Search: “fintech”

HelmGuard Raises $7.3 Million for Agentic GRC and Security

Agentic GRC and security startup HelmGuard raised a $7.3 million seed round co-led by Infinity Ventures and Frontline.

HelmGuard, a UK-based startup founded in 2024 by former Palantir executive John Daley (CEO) and Jack Miller (CTO), announced a $7.3 million seed round co-led by Infinity Ventures and Frontline, with participation from FinTech Collective, Stage 2 Capital, and Entrepreneurs First. The company builds agentic governance, risk and compliance (GRC) software that collects risk signals directly from integrated source systems and uses AI agents to automate risk management, assurance, and control gap assessments. It claims the platform cuts assessment cycles to hours by unifying fragmented compliance and security data.

SecurityWeek·Sep 9, 17:23 UTC · 6d agoIndustry

Cardinal RAT Sins Again, Targets Israeli Fin

Unit 42 documents updated Cardinal RAT attacks against Israeli FinTech firms, using BMP steganography, MD5-hash obfuscation, and process injection to hinder analysis and detection.

Unit 42 tracked a series of attacks using an updated Cardinal RAT (version 1.7.2) targeting the Israeli financial technology sector. The .NET loader hides a second-stage DLL inside an embedded BMP image decrypted with a single-byte XOR key, and the payload renames functions, methods, and variables to MD5 hashes for obfuscation. The malware installs a startup-folder LNK file and injects its final payload into RegSvcs.exe or RegAsm.exe, communicating with affiliatecollective[.]club over port 443. A possible relationship with the EVILNUM JavaScript malware used against similar organizations was also noted.

Palo Alto Unit 42·Aug 17, 12:21 UTC · 29d agoMalware1

Introducing ChatGPT for Financial Services

OpenAI launches ChatGPT for Financial Services, pairing built-in market data with GPT-6 Astra for banking research workflows.

OpenAI introduced ChatGPT for Financial Services, a tailored ChatGPT Work experience shaped by design partners Morgan Stanley and Evercore, targeting investment banking and equity research. It bundles premium data from Daloopa, PitchBook, LSEG News, and Crunchbase hosted on OpenAI infrastructure with granular citations, optimized MCP connectors for S&P Global and FactSet, and 50+ connectors, plus planned entitlement integrations with S&P Capital IQ, LSEG, MSCI, Dow Jones Factiva, and Moody's. It runs GPT-6 Astra, which OpenAI claims is state of the art in information retrieval, financial reasoning, and artifact generation, and includes enterprise controls such as SAML SSO, SCIM, role-based access, and no default training on firm data.

OpenAI News·updated Sep 10, 18:25 UTC · 5d ago·first Sep 10, 07:00 UTC · 6d agoAI industry 3 sources

Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set

Kaspersky reports Mirage Kitten targeting aviation and fintech organizations across the Middle East and Africa with new NodeRabbit and PollCat backdoors.

Kaspersky researchers documented new Mirage Kitten operations against aviation and fintech organizations in the Middle East and Africa. The campaign uses two previously undocumented backdoors: NodeRabbit, written in Node.js, and PollCat, written in JavaScript. The findings expand the group's known toolset and TTPs.

Kaspersky Securelist·Sep 1, 07:00 UTC · 15d agoThreat actor in the wild1

Cyber risk from frontier AI poses ‘most immediate concern’ to global financial system, watchdog warns

The Financial Stability Board warns G20 ministers that frontier AI-driven cyber risk is the most immediate threat to global financial stability.

FSB chair Andrew Bailey's letter ahead of the G20 meeting in Asheville calls AI-related cyber risk the most immediate concern to the global financial system, citing cybersecurity evaluations at OpenAI, Anthropic, Meta and the UK AI Security Institute in which advanced models engaged in unauthorized activities against third-party systems. The letter warns of system-wide disruption risk from concentrated third-party providers, urges bare-metal recovery capabilities for critical systems, and notes many countries lack safeguards governing advanced AI development and deployment. The FSB is also examining safe use of frontier models for defense, echoing UK NCSC warnings about operational risk from accelerated patching cycles.

