LIVE FEED
FIRST LOOK OpenAI Updates Model Spec to Sharpen AI Judgment and Safety // HIGH Prompt Injection Targets AI Agent Planning in New Attacks // FIRST LOOK Mistral Releases Mistral Large 4 Open Weights for Cyber Defense // HIGH Hugging Face Malware Hijacks GPUs via trust_remote_code // CRITICAL Claude Code VS Code Extension Trojanized with SSH Backdoor // FIRST LOOK YC Labs Runs GPT-6.1 Multi-Agent Swarms in Open Game Worlds // FIRST LOOK AWS AgentCore Gateway Turns 400-Plus APIs into Agent Tools // MEDIUM Claude Code Agent Transcripts Leaked via Silent Token Drain // FIRST LOOK Google Launches Gemini 4 Carbon with Cybersecurity Leap // HIGH Attackers Impersonate AI Bots to Scan for Exposed Credentials //
DATA-GOVERNANCE

Data-Governance

3 reports
All LLM Security Agentic AI Industry News Research First Look: Security Supply Chain Prompt Injection Regulatory Adversarial ML Jailbreaks Model Theft Data Poisoning Deep Signal Intelligence Report Monthly Review AI Governance AI Security AI Security Tools Identity & Access Management Security Operations
Microsoft Copilot Gains Local File Access via Hybrid Intelligence

Microsoft Copilot Gains Local File Access via Hybrid Intelligence

FIRST LOOK ATLAS OWASP MEDIUM Moderate risk · Monitor closely ▲ 5.8 The Verge AI

Microsoft has announced Hybrid Intelligence for Copilot, enabling the AI assistant to access local files, execute multi-step OS-level actions, and coordinate between local and cloud AI models on Windows PCs. For defenders, this represents a meaningful evolution in understanding how agentic AI systems interact with endpoint data and OS surfaces — a pattern that security teams now need to account for in endpoint policy and data governance frameworks. The capability arrives without detailed disclosure of permission scoping, audit logging, or consent controls, leaving security teams with open questions about how to govern Copilot's access to sensitive local assets.

AWS Adds Native Access Controls for RAG via Amazon Quick and Bedrock

AWS Adds Native Access Controls for RAG via Amazon Quick and Bedrock

FIRST LOOK ATLAS OWASP MEDIUM Moderate risk · Monitor closely ▲ 6.2 AWS Machine Learning Blog

AWS has introduced integrated access control capabilities for Retrieval-Augmented Generation (RAG) pipelines, combining Amazon Quick and Amazon Bedrock to enforce document-level permissions during AI-driven retrieval. This closes a meaningful gap for defenders: RAG systems have historically treated retrieval as a flat, permissionless operation, meaning users could receive AI-synthesised responses derived from documents they would not normally be authorised to read. Residual maturity questions remain around how granular these controls are at the chunk or passage level, whether they support complex identity federation scenarios, and how access policy drift is monitored over time.

OpenAI Training Opt-Out Setting Silently Re-Enabled for Users

OpenAI Training Opt-Out Setting Silently Re-Enabled for Users

ATLAS OWASP MEDIUM Moderate risk · Monitor closely ▲ 6.2 OpenAI (via HN)

Multiple users report that OpenAI's 'allow training' opt-out setting is being silently re-enabled after they deliberately disabled it, raising serious concerns about data governance and user consent. A similar pattern has been observed on Anthropic's Claude platform, suggesting this may be a broader industry practice tied to TOS updates or subscription renewals. The behaviour undermines the integrity of privacy controls and means sensitive user conversations may be incorporated into training datasets without genuine informed consent.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.