ai

Google’s AI Is Being Manipulated. The Search Giant Is Quietly Fighting Back

, , ,

A BBC investigation revealed that AI chatbots like Google's AI and ChatGPT can be easily manipulated by publishing targeted content online, causing them to spread misinformation on critical topics such as health and finance. In response, Google has updated its spam policies to combat such manipulation, signaling increased efforts by AI companies to prevent abuse, though experts warn that manipulators often stay ahead and users should remain cautious about AI-generated answers.

https://www.bbc.com/future/article/20260519-google-tackles-attempts-to-hack-its-ai-results

Project Glasswing: What Mythos Showed Us

Project Glasswing involved testing Anthropic's Mythos Preview, a security-focused large language model (LLM), on Cloudflare's code repositories to identify vulnerabilities. Mythos Preview demonstrated advanced capabilities in chaining multiple low-severity bugs into exploitable chains and generating working proof-of-concept exploits, significantly improving the quality and actionability of vulnerability findings compared to previous models. Cloudflare noted the importance of using a tailored harness for narrow, parallel tasks and additional safeguards, as well as rethinking security workflows to handle faster detection while managing the complexity of patching and defense.

https://blog.cloudflare.com/cyber-frontier-models/

OpenAI’s GPT-5.5 Is as Good as Mythos at Finding Security Vulnerabilities – Schneier on Security

, ,

The UK’s AI Security Institute evaluated OpenAI’s GPT-5.5 and found that its capability to identify security vulnerabilities is comparable to Anthropic’s Claude Mythos model, with GPT-5.5 being generally available. This evaluation highlights the advancing role of large language models in cybersecurity, although discussions note limitations in reasoning and the potential plateau in detecting new attack classes without human input.

https://www.schneier.com/blog/archives/2026/05/openais-gpt-5-5-is-as-good-as-mythos-at-finding-security-vulnerabilities.html

Frontier AI Models Reap Rapid Discovery of Security Vulnerabilities

, ,

Frontier AI models, such as those tested by Palo Alto Networks under Project Glasswing, are accelerating the discovery of software security vulnerabilities, with 26 new common vulnerabilities recently disclosed compared to the usual five. While these AI tools offer potential for integrating security into the software development lifecycle, experts warn organizations have a limited three- to five-month window to leverage AI defensively before AI-driven exploitation becomes widespread.

https://www.cybersecuritydive.com/news/frontier-ai-rapid-discovery-security-vulnerabilities/820258/

Hackers Used AI to Develop First Known Zero-Day 2FA Bypass for Mass Exploitation

, ,

Google disclosed that hackers have used artificial intelligence to develop the first known zero-day exploit capable of bypassing two-factor authentication (2FA) for mass exploitation. The zero-day vulnerability, implemented in a Python script with characteristics of AI-generated code, targets a popular open-source web-based administration tool and demonstrates how AI models are accelerating the discovery and weaponization of software vulnerabilities.

https://thehackernews.com/2026/05/hackers-used-ai-to-develop-first-known.html

China Scrambles to Close AI Cyber Gap as Anthropic, OpenAI Surge with New Models

,

China is rapidly expanding its AI-driven cybersecurity industry to close the gap with US leaders like Anthropic and OpenAI, whose new models have advanced capabilities in discovering and exploiting cybersecurity vulnerabilities. According to IDC, China’s AI cybersecurity market is projected to grow from 1.58 billion yuan in 2025 to 59.35 billion yuan (US$8.7 billion) by 2030, driven by widespread adoption of AI technologies among domestic cybersecurity vendors.

https://www.scmp.com/tech/tech-trends/article/3352978/china-scrambles-close-ai-security-gap-anthropic-openai-pull-ahead-new-models

Critical Microsoft 365 Copilot Vulnerabilities Expose Sensitive Information

, ,

Microsoft disclosed and fully mitigated three critical information disclosure vulnerabilities in Microsoft 365 Copilot and Copilot Chat in Microsoft Edge, all classified with high confidentiality risks and affecting enterprise data access. These cloud-side flaws, discovered by Microsoft and an independent researcher, required no action from users or administrators as fixes were applied server-side, but organizations are advised to enforce least-privilege access to limit potential exposure of sensitive corporate information.

https://cybersecuritynews.com/microsoft-365-copilot-vulnerabilities-data/

We Scanned 1 Million Exposed AI Services. Here’s How Bad the Security Actually Is

