As AI copilots and assistants become embedded in daily work, security teams are still focused on protecting the models themselves. But recent incidents suggest the bigger risk lies elsewhere: in the workflows that surround those models. Two Chrome extensions posing as AI helpers were recently caught stealing ChatGPT and DeepSeek chat data from over 900,000 users. Separately, researchers

Researchers disclosed two now-patched critical vulnerabilities in the n8n workflow automation platform that could allow arbitrary command execution, including a sandbox escape in the expression compiler and an unauthenticated expression evaluation in Form nodes. n8n released fixes in versions 2.10.1, 2.9.3, and 1.123.22 and recommends restricting workflow permissions, disabling affected nodes,...