What's happening in security
Breaches, credential dumps, actively exploited bugs and AI incidents — pulled from 5,639 items across public feeds, Have I Been Pwned and CISA KEV.
Biggest this week
- Westcon-Comstor posts record US$3.37B first-half sales as APAC demand for AI, cloud and cyber accelerates — Reseller News (NZ), 3d ago
- GitHub Octoverse 2026 — Simon Willison (AI), 4d ago
- Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen — The Hacker News, 2d ago
- Upwind Security Raises $400 Million at $3.8 Billion Valuation — SecurityWeek, 4d ago
- Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds — The Record, 3d ago
-
Anthropic Finds Ingredients for Future AI Worms
Anthropic's latest study combined IoT and network tests to explore AI self-replication, which researchers said would be challenging to shut down.
-
Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets
Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from Anthropic. The frontier AI lab…
-
Businesses need more integrated risk management to counter cyberattacks, AI-powered fraud
Risks are growing at a time when companies are relying more than ever on vendors for cybersecurity, according to a new report.
-
Trellix Wise for Private Cloud delivers auditable AI investigations for security teams
Trellix has announced Trellix Wise for Private Cloud, an on-premises, federated AI core for agentic security operations. The solution extends a security fabric across an organization’s existing infrastructure to improve threat det…
-
Quoting Geoffrey Huntley
If the agent isn't using my diagnostics library, I could introspect and update AGENTS.md, but there's still a delta, and it'll drift. Instead, I write a pre-commit hook that checks the git diff for direct calls to observability mo…
-
NinjaOne combines Katana AI and MCP server to accelerate IT problem resolution
NinjaOne has announced Katana AI, an agentic AI technician that supports and elevates IT workers, and the NinjaOne MCP server, an agentic orchestration connector that extends the platform s governed access to the AI tools teams al…
-
Lattice Sentry 5.0 brings quantum-resistant firmware security to AI data centers
Lattice Semiconductor has released version 5.0 of its Lattice Sentry solution stack, adding post-quantum cryptography (PQC) to its platform firmware resilience (PFR) and attestation capabilities. The update provides CNSA 2.0-align…
-
Russian Influence Operation Widely Targeting Latin America
The AI-enabled operation used spoofed emails, fake government documents, and the creation of a local organization to target schools in Peru and Ecuador, among other efforts.
-
Ridge Security’s RidgeOne keeps autonomous penetration testing data inside customer environments
Ridge Security has announced RidgeOne, a self-contained solution that brings autonomous AI-powered penetration testing and agentic red teaming to mid-sized organizations. Combining Ridge Security’s RidgeGen agentic security valida…
-
Small AI Models May Soon Be Able to Self-Replicate on IoT Devices, Anthropic Warns
Experiments show cheap TV boxes can run capable AI models, and small models may soon be able to spread across such devices on their own. The post Small AI Models May Soon Be Able to Self-Replicate on IoT Devices, Anthropic Warns a…
-
Mozilla’s Firefox Enterprise lets companies block shadow AI in the browser
Mozilla’s Firefox Enterprise is a paid platform that lets organizations control how sensitive data is shared, check device security, and manage employee access to web applications. The platform pairs the browser with a management …
-
AI Turns Familiar Cyberattacks Into a Race Against Time
IBM’s Steve Wallin talks to SecurityWeek on the effect of AI-driven attacks on enterprise defenses. The post AI Turns Familiar Cyberattacks Into a Race Against Time appeared first on SecurityWeek .
-
Product Walkthrough: Bitdefender AI Visibility and Control
A user opens a browser tab, pastes data into a chat assistant, and nothing is installed. A developer adds a coding assistant as an editor extension, and nothing shows up in the installed programs list. Someone downloads a local mo…
-
Meta outlines Muse Wonder safeguards for AI agents acting on your behalf
Meta’s Muse Wonder and Muse Wonder Full models are built for AI agents that handle tasks such as preparing insurance claims, reviewing leases and developing software. The models combine document analysis and tool use with the abil…
-
ClickFix to BEC in 24 Hours: Tragic Quadrant | Huntress
Doris searched for ChatGPT and ended up in a BEC scam. See how ClickFix, a stolen session cookie, and a hidden inbox rule chain into an OH $#!T moment.
