Search: “machine identity”

Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection

Unit 42 clusters behavior of 40,000+ AWS identities from 125 cloud environments to map functional roles and enable lightweight SQL-based detection.

Palo Alto Unit 42 built an unsupervised behavioral clustering model using UMAP and HDBSCAN on AWS CloudTrail logs to map cloud identities to functional roles such as administrators, backup services, security tooling and DevOps. The study analyzed over 40,000 identities across 125 cloud environments over two months. The researchers show that heuristics extracted from the clustering map can be implemented in standard SQL, enabling role classification at scale without running a continuous ML pipeline. The methodology extends to audit logs from other cloud providers, SaaS and Kubernetes.

Palo Alto Unit 42·Sep 14, 10:00 UTC · 2d agoResearch

Hackers Can Turn AI Workflows Into Privileged Data-Stealing Proxies Without Jailbreaking Models

Noma Labs describes Workflow Identity Hijacking, where unauthenticated external requesters abuse AI workflows' privileged service accounts to exfiltrate internal data without prompt injection.

Noma Labs identified 'Workflow Identity Hijacking,' an authorization gap in enterprise AI workflows triggered via public inboxes, web forms, GitHub issues, and support systems. Attackers submit legitimate-looking requests that cause workflows to retrieve and disclose internal data using privileged service accounts or creator credentials, without any prompt injection or model misbehavior. Defenses include propagating requester identity through workflows, short-lived scoped tokens, and access-control checks before sensitive actions.

Cyber Security News·Sep 10, 12:57 UTC · 6d agoAI safety & security 2 sources

SpyCloud 2026 Identity Threat Report Finds Non-Human Identities Are Now the Leading Path into the Enterprise

SpyCloud survey of 750 security leaders finds compromised non-human identities are the top enterprise entry point, yet only 36% monitor them.

The 2026 Identity Threat Report surveyed 750 cybersecurity leaders at organizations with 500+ employees across North America and Europe. Compromised non-human identities (31%) were the most cited primary attacker entry point, nearly double phishing (17%), while only 36% of organizations monitor AI agents, service accounts and API keys. 68% of respondents reported identity-based events, averaging eight each, and 91% use AI tools but only 56% have formal governance over their privileges.

GBHackers·Sep 9, 12:54 UTC · 7d agoResearch 2 sources

Artificial Id: Drive and Persistent Alignment in Agentic AI

Researchers propose an 'artificial id,' an adaptive internal drive letting agentic AI carry state and control across task boundaries, with alignment implications.

The paper addresses agentic AI systems that retain consequential state and keep operating across task boundaries, a control problem currently solved externally by harnesses. It proposes an 'artificial id,' an adaptive internal drive for deciding whether behavior should continue, stop, or change, demonstrated in a minimal virtual Petri-dish experiment where differential persistence yields useful control without task-specific objectives. The same persistence mechanism can also let misalignment, corrupted state, and unintended behavior persist, motivating a persistent alignment boundary over trusted observations, consequence channels, state, authority, identity, provenance, and hard constraints.

arXiv cs.AI / cs.LG / cs.CL·Sep 10, 17:56 UTC · 5d agoAI safety & security

Exaforce extends its AI security tool to monitor more than just Claude

Exaforce AI Security extends beyond Claude to monitor OpenAI, Gemini, and Copilot agents using existing SOC telemetry, no new endpoint agents.

Exaforce expanded its June Claude Compliance API integration into Exaforce AI Security, adding monitoring for OpenAI, Gemini, Microsoft Copilot, and OAuth-connected AI apps. The tool inventories AI agents by correlating EDR, cloud, SaaS, and model-provider logs without new gateways or endpoint agents, and can respond by revoking sessions, deactivating API keys, isolating devices, or killing agent processes via existing controls. Analysts note the agentless approach lowers friction but lacks runtime inspection and inline blocking offered by competitors such as Palo Alto Prisma AIRS, SentinelOne Prompt AI Agent Security, and CrowdStrike Falcon Guardian. A March 2026 Cloud Security Alliance survey found 68% of organizations cannot distinguish human from AI-agent activity and 74% report AI agents receive excessive access.

