AI/ML Security & Trends

CISA added CVE-2025-62593 (CVSS 9.4) in the Ray distributed-compute framework to its Known Exploited Vulnerabilities catalog on Aug 17, giving federal agencies until Aug 20 to patch — one of the tightest windows CISA issues. The flaw allows remote code execution via browser-based DNS rebinding against Ray's /api/jobs endpoints; Ray is widely used to scale ML training/inference workloads. Fix: upgrade to Ray 2.52.0+.

NSA, CISA, FBI, DOE and EPA issued a joint advisory (AA26-231A) on an active threat to Siemens S7 Series PLCs across critical manufacturing, energy, water/wastewater and defense-industrial-base sectors. Attackers used AI to develop Python scripts (via snap7.dll/python-snap7) disguised as legitimate OT monitoring tools to read/write PLC memory and ladder logic; confirmed disruptions forced water utilities in at least 12 states to abandon automated operations. This is a concrete, documented case of AI-assisted attack tooling causing physical-infrastructure impact.

watchTowr Intel observed attackers targeting cloud-hosted MLflow instances almost immediately after CVE-2026-64849 was assigned — an unauthenticated SSRF in webhook delivery validation (bypassed via HTTP redirects and DNS rebinding) affecting versions before 3.15.0. Successful exploitation lets attackers reach internal cloud metadata services to extract credentials and secrets, directly threatening ML pipeline infrastructure.

Varonis Threat Labs disclosed CoSnitch (CVE-2026-24301), a chain of three flaws in Microsoft Copilot Personal where a crafted URL's `?q=` parameter plus an undocumented parameter executed attacker-supplied prompts instantly on page load, exfiltrating data from linked accounts. Worse, attackers could poison Copilot's persistent memory with hidden instructions that survived password changes and session revocation. Reported to Microsoft in December 2025; patched Aug 18, 2026. No evidence of in-the-wild exploitation.

A preprint from Anthropic and EPFL researchers, "Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systems," demonstrates payloads that persuade an agent to adopt a goal, persist it into its own memory/config files, and pass it to the next agent it interacts with — tested in a six-agent coding collaboration and chains modeled on the open-source OpenClaw agent harness. No evidence of successful spread in the wild (a review of the Moltbook agent social network found none), and a one-paragraph system-prompt warning reduced spread to near zero. Directly relevant to multi-agent security and fuzzing-style adversarial testing.

Alibaba released Qwen3.8-27B on Aug 18, a laptop-targeted model aimed at the same on-device niche Meta entered days earlier with Muse Glimmer (30B, Apache 2.0). Alongside it, Alibaba open-sourced the weights of Qwen3.8-Max — its most capable model, scaling to 2.4T total / 95B active parameters — the first time the company has released weights at that scale. Qwen-derived projects on Hugging Face now exceed 151,000, putting Alibaba ahead of Meta and Google in open-weight developer adoption.

Anthropic told investors its annualized revenue run rate surpassed $65 billion as of late July, up more than 7x since the close of 2025, with preliminary Q2 revenue exceeding $11.5 billion (vs. $787M a year earlier) and positive adjusted operating income. The company has confidentially filed for an IPO that could price as early as this fall, potentially putting it on public markets ahead of OpenAI.