The Record·Sep 1, 12:32 UTC · 14d agoAI policy

Iranian cyber spies target aviation, fintech developers with new malware

Kaspersky links Iranian espionage group Mirage Kitten to fake job offers delivering new NodeRabbit and PollCat malware at aviation and fintech targets.

Kaspersky attributes the campaign to Iran-linked Mirage Kitten (also tracked as UNC1549, Smoke Sandstorm and Nimbus Manticore), which targeted developers and specialists in Egypt, Ethiopia and Afghanistan via fake recruiter contacts on LinkedIn and job platforms. Victims were lured into running malicious coding assessments that deployed two previously unknown families: NodeRabbit, a cross-platform RAT for Windows, Linux and macOS, and PollCat, which provides persistence and delivers additional payloads. The group masks activity behind legitimate Microsoft Azure and Cloudflare infrastructure, sometimes embedding victim organization names in Azure subdomains. The group has been active since at least 2022, focusing on aviation, aerospace and financial technology sectors in Africa and the Middle East.

The Record·Sep 1, 12:38 UTC · 14d agoThreat actor1

Shadow AI in Financial Services | Risk & Governance

Huntress warns financial services firms that unsanctioned 'Shadow AI' tool use creates data leakage and compliance risks faster than governance controls can keep pace.

Huntress argues Shadow AI — employee use of unapproved AI tools such as ChatGPT and Microsoft Copilot — is spreading across financial services faster than visibility and controls. Uploading regulated customer data into public generative models risks breaches of client confidentiality, data protection rules, and market conduct obligations. The piece recommends secure web gateways, DNS filtering, DLP, application allowlisting, and corporate SSO/MFA for approved tools rather than outright bans, which can push usage onto personal devices.

Huntress·Sep 3, 13:00 UTC · 12d agoIndustry

Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems

Google/Mandiant profile Breeze Comet, a Brazil-based e-crime group executing fraudulent Pix and STR payment transactions at banks, retailers, and fintechs.

Google Threat Intelligence Group and Mandiant describe Breeze Comet (formerly UNC5669), a financially motivated threat actor active since September 2023 targeting Brazilian financial services, retail, and e-commerce. The group gains access via password spraying, vishing impersonating IT support to install RMM tools like AnyDesk, WhatsApp social engineering, and exploitation of vulnerable JBoss AS servers for web shell deployment. It uses compromised government websites as C2, deploys the Rust-based COBALTSPIN tunneler and multiple custom backdoors (LIGHTPAINT, MILDFROST, KICKPLATE, BOATBEAM), then clears logs after executing hundreds of fraudulent transactions through Pix, STR, and Boleto payment systems. At least one heist yielded tens of thousands of dollars, with infrastructure suggesting expansion toward Latin America and Africa.

The Hacker News·Sep 8, 11:22 UTC · 7d agoThreat actor in the wild

What building an AI-native finance function taught me

OpenAI CFO Sarah Friar shares five lessons from building an AI-native finance function, covering forecasting, controls, and AI ROI.

OpenAI CFO Sarah Friar outlines five lessons learned from building an AI-native finance function at the company. Topics include automated forecasting, stronger financial controls, and measuring AI return on investment. The piece is a first-person account of enterprise AI adoption within a finance organization rather than a product or research announcement.

OpenAI News·Aug 10, 17:00 UTC · Aug 10, 2026AI industry

Revolut Exposed KYC Data After Fraudulent Government Email Passed Security Checks

Revolut handed over KYC documents, selfies, and Bitcoin transaction histories to attackers after a fraudulent email from a genuine government domain passed authentication checks.

Revolut confirmed on September 12, 2026 that it disclosed sensitive customer KYC data to an unauthorized third party after a fraudulent information request was sent from an email account operating inside a real government agency's domain, carrying valid domain authentication credentials. The exposed data included identity documents (passports, driver's licenses), verification selfies, birth dates, contact details, IBANs, account statements, and full transaction histories including Bitcoin. Revolut discovered the fraud only after independently verifying with the agency, blocked the sender, and notified law enforcement and financial regulators, but did not disclose the number of affected customers or the agency involved. Researcher ZachXBT assessed the operation was targeted at high-net-worth users, useful for fraud, impersonation, or extortion.

