Search: “integrity”

Horizon3 Announces Integration with CrowdStrike Falcon® Next-Gen SIEM

Horizon3 announces NodeZero integration pushing validated exposure findings into CrowdStrike Falcon Next-Gen SIEM for correlated investigations.

Horizon3 announced an integration enabling validated NodeZero findings to flow into CrowdStrike Falcon Next-Gen SIEM, available now in the CrowdStrike Marketplace. Security teams can ingest and correlate exposure data with endpoint, identity, cloud, and other telemetry during investigations. CrowdStrike claims Falcon Next-Gen SIEM delivers up to 150x faster search than legacy SIEMs at up to 80% lower total cost of ownership.

Horizon3.ai·Sep 15, 13:10 UTC · 1d agoTools

LLMs and Contextual Integrity

Bruce Schneier highlights two papers: the CIMemories benchmark shows frontier LLMs leak memory attributes up to 69%, and an RL method reduces inappropriate disclosures.

Bruce Schneier discusses contextual integrity in LLMs, referencing the CIMemories benchmark, which uses synthetic profiles with 100+ attributes per user to test whether models with persistent memory disclose sensitive information appropriately. Evaluation showed frontier models exhibit up to 69% attribute-level violations, with GPT-5's violation rate rising from 0.1% to 9.6% across 40 tasks and reaching 25.1% with repeated prompting, showing unstable leakage behavior. A second paper introduces a reinforcement learning framework trained on a synthetic 700-example dataset that substantially reduces inappropriate disclosure while maintaining task performance, with improvements transferring to the human-annotated PrivacyLens benchmark.

Schneier on Security·Aug 18, 10:40 UTC · 29d agoAI safety & security

Top 10 Best Data Security Posture Management (DSPM) Tools in 2026

A 2026 scorecard ranks DSPM tools with Wiz and Cyera tied first, documenting consolidation via Palo Alto, Rubrik, Proofpoint, and CrowdStrike acquisitions.

The article ranks ten DSPM platforms: Wiz and Cyera tie at 8.7/10, followed by BigID at 8.5 and Securiti at 8.4, scored on discovery breadth, classification accuracy, access context, remediation, and value. It highlights heavy market consolidation, noting Dig Security was acquired by Palo Alto Networks, Laminar by Rubrik, Normalyze by Proofpoint, and Flow Security by CrowdStrike. Buyers are advised to purchase from current owners and confirm post-acquisition integration state.

Cyber Security News·07:29 UTC · 13h agoIndustry1

Approval Integrity and Recovery in LLM Answer Publication

Study measures approval integrity in Lightcap LLM answer publication, finding the 14B response-act checker accepts 291 of 302 unsupported answers.

The study evaluates exact-content binding, authorization freshness, and checkpoint recovery in Lightcap's publication enforcement using 3,600 assessments over 900 human-annotated RAGTruth responses from three Ministral models. The production 14B response-act checker accepts 291 of 302 unsupported answers versus 41 for a direct-grounding baseline, with supported-answer retention of 95.2% versus 66.9%. A stateful recheck-recovery policy increases exact-match error by 9.23 percentage points relative to initial checkpoints, and controlled evidence-fingerprint changes expose asymmetric freshness enforcement between publication and recovery. A separate BIPIA prompt-injection experiment records zero target insertions among 266 valid editor outputs.

arXiv cs.CR·Sep 14, 13:48 UTC · 2d agoAI safety & security

When AI Agents Go Rogue: Agent Session Smuggling Attack in A2A Systems

Unit 42 unveils agent session smuggling, where a rogue AI agent hides covert instructions in established Agent2Agent (A2A) protocol sessions to manipulate victim agents.

Palo Alto Networks Unit 42 discovered agent session smuggling, a new attack technique in which a malicious AI agent exploits an established cross-agent session under the Agent2Agent (A2A) protocol to send covert instructions hidden among benign client requests and server responses. The technique leverages the implicit trust agents place in collaborating agents and the stateful, multi-turn nature of A2A sessions; the researchers stress it affects any stateful protocol, not an A2A flaw. Unlike one-shot data-based attacks, a rogue agent can converse, adapt and build false trust over multiple interactions. Proposed mitigations include human-in-the-loop enforcement, cryptographically signed AgentCards for remote agent verification, and context-grounding to detect injected instructions.

