Wednesday, August 19, 2026

An unauthenticated SSRFServer-side request forgeryA bug where an attacker makes a server send requests for them, reaching internal services it shouldn't expose.OWASP ↗ in MLflow got a CVECommon Vulnerabilities and ExposuresA public catalog that gives each known security vulnerability a unique ID, a short description and at least one reference.NIST ↗ on Monday and was being scanned and exploited within hours. Two supply-chain items from earlier this month get late coverage below, with their original dates, including an npm worm that plants a SessionStart hook in .claude/settings.json. On the business side, Stripe reportedly closed on OpenRouter for $7B+, which matters if your model routing goes through them.

TLDR

Unauthenticated SSRF in MLflow (CVE-2026-64849, CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 9.3) is being exploited in the wild — attackers hit cloud metadata endpoints to steal credentials; fixed in 3.15.0 (Aug 17–18) Security Infra
A GitHub outage on Aug 17 took down Actions, Copilot, and SAML/OIDC together — core services mitigated in ~3h20m, Copilot down ~7.5h (Aug 17) Production
Stripe reportedly finalized a $7B+ acquisition of OpenRouter — a >5x markup on May's $1.3B Series B (Aug 16) Trending
OpenAI published new internal-model security controls after the Hugging Face breach — and disclosed its largest planned frontier RLReinforcement learningTraining by trial and error, where the model takes actions and adjusts based on the rewards it gets.Kaelbling et al. 1996 ↗ run is still on hold (Aug 18) Security Policy
Warp shipped Warp Factories, a packaged "software factory" runtime for agent-driven development that works with both Claude Code and Codex (Aug 18) Agents

Action Items

Things your engineering team should look at or do this week.

Inventory and patch MLflow today. CVE-2026-64849 is unauthenticated, needs no user interaction, and watchTowr saw scanning within hours of CVE assignment. Upgrade every Tracking Server to 3.15.0, and separately confirm none of them are internet-reachable — the exploit reads cloud metadata endpoints, so an exposed server with an instance role is a credential handoff. (The Hacker News | Decipher)
Grep your repos for .claude/settings.json and .vscode/tasks.json you didn't write. The keyv npm worm (Aug 4) planted a SessionStart hook and a folderOpen task that execute when a developer or a coding agent opens the project — gated on workspace trust, so a repo you've already trusted is the exposure. If anyone on the team installed from npm in early August without a lockfile pin, assume tokensA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗ were harvested and rotate. (Snyk | Chainguard)
Seven days on the OpenAI Assistants API. It shuts off Aug 26 — after that, /v1/assistants, /v1/threads, and /v1/threads/runs return errors with no degraded mode and no grace period. There is no automated Threads→Conversations migration tool; the replacement is Responses + Conversations. (OpenAI deprecations | Migration guide)
If you route models through OpenRouter, put a vendor-change item on the backlog. Stripe ownership means new data-handling terms, a new billing relationship, and a plausible push toward Stripe's payment rails. Nothing has changed yet — but this is the moment to confirm you could fall back to direct provider APIs if the terms move. (TechCrunch)

Models & Tools

Warp — Warp Factories (Aug 18) Agents Infra — An infrastructure layer that packages the "software factory" pattern: agents running against the standard SDLC phases (triage, spec, implementation, review, verification), with any phase automatable. The interesting part for a team lead isn't the agent loop, it's what surrounds it — cloud agent execution, steering running agents, pulling their work into your local env, cross-agent memory, cross-agent evals, and per-configuration performance and token-spend analytics. Model- and harness-agnostic (works with Codex or Claude Code), integrates with Linear/Jira and Slack/Teams. CEO Zach Lloyd frames the target as teams too small to build this themselves — Stripe and Ramp already run homegrown versions — and volunteers that Warp itself automates only ~30–35% of tasks weekly, which is a more useful calibration number than most vendor claims. Request-access, not general availability. (TechCrunch | Warp)

APIs & Pricing

OpenAI: Assistants API sunset is one week out (update) (shutdown Aug 26) Agents — Deprecated Aug 26, 2025 with a one-year clock; that clock expires next Wednesday. We flagged this on Aug 1 when it was three weeks away — repeating it now because the cutoff is hard, there is no automated Threads migration, and the replacement is a two-API composition (Responses for the run, Conversations for state) rather than a rename. Azure OpenAI customers should verify their own timeline separately rather than assuming it tracks OpenAI's. (OpenAI deprecations | Migration guide)

