research

Autonomous AI-driven worm can reason its way through corporate networks

AI, Don't miss, Hot stuff, LLMs, News, research, threat, worms /

Autonomous AI-driven worm can reason its way through corporate networks 2026-06-03 at 20:20 By Zeljka Zorz Researchers at the University of Toronto, the Vector Institute, and the University of Cambridge have built and tested a proof-of-concept AI-driven worm that does not operate on a fixed list of exploits. Instead, it analyzes each target it encounters, […]

Autonomous AI-driven worm can reason its way through corporate networks Read More »

Only 11% of production agents pass the AI agent security bar

agentic AI, AI, cyber risk, cybersecurity, Don't miss, enterprise, Features, Hot stuff, News, research, security controls /

Only 11% of production agents pass the AI agent security bar 2026-06-03 at 14:00 By Mirko Zorz Enterprise teams are running AI agents that write code, drive browsers, answer customer calls, manage cloud infrastructure, and query data warehouses with standing credentials. A new independent assessment of 100 production agents finds that nearly all of them

Only 11% of production agents pass the AI agent security bar Read More »

This AI model backdoor attack stays hidden until you customize the model

AI, backdoor, data, Don't miss, News, research /

This AI model backdoor attack stays hidden until you customize the model 2026-06-02 at 09:09 By Anamarija Pogorelec Most teams that deploy AI start with a backbone model. They download a large pre-trained system, adapt it to a specific task, and put it into production. The download step carries a security question: the origin of

This AI model backdoor attack stays hidden until you customize the model Read More »

Websites can spy on user activity by analyzing SSD behavior

attack, browser, News, research /

Websites can spy on user activity by analyzing SSD behavior 2026-05-29 at 14:08 By Sinisa Markovic Websites have spent years collecting information about visitors through browser fingerprinting, tracking scripts, and other techniques designed to identify devices and monitor behavior. Researchers have demonstrated another method that relies on something most users would never expect a website

Websites can spy on user activity by analyzing SSD behavior Read More »

Zapier exploit chain shows how known anti-patterns compose into critical risk

AWS, cybersecurity, Don't miss, News, research, Token Security, vulnerability /

Zapier exploit chain shows how known anti-patterns compose into critical risk 2026-05-28 at 16:00 By Mirko Zorz A five-stage exploit chain disclosed by Token Security researchers turned a free Zapier account into write access on Zapier’s public developer SDK packages and on internal packages that load in every authenticated zapier.com session. Each link in the

Zapier exploit chain shows how known anti-patterns compose into critical risk Read More »

Frontier AI models collapse under multi-turn AI attacks, Cisco finds

AI, Amazon, Anthropic, Cisco, cybersecurity, Don't miss, Google, News, OpenAI, report, research /

Frontier AI models collapse under multi-turn AI attacks, Cisco finds 2026-05-28 at 10:16 By Mirko Zorz Attackers who probe large language models rarely give up after one refusal. They reframe, build context across turns, adopt personas, and escalate gradually. New research from Cisco’s AI threat intelligence team finds that the safety benchmarks used across the

Frontier AI models collapse under multi-turn AI attacks, Cisco finds Read More »

$20 per zero-day is already the WordPress plugin reality

0-day, AI, conferences, cybersecurity, Don't miss, Hot stuff, News, research, Trend Micro, WordPress /

$20 per zero-day is already the WordPress plugin reality 2026-05-22 at 17:05 By Mirko Zorz Vulnerability researchers have spent the past year arguing about whether AI agents can find real bugs at scale or whether they mostly generate noise. A pipeline built in three days by researchers from TrendAI and CHT Security supplies an answer,

$20 per zero-day is already the WordPress plugin reality Read More »

Deleted Google API keys keep working for up to 23 minutes, researchers warn

Aikido Security, API security, credentials, Don't miss, Google, Google Cloud, Hot stuff, News, research /

Deleted Google API keys keep working for up to 23 minutes, researchers warn 2026-05-22 at 15:08 By Zeljka Zorz Google API keys are credentials that let applications access Google services, from Maps to the Gemini AI. If a key is leaked, an attacker can use it to make API calls, rack up charges, and, if

Deleted Google API keys keep working for up to 23 minutes, researchers warn Read More »

Meet Fractal, an OS made for microarchitecture reverse engineering

apple, chip, Don't miss, hardware, Hot stuff, MIT, News, operating system, research, reverse engineering /

Meet Fractal, an OS made for microarchitecture reverse engineering 2026-05-22 at 12:17 By Sinisa Markovic Probing how a CPU isolates user code from kernel code is messy work. Researchers patch kernels, write drivers, or boot stripped-down bare-metal programs, and any of those choices change variables they were trying to hold still. Fractal, a new operating

Meet Fractal, an OS made for microarchitecture reverse engineering Read More »

Most dark web activity revolves around a handful of topics

cybercrime, dark web, News, research /

Most dark web activity revolves around a handful of topics 2026-05-21 at 08:31 By Sinisa Markovic Dark web activity often becomes visible during marketplace seizures, major data leaks, or sudden spikes in criminal activity. Those events can create an impression of an ecosystem where attention shifts quickly and new trends regularly replace old ones. A

Most dark web activity revolves around a handful of topics Read More »