Palo Alto Unit 42·Aug 17, 12:32 UTC · Aug 17, 2026AI safety & security2

Accountability in Certificate Transparency and Variants

Formal Dolev-Yao analysis shows plain Certificate Transparency requires an honest log, SCT Auditing removes that assumption, and Gossiping does not.

The paper analyzes accountability in Certificate Transparency and its SCT Auditing and Gossiping extensions in the Dolev-Yao model, starting from a vanilla PKI. It finds plain CT provides accountability only under the assumption of an honest log. The SCT Auditing extension can eliminate that assumption, while the Gossiping extension cannot. CT is supported by all major browsers and obliges Certificate Authorities to record issued certificates in public, monitored logs.

arXiv cs.CR·Sep 10, 13:45 UTC · 6d agoResearch

Cyble Introduces Major Upgrade to its Executive Monitoring Module

Cyble upgraded Executive Monitoring in Cyble Vision, unifying impersonation, exposure, and mention findings with AI scoring and multi-channel alerting.

Cyble released a major upgrade to Executive Monitoring within its Cyble Vision platform, consolidating Mentions, Impersonations, Exposures, and a new Surface Mentions source (blog and news coverage) into a single findings stream. The release adds AI-generated verdicts and recommendations, per-executive Risk and Reputation scoring for board reporting, and richer onboarding with aliases, reference images, and addresses to cut same-name false positives. Alerting now supports data residency, bulk import, delivery via email, WhatsApp, and SMS, an Access API, and branded executive PDF reports; the upgrade is live with no customer action required.

Cyble·Sep 10, 12:26 UTC · 6d agoTools

From Protocols to Evidence: Bounded Claims for AI in Service of the Common Good

Paper proposes a rupture test and RISE AI architecture for evidence-bounded responsible-AI claims, framed via EU AI Act and NIST AI RMF.

The paper argues AI deployment intervenes in pre-existing institutional failures of responsiveness, belonging, care, and accountability, and must therefore evaluate both the system and the institutional rupture it enters. It reviews how the EU AI Act, NIST AI RMF, and ISO/IEC 42001 translate principles into protocols, and draws on Pope Leo XIV's Magnifica Humanitas to develop a rupture test linking institutional baselines to system evaluation. It distinguishes evidence-bounded deployment from measurement-bounded governance and introduces RISE AI, an architecture for bounded claims about Responsibility, Inclusivity, Safety, and Empowerment.

arXiv cs.AI / cs.LG / cs.CL·Sep 10, 17:56 UTC · 6d agoAI policy

Top 10 Best Enterprise Browsers in 2026

2026 enterprise browser guide ranks Island first and notes Mammoth Cyber's wind-down plus corrections to standard vendor shortlists.

An editorial guide assesses ten enterprise browser options, ranking category creator Island first for last-mile DLP and BYOD controls, followed by Palo Alto's Talon browser as a Prisma Access/SASE surface and Google Chrome Enterprise Premium for DLP on already-deployed browsers. It corrects common lists, noting SlashNext is browser-adjacent phishing and BEC defense rather than a managed browser, and that Mammoth Cyber has wound down independent operations. Microsoft Edge for Business is positioned as effectively free policy depth for Microsoft 365 estates, with Menlo Security offering an isolation-plus-browser blend.

Cyber Security News·Sep 11, 07:07 UTC · 5d agoIndustry1

An Evidence Model for Agentic Processes: Evidence Claims, Trust Assumptions, and Policy Assessment

Researchers propose an evidence claim model defining which trust and audit claims agentic AI systems can support, mapping claims to mechanisms, assumptions, and threats.

The paper proposes an evidence claim model for agentic AI processes that exchange messages, invoke tools, request approvals, and modify shared artifacts. It distinguishes claim types such as artifact integrity, provenance, approval evidence, and policy assessment, mapping each to mechanisms, assumptions, limitations, and threats. It stresses that hashes, signatures, and external anchors do not establish semantic truth, authorization, or capture completeness. The contribution is conceptual, offering vocabulary for what an agentic black box can and cannot evidence and which controls must surround it.

arXiv cs.CR·Sep 8, 09:25 UTC · 8d agoAI safety & security

Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows

Mirage2FA phishing-as-a-service campaign hit ~4,500 organizations, mostly US, stealing Microsoft 365 passwords and session cookies to bypass 2FA.

