DevSecurityPro

Today's News | 10/18/25

ChatGPT ShadowLeak Flaw Leaked Gmail Data in Zero-Click Attack

A zero-click vulnerability dubbed ShadowLeak in OpenAI's ChatGPT allowed malicious actors to extract sensitive Gmail data via hidden prompts in the Deep Research agent. Discovered by Radware researchers, it was patched in September 2025. This incident underscores the need for robust AI security to protect personal data integrations.

GuidePoint, CSA Launch SSCF to Standardize SaaS Security Controls

GuidePoint Security and the Cloud Security Alliance launched the SaaS Security Capability Framework (SSCF) to standardize security controls like multi-factor authentication and data encryption in SaaS applications. This initiative addresses misconfigurations and breaches, streamlines risk management, and fosters shared responsibility between vendors and users, potentially transforming industry standards.

LLM Coding Agents Pose Severe Security Risks, Experts Warn

Large language models (LLMs) as coding agents pose severe security risks, including prompt injections, hidden malicious instructions, and hallucinated insecure code, enabling data breaches and system compromises. Emerging defenses like privilege controls offer limited protection. Experts urge prioritizing robust safeguards to avert widespread cyber threats.

DevSecurityPro
AI Fuels Advanced Cyber Threats: Risks, Cases, and Defenses

DevSecurityPro
Google’s $32B Wiz Acquisition Targets AI Cloud Security Threats

DevSecurityPro
Amazon AI Tools Like CodeWhisperer Risk Hacks from Flawed Code

Amazon's AI coding tools, like CodeWhisperer and Q, promise efficiency but often generate code with hidden vulnerabilities from flawed training data, exposing systems to hacks. A recent incident involved a hacker inserting destructive commands into Q. The industry urges hybrid approaches with human oversight to mitigate these risks.