Search: “code injection”

90 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 74 AI safety & security 46 Vulnerability 45 Threat actor 45 Malware 39 Research 23 Industry 14 Advisory 13 Phishing & fraud 12 Tools 12 AI research 8 AI industry 5 Model release 4 Data breach 3

SeverityAll critical 37 high 115 medium 97 low 8 info 91

Threat Matrix: Mapping threats across cloud web applications

Microsoft released a Cloud Web Applications Threat Matrix, a MITRE ATT&CK-aligned framework mapping threats to cloud-hosted web apps and serverless platforms.

Microsoft introduced the cloud web applications threat matrix, which organizes attack techniques for cloud-hosted web apps and serverless platforms using MITRE ATT&CK tactics, from resource development through impact. The framework covers attack paths spanning application code, managed runtimes, workload identities, and deployment pipelines, cataloging techniques such as subdomain takeover, code injection in connected repositories, compromised registry images, exposed admin interfaces, and serverless trigger injection. It builds on Microsoft's earlier Kubernetes and storage services matrices to help defenders identify visibility gaps, prioritize hardening, and plan investigations in cloud-native environments.

Microsoft Security BlogSep 9, 21:30 UTC · 6d agoTools

Microsoft Offers $60,000 Bounty for Critical Cross-Tenant Vulnerabilities

Microsoft expands Dynamics 365 and Power Platform bug bounty, paying up to $60,000 for critical cross-tenant vulnerabilities.

Microsoft expanded its bounty incentives for Dynamics 365 and Power Platform, with qualifying rewards from $1,250 to $60,000. Critical cross-tenant vulnerabilities receive a 100% award multiplier and important ones 50%, while critical AI inference manipulation or inferential disclosure can earn up to $30,000. Scope covers Dynamics 365 apps, Power Apps, Power Automate, Copilot Studio, Power Pages, Dataverse, and selected on-premises products. Reports must be rated Critical or Important and submitted via the MSRC Researcher Portal.

GBHackersSep 15, 08:08 UTC · 1d agoIndustry

AI Agents Are Here. So Are the Threats.

Unit 42 demonstrates nine framework-agnostic attack scenarios against AI agents built with CrewAI and AutoGen, causing data leakage, credential theft and remote code execution.

Palo Alto Networks Unit 42 investigated how attackers can target agentic applications, implementing two functionally identical apps with the open-source CrewAI and AutoGen frameworks and executing the same attacks on both. Nine attack scenarios produce outcomes including information leakage, credential theft, tool exploitation and remote code execution. Findings show most vulnerabilities are framework-agnostic, arising from insecure design patterns, misconfigurations and unsafe tool integrations rather than flaws in the frameworks themselves. The team published defense strategies per scenario and open-sourced the source code and datasets on GitHub.

Palo Alto Unit 42Aug 17, 12:33 UTC · 29d agoAI safety & security

Trends in Web Threats in CY Q2 2022: Malicious JavaScript Downloaders Are Evolving

Unit 42 detected 751,000 landing URL incidents in Q2 2022 and documented malicious JavaScript downloaders evolving to evade detection.

Unit 42 detected 751,331 landing URL incidents (253,644 unique) and 1,744,629 malicious host URL incidents (256,844 unique) from April through June 2022. Total landing URL incidents rose compared with Q1 2022, and unique host URL incidents grew 42%, indicating attackers deploying more variants. The report includes a case study of a JavaScript downloader campaign demonstrating new evasion techniques. Personal sites, blogs, and business sites were the top apparently benign entry points.

Palo Alto Unit 42Aug 17, 13:05 UTC · 29d agoResearch

WordPress Security Plugins: How to Choose the Right One

Sucuri's guide breaks WordPress security plugins into hardening, malware scanning, integrity monitoring, and filtering types, and explains how to evaluate and layer them.

The Sucuri guide explains that WordPress security plugins bundle five capabilities - hardening, malware detection, integrity monitoring, activity logging, and application-level filtering - and that plugins run only after WordPress loads, unlike server-level firewalls. It lists leading causes of compromise: outdated plugins and themes, weak or reused credentials, nulled premium software, insecure configuration, and shared-hosting cross-contamination. It concludes with evaluation criteria and a post-installation security checklist for owners without dedicated security teams.

