Tag: ml
-
Attackers hide malicious code in Hugging Face AI model Pickle files
Tags: ai, data, github, malicious, ml, open-source, programming, remote-code-execution, risk, service, software, threat, tool, vulnerabilityLike all repositories of open-source software in recent years, AI model hosting platform Hugging Face has been abused by attackers to upload trojanized projects and assets with the goal of infecting unsuspecting users. The latest technique observed by researchers involves intentionally broken but poisoned Python object serialization files called Pickle files.Often described as the GitHub…
-
Developers Beware! Malicious ML Models Found on Hugging Face Platform
In a concerning development for the machine learning (ML) community, researchers from ReversingLabs have uncovered malicious ML models on the Hugging Face platform, a popular hub for AI collaboration. Dubbed “nullifAI,” this novel attack method leverages vulnerabilities in the widely used Python Pickle serialization format to execute malicious code on unsuspecting systems. The discovery highlights…
-
Anomalies are not Enough
Tags: ai, attack, ciso, communications, country, cybersecurity, data, data-breach, defense, email, government, LLM, mail, marketplace, mitre, ml, network, resilience, risk, service, siem, threat, toolMitre Att&ck as Context Introduction: A common theme of science fiction authors, and these days policymakers and think tanks, is how will the humans work with the machines, as the machines begin to surpass us across many dimensions. In cybersecurity humans and their systems are at a crossroads, their limitations daily exposed by ever more innovative,…
-
Hackers impersonate DeepSeek to distribute malware
Tags: access, ai, api, attack, automation, breach, china, cloud, computer, credentials, cyberattack, data, hacker, infrastructure, leak, LLM, malicious, malware, ml, pypi, threat, tool, vulnerabilityTo make things worse than they already are for DeepSeek, hackers are found flooding the Python Package Index (PyPI) repository with fake DeepSeek packages carrying malicious payloads.According to a discovery made by Positive Expert Security Center (PT ESC), a campaign was seen using this trick to dupe unsuspecting developers, ML engineers, and AI enthusiasts looking…
-
A pickle in Meta’s LLM code could allow RCE attacks
Tags: ai, attack, breach, cve, cvss, data, data-breach, exploit, flaw, framework, github, LLM, malicious, ml, network, open-source, rce, remote-code-execution, software, supply-chain, technology, theft, vulnerabilityMeta’s large language model (LLM) framework, Llama, suffers a typical open-source coding oversight, potentially allowing arbitrary code execution on servers leading to resource theft, data breaches, and AI model takeover.The flaw, tracked as CVE-2024-50050, is a critical deserialization bug belonging to a class of vulnerabilities arising from the improper use of the open-source library (pyzmq)…
-
Automating endpoint management doesn’t mean ceding control
Tags: ai, automation, business, compliance, control, cybersecurity, data, endpoint, governance, intelligence, ml, risk, security-incident, skills, threat, tool, vulnerabilityBeset with cybersecurity risks, compliance regimes, and digital experience challenges, enterprises need to move toward autonomous endpoint management (AEM), the next evolution in endpoint management and security solutions. CSO’s Security Priorities Study 2024 reveals that 75% of security decision-makers say that understanding which security tools and solutions fit best within their company is becoming more complex. Many are…
-
How organizations can secure their AI code
Tags: ai, application-security, awareness, backdoor, breach, business, chatgpt, ciso, compliance, control, credentials, crime, cybersecurity, data, data-breach, finance, github, healthcare, LLM, malicious, ml, open-source, organized, programming, risk, risk-management, software, startup, strategy, supply-chain, technology, tool, training, vulnerabilityIn 2023, the team at data extraction startup Reworkd was under tight deadlines. Investors pressured them to monetize the platform, and they needed to migrate everything from Next.js to Python/FastAPI. To speed things up, the team decided to turn to ChatGPT to do some of the work. The AI-generated code appeared to function, so they…
-
How AI and ML are transforming digital banking security
In this Help Net Security interview, Nuno Martins da Silveira Teodoro, VP of Group Cybersecurity at Solaris, discusses the latest advancements in digital banking security. He … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/01/14/nuno-martins-da-silveira-teodoro-solaris-ai-digital-banking-security/
-
New Research Highlights Vulnerabilities in MLOps Platforms
New research by Security Intelligence has revealed security risks in MLOps platforms including Azure ML, BigML and Google Vertex AI First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/vulnerabilities-mlops-platforms/
-
Anomaly Detection for Cybersecurity
A long promising approach comes of age I won’t revisit the arguments for anomaly detection as a crucial piece of cybersecurity. We’ve seen waves of anomaly detection over the years”Š”, “Šand CISA, DARPA, Gartner, and others have explained the value of anomaly detection. As rules-based detections show their age and attackers adopt AI to accelerate their…
-
Neue Schwachstellen in Machine-Learning-Systemen – JFrog-Analyse zeigt Risiken auf
