Cloud Security | Breaking Cybersecurity News | The Hacker News

We had an enterprise customer tell us their entire AI footprint was Copilot. That was the whole answer. One tool, one line item, done. We ran the first scan. Copilot wasn't even close to number one. Claude was. OpenAI came in second. Copilot was third. Nobody on the security team knew because Claude doesn't show up the way a SaaS app used to show up. There's no single login screen, no single admin console, no one place to look. That's the part most security teams miss. Claude isn't one surface. It's six. The six places Claude actually runs Claude Enterprise and Connected Apps. This is the surface everyone pictures: employees typing into Claude, OAuth'd into Google Drive, GitHub, Slack, and Jira, asking Claude to act on what's inside. The audit log shows that a connection happened. It does not show what got pulled into the prompt or what came back out. A finance analyst can drop a quarter of board materials into a conversation in ten second...

Security is fundamentally about knowing what a system is supposed to do, then catching it when it does something else. For software with deterministic execution paths, that is a tractable problem. For AI agents, it is not. An agent does not follow a fixed code path. It reasons toward a goal, selects tools based on that reasoning, and adapts its next action based on what those tools return. The same input can produce a different sequence of actions depending on context, session history, and what an external tool happened to return. Behavior is the attack surface, and behavior changes. Traditional proxies and AI firewalls were built to inspect content: what a user sent, what a model returned. Intent security asks a different question: is this agent doing what it was built to do, in this context, for this user, right now? Answering that requires building a behavioral baseline for every agent and measuring deviation from it continuously. That is the problem Lasso was built to solve....

Attackers prefer the path of least resistance. Why break in when you can log in? That is what makes working credentials so valuable. A leaked password, token, or API key does more than reveal sensitive data; it offers a way in. No vulnerability or privilege escalation chain necessary. If the credential is valid, the attacker can simply use it, and the session will look like ordinary activity. This shifts the questions from "where can attackers break in?" to "where do usable keys tend to accumulate? Increasingly, the answer is the developer laptop: one of the most instrumented machines most companies own, and one of the easiest places for credentials to go unnoticed. The endpoint is watched for malware, behavior, posture, and configuration. But a valid plaintext credential is something else: a door an attacker may not need to force. A fully patched fleet can still have usable keys scattered across its devices, enough to turn one foothold into something much larger....

Why Authentication Context Matters Most people think logging in is a small act. Type your password, type your code, tap a screen, scan a face, and move on. But to the systems on the other side, the method behind that moment can matter just as much as the fact that it happened at all. That is where two strangely named but surprisingly important identity concepts enter the story: OIDC's AMR and SAML 2.0's AuthnContext. They sound like the kind of acronyms that only standards committees could love, yet both were created to answer a deeply human question in digital form: How sure a system has to be before it trusts someone? The backstory starts with the internet growing up. Early online services often treated authentication as a light switch: either the user was in, or the user was out. But as online systems began handling payroll, health records, taxes, academic data, contracts, and financial approvals, that simple model started to crack. A login backed by a reused password is not ...

Modern attacks are not primarily defeating infrastructure. They are inheriting trust. Identity Did Not Become Important. It Became Infrastructure. Security teams still talk about identity as though it is one security discipline among many, sitting beside endpoint protection, cloud security, network defense, and vulnerability management. That framing no longer reflects how modern enterprises actually operate. Modern business environments run on identity, delegated trust, cloud roles, automation pipelines, APIs, machine permissions, and continuously exchanged credentials. Users authenticate into SaaS platforms that the organization does not own. Workloads assume permissions that nobody provisions manually. Services trust other services built across years of acquisitions, migrations, technical debt, and operational compromise. The enterprise is no longer running on infrastructure alone. It is running on identity. Attackers recognized this shift before many defenders did. That i...

Identity sprawl, agentic AI risk, and the path to NHI governance maturity When security leaders talk about identity risk, the conversation almost always centers on humans: Privileged users, compromised accounts, insider threats. But for most enterprises, the greater risk has already shifted. And it has nothing to do with your employees. Non-human identities (NHIs) — service accounts, API keys, OAuth tokens, SSH keys, RPA bots, cloud workload credentials and AI agents — are the fastest-growing, least-governed attack surface in the modern enterprise. And the industry is beginning to reckon with what that means. $4.88M Global average cost of a data breach — IBM Cost of a Data Breach 2024 The scope of the problem The numbers are striking. Research from Rubrik Zero Labs puts the NHI-to-human identity ratio at 45:1 in the modern enterprise. For cloud-native and DevOps environments, Entro Labs H1 2025 research puts that figure at 144:1.  These identities are not passive: They au...

Most of the commentary on Anthropic's Claude Mythos Preview has gone in one of two directions: one camp treats it as the civilizational inflection point, the other as marketing dressed up as a research result. Neither read is particularly useful for a security leader who still has a program to run on Monday. The AISLE team's technical response to the Mythos announcement made a fair point worth sitting with: much of what was demonstrated is recoverable on smaller, open-weight models, particularly on the discovery side. Early testing results of OpenAI's GPT 5.5 show CTF performance close to or slightly superior to Mythos; the exclusivity framing is arguable, but the accelerated model improvement in offensive security is undisputable. The UK AI Security Institute found that Mythos can autonomously execute a complete corporate network takeover, succeeding in 30% of its attempts on a complex attack range — a task AISI estimates would require roughly 20 hours for a human e...

The event that didn't exist At 2:14 p.m. on a Tuesday, an employee clicks a link. If you reconstruct the moment from your security stack, nothing happened. A browser process opened an HTTPS connection. The certificate was valid. The destination wasn't flagged. Traffic volume was unremarkable. No detections fired. Inside the browser session, a different story was unfolding. The page that loaded looked like a routine CAPTCHA with "verify you're human" framing, a prompt to complete a quick check to continue. The instructions told the user to press Windows+R, paste what had already been copied to their clipboard, and hit Enter. In the middle of a busy work day, they did. What they pasted was a shell script. It executed in the user's own context, with the user's own permissions, as a deliberate action the user performed with their own hands. Nothing about the browser session looked unusual. The page rendered normal web content. The clipboard write happene...

For security leaders, the inbox remains the front door for attackers. Here's why the smartest teams are adding adaptive, AI-driven protection to their cloud email security, not replacing them. Email is still the number-one attack vector for enterprises, and it is not even close. The FBI's Internet Crime Complaint Center reported that business email compromise alone generated $3 billion in losses in 2024 , with AI-enabled attacks accelerating the trend ( FBI IC3 Report ). The attacks that succeed today don't carry obvious malicious payloads. They rely on trust, tone, and timing; a spoofed vendor sending a "routine" invoice update, or a convincing impersonation of a CEO with an urgent request. No malware. No suspicious links. Just words, carefully chosen. Microsoft 365 is the backbone of productivity for most organizations, and Microsoft Defender and Exchange Online Protection do solid work catching known spam, malware, and co...