What's happening in security
Breaches, credential dumps, actively exploited bugs and AI incidents — pulled from 5,646 items across public feeds, Have I Been Pwned and CISA KEV.
Biggest this week
- Westcon-Comstor posts record US$3.37B first-half sales as APAC demand for AI, cloud and cyber accelerates — Reseller News (NZ), 3d ago
- GitHub Octoverse 2026 — Simon Willison (AI), 4d ago
- Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen — The Hacker News, 3d ago
- Upwind Security Raises $400 Million at $3.8 Billion Valuation — SecurityWeek, 4d ago
- Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds — The Record, 3d ago
-
Claude Sonnet 5.5
Claude Sonnet 5.5 New Sonnet model from Anthropic today. They say it "runs 30%+ faster, and costs up to 30% less for most work" - it's priced the same as Sonnet 5 but appears to beat it on every benchmark, and should be cheaper to…
-
Nvidia Launches AI Agent Safety Platform to Prevent Rogue Activities
The Open Agent Safety Platform relies on both hardware and software components to monitor agent activities and quarantine unruly agents before they cause harm.
-
The Top CISO Stories from Around the Web: September 2026
As deepfake voice scams and rogue autonomous agents reshape the threat landscape, today’s CISOs are stepping onto the front lines of a high-stakes AI revolution. Navigating this shift requires security leaders to evolve into key C…
-
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
Huntress researchers reveal how attackers are exploiting ChatGPT Custom GPTs to spread ClickFix lures and DLL-sideloaded malware. See the full breakdown.
-
Meta Muse appears to read your Apple messages and upload them to the cloud even if you explicitly tell it not …
Meta Muse appears to read your Apple messages and upload them to the cloud even if you explicitly tell it not to: https:// appleinsider.com/articles/26/0 9/28/metas-new-ai-agent-blatantly-ignores-users-permissions
-
AI Agents Are Privileged Users; Who Is Auditing Their Access?
Enterprises regularly rigorously monitor human employees, while autonomous AI agents quietly operate with broad privileges that could turn them into the next generation of insider threats.
-
As AI world debates security, NVIDIA releases open source tools for agents
One expert told CyberScoop that the announcement reflects industry recognition that after years of training models to behave safely or ethically, more outside controls are needed. The post As AI world debates security, NVIDIA rele…
-
IAM for AI agents: A Practical Enterprise Framework
What is IAM for AI agents? AI agents authenticate, invoke tools, and act across enterprise systems with delegated authority. IAM for AI Agents is the identity-control architecture that governs those actors. This guide covers the l…
-
RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims
RatHat's operators build and publish the Android banking trojan and control infected phones from a web console, according to security company Cleafy. Cleafy has traced nearly 100 deployments of that console since April 2026. It sa…
-
Modulate Raises $25 Million to Advance Deepfake Detection
The misuse and abuse of AI-generated voice is growing. Modulate’s intention is to allow real time detection and intervention. The post Modulate Raises $25 Million to Advance Deepfake Detection appeared first on SecurityWeek .
-
JadePuffer agentic AI attacks target Azure, destroy cloud resources
The JadePuffer ransomware operator is targeting Azure tenants with agent-driven attacks that conduct reconnaissance, steal credentials, and destroy core components. [...]
-
Breach of Confidence — 28 September 2026
There was a mass uprising last week in support of moving this newsletter from Friday to Monday. Do not let anyone ever say I m not a man of the people. Unfortunately, I forgot, so it s a bit later in the day than I had hoped for. …
-
JadePuffer AI Actor Compromises Azure Tenant in Destructive Cloud Attack
The agentic threat actor may have used exposed credentials to access resources and delete cloud-based storage, applications, and databases.
-
Niche AI tools pose major cybersecurity risk to infrastructure operators
Security vetting tools and processes weren t designed with obscure AI services in mind, according to TrendAI.
