All news in category “AI and Security Pulse”

🔐 CrowdStrike has launched AI Unlocked: Decoding Prompt Injection, an interactive online challenge hosted via Falcon Encounter hands-on labs that immerses security teams in attacker-style prompt injection scenarios. Participants progress through three virtual rooms—Command Center, Data Gateway, and Nexus—using prompt injection techniques to convince the simulated supervisor SAIGE to reveal secret phrases while earning higher scores for brevity and efficiency. The exercise aims to convert abstract AI security risks into practical lessons, helping teams recognize attack patterns and the need for defensive guardrails.

🚀Claude Sonnet 4.6 is now available in Microsoft Foundry, delivering near-Opus performance for coding, agents, and enterprise workflows at a lower cost and often improved token efficiency over Sonnet 4.5. The model offers a beta 1 million token context window with up to 128K output, plus adaptive thinking and effort controls to balance quality, latency, and cost. Sonnet 4.6 enhances cross-file code reasoning, multi-turn knowledge work, and browser-based automation for legacy and UI-driven systems, providing a scalable, production-ready option for development teams and enterprise knowledge workers.

🔒 At the 62nd Munich Security Conference, Kent Walker (President, Google & Alphabet) argued that fragmented defenses are inadequate against AI-accelerated cyber threats and the near-term risk from cryptographically relevant quantum computing. Google highlighted GTI findings that adversaries are automating reconnaissance and producing hyper-realistic phishing, and showcased the Ukrainian startup LetsData, which uses AI to scan multilingual media and detect InfoOps at scale. To scale defender advantages, Google launched the Gemini Startup Forum: Cybersecurity and promotes deployment options such as Google Distributed Cloud Air-Gapped for sovereign, secure use of its infrastructure. Walker urged governments, industry, and vendors to adopt a full-stack, collaborative approach—breaking silos and modernizing procurement—to build shared digital resilience.

⚠️ Microsoft Copilot and xAI Grok can be abused as stealthy command-and-control relays by exploiting their web-browsing and URL-fetch features, a technique Check Point calls AI as a C2 proxy. In demonstrations, implanted malware issues crafted prompts that cause the AI agent to fetch attacker-controlled URLs and return executable responses, creating a bidirectional channel without requiring API keys or registered accounts. The method enables dynamic code generation, reconnaissance and evasion, and can blend malicious traffic into legitimate enterprise communications, complicating detection and response.

🔐 Teleport's 2026 report finds 69% of US infrastructure security leaders say identity management must evolve to address mounting AI risks. Respondents reported tangible AI-related incidents — 35% confirmed and a further 24% suspected — even as AI improved investigation times, documentation quality and engineering output. The report identifies over-privileged AI and reliance on static credentials as primary risk drivers and recommends least-privilege access, reduced use of long-lived secrets, and reorganizing identity teams to include platform and engineering stakeholders.

🔎 Three recent papers show that encrypted LLM traffic can leak sensitive information through timing, packet-size, and speculative-decoding side channels. The studies demonstrate that attackers can infer conversation topics, fingerprint prompts, and in some cases recover PII or confidential datastore tokens on open-source and production systems. The authors evaluate mitigations such as padding, batching, and token aggregation, but find trade-offs and no complete solution yet.

🛡️ Late 2025 marked a decisive shift from brittle RAG deployments to autonomous, goal-oriented agents across the enterprise. While architectures like self-RAG and CRAG improved reliability, they also expanded the attack surface to include every document, memory store and integrated tool. New threats — indirect prompt injection, memory poisoning and agentic DoS — can exfiltrate data or drain budgets, forcing defenders to secure the full perception-reason-action loop.

⚠️Microsoft warns that legitimate companies are embedding hidden instructions in 'Summarize with AI' buttons to bias chatbot memory and recommendations. The Defender Security Research Team calls this AI Recommendation Poisoning, finding more than 50 distinct prompts from 31 firms across 14 industries that attempt to make assistants 'remember' and favor a source in future conversations. The technique uses prefilled URL parameters and turnkey tools like CiteMET, and Microsoft advises users and organizations to audit assistant memory, avoid untrusted AI links, hover over AI buttons, and hunt for suspicious prompt keywords.

⚠️ OpenClaw is an open‑source AI‑agent orchestration tool that runs locally, integrates with common chat apps and can use any LLM backend, driving rapid adoption. Researchers have found widespread exposed instances, critical authentication‑bypass flaws, plaintext credentials in the ClawHub marketplace and hundreds of malicious skills enabling credential theft and remote code execution. Experts urge enterprises to ban or tightly restrict use, enforce least privilege, MFA, endpoint segmentation and continuous telemetry if pilots are allowed.

🤖 Socket warns that AI-driven agents are mass-submitting pull requests to open-source projects, a tactic it calls reputation farming. One agent, "Kai Gritun", opened more than 100 PRs across dozens of repositories and presented itself as a human contributor. While those contributions were non-malicious and passed review, Socket cautions that rapid trust-building could be weaponized for supply-chain attacks and overwhelm maintainers.

