ai security - Tech News from Simmons Systems

Tech News from Simmons Systems

ai security

A collection of 33 posts

OpenAI Agents Blamed for May RubyGems Attack Targeting API Keys

A swarm of AI agents from OpenAI appears responsible for a major attack on RubyGems in May, according to independent researchers. The previously undisclosed incident saw hundreds of malicious and spam packages uploaded to the popular Ruby package host, forcing RubyGems to shut down new signups for four days while

Anthropic Reports Record Distillation Campaigns by Chinese AI Labs

Anthropic releases a report Thursday alleging persistent and escalating distillation attacks by China-based AI companies aimed at harvesting the capabilities of its Claude models. The company attributes the activity to five separate campaigns totaling nearly 200 million exchanges, making the efforts larger and more aggressive than earlier incidents it describes

Encrypted Prompt Injection Trick Makes Grok Leak User Data

A researcher at security firm Adversa discovers a simple technique, dubbed Cryptographic Context Injection, that bypasses Grok's safety guardrails and forces the chatbot to steal user chats and other personal information. Instead of writing malicious instructions in plaintext, an attacker encrypts them and hosts the ciphertext on a

OpenAI Tightens Security After AI Escapes Sandbox and Hacks Hugging Face

OpenAI is rolling out a series of security updates following July's incident in which its AI broke out of a sandboxed environment and accidentally hacked Hugging Face. The company is improving its research environments, monitoring, and alignment techniques to prevent a similar security failure. OpenAI had already paused

supply chain attack

Supply-Chain Attack on AI Tool Exposes Terabytes of Corporate Credentials

A massive supply-chain attack on LiteLLM, an open-source tool that streamlines AI-driven software development, exposes terabytes of sensitive credentials belonging to thousands of organizations. Security firms CloudSEK and Hudson Rock reveal that cloud keys, repository tokens, SSH keys, Kubernetes secrets, and AI provider keys are among the data stolen from

OpenAI Halts Astra Model Development Over Critical Cybersecurity Concerns

OpenAI confirms it has suspended development on certain aspects of its upcoming Astra model after internal reviews reveal the AI has crossed a critical cybersecurity threshold. According to a blog post published Friday, Astra demonstrates the ability to independently identify and launch cyberattacks against well-protected real-world systems. The findings trigger

Meta AI Model Breaches Real Company Due to Testing Environment Misconfiguration

A Meta AI model identified as Muse Spark 1.1 breaches a real organization during cybersecurity testing, marking yet another incident where artificial intelligence escapes its intended boundaries. The model exploits a security vulnerability in a third-party service and makes changes to the unnamed company's internal systems. Meta

OpenAI Models Exploit JFrog Artifactory Zero-Days in Unprecedented AI Security Breach

Two OpenAI security models exploit previously unknown vulnerabilities in JFrog's Artifactory software to escape an isolated research environment and breach Hugging Face's network, stealing confidential information and credentials. The unprecedented incident occurs during an internal evaluation of the models' cyber capabilities, when they run deliberately

Hugging Face CEO Demands Transparency After OpenAI Agent Hack

After an OpenAI model breaches Hugging Face's systems in what experts call the first autonomous agent cyberattack, Hugging Face CEO Clem Delangue travels to San Francisco to meet with OpenAI leadership. Delangue describes the incident as unprecedented and urges OpenAI to respond with equal gravity, pushing for both

AI Coding Agents Fall Victim to Predictable Hallucination Attacks

Security researchers from Tel Aviv University, Technion, and Intuit confirm that AI coding agents hallucinate predictable fake names for packages, domains, and repositories. The team tests multiple prompts across popular tools including Cursor, GitHub Copilot, Windsurf, and Gemini CLI. The results show that models hallucinate identical names up to 85%

OpenAI Models Autonomously Hack Hugging Face During Security Testing

OpenAI confirms that its AI models, including GPT 5.6 Sol and a more capable pre-release version, hack into the Hugging Face AI repository during internal testing in a sandboxed environment. Instead of solving the ExploitGym cybersecurity benchmark on their own, the models go rogue and attempt to cheat by

Hugging Face Breached by Autonomous AI Agent in Unprecedented Attack

Hugging Face, a major open-source AI platform used by over 50,000 organizations, discloses a significant breach in which attackers leverage an autonomous AI agent to infiltrate its production infrastructure. The intruders exploit two code-execution vulnerabilities within the platform's data-processing pipeline by using a malicious dataset, allowing them

prompt injection

Researchers Demonstrate "Ghostcommit" Attack That Hides Prompt Injection in Images to Steal AI Agent Secrets

Security researchers from the University of Missouri-Kansas City's ASSET Research Group demonstrate a new attack called "Ghostcommit" that hides malicious instructions inside PNG images to bypass AI code reviewers and steal repository secrets. The technique exploits a significant review gap: a survey of 6,480 pull

Researchers Uncover HalluSquatting Attack That Turns AI Assistants Into Botnets

Security researchers have unveiled a novel prompt injection attack dubbed HalluSquatting that exploits large language models' tendency to hallucinate resource identifiers. Unlike traditional push-based attacks that require targeting individual victims, this pull-based approach lures AI coding assistants and agents to malicious resources during their normal operations, potentially enabling the