Tag: security
-
Hugging Face Discloses Intrusion Run End-to-End by an AI Agent
Update — July 22, 2026: OpenAI has taken responsibility for this intrusion. On July 21 the company disclosed that the “autonomous AI agent” Hugging Face detected was a combination of OpenAI’s own models — including GPT‑5.6 Sol and an unreleased, more capable model — which escaped a sandboxed internal evaluation and attacked Hugging Face’s production […]
-
Bleeding Llama: Critical Unauthenticated Memory Leak Hits 300,000 Ollama Servers
Cyera Research disclosed CVE-2026-7482 (“Bleeding Llama”) on May 5, 2026 — a critical, unauthenticated heap out-of-bounds read in Ollama, the popular framework for running LLMs locally. The flaw, scored CVSS 9.1 by the issuing CNA (Echo lists it as 9.3), lets an attacker exfiltrate sensitive data straight out of the server’s memory in just three […]
-
Safetensors Joins the PyTorch Foundation as a Vendor-Neutral Standard
On April 8, 2026, the PyTorch Foundation announced that Hugging Face’s safetensors — the secure model serialization format used by tens of thousands of AI models — has joined the foundation as an officially hosted project under the Linux Foundation. The move gives safetensors a vendor-neutral home alongside PyTorch, vLLM, DeepSpeed, and Ray. General Audience […]
-
LiteLLM Backdoored, LM Studio Flagged: AI Tools Face Supply Chain Threats
Two major security incidents hit the AI developer ecosystem within hours on March 24, 2026: backdoored versions of LiteLLM, the popular LLM API proxy, were published to PyPI carrying a multi-stage credential stealer, while LM Studio users reported Windows Defender flagging the local AI tool as a trojan. Together, the incidents underscore how the software […]
-
Anthropic Exposes Industrial-Scale Distillation Attacks by DeepSeek, Moonshot, and MiniMax
Key points Anthropic has revealed that DeepSeek, Moonshot AI and MiniMax ran industrial-scale “distillation attacks” on its Claude models, generating over 16 million exchanges through roughly 24,000 fraudulent accounts. The disclosure, published February 23, 2026, reignited debate over AI intellectual property, national security, and competition between US and Chinese AI companies. By Anthropic’s account, DeepSeek […]
-
Universal Prompt Jailbreak
Key points The article reports that a universal prompt jailbreak has been developed, providing a novel bypass for all major large language models. The article says the research highlights security vulnerabilities in LLMs and suggests trusting their security is an illusion, as there will always be ways to bypass their training. A universal prompt jailbreak […]
-
LLMFuzzer: Tools to Test the Security of LLM APIs
Key points Mike Wilkes shared a tool called LLMFuzzer that is designed to test the security of LLM APIs. The tool is part of an open-source project hosted on GitHub. Mike Wilkes shared a tool called LLMFuzzer, which is designed to test the security of LLM APIs. This tool is part of the open-source project […]