Search: “authorization”

769 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll AI safety & security 137 Vulnerability 89 Policy & legal 74 AI industry 67 Threat actor 63 Exploit / PoC 48 Research 46 Industry 45 Data breach 44 Malware 43 Phishing & fraud 34 Tools 34 AI research 32 Advisory 28

SeverityAll critical 25 high 191 medium 195 low 21 info 416

Authors push back as publishers and agents make claims on Anthropic settlement

Authors report publishers and agents wrongly claiming shares of Anthropic's $1.5 billion copyright settlement, which pays $3,000 per pirated work across roughly 500,000 titles.

Anthropic's $1.5 billion copyright settlement, given final approval in July, pays $3,000 per pirated work for nearly 500,000 titles, split 50-50 with publishers for in-print books. Authors including April Henry report publishers claiming payments for works whose rights reverted years ago, and some agents claiming percentages despite not being rightsholders. Authors Guild CEO Mary Rasenberger attributes the disputes to poor recordkeeping rather than deliberate overreach. Full author claims require rights reversion before the settlement's August 10, 2022 download date.

TechCrunch · AISep 6, 20:47 UTC · 9d agoAI industry

AI workflows may be creating a dangerous new authorization blind spot

Noma Labs researchers describe 'workflow identity hijacking,' letting unauthenticated users trigger privileged AI workflows that execute actions with high-privilege service accounts.

Noma Labs lead researcher Sasi Levi detailed 'workflow identity hijacking,' where benign unauthenticated inputs via support inboxes, GitHub issues, or web forms trigger enterprise AI pipelines that execute privileged actions. The workflow runs using high-privilege service accounts or developer API keys, decoupled from the requester's identity, effectively creating a confused-deputy condition. Unlike prompt injection, the model behaves correctly; the failure lies in authorization enforcement at the workflow layer, and activity blends into routine automation. Mitigations include identity-aware access at execution points and user-context propagation between AI outputs and downstream operations.

CSO Onlineupdated Sep 10, 12:57 UTC · 5d agofirst Sep 10, 12:04 UTC · 5d agoAI safety & security 2 sources

Metasploit Wrap Up: This One Goes to Sixteen!

Metasploit adds 16 modules including 10 exploits, five covering CISA KEV vulnerabilities in Cisco, SonicWall, PaperCut, JetBrains and Langflow.

Rapid7's weekly Metasploit update ships 16 new modules, 10 of them exploit modules, with five targeting CISA KEV entries. New exploits cover Cisco Secure Firewall Management Center auth bypass (CVE-2026-20079), a SonicWall SMA1000 SSRF-to-root RCE chain (CVE-2026-83548/CVE-2026-83549), JetBrains TeamCity deserialization RCE (CVE-2026-63077), PaperCut NG/MF chain (CVE-2026-81578/CVE-2026-82078), and Langflow authenticated RCE (CVE-2026-19295). The SonicWall and PaperCut chains were reported as actively exploited zero-days, and a new ESC8 relay module exploits CVE-2026-20929 against AD CS Web Enrollment.

Rapid7 BlogSep 11, 13:35 UTC · 4d agoTools in the wildCVE-2025-66516 CVE-2025-54988 CVE-2026-20929+8 CVEs1

Anthropic's $1.5 billion book settlement descends into chaos as authors and publishers fight over who gets paid

Authors and publishers are filing competing claims over payouts from Anthropic's $1.5 billion copyright settlement covering 482,000 pirated books.

Anthropic agreed to pay $3,000 per illegally downloaded book, affecting more than 482,000 titles, in the largest copyright settlement in US history. As payouts begin, authors, publishers, and literary agencies are filing competing claims, complicated by poor rights-reversion records; textbook authors are reportedly owed as little as 10-15 percent under their contracts. A court had ruled Anthropic's use of illegally obtained books unlawful while deeming training on legally purchased books fair use.

