#airisk — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #airisk, aggregated by home.social.
-
"In a recent essay, Derek Thompson engages with AI as Normal Technology (AINT). He agrees with our thesis about AI’s slow labor market impacts, relying on the fact that GDP growth has so far been average, unemployment is below five percent, and even jobs that seemed vulnerable to automation show rising employment and wages. He concludes that so far, the macroeconomic picture is consistent with what we would expect from a “normal” general-purpose technology.
But when it comes to AI risks, he is far more bearish. He points to examples of cyber- and bio-risks and expresses pessimism about AI quickly becoming dangerous across many new domains. (...) Thompson writes: "I can understand a plan to treat AI as a ‘normal’ technology and let Nvidia export powerful chips to China. And I can understand a plan to treat AI as an ‘abnormal’ technology that compels the government to create extraordinary regulations that prevent private companies from selling their products and services on the grounds that they’re too dangerous" [emphasis ours]. He goes on to conclude that AI is, in fact, abnormal, implying support for extraordinary government intervention. Our essay is a response to that conclusion.
In this essay, we lay out the downsides of extraordinary government intervention in response to new technology. We discuss proposals for improving resilience that do not require such intervention. We also discuss why governments have so far been reluctant to invest in resilience. In short, resilience requires us to get better at the *normal* process of policymaking. But sclerosis in the federal government and the ease of justifying interventions on AI companies rather than society at large make extraordinary intervention seem appealing, despite its limitations."
https://knightcolumbia.org/blog/do-ai-risks-require-extraordinary-government-intervention
-
"In a recent essay, Derek Thompson engages with AI as Normal Technology (AINT). He agrees with our thesis about AI’s slow labor market impacts, relying on the fact that GDP growth has so far been average, unemployment is below five percent, and even jobs that seemed vulnerable to automation show rising employment and wages. He concludes that so far, the macroeconomic picture is consistent with what we would expect from a “normal” general-purpose technology.
But when it comes to AI risks, he is far more bearish. He points to examples of cyber- and bio-risks and expresses pessimism about AI quickly becoming dangerous across many new domains. (...) Thompson writes: "I can understand a plan to treat AI as a ‘normal’ technology and let Nvidia export powerful chips to China. And I can understand a plan to treat AI as an ‘abnormal’ technology that compels the government to create extraordinary regulations that prevent private companies from selling their products and services on the grounds that they’re too dangerous" [emphasis ours]. He goes on to conclude that AI is, in fact, abnormal, implying support for extraordinary government intervention. Our essay is a response to that conclusion.
In this essay, we lay out the downsides of extraordinary government intervention in response to new technology. We discuss proposals for improving resilience that do not require such intervention. We also discuss why governments have so far been reluctant to invest in resilience. In short, resilience requires us to get better at the *normal* process of policymaking. But sclerosis in the federal government and the ease of justifying interventions on AI companies rather than society at large make extraordinary intervention seem appealing, despite its limitations."
https://knightcolumbia.org/blog/do-ai-risks-require-extraordinary-government-intervention
-
"In a recent essay, Derek Thompson engages with AI as Normal Technology (AINT). He agrees with our thesis about AI’s slow labor market impacts, relying on the fact that GDP growth has so far been average, unemployment is below five percent, and even jobs that seemed vulnerable to automation show rising employment and wages. He concludes that so far, the macroeconomic picture is consistent with what we would expect from a “normal” general-purpose technology.
But when it comes to AI risks, he is far more bearish. He points to examples of cyber- and bio-risks and expresses pessimism about AI quickly becoming dangerous across many new domains. (...) Thompson writes: "I can understand a plan to treat AI as a ‘normal’ technology and let Nvidia export powerful chips to China. And I can understand a plan to treat AI as an ‘abnormal’ technology that compels the government to create extraordinary regulations that prevent private companies from selling their products and services on the grounds that they’re too dangerous" [emphasis ours]. He goes on to conclude that AI is, in fact, abnormal, implying support for extraordinary government intervention. Our essay is a response to that conclusion.
