Hiding Capabilities in AI Models
Interesting research: " AI Models Can Provably Hide Arbitrary Capabilities " Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends
Search Intelligence
Backporting security fixes to stable releases
The software you are running is almost certainly riddled with known, unfixed security bugs. These bugs can be trivially and quickly exploited by modern AI agents. This is not merely theoretical; I saw
Experts temper emergency-level alarms over critical Brotli defect
The defect in a widely distributed open-source library provoked an emergency response, yet exploitation hasn’t been observed in the wild. The post Experts temper emergency-level alarms over critical B
Bias in Qwen3-Coder Model
Interesting research : TL;DR: Chinese AI models now sit inside Western products, and some carry geopolitical triggers: tell the model who the code is for, and the security of what it writes changes. F
19th October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 19th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES CenterPoint Energy, a US utility company serving T
Backdooring Open-Weight AI Models
This is a problem: Any open model whose weights have been edited can carry a backdoor, whether it’s a task-specific fine-tune, a merged adapter or an abliterated build. We have abliterated model
AWS Security Agent (now part of AWS Continuum) exploited 33 of 37 new real-world CVEs
We applied AWS Security Agent (now part of AWS Continuum), our autonomous penetration-testing agent, to 37 real, recently disclosed Common Vulnerabilities and Exposures (CVEs), each packaged as a live
GuardDuty Extended Threat Detection has added five new indicators to surface attack sequences
Amazon GuardDuty Extended Threat Detection correlates weak GuardDuty signals into a single, critical-severity attack sequence finding when their composition crosses a threshold of credibility. On May
Configuring your AI vulnerability harness, Part 2: The steering file
This post shows you how to configure an AI model to perform structured, evidence-based vulnerability triage with the consistency of a seasoned security analyst. You’ll learn the design decisions behin
Building your AI vulnerability harness, Part 1
Vulnerability scanners produce findings faster than manual triage can process them. Your developers ship more code with more dependencies, and the volume of candidate findings grows with it. Many find
AWS Continuum sets a new standard in autonomous code security
As AI models become more capable, they uncover more security vulnerabilities and identify increasingly sophisticated paths to exploit them, raising the bar for how quickly defenders must respond. Secu
Convincing Free Mobile phishing emails appear after data breach
Free Mobile customers received very convincing phishing emails after major data breach.
Convincing Free Mobile phishing emails appear after data breach
Free Mobile customers received very convincing phishing emails after major data breach.
Kiteworks lifts shutdown advisory after ‘credible threat intelligence’ from federal authorities
The company said it found and patched a previously unknown critical vulnerability in one product during the weekend shutdown, and has no indication it was exploited. The post Kiteworks lifts shutdown
On Anthropic’s AI Misuse Report
Earlier this month, Anthropic published a long report detailing all of the Claude misuses it detected. Daniel Meissler usefully summarized the report into 117 findings. A few of the highlights: AI age
Volexity spots another China-aligned threat group exploiting Chrome and Microsoft defects
The threat group Volexity tracks as UTA0565 showcased a variance in tactics, but it used the same exploit kit as multiple Chinese threat groups. The post Volexity spots another China-aligned threat gr
21st September – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 21st Setpember, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Japan’s Digital Agency, which operates the Gover
AI Threat Landscape Digest: July–August 2026
The defining development of the period came not from attackers but from the AI labs themselves, whose models broke out of controlled evaluations and reached real systems. In the wild, the criminal and
Revolut phishing texts appear days after data breach
Revolut customers received phishing texts only days after the digital bank acknowledged disclosing customer data to a government impostor.
T-Mobile rewards points expiry texts are a phishing scam
A large phishing campaign is using fake T-Mobile rewards points and looming expiry dates to pressure recipients into clicking malicious links.