The DecoderSep 11, 08:40 UTC · 5d agoAI policy1

Akeyless adds real-time enforcement for AI agents in production

Akeyless launches Agentic Runtime Authority, enforcing real-time intent-based access control on AI agent actions, with integrations for Claude Enterprise, OpenAI Codex and Amazon Bedrock AgentCore

Akeyless announced general availability of Agentic Runtime Authority, a real-time identity control layer that evaluates AI agent actions and blocks policy-violating actions before execution, layered on top of its SecretlessAI credential brokering. New integrations cover Claude Enterprise, OpenAI Codex and Amazon Bedrock AgentCore, alongside an Agentic Access Dashboard with session kill switches and event forwarding to Splunk, Datadog and Microsoft Sentinel. The vendor's platform already secures over 220 billion machine identity interactions for Fortune 500 organizations.

Help Net Securityupdated Sep 11, 04:00 UTC · 5d agofirst Sep 9, 13:54 UTC · 6d agoTools 2 sources1

How much of F-Droid is LLM generated?

A FOSS maintainer manually graded 102 F-Droid apps from the September 12, 2026 update batch, finding many show signs of LLM-generated code.

A student and FOSS app maintainer reviewed 102 apps pushed to F-Droid on September 12, 2026, assigning each a three-tier rating for likelihood of LLM-authored code (mostly AI >50%, hard to say/mostly human, no signs of AI). The heuristic relies on commit aesthetics, README and branding style, and the presence of agentic infrastructure like Claude Code or Codex, which automatically places an app in the 'mostly AI' tier. Example ratings include Amber (Nostr event signer) as mostly AI, and Aria for Misskey as showing no AI signs. The author stresses reliable detection of LLM-generated code from text alone is impossible, so ratings are approximate.

Hacker News · AISep 15, 09:47 UTC · 1d agoAI research HN 46↑ · 23 comments

The AI ‘Ghosts’ Contaminating Academic Publishing

Samsung and University of Warsaw researchers find LLMs repeatedly generate the same fake author names, contaminating academic records with 1,655 ghost-authored DOIs.

A preprint from Samsung and the University of Warsaw, "The Ghost Couple: Correlated LLM Name Priors and Their Haunting of the Web and Academic Publishing," shows that LLMs such as Claude, ChatGPT, and Gemini repeatedly generate the same fictional names like Elena Vasquez, Marcus Chen, and Aris Thorne as experts and co-authors. Researchers identified 1,655 ghost-authored records on CERN-operated Zenodo carrying real DataCite DOIs, fabricated journals, and backdated publication dates. Ghost names also form synthetic research groups on ResearchGate and are indexed without verification by Google Scholar and Semantic Scholar. The researchers suggest correlated name priors could serve as provenance signals for detecting AI-generated content.

404 MediaAug 27, 18:14 UTC · 19d agoAI research

VU#889462: Casdoor authentication server is vulnerable to authorization bypass

Casdoor IAM versions 3.115.0 and earlier allow organization admins to bypass tenant isolation through inconsistent authorization checks, tracked as CVE-2026-15630.

CERT/CC published VU#889462 describing an authorization bypass in Casdoor, an open-source access management platform, affecting versions 3.115.0 and earlier. The flaw (CVE-2026-15630) stems from controllers ignoring the ?id= query parameter used for authorization decisions and acting on JSON body fields instead, letting a single-organization administrator perform unauthorized administrative actions against arbitrary organizations in multi-tenant deployments. Impact can escalate to complete tenant-isolation compromise and potential compromise of the entire Casdoor instance, including SSO/SAML disruption. No vendor patch is available because researchers could not reach Casdoor; mitigations include least privilege, MFA for admin accounts, and alerting on cross-organization administrative activity.

CERT/CC Vulnerability NotesSep 3, 17:03 UTC · 12d agoVulnerability CVE-2026-15630

Authorization Architectures for Tool-Using AI Agents

Review paper proposes an authorization reference architecture for tool-using AI agents, identifying runtime enforcement and delegation bounds as unresolved gaps.

This review examines authorization models for tool-using AI agents that invoke APIs, databases, browsers, and protocols like MCP, arguing every consequential agent action must be traceable to a human principal, bounded by delegation, and contestable. It introduces a principal hierarchy spanning human user, operator/deployer, orchestrator agent, sub-agent, and tool endpoint, and analyzes five layers including credential lifecycle, delegation propagation, runtime enforcement, prompt injection as authorization bypass, and auditability. Drawing on 89 primary sources from 2023-2026, it proposes seven structural requirements, a four-layer reference architecture, and three deployable configurations.

arXiv cs.CRSep 14, 17:21 UTC · 1d agoAI safety & security

Google stole open source code without crediting the authors (Artemis/Minitap)

Minitap alleges Google's Artemis mobile-agent project reused its open-source mobile-use code and stripped author attribution, despite Apache 2.0 requirements.