AI red teaming agents change how LLMs get tested

agentic AI, AI, cybersecurity, Don't miss, Features, Hot stuff, LLMs, News, research /

AI red teaming agents change how LLMs get tested 2026-05-21 at 08:00 By Mirko Zorz Adversarial probing of LLMs has piled up a sprawling toolkit over the past three years. Attack techniques with names like Tree of Attacks with Pruning, Crescendo, and Skeleton Key sit alongside hundreds of prompt transforms and scoring methods across open-source

AI red teaming agents change how LLMs get tested Read More »

When your AI assistant has the keys to production

agentic AI, AI, cybersecurity, Don't miss, LLMs, News, research, security operations /

When your AI assistant has the keys to production 2026-05-20 at 09:34 By Sinisa Markovic Large language models in operational roles query telemetry, propose configuration changes, and in some deployments execute those changes against live infrastructure. Ticket drafting and alert summarization were the starting point. Vendors describe this work as autonomous remediation or self-healing infrastructure.

When your AI assistant has the keys to production Read More »

Earbud sensors can authenticate users by their heartbeat, study finds

authentication, biometrics, cybersecurity, Don't miss, Features, hardware, Hot stuff, News, research, sensors /

Earbud sensors can authenticate users by their heartbeat, study finds 2026-05-19 at 09:17 By Mirko Zorz Researchers built a continuous authentication system called AccLock that identifies a wearer by the tiny vibrations a heartbeat makes inside the ear canal. The signal comes from an accelerometer of the kind already sitting inside many wireless earbuds, so

Earbud sensors can authenticate users by their heartbeat, study finds Read More »

Public Instagram posts provide raw material for AI phishing campaigns

AI, cybercrime, Instagram, News, phishing, research, social media /

Public Instagram posts provide raw material for AI phishing campaigns 2026-05-19 at 09:17 By Sinisa Markovic A handful of public Instagram posts can give attackers enough material to generate convincing phishing emails with GenAI. Research from the University of Texas at Arlington and Louisiana State University showed how public social media activity can be turned

Public Instagram posts provide raw material for AI phishing campaigns Read More »

The AI backdoor your security stack is not built to see

AI, backdoor, cybersecurity, Don't miss, enterprise, Features, LLMs, Microsoft, News, research /

The AI backdoor your security stack is not built to see 2026-05-18 at 09:42 By Sinisa Markovic Enterprises deploying LLMs have spent the past two years building defenses around a reasonable assumption: malicious behavior leaves a trace in the input. Scan for suspicious tokens, filter unusual characters, watch for prompt injection patterns. New research from

The AI backdoor your security stack is not built to see Read More »

Deepfake detection is losing ground to generative models

cybersecurity, deepfakes, Don't miss, News, research /

Deepfake detection is losing ground to generative models 2026-05-15 at 09:04 By Sinisa Markovic Deepfake detection has been built around a single question for close to a decade. Given a video or audio clip, is it real or synthetic? Commercial detectors analyze pixels, frequencies, and biometric signals to answer that question, and the best of

Deepfake detection is losing ground to generative models Read More »

Zombie linkages are keeping expired domains trusted for years

certificates, DNS, domain information, News, research /

Zombie linkages are keeping expired domains trusted for years 2026-05-15 at 08:24 By Sinisa Markovic Domains expire, get transferred, and return to the market every day. The systems connected to those domains can continue trusting the original owner long after control has changed. Researchers at USC and the University of Twente examined this problem in

Zombie linkages are keeping expired domains trusted for years Read More »

Vector embedding security gap exposes enterprise AI pipelines

AI, cybersecurity, Data exfiltration, Don't miss, GitHub, Hot stuff, News, research /

Vector embedding security gap exposes enterprise AI pipelines 2026-05-14 at 08:30 By Mirko Zorz Enterprise adoption of retrieval-augmented generation has moved sensitive corporate content into a new storage format that existing security tools cannot inspect. Companies deploying internal AI assistants convert documents into high-dimensional numerical vectors and ship them to embedding services and vector databases

Vector embedding security gap exposes enterprise AI pipelines Read More »

The hidden smart fridge risks that emerge years after purchase

Bosch, data collection, Don't miss, Endpoint Security, Features, hardware, Hot stuff, Internet of Things, LG, News, Privacy, research, Samsung /

The hidden smart fridge risks that emerge years after purchase 2026-05-12 at 09:28 By Mirko Zorz Household refrigerators are built to last more than a decade. The software, cloud services, and mobile apps that control them are not. A new analysis from Erik Buchmann at Leipzig University maps what happens when those two timelines collide,

The hidden smart fridge risks that emerge years after purchase Read More »

One keypress is all it takes to compromise four AI coding tools

AI, Anthropic, Cursor, cybersecurity, DevSecOps, Don't miss, Features, GitHub, Google, Hot stuff, Microsoft, News, research, vulnerability /

One keypress is all it takes to compromise four AI coding tools 2026-05-08 at 01:14 By Mirko Zorz Developers clone unfamiliar repositories all the time. Open-source projects, work from teammates, sample code from a tutorial, a library someone recommended on a forum. The convention is old and reasonable: you look at what’s inside before you

One keypress is all it takes to compromise four AI coding tools Read More »

Scroll to Top