Daily fact-based rundown of the most important AI-related security developments from the last 24 hours.

🔐 Core Security Intelligence

1) OpenAI Codex CLI flaw allowed arbitrary code execution on developer machines

What’s new
New coverage details how a command-injection flaw in OpenAI’s Codex CLI let attackers run arbitrary commands on developer machines by planting a malicious configuration inside a project repository. The bug abused how Codex CLI resolved project-local configuration files (such as .env and .codex/config.toml), automatically loading and executing Model Context Protocol (MCP) server entries without user approval. OpenAI patched the issue in Codex CLI 0.23.0 after disclosure by Check Point Research.

Source: OpenAI Codex flaw let attackers run arbitrary code

Why it matters
This is effectively a supply-chain and developer-tooling vulnerability in an AI agent that reads, edits, and executes code. Any compromised repo, template, or starter project that a team cloned and used with Codex could have silently executed attacker-controlled commands in the developer’s context, with access to source code, SSH keys, and cloud credentials. In environments where Codex is wired into CI or automation, the blast radius extends to build systems and downstream deployments.

Defenses

• Treat AI coding agents as high-risk developer tools. Run Codex (and similar CLIs) in locked-down environments with restricted permissions, and do not assume “AI helper” equals “low risk.”
• Enforce strict review for repo-level configuration files (.env, .codex/*, MCP configs). Flag changes to these files in code review and protect them with branch protections.
• Require upgrades to Codex CLI 0.23.0 or later where it is in use, and monitor for unusual outbound connections or process launches tied to AI tooling on developer endpoints.

Expert insight
This is a textbook example of how AI-augmented developer workflows can collapse traditional trust boundaries. Once an AI agent can both read and execute code, its configuration becomes as sensitive as any privileged script. Security teams should catalog AI tools in the SDLC and explicitly bring them into secure-coding, SAST/DAST, and supply-chain reviews.

2) International AI Safety Report: layered defenses still buckle under prompt injection and model abuse

What’s new
The International AI Safety Report, summarized by Help Net Security, warns that attackers are evolving faster than AI safeguards. The report highlights that layered controls (training-time safety, deployment filters, post-release monitoring) reduce risk but remain fragile under targeted, repeated attacks. Tests show that when adversaries get multiple attempts, they can bypass about half of protections through prompt injection, data poisoning, and fine-tuning abuse. The report also notes that open-weight models are closing the capability gap with frontier systems, making repurposing and misuse easier.

Source: Attackers keep finding new ways to fool AI

Why it matters
This is one of the first large public snapshots of AI safety that reads like a threat-intel report rather than marketing. It confirms what many red teams have already discovered: safety filters that look strong in single-turn demos often fail when subject to iterative probing, chaining, and context-poisoning. It also reinforces that “secure by training” is not enough; behavior can drift after fine-tuning or poisoning, and monitoring systems can be gamed or bypassed.

Defenses

• Assume safety features are probabilistic controls, not guarantees. Wrap models in your own input and output validation, risk scoring, and allow-/deny-lists aligned to business use cases.
• Incorporate adversarial testing into your release process. Simulate prompt injection, tool-calling abuse, and fine-tuning misuse, and treat these as first-class test cases alongside functional QA.
• Treat open-weight and fine-tuned models as mutable assets. Track provenance, changes over time, and re-test safety whenever training data or fine-tuning runs change.

Expert insight
The key takeaway is not that safety work is failing, but that it behaves more like fraud detection than static code security. AI defenses need continuous tuning, telemetry, and adversarial pressure testing. If your AI security story fits on a single slide, it is probably not robust enough.

3) Anthropic simulations show AI agents successfully exploiting real-world DeFi smart contracts

What’s new
A new report on Anthropic’s research, covered by CryptoDnes, describes controlled experiments where models like Claude Opus 4.5 and Sonnet 4.5 were tasked with attacking blockchain smart contracts. In a sandboxed environment with contracts that had been exploited in the real world after March 2025, the agents successfully compromised 17 of 34 targets, extracting the equivalent of about 4.5 million USD in simulated funds. On a broader benchmark of 405 contracts across Ethereum, BNB Smart Chain, and Base, AI agents executed 207 successful exploits, totaling roughly 550 million USD in simulated value. The study also reports discovery of new zero-day-style bugs in contracts previously believed to be safe.

Source: AI Emerges as a Real Threat to Smart-Contract Security

Why it matters
This is a concrete demonstration that modern LLM-based agents can move beyond “code assistant” into fully automated exploit discovery and execution against on-chain targets. DeFi and Web3 ecosystems already suffer from frequent smart-contract exploits; AI automation dramatically lowers the skill and time required to weaponize the long tail of vulnerable contracts. The research also hints that many 2025-era real-world exploits could have been carried out by existing AI systems, not just human experts.