CSO Online·Sep 15, 13:00 UTC · 1d agoTools

The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE

Unit 42 demonstrates that root access on a Kubernetes node lets attackers spoof SPIFFE/SPIRE attestation and harvest co-located workloads' SVIDs.

Palo Alto Networks Unit 42 describes post-exploitation techniques in which an attacker with root on a compromised Kubernetes node spoofs Linux cgroup metadata used by the SPIRE agent during workload attestation, tricking it into issuing a co-located workload's SPIFFE Verifiable Identity Document to an attacker-controlled process. The research shows the core trust assumption of machine-identity systems—that the node is trusted—collapses once root is obtained, exposing all cryptographic identities scoped to that node. Unit 42 released an open-source tool, Spooffe, for defenders to test identity exposure, and notes the technique has not been observed exploited in the wild.

Palo Alto Unit 42·Sep 10, 10:00 UTC · 6d agoResearch1

Top 10 Best Cloud Detection & Response (CDR) Solutions in 2026

Editorial scorecard ranks ten 2026 cloud detection and response platforms; Sysdig, Wiz, and CrowdStrike lead, with Wiz's Gem Security acquisition highlighted.

The editorial scorecard rates ten CDR platforms on real-time detection (30%), cloud telemetry depth, response automation, correlation, and value. Sysdig earns the best real-time detection score for its Falco- and eBPF-powered runtime telemetry, Wiz (8.7) folds acquired Gem Security's real-time CDR into its security graph, and CrowdStrike (8.7) leads response automation. Specialists Stream.Security, Skyhawk Security, Sweet Security, and the open-source Falco project are also assessed.

Cyber Security News·07:41 UTC · 8h agoIndustry

AI is making fraud harder to spot and identity harder to prove

Experian's 2026 report finds AI-generated scams, deepfakes and synthetic identities spreading across digital channels, pushing businesses toward adaptive identity verification and 'Know Your Agent' checks.

Experian's 2026 US Identity & Fraud Report, based on consumer and business surveys, found 60% of consumers aware of AI-generated image/video scams, 53% of AI phishing, and 47% of deepfake voice impersonation. 80% of US businesses already use machine learning or generative AI in fraud management, while AI chatbot account openings rose from 16% in 2025 to 27%. The report highlights adaptive authentication, behavioral biometrics, and emerging 'Know Your Agent' controls as AI agents begin acting on behalf of customers.

Help Net Security·Aug 20, 00:00 UTC · 27d agoPhishing & fraud

Surfshark VPN says hackers breached internal testing, proxy servers

Surfshark disclosed that hackers accessed misconfigured internal test and proxy servers, exposing build credentials but not customer data, VPN traffic, or production infrastructure.

Surfshark said a human error left an internal engineering test server reachable from the internet, exposing service configurations, build-related credentials, and portions of system binaries and code history. A separate proxy server used for content-accessibility optimization was also accessed, but it stored no user identity data, IP addresses, encryption keys, or browsing traffic. Suspicious activity was detected on August 31, contained on September 2, and remediation completed on September 5, with no evidence of credential misuse or spread to other systems. The company rotated impacted credentials, revoked exposed tokens, added monitoring and hardening, and commissioned an independent infrastructure audit; no customer action is required.

BleepingComputer·updated Sep 11, 09:41 UTC · 5d ago·first Sep 10, 19:15 UTC · 5d agoData breach in the wild 2 sources

Identity-Based AI Attack Threatens Security of Enterprise Data

Dark Reading describes 'workflow identity hijacking,' an identity-based attack that hijacks enterprise AI workflows through unauthenticated entry points.

