The Ransomware Crew Had 50 Attack Techniques Ready Before Lunch
A ransomware operator used AI agents to execute more than 50 attack techniques in under ten hours, turning a complex intrusion into a machine-paced workflow.
AI
Artificial intelligence, local AI, agents, tooling and AI security.
Your Password Was Fine. The Stolen Claude Session Still Drained the Account
Infostealers are stealing active Claude sessions, bypassing the need to defeat passwords or multi-factor authentication.
Australia’s AI Music ‘Ban’ Has One Big Weakness: It Starts With Self-Reporting
Australia excluded AI-led recordings from its charts, but enforcement begins with declarations from rights holders. The rule is clear. Its evidence model is not.
Six AshAI Flaws Turned Prompts Into a Path to Server Takeover
AshAI disclosed six vulnerabilities, including a CVSS 10 flaw that compiled attacker-controlled prompt content as Elixir before any model request.
The AI Gateway Held the Keys. Attackers Turned LiteLLM Into a Credential and Persistence Hub.
Microsoft observed attackers turning exposed LiteLLM gateways into credential-harvesting, database-access and persistence hubs. The public exploit chain makes AI gateways a Tier-0 patching priority.
The Argo CD Token Was Outbound. The MCP Server Treated Every Caller as Trusted.
argocd-mcp 0.8.0 exposed its Argo CD tool surface without caller authentication, letting reachable clients act with the server's stored token. Version 0.9.0 rebuilds the boundary.
GitLab’s Claude Agent Read User-Controlled Configuration. Developer Access Reached Arbitrary CI Commands.
GitLab patched a Duo Claude flaw that let a Developer turn user-controlled configuration into arbitrary commands inside a CI job.
130 Tech Companies Say We Have Months to Prepare. Their Letter Includes No Deadlines
More than 130 organisations warn that defenders have only months to prepare, but their voluntary pledge includes no deadlines.
Your ‘American’ AI Model May Still Have Chinese DNA
Cisco warns that model publishers and country labels can hide inherited weights, training data and upstream dependencies.
Microsoft Calls KB5120998 “Non-Security.” It Still Changes Admin Privileges, Agent Isolation and Enterprise Automation.
Microsoft labels KB5120998 a non-security preview, but it changes administrator protection, AI process isolation, WMIC availability, post-quantum TLS and enterprise deployment behaviour.