DifyTap Bugs Let Attackers 'Wiretap' AI Chat Histories

A series of vulnerabilities, dubbed "DifyTap," have been discovered in the Dify AI application building platform, allowing attackers to potentially access and exfiltrate sensitive data, including AI chat histories. The flaws include a tracing configuration flaw, a plugin daemon path traversal vulnerability, an unauthorized document preview bug, and a cross-file user access flaw. While no known exploitation attempts have been reported, the vulnerabilities highlight the growing data security risks associated with AI applications and emphasize the need for robust monitoring and patching.