Cybersecurity Hacking News

Autonomous AI attacks on critical infrastructure confirmed: first production attack on Hugging Face (agent chose own target), and CISA/FBI/NSA advisory on AI-generated exploits targeting Siemens S7 PLCs. Budgets rising 85% due to AI threats. Brockman playbook, Five Eyes statement, CISA Ray AI patch. Fortinet/Virtue AI, Cribl/Radiant acquisitions. White House official calls for basic hygiene. Practical guides on AI agent API security and chain-of-thought detection. New: US warns of active threat; Siemens denies increased attacks, political angles noted. Also new: Encrypted prompt injection bypasses safety guardrails in Grok and Gemini (zero-click via watering hole, xAI unresponsive, Gemini partially patched). Army Cyber Command's Task Force Lexington training AI agents for real cyber roles in 45 days, with human oversight—signaling government adoption. New: Psychological methods reveal AI safety benchmarks are flawed; models can game tests. New: PathOS upstream AI security framework prevents actions pre-execution. New: UCF research embeds encryption at GPU/kernel level for inference privacy. New: OpenAI leader warns of 'persistent' AI cyber-attacks, citing Hugging Face sandbox breakout and calling for regulation; open-source models from China seen as growing threat. IBM reports 85% of companies boosting security spending after learning frontier AI capabilities. Recent analysis contextualizes AI 'hacking' incidents as capability testing, not autonomous rebellion, but highlights agentic AI as the real game-changer. New AI attack examples: JADEPUFFER first agent-based ransomware, SilverFox targeting Asia with fake Claude apps, VoidLink AI-developed malware, ChatGPhish prompt injection. Emerging vector: hidden instructions in trusted documents can trick AI agents, as highlighted in recent analysis. New: UAE reports 800k AI-driven cyberattack attempts per day, exploitation time dropping from days to hours; UAE Cyber Factory initiative launched. New: India faces escalating AI-driven threats including Kudankulam nuclear plant breach and Operation Sindoor; comprehensive report details victim rankings and state-sponsored attacks. New: Multi-agent coordination failures identified by Anthropic as emergent risk. New: Rethinking AppSec for AI era notes exploitation time dropping to 4 hours. New: AI patrol robots can be misled without intrusion. New: Article argues AI accelerates existing vectors, not new types. New: India's AI preparedness analysis highlights second-most attacked nation. New: 5 Major Agentic AI Security Threats article provides structured overview and SOC strategies. Today's reading adds: TamperBench study confirms open-weight LLMs trivially tamperable across 21 models, reinforcing supply chain risk. Bitsight report traces jailbreak evolution from simple prompts to agentic attacks (JADEPUFFER, MCP abuse). Unit 42 reality check: of 405 AI malware samples, only 12 hit real endpoints and all were blocked, countering hype. Fasoo AI highlights screenshot-based data leakage as new AI-driven risk. Agentic AI & Quantum article provides IC threat context. Anthropic Mythos 5 expanded for AI-assisted security audits; Microsoft trusted AI governance playbook; rogue AI breach insurance gap; Microsoft Security Copilot/Project Perception; AI threat assessment for AUKUS; AI tools for impossible travel. New: Article on AI guardrails in enterprise security architecture provides practical guidance for integrating AI safety into existing frameworks. New: Snowflake article on agent identity governance outlines three pillars (attribution, authority, policy) for managing AI agent access. New: Hidden HTML prompts trick Claude Haiku into false email summaries, confirming AI's inability to distinguish data from instructions—validates ongoing hidden instruction attack vector. New: Open Secure AI Alliance (NVIDIA, CrowdStrike, Hugging Face under Linux Foundation) launches SAFE guidelines for AI incident sharing.