LIVE FEED
HIGH OpenAI Disbands Preparedness Team Amid IPO Safety Concerns // FIRST LOOK AWS AgentCore Observability Brings Multi-Cloud AI Agent Monitoring // FIRST LOOK OpenAI Astra Launches with Critical-Level Cyber Evaluation Controls // HIGH Kimsuky Runs Offline LLMs to Sharpen Phishing, Build Malware // HIGH GhostSplice MCP Attack Splits Prompts to Exfiltrate SSH Keys // CRITICAL Claude Mythos 5 Attempts Malware Merge in OSS Supply Chain Attack // FIRST LOOK AWS Launches SageMaker AI and Bedrock AgentCore Workflow Integration // FIRST LOOK Anthropic Frontier Red Team Studies Multi-Agent Conflict Dynamics // FIRST LOOK Cyera Acquires Oasis Security to Unify AI Agent Identity Control // HIGH Trivy Flaw Behind 2,500-Org Breach, Not LiteLLM Packages //
RANSOMWARE

Ransomware

4 reports
All LLM Security Agentic AI Industry News Research Supply Chain First Look: Security Prompt Injection Regulatory Jailbreaks Adversarial ML Model Theft Data Poisoning Deep Signal Intelligence Report AI Governance AI Security AI Security Tools Identity & Access Management Security Operations
AI Widens Skill-Ability Gap, Enabling Autonomous Cyberattacks

AI Widens Skill-Ability Gap, Enabling Autonomous Cyberattacks

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 7.2 Schneier on Security

A Five Eyes joint advisory and Bruce Schneier's analysis highlight how AI systems are dramatically lowering the barrier to sophisticated cyberattacks by decoupling skill from ability. Open-source and frontier models can autonomously execute network intrusions, ransomware deployment, and data theft with minimal user expertise. The piece argues that guardrails from major AI vendors are insufficient, as uncensored open-source models circulate freely and continue to improve.

Langflow LLM Agents Exploited for Ransomware Delivery

Langflow LLM Agents Exploited for Ransomware Delivery

ATLAS OWASP CRITICAL Active exploitation · Immediate action required ▲ 9.2 SecurityWeek

A documented ransomware attack leveraged agentic AI infrastructure — specifically the Langflow LLM orchestration platform — to automate multi-stage intrusion chains combining known exploitation techniques with real-time LLM reasoning. This marks a significant escalation in threat actor capability, demonstrating that agentic AI can serve as an autonomous attack coordinator rather than merely an assistant. Security teams running self-hosted AI orchestration platforms now face an expanded attack surface where the AI layer itself can be both the entry point and the execution engine.

Browser Ransomware via File System Access API: DeepSeek

Browser Ransomware via File System Access API: DeepSeek

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 8.5 Check Point Research

Check Point Research demonstrates how DeepSeek's lower refusal rates allowed researchers to transform an LLM-hallucinated malware concept into a practical browser-native ransomware technique targeting Android photo directories via the File System Access API. The attack requires no native payload, APK installation, or root access — only social engineering to obtain a legitimate browser permission prompt. This research highlights how frontier AI models with weaker safety controls can independently design novel attack paths not yet seen in real-world campaigns.

AGENTIC AIThe Hacker NewsCRITICALCVE-2025-3248: Langflow RCE Enables AutonomousRansomware Attack

CVE-2025-3248: Langflow RCE Enables Autonomous Ransomware Attack

ATLAS OWASP CRITICAL Active exploitation · Immediate action required ▲ 9.8 The Hacker News

Sysdig has documented what it claims is the first end-to-end ransomware attack orchestrated autonomously by an AI agent, attributed to a threat actor tracked as JADEPUFFER. The agent exploited a known remote code execution flaw in Langflow (CVE-2025-3248) to gain initial access, harvest credentials, pivot laterally, and ultimately encrypt and destroy a production database — all without human intervention at the keyboard. The incident demonstrates that AI agents can now lower the skill floor for complex, multi-stage attacks to near zero, representing a qualitative shift in the ransomware threat landscape.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.