OWASP co-leads release free RAID-AI ransomware assessment
Users manually rate controls from zero to five; RAID-AI does not connect to systems or verify the answers.
36
- Mentions · 7d3
- Mentions · 30d19
- All mentions38
- First seenAug 14, 2026
- Last mentioned8h ago
Timeline
38 articles · newest firstOWASP: ChatGPT guided a low-skill tester to an admin takeover
On Hack The Box machine Silentium, ChatGPT steered nmap and curl use against a vulnerable Flowise site; autonomous agents did not finish the takeover.
58
OWASP finds AI agents lower the skill bar for parts of hacking
Guide 2.0 tested guided models and agents on two Hack The Box machines released after the models’ cutoffs.
52
Pentera says the harness, not the model, makes agentic pentesting safe
Pentera Apps pairs a model that chooses tests with code that logs, pauses, and stops every action, and ships replayable exploit scripts.
18
DevGuard open-source platform ranks and tracks supply-chain findings
One CLI wraps six scan types, and a registry proxy can block known-malicious npm, Go, and Python packages before download.
32
Roundtable urges closing SDLC identity gaps before expanding AI
Participants say AI-written and non-developer code is outpacing how security is built into development.
18
Salesforce Agentforce intake can pass public email into agent prompts
Researchers say standard Email-to-Case and Flows can reach agent actions without a misconfiguration.
58
Your AI Agent Doesn’t Have MFA
Report says AI agents lack MFA and have already misused credentials and spread malware.
66
12 Best SBOM Tools Compared (2026): Features & Pricing
A 2026 roundup ranks 12 SBOM tools, naming Anchore Syft the best free generator and FOSSA and Cybeats top managers.
28
AI Agent Workflows Could Expose Credentials Through Trusted Developer Tools
Trellix warns AI agent workflows can leak credentials from vaults into commands, logs, and model context.
52
New Agentic AI Red Team Checklist Adds 222 Tests Across 20 Attack Categories
Researcher Ravi Rajput released 222 agentic-AI red-team tests across 20 categories, mapped to OWASP and MITRE ATLAS.
52
A Security Meta-Model for Retrieval-Augmented Generation Systems
A RAG security meta-model catalogs attacks, weaknesses, risks, and CIA impact drawn from 43 papers.
48
Top 10 Best SCA Tools in 2026 [Ranked & Scored]
A 2026 ranking of ten SCA tools places Snyk first, then Sonatype and Endor Labs.
20
How to mitigate the risk from AI-generated apps built by your 'citizen coder' employees
Tenable outlines governance controls to reduce risk from employee-built AI workplace apps.
32
Top 10 Best Fine-Grained Authorization Tools in 2026 [Ranked & Scored]
A 2026 ranking puts Auth0 FGA, SpiceDB, and Permit.io atop fine-grained authorization tools.
16
Containing the Autonomous Operator: A Defense-in-Depth Framework and Reference Architecture for Securing AI Agents on Kubernetes
Framework secures LLM agents on Kubernetes assuming full prompt-injection compromise, mapping seven defense layers to EKS, AKS, and GKE controls.
52
Enterprises Struggle to Prepare for AI and Quantum Threats, PwC Says
PwC survey finds most enterprises unprepared for AI attacks and quantum decryption threats.
46
ModSecurity Vulnerabilities Let Attackers Bypass Web Application Firewall Protections
New ModSecurity flaws let attackers bypass WAF rules via parsing mismatches, bad Base64 handling, and comment obfuscation.
62
Multiple ModSecurity Vulnerabilities Let Attackers Bypass WAF Rules and Execute Malicious Requests
ModSecurity flaws let attackers bypass WAF filename, transformation, and response-body checks.
61
OWASP Noir: Open-source static analysis tool
OWASP Noir statically inventories API endpoints across 29 languages and 205 frameworks, surfacing shadow APIs and hardcoded secrets for reviewers and DAST tools.
28
IAM for AI agents: A Practical Enterprise Framework
Guide proposes an IAM framework for AI agents, treating each agent as a governed non-human identity with scoped, expiring, auditable access.
