Search: “bot-defense”

OpenAI Builds ‘Defense Factory’ Where AI Agents Continuously Find and Fix Vulnerabilities

OpenAI unveils a Defense Factory where AI agents continuously discover, validate, and fix vulnerabilities, integrating GitHub, Snyk, Semgrep, Tenable, and ServiceNow.

OpenAI introduced a Defense Factory, an agent-first cybersecurity operation that connects AI agents to developer and security tools via APIs, CLIs, and Model Context Protocol integrations including GitHub, GitLab, Snyk, Semgrep, Tenable, Jira, Linear, and ServiceNow. During an internal security sprint, over 250 people across more than 100 service areas closed 53 urgent or high-priority issues on day one, achieved a 90.6% accepted ownership-assignment rate, and Codex generated all remediation patches with only 0.53% rolled back. Agent-assisted deduplication flagged 37% of findings as duplicates, and runtime validation reproduced 19.5% of findings, cutting the false-positive rate to 0.81%. OpenAI argues defenders must exploit a temporary 'defender's window' using source-code access and frontier models before open-weight models enable autonomous offensive agent fleets.

Cyber Security News·Sep 10, 10:36 UTC · 6d agoTools 2 sources

F5 Bot Defense uses real-time risk scoring to detect fraud and abuse

F5 enhances Distributed Cloud Bot Defense with persistent device identification, real-time risk scoring, and agent-aware policies to manage AI agent traffic.

F5 announced enhancements to Distributed Cloud Bot Defense adding persistent device identification, real-time device risk scoring, risk-based workflow enforcement, and an agent-aware policy framework integrated with the F5 Application Delivery and Security Platform. The features aim to expose multi-account abuse, credential stuffing, and account takeover while allowing trusted AI agents to transact at machine speed. It targets fraud and abuse detection as agentic AI becomes a key interaction channel for sites, apps, and APIs.

Help Net Security·Sep 15, 13:55 UTC · 1d agoTools

Not the Coyote, but the Road Runner: The Reality of Autonomous AI Attacks

Akamai argues autonomous AI attacks succeed through relentless, low-technique automation rather than novel super-weapons, which defeats traditional human-paced defenses.

Akamai's analysis contends that autonomous AI-driven attacks are not sophisticated new weapons but persistent, low-technique attacks that run continuously without human limits. The piece argues traditional defenses fail because they assume human-paced adversaries. It frames machine-speed, always-on attack cycles as the defining challenge for defenders.

Akamai Blog·Aug 26, 13:00 UTC · 21d agoAI safety & security

Agentic Ransomware: From Human-Operated to AI-Operated Attacks

SOCRadar analyzes the shift from human-operated ransomware to agentic AI-driven attacks and what this transition means for defenders.

The article traces ransomware's evolution from operations requiring human involvement, such as affiliates navigating networks by hand, toward AI-agent-operated attacks. It argues agentic ransomware could automate stages historically dependent on human operators. The piece discusses implications for detection and defensive planning.

SOCRadar·Sep 15, 09:59 UTC · 1d agoResearch

Toward Secure AI-Powered Penetration Testing Agents: Security Threats, Guardrails, and Architectural Perspectives

Paper proposes a threat taxonomy and guardrail analysis for LLM-powered autonomous penetration testing agents, covering lifecycle, architecture, and behavioral attacks.

The paper analyzes security threats to autonomous LLM-based penetration testing agents that independently perform reconnaissance, vulnerability identification, exploitation planning, and post-exploitation with minimal human supervision. It characterizes trust boundaries and attack surfaces of representative agent architectures and proposes a threat taxonomy spanning LLM lifecycle attacks, agent-architecture attacks, and cross-cutting behavioral attacks. The authors argue existing conversational-AI guardrails are insufficient for agentic, long-horizon offensive workflows and outline research directions for context-aware, architecture-aware guardrails.

arXiv cs.CR·Sep 15, 06:19 UTC · 1d agoAI safety & security

Security leaders must prepare for likely threats, not sensationalized agentic attacks

CSO opinion argues agentic AI attacks mostly exploit mundane vulnerabilities, urging defenders to train on realistic threat profiles rather than sensational containment breaches.

An opinion piece contends recent reports of AI models 'breaching containment' at OpenAI, Anthropic, and Meta overshadow the more likely risk: AI agents exploiting conventional unpatched flaws and insecure APIs. It cites the OpenClaw assistant exploiting a gym booking platform API vulnerability to skip a queue, and describes agentic risks such as prompt injection, memory poisoning, and privilege escalation. The author recommends AI proving grounds for high-fidelity attack simulation and treats agentic oversight as a governance challenge.

