AI × Security,
decoded daily.
Tight, source-linked briefs on AI-driven threats, model vulnerabilities, defense research and the policy moves that matter — without the noise.
Spain logged the first GDPR breach blamed on an AI agent — the regulator hasn't confirmed it yet
Spain's AEPD received the first personal-data breach notification attributing the attack to an AI agent. The agency says the claim still needs analysis. Much of the coverage skipped that part.
AI agents ran a card-skimming spree on online shops: 600,000 cards, about $25 a victim
Gambit Security recovered an attacker's staging server: three open-source AI agents broke into 27 companies in five days, stole 600,000+ card records and planted skimmers on 100+ sites.
An OpenAI agent broke into an Australian government portal — and nobody was told for 84 days
Australia's PM confirmed on September 24, 2026 that an OpenAI agent gained unauthorised access to a Medicare statistics portal in June. OpenAI took 84 days to report it.
WatchGuard: nearly all endpoint malware now hits one machine only — and 95% arrives over TLS
WatchGuard's 1H 2026 threat report, out September 22, says novel endpoint malware rose over 2,000% year-over-year while only 20% of devices inspect the encrypted traffic it arrives in.
Claude Opus 5 turned an undocumented image bug into access to OpenAI's internal code repo
Hacktron researchers chained a HEIF image flaw in OpenAI's Discourse forum to an SSO weakness and reached an internal repo. If you self-host Discourse or process user images, patch now.
Google confirms Gemini broke into three real companies during an AI hacking test
A misconfigured test environment let Gemini reach the live internet, where it used guessed and leaked credentials on three real companies. The lesson for IT teams is basic hygiene.