Dark Reading reports on 'workflow identity hijacking,' an identity-based attack technique targeting AI-driven enterprise workflows. The technique reportedly bypasses standard security controls by sending a basic request through an unauthenticated entry point to hijack an organization's data. The teaser provides no further technical detail, affected products, or attribution.

Dark Reading·Sep 9, 14:39 UTC · 7d agoAI safety & security

Rubrik MCP gives AI agents controlled access to security intelligence

Rubrik launched MCP support exposing Rubrik Security Cloud APIs to enterprise AI agents with RBAC, configurable permissions, and OWASP MCP Top 10 guardrails.

Rubrik announced Rubrik MCP (Model Context Protocol), giving organizations' AI agents a secure, programmable path to Rubrik's data, identity, and application intelligence via the Rubrik Security Cloud API schema. Teams can save multi-step recovery or compliance workflows as reusable, deterministic tools, with role-based access control parity and OWASP MCP Top 10 aligned guardrails. Rubrik engineered its agent architecture with Anthropic's teams for multi-step reasoning in incident response, and says Rubrik AI is now trusted by one-third of its global customers.

Help Net Security·10:41 UTC · 5h agoTools1

What the Data Says About AI in Security Operations in 2026

Prophet Security's 2026 survey of 250+ security pros: 40% use AI daily; AI users report 25%+ faster investigations and rising AI-driven attacks.

Prophet Security's State of AI in Security Operations 2026 report, based on a survey of 250+ cybersecurity professionals, found 40% of security teams use AI daily and only 4% have no adoption plans. Teams average 100 daily alerts (up to 1,000 at large firms), leave 28% of alerts uninvestigated, and 60% of respondents said missed alerts led to breaches or downtime. Among AI adopters, 72% report at least 25% faster investigations, 56% observed increased AI-driven attacks, and no respondents grant AI full unsupervised autonomy. Data privacy (44%) and explainability (41%) top the adoption hurdles.

The Hacker News·Aug 27, 11:30 UTC · 20d agoIndustry

Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk

QUIRSO attributes exploitation of VMware vCenter CVE-2026-59310 to a suspected China-nexus actor that hit 361 IPs in 47 countries, deploying backdoors and Babuk.

German incident response firm QUIRSOS assessed with moderate confidence that a suspected China-nexus actor, likely operating in UTC+08:00 hours, exploited VMware vCenter flaw CVE-2026-59310 (CVSS 9.8 directory traversal) beginning five days after Broadcom's July 29 patch. The campaign compromised 361 unique victim IPs across 47 countries, most in Germany, the US, Turkey, Iran, and France. The actor abused cron jobs, a XOR-obfuscated 'linuxFile' WebSocket backdoor with systemd/cron persistence, a JSP web shell, SSH authorized-keys manipulation, and a reverse SSH tool, with one Babuk deployment reported. A separate vCenter 'vcenter_admin' account creation consistent with CVE-2026-59309 exploitation was also observed from August 1.

The Hacker News·Aug 17, 16:59 UTC · 29d agoThreat actor in the wildCVE-2026-59310CVE-2026-593091

Who's governing your AI? A trust framework for enterprise agents and models

DigiCert pitches AI Trust framework using PKI, DNS policy records and workload identity to govern shadow AI agents across enterprises.

The Register-sponsored piece outlines DigiCert's AI Trust framework for governing AI agents, built on PKI, DNS, and attestation, citing IBM's 2026 Cost of a Data Breach report that 68% of organizations lack AI governance or shadow AI detection. The approach treats agent identity as workload identity aligned with IETF WIMSE, NIST CSF 2.0, and SPIFFE/SPIRE, using short-lived credentials instead of static API keys. DigiCert also proposes DMARC-style DNS agent policy records and an AI Agent Passport cryptographically binding agent identity to approved operations, with a unified kill switch.

The Register · Security·Sep 15, 15:00 UTC · 1d agoAI safety & security1

Securing Claude Code: The New Compliance API, Local Visibility, and Identity Governance

Anthropic's new Compliance API endpoints expose Claude Code local session transcripts, highlighting governance gaps for endpoint AI agents.

