AI security threats: A risk-first guide for CISOs
The first step in addressing AI risk is understanding where it is already being used across the business, and where it is most likely to…
Category: CISOOnline
Backdoored Rust packages hit crates.io, exposing developers to malware at build time
The malicious code ran at build time The attack did not require developers to execute suspicious code or even call a function from arrayref. “Because…
OpenAI adds an AI safety layer to detect misuse without retaining enterprise data
OpenAI is adding a new safety capability that allows enterprises to detect misuse of its AI systems across multiple interactions without retaining prompts or responses,…
Kriminal breaks out of Grok, Claude guardrails at $12.99
Security researchers are warning of a criminal AI service built on Grok and Claude, among other models, that promises uncensored access to powerful AI capabilities…
Citrix issues critical security updates for its NetScaler devices
“There are no public indicators that these two new flaws are being exploited at the moment, but that is likely to change within hours, given…
Critical flaw patched in popular JavaScript sandbox used in AI projects
A critical sandbox escape vulnerability was discovered and patched in isolated-vm, a library for running JavaScript code inside an isolated process. If exploited, the vulnerability…
OpenAI ‘temporarily slows’ scaling efforts, also promises zero data retention for select frontier model customers
Still, Mike Wilkes, enterprise CISO at Aikido Security, observed, “sincerity is not the same thing as permanence. In the old Norse/Scandinavian image of a giant…
CISOs are struggling to threat-model AI. Can 15-minute sessions help?
Shostack says a short session is not supposed to be exhaustive. It should, however, identify enough meaningful risks to guide the next decision: Is the…
Why AI cyberattacks are outpacing enterprise defenses
One of the most effective steps organizations can take to improve their defensive readiness is to move from periodic testing to cultures of constant training.…
Snowflake flaw slips past AI checks, gets exploited by another AI
The workflow ran whenever someone opened a GitHub issue and used the issue title as part of a shell command. A change introduced in PR#1218…
Microsoft finally patches critical one-click Copilot vulnerability, almost eight months after learning of it
“This is the pattern CISOs must internalize: in agentic systems, the malicious action and the legitimate action are the same action with different intent, which…
Critical GitLab flaw allows attackers to delete and modify public repos
“WatchTowr was able to reproduce the vulnerability within minutes of its disclosure, armed only with the advisory details and patch,” Jake Knott, principal security researcher…