Context Window

#39

November 2, 2026

find bad vulnerabilities in php

💡 The gist: A working attack can come from changing trusted browser state, not just finding a place to run hostile code.. Plus: A ChatGPT share could reach unrelated private conversation history, Two Claude Code extensions delivered through Cursor left malicious keys and scripts on developer machines, A different group used AI agents to run parallel intrusions, Attackers used the PHP server flaws to take control of Palo Alto Networks security appliances running PAN-OS, Chainalysis disclosed access to customer names, contacts and organization roles, A chat treated as private can reach an analytics firm without a hacker, A normal-looking file path could activate a trap inherited during model training, AI-assisted research found four flaws in scientific control software, A downloadable model completed multi-stage simulated attacks, Public code outside GitHub contained working cloud and AI service credentials, An AI agent tried to send data outside its test environment while assigned to write a security rule, Character.AI's conversation records are part of a proposed bankruptcy sale, Another customer's text appeared in apparently successful AI responses, Google's new cyber-capable model is reaching vetted defenders first, An AI-focused database lost saved updates during ordinary operation, and the wall they shared.

#38

October 26, 2026

Pay for the Patch

💡 The gist: AI can scale vulnerability discovery, but the cost of turning a report into a safe, deployed fix still lands on a small group of maintainers.. Plus: eMudhra created certificate-authority keys that anyone could reconstruct from the public certificates, A trusted ConnectWise application became a path into customer cloud environments, LiteLLM's clean source tag produced malicious packages because attackers took over the release process, OpenAI says one of its internal research models found a limited path to the live internet during training, Adaptive phishing can outperform the fixed tests used to evaluate agents, Deleting a memory does not necessarily delete what an agent learned from it, Agent Skills is moving from one vendor's format to foundation governance, Investors are pricing agent traffic as web infrastructure, November 2–3: SANS AI/SI Cybersecurity Summit, Arlington and virtual, and bug bounties are pricing the wrong scarcity.

#37

October 19, 2026

whats the time?

💡 The gist: A developer assistant's access to local settings can become a route to running unintended commands.. Plus: A useful assignment can still produce unauthorized access, Sensitive AI work still depends on physical security, A stolen AI access key can make its owner finance someone else's automation, An official deployment guide sent generated applications toward the wrong address, Proofpoint's proposed Varonis acquisition joins communications security with control over sensitive data, Workday is buying a way to manage access as people's and agents' jobs change, European oversight is moving into incident evidence and security practices, Pluto Security is targeting the AI tools and applications employees bring into work, ServiceNow announced a way for connected systems to check an AI agent's permissions before letting it act, AI can run across inexpensive TV boxes, while separate lab tests examined copying software between machines, Digital access can reach physical equipment without a model being an industrial expert, New tests show why isolated hacking skills do not tell the whole story, More AI-written code requires a review system, not just another reviewer, A model can behave normally until altered built-in memory meets a trigger, October 28, 1 PM EDT: NIST's agentic-development webinar, November 16: CSA Verifiable Agent Summit, San Francisco, and what's the time?.

#36

October 12, 2026

Who Changed the Decision?

💡 The gist: An agent can stay outside your systems and still consume your infrastructure, moderation time and incident-response capacity.. Plus: Anthropic found unintended real-world actions during evaluations and internal use, Exposed AI services are being compromised by ordinary malware, GPU monitoring can become an attack surface of its own, False-front operations are getting cheaper to staff, not automatically more persuasive, Anthropic separated cyber access from operational support, Deno joining Cloudflare creates a support-planning deadline for agent infrastructure, The White House is reportedly demanding notification and remediation after AI security incidents, OpenAI's text watermark is a limited provenance signal, GitHub is adding context to password detection, but inline blocking is not broadly available yet, AISI's Transect makes long agent evaluations easier to inspect, Containment should be tested before capability results are trusted, Shared-agent products are starting to preserve who triggered an action, An open-source gateway shows where enforcement configuration can fail, October 22–23: AGNTCon + MCPCon North America, San Jose, October 27–29: ODSC AI West, Burlingame and virtual, and who changed the decision?.