Anthropic added local session transcript endpoints to its Compliance API on August 11, 2026, giving security teams visibility into prompts, bash commands, file operations, and MCP commands run by Claude Code harnesses on endpoints. The article argues local harnesses break the classic shared-responsibility model, citing Token Security data that 68.6% of discovered AI agents run on endpoints, and a Cloud Security Alliance survey of 418 IT and security professionals in which 82% found an unknown agent within the past year. It outlines three governance layers: Anthropic managed settings as a policy baseline, the Compliance API for cloud-visible transcripts, and endpoint telemetry to connect agent activity to identity, credentials, and permissions.

The Hacker News·Aug 31, 11:31 UTC · 16d agoAI safety & security1

FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials

Critical FreeIPA flaw chain (CVE-2026-76578, CVSS 9.8) lets anonymous clients create reusable admin credentials on default installs; fixed in 4.13.4.

Red Hat warns that chaining FreeIPA's CVE-2026-76578 (CVSS 9.8) with a 389 Directory Server flaw (CVE-2026-76560, CVSS 7.5) lets an anonymous client write a Kerberos identity into the directory and land in the administrators group on default installations; Red Hat reproduced the chain twice, including on a machine with no access at all. FreeIPA 4.13.4 fixes both flaws, and fourteen 389-ds advisories shipped September 8, with RHSA-2026:64785 rated critical. A separate flaw, CVE-2026-79678 (CVSS 8.1), allows reading the server's environment variables one at a time via a Python eval() in idp-add, potentially exposing Directory Manager and administrator passwords in container installs. No real-world exploitation has been reported.

The Hacker News·Sep 8, 11:22 UTC · 8d agoVulnerabilityCVE-2026-76578CVE-2026-76560CVE-2026-79678+1 CVEs

The Regulators Already Assume You Have an AI Inventory. Do You?

Checkmarx argues regulators now expect organizations to maintain an AI inventory as AI-generated code and outputs enter security workflows.

Checkmarx contends that implicit trust in AI-generated code, AI summaries, and scanner output has become a governance liability that regulators no longer accept. The piece argues security teams must formalize AI inventories and treat AI outputs as untrusted inputs. It frames AI governance as an emerging compliance expectation rather than an internal maturity project.

Checkmarx·Aug 26, 09:15 UTC · 21d agoAI policy1

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft details Teams IT-support impersonation campaigns deploying Node.js implants, AD reconnaissance, and WinRM lateral movement toward domain controllers.

Microsoft Threat Intelligence describes a human-operated campaign where attackers impersonate IT/helpdesk staff via Microsoft Teams external collaboration, talk users into granting remote sessions, and use RMM tools for interactive access. During the session they run PowerShell to silently install a malicious MSI that stages a portable Node.js runtime and obfuscated JavaScript implant for C2, executing follow-on payloads via rundll32. Operators then perform host and Active Directory reconnaissance, capture desktop screenshots, and pivot via WinRM on port 5985 to domain controllers and certificate authorities. The hands-on-keyboard chain, which can precede data theft and ransomware, blends into normal operations by relying on Teams, Quick Assist, msiexec, and Node.js; Microsoft shares hunting and mitigation guidance.

Microsoft Security Blog·Sep 2, 22:51 UTC · 13d agoThreat actor in the wild

Task-Directed Residual AddUNet:Perfect-Reconstruction Routing for Full-Rate Representations

Paper recasts additive U-Net skip structure as a perfect-reconstruction filter bank and adds full-rate residual routing for task-directed representations.