-
Webinar: How to Govern AI Agents, Reduce Excessive Access, and Control Shadow AI
AI agents are moving into production faster than security teams can govern them. They are connecting to apps, handling data, calling APIs, and acting across business systems—often without the same controls applied to human users. …
-
Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent
Cybersecurity researchers have disclosed details of a new botnet malware called Carbonato that's targeting exposed Docker daemons to deploy an open-source artificial intelligence (AI) agent framework called Hermes Agent. "The impl…
-
NVIDIA wants AI agent safety enforced in silicon, not left to the agent
NVIDIA has introduced an open software platform and a hardware-based reference design intended to keep AI agents within the limits set by the organizations that use them. The Open Agent Safety Platform includes OpenShell, software…
-
OpenAI Pauses Training Its Most Powerful Models After Rogue Agents Target Government
Sam Altman says the company “have not been as fast as we would have liked” at dealing with security breaches, after news of further incidents over the summer forces another temporary halt.
-
“Drunk” AI is terrible at keeping secrets
AI models taught to write like drunk people became easier to jailbreak and more likely to leak secrets shared in confidence. That is the finding of UNSW Sydney researchers Anudeex Shetty, Aditya Joshi and Salil Kanhere, published …
-
Nvidia Unveils AI Agent Safety Platform With Hardware-Based Watchdog
The platform combines open source software and a reference system design to keep AI agents within set boundaries. The post Nvidia Unveils AI Agent Safety Platform With Hardware-Based Watchdog appeared first on SecurityWeek .
-
Context matters when it comes to cybersecurity’s agentic operating model
AI agents need context-aware security beyond traditional models. Workflow data provides the governance guardrails that make AI safe and scalable.
-
Security testing has to keep pace with AI-driven attackers
AI attackers move at machine speed. Security validation needs to follow every meaningful change.
-
If you do one security check this quarter, make it agent memory
In this interview with Help Net Security, Chris Latimer, CEO of Vectorize, talks about the security risks hiding in AI agent memory. He found coding agents storing API keys, credentials, and sensitive documents in plain text on de…
-
Authorizer: Open-source authentication and authorization for your apps
Authorizer is an open-source server for sign-in and access control in web and mobile apps. Teams run it on their own infrastructure and keep user accounts in a database they choose. Its maintainers have built a permissions engine …
-
AI tests the limits of enterprise security governance
AI agents are forcing enterprises to rethink security governance, human accountability and oversight as deployments scale. AWS s Reimagine 2026 argues that organizations need to build governance into their systems and keep humans …
-
Product showcase: A photo can fool your eyes. Verdict checks the evidence
Verdict is an AI image and video detector designed for iPhone. It works offline and requires no account. Choose a photo or video, run a scan, and the app returns a 0–100 score with a verdict and supporting evidence. It requires iO…
-
Quoting Muse AI Agent
Bad news on the MX Keys Mini pickup. Usman showed up at your building around 9:15 and waited, messaged a bunch of times, and nobody came down. He left angry at 9:38 and left a negative rating. Worse, my auto-reply told him "Yep I'…
-
2026 in LLMs (so far)
On Friday I gave the closing keynote at the WeAreDevelopers World Congress North America in San Jose. I tied together the key trends from the past year into a chronological exploration of everything that happened in 2026. The vide…
-
OpenAI is preparing “o,” an always-on ChatGPT assistant that could handle email
OpenAI is testing a new always-on assistant called "o", and references to the unannounced feature briefly showed up on the company's website. [...]
-
A/NZ sees strong demand for security and network consolidation: Cloudflare
Partners across Australia and New Zealand (A/NZ) have a big opportunity to meet demand for a consolidated approach to security and networking, with Cloudflare looking to support those that are doubling down on the concept. Speakin…
-
DraftKings Is Using AI to Supercharge the Harms of Online Behavioral Advertising https://www. eff.org/deeplink…
DraftKings Is Using AI to Supercharge the Harms of Online Behavioral Advertising https://www. eff.org/deeplinks/2026/09/draf tkings-using-ai-supercharge-harms-online-behavioral-advertising
-
RE: https:// mas.to/@skeletor/1173392423971 43240 NOOOOO this is how we got AI
RE: https:// mas.to/@skeletor/1173392423971 43240 NOOOOO this is how we got AI
-
Anthropic turns Claude into an AI marketplace with 2,000+ plugins and connectors
Anthropic has just announced a new Claude Marketplace, and it brings all AI-related tools into one place, including plugins, connectors, agents, and more. [...]
