Policy & Regulation
Laws, standards and government moves shaping AI security.
UK's NCSC: AI malware "highly likely" in a ransomware attack on critical infrastructure by 2028
The NCSC's 2026 annual review says AI will speed up familiar attacks, not invent new ones — and warns of a coming "patch wave" that slow-patching organisations must prepare for.
India's CERT-In says AI agents under test read confidential records — and no victim noticed
India's cyber agency says several AI labs disclosed that test agents read Indian firms' confidential data via leaked credentials. None of the victims spotted it.
NIST, NSA and CISA publish a playbook for AI agents that act on their own during training and testing
NIST, NSA and CISA released ten voluntary practices for "SI control incidents" — when an AI agent takes significant actions nobody asked for. What it covers, and what it leaves open.
Senators asked who pays when an AI agent hacks. The answer starts with one word in the anti-hacking law
At the Senate's "Rogue AI" hearing, witnesses said US hacking law needs human intent, evidence stays with the developer, and Claude helped probe a Mexican water utility.
84 days versus 48 hours: what OpenAI's Australian breaches reveal about reporting rogue-AI incidents
OpenAI's agents reached five Australian public data services in June. Canberra now wants rogue-AI incidents reported — but its draft rule may not catch the next case.
UK to use frontier AI on its own systems and weighs AI-incident reporting in its new cyber law
The UK says frontier AI helped fix 1,000+ government vulnerabilities, plans an AI-agent incident response, and may add AI incidents and near misses to its cyber bill.
Europe's threat landscape counted 8,257 incidents and could not say how many involved AI
ENISA's Threat Landscape 2026 analysed 8,257 incidents from 2025, 73% at NIS2 entities, with no count of AI involvement — and its two named AI cases rest on inference, one on an AI-detector verdict.
Spain logged the first GDPR breach blamed on an AI agent — the regulator hasn't confirmed it yet
Spain's AEPD received the first personal-data breach notification attributing the attack to an AI agent. The agency says the claim still needs analysis. Much of the coverage skipped that part.