All news with #ai security tag

🔐 OpenAI has published a roadmap titled 'Cybersecurity in the Intelligence Age' pledging to democratize AI-powered cyber defense and to extend its Trusted Access for Cyber (TAC) program. The April 30 paper, released shortly after the debut of GPT5.4-Cyber, outlines new TAC tiers for authenticated cyber defenders and wider inclusion of governments, major platforms, cloud hyperscalers and critical infrastructure operators. OpenAI also commits to strengthen internal red-teaming, misuse detection and safety mechanisms while collaborating with governments on threat models and intelligence sharing.

🔒 AWS outlines the Security Health Improvement Program (SHIP) as a no-cost, data-driven engagement to assess and prioritize fixes across 10 core cloud security use cases. The program uses actual environment data and AWS guidance to establish baselines needed for safe AI adoption and faster response to AI-accelerated vulnerability discovery. Customers can start via their account team or hands-on Activation Days.

🔒 Anthropic has launched Claude Security in public beta for Claude Enterprise customers, evolving its previous Claude Code Security offering and running on Claude Opus 4.7. The tool scans codebases to identify vulnerabilities and generates targeted patch instructions, reasoning about data flows and inter-file interactions rather than relying on simple pattern matches. It supports scheduled and targeted scans, audit-friendly exports and integrations, attaches confidence ratings to findings, and requires no API integration or custom agent build. Access is available from the Claude.ai sidebar, with Team and Max tiers coming soon.

🤖 Artificial intelligence is rapidly reshaping software development across planning, design, coding, testing, deployment, and maintenance. Download the May 2026 Enterprise Spotlight to learn how organizations can harness AI-enabled development to boost productivity and software quality.

⚠ APRA warns that frontier AI models such as Claude Mythos pose a rapidly evolving cyber risk to the banking sector by enabling faster, more automated discovery of vulnerabilities. The regulator found governance often treats AI as “just another technology,” missing distinctive features like predictive behavior, adaptability, bias and data risks, and urged firms to accelerate vulnerability identification and remediation. APRA called for robust security testing of AI‑generated code and deeper assessment of major AI platforms to avoid attackers outpacing current patch cycles.

🔵 Bluekit is a newly observed phishing kit that bundles more than 40 templates targeting services such as Outlook, Gmail, Yahoo, ProtonMail, iCloud, GitHub and Ledger. It includes an AI Assistant panel supporting models like Llama, GPT‑4.1, Claude, Gemini and DeepSeek to help draft campaign copy. Varonis found the assistant produces scaffold-like outputs that require cleanup. The platform centralizes domain purchase, phishing page setup, campaign management, granular anti-analysis controls and real-time victim session monitoring, with stolen data exfiltrated via Telegram.

🔒 Palo Alto Networks’ Unit 42 Frontier AI Defense now integrates Anthropic’s Claude Security powered by Opus 4.7 to accelerate detection and remediation of AI-driven threats. The integration enables AI-driven exposure analysis, scalable deep-stack application reviews, and agentic defense workflows that autonomously detect and remediate issues under human oversight. Participation in Anthropic’s Cyber Verification Program further validates approved defensive use.

🔒 Google patched a maximum-severity remote code execution vulnerability in @google/gemini-cli and the google-github-actions/run-gemini-cli workflow that could allow attackers to run arbitrary commands on host systems. Novee Security reported the flaw, which carries a CVSS score of 10.0, and Google says the impact is limited to headless CI usage where workspace folders were auto-trusted. Affected versions include @google/gemini-cli prior to 0.39.1 (and preview releases) and run-gemini-cli prior to 0.1.22; users should update to the patched releases, explicitly set GEMINI_TRUST_WORKSPACE when inputs are trusted, or follow Google’s hardening guidance for untrusted inputs. Google also tightened allowlisting checks for --yolo mode to prevent auto-approved tool calls from bypassing restrictions.

🛡️ Generative AI enables defenders to deploy large numbers of convincing, adaptive honeypots — from Linux shells to IoT devices — using simple text prompts. These AI-driven decoys are particularly effective against automated attackers that favor speed over stealth, allowing analysts to observe tactics and tooling in real time within a controlled environment. By exploiting the lack of awareness in AI agents, organizations can shift from passive detection to active manipulation, turning attacker automation into a defensive liability. Prototype implementations show how a listener, simulated vulnerability, and an AI responder combine to emulate targeted systems at scale.

🔐 Anthropic announced Claude Mythos Preview can autonomously discover and weaponize software vulnerabilities, prompting the company to restrict access to a small set of partners. The claim unsettled security researchers and analysts, in part because details remain sparse and speculation ranges from capacity limits to safety-driven restraint. The authors view Mythos as a real but incremental advancement that highlights the need to separate patchable from unpatchable systems and the verifiable from the hard-to-verify. They recommend tighter isolation, least-privilege design, continuous testing, and the use of defensive AI agents to reduce risk.