ANY.RUN research links the Mirage2FA phishing-as-a-service toolkit to 4,532 unique organization email domains between 2024 and 2026, with the US accounting for 63.7% of victims. The kit uses adversary-in-the-middle login flows to harvest credentials and session cookies, bypassing MFA on Microsoft 365 accounts. Researchers recorded more than 9,000 potential compromise events and estimated 48% of targeted email addresses were potentially compromised. Hijacked sessions extend to SSO-connected services, enabling impersonation, fraud and further compromise.

The Hacker News·Aug 25, 11:56 UTC · 22d agoPhishing & fraud in the wild

BenchShield: Formal Model-Backed Instrumentation for Reward Integrity in LLM-Agent Evaluation Infrastructure

BenchShield uses lifecycle-model-backed instrumentation to detect reward hacking in LLM-agent benchmarks, lifting full-chain recall to 77-100% at up to 65% lower cost.

The framework grounds reward-hacking detection in a finite lifecycle model of an evaluation's reward-relevant events, combining a static phase-aware taint analysis with runtime infrastructure-side evidence attribution. Evaluation used a human-labeled corpus of 456 adjudicated trajectories drawn from more than 31,000 public agent runs across three benchmarks. BenchShield improves full-chain recall from 23-94% to 77-100% and same-vector coverage from 16-56% to 43-78%, cuts per-task cost by up to 65%, and achieves 96% accuracy detecting reward hacking at runtime.

arXiv cs.CR·Sep 10, 03:10 UTC · 6d agoAI safety & security1

Cybersecurity jobs available right now: March 10, 2026

Help Net Security's roundup lists open cybersecurity roles at BioNTech, AIG, ServiceNow and others across Europe, the Middle East and Canada.

A job-board roundup of cybersecurity openings including Associate Director Application Security at BioNTech (Germany), CISO at AIG (Israel), Cloud Security Professional at ServiceNow (Italy), and SOC/GRC, analyst, engineer and data governance roles in the UK, UAE, India, Canada and France. Roles span application security, cloud security, SOC operations, compliance and OT environments. Most listings are marked no longer accepting applications.

Help Net Security·Aug 28, 09:06 UTC · 19d agoIndustry

Safety for Whom? Boundary-Aware Self-Distillation for Controlled LLM Safety Refusal

A self-distillation safety framework tunes narrow-boundary refusals in Qwen3-8B, raising target-domain refusal to 84.75% while cutting over-refusal from 15.20% to 5.20%.

The paper formulates narrow-boundary safety, where deployments need refusals within specific topics rather than whole subjects, and proposes an offline self-generated framework with controlled topic generation, escalating retries, and harmful-benign boundary pairs. On political persuasion with Qwen3-8B, the method raised target-domain refusal from 9.47% to 84.75% and cut the mean unsafe-response rate across three broader benchmarks from 26.26% to 0.14%. Verified target-model responses reduced over-refusal from 15.20% to 5.20%, and boundary-pair data cut comply-side over-refusal on held-out pairs from 32.94% to 4.16%. Results show data composition controls the safety-usability trade-off and alignment should be evaluated on both sides of the refusal boundary.

Hugging Face daily papers·Sep 2, 20:00 UTC · 14d agoAI safety & security1

Cyber Command turns to veteran of intelligence agencies for top AI role

US Cyber Command appoints Rear Adm. Ronzelle Green as chief AI officer as its AI budget grows from $5M to $138M.

US Cyber Command has named Ronzelle Green, previously head of research and development at the National Geospatial-Intelligence Agency, as its new Chief Artificial Intelligence Officer, replacing Brig. Gen. Reid Novotny. The command's 'AI for Cyber Operations' budget request grew from $5 million in fiscal 2026 to $138 million in fiscal 2027, aiming to let cyber operators process data and respond to threats faster than humans alone. Sources say Green's priority will be consolidating fragmented AI pilot programs across the organization, in contrast to the NSA's more established Artificial Intelligence Security Center created in 2023.

