LIVE FEED
FIRST LOOK Microsoft MDASH Brings AI-Powered Windows Vulnerability Discovery // FIRST LOOK FableCut Ships AI-Drivable Browser Video Editor via MCP and REST // FIRST LOOK AI Agents Emerge as a New Identity Class Orgs Must Secure // HIGH CVE-2026-12958: GhostApproval Symlink Attack on Coding Agents // HIGH Prompt Injection Attacks Claude Code and Codex Execution // HIGH DPAPI Abuse in Claude Code and Cursor Triggers EDR // FIRST LOOK Y Combinator Ships Agentic Code Generation at 37K Lines Daily // HIGH Google Gemini Abused for Phishing-as-a-Service // CRITICAL Writer AI Session Token Leak Enables Account Takeover // MEDIUM Anthropic Mythos LLM Scans Federal Software for Vulnerabilities //
DATA-EXFILTRATION

Data-Exfiltration

17 reports
All LLM Security Agentic AI Industry News Research Supply Chain Prompt Injection First Look: Security Regulatory Jailbreaks Adversarial ML Data Poisoning Model Theft AI Security Tools Security Operations
Google Vertex AI Over-Privilege Enables Data Exfiltration

Google Vertex AI Over-Privilege Enables Data Exfiltration

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 8.5 Dark Reading

Palo Alto Networks researchers have identified over-privilege vulnerabilities in Google's Vertex AI platform, demonstrating how malicious actors could exploit AI agents to exfiltrate sensitive data and pivot into restricted cloud infrastructure. The findings highlight systemic risks in agentic AI deployments where excessive permissions granted to AI workloads expand the attack surface beyond traditional cloud security boundaries. This research underscores the growing urgency around securing AI agent permissions and enforcing least-privilege principles in enterprise ML platforms.

AI Browser Extensions 60% Riskier Than Standard Tools

AI Browser Extensions 60% Riskier Than Standard Tools

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 7.5 The Hacker News

A LayerX report reveals that AI browser extensions represent a largely unmonitored attack surface in enterprise environments, with 1-in-6 enterprise users already running at least one AI extension. These extensions are statistically riskier than standard extensions — 60% more likely to carry a CVE, 3x more likely to access cookies, and capable of exfiltrating sensitive data without triggering DLP or SaaS monitoring controls. The finding highlights a critical governance gap in AI consumption channels that bypasses traditional enterprise security tooling.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.