-
Frontier AI cleared every OT attack goal Booz Allen set in its lab
Booz Allen set frontier AI models against an isolated industrial-control testbed in its Chantilly, Virginia lab and watched them clear all eight attack objectives it had defined. The Booz Allen frontier AI OT test architecture (So…
-
Most high-severity cloud security findings are downgraded once an AI agent checks the environment
Cloud security platforms turn every failed rule into a finding, and those findings pile up in queues sorted by severity. Research from Sola Security tested what happens to that order when each finding gets checked against the envi…
-
Zoom appoints Andrew Hindmarch as APAC channel head
Zoom has appointed Andrew Hindmarch as head of channel for the Asia Pacific (APAC) region. Based in Singapore, Hindmarch will lead the company’s channel strategy across the region, working closely with Zoom’s network of distributo…
-
web-edit 0.1a1
Release: web-edit 0.1a1 Includes performance optimizations written by Claude Opus 5.5 after I fed it this Python 3.15 profiling report generated by GPT-6 Astra. Tags: profiling , projects
-
llm-meta-ai 0.2
Release: llm-meta-ai 0.2 Meta AI release Muse Wonder (and Muse Wonder Full), their new "most capable models". These look like they may be Meta's first Fable class models - Artificial Analysis scores Muse Wonder (Max) as equivalent…
-
Anthropic takes risky AI tests offline after models breach govt sites
Anthropic announced that its internal AI models undergoing "high-risk and cybersecurity evaluations" no longer have internet access following incidents involving U.S. government websites at the federal, state, and local levels. [.…
-
Profiling web-edit with Python 3.15: flame graphs and source heatmaps
Research: Profiling web-edit with Python 3.15: flame graphs and source heatmaps I put the new Python 3.15 profiler through its paces by having GPT-6 Astra Extra High in Codex run it against my new web-edit app : I need a Python 3.…
-
web-edit 0.1a0
Release: web-edit 0.1a0 I was working on a project from my phone using Codex Remote when I found myself wanting to edit a credentials file without round-tripping those credentials through the LLM itself. So... I had Codex and GPT-…
-
Bring Your Own Agent: Your Employees' Assistants Are Already Logged In
The personal AI agents rollout is going about as smoothly as expected: Amazon now blocks Meta's Muse because it doesn't identify itself as a bot while browsing; Instinct keeps raising privacy concerns; and the horror stories from …
-
Microsoft’s new model helps AI agents judge their next move
Microsoft-Decision-1 is a small decision-scoring model. Given a situation, a question and a fixed set of answer options, it returns a calibrated probability for each option. “This model is designed for routing, classification, pri…
-
Your AI agent is only as safe as the packages it downloads
NVIDIA's new agent safety platform puts enforcement in the right place. It still must know what it is letting through. The post Your AI agent is only as safe as the packages it downloads appeared first on CyberScoop .
-
AI-driven security: Why agentic AI is changing cybersecurity
Agentic AI is transforming cybersecurity but rogue agents, shadow AI, and third-party risks demand stronger guardrails.
-
CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records
Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine. The…
-
Strands Box: Open-source sandbox for AI agents
AWS released Strands Box, an open source sandbox for AI agents that pairs operating-system isolation with rules that can weigh what an agent has already done before letting it act again. Box is in developer preview and runs on Mac…
-
Lancom’s Aimee Lin on why skilled developers matter more than ever
As AI has changed how software is built, so has the role of developers, who have gone from being code writers to technology strategists, translators and quality controllers. This is the view of Lancom Technology CTO Aimee Lin , wh…
-
AI vulnerability patching has a grading problem
Researchers at Northwestern University tested AI coding agents on 112 real security bugs. They found that a patch which stops a crash often fails the checks the project s maintainers wrote for the fix. With Claude Opus 4.7, third …
-
Python 3.15.0 added to actions/python-versions
Python 3.15.0 added to actions/python-versions Bit of a niche link, but I've been waiting for this for a couple of days - I even told ChatGPT to check for it: Clone https://github.com/actions/python-versions and git pull once an h…
-
Hacker used ARTEX AI and Claude agents to target South Korean banks
The cyberattacks that shook the South Korean financial sector earlier this month were launched by a Chinese hacker using the ARTEX AI penetration testing suite and Claude agents. [...]
