Archives

AnonyMousKIT's AI voice attack reveals how automating social engineering becomes viable at scale.

Russian operation used ChatGPT to staff a fake research institution with plagiarized articles bearing false credentials.

A DNS rebinding vulnerability in NVIDIA NemoClaw allows attackers to persistently poison local AI models through a single malicious webpage.

Hidden prompts in emails manipulate AI summarizers into generating convincing phishing alerts.

Code injection in marimo notebooks runs arbitrary MCP commands on file open, no execution required.

Attackers used fake Google ads impersonating OpenAI Codex to deliver macOS malware through ClickFix social engineering.

AI vulnerability discovery is outpacing the ability of organizations to patch them.

Chinese-speaking cybercrime group deploys AI to automate vulnerability scanning and exploitation across global servers.

Enterprise AI risk concentrates in 5% of power users on shadow accounts; the solution is conventional security, not new tooling.

Varonis researchers used meta-hacking to expose Copilot's internal architecture through the AI's own reasoning.

Three chained vulnerabilities let one click exfiltrate data from Gmail, Drive, and Calendar.

Israeli firm reports first fully autonomous AI cyberattack against Taiwan government, orchestrated entirely through open-source agents.

A GitHub Actions workflow injection in Snowflake was discovered by an AI agent rather than human review or Copilot.

Self-propagating payloads spread between AI agents through prompt files, raising questions about agent architecture vulnerabilities.

Researchers tricked Copilot into revealing its vulnerabilities through questions about why attacks would fail.

AI agents pose real risks. But the threat assessment is filtered through sales dynamics.

Wiz's Red Agent exploited a GitHub Actions vulnerability in Snowflake's repository, demonstrating autonomous exploitation beyond mere discovery.

MCP's blind trust in untrusted server metadata creates an endemic credential exposure problem at scale.

Chinese AI company announces its GLM-5.3 model finds more vulnerabilities than Western competitors, but the claims rest entirely on unverified internal testing.

Black Hat and DEF CON positioned AI agent autonomy as a first-order security threat, but the evidence trail relies on a single incident and thin sourcing.