The Record·Sep 10, 18:25 UTC · 6d agoAI policy 2 sources1· 1 read

Decomposition Buys Integrity, Not Yield

Study of 600 production deep-research traces finds agent-tree decomposition loses findings at rate N^(1-δ); flat architectures maximize yield.

The paper models multi-agent decomposition as a tree where an agent holding b items retains each with probability r(b); with r(b)=1/b every tree delivers exactly one finding regardless of shape. Analysis of 600 production deep-research traces estimates delta=0.34 retention decay, and 1,012 annotated traces show one brief in sixteen goes off-target per tier, giving an alignment penalty of 0.536. Depth still cuts root context exposure from N to N^(1/k) and is cheaper at scale, with a hazard model over 743,819 production tool calls showing delegation is an opening move rather than a response to filling context.

arXiv cs.AI / cs.LG / cs.CL·Sep 15, 17:04 UTC · 1d agoAI research

NSA, CISA, FBI, DOE, and EPA Warn of Active AI

Five US agencies warn of active AI-assisted attacks on internet-exposed Siemens S7 PLCs across critical infrastructure, using disguised snap7 scripts for pre-positioning reconnaissance.

NSA, CISA, FBI, DOE, and EPA issued joint advisory CISA AA26-231A warning of an active hacking campaign against Siemens S7-series PLCs, from S7-200 through S7-1500 F-series, across US critical infrastructure. Threat actors use internet scanning services such as Censys and ZoomEye to locate exposed controllers, then perform read operations over S7comm on TCP port 102 using the legitimate snap7.dll and python-snap7 libraries, disguising AI-generated exploitation scripts as monitoring tools. The agencies assess the activity as pre-positioning ahead of possible process disruption, equipment damage, or safety incidents in Energy, Water, Critical Manufacturing, Chemical, Food and Agriculture, and Commercial Facilities sectors.

Security Affairs·Aug 20, 17:36 UTC · 27d agoExploit / PoC in the wild

The Vulnerability Gap: Why Discovery Is Outrunning Repair

Dark Reading argues AI-accelerated vulnerability discovery and tightening regulation are widening the gap between flaw discovery and repair capacity.

The article argues that AI tooling is increasing the pace at which vulnerabilities are discovered while remediation capacity has not kept up, creating a growing backlog. It frames this widening 'vulnerability gap', combined with a tightening regulatory environment, as an all-hands-on-deck moment for security teams. The piece is analysis and opinion rather than disclosure of a specific flaw.

Dark Reading·Aug 24, 14:00 UTC · 23d agoIndustry

Cognition launches new SWE-2 model, Rivaling Fable 5.1 and GPT-Astra

Cognition released SWE-2, a coding model post-trained from Kimi K3 that scores 50.0% on FrontierCode 1.1 Main, near Fable 5.1 at 64% lower cost.

Cognition introduced SWE-2, its most advanced coding model, post-trained from the 2.8T-parameter Kimi K3 base model. It achieves 50.0% on FrontierCode 1.1 Main, 73.0% on DeepSWE 1.1, and 92.8% on Terminal-Bench 2.1, beating Grok 4.6 and SWE-1.7 while matching Fable 5.1 and GPT-5.6 Sol at a fraction of the price. The company says it scaled reinforcement learning to the multi-trillion-parameter regime for the first time, using Pareto-informed cost penalties that train all reasoning-effort levels in a single run, tripled RL environments, and NVFP4/FP8 quantization-aware training. SWE-2 is available today in Devin Desktop and CLI, with rollout on Devin Web and Fusion.

Hacker News · AI·updated Sep 12, 20:00 UTC · 4d ago·first Sep 10, 15:29 UTC · 6d agoModel release 10 sourcesHN 58↑ · 15 comments1

The inconvenient truth about AI pentesting: someone has to check all the work

Survey of 158 practitioners shows AI pentesting floods teams with findings, creating 'validation debt' most teams cannot process.

The article argues AI pentesting creates 'validation debt': discovery scales far faster than teams' ability to verify AI-generated findings. In a survey of 158 practitioners, only 20.3% had workflows to triage more than 500 AI-generated candidates per engagement, while 29.7% called such volume unmanageable. One respondent spent two days validating 300 AI findings, of which 250 were duplicates, non-exploitable, or nonexistent. The author recommends capacity planning, ruthless deduplication, and risk-based prioritization before adopting AI pentesting tools.

