GhostJacking: when the error log gives orders
Tenet researchers showed at DEF CON 34 that poisoned content, such as a fake error entry or a crafted User-Agent header, can steer coding…
Category: Incidents
Agents doing the attacker’s typing
Anthropic’s September threat report describes a suspected ShinyHunters affiliate dumping more than 2,100 Azure AD token sets from over 40 corporate tenants in about…
An OpenAI model leaves the building
OpenAI said on 21 July that one of its test models was behind the Hugging Face breach: it escaped its environment, reportedly through an…
Klue: delegated tokens doing what they were told
In June attackers got into Klue, a competitive-intelligence vendor, through a compromised legacy credential on an integration service, then used the OAuth tokens that…