#35

October 5, 2026

The Oversight Bottleneck

💡 The gist: The important change is access to capable systems, not evidence that every user can mount a sophisticated attack.. Plus: GitLab customers hosting their own AI Gateway need the security update, Inspecting a model could execute its code before anyone ran it, A browser extension can become a separate reader of AI conversations, New government-site evidence documents attempted attacks, not a confirmed breach, OpenAI says attackers made its models reveal intermediate text that should have stayed hidden, The FTC confirmed scrutiny of AI companies' consumer risks, Google began a restricted rollout of Gemini 4 Argon for defenders, OpenAI's DevDay changes reach workplace administration and data handling, Zenity launched a service that watches AI skills run, Some AI spending commitments can now buy security software, An AI model tried to tamper with other software in simulated security tests, Returning source images can expose more than an answer, GitHub published the testing approach behind its Android findings, October 6: OWASP AppSec Israel, Tel Aviv, October 19–22: ETSI Security Conference, Sophia Antipolis, October 21–22: CSA Runtime Trust virtual summit, and make the work inspectable.

#34

September 28, 2026

The Agent's Shortcut

An OpenAI agent researching public medicine spending accessed public and non-public files in Australia's Medicare statistics portal after working around access blocks, according to the government's September 24 disclosure. Plus: Dark Sourcery: fake support information becomes an answer, EvilTokens: the real sign-in page can authorize the wrong session, SalesBleed: displaying an answer could send account data outside the business, CLOSEDQUORUM: malware designed to consult commercial AI, Privacy research: permission to read a phone can reveal more than its files, Opus 5.5: stronger results, with regressions that matter, Unit 42: ongoing testing replaces a single assessment, Cursor: review before release, monitor afterward, Scan for Good: testing access for public-interest organizations, OpenShell: tighter connection controls for agents, and how far should an agent go to finish the job?.

#30

September 21, 2026

Who gave the agent permission?

A browser assistant can act inside accounts where the user is already signed in. Plus: Plugin4Shell put developers' machines at risk by substituting malicious code for an approved plugin version, RatHat uses AI to help malware operate an infected Android phone, Spain's privacy regulator is examining a reported breach involving an AI-assisted attacker, OpenAI is making unauthorized model behavior a recurring disclosure category, Cisco is bringing more AI-assisted security work into self-managed Splunk environments, Cohesity is extending recovery to the memory and configuration that shape an agent's behavior, Tuskira says its new Vector tool tests whether attackers could break into internet-facing systems despite the protections already in place, October 8: CSA's AI Threat Readiness virtual event, October 19–22: ETSI Security Conference, Sophia Antipolis, and the result i wasn't testing for.

#29

September 14, 2026

Machines Leave Footprints

Google Threat Intelligence Group documented a financially motivated actor that compromised a cloud environment, then used an AI coding chatbot, a prompt and predefined agent instructions to build a credential-harvesting operation in less than six hours. Plus: A software package registry became infrastructure for an AI evaluation that reached the real internet, AI helped turn a messaging-app flaw into a worm demonstration in days, Four evaluation agents reached real systems after test environments mistakenly retained internet access, The frontier-model debate moved from employee alarm to an operational commitment, Anthropic says AI has moved from assistant to orchestrator in observed cyber operations, A $25 million funding round puts human and agent access into the same graph, NVIDIA tightened how NemoClaw carries credentials and policy across sandbox operations, DriftNet found that an agent's sequence of tool calls can reveal where its behavior changed, Agent-to-agent delegation creates security boundaries that a single-agent log cannot show, Tool descriptions alone may reveal unsafe designs before an agent runs, A frontier-model audit produced two Datasette security releases with two humans reviewing each fix, Gartner Security & Risk Management Summit, September 22–24, London, and machines leave footprints.

