Marc Ruef

GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos | Noma Security

Noma Labs found a prompt injection flaw in GitHub Agentic Workflows that let an unauthenticated attacker leak private repo data via a crafted GitHub Issue.

Windows 11 identifier code used to track Scattered Spider perp after Microsoft shared info with FBI — 19-year-old US-Estonian hacker arrested over alleged ties to infamous extortion group

DOJ claims the group stole over $100 million across various attacks.

Hot for Security

OpenAI's AI "goes rogue" and hacks Hugging Face: what you need to know

You can't have failed to hear the news headlines: "AI agent went rogue and hacked startup by itself, OpenAI reveals", "Firm hacked by rogue OpenAI models says it is 'a wake-up call'", and even "Humanity is no longer in control of its most awesome creation.

DroneXL

Pokémon Go Scans Quietly Trained the Navigation Tech Now Headed Into Military Drones

Pokémon Go players

The AI Agent Attack Surface Is Growing Faster Than It Can Be Monitored

The proliferation of AI agents is expanding at a huge rate, creating a fast-developing attack surface. Investigate with the experts at ZeroFox.

TechCrunch

Iran abused mobile networks' vulnerabilities to locate US military in the Middle East, report says | TechCrunch

The Iranian government exploited well-known flaws in cellphone networks to locate and then strike U.S. military personnel in the build-up and beginning of the war.

Microsoft Patches a Record 570 Security Flaws – Krebs on Security

Hot for Security

The ransomware negotiator who was working for the other side

When a company falls victim to a ransomware attack, it is not uncommon for it to turn to experts for help.

Malwarebytes

Ghostcommit attack hides malicious AI instructions in images

A proof-of-concept attack hides prompt injection in a PNG file, turning routine code reviews into a path for secret theft.

Orca world model explained a new approach to AI learning

Tenable®

AI agent config attacks: How attackers turn trusted Dev harness files into payloads

Defend AI coding assistants against config attacks. Learn how attackers weaponize trusted dev harness files for supply chain exploitation, and explore 7 ways to protect your organization.

bbc.com

I tried to prove I'm not AI. My aunt wasn't convinced

I asked experts if I'm real. Bad news. Even my aunt wasn't sure if I was a deepfake. AI is so convincing that a sitting prime minister struggled to prove he's alive. You might be next.

Introducing System One Models and Jev - TypeSafe AI Blog

TypeSafe AI is an AI lab building machine-native intelligence infrastructure for automation, designed to make decisions within software. Try our first System One Model, Jev, in early access.

Schneier on Security

Team Mirai and Democracy - Schneier on Security

Japan’s election last month and the rise of the country’s newest and most innovative political party, Team Mirai, illustrates the viability of a different way to do politics. In this model, technology is used to make democratic processes stronger, instead of undermining them. It is harnessed to root out corruption, instead of serving as a cash cow for campaign donations. Imagine an election where every voter has the opportunity to opine directly to politicians on precisely the issues they care a

The Information

Trump Administration Asks OpenAI to Stagger Release of New Model Over Security Concerns

For AI companies on the verge of releasing cutting edge new AI models, there’s a new normal in the wake of the Trump administration’s tense showdown with Anthropic in recent weeks. On Wednesday, for example, OpenAI CEO Sam Altman informed staff during a Q&A session that the company would release ...

Tenable®

How AI has made legacy vulnerability management obsolete at securing your attack surface

As AI compresses exploit timelines, managing CVEs is no longer enough. Learn how exposure management detects, prioritizes, and fixes CVE and non-CVE issues, like shadow AI.

AAAS

Science | AAAS

Cisco Blogs

Strengthening the Foundation: A Predictable, Customer-Focused Response to AI-Accelerated Vulnerability Discovery

Cisco is moving to a scheduled, twice-monthly security release model to address AI-accelerated vulnerability discovery, providing customers with greater predictability and streamlined, systemic security updates.

Cisco Blogs

Machine Speed, Human Judgement: How AI Changed the SOC in 2026

A firsthand look inside the Cisco Live 2026 SOC and how AI, automation, and agentic workflows are transforming modern security operations.

sysdig.com

JADEPUFFER: Agentic ransomware for automated database extortion | Sysdig

The Sysdig TRT documents JADEPUFFER: the first known agentic ransomware operation, where an LLM autonomously exploited Langflow, harvested credentials, and executed full database extortion.

'It's just his AI and my AI going back and forth' The workplace phenomenon that's undermining human relationships | Fortune

AI isn’t the problem, says leadership expert Leena Rinne: It’s social connection and emotional intelligence instead.

TechCrunch

Chinese cybercrime operation that used AI to scam 'hundreds of thousands of victims' sued by Google | TechCrunch

The tech giant said a group called "Outsider Enterprise" used AI to scam hundreds of thousands of victims, sending 2.5 million text messages over a span of two weeks.

Amazon cracks down on use of AI images by sellers after New York law

A recently enacted New York law mandates that companies disclose when an ad includes a "synthetic performer" in place of a human actor.

The Defence Blog – Military and Defense News

Russia’s cutting-edge drone upgrade is a $2 camping compass

Somewhere in a Russian drone factory, an engineer looked at a satellite-jamming crisis that has cost the Kremlin countless drones and countless rubles, and solved it with the same tool Boy Scouts use to find their way out of the

TechCrunch

How AI guardrails are impeding the work of offensive cybersecurity researchers | TechCrunch

We spoke with several cybersecurity researchers, who look for unknown vulnerabilities and develop tools to exploit them, about how OpenAI’s and Anthropic’s guardrails affect their work.

Zero Day Initiative — The July 2026 Security Update Review

Well folks. Here we are. The bug apocalypse has fully descended upon us. I’ll do my best to sort this out in some way meaningful, but this month’s release shows us the nay-sayers were right, and I’ve got to hand it to the nay-sayers here. Excellent call. Take an extended break from your regularly sc

AMD denies researcher a $10,000 bug bounty after fixing critical auto-updater vulnerability — security flaw took 124 days to patch

Quis renovatores renovat — who updates the updater?

Command Line

Towards secure, autonomous agents with information-flow control (IFC)

A deterministic security system, information-flow control (IFC) offers a promising path towards secure and autonomous agents.

Germany Doxes “UNKN,” Head of RU Ransomware Gangs REvil, GandCrab – Krebs on Security

Artificial intelligence-based law firm wins in court | Computer Weekly

AI-based law firm received Solicitors Regulation Authority approval in June last year in a landmark decision.

XDA

Linus Torvalds used AI to fix a Linux bug, and now LLM critics on Linux face an uncomfortable choice

Avoiding software without AI code is getting very difficult.

The First AI‑Designed Vaccine Has Been Tested in People. Here's What Happened.

Scientists used AI to find targets shared by thousands of related viruses and build what they hope is a universal vaccine.

TechCrunch

Kimi: Threat or menace? | TechCrunch

Chinese company Moonshot AI released a new version of its Kimi model this week, prompting concern about "full AI communism."

Tenable®

How Claude Mythos Preview is changing code security at Tenable

30 days running Claude Mythos Preview against our own code: reproducing exploits, real dollar costs, and why every security team is next.

Malwarebytes

How to tell if an image is AI-generated

Scammers are using AI-generated images to make fake stories more convincing. Here's how to separate real from fake.

ZDNET

'I'm not a programmer' anymore: Linus Torvalds on the only two tools he uses now - ZDNET

At the Open Source Summit in Mumbai, Torvalds discusses the pain and power of AI in the kernel, and why Linux no longer supports 'museum' technology.