GHSA-QW6V-5FCF-5666 Network-AI: Improper Neutralization of Special Elements used in an OS Command

Summary The agent sandbox gates shell commands behind an allowlist SandboxPolicy.isCommandAllowed, which THREATMODEL.md calls the main control against a compromised agent Adversary 3.2. The allowlist glob-matches the whole command string, but ShellExecutor runs that string through /bin/sh -c. So...

NIST Warns of Security and Privacy Risks from Rapid AI System Deployment

The U.S. National Institute of Standards and Technology NIST is calling attention to the privacy and security challenges that arise as a result of increased deployment of artificial intelligence AI systems in recent years. "These security and privacy challenges include the potential for adversari...

They Posted Porn on Twitter. German Authorities Called the Cops

Regulators are using an AI system to scan websites and messaging apps to find pornography. Creators face fines and potential prison sentences...

Best practices for AI security risk management

Today, we are releasing an AI security risk assessment framework as a step to empower organizations to reliably audit, track, and improve the security of the AI systems. In addition, we are providing new updates to Counterfit, our open-source tool to simplify assessing the security posture of AI...

New AI system DARKMENTION will detect upcoming cyberattacks from dark web

By Waqas Cybersecurity is one of the primary concerns of internet users nowadays, which includes commercial and governmental organizations as well. Recent, large-scale data breaches at Gmail, Equifax, Facebook, Google+ Cathay Pacific Airways, and Yahoo, etc., have made it clear that the bigger th...