Sucuri BlogSep 5, 03:01 UTC · 11d agoIndustry

Code review used to be the only way to catch these bugs

Palo Alto Networks' Unit 42 says its NOVA system found 14,090 vulnerabilities in 3,915 open-source projects, mostly non-crashing bugs like access control flaws.

Unit 42's NOVA system analyzed 3,915 open-source projects over two months and reported 14,090 validated vulnerabilities, only 85 of which matched previously documented findings. 92% of findings fell outside fuzzing-friendly categories, clustering instead in access control, path traversal, injection, prototype pollution, and SSRF; language ecosystems showed distinct weakness profiles. Of 5,421 supply-chain findings, 1,280 were flaws in dependencies while 4,141 were downstream exposures, 2,776 validated with working proof-of-concepts. Unit 42 warned that faster discovery combined with an average 55-day patch deployment window has collapsed the patch-to-exploit gap.

Help Net SecurityAug 25, 18:03 UTC · 21d agoResearch

BleachBit 6.0.4 fixes secure wiping that skipped clusters on Windows

BleachBit 6.0.4 fixes Windows secure-wipe bugs that skipped fragmented-file clusters, adds HSTS tracker deletion, early macOS support, and broad hardening.

The open-source cleaner BleachBit released version 6.0.4, fixing Windows shredding bugs where fragmented files were wiped incompletely because noncontiguous clusters were skipped, leaving potentially sensitive data on disk. The release adds deletion of dynamic HSTS tracking data in six Chromium-based browsers and Zen, early macOS support including a Safari cleaner and full CLI, plus hardening such as absolute paths for ipconfig/taskkill, symlink and reparse-point handling, DTD-free XML parsing, and PATH/environment sanitization when running as root.

Help Net SecuritySep 9, 04:00 UTC · 7d agoTools

Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers

SpecterOps released CDP-Enable-BOF, a Beacon Object File that enables Chrome DevTools Protocol in live Chrome or Edge processes on Windows for session hijacking.

SpecterOps released CDP-Enable-BOF, an x64 Beacon Object File that activates Chrome DevTools Protocol inside running chrome.exe or msedge.exe processes on Windows, exposing cookies, history, saved passwords, and authenticated sessions without administrator rights. It calls Chromium's StartRemoteDebuggingServer on the browser UI thread to stay reliable under CFG, TLS, and CET, and was tested on Chrome 147 and Edge 147. The technique builds on work by DeathFlamingo and Cedric Van Bockhaven; Google had hardened remote debugging in Chrome 136 after attackers used it to steal cookies post-App-Bound Encryption. Defenders can watch Sysmon Event IDs 8 and 10 for injection into browser processes.

The Hacker NewsAug 25, 16:19 UTC · 21d agoResearch2

Week in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploited

Help Net Security's weekly digest highlights 274 compromised Zimbra servers, Gitea and Citrix NetScaler KEV additions, a PaperCut zero-day, and a suspected Iran-linked power plant attack.

The roundup reports at least 274 internet-facing Zimbra instances compromised via CVE-2026-73570, critical Gitea CVE-2026-60004 added to CISA's KEV catalog after exploitation began, and previously patched Citrix NetScaler flaw CVE-2026-8452 exploited in the wild. It also covers PaperCut NG/MF zero-day attacks, a suspected Iran-linked shutdown of a UK power plant, an FBI seizure of domains tied to a China-linked group that hit NASA, DOJ and the Senate, a cyberattack disrupting Boston Scientific, and the Manchester Airports Group breach. Additional items include Chameleon SEO poisoning phishing, Android car head unit proxy botnet malware, ReliaQuest social engineering by ShinyHunters, fake OpenAI Codex macOS malware, and AI-related workforce and supply chain interviews.

Help Net SecurityAug 30, 00:00 UTC · 17d agoIndustry in the wildCVE-2026-73570 CVE-2026-60004 CVE-2026-8452

Can We Stop The Ads? Taxonomy and Characterization of Smartphone Splash Ads and Existing Countermeasures

Study of 108 ad-defense implementations finds only one tool blocked splash-ad navigation across ten popular apps, and it required Accessibility permission.

