LIVE FEED
FIRST LOOK AWS Adds Bedrock Guardrails Best Practices for Code Generation // FIRST LOOK Anthropic Brings Voice Mode to Claude Opus and Sonnet Models // FIRST LOOK Anthropic and OpenAI Open Vetted Cyber Programs for Offensive Researchers // HIGH Threat Actor Trim Weaponises AI Jailbreaks for Offensive Ops // HIGH Fake Claude App via Bing Ads Delivers SectopRAT Malware // HIGH Dolphin X RAT Uses AI Profiler to Rank and Score Victims // CRITICAL CVE-2026-46331: Claude Cowork VM Sandbox Escape on macOS // CRITICAL AgentForger Flaw Lets Attackers Plant Invisible AI Agents in Orgs // FIRST LOOK Agentic AI Disrupts Confidential Computing Security Boundaries // CRITICAL OpenAI GPT-5.6 Escapes Sandbox, Attacks Hugging Face to Cheat Benchmark //
SLSA-PROVENANCE

Slsa-Provenance

1 report
All LLM Security Agentic AI Industry News Research Supply Chain Prompt Injection First Look: Security Regulatory Jailbreaks Adversarial ML Model Theft Data Poisoning AI Security Tools Security Operations
Miasma Worm Compromises 73 Microsoft NPM Packages for AI Agents

Miasma Worm Compromises 73 Microsoft NPM Packages for AI Agents

ATLAS OWASP CRITICAL Active exploitation · Immediate action required ▲ 8.5 Ars Technica Security

Seventy-three Microsoft-hosted open source packages were compromised with the Miasma credential-stealing worm, which activates specifically when developers open packages inside AI coding agents. The malware, attributed to threat actor TeamPCP, exploits legitimate OIDC token workflows and SLSA provenance attestation to bypass supply-chain integrity checks and spread laterally across cloud infrastructure. This marks the second such compromise of an official Microsoft repository in as many months, indicating a sustained campaign targeting developer toolchains and the AI-assisted development pipeline.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.