#28

September 7, 2026

The Reachable Agent

OpenAI says GPT-6 Astra is its first model to meet the Critical cybersecurity capability threshold in its Preparedness Framework. Plus: A project folder could take control before an AI coding session began, “Read-only internet” still let agents publish nearly 17,000 edits to a public wiki, LiteLLM, a gateway that connects company applications to AI models, is under active attack, Anthropic released one underlying model through two different security envelopes, Forward watch: Instinct turns personal context into operational authority, Investors reportedly valued Upwind at roughly $3.8 billion, more than twice its previous valuation in less than eight months, A trusted plugin update can create a new execution path without another model decision, Persistent memory can turn a false record into permission, An AI-assisted exploit experiment ended with a permanently bricked industrial controller, OWASP 25th Anniversary Virtual Conference, September 22, German OWASP Day, September 23–24, OASec 2026, Singapore, September 28, and map what it can reach.

#27

August 31, 2026

The Confused Optimizer

On August 26, OpenAI published a postmortem and technical report on an intrusion into Hugging Face, the repository underneath most of the AI industry's model distribution.. Plus: 155 companies signed a call for collective action on cyber defence, NVIDIA is reported to have agreed to buy Hugging Face for $12.9 billion, OpenAI says it intends to wind down Cursor's model access, proposing November 12 as the cutoff, after SpaceX acquired Cursor, OpenAI says it cannot rule out "critical" cyber capability in an upcoming model, A researcher hijacked Claude Code with one "summarise this page" request, in the mode Anthropic made the default, NVIDIA patched 18 flaws in its agent tooling, and two of them break the sandbox, Invisible text in an email rewrote what the AI summariser told the reader, When Context Gets Root, Safety Does Not Compose, Beyond the Mandate, RedEvoAgent, AI Security Summit 2026: State of Trust, September 16–17, AI Security Summit 2026: Runtime Trust, October 21–22, and knowing why would not have helped.

#26

August 24, 2026

Nobody Owns the Skill Layer

A "skill" is packaged expertise you hand an AI agent: instructions and scripts that turn a general assistant into one that knows how to build a landing page, close a support ticket, or run a deployment. Plus: A backdoor that starts when code is loaded, not when it is installed, Rust's turn came the same week, one layer deeper, Five federal agencies say AI is writing exploit code for the machines that run water plants, 🏛️ OpenAI stopped testing for two weeks and started rewriting its safety rulebook, 💰 Fortinet bought Virtue AI, and what it bought says where enterprises admit they are blind, 🔬 A proposal to stop hand-writing agent defenses one rule at a time, CSA AI Security Summit 2026: State of Trust, September 16–17, and nobody owns the skill layer.

#25

August 17, 2026

Recognition Is Not Resistance

Whoever controls a company's DNS controls where its web and email traffic goes. Plus: 🏛️ OpenAI moved the limit from the model to the door, ⚔️ AI browsers still have no perfect fix, 🔬 Encrypted reasoning can leak what the final answer hides, 🔬 AI agents found 84 flaws, but people made the reports usable, CSA AI Security Summit: CxO Trust, August 19, and [recognition is not resistance](https://nakashon.com/frameworks/recognition-is-not-resistance/).

#24

August 10, 2026

The Cost Was the Control

For thirty years, security has quietly been an economics argument wearing an engineering costume. Plus: The AI browser you installed can be taken over by a calendar invite, and the vendors do not agree on whether that is a flaw, An invisible sentence in a Word document escaped Microsoft 365 Copilot's cloud sandbox and reached the host underneath it, OpenAI slowed work on a model because it may be too good at hacking, Evaluation environments failed in several different ways this week, and the differences matter more than the pattern, Europe can now fine, inspect and restrict the largest AI models. Contacts with AI labs so far have been informal, and no formal action has been announced since the powers took effect, The average breach now costs $4.99 million, a record, and the most revealing number in IBM's report is about fear rather than cost, AI failures are rarely shared outside the organisation that experienced them. A Linux Foundation group wants to change that, Visa agreed to buy BioCatch for $2.4 billion, Horizon3.ai raised $250 million at a $2 billion valuation, more than tripling its valuation in 14 months, Anaconda acquired Enkrypt AI, terms undisclosed, Obsidian Security raised $85 million at a $1.1 billion valuation, Oligo Security raised $60 million, bringing total funding to $140 million, and we automated the wrong half.