In this essay, we lay out the downsides of extraordinary government intervention in response to new technology. We discuss proposals for improving resilience that do not require such intervention. We also discuss why governments have so far been reluctant to invest in resilience. In short, resilience requires us to get better at the *normal* process of policymaking. But sclerosis in the federal government and the ease of justifying interventions on AI companies rather than society at large make extraordinary intervention seem appealing, despite its limitations."
https://knightcolumbia.org/blog/do-ai-risks-require-extraordinary-government-intervention
-
"In a recent essay, Derek Thompson engages with AI as Normal Technology (AINT). He agrees with our thesis about AI’s slow labor market impacts, relying on the fact that GDP growth has so far been average, unemployment is below five percent, and even jobs that seemed vulnerable to automation show rising employment and wages. He concludes that so far, the macroeconomic picture is consistent with what we would expect from a “normal” general-purpose technology.
But when it comes to AI risks, he is far more bearish. He points to examples of cyber- and bio-risks and expresses pessimism about AI quickly becoming dangerous across many new domains. (...) Thompson writes: "I can understand a plan to treat AI as a ‘normal’ technology and let Nvidia export powerful chips to China. And I can understand a plan to treat AI as an ‘abnormal’ technology that compels the government to create extraordinary regulations that prevent private companies from selling their products and services on the grounds that they’re too dangerous" [emphasis ours]. He goes on to conclude that AI is, in fact, abnormal, implying support for extraordinary government intervention. Our essay is a response to that conclusion.
In this essay, we lay out the downsides of extraordinary government intervention in response to new technology. We discuss proposals for improving resilience that do not require such intervention. We also discuss why governments have so far been reluctant to invest in resilience. In short, resilience requires us to get better at the *normal* process of policymaking. But sclerosis in the federal government and the ease of justifying interventions on AI companies rather than society at large make extraordinary intervention seem appealing, despite its limitations."
https://knightcolumbia.org/blog/do-ai-risks-require-extraordinary-government-intervention
-
"In a recent essay, Derek Thompson engages with AI as Normal Technology (AINT). He agrees with our thesis about AI’s slow labor market impacts, relying on the fact that GDP growth has so far been average, unemployment is below five percent, and even jobs that seemed vulnerable to automation show rising employment and wages. He concludes that so far, the macroeconomic picture is consistent with what we would expect from a “normal” general-purpose technology.
But when it comes to AI risks, he is far more bearish. He points to examples of cyber- and bio-risks and expresses pessimism about AI quickly becoming dangerous across many new domains. (...) Thompson writes: "I can understand a plan to treat AI as a ‘normal’ technology and let Nvidia export powerful chips to China. And I can understand a plan to treat AI as an ‘abnormal’ technology that compels the government to create extraordinary regulations that prevent private companies from selling their products and services on the grounds that they’re too dangerous" [emphasis ours]. He goes on to conclude that AI is, in fact, abnormal, implying support for extraordinary government intervention. Our essay is a response to that conclusion.
In this essay, we lay out the downsides of extraordinary government intervention in response to new technology. We discuss proposals for improving resilience that do not require such intervention. We also discuss why governments have so far been reluctant to invest in resilience. In short, resilience requires us to get better at the *normal* process of policymaking. But sclerosis in the federal government and the ease of justifying interventions on AI companies rather than society at large make extraordinary intervention seem appealing, despite its limitations."