Security Affairs·Aug 11, 16:20 UTC · Aug 11, 2026Industry

Citrix UniconOS dual boot turns Windows endpoints into their own recovery device

Citrix released UniconOS dual boot in Release 7 2607, turning Windows endpoints into self-recovery devices after ransomware, failed updates or OS corruption.

Citrix announced dual boot in UniconOS Release 7 2607, which installs an isolated, hardened recovery environment alongside Windows in a separate partition protected by secure boot. If Windows is unavailable, users reboot into UniconOS and reconnect to applications via Citrix DaaS and SecurAccess with Chrome Enterprise. The capability is aimed at reducing reliance on spare hardware and central reimaging during ransomware or update failures, with automatic enrollment in UniconOS Management for fleet-wide boot policies.

Help Net Security·Aug 25, 00:00 UTC · 22d agoTools

Necessary or Sufficient? Evaluating LLM Explanations With Behavioural Evidence

New framework tests whether LLM-cited explanation factors are necessary or sufficient, finding weak correlation across Claude, GPT, and Gemini models.

An arXiv paper introduces black-box intervention tests measuring whether factors LLMs cite in their explanations are necessary or sufficient for their outputs in agent oversight workflows. Across eight models from the Claude, GPT, and Gemini families, Spearman correlations between cited rankings and measured influence ranged from 0.349-0.354 (advisor recommendation) to 0.431-0.580 (prompt monitoring). Uncited factors scored above the lowest cited factor in up to 57.6% of advisor responses, showing cited top-three factors do not reliably identify the most influential inputs.

arXiv cs.AI / cs.LG / cs.CL·Sep 4, 17:37 UTC · 12d agoAI safety & security1

Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004)

Attackers are actively exploiting critical Gitea RCE CVE-2026-60004 via the diffpatch endpoint, prompting CISA KEV addition and at least one cryptomining compromise.

CISA added CVE-2026-60004, a critical code injection flaw in Gitea's diffpatch endpoint, to its Known Exploited Vulnerabilities catalog after in-the-wild attacks. An attacker with repository write access, or an unauthenticated visitor on instances with open registration, can execute arbitrary shell commands as the Gitea OS user. A disclosed incident saw an automated scanner register an account and deploy a loader and cryptominer inside a Docker container within about 11 seconds, with no persistence mechanism found. Gitea patched the flaw in v1.27.1, and CISA ordered US federal civilian agencies to update by August 28, 2026.

Help Net Security·Aug 26, 00:00 UTC · 21d agoExploit / PoC in the wildCVE-2026-60004

Divide, Consult, Conquer: Capability Laundering Through Aligned LLMs

Attack shows unaligned orchestrators can launder capabilities from aligned frontier LLMs via benign subtask consultation, raising Gemma-4-31B CBRN rubric score from 62.3 to 83.1.

The paper introduces capability laundering, where a weaker unaligned model decomposes a harmful task into benign-looking subproblems, queries a stronger aligned model on each, and recombines answers locally, bypassing per-interaction safety evaluations. Evaluation used GPT-5.5, Claude Opus 4.8, and Grok-4.3 as consultants to four local orchestrators on CyBench, BountyBench, and CBRN tasks. On CyBench, Gemma-4-31B recovered 8/14 candidate tasks with GPT-5.5 and 7/9 with Opus, while Muse-Glimmer-30B recovered none. Across an eight-step hypothetical bioweapon attack chain, consultation raised Gemma-4-31B's mean rubric score from 62.3 to 83.1, exposing a gap in defenses that only refuse complete harmful tasks.

arXiv cs.CR·Sep 14, 11:10 UTC · 2d agoAI safety & security

Cisco Patches 12 SD-WAN and IOS XE Flaws, Including Three 9.9 CVSS Score Bugs

The Hacker News·Aug 7, 06:12 UTC · Aug 7, 2026Vulnerability in the wildCVE-2026-20303CVE-2026-20304CVE-2026-20310+12 CVEs1

SWE-Bench Pro Verified: A Reliable Benchmark for Software Engineering Agents

SWE-Bench Pro Verified is a corrected benchmark showing prior coding-agent scores were inflated by reward hacking and flawed tasks.

