Computer Security Articles

Feeling comfortable about the safety of your software supply chain because your organization has invested in SBOMs, signing, and provenance? You shouldn’t.In the AI coding era, those tenets of the traditional trust model aren’t enough to ensure software safety. That’s because that model fails to answer an important security question: What is the code capable of doing?CodeHunter CEO Ken Ammon,writing for Help Net Security, summarized the trust vacuum.“[T]raditional trust models are insufficient w

For this installment of Spectra Analyze in Action, the threat intelligence research team at ReversingLabs explores hunting for Scalable Vector Graphics (SVGs) files. SVGs are a sneaky way attackers can target your organization. Due to their nature as image files, they are typically seen as benign, but recently they have been used as a vector for credential phishing sites, malicious redirection, and infected downloads.To aid in protecting your organization, you can use Spectra Analyze to hunt and

Mention offensive AI and expect the discussion to focus on vulnerability discovery, malware creation, and exploit generation, butrecent researchby Cato Networks identified another — and very potent — application for offensive AI.Cato explained in ablog postthat it evaluated in a controlled Active Directory lab environment, how frontier models behave when combined with agent platforms, MCP-enabled tooling, and operational guidance. “The objective was straightforward: determine how effectively an

After AI models from both OpenAI and Anthropic autonomously compromised systems belonging to external organizations, security experts are calling for robust security controls around the testing and evaluation of AI agents.The more widely reported incident involved OpenAI models that, while being evaluated on their ability to autonomously discover and exploit software vulnerabilities, escaped a sandbox and compromised production systems at the AI platform Hugging Face.The test, called ExploitGym,

The Open Worldwide Application Security Project’s newest OWASP Top 10 for LLM Applications includes a change that puts a spotlight on the rise of AI risk.While prompt injection and the disclosure of sensitive information still hold the top two spots, excessive agency jumped from sixth place in 2025 to third in 2026 (pushing supply chain and data model poisoning risks down to the fourth and fifth slots).Now part of OWASP’s GenAI Security Project and created  by hundreds of AI security experts, th

New research may show us how AI is set to break a decades old pattern in cybersecurity where malware authors and security teams battle to exploit — and protect — specific flaws and vulnerabilities.Researchers have created a proof-of-concept AI worm that carries no fixed exploit logic at all, but reasons about each machine it reaches, adapts to what it finds, and writes customized attack code on the fly. It then runs on compute cycles stolen from its victims.The paper, “AI Agents Enable Adaptive

If Black Hat USA 2026 is any indication, the cybersecurity industry is going strong. This year’s conference, part of a series of “Hacker Summer Camp” events held in Las Vegas during the first week of August, drew more than 23,000 verified attendees, according to organizer Informa Tech. That was an increase of more than 15% from last year’s show, with AI the dominant theme.Case in point: a packed, last-minute Breaking News session called “Frontier AI Security Breach Exposed” in which OpenAI secur

Researchers at Upwind found that attackers injected malware directly into the AsyncAPI project’s source repositories before the packages were published to the npm registry.The compromised packages moved through official publishing channels and thus looked legitimate to developers, who were at risk of pulling malicious code into their workstations and CI/CD environments simply by importing the packages.The blast radius of the method extends well past any single application. Once release infrastru