https://knightcolumbia.org/blog/do-ai-risks-require-extraordinary-government-intervention
-
Uno studio analizza la capacità dei modelli di IA di assistere nella progettazione di armi biologiche. Il punto critico non è tanto "può farlo?" quanto: quali sono i guardrail tecnici reali, e chi li valida? Le dichiarazioni dei vendor non bastano — servono audit indipendenti e metodologie riproducibili. #infosec #AIrisk #biosecurity
https://www.lescienze.it/tecnologia-e-intelligenza-artificiale/2026/05/21/news/ia_progettazione_virus_tossine_armi_biologiche-21965458/?rss -
GCC insurers are betting big on cyber and risk cover amid geopolitical pressures
By Puja Sharma Today AI AI risk Digital Transformation GCC insurance market poised for continued growth amid geopolitical…
#UnitedStates #US #USA #AI #AIrisk #america #digitaltransformation #financialservices #Fintechnews #gccinsurance #geopolitics #Insurance #insurtech #middleeast #Politics #unitedstatesofamerica #UnitedStatesPolitics #USPolitics #usapolitics
https://www.europesays.com/3004765/ -
https://www.europesays.com/ch/67342/ ABB integrates voyage optimization data with Cydome AI platform to improve maritime cyber resilience #ABB #AIRisk #CyberRisk #Cybersecurity #Cydome #ManagementEngine #ManagementPlatform #maritime #OT #RiskManagement #RiskMitigation
-
VectorCertain's SecureAgent stops AI-powered cyberattacks before they execute—100% prevention rate on 810 autonomous exploit chains. First platform to validate pre-execution AI agent governance. #CyberSecurity #AIRisk
-
VectorCertain's SecureAgent stops AI-powered cyberattacks before they execute—100% prevention rate on 810 autonomous exploit chains. First platform to validate pre-execution AI agent governance. #CyberSecurity #AIRisk
-
VectorCertain's SecureAgent stops AI-powered cyberattacks before they execute—100% prevention rate on 810 autonomous exploit chains. First platform to validate pre-execution AI agent governance. #CyberSecurity #AIRisk
-
AI Governance Is Racing Behind AI Adoption
https://youtu.be/v7XcaUeS1xY #AIGovernance #CyberSecurity #ArtificialIntelligence #AIRisk #GenAI #AgenticAI #InfoSec #DataPrivacy #CyberRisk #CISO #TechPolicy #AICompliance #DigitalTransformation #RiskManagement #AIAdoption -
AI Governance Is Racing Behind AI Adoption
https://youtu.be/v7XcaUeS1xY #AIGovernance #CyberSecurity #ArtificialIntelligence #AIRisk #GenAI #AgenticAI #InfoSec #DataPrivacy #CyberRisk #CISO #TechPolicy #AICompliance #DigitalTransformation #RiskManagement #AIAdoption -
AI Governance Is Racing Behind AI Adoption
https://youtu.be/v7XcaUeS1xY #AIGovernance #CyberSecurity #ArtificialIntelligence #AIRisk #GenAI #AgenticAI #InfoSec #DataPrivacy #CyberRisk #CISO #TechPolicy #AICompliance #DigitalTransformation #RiskManagement #AIAdoption -
AI Governance Is Racing Behind AI Adoption
https://youtu.be/v7XcaUeS1xY #AIGovernance #CyberSecurity #ArtificialIntelligence #AIRisk #GenAI #AgenticAI #InfoSec #DataPrivacy #CyberRisk #CISO #TechPolicy #AICompliance #DigitalTransformation #RiskManagement #AIAdoption -
AI Governance Is Racing Behind AI Adoption
https://youtu.be/v7XcaUeS1xY #AIGovernance #CyberSecurity #ArtificialIntelligence #AIRisk #GenAI #AgenticAI #InfoSec #DataPrivacy #CyberRisk #CISO #TechPolicy #AICompliance #DigitalTransformation #RiskManagement #AIAdoption -
Three megatrends are converging into a systemic cybersecurity crisis: AI-integrated OS attack surfaces (Apple Intelligence prompt injection hit 76% bypass), self-propagating software supply chain worms targeting dev tools, and the weaponization of trusted platforms like GitHub for exfiltration. Essential read 👇
-
https://www.europesays.com/news/22131/ Musk Cites Meetings With Obama and Larry Page in OpenAI Trial #AiRisk #CeoAltman #company #control #Google #Headlines #JurySelection #LarryPage #LastYear #Lawsuit #meeting #Musk #News #OpenaiTrial #SamAltman #SpaceX #time #TopStories
-
Musk Cites Meetings With Obama and Larry Page in OpenAI Trial
Elon Musk dropped some big names on Tuesday as he sought to convince an Oakland federal jury that…
#UnitedStates #US #USA #AIrisk #company #control #ElonMusk #google #juryselection #LarryPage #lastyear #lawsuit #meeting #Musk #OpenAItrial #SamAltman #SpaceX #testimony #time
https://www.europesays.com/2952733/ -
Oh lord. Can we get a moment's peace? Anthropic's most powerful — and dangerous — AI tool has been compromised. A group on a private Discord gained unauthorized access to Claude Mythos, a cybersecurity model so capable it can exploit vulnerabilities faster than elite human hackers. They cracked it on launch day by guessing its URL. Access came via a third-party contractor. Anthropic says no core systems were breached, but the irony is hard to ignore: an AI built to defend against cyberattacks... got hacked. The group claims curiosity, not malice — but the risk is real. https://techcrunch.com/2026/04/21/unauthorized-group-has-gained-access-to-anthropics-exclusive-cyber-tool-mythos-report-claims