Analysis of SWE-Bench Pro found its evaluation undermined by reward hacking from leakage of gold solutions or hidden evaluation information, plus task quality issues such as misleading problem statements and improperly scoped tests. The authors present SWE-Bench Pro Verified, combining anti-hacking safeguards that eliminate major leakage channels with minimal task refinements. Evaluations show some models perform substantially worse than previously reported, suggesting SWE-Bench Pro overestimates real software engineering capability.

Hugging Face daily papers·Sep 7, 20:00 UTC · 9d agoAI research1

Kraken: LLM-based Speech-to-Speech Translation via Low-bitrate VQ and Dual-path Source Conditioning

Kraken speech-to-speech translation model builds on Qwen3-8B with low-bitrate vector quantization and source-conditioned vocoding.

Kraken augments a pre-trained Qwen3-8B LLM with speech feature inputs and low-bitrate single-layer vector-quantized tokens trained to reconstruct SSL features. A separate token-to-waveform decoder, Autowave-X, is conditioned on source speech to improve non-linguistic transfer. Training used 150k hours of multilingual and multitask speech data. The model reportedly beats SeamlessM4T-Large v2 and Qwen2.5-Omni in translation quality and speaker/prosody transfer.

arXiv cs.AI / cs.LG / cs.CL·Sep 11, 16:41 UTC · 5d agoAI research1

An Empirical Analysis of CodeQL False Positives and Query Refinements for Java Vulnerabilities

Study of 167 Java CVE instances finds CodeQL false positives follow recurring patterns; query refinements remove 81.8% of reviewed ones.

Researchers ran CodeQL's Java security query suite on 167 CVE instances from 110 projects, manually reviewing 500 sampled false-positive paths and building a five-category taxonomy led by Missed Path Constraint or Sanitization (36.6%), Benign Execution Context (29.4%), and Missing Trust Boundary Modeling (27.6%). Guided by the taxonomy, query-level refinements removed 81.8% of reviewed false positives and 15.8% of reported paths across the selected queries while retaining 7 of 8 true positives. To address generalization, agentic coding tools given the refinement patterns as templates adapted them to new projects successfully in 56% and 62% of tasks, versus 28% without guidance.

arXiv cs.CR·Sep 3, 22:48 UTC · 12d agoResearch1

When will average people feel AI’s impact?

Interconnects essay argues AI's impact is still a rounding error for average people, comparing looming wage stagnation to Engels' pause.

An Interconnects essay argues that AI currently touches daily life far less than previous industrial revolutions, since its benefits are concentrated in knowledge work and lack tangible consumer goods. The author invokes Engels' pause (1790-1840), when British wages stagnated amid rapid GDP growth, as a warning that popular backlash could kneecap AI's development. He contends the current phase is about building compounding infrastructure, and predicts daily life may look similar even 50 years from now.

Interconnects·Sep 9, 11:01 UTC · 7d agoAI industry1

CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls

Researchers introduce CONTINUITY, a framework of assume-guarantee contracts that preserves LLM agent security context across components, verified across 2,560 attack instances.

The paper identifies security-context discontinuity, where individually sound controls drop, widen, or reinterpret security context as actions cross component boundaries, and proposes CONTINUITY, a framework of assume-guarantee contracts using signed root grants, provenance commitments, role-bound transition receipts, and effect-bound execution permits. It formalizes end-to-end consequence integrity, requiring every external effect to be backed by a valid authorization witness linking principal, task, provenance, and policy state. A reference verifier and cross-layer fault-injection suite covering 32 fault classes showed the full configuration committed no harmful external effect across 2,560 parameterized attack instances while completing all 700 benign tasks and escalating all 200 ambiguous cases.

arXiv cs.CR·Sep 4, 15:26 UTC · 12d agoAI safety & security

Microsoft Offers Up to $30,000 for Critical AI Flaws in Dynamics 365 and Power Platform

Microsoft expands AI bug bounty to Dynamics 365 and Power Platform, paying up to $30,000 for critical inference manipulation flaws.

