Cybersecurity Integration Digest

Mythos AI deployed to ~150 orgs and CISA for government code audits. GhostApproval symlink attack bypasses human-in-the-loop in Claude Code, Cursor, Amazon Q. GitLost prompt injection leaked private repos. UK NCSC launches Cyber Shield blueprint for autonomous AI defense agents with six core capabilities and a voluntary pledge. AI security paradox: 80% of orgs can't explain AI actions. Zscaler documented two real-world prompt injection campaigns for crypto payments. First fully autonomous AI ransomware attack validates Five Eyes warnings. BeyondTrust critical auth bypass found via Claude Opus 4.8. Keeper Security introduces agentic AI governance. AI overthinking DoS via evolutionary prompt attack amplifies output length up to 26x. Chinese regulator warns of Claude Code 'security backdoor'; Anthropic says anti-abuse. Blackpoint Cyber adds AI SOC agent for identity threat response. AI coding assistants accelerating OSS adoption faster than governance: only 27.8% of orgs have policies despite 98% increasing OSS use. SonarQube Hunter Agent Beta for AI code security audit. Secure by Design v1.1 adds AI-specific guidance. Microsoft warns customers that AI-driven discovery will increase patch volumes. Check Point CTO argues AI's non-deterministic nature demands security-by-design. Coforge launches SecureEdge2Cloud AI-native Zero Trust platform. Critical PoC: AI Now Institute published a multi-stage exploit chain against Claude Code and Codex achieving RCE via auto-mode, undermining safety assumptions of agentic coding tools. This architectural risk likely applies to other platforms. A strategic reframing argues AI doesn't create new risk categories but collapses the exploitation timeline, making agentic AI for remediation the critical path forward. CrowdStrike reveals five new prompt injection techniques (trigger-activated rules, cognitive token suppression, algorithmic decomposition, special token injection). CTEM for AI framework published to address AI-specific attack surfaces. OpenAI's GPT-5.6 Sol found to have similar universal jailbreaks for autonomous cyber attacks as Anthropic's Fable, with AISI developing jailbreaks within hours; no export controls on OpenAI raises policy inconsistency. New regulatory signals: ESRB, Five Eyes, ECB warnings on AI-accelerated threats; ECB October deadline for compliance. AI insurance trends emerging. CIRCIA enforcement beginning. New DoS vector: CoRe-DoS inference-time attack on RAG systems (84.6-100% success, resilient to defenses). New supply chain vector: slopsquatting—attackers register fake package names that LLMs hallucinate (19.7% hallucination rate), no registry protections. Practical guide on using Codex for automated remediation published. New evidence: A paper on fixing vulnerabilities with agentic AI in OSS-Fuzz reports 61-72% patch generation rate, reinforcing the viability of agentic remediation. New attack: Ghostcommit hides prompt injection in PNG images to exploit AI code reviewers; split-payload technique bypasses both human and LLM review. CNCF published sovereignty-first framework for AI workload placement, addressing security governance and supply chain. New concrete case: Ethereum Foundation's multi-agent AI security workflow (CVE-2026-34219) validates AI-driven fleet-based hunting with human verification rule. New: Sentinel Sphere AI-driven DoS detection framework using Mistral 7B achieves 98.2% accuracy and sub-1.2s mitigation latency, demonstrating practical LLM-enhanced security operations. New synthesis: AI coding security risks quantified—91% adoption, 45% vulnerable code, 40% more secrets leakage, with slopsquatting as emerging vector. New research: LLM-powered on-demand test suites for fuzzing deep learning libraries—a concrete application of AI to automate vulnerability discovery in ML infrastructure. New DoS vector: AI overthinking via evolutionary prompt attack amplifies output length up to 26x, transferable across models, requiring no internal access—a practical cost/availability attack on reasoning LLMs. New article: Evaluating the Influence of Large Language Models in Secure Development reinforces the need for human oversight and balanced integration. New data: 99.9% of fixable AI vulnerabilities remain unpatched, 81% of AI adopters have known CVEs. Microsoft formalizes patch deferrals under 3 days and restart grace under 2 days, confirming AI-compressed exploit windows. Legit Security launches autonomous remediation agents (June 16) addressing 252-day median fix time. DEF CON workshop on reproducing Mythos-class vuln discovery with local AI for under $100 makes AI-driven vuln discovery accessible. Hardware security AI assistant (VeriChat) shows promise for chip backdoor detection (87.73% accuracy). Darktrace piece reinforces pre-CVE exploitation windows collapsing, identity as new perimeter, AI agents accelerate threats. New: GPT-5.6 Sol vs Claude Mythos 5 benchmark (ExploitBench: 73.5% vs 78%) provides task-dependent recommendations. New: Cognizant joins OpenAI Daybreak for frontier AI cyber defense. New: AI-generated code security debt as governance problem.