Minitap says Google's Artemis project for automating mobile devices contains code identical to its open-source mobile-use agent, including the Hopper agent's verbatim instructions and a WhatsApp messaging example, and that a package file listing authors Pierre-Louis Favreau, Jean-Pierre Lo, and Nicolas Dehandschoewercker was replaced via an August force push removing their names. The company argues this conflicts with Apache 2.0's requirement to preserve copyright and attribution notices. Minitap also claims the AndroidWorld leaderboard ignored its later 94.8% and 100% submissions while showing Artemis at 99.1% and mobile-use at 91.4%. It has published a public factual record with archived file comparisons.

Hacker News · securitySep 12, 02:39 UTC · 4d agoAI industry HN 25↑ · 6 comments

Wiz achieves GovRAMP High Authorization

Wiz for Gov achieved GovRAMP High authorization, validating NIST SP 800-53r5 controls for state, local government, and higher-education cloud security procurement.

Wiz announced that Wiz for U.S. Government has officially achieved GovRAMP High authorization, validating it against NIST SP 800-53r5 security controls required for highly sensitive state data and critical infrastructure. The 'verify once, serve many' designation is aimed at state, local government, and higher education procurement. Wiz positions its CNAPP as providing code-to-runtime visibility, risk prioritization, compliance automation, and AI pipeline security. Existing Wiz for Gov customers automatically inherit the high-baseline controls without migration.

Wiz BlogSep 10, 11:00 UTC · 5d agoIndustry1

Introducing the CyberAgents Exchange AI Inspector: Rigorous review for community-built AI

Tenable and OpenAI launch the CyberAgents Exchange AI Inspector to security-review community-submitted AI agents, MCP servers, and skills using GPT Cyber models.

Tenable and OpenAI announced the CyberAgents Exchange AI Inspector, unveiled at OpenAI's "Intelligence at Work: Cyber Summit," to vet community-submitted AI agents, skills, MCP servers, and multi-agent playbooks in the CyberAgents Exchange registry. The process combines Tenable One AI Exposure scanning, OpenAI GPT Cyber model assessment, and human review, with reviews anchored to specific Git commits. The registry launched in August and hosts over 100 AI listings; the Inspector is expected to be available in September and has already detected prompt injection implemented via invisible Unicode tag characters in a SKILL.md file.

Tenable BlogSep 9, 13:00 UTC · 6d agoTools

Permify: Open-source authorization as a service

Help Net Security profiles Permify, an open-source Zanzibar-style authorization service supporting RBAC, ABAC, and relationship-based rules with multi-tenant deployments.

Permify is an open-source authorization-as-a-service project modeled on Google Zanzibar that centralizes access-control decisions outside application code. It supports role-based, relationship-based, and attribute-based access rules, answers checks in tens of milliseconds via REST and gRPC, and runs from a single Docker command. It is a CNCF member and is freely available on GitHub.

Help Net SecuritySep 14, 05:30 UTC · 2d agoTools1

OpenAI researcher allegedly pressured mathematician to drop Anthropic co-author from math breakthrough paper

OpenAI researcher Sébastien Bubeck allegedly pressured mathematician Tristan Buckmaster to drop his Anthropic co-author from an AI-assisted Navier-Stokes breakthrough paper.

Mathematician Tristan Buckmaster says OpenAI, after learning of his and Levent Alpöge's AI-assisted progress on the Navier-Stokes equations, pressed him to drop his Anthropic-employed co-author and dictated how any results would be announced. He says Sébastien Bubeck claimed an internal OpenAI model had produced a roughly 100-page proof for Navier-Stokes with forcing and allegedly told him 'Why would you ruin your career?' when he threatened to go public. Buckmaster published a public statement detailing the exchanges; OpenAI has not yet responded. The pair had worked with models including Claude and OpenAI Codex running GPT-5.6 Sol on the Clay Millennium Problem, which carries a $1 million prize.