#Anthropic #ClaudeMythos #CyberSecurity #AIRisk #DataBreach #ProjectGlasswing #ArtificialIntelligence #TechNews #Hacked #AISecuriy -
Oh lord. Can we get a moment's peace? Anthropic's most powerful — and dangerous — AI tool has been compromised. A group on a private Discord gained unauthorized access to Claude Mythos, a cybersecurity model so capable it can exploit vulnerabilities faster than elite human hackers. They cracked it on launch day by guessing its URL. Access came via a third-party contractor. Anthropic says no core systems were breached, but the irony is hard to ignore: an AI built to defend against cyberattacks... got hacked. The group claims curiosity, not malice — but the risk is real. https://techcrunch.com/2026/04/21/unauthorized-group-has-gained-access-to-anthropics-exclusive-cyber-tool-mythos-report-claims
#Anthropic #ClaudeMythos #CyberSecurity #AIRisk #DataBreach #ProjectGlasswing #ArtificialIntelligence #TechNews #Hacked #AISecuriy -
Oh lord. Can we get a moment's peace? Anthropic's most powerful — and dangerous — AI tool has been compromised. A group on a private Discord gained unauthorized access to Claude Mythos, a cybersecurity model so capable it can exploit vulnerabilities faster than elite human hackers. They cracked it on launch day by guessing its URL. Access came via a third-party contractor. Anthropic says no core systems were breached, but the irony is hard to ignore: an AI built to defend against cyberattacks... got hacked. The group claims curiosity, not malice — but the risk is real. https://techcrunch.com/2026/04/21/unauthorized-group-has-gained-access-to-anthropics-exclusive-cyber-tool-mythos-report-claims
#Anthropic #ClaudeMythos #CyberSecurity #AIRisk #DataBreach #ProjectGlasswing #ArtificialIntelligence #TechNews #Hacked #AISecuriy -
Oh lord. Can we get a moment's peace? Anthropic's most powerful — and dangerous — AI tool has been compromised. A group on a private Discord gained unauthorized access to Claude Mythos, a cybersecurity model so capable it can exploit vulnerabilities faster than elite human hackers. They cracked it on launch day by guessing its URL. Access came via a third-party contractor. Anthropic says no core systems were breached, but the irony is hard to ignore: an AI built to defend against cyberattacks... got hacked. The group claims curiosity, not malice — but the risk is real. https://techcrunch.com/2026/04/21/unauthorized-group-has-gained-access-to-anthropics-exclusive-cyber-tool-mythos-report-claims
#Anthropic #ClaudeMythos #CyberSecurity #AIRisk #DataBreach #ProjectGlasswing #ArtificialIntelligence #TechNews #Hacked #AISecuriy -
Oh lord. Can we get a moment's peace? Anthropic's most powerful — and dangerous — AI tool has been compromised. A group on a private Discord gained unauthorized access to Claude Mythos, a cybersecurity model so capable it can exploit vulnerabilities faster than elite human hackers. They cracked it on launch day by guessing its URL. Access came via a third-party contractor. Anthropic says no core systems were breached, but the irony is hard to ignore: an AI built to defend against cyberattacks... got hacked. The group claims curiosity, not malice — but the risk is real. https://techcrunch.com/2026/04/21/unauthorized-group-has-gained-access-to-anthropics-exclusive-cyber-tool-mythos-report-claims
#Anthropic #ClaudeMythos #CyberSecurity #AIRisk #DataBreach #ProjectGlasswing #ArtificialIntelligence #TechNews #Hacked #AISecuriy -
https://www.europesays.com/ie/443608/ Investors demand repayments, private credit tightens and threatens small businesses | Ukraine news #AiRisk #Business #Economy #Éire #IE #InvestorRedemptions #Ireland #News #NonbankLending #PrivateCredit #PrivateCreditInvestorRedemptionsNonbankLendingSmallBusinessFinanceAiRisk #SmallBusinessFinance
-
Bank of England Probes AI Threats to UK Financial Stability
The Bank of England is conducting tests to better understand the risks and opportunities artificial intelligence (AI) pre…
#Economy #AI #AIrisk #BankofEngland #centralbank #CentralBanks #CentralBanksoftheEuropeanSystem #DeutscheBundesbank #ECB #ESCB #Europe #European #EuropeanCentralBank #EuropeanCentralBanks #News #PYMNTSNews #stockmarket #THEBANKOFENGLAND #TheBankofFrance #TheBankofItaly #What'sHot
https://www.europesays.com/2925169/ -
@geoworldpolitical
AI does not obey? That is threatening.
