securityFriday, July 17
Today's security news is split between the rise of AI-powered threats and the tools to fight them. From prompt injection attacks that break coding agents 96% of the time to Microsoft's guidance on least privilege for AI agents, the industry is scrambling to secure autonomous systems. Meanwhile, a password manager's Russian ties and a fast new ransomware strain remind us that older threats haven't gone away.
The most consequential stories today all orbit the same question: how do you secure AI systems that act on their own?
The MOSAIC attack compromised Claude Code, Codex, and Gemini CLI in 96.59% of trials via CLI command-composition. That failure rate is a stark warning for anyone deploying AI coding agents in production.
Microsoft's piece on least privilege for AI agents is timely: it argues that without managed identities and RBAC, agents risk accessing or modifying sensitive data without human approval for each step.
Capital One released VulnHunter, an open-source agentic AI tool that scans source code for vulnerabilities and proposes fixes. It's one of the most ambitious attempts by a major bank to use AI defensively.
This article lays out the two big threats for agentic AI in production: prompt injection and tool misuse, with recommended defenses. It's a solid primer for anyone building or deploying these systems.
Beyond AI, the day's other big stories involve hidden risks in the software supply chain and fast-moving infrastructure threats.
Passwork, a password manager used by European government agencies, shares origins and updates with a Russian firm certified by the FSB. The security implications are serious, and every outlet is talking about it.
Spirals ransomware, written in Rust, goes from initial access to full encryption in under 24 hours. Its per-file AES-128 encryption with ECDH key wrapping makes recovery difficult without the attacker's key.
The HollowByte vulnerability lets an unauthenticated attacker trigger a DoS on OpenSSL servers with just 11 bytes. It's a reminder that even mature crypto libraries have edge cases.
IoT-Vulnerability-Research-Public/TP-Link_Kasa_EC71/Kasa_EC71.md at main · BadChemical/IoT-Vulnerability-Research-Publicgithub.com
AI meets Cryptography 2: What AI Found in OpenVM's zkVMblog.zksecurity.xyz
Google fixing Android lock screen bug that lets Gemini send SMS without a PINwww.theregister.com
The Last Relay — Coming soon to iOSlastrelay.ai-created.comThe Zoom hack that says, ‘Don’t record me’techcrunch.com
If every meeting, watercooler conversation, and date gets transcribed and summarized, who's actually reading any of it?
'You're giving ballistic missiles to individuals with Mythos': JPMorgan CEO Jamie Dimon says Anthropic's AI model poses some serious riskswww.techradar.com
Restricting Mythos to vetted organizations and keeping it out of the hands of the public seems to be the safest option for Anthropic, with JPMorgan CEO describing its risks as a “real issue.”
UN Security Council Sanctions Nangaa, Five Armed Group Leaders Over DRC Conflictplusnews.ug
Corneille Nangaa Yobeluo, the coordinator of the Alliance Fleuve Congo (AFC), an ally of the M23 rebel movement, is among six leaders of armed groups sanctioned by the United Nations (UN) Security Council over their alleged role in fueling the conflict in eastern Democratic Repub
Hackers breached DHS after alarms were twice ruled 'false positives'www.techradar.com
DHS analysts twice ruled intrusion alerts on its HSIN network "false positives", allowing hackers to have weeks of unintended access on the platform.
WordPress 7.0.2 Releasewordpress.org
WordPress 7.0.2 is now available. The 7.0.2 security release addresses one critical and one high severity security issue. Because this is a security release, it is recommended that you update your sites immediately. Due to the severity, the WordPress.org team have enabled forced
FBI Traces Malware-Infected Steam Games to 21-Year-Old in Floridaau.pcmag.com
The complaint against Zyaire Wilkins alleges that he and his co-conspirators distributed eight games on Steam that infected computers belonging to about 8,000 Steam users. The US has arrested a 21-year-old in Florida for allegedly infecting thousands of users via malware-laden ga
wellness roundup
sustainability roundup
open source roundup
real estate roundup
memoir roundup
literature roundup
