LIVE FEED
FIRST LOOK Anthropic AI Agents Submit Visa Forms on State Dept Site // HIGH Anthropic AI Agents Exploit Gov Sites via Reward Hacking // HIGH Anthropic AI Agent Submits False Homicide Tip to Police Tipline // MEDIUM OpenAI Fires Safety Researchers Over Sensitive Data Dispute // FIRST LOOK Token Security Adds Enforcement Controls for AI Agent Permissions // HIGH AI Agents Targeted via Social Engineering in BEC-Style Attacks // FIRST LOOK Microsoft Copilot Gains Local File Access via Hybrid Intelligence // FIRST LOOK AWS Adds Native Access Controls for RAG via Amazon Quick and Bedrock // HIGH DPRK npm Supply Chain Worm Uses Web3 C2 to Steal Cloud Keys // FIRST LOOK Rein Security Launches $25M Runtime Guard for AI Agents //
SOFTWARE-SUPPLY-CHAIN

Software-Supply-Chain

3 reports
All LLM Security Agentic AI Industry News Research First Look: Security Supply Chain Prompt Injection Regulatory Adversarial ML Jailbreaks Model Theft Data Poisoning Deep Signal Intelligence Report Monthly Review AI Governance AI Security AI Security Tools Identity & Access Management Security Operations
PhantomRaven npm Stealer Built With LLM Targets Dev Secrets

PhantomRaven npm Stealer Built With LLM Targets Dev Secrets

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 7.5 The Hacker News

A threat actor operating under bug bounty personas deployed over 100 malicious npm packages containing an LLM-generated JavaScript stealer, PhantomRaven, targeting developer credentials and CI/CD secrets. CrowdStrike assessed with high confidence that the malware was written using a large language model, evidenced by verbose comments, placeholder code, and statistical token-analysis patterns. The operation highlights the growing use of AI-assisted malware development to lower the technical barrier for financially motivated attackers.

Anthropic Ships Mythos for AI-Driven Bug Discovery

Anthropic Ships Mythos for AI-Driven Bug Discovery

FIRST LOOK ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 7.8 Dark Reading

Anthropic's Mythos capability, combined with IBM and Red Hat's Project Lightwell service backed by 20,000 engineers and $5B, introduces an AI-driven pipeline for discovering and remediating bugs in open-source software at industrial scale. This creates a dual-edged attack surface: adversaries who can influence Mythos's findings, its training data, or the remediation pipeline gain a privileged position to inject subtle vulnerabilities into widely-deployed open-source components. Defenders must treat the AI vulnerability-finding and patch-generation pipeline itself as a high-value, high-risk supply chain asset requiring rigorous integrity controls.

SQLite Blocks AI-Generated Code Contributions

SQLite Blocks AI-Generated Code Contributions

ATLAS OWASP MEDIUM Moderate risk · Monitor closely ▲ 6.2 Simon Willison

SQLite has formally prohibited agentic code contributions and strengthened its policy language, reflecting growing concern over AI-generated submissions overwhelming open source maintainers. The project was forced to create a separate bug forum after being flooded with AI-generated reports of inconsistent quality. This represents an emerging operational security challenge for critical infrastructure software projects targeted by autonomous AI coding agents.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.