-
Kākāpō Party
Tool: Kākāpō Party I gave presented a closing keynote for the WeAreDevelopers World Congress North America yesterday. As a STAR moment I decided to weave in references to the record breaking kākāpō breeding season we had in 2026. …
-
China and US Agree to Establish AI Safety Channel and Continue Trade and Military Talks
The US and China agreed to set up a communication mechanism for artificial intelligence-related incidents. The post China and US Agree to Establish AI Safety Channel and Continue Trade and Military Talks appeared first on Security…
-
Claude Opus 5.5 uses 95% fewer em dashes, but its answers are getting longer
Anthropic's Claude Opus 5.5 appears to be changing how it writes, with new analysis showing fewer obvious AI writing patterns, shorter sentences, and simpler wording compared with Opus 5. [...]
-
RE: https:// mstdn.ca/@dbattistella/1173346 31253067704 This is (yet another) warning about AI.
RE: https:// mstdn.ca/@dbattistella/1173346 31253067704 This is (yet another) warning about AI.
-
OpenAI's AI agents accidentally uploaded user-provided images to third-party sites
OpenAI says its AI agents uploaded user-provided images to third-party image-hosting services while carrying out research and evaluation tasks. [...]
-
New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining
The Windows botnet relies on AI to maintain persistence, using xAI Grok to choose from predefined actions. The post New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining appeared first on SecurityWeek .
-
Old-School Credit Card Scams Are Far From Dead
In an era of increasingly sophisticated AI-fueled scams, a retro threat may be lurking in your mailbox.
-
Zero Trust for AI Agents Starts With Fixing Zero Visibility
The way we talk about AI agents is shifting, and the way we implement them requires an even more fundamental shift. While earlier discourse focused on how quickly organizations could stand up agents and how much productivity they …
-
OpenAI Says Its Models Engaged With US Government Websites in New Model Misbehavior Disclosure
OpenAI’s CEO said there is an “extensive and ongoing review related to our agents’ use of internet access during training and evaluation.” The post OpenAI Says Its Models Engaged With US Government Websites in New Model Misbehavio…
-
Listen, I just think it's weird that the same people who are saying they're worried that AI is going to wipe o…
Listen, I just think it's weird that the same people who are saying they're worried that AI is going to wipe out humanity are also eager for military contracts that will give AI control of weapons.
-
AI Sandbox Escapes: Why Forensic Readiness Matters More Than Containment
When autonomous AI agents escape the sandbox, the real story isn't rogue machines — it's the same access-control failures we've seen for decades.
-
What We Missed: Google Gemini Joins the AI Escape Party
In this video conversation, Dark Reading editors discuss some of the news they didn't get a chance to cover, from Google Gemini models breaking containment to ShinyHunters ratting on TeamPCP hackers.
-
OpenAI wants you to use AI — but not to train its AI
Here’s an interesting concept: an AI company that fires people for using AI. It sounds like a strange way to run a company but there’s a real reason behind it. OpenAI has been hiring contractors who have been tasked with reading C…
-
Quoting John Gruber
Muse is getting a lot of attention — including mine — because it’s both groundbreaking technically (each user gets their own entire persistent Linux VM running in Meta’s cloud) and because it’s packaged in an easy-to-install easy-…
-
Anthropic rolls out up to $250 in free Claude Code credits, but only for cloud sessions
Anthropic now allows you to run Claude Code via cloud sessions without signing up for the research preview, and it's offering up to $250 in free usage credits, so more users can give it a try. [...]
-
Storm-3168: Agentic-driven cloud attacks using compromised service principals
Microsoft details JADEPUFFER-linked Azure reconnaissance, resource deletion, and credential access using compromised service principals, identifying the activity as associated with Storm-3168 and providing guidance for defenders. …
-
Storm-3168: Agentic-driven cloud attacks using compromised service principals
Microsoft details JADEPUFFER-linked Azure reconnaissance, resource deletion, and credential access using compromised service principals, identifying the activity as associated with Storm-3168 and providing guidance for defenders. …
Last fetch 8m ago · 1 new · 1 source error(s)