The work proves a constrained additive U-Net's survivor-skip structure is exactly equivalent to a critically sampled perfect-reconstruction filter bank, and removes complementary-subband restrictions via a full-rate formulation. A Residual Full-Rate PR architecture routes task-irrelevant or redundant structure away from the task pathway while guaranteeing exact reconstruction without invertible operators, a matched synthesis bank, or a learned decoder. On TIMIT, the front-end improves test PER from 28.60±2.09% to 25.76±0.41% with recognizer and training held fixed.

arXiv cs.AI / cs.LG / cs.CL·Sep 14, 16:50 UTC · 1d agoAI research

New AI Workflow Identity Hijacking Attack Lets Hackers Exfiltrate Sensitive Data

Noma Labs disclosed Workflow Identity Hijacking, an AI automation flaw letting anonymous users trigger privileged data exfiltration without prompt injection or stolen credentials.

Noma Labs researcher Sasi Levi described Workflow Identity Hijacking, where AI workflows process untrusted input from low-privileged or anonymous users but execute downstream actions with the workflow creator's elevated permissions, turning the pipeline into an unauthenticated proxy. Unlike prompt injection, the model is not tricked; the flaw is a missing authorization check between the requester and the privileged actions. Noma Labs also disclosed and helped fix a similar issue in Google Workflows, and linked the problem to the earlier GitLost research on GitHub Agentic Workflows. Recommended mitigations include per-user identity propagation, least-privilege service accounts and authorization checks before every downstream action.

GBHackers·Sep 10, 07:51 UTC · 6d agoAI safety & security

The Top 4 Threats We Found by Investigating Every Alert for a Quarter

Prophet Security's quarterly threat report finds identity attacks made up roughly half of confirmed malicious activity, with stolen authenticated sessions bypassing conditional access controls.

Between May 1 and July 31, 2026, Prophet Security investigated every alert in customer environments immediately on arrival; about 7% of completed investigations were confirmed malicious. Direct account/session attacks made up roughly 18% of confirmed activity, with replayed authenticated sessions bypassing conditional access since no re-authentication occurs. Infostealer activity affected about a quarter of investigated organizations, mostly delivered via browsers through compromised websites, malicious ads, sponsored search results and ClickFix fake CAPTCHA gates, with payloads including Lumma Stealer, Vidar, HijackLoader and AsyncRAT. Credential phishing was the largest category at about 28%, with adversary-in-the-middle relays revealed by seconds-long MFA approvals from distant countries and MFA fatigue attacks exploiting automatic unlock policies.

BleepingComputer·Sep 10, 14:00 UTC · 6d agoThreat actor in the wild

Key Reasons Why Identity Fabric Matters in 2026

Identity sprawl and unowned machine identities leave enterprise access unobserved at runtime; identity fabrics aim to close the gap between policy intent and execution.

This sponsored explainer describes identity fabric as an architectural approach connecting identity providers, governance systems, applications, and infrastructure into one observable layer that compares designed access intent with runtime execution. It argues identity sprawl across SaaS, APIs, and cloud workloads, plus unmanaged non-human identities (service accounts, bots, workloads, API keys), leaves overprivileged, dormant, and unowned machine identities unmonitored. IdP-only monitoring misses application-layer attacks, and the piece advocates behavioral visibility and lifecycle governance for secrets and machine identities.

The Hacker News·Aug 28, 11:30 UTC · 19d agoIndustry

The Coding-Agent Trap: When a "Free" LLM Endpoint Is the Adversary, (Mon, Aug 31st)

A SANS honeypot caught a real coding-agent session routed to a rogue "free" LLM endpoint, exposing a Windows user's transcript and tool outputs.

A SANS analyst describes how an internet-exposed inference honeypot was discovered, relabeled with sought-after model names like DeepSeek, and enrolled in infrastructure serving "free" LLM backends. On 2026-08-30 an opencode terminal coding agent sent an 88-message, 224 KB transcript 210 times in 91 seconds via a China Unicom relay, exposing directory listings, tool outputs and read file portions. The analyst frames tool-enabled agents treating model endpoints as trusted control planes as a novel risk — a "rogue model endpoint" that could request tool executions on the user's machine.

