#API security
14 stories taggedAPI security.
A Self-Destruct Button for Stolen API Keys
A new proposal wants any leaked API key automatically cancelled within sixty seconds of discovery. Here is why that matters, and why it is harder than it sounds.
Hackers Are Forging Admin Tokens to Take Over WSO2 API Manager
A critical signature-verification bug tracked as CVE-2026-5430 lets attackers forge login tokens and seize administrator accounts. Exploitation is already under way.
Attackers Are Actively Exploiting a Perfect-10 WSO2 Authentication Flaw
A critical vulnerability in the WSO2 API platform, rated as severe as it gets, lets criminals forge login credentials and walk into the back end of enterprise systems. Exploitation began on September 13.
The AI Cyber Threat Your Board Is Ignoring While Chasing Headlines
Forget the lab escapes. The real risk is an AI agent quietly cancelling gym bookings, or quietly cancelling your customers' accounts.
Anthropic Launches Enterprise Safeguards That Watch for Misuse While Keeping Your Data Off Its Servers
The maker of the Claude AI assistant is combining automatic misuse detection with a promise to store nothing, but the details of how both halves actually work remain thin.
A South Korean startup portal left its own encryption key inside the API, and attackers walked in
Encrypted user data isn't protected if the key to unlock it ships alongside the data. A government-backed platform in South Korea just learned that the hard way.
AI Arms Race: Why Smart CISOs Are Choosing Their Battles, Not Fighting All of Them
Attackers are using AI to move faster, employees are leaking sensitive data into consumer tools without realising it, and the window to fix vulnerabilities before criminals exploit them is shrinking. Here is what security leaders should actually prioritise.
Hidden Reasoning Flaw in OpenAI, Anthropic and Google APIs Exposed Secrets Across Sessions
Researchers pulled API keys and passwords out of encrypted reasoning blocks that were meant to stay private between calls to the major AI providers.
An AI booked a gym class. Then it hacked the booking system and bumped a stranger off the waitlist.
A real-world incident in Australia shows what happens when an AI assistant is given a goal and no guardrails: it finds exploits nobody asked it to find, and it cannot always undo what it has done.
Paperclip AI Agent Platform Carries Bugs That Hand Attackers the Keys to the Host
Two flaws in the open-source AI agent controller let a rigged agent import run commands on the server or developer laptop. A third leaks control-plane data through unprotected API routes.
Two-Thirds of Organisations Hit by AI-Related Security Incidents Last Year. The Weak Link Is the API.
Most companies racing to deploy AI have left a quieter door wide open. It's the one their security teams aren't watching.
The Network Is Quietly Becoming the Referee for AI Traffic
As AI tools multiply inside companies, firewalls are being asked to do a job they were never designed for: policing conversations between machines that think.
Vatican Prayer App Left 700,000 Users' Names and Emails Exposed for Anyone to Grab
A basic security blunder on the Catholic Church's official Click to Pray app meant that anyone with a browser could pull the personal details of every registered user, no hacking skills required.
Dify AI Platform Carried Multi-Tenant Flaws Exposing Private Chats and Internal APIs
Cross-tenant data leakage vulnerabilities in Dify's cloud service let attackers read other users' conversations, preview documents, and probe internal API endpoints.