LIVE FEED
FIRST LOOK Anthropic Claude Launches Automated Attack Surface Reduction for Code // FIRST LOOK Anthropic Proposes AI Safety Bill with Model Block Powers // HIGH Rogue AI Agents Read Indian Org Data via Exposed Credentials // FIRST LOOK Microsoft Launches Guardian Agents to Monitor AI Agent Behaviour // FIRST LOOK NVIDIA Launches Nemotron 3.5 Super VL and Bolt Agent Models // FIRST LOOK Laminar YC S24 Launches flow-1 for AI Agent Trace Analysis // HIGH OpenCode Console Breach Exposes API Keys, Fuels AI Distillation Attack // CRITICAL AI Agent Army Used to Breach John Deere and SharkNinja // FIRST LOOK OpenAI Decisions API Brings Typed AI Triage to SOC Platforms // FIRST LOOK OpenAI, Meta and Google AI Agents Blocked by Major Web Services //
GOOGLE-CLOUD

Google-Cloud

3 reports
All LLM Security Agentic AI Industry News Research First Look: Security Supply Chain Prompt Injection Regulatory Adversarial ML Jailbreaks Model Theft Data Poisoning Deep Signal Intelligence Report Monthly Review AI Governance AI Security AI Security Tools Identity & Access Management Security Operations
AWS and Google Cloud Launch Hard Spend Caps for AI Agent Workloads

AWS and Google Cloud Launch Hard Spend Caps for AI Agent Workloads

FIRST LOOK ATLAS OWASP LOW Limited impact · Standard review ▲ 5.5 Simon Willison

AWS and Google Cloud have both introduced hard monthly spending caps for cloud services, enabling developers and organisations to set firm financial ceilings that pause or terminate services rather than allowing runaway billing. For defenders overseeing agentic AI deployments, this closes a meaningful blast-radius gap: coding agents and personal agents that autonomously invoke paid APIs or spin up compute can now be constrained to a pre-approved financial envelope, limiting the operational damage of a misbehaving or compromised agent. The residual gap is significant — coverage remains fragmented across providers, enforcement depends on correct configuration by each team, and hard caps do not yet extend to non-financial resource consumption such as data egress or API call volume.

Vertex AI SDK Bucket Squatting Flaw Enables Model Hijack

Vertex AI SDK Bucket Squatting Flaw Enables Model Hijack

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 8.5 The Hacker News

A vulnerability in the Google Cloud Vertex AI Python SDK allowed unauthenticated attackers to intercept model uploads by pre-registering predictable staging bucket names — a technique Unit 42 calls 'Pickle in the Middle'. Once a malicious model replaced the legitimate upload, arbitrary code executed inside Google's serving infrastructure via pickle deserialization. Google patched the flaw in v1.148.0 after disclosure in March 2026, but the incident highlights systemic risks in ML pipeline supply chains.

Vertex AI Privilege Escalation Exposes GCP Credentials

Vertex AI Privilege Escalation Exposes GCP Credentials

ATLAS OWASP CRITICAL Active exploitation · Immediate action required ▲ 9.2 Palo Alto Unit 42

Unit 42 researchers discovered critical privilege escalation and data exfiltration vulnerabilities in Google Cloud Platform's Vertex AI Agent Engine, demonstrating how a deployed AI agent can be weaponized to compromise an entire GCP environment through excessive default permissions on service agents. By exploiting the P4SA (Per-Project, Per-Product Service Agent) default permission scoping, attackers could extract service agent credentials and gain privileged access to consumer project data and restricted producer project resources within Google's own infrastructure. Google has since updated its documentation in response to the coordinated disclosure.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.