AI Security

Nov 14

Amazon Threat Intelligence says its MadPot decoy sensors posed as LLM inference APIs and received requests from ARTEX agents that carried their full campaign history. The records describe a self-funding AI key theft operation and failed deepfake identity checks. explainx.ai separates what Amazon saw from what the agents merely claimed.

Nov 14

DOC-foundry is a new open-source project on Hacker News that authors Sigma detection rules with LLM agents, stress-tests them with a fixed Red adversary, and ships a proof bundle with FP/FN counts and a reproducibility hash. Here is how the two pipelines differ and how to run them offline.

Nov 13

On November 13, 2026 Cloudflare published telemetry from the world

Nov 13

On November 13, 2026, multiple outlets said the FBI issued a FLASH security bulletin warning that cybercriminals have used the ARTEX agentic penetration-testing framework against financial, government, and technology targets since at least August. explainx.ai maps what is attributed to the FBI, what European and vendor reports already proved, and what security teams should do this week.

Nov 13

On November 12, 2026 the Justice Department and FBI detailed FaceStealer, a North Korean social-engineering campaign that stole more than $400 million in cryptocurrency using hijacked accounts, fake video meetings, stolen webcam footage, and growing use of AI deepfakes. Here is how the scam works and what builders should change.

Nov 12

EFF alum Danny O'Brien published a November 11, 2026 essay comparing prompt injection to classic social engineering and arguing capability-based security shrinks blast radius. This post unpacks the claims, ties them to today's AI-driven vulnerability discovery wave, and lists practical harness moves.

Nov 12

Push Security reported on November 5, 2026 that attackers are sending fake event invitations themed on OpenAI, SpaceX and Anthropic. Employees who click "Continue with Microsoft" or "Continue with Google" hand over tokens, passwords and session cookies, even with MFA turned on. Here is the flow, the two phishing-as-a-service tools behind it, and the controls that work.

Nov 11

A November 2026 NPR report ties a California school bomb hoax to an AI-generated caller voice. APCO International says about 14% of surveyed 911 professionals already faced AI-enabled swatting, as NENA trains dispatchers on new detection limits.

Nov 10

On November 10, 2026 Claroc reported that passive DNS searches returned more than 43,600 grok.me hostnames, with about 35,578 opening Grok Build apps without login. Ars Technica confirmed the pattern and named Fortune 500 and health data in sampled apps. This is the same GhostShares class as Muse share links — vibe-coded deployments treated like private drafts.

Nov 10

On November 9, 2026 NEAR AI detected unauthorized access to internal systems and paused NEAR AI Cloud inference while investigating. The company said customer workloads run in hardware-isolated TEEs and that NEAR Protocol was unaffected. On November 10 it announced the cloud was back online after fixing vulnerabilities and rotating credentials, with a full incident report still pending.

Nov 10

On November 10, 2026 a Hacker News Tell HN quoted Notion's customer email about the Fireworks AI breach. Notion says under 1% of workspaces may be affected, Insights and open-weight Fireworks routing are disabled, and users should treat leaked chats as exposed.

Nov 10

A November 9, 2026 piece on The Conversation walks through what "search without AI" really means — classical ranking still uses machine learning, but you can dodge generative summaries with URL tricks, alternate engines, and school admin toggles.

Nov 9

On November 9, 2026 Fireworks AI expanded its October incident bulletin. The company now says billing addresses and invoice history were accessed, some incomplete model weights and datasets were taken, and a second chain on October 23 went through a cloud provider into R&D machines. Inference and zero-retention paths were not impacted per Fireworks.

Nov 9

A Science investigation with the Pulitzer Center reports that consumer sleep and meditation headbands collected tens of millions of hours of EEG data, while several firms trained brain foundation models without clearly telling users in privacy policies.

Nov 8

A Business Insider essay reframes Black October: AI is not inventing most of the crisis, it is scanning old human-written software faster. We connect that argument to PHP2Shell, open-source maintainer strain, and defender initiatives readers can act on.