A security scan of 1 million exposed AI services revealed widespread vulnerabilities and misconfigurations, with many instances running without authentication by default, leaving sensitive data and business logic openly accessible online. This insecure deployment, driven by the rapid adoption of AI technologies and pressure to deliver quickly, poses significant risks including data exposure, unauthorized access, and potential code execution, highlighting how AI infrastructure security is lagging dangerously behind its growth.

https://thehackernews.com/2026/05/we-scanned-1-million-exposed-ai.html

Critical Ollama Memory Leak Vulnerability Exposes 300,000 Servers Globally

,

A critical memory leak vulnerability named “Bleeding Llama” affects Ollama, a popular platform for running local AI models, exposing approximately 300,000 internet-facing servers globally. This flaw allows unauthenticated attackers to extract sensitive data directly from server memory by exploiting a weakness in processing uploaded model files, potentially leaking prompts, environment variables, and confidential information; users are urged to update to version 0.17.1 and secure exposed deployments immediately.

https://cybersecuritynews.com/ollama-vulnerability-exposes-servers/

Wiz Hands GitHub AI-aided Bug Report That Isn’t Total Slop

, ,

Wiz researchers discovered a high-severity vulnerability (CVE-2026-3854) in GitHub's git infrastructure that allowed remote attackers full read/write access to private repositories using a single command. By leveraging AI-augmented tools for automated reverse engineering, they rapidly identified the flaw, leading to GitHub issuing fixes within six hours and awarding Wiz one of the largest payouts in its bug bounty history.

https://www.theregister.com/2026/04/29/github_woah_a_genuinely_helpful/

Cursor AI Coding Agent Vulnerability Allow Attackers to Execute Code on Developer’s Machine

,

A high-severity vulnerability (CVE-2026-26268) in Cursor, an AI-powered coding environment, allows attackers to execute arbitrary code remotely on a developer’s machine by simply getting them to clone a malicious Git repository. The exploit leverages legitimate Git features—embedded bare repositories and Git hooks—triggering malicious scripts automatically without user interaction when the Cursor AI agent processes the repository, posing a significant risk to developer environments and organizational infrastructure.

https://cybersecuritynews.com/cursor-ai-coding-agent-vulnerability/

Bissa Scanner, An AI-Assisted Credential Harvesting Factory

, ,

An exposed server revealed a criminal operation exploiting the React2Shell vulnerability (CVE-2025-55182) to harvest credentials. The “Bissa scanner” operation used AI tools like Claude Code and OpenClaw to automate target scanning, credential extraction, and victim triage. The operation targeted credentials from various cloud providers, payment platforms, and databases, highlighting the risks of storing secrets in .env files.

https://thecyberexpress.com/bissa-scanner-ai-assisted-credential-factory/

Mozilla: Anthropic’s Mythos Found 271 Zero-Day Vulnerabilities in Firefox 150

,

Mozilla reported that Anthropic’s AI model Mythos Preview identified 271 security vulnerabilities in the unreleased Firefox 150 source code, significantly more than previous AI models. Mozilla’s CTO stated that AI tools like Mythos could decisively shift cybersecurity defenses by making vulnerability detection faster and more efficient, potentially transforming how software security is maintained.

https://arstechnica.com/ai/2026/04/mozilla-anthropics-mythos-found-271-zero-day-vulnerabilities-in-firefox-150/

All Vulnerabilities Are Exploitable: The New Reality of Software Risk

, ,

Javed Hasan, CEO and Cofounder of Lineaje, explains that rapid software evolution and AI-generated code have made all software vulnerabilities potentially exploitable, as automated tools can quickly create working exploits. He argues that traditional vulnerability management is outdated, urging organizations to adopt continuous security practices that assume every vulnerability can be weaponized, embedding security directly into development with automated governance to reduce risk in dynamic software environments.

https://www.cybersecurity-insiders.com/all-vulnerabilities-are-exploitable-the-new-reality-of-software-risk/

Fracturing Software Security With Frontier AI Models

,

Unit 42's research reveals that frontier AI models significantly enhance the ability to autonomously discover software vulnerabilities, accelerating the exploitation of zero-day and N-day flaws and enabling complex attack chains at unprecedented speed and scale. These advancements pose heightened risks to open-source software and software supply chains, as AI-driven attacks can rapidly identify and exploit vulnerabilities, necessitating stronger prevention, rapid patching, and automated incident response strategies for security teams.

https://unit42.paloaltonetworks.com/ai-software-security-risks/

Scroll to Top