42
50
When the Whole Company Adopts AI: What It Does to Your SOC
Analysis of 16.9 million SOC alerts finds AI-related alerts at 0.43%, growing 685% since February, with 94.1% noise and 0.02% real attacks.
A review of roughly 16.9 million SOC alerts found about 73,000 (0.43%) were AI-related, a share that grew 685% between February and June 2026. Of AI-related alerts, 94.1% were noise, 5.8% genuine risks, and 0.02% real attacks; 79.8% received benign verdicts, 81.7% were automatically suppressed, and only 5.4% reached a human analyst. The only confirmed attacks were phishing campaigns that weaponized AI brand names as lures, while developer coding agents spawning shells and reading credential stores routinely tripped detections written before AI agents existed.
45
47
30
50
50
60
42
60
55
55
57
57
60
60
45
60
30
Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code
Malicious .git core.fsmonitor configs let attacker code run in AI coding agents like Claude Code and Codex; four of eight flaws remain unpatched.
Manifold Security disclosed eight flaws across seven command-line AI coding agents where a repository's Git core.fsmonitor configuration causes agent-spawned commands to execute attacker code outside the sandbox and without approval prompts. Fixes shipped for goose (CVE-2026-72718, CVSS 4.0 score 7.0), Claude Code on one path, and Cursor, while Hermes Agent, Qwen Code, Grok Build, and a second Claude Code path were still unpatched as of September 1. OpenAI issued three CVEs for the same class in Codex, including CVE-2026-19592, and prior related bugs include CVE-2021-43891 in Visual Studio Code and CVE-2022-24346 in JetBrains IDEs. Exploitation requires the repository to arrive with its .git directory intact, such as via archives, shared drives, or USB sticks rather than an ordinary clone.
68
Week in review: Exploited newly patched BeyondTrust RCE, United Airlines CISO on building resilience
60
Week in review: AiTM phishing kit used to hijack AWS accounts, year-long malware campaign targets HR
60
Week in review: Cisco patches SD-WAN 0-day, unpatched Microsoft Exchange Server flaw exploited
60
45
57
Week in review: High-severity LPE vulnerability in the Linux kernel, cPanel 0-day exploited for months
60