LIVE FEED
CRITICAL SGLang RCE Exploit Breaches NEAR AI, Hits 18 Agents // FIRST LOOK F-Secure Releases AI Harms Taxonomy Mapping 26 Consumer Risks // CRITICAL Cursor Marketplace Trojanized via Stolen Fireworks AI Key // CRITICAL Cairn AI Framework Hits Semiconductor and Defense Orgs // HIGH TypoPrompting: 186 Fake AI Domains Spread ClickFix Malware // CRITICAL Post-Training Supply Chain Attacks Backdoor AI Coding Agents // HIGH Google Project Zero Cuts Disclosure Window as LLMs Speed Up Exploits // HIGH Unsanctioned AI Agents Expose Five Enterprise Identity Security Gaps // HIGH OpenAI Agents Gain Root Access, Conceal Activity in CI Clusters // FIRST LOOK AWS Launches A2A Protocol for Interoperable Multi-Agent Systems //
API-KEY-LEAKAGE

Api-Key-Leakage

2 reports
All LLM Security Agentic AI Industry News Research First Look: Security Supply Chain Prompt Injection Regulatory Adversarial ML Jailbreaks Model Theft Data Poisoning Deep Signal Intelligence Report Monthly Review AI Governance AI Security AI Security Tools Identity & Access Management Security Operations
LLM Tool Flaw Leaks OpenAI API Keys to Third-Party Endpoints

LLM Tool Flaw Leaks OpenAI API Keys to Third-Party Endpoints

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 7.2 Simon Willison

Simon Willison's LLM CLI tool (version 0.37.2) patches two security vulnerabilities reported by Daniel de Araujo that could inadvertently expose a user's configured OpenAI API key to third-party OpenAI-compatible API providers. The flaws existed in the extra-openai-models.yaml configuration mechanism, triggering key leakage under two specific conditions: an unset api_key_name or use of a responses-mode model with a specific chat completions override flag. Users running LLM with custom third-party endpoints should update immediately and rotate any potentially exposed API keys.

OpenAI, Anthropic, Google APIs Let Weaker Models Steal Reasoning

OpenAI, Anthropic, Google APIs Let Weaker Models Steal Reasoning

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 9.2 The Hacker News

Researchers disclosed a cross-session, cross-user flaw in the reasoning APIs of OpenAI, Anthropic, and Google, where encrypted reasoning blocks could be replayed by weaker models to expose hidden internal reasoning, private credentials, and harmful content. Across nearly 6,700 public agent trajectories, the team recovered 704 privacy artifacts including API keys, passwords, and private keys. All three providers have since deployed mitigations that stopped the demonstrated attacks, but the disclosure highlights systemic risks in how stateless API reasoning state is shared and published.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.