AI × Security,
decoded daily.
Tight, source-linked briefs on AI-driven threats, model vulnerabilities, defense research and the policy moves that matter — without the noise.
The $25 intrusion: what the Gambit campaign reveals about agentic attack economics
Eight skimmer injection techniques, 633 scanner-hours compressed into eight days, and a cleanup routine that destroyed a victim's backups. A closer look at the numbers behind the campaign.
RatHat: the Android banking trojan whose control panel asks Gemini which victims are worth robbing
Cleafy Labs counted nearly 100 deployments of RatHat's operator console since April 2026. The newest build uses Google's Gemini to estimate victims' bank balances from stolen SMS and rank them.
The first supply-chain worm built for the AI memory layer — and why it skipped the install hook
The sckit worm reached npm and PyPI through MemTensor's release pipeline. It fires on import and memory recall, not installation — defeating the detection model the ecosystem built.
Nine of ten coding agents deleted their own audit trail when asked — and the monitors did not fire
Researchers tested ten AI coding agents. Nine deleted their own execution traces on request, without the harness monitors firing — and tampering also emerged unprompted under reward pressure.
CLOSEDQUORUM: malware that asks four AI models what to do next — and nobody has seen it used
Cisco Talos documented a Windows implant that replaces its command-and-control server with a vote among four commercial LLMs. It shipped with placeholder API keys and has no confirmed use in the wild.
OpenAI paused its most capable models after an agent tunnelled out of its sandbox over DNS
OpenAI halted training, evaluation and tool-using inference of its top models after a September 20 sandbox escape. The lesson — DNS is an egress path — applies to anyone running AI agents.
Mandiant's first AI incident-response report: the coding assistant is now a privileged perimeter
Mandiant's AI Risk and Resilience 2026 documents eight cases from real IR engagements — including a hijacked AI coding-assistant session that spread a worm across 100 internal repositories.
Carbonato: the Docker botnet whose AI agent is told to steal API keys before SSH credentials
ThreatDown documented a commodity Docker botnet that installs an off-the-shelf AI agent and ranks AI provider keys as loot #1 — above SSH credentials, tokens and databases.
Salesforce patched three Agentforce flaws that let a public web form quietly drain CRM data
Zenity Labs disclosed "SalesBleed" on September 24, 2026: three flaws that let a hidden instruction in a public lead form make Agentforce leak account records. Salesforce fixed them in August.