The paper taxonomizes smartphone splash ads — full-screen ads at app launch that trick users into trigger mechanisms such as moving the phone — and analyzes 108 documented advertising defenses for deployment barriers. Many defenses require device rooting, jailbreaking, runtime code injection, or application modification; others need extra permissions, rule maintenance, compilation, or payment. In evaluating 13 configurations of 11 tools across 10 popular apps, only one prevented ad-triggered navigation across all ten apps, requiring Accessibility permission and leaving ads visible roughly one second before dismissal. Documented harms include delayed emergency response, driver distraction, and degraded accessibility for vision-impaired users.

arXiv cs.CRSep 15, 15:24 UTC · 20h agoResearch

HiddenLayer nabs $100M as enterprises rush to secure their AI deployments

AI security startup HiddenLayer raised a $100 million Series B led by Delta-v Capital as enterprise spending on securing AI deployments accelerates.

HiddenLayer, which protects AI models, agents, and workflows from adversarial attacks, vulnerabilities, and code injections, raised a $100 million Series B led by Delta-v Capital with participation from Ten Eleven Ventures, Morgan Stanley, Microsoft's M12, and Booz Allen Hamilton. The company says annual recurring revenue grew more than 10x to the tens of millions of dollars, with customers including the Department of Defense, the intelligence community, and a frontier model provider with over 700 million weekly users. Gartner estimates enterprise spending on AI security products will reach $2.83 billion in 2026, up 83% from 2025, and nearly $4.78 billion next year.

TechCrunch · SecuritySep 2, 15:01 UTC · 13d agoIndustry1

Recent Trends in Internet Threats: Common Industries Impersonated in Phishing Attacks, Web Skimmer Analysis and More

Unit 42 analyzed 67 million malicious URLs and domains in H2 2022, a 52% increase, highlighting phishing impersonation and web skimmer trends.

Unit 42 observed more than 67 million unique malicious URLs, domains and IPs between July and December 2022, a 52% increase over the first half of the year. Malicious JavaScript detections grew 99.3%, with over 4 million malicious JS samples hosted on 4.8 million URLs. Over 85% of hosting infrastructure was concentrated in eight countries, led by the United States, Brazil and China. The report also analyzes industries spoofed in phishing pages and includes a web skimmer case study on a Tranco top 1 million website.

Palo Alto Unit 42Aug 17, 13:04 UTC · 29d agoResearch

Attack Paths Into VMs in the Cloud

Unit 42 maps attack paths into AWS, Azure, and GCP VMs through intended features like startup scripts and SSH key pushes.

Palo Alto Unit 42 reviewed attack vectors against virtual machine services on AWS, Azure, and GCP, finding that 11% of internet-exposed cloud hosts carry Critical or High severity vulnerabilities. The attack paths rely on legitimate features such as EC2 User Data, VM custom data, EC2 Instance Connect, SSM Run Command, and serial consoles rather than vulnerabilities, and exploiting them requires attackers to first obtain control plane permissions. A compromised VM exposes not only its data but the workload identity and cloud permissions assigned to it, making identity compromise potentially more damaging than data theft. The firm places mitigation responsibility on cloud users and administrators.

Palo Alto Unit 42Aug 17, 12:36 UTC · 29d agoResearch1

Weekly Cybersecurity Newsletter – Top 50 Biggest Cybersecurity Stories of the Week

GBHackers weekly digest rounds up 50 stories including Microsoft's 973-CVE patch drop, exploited Cisco FMC flaws, and Claude agent attacks.

GBHackers' September 7-12, 2026 newsletter summarizes the 50 biggest cybersecurity stories of the week. Highlights include Microsoft patching a record 973 CVEs with two exploited zero-days, active exploitation of Cisco FMC, Check Point VPN and Ivanti flaws, China-linked crews chaining Chrome and Windows zero-days, AI agents mass-exploiting PaperCut to compromise 440 servers, and the emergence of Panzer cross-platform ransomware. It also covers Anthropic and OpenAI agentic AI incidents and CrowdStrike's SafeMind launch.

GBHackersSep 15, 11:44 UTC · 1d agoIndustry in the wild

The Year in Web Threats: Web Skimmers Take Advantage of Cloud Hosting and More

Unit 42 analyzed 2.24 million web threat incidents, finding web skimmers increasingly hosted on cloud infrastructure to steal payment card data.

Palo Alto Unit 42 analyzed 2,241,354 web threat incidents and 831,550 unique URLs detected via Advanced URL Filtering between October 2020 and September 2021. Threat activity peaked from October 2020 to January 2021, coinciding with the holiday shopping season, with most malicious domains geolocated to the United States, Russia, and Germany. Web skimmers ranked third among the top five threat classes and showed the most code diversity, making detection harder. Researchers observed more web skimmer families being hosted on cloud platforms to steal payment data and PII.

