LIVE FEED
FIRST LOOK Microsoft Copilot Gains Local File Access via Hybrid Intelligence // FIRST LOOK AWS Adds Native Access Controls for RAG via Amazon Quick and Bedrock // HIGH DPRK npm Supply Chain Worm Uses Web3 C2 to Steal Cloud Keys // FIRST LOOK Rein Security Launches $25M Runtime Guard for AI Agents // HIGH APT Uses AI-Generated Lures in Google AitM Phishing on Taiwan // CRITICAL Tensorlake npm Package Hijacked by Shai-Hulud Worm // FIRST LOOK Meta Launches Open Standard to Authenticate AI Agents on the Web // FIRST LOOK Anthropic Launches 3-Tier Cyber Verification Program for AI Access // FIRST LOOK CrowdStrike Maps LLM Safety Classifier Evasion for Defenders // HIGH OpenAI Adds Training Monitors After Medicare Data Breach //
SESSION-HIJACKING

Session-Hijacking

3 reports
All LLM Security Agentic AI Industry News Research First Look: Security Supply Chain Prompt Injection Regulatory Adversarial ML Jailbreaks Model Theft Data Poisoning Deep Signal Intelligence Report Monthly Review AI Governance AI Security AI Security Tools Identity & Access Management Security Operations
Infostealer Malware Hijacks Claude Sessions via Cookie Theft

Infostealer Malware Hijacks Claude Sessions via Cookie Theft

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 7.2 BleepingComputer

Anthropic has confirmed that infostealer malware families including Vidar, LummaC2, StealC, and RedLine are being used to steal authenticated Claude browser sessions, granting attackers API-level access without needing credentials or 2FA. The attack bypasses standard authentication controls entirely by harvesting session cookies from compromised endpoints, allowing threat actors to consume victims' Claude usage quotas and potentially access stored payment data. Anthropic is revoking sessions and issuing refunds, but the incident highlights a systemic risk for AI service accounts when endpoint security is weak.

Writer AI Session Token Leak Enables Account Takeover

Writer AI Session Token Leak Enables Account Takeover

ATLAS OWASP CRITICAL Active exploitation · Immediate action required ▲ 9.2 The Hacker News

A critical vulnerability dubbed WriteOut in the Writer enterprise AI platform allowed attackers to hijack victim session tokens across organisational boundaries using a malicious agent preview link. The flaw exploited Writer's live preview sandbox, which incorrectly forwarded authenticated session cookies into attacker-controlled execution environments. Writer has patched the issue by isolating sandbox origins and stripping session cookies from preview requests.

AI Browser Extensions 60% Riskier Than Standard Tools

AI Browser Extensions 60% Riskier Than Standard Tools

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 7.5 The Hacker News

A LayerX report reveals that AI browser extensions represent a largely unmonitored attack surface in enterprise environments, with 1-in-6 enterprise users already running at least one AI extension. These extensions are statistically riskier than standard extensions — 60% more likely to carry a CVE, 3x more likely to access cookies, and capable of exfiltrating sensitive data without triggering DLP or SaaS monitoring controls. The finding highlights a critical governance gap in AI consumption channels that bypasses traditional enterprise security tooling.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.