AI/ML Security & Trends

Varonis Threat Labs' CoSnitch vulnerability (CVE-2026-24301) in Microsoft Copilot Personal allowed attackers to exfiltrate email content, connected-app data (Gmail, Google Drive, Calendar), file metadata, and Copilot chat history with a single click, via an undocumented '?autorun=1' parameter that auto-executed embedded prompts. Researchers found the exploitable parameter by iteratively questioning Copilot about why autorun 'wasn't possible,' with its own refusals leaking the architecture. Microsoft shipped a patch on August 18, 2026, roughly eight months after Varonis's December 2025 disclosure; no in-the-wild exploitation confirmed. Classic indirect-prompt-injection-to-data-exfiltration chain in a mainstream AI assistant.

CISA added CVE-2025-62593, a code injection vulnerability in the open-source Ray Project (heavily used for ML training/inference and scalable Python workloads), to its Known Exploited Vulnerabilities catalog on August 17, 2026, with a remediation deadline of August 20. Exploitation can grant remote code execution with the privileges of the Ray process; a documented attack pattern has a developer's browser send requests to a locally-running Ray service to trigger code execution. Unpatched Ray clusters with NVIDIA GPUs have already been hijacked for the "ShadowRay 2.0" crypto-mining botnet campaign and the RondoDox DDoS botnet. Fixed in Ray 2.52.0.

Anthropic's August 2026 company-wide Risk Report (published Aug 14) raised its rating of catastrophic-harm-from-misalignment risk in high-stakes settings from 'very low' to 'low,' up from its first report in February. Anthropic says the change reflects increased uncertainty — driven partly by the recent wave of cybersecurity-evaluation incident disclosures across labs (OpenAI/Hugging Face, Meta, and Anthropic's own Irregular-linked incidents) — rather than a specific new safety-test failure. Notably, the internal benchmark built to detect dangerous-capability thresholds has saturated and can no longer register incremental gains, just as the company reports early signs of the capability acceleration that benchmark was meant to catch. Anthropic also disclosed an unreleased internal model, 'Model 2,' somewhat more capable than frontier Mythos 5, with no plans to release it externally.

OpenAI signed a 20-year lease for an 8 IT-gigawatt data center campus in Pike County, Ohio, built and operated by SB Energy on land including the former Portsmouth Gaseous Diffusion Plant. Nvidia — the exclusive chip supplier for the site — is guaranteeing up to $105 billion in conditional lease and power obligations to SB Energy. First 800MW comes online in 2028, with the full 8GW (backed by 10GW of new power generation) delivered in phases through 2032. Underscores the scale of compute buildout underpinning frontier-model development.

Stripe finalized a deal to acquire OpenRouter, the startup whose gateway lets developers route calls across 400+ models from OpenAI, Anthropic, Google, Meta and DeepSeek, for more than $7 billion — a steep premium over the $1.3B valuation OpenRouter reached in its Series B just three months earlier. The deal signals payments infrastructure and AI model-routing infrastructure converging, and highlights how central inference-gateway/proxy layers (the same category as LiteLLM, subject of a major supply-chain breach earlier this year) have become to enterprise AI spend.