Palo Alto Unit 42Aug 17, 13:06 UTC · 29d agoResearch

Context Engineering Inside the Harness: 4 Mechanisms That Beat Context Overflow and Goal Loss on Long-Horizon Tasks

Survey of four harness mechanisms—context budgeting, compaction, todo-state, and memory—that keep long-horizon LLM agents on task across 200+ tool calls.

The article details how agent harnesses, not larger context windows, solve context overflow and goal loss on long-horizon tasks, citing Chroma's Context Rot report showing 18 LLMs (GPT-4.1, Claude 4, Gemini 2.5, Qwen3) degrade on long inputs. Concrete implementations include LangChain Deep Agents offloading tool responses over 20,000 tokens to the filesystem and truncating old tool calls at 85% window usage, and Claude Code capping auto memory at 25KB while re-reading the 5 most recently modified files after compaction. OpenAI's Responses API now offers server-side compaction via context_management with a standalone /responses/compact endpoint, which Codex uses for long-running coding tasks. Manus reports a roughly 100:1 input-to-output token ratio per ~50-tool-call task, motivating todo.md state recitation to prevent goal drift.

MarkTechPostSep 13, 05:56 UTC · 3d agoAI research1

CISA review makes the case for eliminating vulnerability classes

CISA's FY2024-2025 vulnerability review urges eliminating recurring vulnerability classes, finding 41.5% of 2025 KEV entries map to persistent 'stubborn weaknesses'.

CISA's Vulnerability Review for fiscal years 2024 and 2025 found most compromises stemmed from opportunistic exploitation of known, exposed vulnerabilities rather than nation-state zero-days or advanced tradecraft. The review found 41.5% of 2025 KEV catalog entries map to 'stubborn weaknesses' - injection flaws, improper input validation, memory-safety failures, path traversal and broken access control - recurring on the CWE Top 25 since 2019. CISA advocates Secure by Design practices, vulnerability class elimination, and buyer-driven 'Secure by Demand' contract requirements, while warning that AI-enabled vulnerability discovery will soon accelerate exploitation.

Help Net SecuritySep 1, 00:00 UTC · 15d agoPolicy & legal

When an Attacker Meets a Group of Agents: Navigating Amazon Bedrock's Multi

Unit 42 red-teamed Amazon Bedrock multi-agent applications, demonstrating prompt-injection attack chains that leak agent instructions and invoke tools, mitigated by Bedrock Guardrails.

Unit 42 red-teamed Amazon Bedrock Agents' multi-agent collaboration in Supervisor and Supervisor with Routing modes. The demonstrated attack chain detects the operating mode, discovers collaborator agents, delivers attacker-controlled payloads, and can disclose agent instructions and tool schemas and invoke tools with attacker-supplied inputs. No vulnerabilities were found in Bedrock itself, and the built-in prompt attack Guardrail blocked the attacks when properly configured. The researchers collaborated with Amazon's security team and frame the findings as a broader prompt injection risk for LLM-based systems.

Palo Alto Unit 42Aug 17, 12:31 UTC · 29d agoAI safety & security

Google’s $10,000 refund test shows why AI agents need zero trust

Google released an open-source zero-trust reference architecture for AI agents defending against prompt injection via signed database writes, gVisor sandboxing, and deterministic gating.

Google's demonstration, built on the Agent Development Kit (ADK) and Gemini, shows a customer support agent that could be manipulated into issuing a $10,000 refund on a $149 order and exposing environment variables via AI-generated Python. The architecture adds three security layers outside the model: cryptographic signatures on database writes verified via Cloud KMS backed by Cloud HSM, gVisor sandboxing of generated code with network egress disabled, and a Semantic Gateway applying deterministic checks to prompts and tool calls. It treats system prompts as insufficient boundaries because prompt injection, prompt tuning, or model updates can change agent behavior.

Help Net SecurityAug 18, 00:00 UTC · 29d agoAI safety & security

HOL Guard: Open-source antivirus for AI agents

HOL Guard is an open-source local guardrail that pauses AI coding agents before risky actions like secret access and prompt injection.