Especially if you know how wrong AI can be.
#ai #aisafety #airisk -
@geoworldpolitical
AI does not obey? That is threatening.
Especially if you know how wrong AI can be.
#ai #aisafety #airisk -
Suspect Arrested For Allegedly Throwing Molotov Cocktail at Sam Altman's Home
-
Suspect Arrested For Allegedly Throwing Molotov Cocktail at Sam Altman's Home
-
Suspect Arrested For Allegedly Throwing Molotov Cocktail at Sam Altman's Home
-
Suspect Arrested For Allegedly Throwing Molotov Cocktail at Sam Altman's Home
-
Suspect Arrested For Allegedly Throwing Molotov Cocktail at Sam Altman's Home
-
Meta paused work with a $10B AI data vendor after hackers poisoned an open-source Python library called LiteLLM and walked out with four terabytes of data. So, that's bad. And the worst part? The stolen data might include the actual training methodologies that Meta, OpenAI, Anthropic, and Google paid billions to develop. Think about what that means. You can't protect your crown jewels if they're sitting inside a vendor who's connected to your three biggest competitors, all sharing the same open-source tools, all exposed by the same 40-minute window on PyPI before anyone noticed.
🎯 The attack chain here is worth understanding: hackers compromised a security scanner called Trivy, used that access to get credentials for a LiteLLM maintainer, then published two malicious package versions that lasted less than an hour before removal. Forty minutes. That's all it took.
💼 Mercor is not some sloppy startup. It's 22-year-old founders, $500M annualized revenue, and clients at the very top of the AI industry. Sophistication doesn't protect you from a poisoned dependency you never thought to audit.
🔍 The question I'd be asking right now if I were a CISO at any of these labs isn't "were we breached." It's "how many vendors in our training pipeline are running LiteLLM, and did we even know?"
Most companies audit their own software. Almost nobody audits the software their vendors use to build the data they're buying.
https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk
#Cybersecurity #AIRisk #SupplyChainSecurity spc #security #privacy #cloud #infosec #ThirdPartyRisk -
Meta paused work with a $10B AI data vendor after hackers poisoned an open-source Python library called LiteLLM and walked out with four terabytes of data. So, that's bad. And the worst part? The stolen data might include the actual training methodologies that Meta, OpenAI, Anthropic, and Google paid billions to develop. Think about what that means. You can't protect your crown jewels if they're sitting inside a vendor who's connected to your three biggest competitors, all sharing the same open-source tools, all exposed by the same 40-minute window on PyPI before anyone noticed.
🎯 The attack chain here is worth understanding: hackers compromised a security scanner called Trivy, used that access to get credentials for a LiteLLM maintainer, then published two malicious package versions that lasted less than an hour before removal. Forty minutes. That's all it took.
💼 Mercor is not some sloppy startup. It's 22-year-old founders, $500M annualized revenue, and clients at the very top of the AI industry. Sophistication doesn't protect you from a poisoned dependency you never thought to audit.
