LIVE FEED
FIRST LOOK Microsoft Copilot Gains Local File Access via Hybrid Intelligence // FIRST LOOK AWS Adds Native Access Controls for RAG via Amazon Quick and Bedrock // HIGH DPRK npm Supply Chain Worm Uses Web3 C2 to Steal Cloud Keys // FIRST LOOK Rein Security Launches $25M Runtime Guard for AI Agents // HIGH APT Uses AI-Generated Lures in Google AitM Phishing on Taiwan // CRITICAL Tensorlake npm Package Hijacked by Shai-Hulud Worm // FIRST LOOK Meta Launches Open Standard to Authenticate AI Agents on the Web // FIRST LOOK Anthropic Launches 3-Tier Cyber Verification Program for AI Access // FIRST LOOK CrowdStrike Maps LLM Safety Classifier Evasion for Defenders // HIGH OpenAI Adds Training Monitors After Medicare Data Breach //
BLAST-RADIUS

Blast-Radius

2 reports
All LLM Security Agentic AI Industry News Research First Look: Security Supply Chain Prompt Injection Regulatory Adversarial ML Jailbreaks Model Theft Data Poisoning Deep Signal Intelligence Report Monthly Review AI Governance AI Security AI Security Tools Identity & Access Management Security Operations
AWS and Google Cloud Launch Hard Spend Caps for AI Agent Workloads

AWS and Google Cloud Launch Hard Spend Caps for AI Agent Workloads

FIRST LOOK ATLAS OWASP LOW Limited impact · Standard review ▲ 5.5 Simon Willison

AWS and Google Cloud have both introduced hard monthly spending caps for cloud services, enabling developers and organisations to set firm financial ceilings that pause or terminate services rather than allowing runaway billing. For defenders overseeing agentic AI deployments, this closes a meaningful blast-radius gap: coding agents and personal agents that autonomously invoke paid APIs or spin up compute can now be constrained to a pre-approved financial envelope, limiting the operational damage of a misbehaving or compromised agent. The residual gap is significant — coverage remains fragmented across providers, enforcement depends on correct configuration by each team, and hard caps do not yet extend to non-financial resource consumption such as data egress or API call volume.

Agent Hijacking: Microsoft's Defense-in-Depth Framework

Agent Hijacking: Microsoft's Defense-in-Depth Framework

ATLAS OWASP MEDIUM Moderate risk · Monitor closely ▲ 7.2 Microsoft Security Blog

Microsoft's Security Blog introduces a layered defense-in-depth model specifically designed for autonomous AI agents, which now invoke tools, modify data, and trigger workflows with minimal human oversight. The framework identifies novel threat classes — including agent hijacking, intent breaking, and supply chain compromise — that are amplified by agentic autonomy. The guidance positions application-layer architecture, permissions, and governance as the most critical controls as agent autonomy scales.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.