Category
Cisco's 2026 State of AI Security report reveals a dangerous gap: enterprises are deploying AI agents faster than they can secure them, with MCP vulnerabilities and prompt injection attacks proliferating.
Security researchers found that simply opening an untrusted repository in Claude Code could execute arbitrary commands and steal your Anthropic API keys - all before you saw a warning.
xAI's chatbot generated millions of sexual deepfakes, including of children. Now regulators from California to the EU are closing in.
IBM's annual threat intelligence report reveals attackers are using AI to accelerate vulnerability discovery while infostealer malware harvests hundreds of thousands of AI chatbot credentials from the dark web.
78 chatbot bills are active in 27 states as lawmakers respond to tragedies involving Character.AI and other companion chatbots. California and New York laws are already in effect.
Android malware using Gemini for real-time evasion. A low-skill attacker using Claude and DeepSeek to compromise 600 networks. NIST launches an emergency standards initiative. Welcome to February 2026.
Amazon threat researchers tracked a Russian-speaking attacker who used commercial AI tools to compensate for limited hacking skills. The result: 600+ FortiGate devices compromised across 55 countries.
A bug allowed Microsoft 365 Copilot to summarize emails marked with confidentiality labels, bypassing DLP protections. Microsoft says no one saw data they weren't authorized to see. That misses the point.
Microsoft's 'Share with Copilot' taskbar feature is enabled by default and transmits visual snapshots of any open window to cloud servers for AI processing.
This week in AI security: Chat & Ask AI exposes 300 million messages, Microsoft patches Copilot email vulnerability, and vibe-coded apps prove trivially hackable.
Kaspersky finds DeepSeek, Llama, and ChatGPT all produce password outputs that fail standard strength tests. Prediction capability makes LLMs bad at randomness.
Microsoft Semantic Kernel has back-to-back CVSS 10.0 vulnerabilities enabling remote code execution and arbitrary file writes through AI agent function calls
A CVSS 9.8 flaw in the popular AI inference engine allows unauthenticated remote code execution through malicious video URLs. Patch now if you're running multimodal models.
Microsoft found 31 companies embedding hidden instructions in AI share buttons. One click poisons your assistant's memory without your knowledge.
Two vulnerabilities in the popular Chainlit AI framework allow attackers to steal cloud credentials, API keys, and user data from enterprise chatbots.
Discord announces mandatory facial scanning and ID uploads months after a breach exposed 70,000 government documents. Users are fleeing to Matrix and TeamSpeak.
ESET discovers Android malware that queries Google's Gemini AI in real-time to navigate infected devices and maintain persistence across any Android version.
Researchers discovered that displaying an AI model's reasoning process creates a roadmap for attackers. OpenAI's o1 rejection rate dropped from 98% to under 2%.
A source-by-source audit of eight AI assistants, what they collect, how training defaults differ, and which privacy settings users can change.
A Cybernews analysis of 1.8 million Android apps found most AI apps leak credentials in code. Over 200M files were exposed via misconfigured databases.
Check Point demonstrated how web-browsing AI assistants can relay malware commands through legitimate traffic. Microsoft changed Copilot's behavior.
Researchers tricked Google Translate's Gemini-based Advanced mode into answering prompts, including requests for drug and malware instructions.
Research from ELLIS Alicante shows AI reasoning models can autonomously plan and execute attacks that bypass safety guardrails in nearly all other AI systems.
The viral AI agent went from 135K GitHub stars to enterprise blacklists in three weeks. Here's what went wrong and why it matters for every AI agent.
