42
55
55
Hunting Vulnerabilities Using Frontier Models
Okta used frontier AI models GPT-5.5 Cyber and Mythos via OpenAI and Anthropic programs to scan millions of code lines for vulnerabilities.
Okta describes using frontier AI models, including GPT-5.5 Cyber Preview (TAC) and Mythos Preview, through OpenAI's Daybreak Cyber Partner Program and Anthropic's Project Glasswing to hunt vulnerabilities across its product codebase. The team built a custom Python orchestrator with strong isolation, vendor-agnostic model support, and four distinct scanning pipelines executed as isolated Codex or Claude Code sessions with progressive context loading to reduce context bloat. Human experts and AI agents worked both autonomously and in paired hunts, and Okta reports the best results when humans and agents taught each other.
50
30
42
30
30
30
30
30
SpyCloud 2026 Identity Threat Report Finds Non-Human Identities Are Now the Leading Path into the Enterprise
SpyCloud survey of 750 security leaders finds compromised non-human identities are the top enterprise entry point, yet only 36% monitor them.
The 2026 Identity Threat Report surveyed 750 cybersecurity leaders at organizations with 500+ employees across North America and Europe. Compromised non-human identities (31%) were the most cited primary attacker entry point, nearly double phishing (17%), while only 36% of organizations monitor AI agents, service accounts and API keys. 68% of respondents reported identity-based events, averaging eight each, and 91% use AI tools but only 56% have formal governance over their privileges.
32
30
30
The best human hacking team still out-solved the best AI team
Hack The Box 2026 benchmark data shows AI agents helped top teams but human-only teams still solved everything while best AI teams stalled at 32 of 36 challenges.
At the 2026 Global Cyber Skills Benchmark (Project Nightfall) run by Hack The Box, 93 designated AI agent accounts across 54 teams held 2.7% of registered accounts but produced 4.2% of submitted flags and 4.6% of awarded points, and appeared in 17 of the Top 25 finishers. Median solve time dropped from 26 hours in 2024 to 13.8 hours in 2026, though the data cannot attribute the change to AI. At the November 2025 NeuroGrid CTF, AI-augmented teams solved challenges 3.2x faster overall but only 1.69x among the Top 5%, and the only team to complete all 36 challenges was human, while the best AI team stopped at 32.
35
30
30
30
30
30
Agentic Ransomware: From Human-Operated to AI-Operated Attacks
SOCRadar analyzes the shift from human-operated ransomware to agentic AI-driven attacks and what this transition means for defenders.
The article traces ransomware's evolution from operations requiring human involvement, such as affiliates navigating networks by hand, toward AI-agent-operated attacks. It argues agentic ransomware could automate stages historically dependent on human operators. The piece discusses implications for detection and defensive planning.
45
30
30
30
30
30
55
Cross-Domain Inference for Human Localization: Applying Wi-Fi RSSI Data to CSI-Trained Models
Researchers show CSI-trained Wi-Fi models can localize people from RSSI data at ~80% confidence, enabling privacy attacks from ordinary IoT devices.
The paper investigates cross-domain inference, feeding RSSI data into an existing CSI-based Wi-Fi pose prediction model. RSSI is accessible on IoT devices without elevated OS permissions or specialized drivers, unlike CSI. Using an RSSI dataset synchronized with video ground truth, the model predicted human locations with approximately 80% confidence when movement was present. The results imply a wide range of commodity IoT devices could be used for privacy invasion in Wi-Fi-dense environments.
18
The AI Malware Maturity Gap
Recorded Future introduces AIM3, a five-level maturity model for AI malware, showing current attacker AI use is mostly AI-assisted rather than autonomous.
Recorded Future proposes AIM3, a five-level model defining AI malware from LLM-translated to LLM-embedded, spanning experimentation to fully autonomous agentic campaigns. Public examples remain early-stage: PROMPTFLUX uses Google Gemini to rewrite its VBScript dropper (Level 1), while Lamehug/PROMPTSTEAL, attributed to APT28, invokes the HuggingFace API to generate reconnaissance commands (Level 3). The authors argue most current AI malware augments existing tradecraft rather than enabling one-click autonomous attacks.
55
55
30
30
30
30
30
30
30
30
AIJon: Automated Generation of Annotations for Fuzzingnew
AIJON uses LLMs to auto-generate IJON-style fuzzing annotations, matching human-expert quality on the Magma benchmark.
Researchers replicate IJON experiments and propose AIJON, a system that uses LLMs to automatically generate expert-style annotations for coverage-guided fuzzing at scale. On the Magma benchmark, LLM-generated annotations performed comparably to human-generated ones, though annotation-based fuzzing was not strictly better than AFL++. The paper analyzes how annotations affect fuzzer energy distribution across campaigns.
45
30