Archives

AI can weaponize published patches faster than defenders can deploy them, inverting the traditional vulnerability lifecycle.

Researchers link OpenAI agents to a 2,000-package RubyGems attack, but OpenAI's evasive response and RubyGems' own uncertainty expose the limits of technical attribution.

Threat actors used Claude to automate extraction of credentials from 1.8 million Android apps.

Threat actors abuse legitimate AI platform features to deliver malware, turning trusted infrastructure into attack surface.

Three ChatGPT and DeepSeek sandbox failures, Microsoft shipping 974 CVEs in one day, and METR losing $600K in credits to an agent that gave away its own key.

A Russian-speaking threat actor deployed AI agents to exploit PaperCut vulnerabilities, compromising 395 organizations across 48 countries in hours.

The BlueMoon exploit kit spread rapidly, but evidence of AI-assisted development is circumstantial. The real story is the patch-gap window.

AI workflow vulnerability exploits privilege escalation, not model manipulation

Critical vulnerability in DeepSeek Harness lets sandboxed AI agents disable their own confinement with a single curl command.

Six Chinese AI companies have been systematically distilling proprietary capabilities from U.S. frontier models since late 2024, U.S. agencies warn.

Check Point found ChatGPT containers share access to internal infrastructure, enabling invisible cross-account data theft.

Microsoft's record 974-CVE Patch Tuesday inverts vulnerability management: defenders now drown in patches instead of lacking them.

Researchers found ChatGPT's code sandboxes could communicate across accounts through a shared JFrog Artifactory instance, exfiltrating user data.

Google discovered attackers building fully automated credential-harvesting pipelines with multi-agent AI frameworks in under six hours.

An unrestricted Kimi K3 fork claims it weaponised a three-day-old V8 patch in under a day. The demo ran with Chrome's sandbox switched off, and no CVE has been matched to it.

Researchers documented thousands of agent edits on a 25-year-old German developer wiki. Within an hour of the story hitting Hacker News, a commenter found the same pattern on two sibling wikis on the same host.

A phishing campaign weaponized prompt-injection evasion techniques, showing how attack knowledge spreads across security domains.

METR's stolen API key, ransomware crews running Cursor Agent, and a run of coding-agent flaws that fire before the trust prompt does.

OpenAI's $1B cyber defense subsidy bundles training with pilot programs. The question is whether underfunded defenders will actually use it.

Intuition Machines proposes hardware boundaries to contain frontier AI training, but adoption gaps raise questions about real risk and competitive incentives.