Tag: ai security
177 articles
Anthropic's Fable 5 Model Quickly Jailbroken
Anthropic's supposedly secure Fable 5 model was quickly exploited, with its guardrails designed to prevent cyberattacks bypassed in just days. This rapid jailbreak raises concerns about the model's safety and reliability.
Agentic AI Reshapes Offensive Operations
Meet the "script kiddie as a service" era, where AI has erased the old skill barrier, allowing attackers with just intent and access to capable tools to launch sophisticated, autonomous attacks. Agentic AI has made it possible for previously unskilled actors to plan and execute campaigns without needing to pull the trigger themselves.
Dify Vulnerabilities Expose AI Chats Across Tenants
Researchers have uncovered four critical vulnerabilities in Dify, a popular AI platform with over 146,000 GitHub stars, that could allow attackers to read sensitive AI conversations across different customer applications without needing authentication. These flaws, collectively known as DifyTap, expose a broad attack surface due to Dify's default multi-tenant setup.
Shadow AI Exposes Access Control Gaps
The real risk of Shadow AI isn't about employees sharing sensitive info, but about unauthorized AI agents operating within your organization, connected to critical systems, and taking actions that can lead to data breaches and access-control failures. A staggering 65.4% of unused chatbots still have active credentials, leaving a gaping hole in your security.
AI Coding Agents Exposed to Agentjacking Attack
Imagine a sneaky new attack that tricks AI coding assistants into doing an attacker's bidding - without ever touching the victim's infrastructure. This clever hack, dubbed Agentjacking, uses a sneaky sequence of steps to get AI tools to execute malicious code on developers' machines.
AI Skills Marketplace Exposes Security Gaps
A recent audit of OpenClaw's AI skills marketplace uncovered a staggering 250,706 behavioral deviations in 49,943 agent "skills", revealing a significant gap between what AI skills claim to do and what they actually do. This alarming mismatch highlights the urgent need for robust security measures, such as Palo Alto Networks' Unit 42's Behavioral Integrity Verification (BIV) solution.
Trump Memo Targets AI Contractors With New Security Rules
The US is set to supercharge its AI capabilities in intelligence and warfighting domains, with a new presidential memo directing the federal government to accelerate AI adoption while prioritizing speed, security, and responsible innovation. The move aims to harness AI's potential in line with American values, with rigorous oversight to ensure safe and effective deployment.
OpenAI Bolsters ChatGPT Security With New Controls
OpenAI has introduced Lockdown Mode for ChatGPT, a game-changing security control that limits the model's access to the web and external services, giving users and organizations handling sensitive data an added layer of protection. This new feature is now available to personal and self-serve business accounts, following its initial rollout for enterprise plans in February.
OWASP Researcher Warns of Unsolved Prompt Injection Risk in AI Development
Ariel Fogel, an AI security researcher, warns that organizations are rapidly deploying AI agents without proper governance, leaving a critical vulnerability - prompt injection - unsolved. This architectural flaw in large language models allows inputs to be processed as a single token sequence, with no reliable way to enforce privilege boundaries.
Lloyds Banking Group Unveils Hands-On Approach to Securing Agentic AI
Lloyds Banking Group is taking a proactive approach to securing agentic AI, recognizing that understanding AI itself is crucial to embedding security into its adoption. The bank has made security a top priority, framing it as a deliberate technical strategy that spans the entire AI lifecycle.
Secure Infrastructure Unlocks AI's Defense Potential
As Dave Wajsgras, chairman and CEO of Everfox, aptly puts it, AI's trustworthiness is only as strong as the security of its underlying data, networks, and access controls. A recent incident involving Anthropic's Claude Mythos model serves as a stark reminder of the risks, with an unauthorized group reportedly gaining access in mere hours.
Pentagon Integrates Cyber into Operations, Prioritizes AI Security
The Pentagon is revolutionizing its approach to cyber operations, shifting away from treating it as a separate entity and instead weaving it into every military operation from the ground up. By doing so, the Defense Department aims to harness the full power of information on the battlefield, with AI security at the forefront of this strategic evolution.