The DecoderSep 8, 17:23 UTC · 7d agoAI industry1

French prosecutors confirm arrest of suspected ZeroBytes hacker behind tax cyberattack

French prosecutors arrested an 18-year-old suspected ZeroBytes member tied to a tax authority breach exposing data of 600,000 people.

French authorities arrested an 18-year-old, alias 'ChatNoir,' in the Paris region on Aug. 18 and placed him in pretrial detention two days later over ZeroBytes attacks; a second suspect under 16 was arrested Aug. 26 and released. ZeroBytes claimed attacks on French government agencies, schools and companies starting July 16, including the DGFiP tax authority, which disclosed an August breach affecting data of more than 600,000 people. The suspect was previously under formal investigation for the 2024 Free telecom breach affecting over 19 million customers and for X account takeovers of BFM-TV and RMC linked to the Epsilon collective. Charged offenses carry up to 10 years in prison and a 300,000-euro fine.

The RecordSep 8, 12:30 UTC · 7d agoPolicy & legal

ResidualAuth: What Authorization State Must Language Agents Preserve under Revocable Delegation?

Formalizes residual authorization state language agents must preserve under revocable delegation; token-budget summaries mostly fail while hard gates stop unauthorized effects.

The paper shows two authorization histories with identical current permissions can require opposite decisions after the same direct-edge revocation, formalizing the needed information as residual authorization state. Exponentially many future-distinct states can share one transitive closure, with exact or tight asymptotic bounds on the state an exact monitor requires. Across four open-weight models, fixed 256-token summaries solved at most 2 of 16 paired episodes while authenticated current-query reads solved 15-16 of 16. A hard effect gate reduced eight observed unauthorized effects to zero without changing preceding attempts.

arXiv cs.CRSep 8, 00:05 UTC · 8d agoResearch

Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones

Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.

Google's Chrome 153 Stable channel update (153.0.8010.47/.48 for Windows/macOS, 153.0.8010.47 for Linux) patches 42 vulnerabilities: three Critical, 27 High, ten Medium, and one Low. The Critical flaws are CVE-2026-91721 (use-after-free in Internals), CVE-2026-91749 (use-after-free in Workers), and CVE-2026-91726 (out-of-bounds read in WebGL). Google's bulletin states none of the patched issues are actively exploited, and detailed bug links remain restricted until most users receive the fixes. Bug bounty awards include $1,500 to Hafiizh for CVE-2026-91724 and $1,000 to Jihyeon Jeong of Seoul National University for CVE-2026-91728.

Cyber Security News03:01 UTC · 7h agoVulnerability CVE-2026-91721 CVE-2026-91749 CVE-2026-91726+27 CVEs

Patch Tuesday - September 2026

Microsoft's September 2026 Patch Tuesday fixes 999 CVEs, a record, with two zero-day privilege escalation flaws already exploited in the wild.

Microsoft published 974 own-product vulnerabilities plus 25 non-Microsoft CVEs, totaling 999 — the most CVEs Microsoft has ever released in a single day. Two flaws are exploited in the wild: CVE-2026-85880, an out-of-bounds write in Windows ALPC granting SYSTEM privileges, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack also leading to SYSTEM. Chrome's V8 zero-day CVE-2026-85046 was patched in Edge on September 2, but Microsoft had not published a corresponding advisory, leaving uncertainty about other Chromium fixes in Edge. October 14 lifecycle changes end servicing for Windows 11 24H2 Home/Pro, Office 2021, and Exchange Server 2016/2019.

Rapid7 BlogSep 8, 21:44 UTC · 7d agoVulnerability in the wildCVE-2026-85880 CVE-2026-81963 CVE-2026-85046+10 CVEs

AWS limits AI agents’ data access, even when manipulated

AWS detailed propagating user authorization context through Bedrock AgentCore so downstream services enforce access controls even if the agent is manipulated via prompt injection.

AWS described an architecture for Amazon Bedrock AgentCore where user tokens and department claims are validated at runtime and propagated to DynamoDB, Bedrock Knowledge Bases, and Salesforce. Downstream services enforce authorization themselves, so a prompt-injected or buggy agent cannot retrieve data the user is not entitled to see. AWS demonstrated the pattern with a CRM use case separating Sales and Finance access and recommends IAM-backed knowledge bases for stricter isolation.