-
Criminal IP Introduces AITEM as the Next Evolution of Attack Surface Management
Traditional attack surface management helps organizations discover exposed assets, but visibility alone is not enough to address threats. Criminal IP introduces AITEM, an AI-powered approach that connects exposure discovery with i…
-
AI Is Getting Really Good at Messing With Cybercriminals
Anti-cybercrime initiatives are increasingly using AI to scam the scammers by tricking them into talking to lifelike bots that they think are real victims.
-
The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't
In environments studied for the 2026 State of Agent Security Report, roughly 1,280 third-party products now embed AI. About 282 of them sit behind single sign-on. The other thousand are invisible to identity infrastructure by defa…
-
Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws
Anthropic on Friday said it's cutting off live internet access for all its internal evaluations following the discovery of new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior and targeted r…
-
Quoting The New York Times
Anthropic detailed the activity of its A.I. agents in a blog post on Friday, without naming the targeted websites. But two sources with knowledge of the incidents said Anthropic’s A.I. agents had submitted 20 visa applications thr…
-
OpenAI Fires 3 Safety Researchers in Dispute Over AI Risks
The ChatGPT maker said the researchers "violated clear policies on handling sensitive information.” The post OpenAI Fires 3 Safety Researchers in Dispute Over AI Risks appeared first on SecurityWeek .
-
My Thoughts on Renaming AI to Super Intelligence
A colossal purple intelligence building a stone arch while a small figure on a ladder lifts a cheap cracked mask off its face, and a second figure watches with arms crossed/images/renaming-ai-to-super-intelligence.webp/images/rena…
-
Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks
Hackers are abusing legitimate Bing search-result redirects as click URLs in Google search ads to direct users to fake Claude installers that deliver ClickFix attacks. [...]
-
AI Scramble Drives Cybersecurity M&A Boom
Welcome to another gangbuster year for strategic M A activity in cyber, with 117 deals announced in the latest quarter. What's different: Many of the buyers are not your typical cybersecurity firms.
-
I understand that Anthropic thinks they're doing open source projects a favor here, but what they're actually …
I understand that Anthropic thinks they're doing open source projects a favor here, but what they're actually doing is creating an enormous amount of work for people that they are not paying. https://www. anthropic.com/research/la…
-
Quoting Matthew Green
Everyone is very concerned about being respectable, so I’m going to be the goofball who raises worst-case possibilities. I think there is a 1% chance we live in Minicrypt, and a 15% chance we functionally lose confidence in our ex…
-
How to keep AI agents within their permissions
AI agents can use valid credentials to perform actions beyond their assigned permissions, creating risks that traditional access controls may not prevent. Token Security explains how organizations can enforce agent-specific polici…
-
You know, if “super intelligence” flames out, maybe we can reclaim “AI” for something else
You know, if “super intelligence” flames out, maybe we can reclaim “AI” for something else
-
OpenAI says it disrupted Russian and Iranian influence ops that used ChatGPT
A Latin American propaganda operation run by Russians and a cluster of Iranian fake journalist identities each had help from now-closed ChatGPT accounts, OpenAI's safety team said.
-
Social Engineering AI Agents: The New BEC for 2026
As AI agents gain authority over business systems, attackers can manipulate them like business email compromise (BEC) victims.
-
Adventures in LLM-land: I was Googling for an abstract to a previous talk of mine, and decided to let Gemini g…
Adventures in LLM-land: I was Googling for an abstract to a previous talk of mine, and decided to let Gemini give it a shot since I wasn’t finding it. It couldn’t find it either, but offered to summarize the talk and give me the m…
-
A new feature for my blog, built using my voice
I shipped a new feature for my blog today: the Newsletters page, which offers an index of all of the newsletters I've sent out, both my free weekly Substack and my monthly sponsors-only updates. I built the feature almost entirely…
Last fetch 15m ago · 0 new · 1 source error(s)