AI Security | Breaking Cybersecurity News | The Hacker News

Modern attacks are not primarily defeating infrastructure. They are inheriting trust. Identity Did Not Become Important. It Became Infrastructure. Security teams still talk about identity as though it is one security discipline among many, sitting beside endpoint protection, cloud security, network defense, and vulnerability management. That framing no longer reflects how modern enterprises actually operate. Modern business environments run on identity, delegated trust, cloud roles, automation pipelines, APIs, machine permissions, and continuously exchanged credentials. Users authenticate into SaaS platforms that the organization does not own. Workloads assume permissions that nobody provisions manually. Services trust other services built across years of acquisitions, migrations, technical debt, and operational compromise. The enterprise is no longer running on infrastructure alone. It is running on identity. Attackers recognized this shift before many defenders did. That i...

Launching a ransomware attack used to take real effort. Now, thanks to AI, almost anyone can launch a sophisticated attack, which changes the game for everyone responsible for protecting businesses. Reconnaissance that once took hours now takes minutes. Phishing emails that used to require careful crafting can now be generated at scale and sent to hundreds of targets simultaneously. IBM's 2025 Cost of a Data Breach Report found that AI reduced the time required to create phishing emails from 16 hours to just 5 minutes. For MSPs managing dozens or hundreds of clients, and for internal IT teams holding the line across an entire organization, understanding how AI is changing ransomware is key to staying ahead of the threat and minimizing disruption when attacks occur. The attack that starts in the inbox Before attackers can encrypt files or demand a ransom, they first need a way into the organization. One of the easiest ways to get that access is by tricking someone into cli...

The conversation around Anthropic's Claude Mythos Preview has understandably centered on zero-days. If AI systems can identify and exploit vulnerabilities across every operating system and browser at scale, defenders have to assume that exploit timelines will keep compressing. But for CISOs, the harder question is how long exposed access credentials remain valid after defenders discover the exposure. Credentials determine how far an attacker can move, how long they can persist, and how difficult containment becomes. A vulnerability just gets them in the door. That gap between time-to-exploit and time-to-revoke is where many organizations are most exposed. GitGuardian's State of Secret Sprawl report shows 64% of valid secrets detected in 2022 were still active and exploitable four years later in an environment where exploitation now collapses to hours. Vulnerabilities get attackers in the door, but credentials decide how far they go. The Mythos-ready briefing , developed b...

The event that didn't exist At 2:14 p.m. on a Tuesday, an employee clicks a link. If you reconstruct the moment from your security stack, nothing happened. A browser process opened an HTTPS connection. The certificate was valid. The destination wasn't flagged. Traffic volume was unremarkable. No detections fired. Inside the browser session, a different story was unfolding. The page that loaded looked like a routine CAPTCHA with "verify you're human" framing, a prompt to complete a quick check to continue. The instructions told the user to press Windows+R, paste what had already been copied to their clipboard, and hit Enter. In the middle of a busy work day, they did. What they pasted was a shell script. It executed in the user's own context, with the user's own permissions, as a deliberate action the user performed with their own hands. Nothing about the browser session looked unusual. The page rendered normal web content. The clipboard write happene...

The transition to container-first infrastructure is complete, with microservices now powering production-critical workloads and driving digital innovation for most enterprises. While 100% of DevSecOps leaders view containerization as critical to their production strategy, this shift has been accompanied by a crisis in security frameworks. According to the ActiveState 2026 State of Vulnerability Management & Remediation Report , respondents' organizations faced a staggering 82% container breach rate over the past year. Many companies have tried to mitigate risk by "shifting left", empowering developers to build security into their code from the start while still leveraging containers and open-source software from public registries. But in 2026, the reality of shifting left has often meant shifting a mountain of undifferentiated remediation work (i.e., fixing someone else's code) onto already overextended engineering teams. How should Security Leaders think about container se...

In November 2025, Anthropic revealed a cyber espionage campaign dubbed GTG-1002, the first documented case of an AI agent orchestrating real-world intrusions with minimal human input. A Chinese state-sponsored group manipulated Anthropic's Claude Code assistant into executing about 80% of a multi-target hacking campaign autonomously. Instead of merely advising cybercriminals, the AI took control of key steps: reconnaissance, vulnerability discovery, exploitation, credential theft, and data exfiltration across dozens of organizations. The result was an operation running at machine tempo. Claude performed tasks in a fraction of the time a human team would need, even identifying sensitive databases and writing exploits in seconds. Figure 1: The distinct phases of the Claude cyberattack At the peak of the attack, the AI made thousands of requests (often several per second), an onslaught of activity impossible for humans to match. This speed and scale of automation is a game changer: a...

Employees are increasingly using personal AI tools, AI-powered extensions, and emerging agentic browsers to accelerate their work. But unlike sanctioned AI platforms, these tools operate inside the browser runtime, where neither CASBs, SWGs, EDRs, nor DLP solutions have visibility. This has quietly turned the browser into an unmanaged AI execution environment, giving way to a new threat known as shadow AI. Shadow AI isn't just the latest buzzword; it's a serious risk that leaves organizations vulnerable to data loss, cyberattacks, compliance violations, and more.  What is Shadow AI? Shadow AI refers to GenAI-powered tools, browser extensions, and browsers that workers use on their own, without any company vetting or guidance. Different from shadow IT, where unsanctioned apps or devices slip through the cracks, shadow AI lives directly in the browser.  For example, employees might use their personal Claude accounts to work with sensitive company data or work on important pr...

For most of its history, the Security Operations Center (SOC) has been a privilege of the few. Building one meant millions in technology spend and round-the-clock analyst coverage. Unsurprisingly, for years, SOCs were a privilege of the few -  large enterprises and organizations with high-risk profiles, where budgets and scale justified the investment. Everyone else was left with partial coverage or had to outsource. That reality is changing. AI has flipped the SOC equation. What was once out of reach for all but the largest enterprises is now accessible and affordable for nearly every company that needs one. The risk every company faces By now, almost any 9-year-old knows that cyberattacks threaten every company . It's no longer just banks and financial giants in the crosshairs. Over the past decade, cyberattacks have expanded into every sector, from e-commerce sites to research institutes to local hospitals. Recent data from the 'VikingCloud 2025 SMB Threat Landscape' repo...

At some point in the last decade, SIEMs turned into that one friend who always promises to help you move, then shows up late, eats all your pizza, and still expects gas money. They were supposed to deliver centralized visibility and faster investigations. Instead, most SOC teams ended up with endless alerts, eye-watering bills, and dashboards that look impressive on the big screen but don't actually stop attackers. So, how did we end up here? A short history: when SIEMs were actually useful Back when firewalls were still exciting, SIEMs solved a real problem: logs scattered everywhere, auditors breathing down your neck, and no way to answer "who logged into what, when?" Then came the "next-gen" era. Vendors promised smarter detection, correlations across your stack, and even a pinch of threat intel. The promise was fewer false positives and a faster response. But instead of taming noise, NG SIEMs just amplified it. It was like turning up the volume on a broken radio and calling ...