38
If you do one security check this quarter, make it agent memory
Vectorize CEO Chris Latimer says coding-agent memory keeps API keys in plaintext and can be poisoned via plugins and MCP.
52
API Secrets Should Never Become Tokens in the LLM's Vocabulary: A Threat Analysis of API Credential Handling in LLM Agent Systems and an Empirical Evaluation of a Vault-Mediated Execution Boundary
Researchers show LLM agents can expose API secrets and evaluate a vault that keeps credentials outside the model.
56
CISA outlines improvement plan for CVE program
CISA published a white paper to improve CVE quality as disclosure volume surges.
46
Meta’s Muse AI assistant has a zero-day that can turn it into a Mac backdoor
Patrick Wardle says a local zero-day can redirect Meta Muse dictation traffic and steal its account token.
62
How AI Agents Can Trigger Runaway Costs for Enterprises
Dark Reading warns unbounded AI-agent consumption, sixth on OWASP's LLM Top 10, can drive runaway enterprise costs.
28
The SMB cybersecurity squeeze: AI agents at work, old attacks in overdrive
ESET warns SMB AI agents face malicious skills and prompt injection while classic attacks still dominate breaches.
64
Google Gemini AI Hacked 3 Real Companies during a Cybersecurity Test
Google's Gemini agent accessed systems at three real companies during an Irregular evaluation after accidental internet access and a fictional-name collision.
73
Cyberthreats are moving faster than SMBs: Readiness must accelerate
ESET's SMB Cyber Readiness Index 2026 finds 73% of SMBs adopting AI while 40% lack AI policy, and reports 3,000+ malicious AI agent skills.
25
Hackers Weaponize AI Safety Guardrails to Hide Malware From LLM-Powered Security Scanners
ESET says Russia-aligned actor UAC-0099 hid guardrail-triggering comments in VBScript to derail LLM-based malware scanners in Ukraine.
58
10 most critical LLM vulnerabilities
OWASP updated its Top 10 LLM application vulnerabilities, ranking prompt injection first and elevating excessive agency to third amid agentic adoption.
55
When the prompt becomes the payload: A practical pen-testing guide for GenAI, LLM and RAG applications
CSO Online publishes a practical penetration-testing guide for GenAI, LLM, and RAG applications, covering prompt injection, retrieval poisoning, and tenant isolation testing.
28
Securing AI agents: Key controls and best practices
Security experts warn AI agents with employee-level privileges outpace human access controls and advise layered enforcement, sandboxing, and approval gates.
48
Your AI agent's system prompt is not a security control
AWS and SANS guidance says system prompts are not security controls; enforce user permissions at retrieval time and default-deny every agent tool invocation.
62
What 90 days and a small budget can buy in AI agent security
Versa Field CISO details hidden costs of self-hosting open-weight models and a 90-day AI agent security plan of inventory, blast-radius reduction and testing.
30
One in four MCP servers opens AI agent security to code execution risk
Noma Security whitepaper finds most popular AI Skills and many MCP servers carry high-risk capabilities, with state changes most prevalent.
62
OWASP Flags Top AI Skill Risks in New Security Blueprint
OWASP released a new top 10 security list for AI skills and introduced a Universal Skill Format to standardize security of AI add-ons.
45
The OWASP Top 10 for LLM Applications 2026: From Model Risks to Agentic Security
Akamai analyzes the OWASP Top 10 for LLM Applications 2026, which shifts focus from model-level risks to agentic AI security.
Akamai Blog42
Appears with
- NISTorganization · 5
- OpenAIvendor · 4
- CISAorganization · 3
- Claude Codeproduct · 3
- Googlevendor · 3
- Salesforcevendor · 3
- OWASPvendor · 3
- ESETvendor · 3
- OpenAIorganization · 3
- Anthropicvendor · 3
- ESETorganization · 3
- Veracodevendor · 2
- ModSecurityproduct · 2
- Amazonvendor · 2
- CSO Onlinevendor · 2
- Mendvendor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.