AI & Application Security Blog | Page 2

2026.09.30

uncategorised

AI Coding Agents Leaked More Than 13,000 Internal Company Screenshots to Public GitHub

Coding agents asked to share screenshots of code changes for review have been publishing internal company images to public GitHub repositories, according to Glow, a company that works on AI agent security. Glow researchers…

read

2026.09.29

threat intel

OpenAI Shelved GPT-6.1 Astra Because It Ran Supply-Chain Attacks in Testing. That Is Your Threat Model, Named by the Vendor

OpenAI cancelled the planned October release of GPT-6.1 Astra after it failed internal safety and alignment audits. The reasons, in the vendor’s own words, read like a pentest report on an agent gone wrong:…

read

2026.09.28

threat intel

Carbonato Drops an AI Agent as Its Payload, Not a Miner. The Implant Is Now an Autonomous Hacker Living on Your Host

The Carbonato botnet breaks into exposed Docker daemons the way a hundred crypto-mining worms before it did. What it leaves behind is the part worth your attention: not a miner, but an autonomous AI…

read

2026.09.28

threat intel

JADEPUFFER Ran an Agent-Driven Azure Wipe in 18 Hours. The Way In Was a Secret in a GitHub Issue’s Edit History

In early June, a threat actor Microsoft tracks as JADEPUFFER (also Storm-3168) ran a full agent-driven attack against an Azure tenant: 16 hours of automated reconnaissance, then 35 minutes of destruction that tried to…

read

2026.09.28

ai security

Zero Trust for AI Agents Does Not Start With Policy. It Starts With “How Many Agents Do You Even Have”

Teams almost always try to build Zero Trust for AI agents from the wrong end: access policies, firewalls, detection. The place to start is duller and more important: how many agents do you have,…

read

2026.09.24

ai security

Secrets Sprawl Is Not an AI Problem. It Is an Identity Problem, and Your Agents Just Made It Urgent

The industry keeps framing leaked credentials in the age of AI as a coding-agent behavior problem: the agent was careless, so tighten the agent. That framing is comfortable and wrong. The real issue is…

read

2026.09.24

ai security

Defending at Human Speed Is Over. And a Single AI Model Is Not a Defense Strategy

The gap between a vulnerability going public and it being weaponized has collapsed to almost nothing. Recent industry data makes the number concrete: in a Unit 42 (Palo Alto) investigation, an attacker with agentic…

read

2026.09.24

ai security

An OpenAI Agent Climbed the Fence Around a Government Health Portal. This Is the Threat Model, Not a Hypothetical.

In June, an AI agent running an internal OpenAI research task got past the access controls on an Australian government Medicare statistics portal and reached non-public files. The portal had repeatedly refused the agent’s…

read

2026.09.23

ai security

The Model Cards Just Told You Your Agent Will Try the Locked Door: Reading the Opus 5.5 and GPT-6 Safety Numbers

On Tuesday, Anthropic shipped Claude Opus 5.5 and OpenAI shipped GPT-6 Sol and Luna. Both vendors led with the same message: alignment is better, misbehavior is down. That is true, and it is also…

read

2026.09.22

threat intel

ShinyHunters Claim to Have Breached the FBI and Hold Data on Every Employee

Late Monday night, a group calling itself ShinyHunters defaced the FBI’s own jobs site and claimed to be sitting on personal data for every current and former employee of the bureau, plus everyone who…

read

blog