When your AI Assistant Becomes the Attacker’s Command-and-Control

Earlier this month, Microsoft uncovered SesameOp, a new backdoor malware that abuses the OpenAI Assistants API as a covert command-and-control C2 channel. The discovery has drawn significant attention within the cybersecurity community. Security teams can no longer focus solely on endpoint malwar...

MAL-2025-191363 Malicious code in @voiceflow/openai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a608e865dea4b33cde3e1730149f8122e44d2e8caf9147cefe48b581cce6fc53 The package @voiceflow/openai was found to contain malicious code. Source: google-open-source-security...

Malicious code in @voiceflow/openai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a608e865dea4b33cde3e1730149f8122e44d2e8caf9147cefe48b581cce6fc53 The package @voiceflow/openai was found to contain malicious code. Source: google-open-source-security...

EUVD-2025-199399

Malicious code in @voiceflow/openai npm...

AI Pulse: How OpenAI Became the Majority Player

...

WordPress S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator plugin <= 1.7.8 - Authenticated (Editor+) Arbitrary File Upload vulnerability

Authenticated Editor+ Arbitrary File Upload vulnerability discovered by Ryan Kozak in WordPress Plugin S2B AI Assistant versions = 1.7.8...

TASO: Jailbreak LLMs Via Alternative Template and Suffix Optimization

Many recent studies showed that LLMs are vulnerable to jailbreak attacks, where an attacker can perturb the input of an LLM to induce it to generate an output for a harmful question. In general, existing jailbreak techniques either optimize a semantic template intended to induce the LLM to produc...

AI teddy bear for kids responds with sexual content and advice about weapons

In testing, FoloToy’s AI teddy bear jumped from friendly chat to sexual topics and unsafe household advice. It shows how easily artificial intelligence can cross serious boundaries. It’s a fair moment to ask whether AI-powered stuffed animals are appropriate for children. It’s easy to get swept u...

aggressor (=0.0.1a0), cartesia-mlx (=0.0.2) +13 more potentially affected by CVE-2025-62609 via mlx (>=0.0.4 <=0.29.2)

mlx PYPI version =0.0.4, =0.0.1, =0.6.0, =0.1.9, =0.4.2, =1.2.0, =0.0.0, =0.0.27, =0.0.1, =0.0.3a0 Source cves: CVE-2025-62609 Source advisory: OSV:GHSA-J842-XGM4-WF88...

CVE-2025-12732

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information due to a missing authorization check on the showsetting function in all versions up to, and including, 7.33. This makes it possible for authenticated attacker...

CVE-2025-12732

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information due to a missing authorization check on the showsetting function in all versions up to, and including, 7.33. This makes it possible for authenticated attacker...

CVE-2025-12732 WP Import – Ultimate CSV XML Importer for WordPress <= 7.33 - Missing Authorization to Authenticated (Author+) Sensitive Information Exposure

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information due to a missing authorization check on the showsetting function in all versions up to, and including, 7.33. This makes it possible for authenticated attacker...

CVE-2025-12732 WP Import – Ultimate CSV XML Importer for WordPress <= 7.33 - Missing Authorization to Authenticated (Author+) Sensitive Information Exposure

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information due to a missing authorization check on the showsetting function in all versions up to, and including, 7.33. This makes it possible for authenticated attacker...

EUVD-2025-119985

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information due to a missing authorization check on the showsetting function in all versions up to, and including, 7.33. This makes it possible for authenticated attacker...

PT-2025-46579

Name of the Vulnerable Software and Affected Versions WP Import – Ultimate CSV XML Importer for WordPress plugin versions prior to 7.34 Description The WP Import – Ultimate CSV XML Importer for WordPress plugin contains a flaw that allows unauthorized access to sensitive information. This is due ...

EUVD-2025-38356

The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to SQL Injection via the 'posttypes' parameter in all versions up to, and including, 3.40.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2025-11972 Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.0 - Authenticated (Editor+) SQL Injection

The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to SQL Injection via the 'posttypes' parameter in all versions up to, and including, 3.40.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2025-11972 Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.0 - Authenticated (Editor+) SQL Injection

The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to SQL Injection via the 'posttypes' parameter in all versions up to, and including, 3.40.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

PT-2025-45543

Name of the Vulnerable Software and Affected Versions The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress versions through 3.40.0 Description The software is susceptible to SQL Injection due to inadequate input validation and query preparation. Specifically, t...

WordPress plugin Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin ... WordPress...