Search: “Agents API”

106 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 352 Malware 242 AI safety & security 179 Exploit / PoC 132 Ransomware 127 Data breach 107 AI tools & infra 105 Threat actor 101 Policy & legal 76 Phishing & fraud 62 Model release 49 Tools 34 AI industry 33 AI research 22

SeverityAll critical 512 high 354 medium 409 low 83 info 330

Beyond the Perimeter: Building Resilience Against Cloud and SaaS Supply-Chain Attacks

ShinyHunters exploited an Oracle PeopleSoft zero-day to steal data and extort roughly 100 organizations, including the Council of Europe, for up to $2.3M.

Between May and early June 2026, the ShinyHunters group exploited a critical zero-day in Oracle PeopleSoft across about 100 organizations and 300 instances worldwide, per reports cited by The Register. Stolen records included employee and student personal data, payroll, tax, financial and health information, plus immigration and passport documents. AgentCypher.ai estimates extortion demands of $400,000 to $2.3 million per victim, typically in Bitcoin; the Council of Europe refused to pay. The article uses the incident to argue for Zero Trust, supply-chain risk management, rapid patching, encrypted distributed backups and defined recovery-time objectives.

Cyber Security NewsSep 12, 10:46 UTC · 4d agoData breach in the wild1

Astra API Security Platform secures undocumented and vulnerable APIs

Help Net SecuritySep 19, 00:00 UTC · Sep 19, 2025Data breach

Hackers breached six Cisco servers through SaltStack Salt vulnerabilities

Help Net SecurityMay 29, 00:00 UTC · May 29, 2020Data breach CVE-2020-11651 CVE-2020-11652

Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeks

Attackers stole a METR API key via an exposed agent-run EC2 instance and consumed about $600,000 in public model credits over three weeks.

AI evaluation nonprofit METR disclosed two incidents. In March 2026, a fail-open bug in a vibe-coded app disabled authentication on a publicly accessible EC2 instance; an attacker prompted the running agent to reveal a model provider API key, added an SSH key for persistence, and consumed roughly $600,000 in free public-model credits over three weeks without being noticed. In May 2026, attackers probed METR's public infrastructure using agents, automated vulnerability discovery, credential stuffing, OAuth token attempts, and phishing; a separately exposed read-only SQL mechanism found by a bug bounty hunter risked leaking unpublished evaluation data, but no access to non-public data was confirmed.

The Register · SecuritySep 1, 20:45 UTC · 15d agoData breach in the wild1

Attackers Steal METR API Key and Consume AI Credits Worth About $600,000

METR disclosed attackers stole an API key and burned about $600,000 in inference credits, plus a second probing campaign against its infrastructure.

METR, the AI model evaluation non-profit, disclosed two 2026 security incidents. In March, attackers found a publicly exposed EC2 instance behind a fail-open authentication bug, prompted an agent to reveal its API key, added SSH persistence, and consumed roughly $600,000 in inference credits over three weeks. In May, a likely financially motivated actor systematically probed METR's public infrastructure using agents for vulnerability discovery, credential stuffing, OAuth token grants and staff phishing, with no confirmed access to non-public data.

The Hacker NewsSep 1, 09:05 UTC · 15d agoData breach in the wild

Week in review: Acrobat Reader flaw exploited, Claude Mythos offensive capabilities and limits

Help Net SecurityApr 19, 00:00 UTC · Apr 19, 2026Data breach in the wildCVE-2026-34621 CVE-2026-39813 CVE-2026-39808

How to Prevent ChatGPT From Stealing Your Content & Traffic

The Hacker NewsAug 31, 13:52 UTC · Aug 31, 2023Data breach

ThreatNG Cloud and SaaS Exposure Module empowers users with a proactive outside-in perspective

Help Net SecurityMar 2, 00:00 UTC · Mar 2, 2023Data breach

C1 adds shadow AI discovery to its identity governance platform

Help Net SecurityJul 27, 00:00 UTC · Jul 27, 2026Data breach

Authentication and the Have I Been Pwned API

Troy HuntJul 18, 09:38 UTC · Jul 18, 2019Data breach

Sofacy APT hits high profile targets with updated toolset

Kaspersky SecurelistDec 4, 10:59 UTC · Dec 4, 2015Data breach CVE-2015-2590

Wallarm API Attack Surface Management mitigates API leaks

Help Net SecurityAug 22, 00:00 UTC · Aug 22, 2024Data breach

Akeyless introduces AI Agent Identity Security for safer AI operations

Help Net SecurityOct 30, 00:00 UTC · Oct 30, 2025Data breach

authID Mandate Framework establishes governance model for secure agentic AI deployment

Help Net SecurityNov 19, 00:00 UTC · Nov 19, 2025Data breach

PlainID announces Policy Management for Agentic AI

Help Net SecurityMay 28, 00:00 UTC · May 28, 2025Data breach

Spain reports first alleged AI-powered data theft attack

Spain's data protection agency received a report of an AI agent autonomously exploiting flaws, logging in, altering personal data, and reading invoices.

The Spanish Data Protection Agency (AEPD) was notified of an incident in which an AI agent powered by a known LLM reportedly searched for vulnerabilities, gained access to systems, modified personal data, and accessed financial documents. AEPD has not yet investigated or verified the report but says it shows AI-related data breaches are no longer theoretical. The agency urged defenders to revise incident-response procedures, strengthen credential and identity security, and explicitly account for machine-speed AI-assisted attacks.