🔍 The question I'd be asking right now if I were a CISO at any of these labs isn't "were we breached." It's "how many vendors in our training pipeline are running LiteLLM, and did we even know?"
Most companies audit their own software. Almost nobody audits the software their vendors use to build the data they're buying.
https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk
#Cybersecurity #AIRisk #SupplyChainSecurity spc #security #privacy #cloud #infosec #ThirdPartyRisk -
Meta paused work with a $10B AI data vendor after hackers poisoned an open-source Python library called LiteLLM and walked out with four terabytes of data. So, that's bad. And the worst part? The stolen data might include the actual training methodologies that Meta, OpenAI, Anthropic, and Google paid billions to develop. Think about what that means. You can't protect your crown jewels if they're sitting inside a vendor who's connected to your three biggest competitors, all sharing the same open-source tools, all exposed by the same 40-minute window on PyPI before anyone noticed.
🎯 The attack chain here is worth understanding: hackers compromised a security scanner called Trivy, used that access to get credentials for a LiteLLM maintainer, then published two malicious package versions that lasted less than an hour before removal. Forty minutes. That's all it took.
💼 Mercor is not some sloppy startup. It's 22-year-old founders, $500M annualized revenue, and clients at the very top of the AI industry. Sophistication doesn't protect you from a poisoned dependency you never thought to audit.
🔍 The question I'd be asking right now if I were a CISO at any of these labs isn't "were we breached." It's "how many vendors in our training pipeline are running LiteLLM, and did we even know?"
Most companies audit their own software. Almost nobody audits the software their vendors use to build the data they're buying.
https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk
#Cybersecurity #AIRisk #SupplyChainSecurity spc #security #privacy #cloud #infosec #ThirdPartyRisk -
Meta paused work with a $10B AI data vendor after hackers poisoned an open-source Python library called LiteLLM and walked out with four terabytes of data. So, that's bad. And the worst part? The stolen data might include the actual training methodologies that Meta, OpenAI, Anthropic, and Google paid billions to develop. Think about what that means. You can't protect your crown jewels if they're sitting inside a vendor who's connected to your three biggest competitors, all sharing the same open-source tools, all exposed by the same 40-minute window on PyPI before anyone noticed.
🎯 The attack chain here is worth understanding: hackers compromised a security scanner called Trivy, used that access to get credentials for a LiteLLM maintainer, then published two malicious package versions that lasted less than an hour before removal. Forty minutes. That's all it took.
💼 Mercor is not some sloppy startup. It's 22-year-old founders, $500M annualized revenue, and clients at the very top of the AI industry. Sophistication doesn't protect you from a poisoned dependency you never thought to audit.
🔍 The question I'd be asking right now if I were a CISO at any of these labs isn't "were we breached." It's "how many vendors in our training pipeline are running LiteLLM, and did we even know?"
Most companies audit their own software. Almost nobody audits the software their vendors use to build the data they're buying.
https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk
#Cybersecurity #AIRisk #SupplyChainSecurity spc #security #privacy #cloud #infosec #ThirdPartyRisk -
Meta paused work with a $10B AI data vendor after hackers poisoned an open-source Python library called LiteLLM and walked out with four terabytes of data. So, that's bad. And the worst part? The stolen data might include the actual training methodologies that Meta, OpenAI, Anthropic, and Google paid billions to develop. Think about what that means. You can't protect your crown jewels if they're sitting inside a vendor who's connected to your three biggest competitors, all sharing the same open-source tools, all exposed by the same 40-minute window on PyPI before anyone noticed.
🎯 The attack chain here is worth understanding: hackers compromised a security scanner called Trivy, used that access to get credentials for a LiteLLM maintainer, then published two malicious package versions that lasted less than an hour before removal. Forty minutes. That's all it took.
💼 Mercor is not some sloppy startup. It's 22-year-old founders, $500M annualized revenue, and clients at the very top of the AI industry. Sophistication doesn't protect you from a poisoned dependency you never thought to audit.
🔍 The question I'd be asking right now if I were a CISO at any of these labs isn't "were we breached." It's "how many vendors in our training pipeline are running LiteLLM, and did we even know?"