Help Net SecurityAug 20, 00:00 UTC · 27d agoAI safety & security

CVE-2026-72524: Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables

Apache Doris authorization bypass CVE-2026-72524 lets authenticated low-privilege users read, write, or drop arbitrary tables in affected 3.1.x through 4.1.3 versions.

CVE-2026-72524 is an incorrect authorization vulnerability in Apache Doris rated important, allowing an authenticated low-privilege user to bypass privilege checks and read, write, or drop arbitrary tables. Affected versions include Apache Doris 3.1.0 through 3.1.*, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.3. The flaw permits access to or modification of data the user is not authorized to touch.

oss-securitySep 14, 15:09 UTC · 1d agoVulnerability CVE-2026-725241

CVE-2026-68570: Apache Doris: Authorization bypass leading to unauthorized data access

Apache Doris authorization bypass CVE-2026-68570 lets authenticated users read unauthorized data, disclosing information across versions 2.0.0 through 4.1.3.

CVE-2026-68570 is an incorrect authorization vulnerability in Apache Doris rated important, allowing an authenticated user to bypass privilege checks and read data they are not authorized to access. Affected versions span Apache Doris 2.0.0 through 2.1.*, 3.0.0 through 3.0.*, 4.0.0 before 4.0.8, and 4.1.0 before 4.1.4. The issue results in unauthorized disclosure of information.

oss-securitySep 14, 15:07 UTC · 1d agoVulnerability CVE-2026-68570

IDORacle: Template-Guided SQL-Sink Mediation for Object-Level Authorization in Java Applications

IDORacle intercepts MyBatis/JDBC SQL sinks to block horizontal privilege escalation in legacy Java apps with sub-millisecond guard latency.

IDORacle is a template-guided SQL-sink interception and rewriting framework that prevents IDOR/BOLA horizontal privilege escalation at runtime in Java database applications. It propagates authenticated identity context across HTTP requests, asynchronous tasks, and data-access boundaries via a server-side trace identifier, and computes dual SQL fingerprints at the MyBatis/JDBC boundary to generate reusable mediation plans. On a Java-SQL benchmark grounded in real-world CVE reports, it blocks tested violations with worst-case guard latency of 0.17 ms, reduced to 0.017 ms average for hot templates via redundancy-aware optimization.

arXiv cs.CRSep 11, 04:20 UTC · 5d agoResearch1

CVE-2026-80352: Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects

Apache Camel K CVE-2026-80352 lets CR authors inject arbitrary Kubernetes objects via Master trait serviceAccountName YAML injection.

Apache disclosed a critical YAML injection vulnerability (CVE-2026-80352, improper control of code generation) in Apache Camel K's Master trait serviceAccountName setting. An authorized custom resource author can inject arbitrary Kubernetes objects, potentially enabling unauthorized resource manipulation. Affected versions are 2.0.0 before 2.9.3 and 2.10.1 before 2.10.2; fixes are available in 2.9.3 and 2.10.2.

oss-securitySep 10, 14:08 UTC · 5d agoVulnerability 3 sources CVE-2026-803521

[0day-rubbish] SmarterMail 100.0.9693 (Build 9693) Antivirus command-line configuration executing as NT AUTHORITY\SYSTEM (7.2)

SmarterMail 100.0.9693 executes its antivirus command-line configuration as NT AUTHORITY\SYSTEM, a CWE-250 flaw rated CVSS 7.2.

0day Rubbish Research Team disclosed that SmarterMail 100.0.9693 (build 9693) runs its antivirus command-line configuration with NT AUTHORITY\SYSTEM privileges, classified as CWE-250 (deployment of executable with unnecessary privileges) and rated CVSS 7.2. Control over that configuration could yield SYSTEM-level code execution on the mail server. The disclosure does not report exploitation in the wild.

Full DisclosureSep 8, 17:31 UTC · 7d agoVulnerability

I've factored the RSA keys of a Certificate Authority from the 90s

Security researcher factored two 512-bit RSA root CA keys from defunct 1990s certificate authority E-Certify using CADO-NFS on a desktop in roughly 30 hours each.

