Tag
AI
27 stories since Aug 2025.
- 27
- stories
- OCT 7
- latest
Patching Faster Has Never Been the Answer
Patching is a necessary evil and doing it manually in any decent sized organization was essentially impossible in the pre-AI times and is now pure folly.
DENNIS FISHER · OCT 7 · 3 min
All AI
Here Come the AI-Generated BEC Scams
Messages delivered through legitimate third-party email infrastructure had C-suite sender display names, custom signatures, and direct approval notes.
Dennis Fisher · 2 min
Linux Foundation Backs New TRACE AI Security Standard
TRACE aims to help prove that sensitive data in organizations is being handled “according to policy” by AI agents and open weight models.
Lindsey O'Donnell-Welch · 2 min
Inside ExploitGym: How Researchers Are Measuring AI Agent Exploitation Capabilities
A research collaboration, directed by UC Berkeley, led to the development of ExploitGym, a large-scale benchmark for measuring AI agents’ abilities to develop exploits. Here’s the story of how ExploitGym came to be.
Lindsey O'Donnell-Welch · 9 min
MLflow Bug Actively Exploited to Steal Credentials
This flaw allows remote, unauthenticated attackers to read sensitive data from internal network services or cloud metadata endpoints.
Dennis Fisher · 2 min
OpenAI, Anthropic AI Agents Performed ‘Unsanctioned’ Actions During Cyber Tests
OpenAI and Anthropic models made “unsanctioned” actions during tests by the AI Security Institute. Here’s what we know.
Lindsey O'Donnell-Welch · 5 min
Your LLM Is Showing: New Data Finds Sharp Rise in Exposed AI Tools
Exposures of AI/LLM tools has risen by more than 60 percent over the last nine months.
Dennis Fisher · 2 min
Bug in Cursor Allows Simple RCE
This exploit occurs entirely in the background, requiring no user approval, dialogue prompts, or interaction.
Dennis Fisher · 3 min
Researchers Find New GhostApproval Bug in Many AI Coding Assistants
The bug is a modern twist on a Clinton-era piece of known Unix badness: following symbolic links.
Dennis Fisher · 4 min
macOS Gaslight Backdoor Weaponizes Prompt Injection Against Security Analysts
Gaslight is a Rust-based backdoor that researchers from SentinelOne have attributed to DPRK-aligned threat actors.
Dennis Fisher · 3 min
Mastra AI Hit By npm Compromise
The unknown threat actor gained unauthorized access to legitimate npm accounts, allowing them to inject malicious dependencies into widely used packages.
Dennis Fisher · 2 min
A Copy Fail FAQ
The latest branded bug is a slick, portable LPE in many Linux kernels going back to 2017.
Dennis Fisher · 3 min
Vercel Says Internal Systems Hit in Breach
The incident came to light on Sunday and the company says it has brought in an incident response provider to investigate the intrusion. Details of the intrusion are scant at this point.
Dennis Fisher · 3 min
Myths and Mythos: An AI Vulnerability Research FAQ
It’s still very early days for all of this, and relatively little is known about Claude Mythos’s real capabilities, so we wanted to dig into what actually is known and what it all means.
Dennis Fisher · 6 min
Anthropic’s Claude Mythos is Just the Beginning
Anthropic’s Project Glasswing initiative, announced this week, sent shockwaves across the cybersecurity world.
Lindsey O'Donnell-Welch · 3 min
Command Injection Bug in OpenAI Codex Exposed GitHub OAuth Tokens
The bug is a command injection issue and lies in the way that Codex processed GitHub branch names during the execution of tasks.
Dennis Fisher · 3 minFor AI and Security, ‘The Storm is Coming’
Technology moves quickly, and as we’re discovering yet again, threat actors move just as quickly, and are adopting AI tools and platforms at an astonishing rate.
Dennis Fisher · 3 min
Mister Decipher’s Neighborhood
It’s a beautiful day in the neighborhood for hacking! Come along on a magical adventure as Mr. Decipher teaches you about the dangers of brute-force attacks!
Dennis Fisher · 1 min