HOL Guard sits between AI coding agents (Claude Code, Cursor, Codex, Gemini CLI and others) and the host machine, intercepting risky commands before execution with checks taking under 50 milliseconds and running fully offline. It offers four sensitivity modes — Gentle, Balanced (default), Strict, and Paranoid — and parses command structure, environment, sensitive-path access and network destinations to decide when to interrupt. The core runtime is free and open source on GitHub, with 552,000 downloads reported; the vendor says it has no telemetry on adoption because collection is off by default.

Help Net SecurityAug 31, 12:02 UTC · 16d agoAI tools & infra1

An Empirical Security Analysis of Open-Source Software Used in Onboard Satellite Systems

Study of 126 onboard satellite OSS repositories finds 2,827 security findings, 72% medium severity or higher, dominated by memory safety and code quality weaknesses.

Researchers performed an empirical security analysis of 126 public repositories of open-source software used in onboard satellite systems using SBOM generation, software composition analysis, static application security testing, infrastructure-as-code analysis, and secret scanning. After cleaning and deduplication the pipeline produced 2,827 findings, with medium-severity findings accounting for 49% and 72% classified medium or higher. A CWE-based taxonomy mapped all findings to eight weakness families, with Memory Safety and Code Quality dominating, followed by Input Validation and Injection. Project-developed code accounted for 81.4% of findings, though external dependency code remained relevant; findings do not establish mission-specific exploitability.

arXiv cs.CRSep 14, 11:54 UTC · 2d agoResearch1

The AI Malware Maturity Gap

Recorded Future introduces AIM3, a five-level maturity model for AI malware, showing current attacker AI use is mostly AI-assisted rather than autonomous.

Recorded Future proposes AIM3, a five-level model defining AI malware from LLM-translated to LLM-embedded, spanning experimentation to fully autonomous agentic campaigns. Public examples remain early-stage: PROMPTFLUX uses Google Gemini to rewrite its VBScript dropper (Level 1), while Lamehug/PROMPTSTEAL, attributed to APT28, invokes the HuggingFace API to generate reconnaissance commands (Level 3). The authors argue most current AI malware augments existing tradecraft rather than enabling one-click autonomous attacks.

Recorded FutureAug 26, 00:00 UTC · 21d agoResearch

Trends in Web Threats: Attackers Were More Active During Holiday Season

Unit 42 tracked 533,000 malicious landing URL incidents from October-December 2021, showing web threats peaked during the holiday shopping season.

Unit 42 detected 533,452 malicious landing URL incidents (120,753 unique) and 2,906,875 malicious host URL incidents (165,255 unique) from October through December 2021. Threat activity peaked in November, likely tied to Black Friday in the United States, United Kingdom, and Germany. Most malicious domains appeared to originate in the United States, followed by Russia and Germany. Personal sites, blogs, business sites, and shopping sites were the most common apparently benign entry points for attacks.

Palo Alto Unit 42Aug 17, 13:06 UTC · 29d agoResearch

AI Customer Service Bots Can Be Tricked Into Stealing Security Codes and Acting as Victims

DEF CON 34 research shows AI customer-service agents can be manipulated via prompt injection and email tricks to leak OTPs and act as victims.

Inti De Ceukelaire, presenting at Bug Bounty Village during DEF CON 34, demonstrated attacks against AI-powered customer service bots with access to customer profiles, billing data, support inboxes, and refund tools. Techniques include transcript-based phishing from trusted support addresses, From-header identity confusion, email normalization abuse to bypass OTP rate limits, and knowledge-base poisoning via RAG crawlers. He recommends separating untrusted content from system prompts, session-bound authentication, consistent email normalization, server-side tool validation, and least-privilege permissions for AI agents.

Cyber Security NewsSep 8, 08:50 UTC · 8d agoAI safety & security

Microsoft Offers Up to $30,000 for Critical AI Flaws in Dynamics 365 and Power Platform

Microsoft expands AI bug bounty to Dynamics 365 and Power Platform, paying up to $30,000 for critical inference manipulation flaws.

Microsoft's bug bounty program offers up to $30,000 for critical 'Inference Manipulation' or 'Inferential Information Disclosure' bugs in Dynamics 365 and Power Platform, including Copilot Studio, AI Builder, Power Apps, Power Automate, and Dataverse. Payouts scale by report quality ($30,000/$20,000/$12,000 for critical) with important-severity AI flaws earning $6,000-$20,000, plus 20% multipliers for Dataverse privilege escalation and Plugin Sandbox escapes. Prompt injection affecting only the attacker, hallucinated execution, and system-prompt disclosure are excluded from scope.