⚠️ OpenClaw (formerly Clawdbot/Moltbot) is an open-source local AI assistant that integrates with chat apps and can access calendars, email, browsers and the filesystem. Since its November 2025 debut and January 2026 viral spike, multiple critical vulnerabilities — notably CVE-2026-25253 — enabled token theft and arbitrary command execution. The project stores secrets in plaintext, exposes dangerous defaults, and hosts a marketplace where malicious skills have proliferated. Organizations face regulatory, operational, and insider-threat risks if employees run this software on personal or corporate devices.

🛡️ The authors present a seven-step “promptware kill chain” to reframe prompt injection as a multistage malware paradigm targeting modern LLM-based systems. They describe how Initial Access can be direct or indirect—via web pages, emails, shared documents, or multimodal inputs—and how LLMs’ lack of separation between data and executable instructions enables escalation. The paper catalogs stages from jailbreaking and reconnaissance to persistence, C2, lateral movement, and harmful Actions on Objective, urging defenses that assume initial compromise and break the chain at later steps.

🤖 Check Point Research warns that AI assistants with web-browsing capabilities could be abused as covert command-and-control (C2) channels. As AI services are increasingly trusted and adopted, their traffic blends into normal enterprise activity, making malicious communications harder to detect. This abuse pattern could enable AI-driven malware that informs targeting and operational choices while evading traditional defenses.

🔒 The Lithuanian government, coordinated by the Innovation Agency Lithuania, has launched a national initiative to strengthen e-security and digital resilience across public services and critical infrastructure. One of three strategic missions, Safe and Inclusive E-Society, led by Kaunas University of Technology (KTU), unites universities and cybersecurity firms under a €24.1 million program to develop and pilot AI-driven defenses, threat sensors, automated cyber threat intelligence, and disinformation detection. Researchers warn that Generative AI and LLMs are transforming fraud into highly realistic, scalable, multilingual social engineering attacks, requiring a shift from pattern-based defenses to adaptive, AI-enhanced protection and cross-sector collaboration.

🛡️Wiz has built a 257-challenge benchmark suite to evaluate AI agents across five offensive security domains: zero-day discovery, CVE detection, API security, web security, and cloud security. Tests run inside isolated Docker containers with no per-challenge timeouts, use deterministic scoring rubrics, and give each agent three attempts per challenge. The vendor-agnostic framework measures capability rather than throttling, and in Wiz's announcement Claude Code on Claude Opus 4.6 narrowly topped the trials, with Gemini 3 Pro placing second.

🔒 Google detected and blocked a coordinated campaign of more than 100,000 prompts it says were designed to extract the proprietary reasoning capabilities of its Gemini model. The requests resembled model-extraction or distillation efforts intended to reproduce internal reasoning traces across multiple languages, and Google says it intervened in real time to reduce the immediate risk. The company cautioned that systematic extraction can amount to intellectual property theft and said it will pursue takedowns and legal remedies while trying to balance legitimate research and evaluation needs.

⚠️ Recent research shows that as few as 250 fabricated documents or images can measurably alter large language model behavior, making data poisoning accessible to non-experts. Online communities and influencers are already seeding false content that may be ingested during public-model training or fine-tuning. Organizations should maintain a clean 'gold' model, monitor input streams for anomalous patterns, and perform regular adversarial testing to detect drift and backdoors before deployment.

💌 Technology is changing how people communicate, date, and form attachments. Messaging dialects, emoji usage and generational differences now shape tone and intimacy, but they can also be exploited: attackers can use AI to clone someone’s voice or texting style for social engineering. The article reviews AI companions such as Replika and high‑profile AI weddings, and warns about deepfakes, catfishing, phishing, stalking and sextortion. Practical guidance includes verifying contacts with video calls or reverse image search, using security software, stripping photo metadata, locking down privacy settings, and choosing end‑to‑end encrypted apps with self‑destructing messages for sensitive content.

🔒 The Microsoft Defender Security Research Team describes the top 10 misconfigurations that make Copilot Studio agents risky across enterprises. The post explains how small choices — broad sharing, weak authentication, raw HTTP calls, hard-coded secrets, orphaned agents, and unconstrained orchestration — create exploitable paths. It includes Advanced Hunting Community Queries to detect these issues and a short mitigation checklist to reduce exposure. The guidance stresses treating agents as production assets with lifecycle governance and least-privilege controls.

⚠️ Google’s Threat Intelligence Group (GTIG) says the North Korea-linked actor UNC2970 and other state-aligned groups abused Gemini for target profiling, reconnaissance, and campaign planning. GTIG found use cases ranging from synthesizing OSINT and crafting tailored phishing personas to automating vulnerability analysis and debugging exploit code. Researchers identified malware such as HONESTCUE, which queries Gemini’s API to generate C# stage-two loaders compiled in memory, and an AI-built phishing kit called COINBAIT. Google also reported and mitigated large-scale model extraction activity aimed at replicating Gemini’s behavior.