Securing AI Agents with Information-Flow Control

As AI agents become increasingly autonomous and capable, ensuring their security against vulnerabilities such as prompt injection becomes critical. This paper explores the use of information-flow control IFC to provide security guarantees for AI agents. We present a formal model to reason about t...

Fake AI video generator tools lure in Facebook and LinkedIn users to deliver malware

Cybercriminals are taking advantage of the public’s interest in Artificial Intelligence AI and delivering malware via text-to-video tools. According to researchers at Mandiant, the criminals are setting up websites claiming to offer “AI video generator” services, and then using those fake tools t...

Malware Hidden in AI Models on PyPI Targets Alibaba AI Labs Users

ReversingLabs discovers new malware hidden inside AI/ML models on PyPI, targeting Alibaba AI Labs users. Learn how attackers…...

ChatGPT o3 Resists Shutdown Despite Instructions, Study Claims

ChatGPT o3 resists shutdown despite explicit instructions, raising fresh concerns over AI safety, alignment, and reinforcement learning behaviors...

CVE-2025-5151

A vulnerability classified as critical has been found in defog-ai introspect up to 0.1.4. This affects the function executeanalysiscodesafely of the file introspect/backend/tools/analysistools.py. The manipulation of the argument code leads to code injection. It is possible to launch the attack o...

The future of AI agents—and why OAuth must evolve

I believe we're at the beginning of something extraordinary. Today's AI agents are already impressive—they're helping software engineers write code, assisting site reliability teams in troubleshooting systems, and handling a variety of analytical tasks. Yet, as capable as these specialized agents...

AI Agents and the Non‑Human Identity Crisis: How to Deploy AI More Securely at Scale

Artificial intelligence is driving a massive shift in enterprise productivity, from GitHub Copilot's code completions to chatbots that mine internal knowledge bases for instant answers. Each new agent must authenticate to other services, quietly swelling the population of non‑human identities NHI...

Trend Micro Leading the Fight to Secure AI

New MITRE ATLAS submission helps strengthen organizations’ cyber resilience...

This Week in Spring (AI) - May 27th, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! This time, I'm talking to you after an insane week behind me. Last week I flew from San Francisco to Stockholm, Sweden where I was the speaker for the JForum event, a monthly meetup. Spring drew the largest audience to JForum...

A week in security (May 19 – May 25)

Last week on Malwarebytes Labs: Lumma information stealer infrastructure disrupted Stalkerware apps go dark after data breach Scammers are using AI to impersonate senior officials, warns FBI 23andMe and its customers’ genetic data bought by a pharmaceutical org Malware-infected printer delivered...

ADA: Automated Moving Target Defense for AI Workloads Via Ephemeral Infrastructure-Native Rotation in Kubernetes

This paper introduces the Adaptive Defense Agent ADA, an innovative Automated Moving Target Defense AMTD system designed to fundamentally enhance the security posture of AI workloads. ADA operates by continuously and automatically rotating these workloads at the infrastructure level, leveraging t...

Engineering Trustworthy Machine-Learning Operations with Zero-Knowledge Proofs

As Artificial Intelligence AI systems, particularly those based on machine learning ML, become integral to high-stakes applications, their probabilistic and opaque nature poses significant challenges to traditional verification and validation methods. These challenges are exacerbated in regulated...

CVE-2025-5151

A vulnerability classified as critical has been found in defog-ai introspect up to 0.1.4. This affects the function executeanalysiscodesafely of the file introspect/backend/tools/analysistools.py. The manipulation of the argument code leads to code injection. It is possible to launch the attack o...

CVE-2025-5151 defog-ai introspect analysis_tools.py execute_analysis_code_safely code injection

A vulnerability classified as critical has been found in defog-ai introspect up to 0.1.4. This affects the function executeanalysiscodesafely of the file introspect/backend/tools/analysistools.py. The manipulation of the argument code leads to code injection. It is possible to launch the attack o...

CVE-2025-5151 defog-ai introspect analysis_tools.py execute_analysis_code_safely code injection

A vulnerability classified as critical has been found in defog-ai introspect up to 0.1.4. This affects the function executeanalysiscodesafely of the file introspect/backend/tools/analysistools.py. The manipulation of the argument code leads to code injection. It is possible to launch the attack o...

CVE-2025-5151 defog-ai introspect analysis_tools.py execute_analysis_code_safely code injection

A vulnerability classified as critical has been found in defog-ai introspect up to 0.1.4. This affects the function executeanalysiscodesafely of the file introspect/backend/tools/analysistools.py. The manipulation of the argument code leads to code injection. It is possible to launch the attack o...

A Systematic Classification of Vulnerabilities in MoveEVM Smart Contracts (MWC)

We introduce the MoveEVM Weakness Classification MWC system -- a dedicated vulnerability taxonomy for smart contracts built with Move and executed in EVM-compatible environments. While Move was originally designed to prevent common security flaws via linear resource types and strict ownership, it...

PT-2025-22863 · Unknown · Defog-Ai Introspect

Name of the Vulnerable Software and Affected Versions: defog-ai introspect versions up to 0.1.4 Description: A critical vulnerability has been found in defog-ai introspect. This issue affects the execute analysis code safely function of the file introspect/backend/tools/analysis tools.py. The...

Exploit for CVE-2025-2294

CVE-2025-2294 🚨 CVE-2025-2294 - Local File Inclusion LFI...

CVE-2025-24369

Anubis is a tool that allows administrators to protect bots against AI scrapers through bot-checking heuristics and a proof-of-work challenge to discourage scraping from multiple IP addresses. Anubis allows attackers to bypass the bot protection by requesting a challenge, formulates any nonce suc...