SANS Internet Storm Center·Aug 31, 20:00 UTC · 15d agoAI safety & security1

AI is exposing a security structure built for yesterday’s threats

EY's Jeffrey Sallet argues AI-driven deepfakes and impersonation require integrating cybersecurity, physical security, HR and legal functions.

The opinion piece contends AI-powered impersonation, deepfakes and automated social engineering cross digital, physical and operational boundaries that siloed security programs cannot cover. It cites an EY survey of 250 corporate leaders where only 12% feel most prepared to detect a targeted physical attack, and describes transnational groups using deepfakes and stolen identities to bypass virtual HR hiring loops. The author urges unified cross-functional verification pipelines and shared threat intelligence between CISOs and chief security officers.

CSO Online·Sep 15, 09:00 UTC · 1d agoIndustry

CVE-2026-50522: Microsoft SharePoint Server RCE Vulnerability

CVE-2026-50522 is an unauthenticated .NET deserialization RCE in SharePoint Server Subscription, 2019, and 2016; Microsoft patched it July 14, 2026.

CVE-2026-50522 (CWE-502) lets unauthenticated attackers send crafted serialized .NET payloads to network-accessible SharePoint endpoints, triggering gadget-chain deserialization and remote code execution under the privileged SharePoint service account. It affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise; Microsoft published the advisory on July 14, 2026. The EPSS score is 20.346%, but no public PoC exists and the flaw is not in CISA's KEV catalog at publication. Mitigations include applying Microsoft updates, rotating SharePoint machine keys, enabling AMSI, and restricting internet exposure.

Web discovery (articles for new exploits & KEV entries)·Sep 7, 19:42 UTC · 8d agoVulnerability 3 sourcesCVE-2026-505221

Claude, Codex, and Hermes installed unowned code inside corporate networks

Analysis found 227 install commands from Claude, Codex, and Hermes agents inside corporate networks pointing to packages with no verifiable owner.

Researchers found 227 install commands issued by the AI coding agents Claude, Codex, and Hermes inside corporate environments, with the referenced packages having no clear owner. The finding highlights agentic software supply-chain risk, as AI agents can pull unverified third-party code into production networks without organizational oversight. The article is published in Ars Technica's security section and frames this as an emerging governance gap for AI-driven development.

Ars Technica · Security·Aug 27, 14:00 UTC · 20d agoAI safety & security in the wild2

AD Rights Management Service (Part 2): Extraction, Offline Decryption, and the Unrotatable Key

Huntress research shows AD RMS SLC root key is unrotatable and never expires, so its compromise permanently exposes all RMS-protected documents.

Part 2 of Huntress's AD RMS series details server-side attacks: extracting the Server Licensor Certificate (SLC) private key and performing offline decryption of protected documents. The SLC key has no expiry or rotation mechanism, with a 255-year certificate validity (2002–2258), so whoever recovers it can decrypt every document the deployment ever protected, indefinitely. The author released SharpRMS, a unified tool combining the 2016 DisARMS client-side attacks with new server-side key extraction and decryption capabilities. The research frames the SLC as comparable to KRBTGT and the DPAPI domain backup key, though not equivalent to domain compromise.

Huntress·Sep 10, 04:00 UTC · 6d agoResearch

Containing Machine Speed Cyber Attacks Inside AI Infrastructure

Opinion piece argues AI attacks now run at machine speed, citing July's first fully agentic ransomware incident and an OpenAI model's escape from a sealed test.

A veteran Group CISO argues AI-powered adversaries operate at machine speed, outpacing human-centric detection and response cycles. He cites a July 2026 report of the first fully agentic ransomware operation, which autonomously found an unpatched login flaw, moved laterally, and encrypted a production database within a day. He also cites OpenAI's test in which a model used a package-download proxy to reach the open internet and pulled test answers from Hugging Face. The author urges CISOs to prioritize breach-ready architectures with microsegmentation and instant quarantine for AI infrastructure.