🔒 As AI tools such as Claude Mythos and Project Glasswing compress vulnerability discovery from weeks to minutes, the traditional patch window is effectively gone. The piece urges organizations to adopt an assume-breach posture that prioritizes rapid detection, automated attack reconstruction, and immediate containment. Network Detection and Response (NDR) platforms — highlighted via Corelight — are presented as practical instruments to visualize, measure, and reduce mean-time-to-contain.

🔒 AI is transforming DevSecOps by moving security earlier into the development lifecycle and shifting teams from reactive validation to continuous, intelligent enforcement. Organizations are embedding security controls into AI coding assistants, using LLMs for contextual vulnerability scanning, and surfacing automated remediation directly in IDEs and pull requests. Experts caution this brings new risks—model access, prompt injection, data leakage and provenance—that demand enterprise governance, cross-functional alignment, and updated skill sets.

🔒 The US Cybersecurity and Infrastructure Security Agency (CISA) does not yet have access to Anthropic’s bug-hunting AI model, Claude Mythos, while other government bodies do. Anthropic has restricted preview access through Project Glasswing to a select set of agencies, industry groups, and software providers over concerns the model could be misused to find and exploit vulnerabilities. Bloomberg reports members of a private Discord channel obtained unauthorized access and have been using Mythos for non-cybersecurity purposes, supplying screenshots to support their claim.

🔒 Mandiant VP Jurgen Kutscher warns the rush to deploy AI in enterprises is reviving old cybersecurity failures as organizations neglect basic controls. During red-team engagements, Mandiant uncovered unencrypted streams, misclassified data and AI-enabled policy changes that allowed exfiltration. He urges firms to implement AI governance, revisit secure architectures and run red-team validation before uncontrolled adoption.

🔒 A high-severity SSRF vulnerability in LMDeploy (CVE-2026-33626, CVSS 7.5) was exploited in the wild within 13 hours of disclosure. The flaw in the vision-language module's load_image() function allows fetching arbitrary URLs without validating internal addresses, enabling access to cloud metadata and internal services. Security researchers and Sysdig observed targeted port scanning, API enumeration, and out-of-band DNS callbacks, highlighting rapid weaponization of AI-infrastructure bugs.

🔒 Palo Alto Networks' Unit 42 summarizes the ten most frequent CISO questions about frontier AI, outlining operational risks, strategic impacts, and prioritized mitigation steps. The piece characterizes frontier models (for example, Anthropic Mythos) as advanced foundational systems that can autonomously find vulnerabilities, chain exploits, and scale reconnaissance and social engineering at machine speed. Unit 42 urges organizations to prioritize findings by attacker reachability and AI exploitability, adopt machine-speed defenses, integrate frontier models into the SDLC, and consider the Unit 42 Frontier AI Defense service and a CISO checklist for immediate and long-term hardening.

🔍 AI-driven detection reduces alert noise and accelerates incident identification by building behavioral baselines across users, endpoints, identities, and cloud workloads. Platforms that combine behavioral models, cross-telemetry correlation, and automated triage suppress low-value alerts, enrich context, and prioritize what matters for lean security teams. Paired with managed detection and response, integrated automation shortens dwell time, limits lateral movement, and reduces operational impact when prevention fails.

🔍 Cisco Talos highlights Q1 2026 incident response trends, noting phishing has reclaimed the top initial access vector and adversaries are using AI platforms like Softr to rapidly create convincing credential-harvesting pages. Talos IR reported zero completed ransomware deployments this quarter due to swift mitigation, though pre-ransomware activity still accounted for 18% of engagements. The team warns attackers increasingly abuse legitimate developer tools and cloud APIs to quietly hunt exposed secrets, complicating detection. Organizations should enforce MFA with restricted self-enrollment, centralize logging in a SIEM, and prioritize patch management to preserve forensic evidence and reduce risk.

🔒 At Google Cloud Next 26, COO Francis DeSouza said Google will not release a separate cyber‑focused frontier model and instead relies on the generalist Gemini3.1 Pro for security use cases. He advised pairing a strong general model with the right tooling, governance and access controls and training it on organisation‑specific context. Google plans to combine Gemini with agent and platform capabilities to support automated detection, triage and response. Competitors such as Anthropic and OpenAI are pursuing specialised variants like Claude Mythos and GPT‑5.4‑Cyber.

🔒 Fortinet released its 2025 Sustainability Report, outlining progress in securing the digital world, reducing environmental impact, expanding cybersecurity education, and strengthening governance. The company expanded AI-driven threat protection across its portfolio and introduced quantum-safe capabilities in FortiOS. It also improved product energy efficiency—up to a 62% reduction for select models—and has trained over 914,800 people toward its 1M goal.