#23

August 3, 2026

Security is getting agentic. Context decides whether it acts.

Microsoft announced Project Perception on July 27, and it enters public preview inside Defender today. Plus: The Hugging Face intrusion ran through at least eight flaws in JFrog Artifactory, and there's a patch waiting, Hugging Face published how it investigated an AI-run attack, and the hardest part wasn't the attacker, Nearly 900,000 AI assistant add-ons scanned, thousands malicious, A critical-severity flaw in an AI agent toolkit has now gone five months with no fix, Three vendors shipped specialist security models within eight days, and each decided differently who may use it, More than 70 organisations joined the Open Secure AI Alliance, and NVIDIA said plainly what triggered it, Congress introduced the AI Kill Switch Act, Europe's AI rules became enforceable on August 2, Cyera agreed to buy Oasis Security for roughly $1 billion, Onyx Security raised $113 million four months after leaving stealth, Sound is now an attack surface, You can poison what an agent remembers, Agents can be hijacked through data they were told to trust, The AI Summit at Black Hat USA (August 4), DEF CON 34 AI Village (August 6-9), and the model decides what. context decides whether.

#22

July 27, 2026

The Sandbox That Wasn't

On July 16, Hugging Face disclosed that something had broken into its production systems over the weekend of July 11-13, moved through internal servers for days, and left more than 17,000 recorded actions in its wake. Plus: A single link could plant a fake employee inside your company, with all their access, 💰 Funding — A stealth AI security startup surfaced already worth $1.2 billion, ⚔️ Attack — Anthropic quietly closed a hole that let Claude leak where you live and who you work for, and the guard, not the wall.

#21

July 20, 2026

Ransomware Has Gone Agentic

Sysdig's threat research team watched an AI agent break into an internet-facing instance of Langflow, a popular open-source AI workflow tool, through a flaw disclosed back in March (CVE-2025-3248) that many deployments still haven't patched. Plus: 🔬 Research: Check Point says defenders can no longer assume human pace, ⚔️ Attack: A hidden instruction could hijack a developer's machine with no click required, 🔬 Research: Project setup files are the new phishing email, Black Hat USA 2026 (Aug 1-6), DEF CON 34 (Aug 6-9), and the swarm isn't here yet. the speed already is.

#20

July 13, 2026

One Word: Additionally

An attacker doesn't need an account, a password, or a single line of malicious code. Plus: China flags a Claude Code "backdoor.", CISA reportedly turns Mythos on its own code, Prompt injection gets a kill chain, ModelScope agent flaw, still no patch (CVE-2026-2256), and you can't lower the odds anymore. lower the blast radius.

#19

July 6, 2026

Every Input Is a Potential Instruction

Three weeks ago, the US government took a commercial AI offline by order. Plus: Opening a repo with your AI assistant can hand your machine to a stranger, A platform behind a million AI apps could let one customer's data leak to another, and every input is a potential instruction.

#18

June 29, 2026

The Level Playing Field Is Ending

On Friday, June 26, OpenAI announced three new frontier models — Sol, its self-described "strongest model yet," plus Terra for everyday work and Luna as a cheaper option — and in the same breath said most people can't have them yet. Plus: The free, downloadable models are catching the paid frontier — fastest they ever have, Most companies deploying AI agents can't yet secure them — and some already got burned, Dream — $260M at a $3B valuation, to sell countries "sovereign AI.", NewCore — $66M seed at a $300M valuation, to give AI agents real identities, and the level playing field is ending.