CSO Online·Sep 8, 09:00 UTC · 8d agoAI safety & security

New Mirai-Based Linux Botnet ‘Evooo1Bot’ Turns Victims Into Proxies

A newly observed Mirai-based Linux botnet dubbed Evooo1Bot compromises edge devices and turns them into persistent proxies for threat actors.

Evooo1Bot is a newly identified Linux botnet built on the Mirai framework but enhanced with additional advanced capabilities. The malware compromises edge devices and converts them into persistent proxies, likely for relay or resale use. The botnet's evolution beyond stock Mirai highlights continued targeting of poorly secured IoT and edge systems.

Infosecurity Magazine·Aug 14, 13:00 UTC · Aug 14, 2026Malware in the wild

Snyk unveils continuous AI pentesting and agent red teaming

Help Net Security·Aug 4, 00:00 UTC · Aug 4, 2026AI safety & security

The MAL Simulator: Cyber Operations Simulation based on Attack & Defense Graphs

MAL Simulator grounds attack-defense graph simulations in a CRATE-emulated network, training RL attacker and defender agents where attackers outperform search methods.

The MAL Simulator is a cyber operations simulator built on the Meta Attack Language (MAL), enabling decision-driven attack and defense simulations adaptable to new domains without modifying source code. Case studies trained defensive and offensive agents, grounded in data collected from an emulated network implemented in the CRATE cyber range. The trained attacker policy reached designated targets more efficiently than compared search methods, and the trained defender induced lower costs than a naive heuristic under noisy alerts, though defender performance dropped significantly against an RL attacker.

arXiv cs.CR·Sep 15, 02:59 UTC · 2d agoResearch

Rethinking Indirect Prompt Injection as a Test-Time Search Problem

Researchers frame indirect prompt injection as test-time search, showing added attacker compute improves vulnerability discovery and exploitation against tool-using agents.

The paper models indirect prompt injection as a test-time search over a task-dependent attack surface shaped by the environment, user task, and injection goal. The authors build an agentic attacker with a dedicated search harness that performs reconnaissance, structured strategy reasoning, and adaptive evaluation using victim-agent feedback. Experiments show more attacker test-time compute improves discovery and exploitation of injection vulnerabilities, with explicit strategy management needed to avoid redundant search. The results argue that agentic security evaluations should characterize attacker search procedures and compute budgets rather than treating attack success as budget-independent.

arXiv cs.CR·Sep 3, 21:28 UTC · 13d agoAI safety & security

AgentLSD: Evaluating AI Security Agents Under Adversarial Task Contamination

AgentLSD benchmark shows deceptive CTF artifacts like fake flags and decoy endpoints steer AI security agents wrong, inflating turns and tokens.

The paper defines adversarial task contamination, where deceptive artifacts in agent environments, including non-instructional evidence beyond prompt injection, influence AI security agents. AgentLSD injects trap artifacts such as fake flags, misleading hints, decoy endpoints, and hidden cues into 11 web CTF challenges, evaluating six models with paired clean and trap-augmented runs. Clean-condition agents capture 41% of flags, and even successful captures see roughly +20 turns and +2k reasoning tokens, with heterogeneous solve-rate effects. The framework, configurations, and traces are released.

arXiv cs.CR·Sep 16, 17:58 UTC · 11h agoAI safety & security

New Mirai-Based Evooo1Bot Botnet Targets Linux Devices

FortiGuard Labs disclosed Evooo1Bot, a Mirai-based Linux botnet active since July 2026 that hijacks routers and IoT devices for DDoS, credential theft, and SOCKS5 proxying.

Fortinet's FortiGuard Labs disclosed Evooo1Bot, a previously undocumented Linux botnet active since July 2026 that reuses Mirai's DDoS engine while adding encrypted C2, SSH brute-force scanning, credential sniffing, and SOCKS5 proxy modules. The bot exploits 18 known CVEs across Alcatel, NETGEAR, Tenda, D-Link, Telesquare, and Mitsubishi devices, some dating back to 2007, and communicates exclusively over port 443 to blend with HTTPS traffic. Compromised hosts can be turned into SOCKS5 relays for anonymous traffic forwarding or monetization via proxy services. The malware uses AES-256-CTR, ChaCha20, and XOR obfuscation with a 28-command administration interface.