Most companies audit their own software. Almost nobody audits the software their vendors use to build the data they're buying.
https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk
#Cybersecurity #AIRisk #SupplyChainSecurity spc #security #privacy #cloud #infosec #ThirdPartyRisk -
We keep worrying about AI doing something evil. Which it might, but right now, there’s a risk in the plumbing supporting it. Three vulnerabilities in LangChain and LangGraph, path traversal, unsafe deserialization, SQL injection. Not AI-specific attacks. They’re not novel nor sophisticated but these are the kinds of bugs we've been patching since the late '90s. One of them scored a severity of 9.3 out of 10. "The biggest threat to your enterprise AI data might not be as complex as you think." Remember that you're building AI on top of frameworks you didn't write, can't fully audit, and update whenever it's convenient. That's the actual problem.
🔐 Path traversal lets attackers read arbitrary files from the host system, including credentials
🔑 Unsafe deserialization exposes API keys and environment variables at runtime
🗄️ SQL injection in the checkpointing layer leaks conversation history from your AI agentsAll three are fixed now. But "fixed" only matters if you've actually applied the patches across every integration. Most organizations haven't.
The lesson isn't about AI security. It's that AI doesn't change what good security engineering looks like. Input validation, parameterized queries, strict path sandboxing. This is stuff your dev team learned before ChatGPT existed.
If you're deploying AI pipelines and you haven't done a security review of the frameworks underneath them, you're not running an AI strategy. You're running a trust exercise.
https://www.csoonline.com/article/4151814/langchain-path-traversal-bug-adds-to-input-validation-woes-in-ai-pipelines.html
#CyberSecurity #AIRisk #AppSec #security #privacy #cloud #infosec -
We keep worrying about AI doing something evil. Which it might, but right now, there’s a risk in the plumbing supporting it. Three vulnerabilities in LangChain and LangGraph, path traversal, unsafe deserialization, SQL injection. Not AI-specific attacks. They’re not novel nor sophisticated but these are the kinds of bugs we've been patching since the late '90s. One of them scored a severity of 9.3 out of 10. "The biggest threat to your enterprise AI data might not be as complex as you think." Remember that you're building AI on top of frameworks you didn't write, can't fully audit, and update whenever it's convenient. That's the actual problem.
🔐 Path traversal lets attackers read arbitrary files from the host system, including credentials
🔑 Unsafe deserialization exposes API keys and environment variables at runtime
🗄️ SQL injection in the checkpointing layer leaks conversation history from your AI agentsAll three are fixed now. But "fixed" only matters if you've actually applied the patches across every integration. Most organizations haven't.
The lesson isn't about AI security. It's that AI doesn't change what good security engineering looks like. Input validation, parameterized queries, strict path sandboxing. This is stuff your dev team learned before ChatGPT existed.
If you're deploying AI pipelines and you haven't done a security review of the frameworks underneath them, you're not running an AI strategy. You're running a trust exercise.
https://www.csoonline.com/article/4151814/langchain-path-traversal-bug-adds-to-input-validation-woes-in-ai-pipelines.html
#CyberSecurity #AIRisk #AppSec #security #privacy #cloud #infosec -
We keep worrying about AI doing something evil. Which it might, but right now, there’s a risk in the plumbing supporting it. Three vulnerabilities in LangChain and LangGraph, path traversal, unsafe deserialization, SQL injection. Not AI-specific attacks. They’re not novel nor sophisticated but these are the kinds of bugs we've been patching since the late '90s. One of them scored a severity of 9.3 out of 10. "The biggest threat to your enterprise AI data might not be as complex as you think." Remember that you're building AI on top of frameworks you didn't write, can't fully audit, and update whenever it's convenient. That's the actual problem.
🔐 Path traversal lets attackers read arbitrary files from the host system, including credentials
🔑 Unsafe deserialization exposes API keys and environment variables at runtime
🗄️ SQL injection in the checkpointing layer leaks conversation history from your AI agentsAll three are fixed now. But "fixed" only matters if you've actually applied the patches across every integration. Most organizations haven't.