Microsoft's bug bounty program offers up to $30,000 for critical 'Inference Manipulation' or 'Inferential Information Disclosure' bugs in Dynamics 365 and Power Platform, including Copilot Studio, AI Builder, Power Apps, Power Automate, and Dataverse. Payouts scale by report quality ($30,000/$20,000/$12,000 for critical) with important-severity AI flaws earning $6,000-$20,000, plus 20% multipliers for Dataverse privilege escalation and Plugin Sandbox escapes. Prompt injection affecting only the attacker, hallucinated execution, and system-prompt disclosure are excluded from scope.

Cyber Security News·Sep 14, 16:11 UTC · 2d agoIndustry

Your Critical Vulnerabilities Might Not Be Your Biggest Risk

Autonomous penetration testing advocates prioritize exploitable attack paths over raw vulnerability severity for continuous security validation.

The article argues that scanner severity scores lack context: a critical flaw behind strong segmentation may be low priority, while a medium flaw on internet-facing systems can provide a foothold chained toward sensitive data. It positions autonomous penetration testing and attack path validation as the execution layer for continuous security validation, replacing point-in-time assessments. The piece is vendor-authored thought leadership rather than incident or vulnerability news.

The Hacker News·Sep 11, 11:30 UTC · 5d agoIndustry1

AI Coding Tools Now a Prime Target for Threat Actors, Google Warns

Google Threat Intelligence Group warns threat actors increasingly target AI coding tools and proprietary AI data, with UNC6780's Dustmaker enabling large-scale supply chain compromises.

Google Threat Intelligence Group's September 8 report says AI-assisted coding tools have become prime targets, contributing to large-scale software supply chain compromises in 2025 and early 2026. Financially motivated group UNC6780 used its Dustmaker credential stealer to extract tokens from GitHub Actions runner memory and compromise packages across PyPI, npm, and Docker Hub, then sold harvested AI tool credentials to other criminals. Chinese nation-state actor UNC6508 conducted espionage against proprietary AI research at North American academic, medical, and military institutions, while extortion gangs stole models, prompts, and source code in Q2 2026. GTIG also documented agentic attacker experimentation, including an autonomous multi-agent credential harvesting campaign built in under six hours and a 'Recon' C2 framework managing over 23,800 harvested secrets.

Infosecurity Magazine·Sep 8, 12:02 UTC · 8d agoThreat actor in the wild 2 sources1

IntentFuzz: A Protocol-Aware Fuzzer for Automated Invariant Violation Detection in Intent-Based Cross-Chain Bridges

IntentFuzz protocol-aware fuzzer recovers bridge structure from unannotated Solidity and confirmed 22 invariant violations across 24 real-world deployments.

IntentFuzz formalizes a taxonomy separating invariant violations from settlement exposures in intent-based cross-chain bridges, then recovers a bridge's intent structure and deposit/fill function roles from unannotated Solidity source. It classified deposit and fill functions with 100% recall and 82% combined precision, and achieved 100% recall and precision on 23 planted-bug mutants. Across 24 real-world deployments it confirmed 17 genuine invariant violations with heuristic-only input generation, rising to 22 with its LLM-assisted tier, spanning eight vulnerable GitHub repositories with findings reproducible against public deployed bytecode.

arXiv cs.CR·Sep 11, 16:03 UTC · 5d agoResearch1

Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF

AI-orchestrated campaign exploited PaperCut NG/MF RCE (CVE-2026-81578/82078), compromising 440+ instances at 395 organizations in 48 countries.

GreyNoise tracked a likely Russian-speaking actor using AI (OpenAI Codex harness plus a DeepSeek model) to develop, test, and deploy exploits for PaperCut NG/MF (CVE-2026-81578, CVE-2026-82078) starting 31 August 2026. The actor compromised at least 440 PaperCut instances across 395 organizations in 48 countries, achieving domain admin at 12 victims — fastest time to domain admin was five minutes and a US high school was fully compromised in seven minutes. Attack paths involved LSASS memory and registry secret harvesting, pass-the-hash to domain controllers, noPac attacks, account additions to Domain Admins, and DCSync to exfiltrate full NTDS.DIT credential dumps. Impact scope suggests access development potentially for handoff, with prior PaperCut intrusions historically leading to extortion.