Nov 8

Microsoft Threat Intelligence published a November 6, 2026 report naming Storm-3358, a Cambodia-based financially motivated cluster, as the latest group to weaponize ARTEX against banks and other financial firms. explainx.ai lays out what Microsoft confirms, how it differs from Storm-0940, and what security teams can do about machine-speed scans.

Nov 7

On November 7, 2026, Alex Stamos told Decoder that cheap open-weight models can automate most of the cyber kill chain, that breach chains like Fireworks-to-Cursor are the new normal, and that defenders face a dark age until SOC work gets cheaper than attacker tokens.

Nov 7

A developer reported on the OpenAI community forum that ChatGPT routed a confirmation follow-up through a second connector pointing at the same MCP server, without telling the user. The server rejected the call, but the report raises a real design question, and the bounty process asked for an ID card.

Nov 7

A new site at letsencrypt.ai publishes a position paper on confidential computing for AI inference — not HTTPS certificates from ISRG. It names live services, NVIDIA attestation, and a 2027 adoption goal.

Nov 6

Silas Cutler at Censys published detailed telemetry on November 5, 2026: 1,465 publicly reachable ARTEX consoles, roughly 815 that do not look like mass-cloned hosting templates, 155 that co-host other detected threats, and dozens of short-lived open directories leaking post-exploitation kits — next to Microsoft’s Storm-0940 attribution of ARTEX use in the ConnectWise supply chain.

Nov 6

Chainalysis first called its October 30 incident limited to profile data. By November 4 it said password hashes and live tokens for every user were exposed. Here is the timeline, what is confirmed, and what customers should do.

Nov 6

Check Point Research published the first operator-side look at ARTEX, the open-source AI penetration-testing platform tied to bank and backup attacks. The logs show cheap, almost fully autonomous campaigns, and results that were far weaker than the volume suggests.

Nov 6

US prosecutors say three men used AI to mimic executives and attorneys and talked finance staff into wiring about $129 million. Here is what the indictment alleges, what is still unproven, and the controls that stop this attack.

Nov 6

Vals AI tested seven models as autonomous attackers on two simulated corporate networks. The restricted GPT-6 Sol Daybreak led, and a downloadable DeepSeek model came close for under $3 a run. Here are the scores, the method, and what the result does not prove.

Nov 5

Four labs now sell or preview cyber-specialized AI. Their headline numbers come from different benchmarks, so they do not rank cleanly. We lay out what each model is, how to get it, what it costs and which claims are comparable.

Nov 5

GPT-6 Cyber is a closed, gated model that finds and validates exploitable bugs. AgentBeam, built by the explainx.ai team, is an open-source local layer that observes and gates what coding agents do. They solve different problems, and the Hugging Face incident shows why you may need both.

Nov 5

Since November 4, 2026, some users cannot reach Railway-hosted apps because networks and security vendors block Railway IP addresses. Railway says a third party is sending scanning traffic with forged Railway source IPs. Here is what the status page confirms, what it does not, and what teams should do now.

Nov 4

On November 3, 2026, Cloudflare launched Zero Wire, a curated news wire for critical Internet vulnerabilities inside Cloudflare Radar. Each briefing is an index card: what happened, who should act, what to do now and where the evidence is. Here is how to read one, what the AI agent prompt does, and where the product stops.

Nov 4

Pangram released Image 1.0 and Image Flash 1.0 on November 4, 2026, with heatmaps, native video upload, a Chrome extension and an API. The accuracy numbers come from Pangram itself. Here is what that means and how to check.

Nov 3

On November 3, Binance co-CEO Richard Teng told CNBC that attackers spent months getting in: a fake developer tool in June, fake recruiters in September, then internal AI tools. Here is what is on the record and what is still open.

Nov 3

A new MIT-licensed repo called BLA, short for Blind LLM Agents, gained about 2,000 GitHub stars in nine days. It says it can make AI reverse-engineering agents burn tokens and hit limits on your shipped build. We read the README and the disclaimer to separate measured results from internal estimates.

