Search: “Reflection AI”

3 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll AI industry 33 AI safety & security 24 Industry 20 Exploit / PoC 16 AI research 11 Research 11 Tools 9 Policy & legal 9 Vulnerability 7 Threat actor 7 Malware 6 Phishing & fraud 5 Model release 5 Advisory 3

SeverityAll critical 9 high 26 medium 21 low 2 info 112

The hidden risks of shadow AI

UK NCSC guidance warns shadow AI use by employees risks data exposure, lost data control, and attacker exploitation of vulnerable AI agents.

The UK NCSC warns that 'shadow AI'—use of AI tools not captured in organizational approved systems—is widespread, with 71% of employees reporting unapproved AI tool use. Risks include exposure of sensitive company and customer data, loss of visibility and control when data goes to consumer AI services, and new attack opportunities if adversaries exploit vulnerabilities in AI agents with access to corporate systems. The NCSC advises reducing rather than eliminating the risk through positive security culture, understanding employee needs, offering secure alternatives, and following its joint guidance on careful adoption of agentic AI services.

NCSC UKSep 7, 12:00 UTC · 9d agoAdvisory

AI-fueled attacks pose ‘active threat’ to water, other sectors, U.S. agencies warn

NSA, CISA, FBI, DOE and EPA warn hackers are using AI-generated scripts to actively attack Siemens S7 PLCs across critical-infrastructure sectors.

A joint cybersecurity advisory from the NSA, CISA, FBI, Department of Energy and EPA warns of an active threat campaign targeting water, food, energy, chemical, manufacturing and commercial facilities via Siemens S7 Series programmable logic controllers. The actors use internet scanning to find exposed or poorly protected PLCs, then deploy AI-generated exploitation scripts disguised as legitimate monitoring tools, an OT first that dramatically lowers the expertise required for ICS attacks. Siemens says no new S7 vulnerabilities are involved, only exploitation of misconfigurations, and it is coordinating with CISA's ProductCERT. The warning follows a joint FBI-EPA advisory confirming attacks at water and wastewater utilities in at least 12 states since July 27.

CyberScoopAug 20, 14:00 UTC · 27d agoAdvisory in the wild1

Schneider Electric Easergy, EcoStruxture, PowerLogic, and Saitel Products (Update A)

CISA updated ICSA-26-169-07: CVE-2026-4827 (CVSS 8.3) insufficient entropy enables session hijacking across dozens of Schneider Electric grid products; fixes available.

CISA republished advisory ICSA-26-169-07 (Update A) for CVE-2026-4827, CWE-331 insufficient entropy in session management, scored CVSS 8.3. Affected lines include Easergy MiCOM relays and C5, EcoStruxure Power Automation (EPAS-GTW, EPAS-UI, iPMFLS), EcoStruxure Power Operation, PowerLogic P5/P7/T300/T500, and Saitel DP/T150 RTUs, with dozens of fixed versions listed. Successful exploitation could enable session hijacking and unauthorized operations on systems in energy, chemical, critical manufacturing, and water sectors. Fixes are available; no exploitation is reported.

CISA AdvisoriesSep 3, 12:00 UTC · 13d agoAdvisory CVE-2026-4827