Browser Becomes Front Line in AI Security Battle
The battle for AI security is heating up, and the browser has become the front line - with security teams facing a double threat of AI-powered attacks converging in this critical space. Attackers are leveraging AI to supercharge phishing techniques, including device code phishing kits that have surged 18x in just one year.
OWASP Launches Agentic Research Council to Tackle AI Security Gap
OWASP's new Agentic Research Council is set to revolutionize AI security by bridging the gap between rapidly evolving AI capabilities and lagging security research, bringing expert-backed solutions to the forefront. By uniting research and practice, the council aims to empower cybersecurity practitioners, developers, and leaders to stay ahead of emerging threats.
ChatGPT Vulnerability Exposes Users to Phishing Attacks via Web Summaries
Beware of ChatGPhish, a vulnerability in ChatGPT's web summarization feature that lets hackers disguise phishing attacks as harmless links and images. This security flaw could put you at risk of falling prey to scams via web summaries.
ChatGPT Exposes Users to Prompt Injection Attacks via Browser Content
Researchers have uncovered a vulnerability in ChatGPT that leaves users open to prompt injection attacks, where malicious content is embedded into web pages and then summarized by the AI system as legitimate information. This loophole could put users at risk of falling prey to spoofed security alerts and other online threats.
Snowflake Bolsters AI Security with Natoma Acquisition
Snowflake is supercharging its AI security with the acquisition of Natoma, empowering users to tackle everyday tasks like sending emails and checking calendars without leaving Snowflake Intelligence or Coco. This move is part of Snowflake's vision for an "agentic control plane," where AI agents can take actions across business systems while keeping security controls firmly in place.
OpenAI Bolsters Cybersecurity, Election Integrity with 2026 Midterm Safeguards
OpenAI is stepping up its game to safeguard the 2026 midterm elections with a robust five-part plan to combat AI-driven interference and bolster cybersecurity. The company is committed to protecting digital infrastructure and promoting election integrity by spreading reliable information, watermarking deepfakes, and more.
Executives' Blind Spot: Shadow AI Use Exposes Security Risks
Most organizations have a blind spot when it comes to AI usage, leaving them vulnerable to security risks - and the truth is, you can't protect what you can't see. A recent study by Okta and Apprize360 found that shadow AI use is rampant, exposing companies to potential breaches, data exposures, and system disruptions.
Russian Hacker Exploits Jailbroken AI in Crypto Fraud Scheme
A solo Russian hacker, known as bandcampro, has orchestrated a massive crypto fraud scheme, reaching 17,000 subscribers on Telegram with AI-generated content that convincingly mimicked popular conspiracy styles. This alarming development marks a turning point in cybercrime conspiracies, with AI-powered threats on the rise.
Trump Delays AI Security Order Amid Industry Competition Concerns
President Donald Trump has delayed an executive order aimed at regulating frontier AI models, citing concerns over certain aspects of the proposal, which would have required a 90-day testing and vetting regime for new AI models. The order would have allowed federal agencies to study new models before public release and facilitated access for cybersecurity testers.
Measuring AI Security Effectiveness Proves Elusive
Measuring AI security effectiveness is a complex challenge that can't be reduced to a single score or benchmark. Relying on benchmarks alone simply doesn't work when it comes to safeguarding AI systems.
Microsoft Bolsters AI Security with Open-Source RAMPART and Clarity Tools
Microsoft's new open-source tools, RAMPART and Clarity, empower product managers and engineers to stress-test AI security assumptions early on, saving months of potential rework and costly mistakes. With RAMPART, developers can write and run safety tests to identify vulnerabilities in AI agents, covering both adversarial and benign threats.
OpenClaw Flaw Enables Hackers to Hijack AI Agents
A newly discovered flaw in OpenClaw, dubbed the Claw Chain, allows hackers to hijack AI agents and use their privileges to gain persistent control of an environment. By exploiting this vulnerability, attackers can escalate privileges, access sensitive data, and maintain a foothold within the system.