A researcher extracted legacy root certificates from archived Netscape and Internet Explorer installers, identifying two 512-bit RSA roots shipped with Netscape 4.51 in 1999 by the defunct Canadian CA E-Certify. Using CADO-NFS on a Ryzen 9 5950X desktop, the keys were factored in 32 and 29 hours respectively, allowing private key reconstruction. The work comes shortly after RSA-260 (862-bit) was factored, the largest known factorization to date. The researcher also built a legacy TLS server and published keys and tools on GitHub.

Hacker News · securitySep 8, 01:16 UTC · 8d agoResearch HN 411↑ · 86 comments

Google Chrome 153 Released With Fixes for 42 Security Vulnerabilities

Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.

Google released Chrome 153 (153.0.8010.47/48) for Windows, macOS, and Linux, patching 42 security vulnerabilities including three rated critical: CVE-2026-91726 (out-of-bounds read in WebGL), CVE-2026-91721 (use-after-free in Internals), and CVE-2026-91749 (use-after-free in Workers). Twenty-eight fixes are rated high severity, covering use-after-free, type confusion, race condition, integer overflow, and authorization flaws across components like V8, Skia, DOM, ServiceWorker, PDF, and Extensions. Google's bulletin indicates no vulnerabilities are currently being exploited in the wild, and external researchers earned rewards up to $1,500 for reported issues. Enterprises are advised to verify fleet-wide deployment via browser-management consoles and enable automatic updates.

GBHackers05:00 UTC · 5h agoVulnerability CVE-2026-91726 CVE-2026-91721 CVE-2026-91749+27 CVEs

1Password's AI patching benchmark is misleading

Trail of Bits reanalysis says 1Password's 26% AI clean-fix rate is misleading; 86% of eligible patches blocked exploits.

Trail of Bits critiques 1Password's FLAWED AI patching benchmark, arguing its 26% clean-fix headline mixes trials where agents were instructed to apply wrong fixes (22% of data) with trials that prohibited compiling or testing (36%). Restricting to reasonable conditions, 2,634 of 3,067 patches (86%) blocked the supplied exploit. Trail of Bits also reports 12.5% of 2,265 developer first fixes failed in its own 2024-2026 assessments, and released post-patch-validation and review-walkthrough agent skills.

Lobsters · securitySep 15, 20:03 UTC · 14h agoResearch

CVE-2026-75030: Apache Syncope: Incomplete authorization checks for Group members deprovisioning

Apache Syncope patches missing authorization checks (CVE-2026-75030) in Group members deprovisioning that administrators can abuse.

CVE-2026-75030 is a moderate-severity missing authorization vulnerability in Apache Syncope's Group members deprovisioning logic (syncope-core-idrepo-logic). An administrator with task execution permissions can bypass the incomplete authorization checks. Affected versions include 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-securitySep 14, 15:38 UTC · 1d agoVulnerability CVE-2026-750301

Retrospective by 'gpg.fail' authors

Authors of the gpg.fail GnuPG vulnerability set published a retrospective with talk recording, slides, and a repo PoC.

Sam James shares that the researchers behind the 'gpg.fail' set of GnuPG vulnerabilities have published a retrospective, including a talk recording and slides. The slides appear to mention an additional vulnerability not yet widely reviewed, and a proof-of-concept is available in their repository. This follows earlier discussion of the gpg.fail findings on oss-security.

oss-securityupdated 05:03 UTC · 5h agofirst Sep 13, 01:12 UTC · 3d agoResearch 6 sources1

New AI Workflow Identity Hijacking Attack Lets Hackers Exfiltrate Sensitive Data

Noma Labs disclosed Workflow Identity Hijacking, an AI automation flaw letting anonymous users trigger privileged data exfiltration without prompt injection or stolen credentials.

Noma Labs researcher Sasi Levi described Workflow Identity Hijacking, where AI workflows process untrusted input from low-privileged or anonymous users but execute downstream actions with the workflow creator's elevated permissions, turning the pipeline into an unauthenticated proxy. Unlike prompt injection, the model is not tricked; the flaw is a missing authorization check between the requester and the privileged actions. Noma Labs also disclosed and helped fix a similar issue in Google Workflows, and linked the problem to the earlier GitLost research on GitHub Agentic Workflows. Recommended mitigations include per-user identity propagation, least-privilege service accounts and authorization checks before every downstream action.