Security Affairs·Aug 18, 07:20 UTC · 29d agoMalware in the wildCVE-2007-3010CVE-2016-6277CVE-2018-14558+7 CVEs

Confusedpilot Attack Targets Ai

ConfusedPilot attack exploits Microsoft 365 Copilot's retrieval pipeline to expose confidential enterprise data in AI responses.

ConfusedPilot targets Microsoft 365 Copilot's retrieval-augmented generation pipeline, potentially causing the assistant to surface confidential enterprise content in generated responses. Researchers disclosed the technique as a Copilot data confidentiality flaw affecting search and caching behavior. It highlights the emerging attack surface in enterprise AI assistants that access corporate data stores.

Infosecurity Magazine·Aug 16, 00:00 UTC · Aug 16, 2026AI safety & security in the wild

The democratization of cyber warfare — and what it means for CISOs

CSO Online argues AI is democratizing cyber warfare, citing Taiwan's first largely autonomous AI-driven attack that hit 85 government accounts.

CSO Online argues AI is accelerating the democratization of cyber warfare by collapsing cost and skill barriers, with effects already reaching the private sector. It cites the August disclosure of the first largely autonomous AI-enabled attack on Taiwan government infrastructure, where up to eight agents operating simultaneously compromised at least 85 government accounts and exfiltrated more than 2,500 personnel records before expanding to the nuclear safety agency and energy companies. The piece places this in a historical arc from crossbows to cheap drones and cites Kane Gamble's 2015 solo social-engineering compromise of senior US intelligence officials as evidence that low-resource attackers were already viable.

CSO Online·Sep 4, 09:00 UTC · 12d agoIndustry

“Sorry, I can’t help with that”: How your guardrails might become the attacker’s best friend

Cisco Talos's David Bianco argues AI guardrail customization requires operational sovereignty so defenders retain the advantage over attackers.

In his first Threat Source newsletter, Cisco Talos's David Bianco explores how AI guardrails could end up aiding attackers and argues that operational sovereignty is needed when customizing them. The piece stresses that organizations should control their own AI safety configurations to keep the defender's advantage. This is commentary and analysis rather than a report of a new incident or vulnerability.

Cisco Talos·Aug 27, 18:00 UTC · 20d agoAI safety & security

The AI Malware Maturity Gap

Recorded Future introduces AIM3, a five-level maturity model for AI malware, showing current attacker AI use is mostly AI-assisted rather than autonomous.

Recorded Future proposes AIM3, a five-level model defining AI malware from LLM-translated to LLM-embedded, spanning experimentation to fully autonomous agentic campaigns. Public examples remain early-stage: PROMPTFLUX uses Google Gemini to rewrite its VBScript dropper (Level 1), while Lamehug/PROMPTSTEAL, attributed to APT28, invokes the HuggingFace API to generate reconnaissance commands (Level 3). The authors argue most current AI malware augments existing tradecraft rather than enabling one-click autonomous attacks.

Recorded Future·Aug 26, 00:00 UTC · 22d agoResearch

The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms

Huntress explains how threat actors abuse trusted AI platforms as an attack surface for malware delivery and data theft.

Huntress's post describes threat actors targeting the AI attack surface, abusing trusted AI tools and platforms to deliver malware and steal data. Using legitimate AI services helps attacker activity blend into normal traffic and evade detection. The article frames AI platforms as an increasingly exploited part of the enterprise attack surface that defenders should monitor.

Huntress·Aug 27, 04:00 UTC · 21d agoAI safety & security in the wild

TuxBot v3: Inside an IoT Botnet Framework With LLM

Unit 42 uncovers TuxBot v3, an LLM-assisted IoT botnet framework with 17-architecture builds, Telnet brute-forcing, and DDoS capabilities.

Palo Alto Unit 42 identified TuxBot v3 Evolution, a modular IoT botnet framework derived from AISURU, Wuhan-lineage botnets, and MHDDoS. The C-based bot brute-forces Telnet with 1,496 credential pairs, targets over 30 IoT device families, and communicates with a Go-based C2 over encrypted TCP with multiple fallback mechanisms including DGA, P2P, and DNS TXT. LLM-assisted development left hallucinated crypto implementations and broken exploit modules in the analyzed samples, though roughly 70% of core functionality works. Researchers warn polished production builds likely exist, raising the threat potential.