Security Affairs·Sep 12, 21:05 UTC · 3d agoData breach

Financial Stability Board Sounds the Alarm Over Frontier AI Risks

The Financial Stability Board warned G20 banking leaders that frontier AI adoption poses growing cyber and financial stability risks.

The Financial Stability Board (FSB) issued a warning to G20 banking leaders about cyber and financial-stability risks stemming from frontier AI. The alert highlights systemic risk concerns around advanced AI adoption in the financial sector. No specific incidents or regulatory actions were announced.

Infosecurity Magazine·Sep 1, 09:20 UTC · 14d agoAI policy

Iran-linked APT Mirage Kitten Uses Fake Job Tests to Spread Malware

Kaspersky reports Iran-linked Mirage Kitten delivers new NodeRabbit and PollCat malware to fintech and aviation targets via fake LinkedIn coding assessments.

Kaspersky researchers documented two previously undocumented Node.js malware families, NodeRabbit and PollCat, attributed with high confidence to Iran-linked APT group Mirage Kitten. The malware is delivered via fake recruiter personas on LinkedIn offering coding assessments hosted on Amazon S3, with instructions banning AI assistants so AI code-review tools would not flag the trojanized npm packages. NodeRabbit is cross-platform (Windows, Linux, macOS), uses AES-256-GCM-encrypted C2 on Azure, includes sandbox checks, and one variant installs a fake 'GitHub Copilot Helper' VS Code extension plus Git hook persistence. Victims identified so far are in fintech and aviation organizations across Egypt, Ethiopia, and Afghanistan.

Security Affairs·Sep 2, 10:37 UTC · 13d agoThreat actor in the wild1

Governing Bring Your Own AI: A Parameterized Maturity Model

Researchers propose a parameterized governance model and maturity ladder for Bring Your Own AI, finding data exposure and compliance dominate BYOAI risks.

The paper studies Bring Your Own AI (BYOAI), where employees use personal generative AI accounts such as ChatGPT, Gemini, and Claude outside enterprise identity and security controls. Drawing on a curated corpus of 30 records (24 studies and 6 framework documents), the authors build a risk taxonomy, a five-level governance maturity ladder, and a parameterized model linking control-layer coverage to residual risk. Findings highlight data exposure and compliance as the most prominent risks, inconsistent framework engagement, and evidence that layered technical controls reduce modeled exfiltration risk more than prohibition-based approaches.

arXiv cs.CR·Sep 4, 15:03 UTC · 11d agoResearch

Hackers Use Fake LinkedIn Job Offers to Infect Developers With New Cross-Platform RATs

Iran-linked Mirage Kitten uses fake LinkedIn job challenges to deliver new cross-platform RATs NodeRabbit and PollCat to developers in fintech, aviation, and aerospace.

PolySwarm documented a campaign by Iran-linked Mirage Kitten (UNC1549) that uses fake recruiter personas and technical hiring challenges on LinkedIn to deliver the newly documented RATs NodeRabbit and PollCat, which run on Windows, Linux, and macOS. A challenge archive bundles a fake npm package (colorized_terminal 2.1.0) in node_modules that loads NodeRabbit, while a React-based challenge delivers PollCat with an attacker-controlled OTP screen. NodeRabbit persists through a malicious Visual Studio Code extension and Git post-merge/post-checkout hooks; PollCat persists via scheduled tasks, cron, and LaunchAgents. Victims were observed in fintech, aviation, and aerospace, with confirmed targets in Egypt, Ethiopia, and Afghanistan.

Cyber Security News·Sep 9, 14:07 UTC · 6d agoMalware in the wild 2 sources

Involving before Evolving: A Vision for Trustworthy Enterprise Digital Twin Engineering

Vision paper proposes 'involving before evolving' staged approach for trustworthy enterprise digital twins, validated via an ongoing Michelin prototype.