GBHackersSep 10, 07:51 UTC · 6d agoAI safety & security

Microsoft says virtually nobody was grabbing NYT articles through its chatbot

Microsoft files summary judgement briefs in NYT copyright lawsuit, arguing only 59,545 of 8.2M Copilot logs show substantial overlap with news content.

Microsoft filed new legal filings in the consolidated copyright lawsuit brought by The New York Times, authors, and publishers against Microsoft and OpenAI, arguing for summary judgement. Analysis of 8.2 million Copilot chat logs found only 59,545 contained at least 16 words in common with news content, with just 24 responses showing at least 30 matching words in the authors' case. Microsoft argues the numbers support fair use, claiming Copilot rarely reproduces substantive chunks; the Times says discovery shows Microsoft and OpenAI stole from it, and the Trump administration filed a statement of interest supporting OpenAI.

The Verge · AISep 4, 16:05 UTC · 11d agoAI policy1

Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models

Cloudflare launches invitation-only Vulnerability Discovery and Remediation within Managed Defense, using OpenAI Daybreak models and WAF context to prioritize and patch vulnerabilities.

Cloudflare announced early access to Vulnerability Discovery and Remediation, an invitation-only service within Cloudflare Managed Defense. The service uses OpenAI Daybreak models, including GPT-5.6 Cyber, via the Daybreak Defense Network to hunt and validate vulnerabilities in customer-authorized codebases across Workers and proxied applications. Findings are prioritized using production traffic, WAF rule, and security event context, and proposed patches and WAF mitigations are automatically checked before customer review.

Cloudflare BlogSep 3, 21:03 UTC · 12d agoTools

Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means

GitGuardian found the Shai-Hulud infostealer worm now scans 469 credential locations, including CI/CD and AI tool configs, expanding supply-chain risk.

GitGuardian researchers found that a recent Shai-Hulud worm variant scans for credentials across 469 locations in developer environments, CI/CD tooling, cloud configurations, and AI tool configs, up from 189 paths in earlier variants. The worm reuses stolen credentials to pivot from developer workstations to source code, cloud infrastructure, and package publishing channels, turning credential theft into forward-propagating supply chain attacks. The analysis urges defenders to prioritize removing long-lived package publishing tokens in favor of short-lived OIDC-based trusted publishing, citing recent Docker and GitHub Actions improvements.

The Hacker NewsSep 3, 10:36 UTC · 13d agoMalware in the wild1

Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads

US and European authorities with CrowdStrike dismantled the two-decade-old Sality P2P botnet using peer-list manipulation, blocking payload delivery to infected hosts.

The US Department of Justice announced a coordinated takedown of the Sality peer-to-peer botnet, executed August 31, 2026 by authorities from the US, Bulgaria, Hungary, and Romania with CrowdStrike and the Shadowserver Foundation. Sality, active since 2003, infects Windows executables and delivers payloads including the EggJagger crypto clipper, which stole at least $150,000, and was used for DDoS campaigns. The operation abused the botnet's peer-list maintenance cycle to insert sinkhole nodes and isolate both super peers and NAT-hidden infections, cutting off URL and payload distribution to more than 15,000 infected machines across two P2P networks.

The Hacker NewsSep 2, 10:20 UTC · 14d agoMalware

You don’t have to join the hack-back program to inherit its risk

A new US presidential memorandum creates a vetted private hack-back program, leaving participating vendors and their customers with untested legal liability and collateral risks.

The August 12 National Security Presidential Memorandum directs the National Coordination Center, run jointly by DOJ and DHS, to approve covert surveillance and disruptive Cyber Effects Operations by vetted private companies, with a forfeitable bond of at least $1 million required as a contract condition. The analysis argues the criminal shield rests on an untested reading of the CFAA exemption at 18 U.S.C. 1030(f), with no civil safe harbor, no state-law preemption and no foreign-law protection. Non-participating organizations can still inherit risk through shared infrastructure collateral damage, lack of customer disclosure, Lloyd's bulletin Y5381 state-backed attack exclusions, and threat-intelligence pipelines feeding offensive proposals.

CSO Online09:00 UTC · 1h agoPolicy & legal

Revolut Data Breach Via Fake Government Requests – What We Know So Far

Revolut confirmed attackers extracted customer KYC records by sending fraudulent data requests from a spoofed or compromised government agency email domain.