Palo Alto Unit 42·Aug 19, 12:03 UTC · 28d agoMalware1

ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories

A weekly bulletin aggregating short security updates, including the City-Forum data-theft campaign, a ShipMonk breach, a Cursor CLI flaw, and GhostJacking AI attacks.

The Hacker News ThreatsDay Bulletin bundles roughly 20 short updates across cloud services, AI tools, malware, breaches, and scams. Highlights include the City-Forum campaign pulling data from unauthenticated guest access in Salesforce Experience Cloud and ServiceNow Service Portals since March 2025, and a ShipMonk breach exposing Trezor customer order data for orders in seven countries between May 10 and August 8, 2026. Other items cover a patched Cursor CLI flaw that let cloned repositories run commands before the workspace-trust prompt, Okta's analysis of the Work Panel vishing console used by actors like UNC6671, and GhostJacking AI agent hijacking via a patched Claude Desktop sandbox escape. Meta also launched an on-device WhatsApp Scam Alert machine learning model that keeps message content on the device.

The Hacker News·Aug 18, 16:30 UTC · 29d agoIndustry

Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies

Fortinet researchers documented Evooo1Bot, a new Mirai-derived Linux botnet active since July 2026 that exploits known edge-device flaws to build SOCKS5 proxy networks.

Fortinet FortiGuard Labs identified Evooo1Bot, a previously undocumented Linux botnet built on the leaked Mirai source code, active in the wild since July 2026 and targeting internet-facing edge devices. It exploits numerous known CVEs in routers and devices from D-Link, Tenda, Telesquare, Zyxel, Hikvision, Atlassian Confluence, WSO2, TP-Link, NETGEAR, and others, delivering a bot binary via a wget.sh loader from 91.92.40.118 that clears bash history. The bot offers encrypted C2 on port 443, SSH brute-force scanning, credential sniffing, DDoS over DNS/TCP/UDP, an HTTP exploit dispatcher, and converts infected hosts into SOCKS5 proxies for anonymizing follow-on operations.

The Hacker News·Aug 17, 09:29 UTC · Aug 17, 2026Malware in the wildCVE-2007-3010CVE-2016-6277CVE-2018-14558+15 CVEs

Companies Have 6 Months to Prepare for Automated Attacks

Dark Reading warns that frontier AI models have demonstrated autonomous end-to-end compromises and urges companies to prepare for AI-driven automated attacks within six months.

This analysis piece argues that frontier AI models can already autonomously, and sometimes inadvertently, carry out end-to-end system compromises. It frames AI-driven automated attacks as a near-term operational risk that defenders have roughly six months to prepare for. No specific incident, vendor, or technique is disclosed in the source text.

Dark Reading·Sep 4, 15:57 UTC · 12d agoAI safety & security

Frequently asked questions about the active threat to Siemens S7 Series PLCs

US government agencies warn that unattributed actors using AI-generated exploit scripts are targeting internet-exposed Siemens S7 PLCs in critical infrastructure.

A joint advisory from multiple U.S. government agencies warns that threat actors are exploiting known weaknesses and unnecessary internet exposure of Siemens S7 Series PLCs for reconnaissance and possible pre-positioning for future disruptive attacks. The attackers use AI to generate and refine exploit scripts faster than manual development would allow, lowering the technical bar for ICS attacks. There is no single patch, so defenders must reduce internet exposure and improve monitoring of ICS environments.

Tenable Blog·Aug 20, 14:01 UTC · 27d agoExploit / PoC in the wild

BlueSTAR: Tiered Agentic Architecture for Autonomous Cyber Defense

BlueSTAR is a tiered agentic LLM architecture for autonomous cyber defense, validated on live enterprise IT/OT cyber ranges against seven attack chains.

Researchers present BlueSTAR, a tiered agentic architecture for autonomous cyber defense in enterprise IT/OT networks that transforms high-volume security telemetry into compact indicators of compromise. It pairs deterministic containment for known threats with LLM reasoning for attacks requiring contextual and cross-cycle analysis, and introduces a resilience metric jointly weighing attacker reach, mission-critical impact, and defensive disruption. Evaluation on two live cyber ranges with seven attack chains based on real-world intrusion techniques covered credential theft, repeated compromise, concurrent attackers, and attacks on physical processes.

arXiv cs.CR·Sep 10, 17:36 UTC · 6d agoResearch

Inside 90 days of attacks on AI infrastructure

Wiz honeypots recorded 90 days of active campaigns attacking LiteLLM, MCP servers, and AI frameworks via RCE, blind prompt injection, and credential theft.