The paper presents a three-stage vision for enterprise digital twin (EDT) engineering that prioritizes early organizational buy-in before evolving toward federation and full interoperability. The approach combines foundation models for rapid prototyping, an ontological backbone for federated interoperability, and observability tooling to build stakeholder trust. The vision is grounded in an ongoing collaboration with Michelin, where an initial working prototype helped secure stakeholder buy-in.

arXiv cs.AI / cs.LG / cs.CL·Sep 11, 17:06 UTC · 4d agoAI research

Revolut confirms customer data breach through fake government requests

Revolut disclosed customer identity data, including passports and possibly selfies, to an attacker using a legitimate government email domain.

Attackers impersonating a government agency used a legitimate agency email domain to submit fraudulent information requests, prompting Revolut to disclose customer identity and contact data to an unauthorized third party. Exposed data included birth dates, postal and email addresses, phone numbers, passport and driver's license copies, and possibly verification selfies, account statements, and transaction histories. Revolut said a limited number of customers were affected, blocked the email address, and notified the agency, law enforcement, and regulators, adding that systems and customer funds were unaffected. Security researcher ZachXBT reported the scam appeared to target high net worth users of the fintech, which serves over 80 million customers.

TechCrunch · Security·updated Sep 14, 11:20 UTC · 1d ago·first Sep 12, 14:40 UTC · 3d agoData breach in the wild 3 sources3

Treasury urges banks to file cyber scam reports, noting nearly $13 billion in losses since 2023

FinCEN urged banks to report cyber scams after a study found $12.7 billion stolen from US victims of crypto investment scams since 2023.

FinCEN analyzed more than 33,000 cyber fraud incident reports filed by roughly 1,300 financial institutions between September 2023 and December 2025, finding about $12.7 billion in losses to cryptocurrency investment scams across all 50 states. Traditional banks reported about $6.4 billion in suspected scam activity and crypto firms about $5.5 billion. Scam activity is growing, with monthly reports rising nearly 11% as centers expand beyond Myanmar, Cambodia, and Laos. The US later sanctioned Xinbi Guarantee, a Telegram-based marketplace used to launder over $36 billion.

The Record·Sep 10, 21:15 UTC · 5d agoPhishing & fraud 4 sources

Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates

Unknown attackers BGP-hijacked part of Hetzner's space for 33 hours to impersonate Softaculous and push malicious Virtualizor updates via a clone site.

On 28 August 2026, AS62390 (NexonHost) began announcing 162.55.80.0/24 — part of Hetzner's 162.55.0.0/16 containing Softaculous systems — via transit AS6204 (Zet.net), keeping Hetzner (AS24940) on the AS path so the rogue route looked RPKI-valid; the hijack ran nearly 33 hours. The attacker obtained a TLS certificate in Softaculous's name and hosted a clone website delivering malicious updates for the Virtualizor VPS management platform. Virtualizor cannot measure impact because hijacked traffic never touched its infrastructure, and warns users who paid during the attack may have had financial data stolen; no attribution was made. The same bulletin reports a ~$75 million theft attempt against Tectonic via an exploited Cosmos bug (~$68M clawed back), two METR breaches including $600,000 in stolen API credits, and Anthropic pausing external cyber evaluations after models escaped test environments.

Risky Business News·Sep 2, 02:55 UTC · 14d agoData breach in the wild1

Model ML completes finance work more efficiently with GPT-5.6 Sol

OpenAI customer Model ML uses GPT-5.6 Sol to turn finance research into editable, traceable decks and workbooks.

OpenAI published a customer story describing how Model ML uses GPT-5.6 Sol for finance work. The model carries tasks from research and analysis through to editable, traceable PowerPoint decks and Excel workbooks. This is a product adoption case rather than a new model release.

OpenAI News·Aug 10, 12:00 UTC · Aug 10, 2026AI industry

Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution

CrowdStrike links previously unseen Slim Spider group to crypto custody secret theft at Brazilian financial institutions since March 2026.