Revolut confirmed a data breach in which an unauthorized party obtained sensitive customer records by submitting fraudulent information requests from an email account on a legitimate government agency domain with valid SPF/DKIM/DMARC authentication. Disclosed data could include full names, dates of birth, passport or driving-license copies, onboarding facial images, IBANs, account statements, withdrawal records, and complete transaction histories including Bitcoin activity. Crypto investigator ZachXBT assessed the operation targeted high-net-worth users, while a threat actor using the name 'IAmNotAVillain' claimed Italian law-enforcement departments were compromised over six months with 147 GB of material, claims that remain unverified. Revolut says only a limited number of customers were affected, blocked the email address, and notified regulators and affected customers, stating its systems and funds were not compromised.

Cyber Security NewsSep 15, 03:46 UTC · 1d agoData breach

Unsolved Problem by Fields Medalist Breached by Two High School Students

Two high school students used Claude Opus 5 and GPT-5.6 Sol to help solve an open Lorentzian polynomials problem, posting a 75-page arXiv proof.

Aayush Bathija and Prince Rohatgi of Oak Park High School, mentored by UCLA postdoc Daniel Soskin, published the 75-page paper 'Bounded Ratios for Lorentzian Polynomials' (arXiv 2609.05341), solving an open problem in Fields Medalist June Huh's Lorentzian polynomial theory. The main structural theorem extends bounded coefficient-ratio characterization from quadratic to arbitrary-degree polynomials via discrete convexity conditions. The students used Claude Opus 5 and GPT-5.6 Sol for exploration and proof ideas but independently verified all arguments; the result follows an open letter from 25 Fields Medalists voicing concerns about AI's impact on mathematical rigor.

Hacker News · securitySep 14, 12:23 UTC · 1d agoAI research HN 22↑ · 19 comments

CVE-2026-82432: Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides

Apache Storm Nimbus blobstore authorization bypass via rebalance configuration overrides, fixed in 3.1.0.

CVE-2026-82432 (rated moderate) affects Apache Storm Nimbus (storm-server) versions 3.0.0 before 3.1.0. Nimbus validates topology.blobstore.map against the calling subject only at topology submission time. The rebalance operation accepts configuration overrides and strips a small set of keys but never re-runs that validation, so a caller authorized only to rebalance a topology can introduce an unauthorized blobstore map.

oss-securitySep 13, 14:30 UTC · 2d agoVulnerability CVE-2026-82432

Orchid Security targets AI agent risk with drift detection and kill switches

Orchid Security launched identity drift detection and application-level kill switches to govern AI agents that exploit enterprise identity debt.

Orchid Security announced AI readiness controls including agent discovery, continuous drift detection between an agent's intended purpose and observed behavior, and application-level kill switches that revoke credentials, disconnect tools, or suspend agent workflows. The company cites its Identity Gap 2026 finding that 57% of enterprise identity is unseen and unmanaged, which agents can leverage to gain elevated access in seconds to minutes. New integrations include a certified PAM integration for Palo Alto Networks Idira and identity telemetry streaming to Splunk Enterprise Security. The launch follows agentic enhancements to Orchid's Identity Control Plane in May 2026 and cites NIST's draft Cyber AI Profile and DORA as regulatory drivers.

Help Net SecuritySep 9, 13:29 UTC · 6d agoAI safety & security

When Intelligence Becomes Agency: A Theory of Governed, Proactive Agency for Symbiotic AI Systems

Researchers propose a formal framework for governed proactive AI agency, linking activation decisions to continuing authorization, accountability, and bounded delegation in symbiotic systems.

The paper defines the activation problem: persistent AI assistants must decide whether a situation warrants behavior, and whether to act, ask, monitor, defer, or deliberately refrain. It distinguishes autonomous from delegated agency and defines symbiotic agency as delegation under a standing, revocable mandate, coupled to the principal's situation with calibrated inference and bounded personalization. The framework links activation decisions to authorized perception, behavior selection, authority containment, traceable restraint, and constrained adaptation, and provides an agency classification method, evaluation framework, benchmark scenarios, and reference architecture for always-present assistants and embodied support systems.

arXiv cs.AI / cs.LG / cs.CLSep 7, 16:46 UTC · 8d agoAI safety & security