Defenses

• Treat AI-assisted auditors as a baseline, not a luxury. Before deployment, subject contracts to both traditional formal verification and AI-assisted security reviews trained on exploit patterns and on-chain data.
• Implement strong runtime defenses: circuit breakers, pause functions, rate limits, and anomaly detection on transaction patterns, so that even an automated exploit has limited window and impact.
• Build threat models that assume cheap automated exploitation. Prioritize patching and migration for high-TVL contracts and protocols whose design patterns match known exploitable classes.

Expert insight
We are entering a phase where “script kiddie” equivalents can wield sophisticated AI-driven exploit chains against DeFi. The only realistic response is to normalize pre-deployment security testing that also uses AI, and to treat on-chain defenses and monitoring as essential safety rails, not optional extras for mature projects.

🌐 Extended Risk & Ecosystem

4) Android patches two exploited zero-day vulnerabilities impacting modern devices

What’s new
Google’s December 2025 Android update includes fixes for 107 vulnerabilities, including two zero-days (CVE-2025-48633 and CVE-2025-48572) that the company says are already being exploited in the wild. Both flaws affect the Framework component and could allow information disclosure or privilege escalation on Android 13–16 devices. SecurityWeek notes that the bugs may be linked to commercial spyware activity.

Source: Android’s December 2025 Updates Patch Two Zero-Days

Why it matters
Even though these are not “AI bugs” per se, Android devices are now primary endpoints for AI assistants, enterprise chatbots, and on-device inference workloads. Compromise at the OS level undermines any assurances you have built around mobile AI applications, from data-loss prevention to zero-trust access based on mobile posture. For staff using AI tools on BYOD or semi-managed devices, these zero-days increase the risk that sensitive prompts or outputs could be observed or exfiltrated.

Defenses

• Enforce timely Android patching via MDM or EMM, with specific SLAs for high-severity and exploited-in-the-wild vulnerabilities. Block or restrict access to sensitive AI apps from devices that are not at the required patch level.
• Treat mobile AI use as part of your threat model. Log and monitor mobile access to AI-enabled internal services, and apply conditional access controls based on device risk signals.
• Where possible, keep the most sensitive AI-enabled workflows off mobile altogether, or require hardened, fully managed devices for those use cases.

Expert insight
For many organizations, “AI risk” will arrive on mobile first because that is where staff actually use assistants and chatbots. Closing OS-level holes like these is a prerequisite for any meaningful control over AI-driven business processes on phones and tablets.

5) Siren and Elastic expand AI-driven investigation platform for national security and financial crime

What’s new
VentureBeat reports that Siren, an investigation platform vendor, has secured strategic investment from Elastic to expand its AI-driven investigation capabilities. The partnership combines Elastic’s search, retrieval, and anomaly detection with Siren’s graph-based investigative tooling, aiming to support national security, law enforcement, and financial-crime investigations. The joint stack emphasizes explainability, auditability, and cross-source data fusion for AI-assisted investigations.

Source: Siren Secures Investment to Advance AI-Driven Investigations for National Security

Why it matters
While much AI security news focuses on offensive use, this is a concrete example of AI being operationalized defensively at scale. The fact that the platform is built around explainable search and graph operations, rather than opaque “magic scoring,” aligns with regulatory expectations for national-security and financial-crime work. It also signals that AI-driven threat hunting and investigations are moving from bespoke pilots into more standardized products used across agencies and industries.

Defenses / opportunities

• If you operate in high-regulation sectors (finance, critical infrastructure, government), evaluate AI-assisted investigation platforms through the lenses of explainability, audit trails, and data lineage, not just detection lift.
• Integrate these tools into your broader SOC and GRC workflows so that AI-generated links and hypotheses can be validated, documented, and handed off cleanly to human analysts and legal teams.
• Use the emergence of such platforms as leverage with vendors: insist on transparent model behavior, clear error bounds, and integration points that let you layer your own controls on top of AI insights.

Expert insight
The defensive side of AI is maturing. The winners here will be the teams that treat AI as an amplifier of disciplined investigative practice, not as a black-box oracle. Platforms that combine search, graphs, and LLMs in an auditable way will be much easier to defend and to justify to regulators.

📊 At-a-Glance Summary

Categories: Cybersecurity News

Tags: AI Security, Android Zero-Day, Codex CLI, DeFi Security, Elastic, LLM Security, Model Safety, National Security, Prompt Injection, Siren