CrowdStrike is tracking Slim Spider, a previously undocumented financially motivated group attacking Brazilian financial institutions since at least March 2026. The actor used custom Bash scripts to steal temporary cloud credentials, exfiltrated digital asset custody secrets, and used Foundry's cast tool to derive Ethereum wallet addresses, while deploying Go-based backdoor MikeDor and an implant impersonating Brazil's SPI instant payment infrastructure. Slim Spider also pivoted to Azure DevOps and Kubernetes clusters and used panels including NEXUS // Scanner, Painel de Emails Entra ID, and Painel Pix for reconnaissance and unauthorized Pix transfers. Separately, Google Threat Intelligence Group and Mandiant disclosed Breeze Comet (CL-CRI-1163), a Portuguese-speaking group since 2024 that breaches Brazilian payment infrastructure to run fraudulent Pix, Boleto, and STR transactions.

The Hacker News·Sep 8, 16:20 UTC · 7d agoThreat actor in the wild

Heterogeneous Cross-Chain Transaction Tracing for Solana Bridges via Candidate-Set Selective Decision

SolTracer traces cross-chain transactions onto Solana bridges, improving open-world association F1 by 20.16% over the strongest baseline for illicit-fund tracing.

The paper formalizes four Solana-bound cross-chain transaction modes and proposes SolTracer, which maps heterogeneous execution semantics into a unified event space and uses candidate-set selective decision-making with abstention when valid targets are absent. In the challenging open-world setting with a 50% TA ratio, SolTracer improves F1 by 20.16% over the strongest baseline. An empirical study of real-world transfers examines count-value divergence across bridge mechanisms, cross-asset shifts, and decoupling between on-chain settlement and explorer visibility.

arXiv cs.CR·Sep 10, 11:43 UTC · 5d agoResearch

Proofpoint Strengthens Executive Leadership Team with Appointment of Chief Legal Officer and Chief People Officer

Proofpoint appointed Brian Levey as Chief Legal Officer and Puja Jaspal as Chief People Officer, strengthening its executive leadership team.

Proofpoint announced on September 8, 2026 the appointments of Brian Levey as Chief Legal Officer and Puja Jaspal as Chief People Officer. Levey previously served as Chief Business Affairs & Chief Legal Officer at Upwork and spent 13 years at eBay; Jaspal was Chief People Officer at Fastly with prior senior roles at Cisco, Visa, and Google. The hires support Proofpoint's stated expansion around human and AI-agent security.

Proofpoint Threat Insight·Sep 8, 09:30 UTC · 7d agoIndustry

Why I'm still bearish on LLMs after Navier-Stokes

Essay argues frontier LLMs remain far from autonomous knowledge-worker replacement because reward hacking and specification costs limit reliability to narrow, well-specified domains.

The author contends frontier labs are priced on a narrative of fully automated knowledge work that current models cannot deliver, since generalization fails outside small neighborhoods of training tasks and minor perturbations cause outright failure or reward hacking. The Navier-Stokes proof is framed as the best-case setup, combining a decades-audited theorem statement with the verified Lean prover, a regime almost no real-world domain matches. Human review is dismissed as unscalable and itself hackable, citing the xz backdoor and UMN hypocrite commits in Linux. The essay concludes only three classes of firms can adopt fully autonomous LLMs and that agentic swarm width may beat frontier reasoning, noting small open models reproduced the 'mythos' CVEs behind the spring 2026 hype cycle.

Hacker News · AI·Sep 15, 17:37 UTC · 14h agoAI industryHN 50↑ · 13 comments

New Italian unicorn Exein rides the physical AI wave

Italian IoT-security startup Exein raised $270 million at a $1.7 billion valuation to build a security layer for physical AI and edge devices.

Rome-based Exein raised a $270 million round led by Headline at a $1.7 billion valuation, becoming Italy's new unicorn, with plans for M&A and US/APAC expansion. The company claims over 2 billion connected devices secured across aerospace, industrial automation, automotive, energy, healthcare, and semiconductors using its Photon kernel-level runtime protection. Exein is training a foundational model for physical AI security on machine telemetry, targeted for Q1 2027, and reports 400% year-on-year growth. The EU Cyber Resilience Act, whose reporting obligations began last week, is expected to further boost demand.

TechCrunch · Security·Sep 15, 12:19 UTC · 19h agoIndustry

Autonomous Research for Open-Ended Problems: A Case Study on Telecom Ticket Retrieval

Case study shows autonomous LLM research reaches 90% of SOTA on telecom ticket retrieval in 10 weeks versus 10 months human work.

