Dark Reading

Evidence suggests a model may have generated and revised commands during the ransom gang's breach, though researchers stopped short of claiming full automation.

Microsoft's Digital Defense Report identifies government agencies as AI attack targets but lacks analysis of concurrent Microsoft vulnerability exploitation.

Trojanized Claude Code extension in Cursor IDE exploits two vulnerabilities; developers using Cursor should audit installed extensions immediately.

Anthropic-themed phishing emails bypass enterprise email gateways, exploiting AI adoption context and security awareness gaps.

Commentary on adapting cybersecurity awareness training for AI-era threat landscape; organizational/governance perspective.

Unreleased Claude version discovered chaining zero-days across Chrome, Safari, Android, Windows, Linux in exploit generation.

Unauthorized AI relay disables OpenAI Codex and Claude sandboxes, distributing to China with security bypassed.

Healthcare AI deployments lack security posture, creating cybersecurity risks in clinical settings.

Threat actor impersonates OpenAI, Anthropic, Meta bots to harvest exposed credentials at scale.

Framework for CISOs to mitigate AI liability via documentation, vendor contracts, and transparency; operational guidance.

Opinion on AI-driven automation threatening cybersecurity job skills and technical expertise retention.

Aokigahara malware targets developer keyrings and AI assistant sessions to steal credentials and business data.

Fragmented AI security benchmarks lack holistic coverage; organizations must supplement with internal testing against their own code.

Nvidia's Mark Weatherford argues CISOs must guide business risk-weighting for AI deployments and ensure ownership of deployment consequences.

Researchers demonstrate prompt injection via markdown files in AI agents, enabling local-file-based instruction execution with minimal defenses.

Open-weight models enabling large-scale, low-cost attack campaigns (105 sites compromised for minimal cost; $12 to gain domain control).

Microsoft's Guardian Agents monitor anomalous AI agents in Project Perception, but experts caution agent-policing-agent approach may amplify risks.

Agentic AI coverage splits insurers: specialized underwriters offer policies while major carriers quietly exclude coverage, leaving enterprises exposed.

UAE migrates 50% of government services to agentic AI with stated security/safety foundations; limited technical detail provided.

Marvell, Microsoft, Oracle collaborate to standardize NIST FIPS 140-3 Level 3 HSM for cloud/hyperscale data center hardware security.

Ex-OpenAI engineer detained for planting hidden recorder in conference room; Saudi ties noted; exemplifies preventable insider threat vector.

Dark Reading roundtable: identity gaps in SDLC compound AI security risks; collaboration, visibility, and reduced testing friction offer mitigations.

Chinese-speaking attacker exploits AI pen-test tool Cairn to breach hundreds of sites including John Deere, SharkNinja, and Cummins.