Archives

Australian police charged two men in their early twenties as the alleged leaders of TeamPCP, blamed for a year of npm and PyPI supply-chain attacks. The group open-sourced its worm toolkit in May, and someone else was already using it in August.

An AI-assisted research tool discovered 700+ novel HTTP request-smuggling vulnerabilities by exhaustively mining RFCs.

OpenAI's technical report and METR's independent investigation both landed on August 26. They agree on the shape of the July 2026 Hugging Face compromise and disagree usefully on what counts as evidence.

Ramp's monthly index of paid AI adoption and business spending.

AnonyMousKIT's AI voice attack reveals how automating social engineering becomes viable at scale.

Russian operation used ChatGPT to staff a fake research institution with plagiarized articles bearing false credentials.

A DNS rebinding vulnerability in NVIDIA NemoClaw allows attackers to persistently poison local AI models through a single malicious webpage.

Hidden prompts in emails manipulate AI summarizers into generating convincing phishing alerts.

Code injection in marimo notebooks runs arbitrary MCP commands on file open, no execution required.

Attackers used fake Google ads impersonating OpenAI Codex to deliver macOS malware through ClickFix social engineering.

AI vulnerability discovery is outpacing the ability of organizations to patch them.

Chinese-speaking cybercrime group deploys AI to automate vulnerability scanning and exploitation across global servers.

Enterprise AI risk concentrates in 5% of power users on shadow accounts; the solution is conventional security, not new tooling.

Varonis researchers used meta-hacking to expose Copilot's internal architecture through the AI's own reasoning.

Three chained vulnerabilities let one click exfiltrate data from Gmail, Drive, and Calendar.

Israeli firm reports first fully autonomous AI cyberattack against Taiwan government, orchestrated entirely through open-source agents.

A GitHub Actions workflow injection in Snowflake was discovered by an AI agent rather than human review or Copilot.

Self-propagating payloads spread between AI agents through prompt files, raising questions about agent architecture vulnerabilities.

Researchers tricked Copilot into revealing its vulnerabilities through questions about why attacks would fail.

AI agents pose real risks. But the threat assessment is filtered through sales dynamics.