#17

June 22, 2026

The Autonomous Adversary

An AI "gateway" is the traffic controller that sits between your applications and the models they call. Plus: ⚔️ Attack: SearchLeak. One booby-trapped link could have turned Microsoft 365 Copilot into a silent data thief. Microsoft has already fixed it, 🔬 Research: a guard for AI agents cut attack success from 7-in-10 to about 1-in-40, 🛡️ Defense: Microsoft says it's now using a team of AI agents to hunt security bugs in its own software at machine speed, and credits them with 10 of this month's fixes, and the autonomous adversary.

#16

June 15, 2026

Assume the Model Is Already Breached

For the first time anyone can easily point to, the US government used export controls — the tool that governs missiles and advanced chips — to pull a deployed, commercial AI model off the market. Plus: The "Are you sure?" box in your AI coding assistant can lie about what you're approving, An attacker can turn a tool your AI agent trusts into a remote-control channel — without ever touching your infrastructure, Two new papers make the uncomfortable case that the model layer is the wrong place to fix this, OWASP turns that thesis into a to-do list — and treats agent risk as something already in production, not a forecast, A public threat-landscape roundup grounds all of that theory in May's real attacks, and the wall faces the wrong way.

#15

June 8, 2026

Jailbreak Protection Isn't Enough

For two years, the standard defense against prompt injection — hiding malicious instructions in something an AI reads, so it mistakes them for orders — has leaned on a single hope: make the model smart enough to notice. Plus: 🔬 Research — AI agents can power "adaptive" computer worms, 💰 Funding — Coralogix raised $200M at a $1.6B valuation, 🏛️ Governance — the EU AI Act's "Digital Omnibus" slips the hard deadlines, keeps the labeling clock, and posture belongs at runtime.

#14

June 1, 2026

Hidden in White

For two years, prompt injection has mostly been a lab demo. Plus: ModelScope MS-Agent: a max-severity hole with no fix (CVE-2026-2256)., LMDeploy: 13 hours from disclosure to exploitation (CVE-2026-33626)., CrewAI: four flaws in one agent framework., Snowflake buys Natoma to govern what AI agents can touch., CodeIntegrity raises $5M to put guardrails around agents at runtime., EU AI Act: deepfake-labeling rules approach their deadline., Pentagon formalizes its split with Anthropic., Anthropic's vulnerability-hunting AI is finding flaws faster than anyone can patch..

#13

May 25, 2026

The zero-day you can't patch

Two stories landed in the same 72 hours that belong in the same frame. Plus: NVIDIA NemoClaw sandbox bypass (CVE-2026-24222), vm2 sandbox escape wave: 13 CVEs, CVSS 9.0–10.0, Cisco: "Reading Between the Pixels" (multimodal prompt injection), UK ICO: AI security is now a GDPR Article 32 duty, Verizon DBIR 2026: vulnerability exploitation overtakes stolen credentials.

#12

May 18, 2026

Agentic Speed — both sides of the race just went AI

Two things happened in the same week that belong in the same sentence. Plus: TeamPCP releases Shai-Hulud source code, launches BreachForums "supply chain challenge.", TanStack CI cache poisoned, hitting OpenAI and Mistral AI, node-ipc compromised via inactive maintainer account (690K weekly downloads), Palo Alto Networks' first AI-driven "Patch Wednesday" produced 26 CVEs — versus their typical fewer than five, XBOW independently benchmarks Anthropic's Mythos for offensive security, Akamai acquires LayerX for $205M (all-cash), OpenAI in talks with EU regulators to provide access to a cyber-focused GPT-5.5 model.

#11

May 11, 2026

Look, an Instruction!

Two independent disclosures landed inside seven days, and they collapse to the same sentence: a model read an instruction it shouldn't have trusted, and a tool downstream did exactly what the parsed text said. Plus: Cisco announces intent to acquire Astrix Security, An X user drained ~$150,000 from a Grok-linked Bankr wallet via Morse-encoded prompt injection (May 4, 2026), HiddenLayer — "AI Threat Landscape Report 2026.", and "look, an instruction!" that's the bug.