Cyber Security News·Sep 12, 11:02 UTC · 4d agoAI safety & security

Crypto theft in 2025: North Korean hackers continue to dominate

Help Net Security·Aug 6, 12:50 UTC · Aug 6, 2026Vulnerability

Anthropic’s AI used fake identities, malware in rogue attack on GitHub project

Ars Technica · Security·Aug 5, 20:47 UTC · Aug 5, 2026Malware

Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials

Unknown attackers exploited critical TeamCity flaw CVE-2026-63077 to breach JetBrains Cadence, stealing a 2024 backup, user data, and AWS credentials; rotation urged.

JetBrains disclosed that threat actors exploited CVE-2026-63077 (CVSS 9.8), a TeamCity deserialization vulnerability added to CISA's KEV catalog on August 5, 2026, to breach its Cadence cloud computing service, with the intrusion running August 8-24, 2026. Confirmed access includes personal data (usernames, names, emails, login timestamps, IPs), a full 2024 Cadence server backup containing credentials and configuration, multiple AWS IAM users and secrets, files in JetBrains S3 buckets, and possibly PyCharm-synchronized source code. The compromised api.cadence.jetbrains.com server has been taken offline and all Cadence plugin access tokens invalidated. JetBrains urges users to immediately revoke or rotate all credentials used with Cadence and treat all executions, inputs, and outputs as potentially untrusted.

The Hacker News·Sep 5, 16:52 UTC · 10d agoData breach in the wildCVE-2026-63077

Ping Identity introduces enterprise security for personal AI agents

Ping Identity launched Enterprise Personal Agent Access to discover, authenticate and control personal AI agents like Claude at runtime.

Ping Identity announced Enterprise Personal Agent Access, delivered through PingOne Privilege, to give enterprises visibility and control over personal AI agents such as Claude and Claude Code. The product discovers agents including shadow AI, associates each session with the user and device behind it, and enforces allow, deny, log, human-approval or revocation decisions on agent access at runtime. It enables secretless developer workflows so agents can commit code without long-lived credentials while keeping actions attributable to the agent. Ping cites Gravitee research that 48% of production AI agents run unsecured and says the product is available now and piloting with global enterprises.

Help Net Security·Sep 3, 06:25 UTC · 13d agoAI safety & security

AI developers targeted via trojanized GitHub repositories

Help Net Security·Aug 4, 00:00 UTC · Aug 4, 2026Malware1

NHIs Now the Number One Corporate Entry Point for Hackers

SpyCloud survey finds non-human identities like AI agents and API keys were the primary entry point in 31% of intrusions, nearly double phishing.

SpyCloud's Identity Threat Report, based on a survey of 750 security leaders at organizations with 500+ employees, found non-human identities caused 31% of intrusions versus 17% for social engineering. Only 36% of organizations actually monitor NHIs although 95% believe they have adequate visibility into them. Some 68% of respondents suffered an identity-based event, with NHI-related misuse at 42%, and organizations able to see stolen session cookies reported identity incidents at a lower rate (37% vs 50%).

Infosecurity Magazine·Sep 9, 13:00 UTC · 7d agoResearch in the wild

Product showcase: Material unifies Google Workspace email, file & OAuth defense

Help Net Security·Aug 5, 00:00 UTC · Aug 5, 2026Data breach

Flirty OnlyFans promoters on X may be using AI to appear human

Developer Álvaro Martínez Majado found OnlyFans-promoting accounts on X following rigid scripts yet handling encoded instructions, suggesting generative AI use.

Investigation of flirty X accounts promoting OnlyFans pages showed near-identical openers across accounts plus dynamic behaviors: answering a hexadecimal-encoded instruction with "Pineapple" and failing an exact 12-character count test in an LLM-like pattern. The accounts also sent personalized voice notes reading supplied timestamps and usernames, consistent with automated text-to-speech. Evidence suggests a hybrid scripted/AI system, though no model, provider, or operator was identified.