Um Risiken zu minimieren, empfiehlt das JFrog-Team, keine nicht-vertrauenswürdigen ML-Modelle zu laden auch nicht in scheinbar sicheren Formaten wie Safetensors. Unternehmen sollten ihre ML-Nutzer für die Gefahren sensibilisieren und Sicherheitsrichtlinien entsprechend anpassen. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/neue-schwachstellen-in-machine-learning-systemen-jfrog-analyse-zeigt-risiken-auf/a39362/
-
Die 10 häufigsten LLM-Schwachstellen
Tags: access, ai, api, application-security, awareness, breach, cloud, control, cyberattack, data, detection, dos, encryption, injection, least-privilege, LLM, ml, monitoring, privacy, RedTeam, remote-code-execution, risk, service, tool, update, vulnerability, zero-trust -
ML clients, ‘safe’ model formats exploitable through open-source AI vulnerabilities
First seen on scworld.com Jump to article: www.scworld.com/news/ml-clients-safe-model-formats-exploitable-through-open-source-ai-vulnerabilities
-
AWS launches tools to tackle evolving cloud security threats
The increasing sophistication and scale of cyber threats pose a growing challenge for enterprises managing complex cloud environments. Security teams often face overwhelming volumes of alerts, fragmented workflows, and limited tools to identify and respond to attack patterns spanning multiple events.Amazon Web Services (AWS) is addressing these challenges with two significant updates to its cloud…
-
JFrog fördert sichere KI-Entwicklung mit Integration von Databricks MLflow
Die neue JFrog Artifactory-Integration bietet Entwicklern und Data Scientists eine Open Source Software-Lösung, um die Entwicklung von ML-Modellen zu … First seen on infopoint-security.de Jump to article: www.infopoint-security.de/jfrog-foerdert-sichere-ki-entwicklung-mit-integration-von-databricks-mlflow/a37220/
-
JFrog übernimmt Qwak AI Rationalisierung von KI- & ML-Modellen
Als Teil der JFrog-Plattform wird die Qwak-Technologie eine unkomplizierte und problemlose Überführung von Modellen in die Produktion bieten, basiert … First seen on infopoint-security.de Jump to article: www.infopoint-security.de/jfrog-uebernimmt-qwak-ai-rationalisierung-von-ki-ml-modellen/a37667/
-
It’s Near-Unanimous: AI, ML Make the SOC Better
Efficiency is the name of the game for the security operations center, and 91% of cybersecurity pros say artificial intelligence and machine learning are winning that game. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-operations/survey-report-ai-ml-make-soc-better
-
Kritische Schwachstellen in PyTorch, TensorFlow und ONNX gefährden maschinelles Lernen
Die dokumentierten Schwachstellen betreffen die wichtigsten ML-Plattformen und machen deutlich, wie böswillige Akteure durch gezielte Angriffstechniken die Vertraulichkeit, Integrität und Verfügbarkeit produktiver ML-Systeme gefährden könnten. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/kritische-schwachstellen-in-pytorch-tensorflow-und-onnx-gefaehrden-maschinelles-lernen/a38926/
-
Sicherheitslücken in ML-Toolkits: Zahlreiche Tools betroffen
Neue Schwachstellen in ML-Toolkits: Sicherheitslücken erhöhen das Risiko von Angriffen auf ML-Systeme durch KI-Hacker. First seen on tarnkappe.info Jump to article: tarnkappe.info/artikel/it-sicherheit/sicherheitsluecken-in-ml-toolkits-zahlreiche-tools-betroffen-304052.html
-
JFrog-Analyse zur Gefährdung Maschinellen Lernens: Kritische Schwachstellen in ML-Frameworks entdeckt
First seen on datensicherheit.de Jump to article: www.datensicherheit.de/jfrog-analyse-gefaehrdung-maschinelles-lernen-kritisch-schwachstellen-ml-frameworks-entdeckung
-
Security Flaws in Popular ML Toolkits Enable Server Hijacks, Privilege Escalation
Cybersecurity researchers have uncovered nearly two dozen security flaws spanning 15 different machine learning (ML) related open-source projects.These comprise vulnerabilities discovered both on the server- and client-side, software supply chain security firm JFrog said in an analysis published last week.The server-side weaknesses “allow attackers to hijack important servers in the First seen on thehackernews.com Jump…
-
AI Recruitment Tools Prone to Bias, Privacy Issues
ML, NLP Tools Collect More Personal Information Than Required, UK Regulator Says. Artificial intelligence tools currently used by organizations in the United Kingdom to screen job applicants pose privacy risks and are susceptible to biasness and accuracy issues, the U.K. Information Commissioner’s Office found. The ICO focused on machine learning and natural language processing. First…
-
Researchers Uncover Vulnerabilities in Open-Source AI and ML Models
A little over three dozen security vulnerabilities have been disclosed in various open-source artificial intelligence (AI) and machine learning (ML) m… First seen on thehackernews.com Jump to article: thehackernews.com/2024/10/researchers-uncover-vulnerabilities-in.html
-
Open-Source AI, ML Tools Plagued With Vulnerabilities
First seen on scworld.com Jump to article: www.scworld.com/brief/open-source-ai-ml-tools-plagued-with-vulnerabilities
-
Exploring the Transformative Potential of AI in Cybersecurity
By continuously learning from new data, ML models can adapt to evolving threat landscapes, making them invaluable in identifying zero-day vulnerabilit… First seen on securityboulevard.com Jump to article: securityboulevard.com/2024/10/exploring-the-transformative-potential-of-ai-in-cybersecurity/