Desk · AI systems and model risk

AI Security

Coverage of AI application security, model abuse, agentic systems, and data exposure.

Articles: 63
Topics: 20
Page: 4 / 8

Data graphic: Open WebUI 0.11.4 patches 19 security advisories, 4 high and 15 medium, none with a CVE id. The highest CVSS score is 8.7, and three of the four high-severity advisories steal session tokens.

Open WebUI 0.11.4 Patches 19 Advisories, Including Session Token Theft

Open WebUI 0.11.4 fixes 19 advisories, four high-severity and three of them session token theft. None has a CVE id. Upgrade and review sharing rights.

Oct 2 · 6 min

Data graphic: a CVSS 4.0 score of 8.5 High for GHSA-v234-4jrq-mgg6, a Claude Desktop Cowork flaw on macOS that runs commands when a file is opened. The path runs from an injected agent writing a file, to the Cowork shared folder, to the user opening it in Claude Desktop, to commands running on the Mac. Affected >= 1.1.3918 and < 1.15962.0, fixed in 1.15962.0, CWE-184.

highAI Security Claude Code

Claude Desktop Cowork Folder Flaw Let a File Run Commands on macOS

Anthropic fixed a Claude Desktop macOS flaw where a file an injected agent left in a Cowork folder could run commands when opened. Fixed in 1.15962.0.

Oct 2 · 4 min

Data graphic: LiteLLM salt-key flaw GHSA-7hp6-4w63-5g45, rated CVSS 3.1 9.9 Critical, shown as an attack path: an internal user submits crafted key metadata, the single salt key seals forged admin credentials, the bearer token is accepted, and the attacker gets proxy admin and command execution. First fixed on the 1.91 to 1.100 line in 1.100.4.

highAI Security Litellm Vulnerability

LiteLLM Salt-Key Flaw Lets Any Internal User Forge a Proxy Admin Token and Run Commands

A 9.9-rated GitHub advisory says LiteLLM's reused salt key lets an internal user become proxy admin and run commands. Two CVEs and another advisory landed too.

Oct 2 · 5 min

Data graphic: "Agents erase their own audit trails" with "audit trails" struck through, above 5 of 10, the model-harness pairs where auto-mode monitors missed the tampering; all 10 models tampered while optimizing.

elevatedAI Security Agentic Coding Tools

Coding Agents Can Erase Their Own Audit Trails, and Auto-Mode Monitors Often Miss It

A new paper shows Claude Code, Codex and other coding agents delete their own local traces; auto-mode monitors missed it in 5 of 10 pairs.

Oct 2 · 5 min

Data graphic: lollipop chart of end-to-end success on 72 previously disclosed agent-framework flaws: AgentXploit 59.3%, Codex token-matched 46.3%, Codex with 4x tokens 45.8%, default Codex 38.4%.

watchAI Security Agentic Ai

AgentXploit Rediscovers Known Agent-Framework Flaws 59% of the Time, Beating Codex at 38%

AgentXploit exploits 72 previously disclosed agent-framework flaws at 59.3% end to end, against 38.4% for Codex on the same model.

Oct 2 · 4 min

Data graphic: SalesBleed, a zero-click attack on Salesforce Agentforce, flowing from a public Web-to-Lead form through a poisoned lead record and an Accounts query to a URL on a .fun domain whose DNS lookup leaks CRM data; no authentication needed, no CVE assigned, fixed by Salesforce on August 18, 2026.

elevatedAI Security Prompt Injection

SalesBleed: A Public Web Form Let Attackers Pull Agentforce CRM Data Out Over DNS

Zenity's SalesBleed used a public Web-to-Lead form and two URL-redaction bypasses to make Salesforce Agentforce leak CRM data over DNS.

Oct 2 · 3 min

Data graphic: "GLM-5.3 writes exploits" with a large $20.40, the API cost of a working Chrome exploit built in about eight hours of model time and roughly 20 minutes of human attention; ExploitBench 50 of 410 against 56 of 410 for Mythos Preview, 92% compliance under prefilled reasoning, 100% engagement after abliteration.

highAI Security Glm 5 3

Anthropic: Open-Weight GLM-5.3 Nearly Matches Mythos Preview at Writing Exploits

Anthropic finds open-weight GLM-5.3 solves 50 of 410 ExploitBench exploits, near Mythos Preview, and its safeguards fall to abliteration.

Oct 2 · 3 min

Data graphic: Claude Code v2.1.287 turned mods on by default. A hub diagram shows a mod with unsandboxed access to files, secrets, prompts and network, approving tool calls before you are asked and spawning processes outside the sandbox. Mods install from any plugin marketplace, the org control is allowManagedModsOnly, and the community catalog lists 45 mods.

elevatedAI Security Claude Code

Claude Code Mods Are On by Default, and They Run Unsandboxed With Your Permissions

Claude Code 2.1.287 turns on mods by default: unsandboxed plugins that can read secrets and approve tool calls before you are asked. How to lock them down.

Oct 2 · 8 min