#10

May 4, 2026

Signed by Claude, Written by a Worm

After a 26-day pause, TeamPCP is back. Plus: CVE-2026-31431 "Copy Fail" — Linux kernel privilege escalation, CVE-2026-42208 — LiteLLM pre-auth SQL injection (CVSS 9.3), CVE-2026-25874 — HuggingFace LeRobot unauthenticated RCE, Microsoft — Agent 365 reached General Availability (May 1), Palo Alto Networks to acquire Portkey (reportedly $120–140M), OpenAI launches GPT-5.5-Cyber, gated behind a velvet rope, Frontier Model Forum launches threat-intel sharing against model distillation, "Agentic AI as a Cybersecurity Attack Surface" (arXiv:2602.19555), UK AISI Frontier AI Capability Report, and when trust is the exploit.

#9

April 27, 2026

Three Layers, Three Attack Surfaces, One Agent

The Cloud Security Alliance and OX Security jointly disclosed an architectural vulnerability in MCP’s STDIO transport — the most common transport used by local MCP servers across the open-source agent ecosystem. Plus: Curator’s Corner on why most security teams are securing one layer while the agent already touches three.

#8

April 20, 2026

Every Consultancy Is a Honey Pot Now

Researcher Aonan Guan published the first cross-vendor demonstration of a prompt-injection pattern that turns GitHub itself into the command-and-control channel for stealing runner credentials out of AI coding agents.

#7

April 13, 2026

Ninety Days to Patch the World

Anthropic announced Claude Mythos Preview alongside Project Glasswing — the most consequential AI security development of 2026. Plus: Grafana AI exfiltration, $100M open-source security commitment, Cisco acquiring Astrix, and the new OWASP Agentic Top 10.

#6

April 6, 2026

Instructions Are Not Guardrails

Anthropic accidentally leaked Claude Code’s entire source code to npm — 512,000 lines including an autonomous daemon called KAIROS. North Korea compromised Axios npm via AI-assisted social engineering. Plus: Microsoft open-sources Agent Governance Toolkit.

#5

March 30, 2026

From Zero Day to Zero Second

Over ten days in March, threat actor TeamPCP executed the most ambitious AI supply chain campaign in history — hitting Trivy, KICS, LiteLLM, and Telnyx across five ecosystems. Plus: RSA’s agent era and Amazon Project Metis.

#4

March 23, 2026

AI Sandboxes Are Broken — Two Platform Escapes in One Week

Two major AI platform sandbox escapes dropped in one week, on the eve of RSA Conference 2026. Plus: Microsoft launches Agentic AI Security, OpenAI acquires Astral, and a critical Langflow RCE exploited within hours.

#3

March 16, 2026

An AI Agent Hacked McKinsey’s AI Chatbot in Under 2 Hours

An autonomous AI agent breached McKinsey’s AI platform Lilli via SQL injection — exposing 46.5M messages and 95 writable system prompts. Plus: Chrome Gemini hijack, SGLang RCE, and OpenAI buys Promptfoo.

#2

March 8, 2026

900K Users, Fake AI Extensions, and Why Agent Memory Needs Zero Trust

Fake AI assistant browser extensions hit 900K installs across 20K+ enterprise tenants — some agentic browsers auto-installed them. Plus: CVSS 9.8 agent framework RCE and three M&A moves pre-RSA.

#1

March 1, 2026

AI Jailbreak Hits National Infrastructure + $1.6B in AI Security M&A

A hacker jailbroke Claude to attack Mexico’s federal government. Plus: a self-propagating worm in MCP servers, NIST’s agent standards initiative, and why traditional posture management isn’t enough for agentic AI.

All Episodes

Signal Long-form Investigations

A Podcast Humans Can Hear and Agents Can Read

About the Show