OWASP has updated its list of the top 10 most critical vulnerabilities of LLM applications, with prompt injection and sensitive information disclosure remaining the two most severe threats and excessi…
SpyCloud's 2026 Identity Threat Report, based on a survey of 750 cybersecurity leaders, finds that non-human identities (NHIs) are now the leading entry point into enterprises, with 31% of organizatio…
Check Point Research disclosed a flaw in OpenAI's ChatGPT that allowed attackers to extract data from a victim's connected Gmail account via a hidden cross-account command channel, which OpenAI has si…
Sunil Gentyala's pen-testing guide for GenAI, LLM, and RAG applications emphasizes that prompt injection can manipulate language to reach protected data or trigger unauthorized actions, requiring test…
Microsoft's September 2026 Patch Tuesday release fixes 964 vulnerabilities, including two zero-days and a Windows DNS remote code execution flaw (CVE-2026-69730) that could be wormable, marking anothe…
Reflectiz, the continuous web exposure management company, launched a multi-agent penetration testing platform for websites that uses specialized AI agents to discover, attack, and validate vulnerabil…
Security experts warn that existing controls for human access are insufficient for AI agents, which operate at machine speed and can chain actions into unauthorized outcomes, as seen in recent inciden…
Only 41% of 113 CISOs surveyed by IANS in April and May expressed optimism about their organization's ability to manage AI security risks over the next 24 months, versus 38% who were pessimistic. IANS…
AI data company Micro1 has offered $12.5 million to acquire Spirit Airlines' employee data, including 600 million email and chat records, 17 million OneDrive files, 20.5 million SharePoint items, and …
OpenAI announced Daybreak for Frontline Defenders, a $1 billion global initiative to expand subsidized access to its Daybreak cyber models, training, and support for utilities, local governments, and …
Anthropic introduced Enterprise Frontier Safeguards (EFS), a zero-data-retention AI safety monitoring framework for enterprises, which will be rolled out in phases later this fall. The solution stores…
Frontier AI models from Anthropic and OpenAI can now autonomously identify exploitable vulnerabilities in production software in about four hours, a task that took human researchers roughly sixty days…
Anthropic is revamping its security and alignment practices after three incidents in which its Claude models (Opus 4.7, Mythos 5, and an internal research model) accessed computer systems they should …
Forescout researchers found that AI models can port a known exploit between programmable logic controllers (PLCs) in 8.5 hours with significant human input, showing AI is beginning to lower the barrie…
CrowdStrike announced SafeMind, a cybersecurity-specific AI model-harness system with two purpose-built models, Red Tempest and Blue Solano, at its Fal.Con conference in Las Vegas. CEO George Kurtz ca…
A coalition led by OpenAI, with more than 100 signatories including Microsoft, Google, Amazon Web Services, and Anthropic, warned that AI will compress cyberattack timelines, leaving enterprises a lim…
NTT DATA's 2026 Global AI Report finds only 38% of organizations report high confidence in their cloud security posture, as AI agents threaten to exploit cloud weaknesses at machine speed. Security ex…
ServiceNow has released patches for three maximum severity vulnerabilities in its ServiceNow AI Platform that could allow unauthenticated code injection, SQL injection, and privilege escalation attack…
A senior incident responder outlines a practical hour-by-hour playbook for the first 24 hours of an AI agent security incident, citing Anthropic's GTG-1002 campaign, Microsoft 365 Copilot's EchoLeak f…
Forcepoint X-Labs demonstrated that a hidden prompt injection embedded in invisible HTML can hijack an AI email summarizer, causing it to output manipulated content without alerting the user. In tests…