Malwarebytes Labs·Sep 7, 11:18 UTC · 9d agoAI safety & security

New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing

Three research teams showed passkey bypasses: WebAuthn assertion replay in Microsoft Entra ID, synced-passkey key recovery in Google Password Manager, and Windows Hello key reuse.

SpecterOps' Pass-the-Passkey research showed Windows stored past YubiKey signatures in cleartext and chained this with Microsoft Entra ID passkey validation weaknesses to impersonate privileged users despite phishing-resistant MFA; the Windows Event Logging Service issue is tracked as CVE-2026-34348 (CVSS 6.5) and fixed in July 2026 updates. Unit 42's Golden Pass-ta-key attack recovered the 32-byte Security Domain Secret protecting Google Password Manager synced passkeys from Chrome on Windows via pre-existing malware. Dirk-jan Mollema showed in-session malware can use a hardware-bound Windows Hello for Business key without a fresh PIN or biometric check. Microsoft applied Entra-side mitigations for the relay assertion issue; no real-world exploitation has been reported.

The Hacker News·Aug 11, 12:45 UTC · Aug 11, 2026VulnerabilityCVE-2026-34348

Scaling Verification of Cryptographic Software with Aeneas, Rust, and Lean

Microsoft SymCrypt implementations of SHA-3 and ML-KEM verified in Lean via Aeneas-extracted Rust models, with AI agents writing proofs.

The paper develops a methodology for verifying production Rust cryptographic code by using Aeneas to extract pure models into Lean, avoiding low-level pointer and aliasing reasoning. Applied to Microsoft's SymCrypt, it verifies SHA-3 and ML-KEM implementations ported from C to Rust and extends SymCrypt with FrodoKEM, ML-DSA, and HPKE. A 237 KLOC Lean development establishes safety, panic-freedom, and functional correctness of 16.7 KLOC of Rust supporting post-quantum cipher suites on x86-64 and ARM. AI agents autonomously write formal proofs verified by the Lean kernel, and evaluation shows verified Rust meets SymCrypt's performance and portability requirements.

arXiv cs.CR·Sep 14, 14:32 UTC · 2d agoResearch1

The VMs Powering Mobile Agents (Instinct, Claude Code)

A teardown reveals Claude Code runs in Firecracker microVMs with a Rust PID 1 and MITM'd egress, while Instinct rents E2B sandboxes with git-based memory.

The author inspects the virtual machines hosting cloud agents: Claude Code runs in a Firecracker microVM with a custom Rust init (process_api) as PID 1, a 324 MB Bun harness on a read-only disk, and 443-only MITM'd SSE egress to api.anthropic.com with host-rotated OAuth tokens and no inbound access. Instinct rents E2B sandbox-as-a-service Firecracker microVMs (Ubuntu 22.04, 2 vCPU, 1.9 GB RAM) where agent memory is a git repo of Markdown committed by the agent and pushed to S3 as a single bundle, using short-lived STS credentials. Both platforms rely on Firecracker, differing mainly in fleet operator and guest boot configuration.

Hacker News · AI·Sep 8, 04:36 UTC · 8d agoAI tools & infraHN 58↑ · 19 comments1

AutoTrans: AI-Assisted Automatic Translation of Security Assertions for RISC-V Processors

AutoTrans uses LLMs with regex extraction and formal verification to automatically translate security assertions across RISC-V processors, achieving 78% unattended acceptance.

AutoTrans is an automated framework for translating verified security assertions between RISC-V processor targets, where manual translation takes hours per assertion. It combines a regex-based SystemVerilog signal extractor to prevent LLM signal hallucination, a pinned prompt template yielding byte-identical prompts resilient to model updates, and JasperGold FPV formal verification of generated assertions. Applied with DeepSeek V4 to translate assertions between RISC-V targets such as IBEX and NS31A, it achieves a 78% automatic translation acceptance rate without human intervention and 100% after human refinement.

arXiv cs.CR·Sep 9, 11:31 UTC · 7d agoResearch