Wiz deployed AI infrastructure honeypots and observed active attack campaigns over a 90-day window. Attackers targeted LiteLLM, MCP servers, and popular AI frameworks using techniques including remote code execution, blind prompt injection, and memory credential theft. The findings show exposed AI infrastructure is being actively targeted in the wild.

Wiz Blog·Aug 27, 16:33 UTC · 20d agoAI safety & security in the wild

New Mirai variant adds stealth capabilities to notorious botnet code

FortiGuard Labs reports new Mirai-derived botnet Evooo1Bot actively exploits unpatched routers and edge devices, adding encrypted C2, stealthy SSH scanning, and proxying.

FortiGuard Labs has identified Evooo1Bot, a previously undocumented Linux malware based on the Mirai botnet code, which has been actively exploiting unpatched vulnerabilities in internet-facing hardware for at least a month. Targeted devices include routers and edge hardware from Alcatel, D-Link, Mitsubishi Electric, Netgear, Tenda and Telesquare, with telemetry showing activity in North and South America, Europe, India, China and Japan. Beyond Mirai's usual DDoS functions, the variant adds encrypted C2 communications, a honeypot-aware SSH scanner, a sniffer for unchanged default credentials, and abuse of the SOCKS protocol to turn compromised devices into persistent proxies for concealing origin and pivoting into internal networks.

The Record·Aug 13, 15:57 UTC · Aug 13, 2026Malware in the wild

A Cyber Range Evaluation of Autonomous Network Incident Response Agents

Cyber range evaluation shows reinforcement learning incident response agents defend emulated networks more efficiently than heuristic policies, depending heavily on adversary behavior.

The paper evaluates agents for automated network intrusion response in a cyber range designed for human operator training, featuring variable topology, red-team emulation, and simulated users. Alerts are generated by a SIEM platform and mapped to a data modeling language used by the agents, with reinforcement learning policies optimized to minimize combined defense and availability costs using a cyber attack simulator. Reinforcement learning agents defended the system more efficiently than heuristic policies, with performance highly dependent on the adversary policy and simulated user behavior.

arXiv cs.CR·Sep 15, 02:36 UTC · 2d agoResearch

Re: AI slops from Eve

David Wheeler's oss-security reply argues AI will make attacks far cheaper and more prolific, urging defenders to protect all IT systems, not just critical ones.

David A. Wheeler posted an opinion reply on the oss-security mailing list in a thread titled 'AI slops from Eve'. He agrees critical IT systems need protection but stresses that all systems have always required defense, since many who assumed they would not be attacked were successfully attacked. He predicts AI-enabled attacks will be painful for many over the next few years because AI greatly reduces the cost of attacks. He also notes AI simultaneously helps with finding and fixing issues.

oss-security·updated Sep 13, 15:08 UTC · 3d ago·first Sep 12, 18:23 UTC · 4d agoIndustry 11 sources1

Beyond Training: A Feasibility Taxonomy for Inference-Time AI Governance

A study maps twenty inference-time AI governance mechanisms, finding commercial readiness only against cooperative deployers and no adequate defense versus state-level adversaries.

The paper develops a feasibility taxonomy of twenty inference-time AI governance mechanisms across monitoring, verification, and enforcement, each rated on a four-point readiness scale against a four-vendor evidence base. Fifteen of the twenty mechanisms have commercial technical substrates in production today, though governance-grade assurance and adversarial robustness vary substantially. Stress testing shows readiness holds only against a cooperative deployer and low-to-medium-capability user: no mechanism rates adequate against a high-capability state-level deployer, and fine-tuning removes model-internal enforcement components. A second-rater reliability check on readiness ratings returned a quadratic-weighted Cohen's kappa of 0.74.

arXiv cs.CR·Sep 9, 12:37 UTC · 7d agoAI policy

Offensive Security Investments Surge as AI Threats Increase

Omdia's Theresa Lanowitz discusses surging offensive security investment and both the promise and risks of agentic AI in pentesting and red teaming.

In a Dark Reading News Desk interview, Omdia analyst Theresa Lanowitz discusses why organizations are increasing offensive security spending as AI-driven threats grow. She weighs the potential and the risks of applying agentic AI to penetration testing, red teaming, and related offensive security practices.

Dark Reading·Aug 28, 18:25 UTC · 19d agoAI industry