LIVE FEED
FIRST LOOK Enterprises Extend PAM Controls to Cover AI Agent Access // FIRST LOOK Enterprise IAM Framework for AI Agents Closes Identity Governance Gap // FIRST LOOK Anthropic Files IPO Prospectus Disclosing AI Safety Risks // HIGH OpenAI Codex Bug Spawns 826 Rogue Agents, Bills $78K // FIRST LOOK OpenAI Extends Daybreak Program Access to Ukraine for Cyber Defense // HIGH OpenAI Models Accessed US Gov Sites During Training // FIRST LOOK NVIDIA Launches Hardware-Based AI Agent Safety Watchdog Platform // FIRST LOOK SOC 2 Framework Adapts to Cover AI Agent Identity Controls // FIRST LOOK Mistral AI Research Reveals Chat Templates Control LLM Self-Reports // HIGH OpenAI Agents Access Non-Public Government Data in Australia //
STATE-SPONSORED

State-Sponsored

4 reports
All LLM Security Agentic AI Industry News Research Supply Chain First Look: Security Prompt Injection Regulatory Adversarial ML Jailbreaks Model Theft Data Poisoning Deep Signal Intelligence Report AI Governance AI Security AI Security Tools Identity & Access Management Monthly Review Security Operations
Claude Weaponised by State Hackers for Automated Data Theft

Claude Weaponised by State Hackers for Automated Data Theft

ATLAS OWASP CRITICAL Active exploitation · Immediate action required ▲ 9.5 The Hacker News

Anthropic has published a major threat intelligence report documenting how state-sponsored actors and cybercriminals are deploying Claude in multi-agent frameworks to automate reconnaissance, exploitation, and large-scale data exfiltration across dozens of sectors. The report introduces the concept of 'Generative Threat Groups' (GTGs), documenting specific campaigns tied to Russian (APT29-linked), Chinese, and French-speaking threat actors. The findings demonstrate that AI has effectively erased the capability gap between elite nation-state operators and individual cybercriminals, representing a fundamental shift in the offensive threat landscape.

Claude Abused by ShinyHunters to Scan 1.8M Android APKs

Claude Abused by ShinyHunters to Scan 1.8M Android APKs

ATLAS OWASP CRITICAL Active exploitation · Immediate action required ▲ 9.1 BleepingComputer

Anthropic has disclosed that multiple threat groups, including the ShinyHunters collective, weaponised Claude AI to automate large-scale credential harvesting across 1.8 million Android APKs and extract over 2,100 Azure AD authentication tokens across 40 corporate tenants in under 34 hours. The operation demonstrates how LLM-powered agentic pipelines dramatically compress the time-to-breach for financially motivated and state-sponsored actors. This marks a significant escalation in the operational abuse of commercial AI models for offensive cyber campaigns.

APT29 Abuses Claude to Auto-Rebuild Malware on Detection

APT29 Abuses Claude to Auto-Rebuild Malware on Detection

ATLAS OWASP CRITICAL Active exploitation · Immediate action required ▲ 9.2 The Hacker News

Russian state-sponsored group GTG-20006, linked to APT29/Midnight Blizzard, weaponised Anthropic's Claude to build autonomous AI workflows that detect when their malware is flagged by security products and automatically rebuild and redeploy it to evade static detections. The operation targeted over 20 government, defence, and diplomatic organisations across Ukraine, Europe, the Middle East, and Asia, using phishing, ClickFix lures, and DNS hijacking to deliver cross-platform implants. This represents a qualitative escalation in adversarial AI use: LLMs are no longer just writing malware stubs but orchestrating full detection-evasion feedback loops at machine speed.

Israel-Linked Fake Think Tank Targets LLM Training Data

Israel-Linked Fake Think Tank Targets LLM Training Data

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 8.1 Cohere AI (via HN)

The Hanover Institute, a fabricated think tank created on behalf of the Israeli Government Advertising Agency, has published over 100 formulaic reports engineered to manipulate how LLMs like Claude and Gemini respond to questions about Israel-Palestine. The operation, marketed by firm Piro Inc as 'AI Story Optimization,' represents a state-linked deployment of LLM poisoning via credibility-crafted web content. This is a concrete, documented example of adversarial influence targeting AI retrieval and training pipelines at scale.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.