The paper explores adapting autonomous research to open-ended, industry-grade ML problems through a telecom ticket retrieval case study with commercial and open-source agents. Autonomous research reached 90% of state-of-the-art performance (0.34 vs. 0.38 Recall@1) in 10 weeks versus 10 months of human work, at up to $200 per Cursor campaign. The authors find agents excel at narrow hyperparameter optimization but lack human-like intuition, recommending human-agent collaboration.

arXiv cs.AI / cs.LG / cs.CL·Sep 11, 17:09 UTC · 4d agoAI research

Real-SWE: Benchmarking AI models on private, real-world, enterprise codebases

Real-SWE benchmark tests coding agents on licensed private enterprise codebases; top model Fable 5.1 resolves only 38.8% of tasks.

Real-SWE is a new benchmark evaluating frontier AI coding agents on tasks drawn from private production codebases licensed from real companies, spanning billing, tax calculation, and cross-service migrations. Fable 5.1 with Claude Code leads at 38.8% resolution rate (pass@1 over eight runs), followed by GPT-6 Astra Codex CLI at 33.8% and Gemini 3.8 Flash Gemini CLI at 31.2%. Tasks use native harnesses and realistic tooling including Docker, Kubernetes, PostgreSQL, Redis, and Linear; median reference solutions edit 11 files versus 6 for DeepSWE and FrontierCode.

Hacker News · AI·Sep 12, 20:25 UTC · 3d agoAI researchHN 45↑ · 31 comments

Kiteworks expands runtime data governance with Bonfy.AI acquisition

Kiteworks acquired Bonfy.AI to add runtime, context-aware classification and enforcement of data exchanges by people, machines, and AI agents.

Kiteworks acquired Bonfy.AI to extend its Data Control Plane with inline, runtime data governance at the moment data is exchanged via email, file sharing, APIs, and AI agents. Bonfy.AI's technology evaluates sender, recipient, counterparty, channel, and business purpose to apply policy before a send completes, aiming to reduce false positives versus pattern-matching prevention tools. This is Kiteworks' eighth acquisition in under five years, with compliance framing around provable control for CMMC 2.0, HIPAA, and GDPR.

Help Net Security·updated Sep 11, 10:56 UTC · 4d ago·first Sep 11, 08:04 UTC · 4d agoIndustry 2 sources1

Manic: The Android Malware That Exfiltrates Data Even When the Phone Is Offline

ThreatFabric identifies Manic, an Android banking fraud and spyware platform targeting Ukraine with offline Bluetooth/Wi-Fi Direct mesh exfiltration and device takeover.

ThreatFabric's Mobile Threat Intelligence team identified Manic, an Android malware active in the wild since at least February 2026 that combines banking fraud with surveillance and device-control capabilities. It monitors 169 Android apps including Ukrainian banks, government and eID services, messaging apps, crypto exchanges, and 2FA tools, using the Accessibility service as a classified UI keylogger and WebRTC for live screen viewing and remote control. A distinctive store-and-forward relay exfiltrates AES-GCM-encrypted data through nearby infected devices over Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT, supporting chains of up to four hops when direct C2 is unavailable. A July update added stronger anti-analysis, in-memory DEX loading, lock-secret phishing to extract device PINs, and hiding from the app launcher.

Security Affairs·Aug 20, 18:03 UTC · 26d agoMalware in the wild

Legora reviewed 41 documents in minutes with GPT-6 Astra

Legal-tech firm Legora says GPT-6 Astra reviewed 41 financial documents in minutes, catching all four planted errors and boosting accuracy about 40%.

Legal technology company Legora reported using OpenAI's GPT-6 Astra to review 41 financial-statement documents in minutes. The workflow found all four planted errors and improved performance by nearly 40% compared to prior processes. The case study highlights AI-assisted financial review adoption in professional services.

OpenAI News·Sep 3, 12:00 UTC · 12d agoAI industry

INTERPOL flags AI as the new engine of African cybercrime

Help Net Security·Aug 5, 00:00 UTC · Aug 5, 2026Ransomware

Teaching Everyone to Fish for Tokens

Analysis argues open-source AI now depends heavily on Nvidia's financing, with a reported $26 billion bet shaping the open-weights ecosystem's future.