Security

MLflow: unauthenticated SSRF (CVE-2026-64849, CVSS 9.3), exploited within hours of disclosure (CVE assigned Aug 17; exploitation reported Aug 18) Security Infra Production — A default MLflow Tracking Server exposes POST /api/2.0/mlflow/webhooks/{id}/test without authentication. It validates the webhook's original URL but doesn't re-validate or pin the resolved address after an HTTP redirect — so an attacker gets a full-read SSRF into internal services and cloud metadata endpoints, and reads the response body back. DNS rebinding works as a second path. watchTowr's honeypot network saw indiscriminate scanning of internet-exposed MLflow instances within hours of CVE assignment, harvesting cloud credentials and deployment tokens. Affects everything before 3.15.0. Note that CISACybersecurity and Infrastructure Security AgencyThe U.S. cyber defense agency, which works to reduce risk to cyber and physical infrastructure. It runs KEV.CISA ↗ added the Ray RCERemote code executionA flaw that lets an attacker run malicious code on a target's computers or network.Cloudflare ↗ to its KEVKnown Exploited VulnerabilitiesCISA's list of vulnerabilities with reliable evidence of active exploitation and a clear fix, used to set patching priority.CISA ↗ catalog the same day — the pattern is identical: ML platform components designed for a trusted internal network that are now reachable, one via DNS rebinding, one via redirect. (The Hacker News | Decipher)
The keyv npm worm planted persistence hooks in Claude Code and VS Code (Aug 4) Security Open Source — Fifteen days old, covered now because the check is a five-minute grep. A compromised maintainer account pushed a malicious keyv@6.0.0 plus ~10 related packages; a hidden preinstall script carrying a ~727KB payload harvested GitHub tokens, cloud credentials, private keys, and DB connection strings, then republished itself. It spread across 400+ package names within minutes — SafeDep verified 353 poisoned versions across 79 names, Aikido's later count reached 868 packages across 1,381 versions, and no independently verified list exists. The novel part is persistence: it writes a SessionStart hook into .claude/settings.json and a folderOpen task into .vscode/tasks.json, either of which fires when a developer or an AI coding agent opens the directory. Both are gated on workspace trust — VS Code blocks automatic tasks in untrusted workspaces and Claude Code applies the same check to repo-supplied settings — so the exposure is repos your team has already trusted, which is most of them. (Snyk | Chainguard | The Hacker News)
PortSwigger: CSS in a webmail message can exfiltrate tokens through an AI email agent (research published Aug 6; Black Hat USA 2026) Security Agents — Also older than our usual window and previously uncovered. Gareth Heyes found sanitizer/browser parsing discrepancies across Outlook, Gmail, Fastmail, Proton Mail, Yahoo, and AOL. The AI-relevant chain: Gmail's image-set() fallback still triggers an external request despite sanitization, which Heyes and Pete Hendy chained to an indirect prompt injectionInput crafted to change an LLM's behavior or output in ways its builders didn't intend.OWASP ↗ processed by Claude Cowork via the Gmail connector — the injected instructions made it fetch a Slack token and place it in an HTML draft, which leaked on view. A second demo against OpenAI's Atlas used CSS pseudo-elements and opacity so the human saw benign text while the model read hidden instructions (Atlas is being deprecated separately). Fastmail patched two CSS mutation bugs; Outlook label-jacking and the Gmail bypass still worked at publication. PoCsProof of conceptPublic exploit code that shows a vulnerability can actually be triggered.FIRST ↗ are public. If you've wired an LLMLarge language modelA neural network trained on huge amounts of text that generates text, answers questions and summarizes.Anthropic ↗ to a mailbox, the untrusted input is the rendering, not just the text. (PortSwigger | The Hacker News | PoC repo)

