Unit 42, Palo Alto Networks' threat intelligence team, reported a ransomware attack in which a human attacker used frontier AI agents to breach an enterprise network autonomously, compressing over 50 …
A developer detailed how attackers can blind AWS audit trails by calling `cloudtrail stop-logging`, which halts event delivery while leaving the trail's configuration looking healthy. The post highlig…
Cisco Talos has published a structured workflow for safely analyzing obfuscated JavaScript in phishing kits and malicious npm packages. The method preserves the original file, restores strings, identi…
A new open-source framework called Agent Control Plane (ACP) moves AI agent authorization outside the model, into a structured-input control plane where prompt injection cannot reach, ensuring a compr…
A new study from arXiv (submitted Aug 5, 2026) finds that coding agents are highly vulnerable to malicious skill files, with Gemini CLI exploited in 95.5-96.1% of runs and Qwen Code in 71.6-74.0% of r…
Sophos X-Ops published telemetry from June 2026 showing that AI coding agents Claude Code, Cursor, and OpenAI Codex triggered enterprise endpoint detection rules, with 56.2% of blocked activity mappin…
Google DeepMind published its AI Control Roadmap (v0.1) in June 2026, proposing a security framework for AI agents that assumes alignment training may fail and treats deployed agents as potential insi…
A Snyk security audit of the Agent Skills ecosystem, including Anthropic's Claude and Vercel, found that 36% of all skills contained at least one critical-level security issue, such as malware distrib…
Black Hat USA 2026 Arsenal will feature 101 open-source security tools, including new AI-focused offerings such as AgentsLeak, a runtime protection platform for AI coding agents, and ARAY, which gener…
Black Hat 2026 showcased cybersecurity vendors moving beyond AI copilots to integrate AI into operational workflows, with ArmorCode expanding its Agentic Control Plane with four new Anya AI agents, Cr…
Tanium announced new agentic security capabilities for its Atlas platform at Black Hat USA 2026 on August 3, including background AI agents, an MCP server, attack-path mapping, agent-guided threat hun…
Researchers trained a multi-label classifier on a curated gold dataset of 1,207 CVEs from expert MITRE Center for Threat-Informed Defense mappings, achieving recall@5 of 0.673 ± 0.019 for mapping CVEs…
AWS launched the public preview of Amazon GuardDuty investigation agent, an AI-powered security tool that evaluates findings, correlates historical activity, and maps threat telemetry across AWS accou…
Defenders should assume their security controls will fail and design for resilience rather than 100% prevention, according to a security expert presenting a battle-tested strategy. The approach maps c…
A practical tutorial for SOC analysts details how to integrate ChatGPT into L1 workflows for triage, documentation, and optimization, emphasizing that LLMs handle grunt work but require human verifica…
A developer provides ten ChatGPT prompts tailored for L1 SOC analysts to assist with alert triage, threat analysis, and documentation. The prompts cover scenarios such as security alert summarisation,…
Cribl acquired CardinalOps on July 14th for an estimated $100 million, adding an Israeli detection-engineering team as CEO Clint Sharp pushes the telemetry vendor into security operations. The acquisi…
A developer discovered a Windows trojan, Trojan:Win64/Lazy.PGPK!MTB, hidden in a typosquatting GitHub repository for an MCP server. The attacker used a staged launcher with a CMD wrapper and obfuscate…
RelayShield released four smolagents.Tool classes that let an AI agent check its own attack surface before acting, including verifying whether an MCP server is known-malicious, detecting prompt-inject…
Sophos's July 2026 telemetry report reveals that coding agents from Claude Code, Cursor, and OpenAI Codex triggered EDR rules designed to catch attackers, with credential access and execution tactics …