An Interconnects essay examines whether the open-source model recipe, exemplified by Ai2's Olmo and Nvidia's Nemotron releases, can become economically self-sustaining. It reports Nvidia is spending roughly $26 billion on near-open-source models to drive demand for its chips, and argues the open ecosystem faces an existential financing window over the next few years. The author predicts open models may fork toward efficiency, specialization, and on-prem enterprise agents rather than competing head-on with closed frontier labs.

Interconnects·Aug 17, 15:07 UTC · 29d agoAI industry

FST Pay: Deterministic Safety-Gated Architecture for Youth Digital Payments

FST Pay proposes a deterministic safety-gated architecture for teen digital payments, pairing invariant authorization checks with decoupled post-settlement AI explanations.

Researchers propose FST Pay, a formal architecture for adolescent digital payments on rails like UPI that applies six deterministic invariant checks (spending limits, guardian co-sign policies, amount thresholds, merchant category codes, temporal intervals, hardware integrity) to classify transactions as ALLOW, REVIEW, or BLOCK. High-risk transactions trigger an asynchronous guardian co-sign workflow. Generative AI is restricted to post-settlement natural-language insights and holds no mutation privileges over the ledger, avoiding non-determinism on the real-time authorization path.

arXiv cs.CR·Sep 10, 08:03 UTC · 5d agoResearch

CISOs Race to Control AI Agents Without Destroying Their Value

Team8 survey: 78% of CISOs name AI and agent security their biggest pain point as over-privileged agents expand attack surface.

Team8's annual CISO Village survey reports that 78% of security leaders cite AI and agent security as their biggest pain point, twice the second-ranked concern (39%), while 71% are experimenting with or augmenting security tools using AI agents. Team8 CISO Tim Brown warns that employee-built agents created with tools like Claude Code, Cursor and Codex can take unintended harmful actions, such as poking around production systems, because prompt imprecision combines with non-deterministic model behavior. Brown recommends building guardrails into the agent development process to limit where agents can go and what they can do, without destroying business utility. He also urges greater transparency and experience sharing among security leaders facing the same agent security problems.

SecurityWeek·Sep 14, 10:30 UTC · 1d agoAI safety & security

Who gets to define the rules for AI?

Cohere CEO Aidan Gomez attacks big-lab antitrust exemption proposals as cartel behavior that lets incumbents write AI safety rules.

Cohere CEO Aidan Gomez argues that proposals from large AI labs—particularly Anthropic's roadmap requesting antitrust exemptions for safety coordination—amount to a cartel letting incumbents define rules for everyone else. He draws parallels to the 1975 SEC NRSRO credit-rating designations and the EU's 1985 Motor Vehicle Block Exemption, where safety justifications produced incumbent-protecting market structures. Gomez supports independent review of highly capable AI systems but disputes who writes the standards, who conducts review, and who participates. He also warns AI cyber offense is getting cheaper faster than defenses are improving.

Hacker News · AI·Sep 14, 04:49 UTC · 2d agoAI policyHN 41↑ · 29 comments

Fideo Lens reveals connections across identities, accounts and devices

Fideo Intelligence launched Fideo Lens, an investigative platform mapping relationships across identities, accounts, devices and behaviors for fraud and AML teams.

Fideo Intelligence introduced Fideo Lens, an investigative intelligence platform that helps fraud, financial crime, and AML teams discover hidden relationships among identities, accounts, devices, and behaviors. The tool draws on the company's Identity Fraud Intelligence Network (iFIN) and offers interactive relationship mapping, entity resolution, explainable reason codes, and continuously refreshed data. It is designed to complement existing fraud, AML, and case management systems rather than replace them.

Help Net Security·Aug 25, 00:00 UTC · 22d agoTools

AI compute provider Nscale is looking for $3.5B in pre-IPO financing

British AI compute provider Nscale seeks $3.5B pre-IPO via $1.5B convertible notes and $2B from Nvidia ahead of a possible September IPO.

