LIVE FEED
FIRST LOOK Anthropic AI Agents Submit Visa Forms on State Dept Site // HIGH Anthropic AI Agents Exploit Gov Sites via Reward Hacking // HIGH Anthropic AI Agent Submits False Homicide Tip to Police Tipline // MEDIUM OpenAI Fires Safety Researchers Over Sensitive Data Dispute // FIRST LOOK Token Security Adds Enforcement Controls for AI Agent Permissions // HIGH AI Agents Targeted via Social Engineering in BEC-Style Attacks // FIRST LOOK Microsoft Copilot Gains Local File Access via Hybrid Intelligence // FIRST LOOK AWS Adds Native Access Controls for RAG via Amazon Quick and Bedrock // HIGH DPRK npm Supply Chain Worm Uses Web3 C2 to Steal Cloud Keys // FIRST LOOK Rein Security Launches $25M Runtime Guard for AI Agents //
ADVERSARIAL ML

Adversarial ML

Evasion attacks, adversarial examples, and physical-world perturbations against computer vision, NLP, and autonomous systems. Mapped to MITRE ATLAS AML.T0043 and AML.T0015.

63 reports
All LLM Security Agentic AI Industry News Research First Look: Security Supply Chain Prompt Injection Regulatory Adversarial ML Jailbreaks Model Theft Data Poisoning Deep Signal Intelligence Report Monthly Review AI Governance AI Security AI Security Tools Identity & Access Management Security Operations
Legacy Vulnerabilities Amplified by AI at Enterprise Scale

Legacy Vulnerabilities Amplified by AI at Enterprise Scale

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 6.5 Dark Reading

The article argues that AI's primary security risk lies not in introducing entirely new vulnerability classes, but in dramatically amplifying the impact and exploitability of well-established ones. This framing has significant implications for defenders, suggesting that legacy vulnerability management practices must be re-evaluated through an AI-augmented threat lens. The convergence of classic weaknesses with AI capabilities raises the baseline risk profile for organisations deploying or adjacent to AI systems.

Pushpaganda: AI-Generated Scareware Hits Google Discover

Pushpaganda: AI-Generated Scareware Hits Google Discover

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 6.2 The Hacker News

A large-scale ad fraud and scareware campaign dubbed 'Pushpaganda' has been uncovered exploiting Google Discover by using AI-generated content to poison search discovery surfaces and lure users into enabling malicious push notifications. At its peak the operation generated 240 million bid requests across 113 domains in a single week, demonstrating how AI-generated disinformation can be weaponised as an automated delivery mechanism for financial fraud. The campaign highlights the growing abuse of generative AI to scale deceptive content operations against trusted platform surfaces.

SWE-bench, WebArena Exploited via Environmental Manipulation

SWE-bench, WebArena Exploited via Environmental Manipulation

ATLAS OWASP CRITICAL Active exploitation · Immediate action required ▲ 9.2 HN AI Security

Researchers at UC Berkeley demonstrated that every major AI agent benchmark — including SWE-bench, WebArena, OSWorld, and others — can be fully exploited to achieve near-perfect scores without solving a single task, using trivial environmental manipulation rather than genuine capability. The attacks include pytest hook injection, config file leakage, DOM manipulation, and reward component bypassing, with zero LLM calls required in most cases. This represents a systemic integrity failure in the evaluation infrastructure underpinning AI deployment decisions across industry and research.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.