The lesson isn't about AI security. It's that AI doesn't change what good security engineering looks like. Input validation, parameterized queries, strict path sandboxing. This is stuff your dev team learned before ChatGPT existed.
If you're deploying AI pipelines and you haven't done a security review of the frameworks underneath them, you're not running an AI strategy. You're running a trust exercise.
https://www.csoonline.com/article/4151814/langchain-path-traversal-bug-adds-to-input-validation-woes-in-ai-pipelines.html
#CyberSecurity #AIRisk #AppSec #security #privacy #cloud #infosec -
We keep worrying about AI doing something evil. Which it might, but right now, there’s a risk in the plumbing supporting it. Three vulnerabilities in LangChain and LangGraph, path traversal, unsafe deserialization, SQL injection. Not AI-specific attacks. They’re not novel nor sophisticated but these are the kinds of bugs we've been patching since the late '90s. One of them scored a severity of 9.3 out of 10. "The biggest threat to your enterprise AI data might not be as complex as you think." Remember that you're building AI on top of frameworks you didn't write, can't fully audit, and update whenever it's convenient. That's the actual problem.
🔐 Path traversal lets attackers read arbitrary files from the host system, including credentials
🔑 Unsafe deserialization exposes API keys and environment variables at runtime
🗄️ SQL injection in the checkpointing layer leaks conversation history from your AI agentsAll three are fixed now. But "fixed" only matters if you've actually applied the patches across every integration. Most organizations haven't.
The lesson isn't about AI security. It's that AI doesn't change what good security engineering looks like. Input validation, parameterized queries, strict path sandboxing. This is stuff your dev team learned before ChatGPT existed.
If you're deploying AI pipelines and you haven't done a security review of the frameworks underneath them, you're not running an AI strategy. You're running a trust exercise.
https://www.csoonline.com/article/4151814/langchain-path-traversal-bug-adds-to-input-validation-woes-in-ai-pipelines.html
#CyberSecurity #AIRisk #AppSec #security #privacy #cloud #infosec -
We keep worrying about AI doing something evil. Which it might, but right now, there’s a risk in the plumbing supporting it. Three vulnerabilities in LangChain and LangGraph, path traversal, unsafe deserialization, SQL injection. Not AI-specific attacks. They’re not novel nor sophisticated but these are the kinds of bugs we've been patching since the late '90s. One of them scored a severity of 9.3 out of 10. "The biggest threat to your enterprise AI data might not be as complex as you think." Remember that you're building AI on top of frameworks you didn't write, can't fully audit, and update whenever it's convenient. That's the actual problem.
🔐 Path traversal lets attackers read arbitrary files from the host system, including credentials
🔑 Unsafe deserialization exposes API keys and environment variables at runtime
🗄️ SQL injection in the checkpointing layer leaks conversation history from your AI agentsAll three are fixed now. But "fixed" only matters if you've actually applied the patches across every integration. Most organizations haven't.
The lesson isn't about AI security. It's that AI doesn't change what good security engineering looks like. Input validation, parameterized queries, strict path sandboxing. This is stuff your dev team learned before ChatGPT existed.
If you're deploying AI pipelines and you haven't done a security review of the frameworks underneath them, you're not running an AI strategy. You're running a trust exercise.
https://www.csoonline.com/article/4151814/langchain-path-traversal-bug-adds-to-input-validation-woes-in-ai-pipelines.html
#CyberSecurity #AIRisk #AppSec #security #privacy #cloud #infosec -
Forget sci-fi, the real AI risks are already here: cyberattacks, misinformation, and systems making life altering decisions with zero human oversight. 😳 Experts like Hinton & Bengio are warning us. Time to pay attention.
🔗 https://techglimmer.io/could-ai-actually-take-over-the-world/
#AI #ArtificialIntelligence #TechNews #AIRisk -
Forget sci-fi, the real AI risks are already here: cyberattacks, misinformation, and systems making life altering decisions with zero human oversight. 😳 Experts like Hinton & Bengio are warning us. Time to pay attention.
🔗 https://techglimmer.io/could-ai-actually-take-over-the-world/
#AI #ArtificialIntelligence #TechNews #AIRisk