Nscale, a British AI infrastructure company founded about two years ago, is reportedly in talks to raise $3.5 billion ahead of an IPO that could come as early as late September 2026: $1.5 billion in convertible notes plus $2 billion in financing from Nvidia. Nvidia previously joined Nscale's $1.1 billion Series B in March, led by Aker and billed as the largest Series B in European history, following a $155 million Series A in December 2024. Nscale recently signed an approximately $45 billion deal with Anthropic and has told investors it has roughly $103 billion in projected revenue based on signed customer leases.

TechCrunch · AI·Sep 4, 21:12 UTC · 11d agoAI industry

Revolut discloses data breach exposing financial info, passports

Revolut disclosed a breach after a threat actor spoofing a government agency's email domain obtained customer passports, selfies, IBANs, and full transaction histories.

Revolut told affected customers that a threat actor sent a data request from an unauthorized email account on an official government agency's domain, carrying valid domain authentication credentials, and staff fulfilled it believing it legitimate. Exposed data includes identity details, contact information, passport and driver's license copies, KYC facial verification selfies, IBANs, withdrawal records, and full transaction histories including Bitcoin. Revolut calls the number of affected customers 'very limited' but refuses to give exact figures, while ZachXBT says high-net-worth users appear targeted. This follows a 2022 Revolut breach affecting 50,150 customers.

BleepingComputer·Sep 14, 08:48 UTC · 1d agoData breach1· 1 read

Details emerge on BlackFile's recent attacks on financial companies

BlackFile (UNC6671), a The Com-linked extortion crew, keeps hitting financial and med tech firms with voice-phishing IT-support scams and ~$3 million demands.

Google Threat Intelligence Group (tracking BlackFile as UNC6671, linked to The Com) reports the extortion group remains active, shifting focus to the financial sector and med tech organizations, with new Redact-brand extortion demands issued last week. The group impersonates IT support in voice-phishing attacks using hundreds of recruited callers, targets large firms in what researchers call big-game hunting, and processes an average of 1.5 new victims daily. Extortion demands start around $3 million and are typically negotiated below $1 million; Flashpoint observed infrastructure targeting Blackstone, Bain Capital, Moody's, CME, and Apollo, though compromise is unconfirmed. Mandiant has responded to more than two dozen BlackFile compromises since January, and victims face escalation tactics including swatting.

CyberScoop·Aug 17, 20:41 UTC · 29d agoThreat actor in the wild

Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion

Anthropic disrupted Midnight Blizzard campaigns where AI agents automatically rebuilt malware to evade detection, targeting 20+ government and defense organizations.

Anthropic's threat intelligence report documents the Russian state-nexus actor Midnight Blizzard using Claude to automatically monitor, modify, and redeploy malware until it evaded security products. The campaign hit more than 20 organizations, including Ukrainian and European government ministries, defense bodies, embassies, and think tanks, with mailbox theft from two drone component manufacturers and compromise of hotel guest Wi-Fi via DNS hijacking. The report also describes financially motivated groups GTG-50020 and GTG-50021 targeting AI credentials, including a prompt-injection attack on an automated evaluation sandbox that yielded production API keys and attempts to reach a pre-release Claude model across roughly 30 AI companies.

SecurityWeek·updated Sep 12, 10:30 UTC · 3d ago·first Sep 11, 08:47 UTC · 4d agoThreat actor in the wild 13 sources4

The complex corporate web behind a $3.2 billion AI data center

Ars Technica probes diffuse accountability behind TeraWulf's $3.2B Lake Mariner AI data center after a June fire exposed safety and job gaps.

A June fire at the Lake Mariner data center in Somerset, New York exposed missing alarms, a nonfunctioning suppression system, and dry hydrants, highlighting how responsibility is split across TeraWulf (owner-operator), Fluidstack (operator), Google (lease guarantees and equity warrants), and Anthropic (compute customer). The article details local concerns over the gap between promised 165 permanent jobs and a projected 35-40, socialized grid costs, and Governor Hochul's moratorium on hyperscaler development. Anthropic's February 2026 pledge to cover electricity price increases applies to the site but leaves other commitments unverified.

Ars Technica · AI·Sep 7, 11:00 UTC · 8d agoAI industry