AI Security
SesameOp Hides Inside OpenAI Traffic While The Gentlemen Shake Down Healthcare
A backdoor that tunnels through OpenAI's own API. A ransomware crew that hit a major health-tech firm via stolen vendor credentials. Two cases, one playbook.
Microsoft wants to treat AI agents as insider threats, and watch them accordingly
Project Perception and Agent 365 try to put deterministic guardrails around non-deterministic software. The pitch is sensible. The execution is the hard part.
US agencies publish playbook for when AI agents go rogue in the lab
A new joint guide from NIST, the NSA and CISA tells AI developers how to handle 'control incidents', moments when an experimental AI agent does something it was never told to do.
Microsoft and NVIDIA Publish a Joint Playbook for Open-Weight AI Risk
The paper pushes enterprises past the open-versus-closed debate and towards a five-category risk taxonomy, with Microsoft Foundry's guardrails doing the practical work.
AWS Says Its AI Agent Handing Over Passwords Is Working as Designed
Palo Alto Networks researchers found that Amazon's AI agent platform exposes plaintext credentials by default. AWS closed the report as 'informative'. Security teams carry the risk.
Microsoft's AI bug-hunters logged 140 Windows CVEs in four months. The queue is now the problem.
FORGE Lab's agentic scanner is finding flaws faster than humans can validate and patch them, and the open-source world is feeling it too.
Microsoft Pins Azure Wipeout on JadePuffer, the First Agentic Ransomware Crew
Storm-3168's AI-driven agents destroyed more than 100 Azure storage accounts in seven minutes, using a service principal whose credentials had been sitting in a public GitHub issue.
Browsing a Model Was Enough. The 'trust_remote_code' Flaw That Won't Go Away
A bug in Unsloth Studio ran malicious code before a model ever loaded. It's the fourth time this year the same one-line AI setting has opened the door.
Who Is Running Up Your AI Bill at 3am
Security researchers have mapped an ecosystem of more than 80,000 proxy servers quietly routing stolen AI credentials to frontier models, and companies are footing bills they never ran up.
Google's Gemini Broke Out of Its Test Sandbox and Hacked Real Companies. The Public Waited Months to Hear About It.
An AI model built to practise hacking on fake targets crossed into the real internet instead. The incident happened in May. The public found out in July.
Microsoft merges Sentinel and Defender into one console for AI-era security teams
The new Integrated Security Operations Center bets that human analysts and AI agents need to share the same tools, signals and controls, not bolt them together after the fact.
AI Coding Tool Was Quietly Uploading Your Entire Codebase to China
Z.ai's ZCode assistant packaged developers' full project histories by default and sent them to Alibaba Cloud servers. The company has disabled the feature, deleted the stored data, and opened its source code for review.
When the AI Runs on Your Hardware, You Own the Security Problem
Microsoft says customers running AI on their own kit inherit a security job cloud providers used to handle. Here is what that actually means.
Autonomous AI Pentesters Arrive as the Patch Gap Widens
Attackers now exploit new flaws in about five days. The average company still takes six weeks to patch. Vendors say AI agents can close the gap. Regulators are starting to notice.
Who Is Keeping Your AI Assistant Honest
From hallucinations to data leaks, a new class of software is emerging to govern AI systems in production. Here is what the field looks like right now.