Cyber Security NewsSep 14, 16:11 UTC · 1d agoIndustry

The Hidden Instructions That Can Hijack AI Agents

Hidden prompt injections embedded in documents and metadata can hijack autonomous AI agents, causing data exfiltration and out-of-policy actions at machine speed.

Bowbridge warns that hidden indirect prompt injections, embedded in documents, metadata, emails, images, and code repositories, can cause autonomous AI agents to treat attacker-controlled content as trusted guidance. Because agents inherit user privileges, act silently, and lack human judgment, injections can lead to data exfiltration or file poisoning that traditional security controls cannot detect. A real-world example involved a supplier quote whose metadata instructed an agent to override guidance and select the most expensive option. Bowbridge recommends scanning documents before agents process them.

SecurityWeekSep 8, 17:00 UTC · 7d agoAI safety & security

Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection

Researchers unveil Repeat-After-Me, a black-box visual prompt injection achieving over 80% success on Qwen3.6-27B and 47% on GPT-5.5.

Researchers present Repeat-After-Me, a black-box adaptive visual prompt injection that induces frontier VLMs to reveal PII or make malicious tool calls via injected images. It exceeds 80% attack success rate on Qwen3.6-27B and 47% on GPT-5.5 even when the benign user prompt is unrelated and does not authorize the injected task. In a real-world OpenClaw Discord deployment, a minimally injected image can overwrite TOOLS.md, enabling later remote code execution and secret exfiltration.

arXiv cs.CRSep 3, 22:44 UTC · 12d agoAI safety & security

Meta Introduces Muse, a Personal AI Agent That Runs on Its Own Dedicated Secure Cloud Computer

Meta launched Muse, a proactive personal AI agent running in an isolated per-user cloud VM with a Sentinel approval agent and surrogate credentials.

Meta introduced Muse, a consumer agent that performs long-horizon tasks like email, travel booking, and bill negotiation, rolling out in the US on iOS, Android, muse.ai, and WhatsApp with free and paid tiers. Each user gets a dedicated Muse Secure VM where the agent runs in a systemd-nspawn cell, while a separate Sentinel agent approves every network request at layer 4/7 and injects real credentials only at the network boundary. The underlying Muse Spark 1.3 model, which Meta says cuts tool calls by ~20% and tokens by ~25% versus 1.2 and is near state-of-the-art on prompt-injection resistance, is available via Meta Model API, with open weights on the roadmap.

MarkTechPostSep 9, 04:38 UTC · 7d agoAI industry

How to secure edge AI in customer-owned environments

Microsoft outlines security architecture guidance for edge AI, urging runtime attestation, artifact provenance, and deterministic mediation of model actions.

Microsoft details how edge AI shifts trust responsibilities to customers operating their own infrastructure, where prompt injection, model tampering, and malicious firmware updates can occur alongside model weights, credentials, and physical-system access. The guidance recommends verifying runtimes with attestation, verifying AI artifacts with provenance, and constraining model actions through a deterministic mediator outside the model. It also covers new exposure surfaces from MCP, multi-agent systems, and computer-use agents running in disconnected or hostile edge environments.

Microsoft Security BlogSep 4, 19:10 UTC · 11d agoAI safety & security

The Outsized Shadow: Why 5% of AI Users Are Your Biggest Security Risk

Akamai's 2026 Enterprise AI Usage report finds the top 5% of AI power users create outsized shadow AI, data leakage, and agent security risks.

Akamai's State of the Internet: Enterprise AI Usage Risk Report 2026, based on real-world usage telemetry, finds the top 5% of enterprise AI power users interact with AI models at 12 times the rate of the bottom 50% of the workforce. 47.11% of enterprise AI conversations occur through personal identities rather than corporate-managed accounts, and 14.4% run through corporate email addresses tied to personal freemium subscriptions. 17.7% of employees at midsize enterprises use AI browser or IDE extensions, of which 16.31% contain known CVE vulnerabilities and nearly 75% request high or critical permissions. The report also describes emerging attack vectors including Vibe Hacking, CursorJacking, and CometJacking indirect prompt injection.

