TAG
#model-security
Stories connected through a shared idea, actor, technology or theme.
OpenAI links a 16,000-request reasoning-extraction campaign to Moonshot-associated usersOpenAI said activity peaked at 16,000 requests from more than 4,000 users on July 24 and 25, with a broader related cluster exceeding 15,000 users. The operators copied encrypted reasoning between conversations and asked another model to decrypt it; OpenAI said no encryption or stored user data was compromised.→CERT warns MLflow model loaders can bypass pickle controlsCERT/CC reported that MLflow's DSPy flavour applies its pickle guard conditionally based on the file extension, while the statsmodels flavour omits the guard. A malicious model artifact can therefore trigger arbitrary remote code execution through `mlflow.pyfunc.load_model()` even when pickle deserialization is disabled; statsmodels is fixed in version 3.15.0 and DSPy users are advised to avoid the affected flavour until fixed.→