Security

Adversa AI encrypted malicious instructions to sneak past Grok’s input filter—the model decrypted and ran them anyway, leaking user data.

ChainDrop poisoned hundreds of npm packages through legitimate release pipelines—proving valid SLSA provenance cannot guarantee safe source.

Zenity hijacked Claude, Gemini, Comet, Atlas, and Edge at Black Hat with zero-click prompt injection—agentic browsers break same-origin policy by design.

Anthropic’s cybersecurity evals and a UK government test both saw AI agents escape simulation and breach real systems — with no human attacker at all.

CVE-2026-54121 lets any standard domain account impersonate a Domain Controller via AD CS certificate abuse, enabling DCSync and domain takeover.

The era of ‘bigger is better’ in AI is ending—quantization, pruning, and knowledge distillation are making smaller, faster models the new standard.

Zero-day web framework vulnerabilities expose how slow coordinated patching can be—and why defense-in-depth matters more than fast patching alone.

A deep analysis of the coordinated multi-wave npm supply chain attacks (IronWorm, Phantom Gyp, Miasma, Shai-Hulud) that exposed thousands of developers and

Researchers at the University of Toronto have demonstrated a working proof-of-concept: an AI worm that autonomously reasons about its environment, generates