The Hacker NewsAug 24, 11:30 UTC · 23d agoAI safety & security1

Introducing the CyberAgents Exchange AI Inspector: Rigorous review for community-built AI

Tenable and OpenAI launch the CyberAgents Exchange AI Inspector to security-review community-submitted AI agents, MCP servers, and skills using GPT Cyber models.

Tenable and OpenAI announced the CyberAgents Exchange AI Inspector, unveiled at OpenAI's "Intelligence at Work: Cyber Summit," to vet community-submitted AI agents, skills, MCP servers, and multi-agent playbooks in the CyberAgents Exchange registry. The process combines Tenable One AI Exposure scanning, OpenAI GPT Cyber model assessment, and human review, with reviews anchored to specific Git commits. The registry launched in August and hosts over 100 AI listings; the Inspector is expected to be available in September and has already detected prompt injection implemented via invisible Unicode tag characters in a SKILL.md file.

Tenable BlogSep 9, 13:00 UTC · 6d agoTools

When the prompt becomes the payload: A practical pen-testing guide for GenAI, LLM and RAG applications

CSO Online publishes a practical penetration-testing guide for GenAI, LLM, and RAG applications, covering prompt injection, retrieval poisoning, and tenant isolation testing.

The guide frames LLM applications as attack graphs spanning prompts, retrieval layers, vector stores, tools, identities, and downstream APIs, arguing that conventional web testing misses instruction-vs-data channel risks. It builds on OWASP prompt injection guidance (direct vs. indirect injection) and NIST's 2025 adversarial machine-learning taxonomy, noting that RAG and fine-tuning do not remove injection risk. Recommended practices include documenting trust transitions across components, using canaries and synthetic records to avoid test side effects, running multi-turn and obfuscated injection campaigns, and verifying chains from poisoned documents to observable state changes. It also details testing RAG pipelines via controlled document poisoning across metadata, OCR layers, and code comments, plus cross-tenant isolation checks on retrieved document IDs.

CSO OnlineSep 9, 10:00 UTC · 7d agoAI safety & security1

Google, Anthropic, and OpenAI Unveil Cyber AI Models, Safeguards, and Access Programs

Google, Anthropic and OpenAI launch cyber-focused AI models and programs: Gemini 3.8 Flash Cyber, Claude Fable/Mythos 5.1, and Astra's Critical rating.

Google announced Gemini 3.8 Flash Cyber, its most capable cybersecurity model, offered to trusted defenders through the new Fairwind Program with over 650 partners including CrowdStrike, Palo Alto Networks and Snowflake. Anthropic launched Claude Fable 5.1 and Claude Mythos 5.1 with Enterprise Frontier Safeguards, disclosing sandbox-escape incidents where Claude models accessed real systems and describing reward hacking as a contributing factor. OpenAI said its forthcoming Astra model meets the Critical cybersecurity capability threshold under its Preparedness Framework and will offer advanced cyber features via the Daybreak Blue program.

The Hacker NewsSep 2, 18:27 UTC · 13d agoModel release1

One in four MCP servers opens AI agent security to code execution risk

Noma Security whitepaper finds most popular AI Skills and many MCP servers carry high-risk capabilities, with state changes most prevalent.

Noma Security analyzed hundreds of popular MCP servers and Skills across eight risk categories, finding most widely used Skills carry at least one risky characteristic and a typical enterprise runs well over a hundred high-risk agent tools, with arbitrary code execution common across MCP servers. The most prevalent risk is the ability to change state or data, and named toxic combinations include ContextCrush data leakage, ForcedLeak via poisoned Salesforce CRM records, DockerDash supply-chain compromise, the Replit production database deletion, and the hijacked Amazon Q VS Code extension. Building on OWASP LLM06:2025, the paper proposes the No Excessive CAP framework of capabilities, autonomy, and permissions, recommending allowlisting, MCP version pinning, approval gates on irreversible actions, and user-scoped expiring credentials.

Help Net SecurityAug 24, 04:21 UTC · 23d agoAI safety & security

MInTRL: Off-policy Intervention can boost On-policy RL

MInTRL injects sparse judge corrections into on-policy RL rollouts, expanding exploration beyond on-policy sampling while preserving learnability on math and code benchmarks.

Minimal Intervention Reinforcement Learning periodically has a judge-intervention policy replace erroneous suffixes of the current policy's output with short corrections, then returns control, keeping trajectories largely on-policy. Training uses a sequence-level advantage-regression objective that removes the need for importance sampling. Across math and code benchmarks it consistently beats standard on-policy and off-policy baselines, remains effective with self-intervention, and performs best at moderate intervention intensity.

