Fastly's Next-Gen WAF recorded about 6.3 million requests from nearly 10,200 unique IP addresses in a single 24-hour period that falsely claimed to be AI crawlers while probing for private files such …
A nine-month review of security incidents from December 2025 through September 2026 documents how credential theft evolved into autonomous AI-driven credential misuse, citing 28.6 million secrets expo…
TeamPCP (also tracked as UNC6780) deployed a cross-platform JavaScript credential stealer called DUSTMAKER that compromised thousands of developer credentials in under six hours on September 9, 2026, …
A threat actor tracked by Huntress as UNC-PRNT used OpenAI Codex and DeepSeek models to build an AI-assisted offensive pipeline that compromised more than 440 PaperCut NG/MF instances across 395 organ…
A developer's AI crawler dashboard recorded 20 requests for the site's /.env secrets file over seven days, all claiming to be ClaudeBot, while only 68% of ClaudeBot traffic that week could be verified…
Apollo Research released Apollo Watcher, a runtime monitor for coding agents that blocks 93% of dangerous tool calls before they execute and works with Claude Code and Codex via a one-command install.…
GreyNoise reported that a likely Russian-speaking threat actor used an AI agent swarm to compromise 440 PaperCut NG/MF print servers across 395 organizations in 48 countries, exploiting CVE-2026-81578…
GreyNoise reported that a threat actor used hundreds of AI agents built on OpenAI's Codex and DeepSeek models to develop and launch exploits against two known PaperCut NG/MF vulnerabilities, compromis…
A likely Russian-speaking threat actor used hundreds of AI agents powered by OpenAI's Codex orchestration harness and a DeepSeek model to compromise at least 440 PaperCut NG/MF instances across 395 or…
GreyNoise reported on September 9, 2026 that an actor it describes as "likely Russian-speaking" used hundreds of AI agents running OpenAI's Codex harness with a DeepSeek model to compromise at least 4…
GreyNoise reported that a likely Russian-speaking malicious cyber actor used hundreds of AI agents powered by OpenAI's Codex harness and a DeepSeek model to compromise at least 440 PaperCut MF/NG inst…
A suspected Russian-speaking cyber actor used hundreds of AI agents powered by OpenAI Codex and a DeepSeek model to compromise at least 440 PaperCut MF/NG instances across 395 victim organizations in …
A suspected Russian-speaking attacker used hundreds of AI agents to exploit two zero-day vulnerabilities in PaperCut NG/MF print management software, tracked as CVE-2026-81578 and CVE-2026-82078, comp…
A Russian-speaking threat actor used AI agents to autonomously exploit PaperCut NG/MF print management software, compromising at least 440 instances across 395 identified organizations in 48 countries…
An attacker using hundreds of AI agents powered by OpenAI's Codex and DeepSeek models exploited two PaperCut MF/NG vulnerabilities, CVE-2026-81578 and CVE-2026-82078, to compromise at least 395 organi…
Threat actors are disguising automated scanning as traffic from AI crawlers operated by OpenAI, Anthropic, Google, Perplexity and other companies while searching websites for exposed credentials and c…
GreyNoise and CrowdStrike announced an expanded integration bringing GreyNoise threat intelligence into CrowdStrike Falcon Next-Gen SIEM and Charlotte Agentic SOAR, adding a purpose-built SIEM dashboa…
GreyNoise reported that automated scanners forged the web crawler identities of OpenAI, Anthropic, DeepSeek, Google and Perplexity to request credentials and secrets, with six forged AI crawler names …