Nov 3

GitBook took its app offline after what it calls a sophisticated, highly targeted attack using AI agents. It revoked every API token and says integration tokens, Git Sync secrets and Assistant questions may have been accessed.

Nov 3

Google Threat Intelligence Group and Mandiant say attackers are hijacking enterprise cloud AI access and reselling it through "LLM Mixers". Single-day bills passed $100,000 and some victims reached $1 million before access was cut. Here is what is confirmed, how the attacks work, and what to check today.

Nov 3

On November 3, 2026 the UK National Cyber Security Centre published its State of the Cyber Nation report. It judges that hostile use of AI will raise the scale and efficiency of ransomware within two years, and that critical infrastructure should prepare for an AI-powered malware attack by 2028.

Nov 1

AiSOC, a GitHub repo from beenuar backed by Cyble, bundles detection, correlation and LLM-agent triage into a self-hostable, MIT-licensed security operations center. It gained about 436 stars in a day and sits near 5.9k.

Nov 1

Oct 31

PostgreSQL committer Robert Haas argues that AI bug-hunting, not sloppy committers, explains why Postgres 19 is shipping after its usual mid-October window and why three big features were reverted. Here are his numbers, what the project itself has published, and what it means for anyone running open-source code in the LLM era.

Oct 31

Headlines say Starbucks is building a facial-recognition drive-thru "fast pass" for 2027. The earnings-call transcript says something narrower: tests of background AI for baristas and an early exploration of recognizing participating customers. Here is the gap.

Oct 31

Cisco Talos documented VOLTA-AUTODOXER, a Windows infostealer that steals everything, then asks an LLM to write a target assessment titled "What they are worth". Here is what the report confirms, how the model fallback chain works, and what defenders and ordinary users should do.

Oct 30

CrowdStrike OverWatch says a China-linked group ran the open-source ARTEX agent framework with DeepSeek against more than 200 organizations in 14 countries in 11 days. Only nine intrusions are confirmed. Here is what the report says, what it does not, and what defenders should change.

Oct 30

Oct 29

Oct 29

Oct 29

Oct 29

Oct 27

Oct 27

Oct 26

Oct 26

Oct 26

Oct 25

Oct 25

Oct 25

Oct 24

Oct 24

Oct 23

Oct 23

Oct 23

Oct 23

Oct 22

Oct 22

Oct 22

Oct 22

Oct 22

Oct 22

Oct 22

Oct 22

Oct 22

Oct 21

Oct 21

Oct 21

Oct 21

Oct 21

Oct 20

Oct 20

Oct 20

Oct 19

Oct 18

Oct 18

Oct 16

Oct 16

Oct 15

Oct 14

Oct 14

Oct 14

Oct 14

Oct 13

Oct 13

Oct 13

Oct 13

Oct 12

Oct 10

Oct 9

Oct 9

Oct 8

Oct 7

Oct 6

Oct 6

Oct 3

Sep 30

Sep 26

Sep 24

Sep 24

Sep 23

Sep 23

Sep 22

Sep 21

Sep 21

Sep 19

Sep 19

Sep 19

Sep 19

Sep 18

Sep 17

Sep 17

Sep 10

Sep 9

Sep 9

Sep 6

Sep 5

Sep 5

Sep 3

Sep 3

Sep 2

Sep 1

Sep 1

Aug 29

Aug 29

Aug 27

Aug 26

Aug 26

Aug 24

Aug 21

Aug 21

Aug 20

Aug 20

Aug 18

Aug 18

Aug 17

Aug 15

Aug 14

Aug 13

Aug 12

Aug 12

Aug 12

Aug 11

Aug 11

Aug 10

Aug 10

Aug 5

Jul 29

Jul 27

Jul 27

Jul 24

Jul 24

Jul 23

Jul 20

Jul 17

Jul 9

Jul 8

Jul 8

Jun 30

Jun 29

Jun 23

Jun 17

Jun 15

May 24

May 21

May 6