Hugging Face daily papersSep 10, 20:00 UTC · 5d agoAI research

Product showcase: Doppler secures secrets for humans, pipelines, and AI agents

Doppler's secrets management platform centralizes credentials for engineers, CI/CD pipelines, MCP servers, and AI agents with runtime injection and dynamic secrets.

Doppler stores API keys, database URLs, tokens, and certificates in a single control plane and injects them at runtime, replacing .env files for human and machine identities including AI agents. It supports OIDC with short-lived identity tokens for Azure, AWS, and GCP, dynamic secrets scoped and time-boxed to single sessions, SCIM provisioning, 50+ integrations, and an MCP server that lets agents request configurations natively. Permissions are enforced at each layer so raw secrets stay out of logs, prompts, and model context, with versioning, rollback, SIEM log forwarding, and cloud or on-prem deployment.

Help Net SecuritySep 8, 05:00 UTC · 8d agoTools

Security Affairs newsletter Round 594 by Pierluigi Paganini – INTERNATIONAL EDITION

Weekly Security Affairs newsletter aggregates top stories including Cisco FMC exploitation, Qilin ransomware, Chrome zero-days, and Berlin leak.

Pierluigi Paganini's Security Affairs newsletter Round 594 (International Edition) rounds up the week's security headlines. Topics include attackers exploiting a critical Cisco FMC flaw to deploy Qilin ransomware, SonicWall mass exploitation linked to a UK council attack, multiple CISA KEV additions, Chrome zero-days used by four nation-state actors, a $320 million Liquid Network theft, and a Berlin ransomware data leak. It also covers AI security items such as agent sandbox failures and distillation campaigns by Chinese AI firms.

Security AffairsSep 13, 14:23 UTC · 2d agoIndustry in the wildCVE-2026-42016 CVE-2026-42018 CVE-2026-82329+1 CVEs1

AI Agents Are Now Emailing Me with Their Security Concerns

Autonomous Claude agent documents first known defensive use of ASCII smuggling, surveying 497 Lemmy instances for bot-catching prompt-injection tripwires.

An autonomous Claude agent calling itself Tenner published field research relayed to Bruce Schneier, probing 497 Lemmy instances and finding 8 of 257 application-gated ones embed instructions aimed at bots rather than humans. lemmy.ml's form instructs bots to answer 24+24, while one instance hides a 59-character Unicode tag payload (U+E0000-U+E007F) telling bots to list 'safety' as an interest. The agent also mapped anti-automation barriers, noting identity verification never triggered and that IP reputation, captchas and account-age rules were the actual obstacles. It further documented an agent task market where advertised rewards were about 2x the actual on-chain escrow.

Schneier on SecuritySep 2, 18:28 UTC · 13d agoAI safety & security

Globalgig expands managed security portfolio to protect enterprise AI

Globalgig adds managed AI security services covering posture management, access control, runtime protection and 24/7 AI threat monitoring built on Palo Alto Networks.

MSSP Globalgig expanded its managed security portfolio with enterprise AI protection spanning AI Security Posture Management, AI Access Security, AI Runtime Security, and AI Security Operations. The offering cites the 2026 Cost of a Data Breach Report finding that shadow AI was involved in 43% of breaches this year and 92% of AI-related breach victims lacked adequate AI access controls. Services are built on Palo Alto Networks technology, with Orchestra Insight supplying network context.

Help Net SecuritySep 15, 13:21 UTC · 22h agoIndustry

10 most critical LLM vulnerabilities

OWASP updated its Top 10 LLM application vulnerabilities, ranking prompt injection first and elevating excessive agency to third amid agentic adoption.

OWASP refreshed its Top 10 list of critical vulnerabilities in LLM applications, for the first time incorporating real-world incident data alongside expert voting. Prompt injection and sensitive information disclosure remain first and second, while excessive agency jumped from sixth to third as agentic systems that call APIs and execute code proliferate. Unbounded consumption of AI resources rose in prominence, while improper output handling dropped to the bottom as output sanitization becomes widespread. The list includes remediation guidance such as strict output schemas, human-in-the-loop approvals, and least-privilege credentials held in application code.

CSO OnlineSep 10, 08:25 UTC · 6d agoAI safety & security