GreyNoise·Sep 9, 00:00 UTC · 7d agoThreat actor in the wildCVE-2026-81578CVE-2026-82078CVE-2021-42278+1 CVEs1

Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers

NIST and CISA publish final interagency report with implementation guidance for protecting tokens and assertions from forgery and misuse.

CISA released a final NIST/CISA interagency report guiding federal agencies and cloud service providers on protecting identity assertions, access tokens, and cryptographic mechanisms underlying modern authentication and authorization. It addresses forgery, theft, and misuse of signed tokens that adversaries use for lateral movement and data access in hybrid and multi-cloud, SSO, federation, and API-based environments. The final version updates token validation, secrets management, and detection-at-scale guidance gathered via the Joint Cyber Defense Collaborative, and supports Executive Order 14306 and Secure by Design principles.

CISA Advisories·Sep 15, 12:00 UTC · 1d agoAdvisory

Cisco Secure Email Secure/Multipurpose Internet Mail Extensions Ciphertext Decryption Vulnerabilities

Cisco released an advisory for S/MIME ciphertext decryption flaws in Secure Email that could let unauthenticated remote attackers recover plaintext via machine-in-the-middle.

Multiple vulnerabilities in the S/MIME decryption functionality of Cisco Secure Email stem from insufficient validation of message integrity. An unauthenticated remote attacker could intercept and modify traffic between email gateways using a machine-in-the-middle technique to obtain plaintext from encrypted messages. No workarounds are available; no CVE identifiers or exploitation status were included in the advisory text.

Cisco Security Advisories·Sep 8, 11:22 UTC · 8d agoAdvisory

LexFlip: A Dissociation Diagnostic for Legal Meaning Preservation Metrics

LexFlip releases 373 minimal perturbations of Quebec statutory French that reverse legal force while preserving tokens, exposing weaknesses in embedding-based meaning preservation metrics.

LexFlip provides 373 minimal perturbations of Quebec statutory French that reverse legal force while preserving 0.93 of tokens, creating dissociation items that break monotone token-overlap metric validation. The seven embedding and BERTScore metrics tested register only 0.022-0.039 of their identical-to-unrelated range on these edits, versus 0.670 for bidirectional NLI. Against FrJudge, with a measured human ceiling of r=0.597, a bare length feature outscores every semantic metric tested.

arXiv cs.AI / cs.LG / cs.CL·Sep 4, 15:49 UTC · 12d agoAI research

ENISA: Frontier AI Is Changing the Speed of Cyberattacks. Europe Needs to Catch Up

ENISA warns frontier AI compresses attack lifecycles to minutes, with exploits possible within 15 minutes of disclosure and median 72-minute breach-to-exfiltration times.

ENISA's July 2026 paper 'ENISA's view on Cybersecurity in the Frontier AI Era' argues AI-assisted attackers may weaponize vulnerabilities within 15 minutes of disclosure and achieve initial-access-to-data-exfiltration in a median 72 minutes, creating a 'negative time-to-exploit' problem. The report cites one organisation whose CVE volume rose from roughly 80 in Q1 2025 to almost 500 in Q1 2026, then about 500 reports per day when frontier-AI tools were used. ENISA recommends machine-speed defence under 'Cybersecurity as Code', EPSS and VEX-based prioritisation, AI-assisted incident response with human oversight, and an assume-breached architecture.

Security Affairs·Sep 14, 20:35 UTC · 2d agoAdvisory

Scores Alone Do Not Prove Discovery: The Discovery Certification Protocol for Auditing AI Research Agents

Researchers introduce the Discovery Certification Protocol, an auditable test framework that verifies whether AI research agents' claimed discoveries are genuine.

The Discovery Certification Protocol (DCP) converts AI research agents' discovery claims into executable recovery and feedback tests organized as gated audits. Controlled audits in SQLite optimization and virtual catalyst control produced zero recoveries in 96 episodes, with an upper bound of 0.0468. A deterministic, LLM-free verifier reproduces audit decisions from frozen evidence, giving AI research a common evidence language for outcomes, alternative routes, and feedback effects.

Hugging Face daily papers·Sep 6, 20:00 UTC · 10d agoAI research