Trojanized AI skills gain 1.7M installs in agent-targeted attack
Researchers have uncovered an extremely effective attack campaign that involved AI agent skills trojanized to deploy a credential stealer. The incident is pa...
enterprise
20 articles
Moonshot’s Kimi AI model has also escaped from a test environment
Yet another AI model has escaped from a cybersecurity test lab: This time, it’s the Chinese company Moonshot’s Kimi K3 model on the run. Frontier Security sp...
Snowflake attacker pleads guilty to hack of 165 companies’ data
A Canadian hacker has admitted being part of a group responsible for several major cyberattacks. Connor Riley Moucka pleaded guilty to being part of a coteri...
Python package security in 2026: How supply chain attacks are targeting your AI development environment
On March 24, 2026, developers building AI applications with LiteLLM — a Python package with 95 million monthly downloads — unknowingly installed malicious co...
Human oversight is still critical as AI patching tools miss security risks
AI-generated vulnerability patches still heavily depend on human review, particularly the ones involving security-sensitive code, according to a research. Re...
What does a data breach cost? AI is a sizable factor
The financial impact of a data breach is substantial for any modern business, regardless of industry or size. IBM’s latest Cost of a Data Breach report disco...
Why exposure management is replacing vulnerability management
Vulnerability management isn’t failing because security teams lack visibility. Most organizations already have more findings than they can reasonably address.
NatJack exploits put NAT security assumptions to the test at Black Hat
For decades, Network Address Translation (NAT) has been the default way IP addresses are provided inside larger networks, as a means to deal with the challen...
How a software provider closed unknown paths to cloud compromise
A healthcare software provider believed its segmented environment was reasonably secure. The company had invested heavily in layered controls across a distri...
How a global investment firm reduced security surprises
Most security teams don’t suffer from a lack of data. They suffer from a lack of certainty.
An Irregular testing that caused Meta, OpenAI, and Anthropic AI agents to go rogue
Meta has become the third frontier AI developer in recent weeks to disclose a security incident involving one of its advanced AI models during cyber capabili...
Meta joins OpenAI, Anthropic in latest AI test breach
Meta has become the third frontier AI developer in recent weeks to disclose a security incident involving one of its advanced AI models during cyber capabili...
You’re only as secure as your last evaluation
The updated Cybersecurity Maturity Model Certification (CMMC) represents a critical evolution in the Department of War (DoW) strategy to secure the Defense I...
Cybersecurity needs a new operating model
For decades, cybersecurity has been built around one assumption: defenders had enough time to: Discover vulnerabilities. Assess exposure.
The exploit window is shrinking. Most security workflows are not
AI is accelerating vulnerability discovery, exploit development, and attacker weaponization faster than most organizations can adapt. Security teams are inun...
CTEM isn’t failing. It’s not being operationalized
Cybersecurity is full of frameworks, regulations, and directives that tell organizations what they should do. Zero Trust, NIST, CIS Controls, CMMC, DORA, NIS...
Autonomy is earned, not claimed
After more than 300,000 production penetration tests (pentests), our company has learned something that may surprise people watching the recent wave of auton...
Attackers hid malware inside Oracle Database after SQL injection breach
Huntress has documented a case where the Oracle database itself became the malware host. The security firm disclosed a campaign in which threat actors exploi...
Verification closes the loop
Most organizations assume remediation reduces risk. It’s a reasonable assumption.
Why the ‘rogue AI’ problem will lead to an era of headaches for security practitioners
Shortly after OpenAI publicly acknowledged the Hugging Face breach on July 21, Reuters journalist Raphael Satter called me for comment on a story which would...