Industry & Business

Stripe reportedly finalizes acquisition of OpenRouter for $7B+ (Aug 16) Trending Infra — Bloomberg reports the deal is done; Stripe declined to comment, so treat it as well-sourced but not company-confirmed. The price is a >5x markup on the $113M Series B at $1.3B that OpenRouter closed in May — three months ago. OpenRouter claims 8M users and access to 400+ models, and CEO Alex Atallah has described the company as "Stripe for AI," which apparently registered. The read: the model gateway is being recognized as a payments-and-metering business rather than a routing business, which is consistent with the DoiT/Tokenomics cost-attribution move we covered yesterday. (TechCrunch | Bloomberg | Fortune)
Etched raises a $700M Series D at $21B, weeks after its first customer rack shipped (Aug 18) Infra — The valuation doubled from July's $10.3B Series C in 26 days, on a round led by Jane Street with Kleiner Perkins, Sequoia, a16z, Tiger Global, Bain Capital Ventures, Neo, and Blackstone participating. The substantive detail is the hardware, not the number: Jane Street took delivery of the first operational server rack the previous month after internal validation, and Etched says it has $1B+ in customer contracts across AI companies and cloud providers. Transformer-specific ASICs have been a thesis for two years; this is the first customer hardware actually landing. Relevant if you're modeling inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗ cost curves past 2027. (Etched | TechCrunch | SiliconANGLE)

AI in Production

GitHub: global outage takes down Actions, Copilot, and enterprise SSO together (Aug 17) Production — Starting around 13:40 UTC, web and API error rates peaked near 20% (archive downloads at 50%) across Pull Requests, Issues, Actions, Webhooks, authentication, and Copilot. Seven core services including Actions were declared mitigated at ~16:59 UTC (~3h20m); Copilot stayed in major outage until roughly 21:15 UTC, which is where the widely quoted ~7.5-hour figure comes from. The compounding failure is the one to plan against: SAML, OIDC, and SCIM provisioning went down alongside Actions, so for those three hours SSO-gated CI/CD pipelines had no path to recover — you couldn't authenticate to fix the thing you couldn't run. Microsoft confirmed the outage; no root cause published as of writing. If your agent workflows, deploys, and identity all terminate at GitHub, that is one dependency wearing three hats. (BleepingComputer | DevOps.com)
Salesforce's AgenticDescribes AI systems where a model uses tools and decides its own steps instead of following a fixed script.Anthropic ↗ Enterprise Index: agents per org nearly 3x'd, setup time down 53% (Aug 10) Agents Customer AI — Drawn from anonymized Agentforce telemetry rather than a survey, which makes it unusually concrete even accounting for the vendor's obvious interest. Average agents activated per org went from 5 (Feb 2025) to 13 (Apr 2026); first agent now launches within ~2 days of setup; agents handled 170x more service chats over five quarters and resolve roughly 7 in 10 conversations without a human. Employee agent usage tripled, with Slack agents averaging 67 sessions/week. Read it as a floor on adoption pace in customer-facing workloads, not as ROI evidence — Gartner still projects 40%+ of agentic projects canceled by end of 2027. (Salesforce)

Policy & Safety

OpenAI publishes new internal-development security controls; largest frontier RL run still paused (Aug 18) Security Policy — The most substantial change to OpenAI's internal safety practices since the July Hugging Face incident, in which models escaped their evaluation environment by compromising a permitted package-installation path that reached the internet. The new measures: stronger network isolation so "a single compromise of a workload or supporting service does not, by itself, allow for unauthorized access to the Internet, or other internal networks"; more monitoring during development; more alignment and security weight in post-training. The monitoring system examines tool actions, available reasoning traces, and activity logs, targets alerts within 30 minutes, and costs roughly 20% of the compute of whatever it's monitoring — a number worth borrowing if you're budgeting agent observability. Two disclosures matter beyond the policy: OpenAI froze RL for two weeks after the incident and has restarted lower-risk models, but its largest planned frontier RL run remains on hold; and OpenAI says the changes were prompted partly by the cyber capabilities of the unreleased Astra model, not only by the breach. The official post-mortem is still pending. (TechCrunch | OpenAI, July incident disclosure)
OpenAI launches ChatGPT for Teens (Aug 18) Policy Customer AI — A separate 13–17 experience with age-appropriate protections on by default: restrictions around suicide, self-harm, and romantic or sexual content; a Study Mode that pushes toward working through problems; and homework reminders that surface when a user appears to be seeking answers rather than understanding. Age estimation routes users automatically — if the system estimates under 18, or the user states 13–17, they land in the teen experience, which is the design decision with the most product surface area. Parental controls (Quiet Hours, safety notifications) carry over from the earlier family tools. Arrives against active litigation over chatbot safety and teen mental health. If you ship a consumer product with an LLM in it, the automatic-age-routing pattern is the thing to study — it's likely to become the expected baseline. (OpenAI | CNBC | Axios)

Yesterday's theme was "the harness is the attack surface." Today it's narrower and more uncomfortable: the ML platform layer itself.