MIDS student Sunil Thakur shared his thoughts about building an enterprise governance framework that'll keep up with the speed of AI innovation. "Risk, compliance, and security define the boundaries within which innovation can safely operate," he wrote.

Building an AI Governance Framework for the Enterprise

From Trusted Data to Autonomous Operations

medium.com

Joe Security researchers look into ToxNetV2, an AArch64 Linux peer-to-peer botnet that integrates an LLM into the operational workflow of its controller. joesecurity.org/blog/6764463...

A secure LLM system cannot be given write access to any important endpoints. That's the basic first principle of AI security at the moment. thecybersecguru.com/news/instagr...

Instagram Meta AI Vulnerability: How Hackers Bypassed 2FA with Prompt Injection | The CyberSec Guru

A critical Meta AI vulnerability on Instagram allowed hackers to bypass 2FA and hijack high-value OG accounts. Discover how the exploit worked

thecybersecguru.com

My comment in @reuters.com on a “test” of AI that crossed a remarkable line. AI agent attempted a real software supply-chain attack, then used deception against a developer who caught it. This crossed the line from autonomous hacking to interactive deception. www.reuters.com/world/how-te...

Binary rules won't fix scraping. @virtualroutes.bsky.social European #cybersecurity fellow Elisa Chiapponi argues for risk-based governance: weighing scale, intent, and downstream use, while keeping anti-bot defences proportionate and transparent. bindinghook.com/balancing-se...

Balancing security and privacy in the battle against AI scraping

As generative AI reshapes how data is collected online, regulators face a difficult question: how can we protect websites without compromising user trust and privacy?

bindinghook.com

HCL shipped an MCP server for BigFix. You can point an LLM at the platform that patches your fleet. The security engineering is good. The defaults are not, and the defaults are what ships. 🌐 caseycannady.com/blog/they-di...

US case in which plaintiff tried to trick the court into issuing a judgment in his favour using AI prompt injection in his filings - lnkd.in/p/ejAmhP7b

Prompt injection decision | Jakob Plesner Mathiasen

New decision on AI prompt injections in court documents We have seen several cases where (unintentionally) the use of AI has gone wrong in court and arbitration proceedings. Lawyers have used AI whi...

lnkd.in

🤖🔐 AI is changing how we code, let’s make sure it doesn’t change how we break it! Join Jim Manico on Nov 4 for hands-on training in secure AI-assisted development with Claude Code & Codex. 🎟️ Register: owaspglobalappsecusa... #GlobalAppSecSanFran26 #OWASP #AppSec #AISecurity

“Calling such behaviour ‘rogue’ seems misguided” www.nature.com/articles/s42...

Agentic AI and cybersecurity, the story so far - Nature Machine Intelligence

Frontier large language models (LLMs) have rapidly developed from helpful coding assistants to highly capable cybersecurity systems. After several security incidents in the past few months, more overs...

nature.com

ChatGPT prompts show how an expert witness report was created in a $61 million lawsuit over an explosion that killed three people. www.404media.co/show-how-3m-...

‘Show How 3M Is 0% at Fault:’ Expert Witness Used ChatGPT to Write Report Defending Company in Deadly Explosion Lawsuit

ChatGPT prompts show how an expert witness report was created in a $61 million lawsuit over an explosion that killed three people.

404media.co

Palomar outsources truth-verification of math to an LLM performing "non-deterministic" semantic checks, then calls the result a registry instead of what it is: pre-training data for the next proof-generating model.

Palomar – a registry of Lean verified mathematics

In recent months there has been a proliferation of AI-generated proofs of various old and new results, some of which have been formalized in the proof assistant language Lean. However, checking tha…

terrytao.wordpress.com

"Demir stood his ground and the sabotage attempt was thwarted. The 24-year-old [...] figured he had caught a wily hacker [...]. So he said he was shocked when Britain's AI Security Institute (AISI) got in touch to tell him that [...] an autonomous artificial-intelligence agent that had run amok."

EXCLUSIVE: How a Texas student blew the whistle on a rogue AI hacking attempt

Sinan Can Demir wanted to spend the last week of July burnishing his resume. Instead, he engaged in a battle of wits with an artificial-intelligence agent unleashed by a British government lab.

reuters.com

Grok Bot, Claude Tag, and Hermes Bot Mode are making AI agents persistent. Before you call one a coworker, check what it remembers -- and what it can access.

Grok, Claude, and Hermes agents get job titles -- and persistent permissions

Grok Bot, Claude Tag, and Hermes Bot Mode are making AI agents persistent. Before you call one a coworker, check what it remembers -- and what it can access.

bit.ly

When access to Claude Mythos was suspended by the US govt months back, I asked the GCSB for information about dependency on foreign LLM providers They just got back saying that doing so would "provide an untenable degree of insight" into their methods and capabilities fyi.org.nz/request/3495...

Mythos/Fable Revocation Response - a Official Information Act request to Government Communications Security Bureau

I am interested in requesting the following information regarding the recent export control directive issued by the US government in regards to Anthropic's Mythos/Fable 5 models: 1. Any type of risk ...

fyi.org.nz

Today, the NCSC has published a new blog post on managing the cyber risk from agentic AI. The advice supports system designers and operators to make informed decisions as AI cyber security continues to evolve. Read it now: https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai

If you are an expert witness, do not use ChatGPT to write the report you are charging $475/hour for. All of your chat prompts are subpoenable and we are all going to laugh so hard. www.404media.co/show-how-3m-...

‘Show How 3M Is 0% at Fault:’ Expert Witness Used ChatGPT to Write Report Defending Company in Deadly Explosion Lawsuit

ChatGPT prompts show how an expert witness report was created in a $61 million lawsuit over an explosion that killed three people.

404media.co

Grok exfiltrates user data when malicious instructions are encrypted arstechnica.com/security/202...

Grok exfiltrates user data when malicious instructions are encrypted

Cryptographic Context Injection is only the latest way to break an LLM safety guardrail.

arstechnica.com

New, from the 🇬🇧 NCSC: Managing the cyber risk of agentic AI; Use safeguards, sandboxing and active oversight to realise the benefits of autonomous systems while limiting the unintended activity. www.ncsc.gov.uk/blogs/managi... #CyberSecurity @gate15.bsky.social @campuscodi.risky.biz

Managing the cyber risk of agentic AI

Use safeguards, sandboxing and active oversight to realise the benefits of autonomous systems while limiting the unintended activity.

ncsc.gov.uk

This is the part most AI policies skip. Rules get written for the employee, never with them, and then everyone acts surprised when the workaround shows up in week two. A policy people helped write is a policy people follow. The rest is a document to be cited after an incident.

Val Potter@wordwrangler.bsky.social · 2w ago

A lot of companies have AI policies that lay out approved tools and usage guidelines. But how many ask their employees what they want or include worker protections in those policies? Here are some key steps to building an AI policy everyone can agree on.

I stole an Outlook password with nothing but CSS inside an email 👀 Whitepaper below 👇 This video is from my research "CSS: the bomb inside your inbox". Whitepaper & slides: portswigger.net/research/css...

The detail worth sitting with: the assistant did exactly what it was told. No exploit chain, no privilege escalation, just instructions arriving through a channel nobody was inspecting. Enterprise AI risk keeps turning out to be an input problem, and inputs are only controllable where they enter.

HackerNoon@hackernoon.com · 2w ago

RovoBlast shows how a single crafted link could abuse Atlassian Rovo to access enterprise data, highlighting the risks of AI prompt injection and agent autonomy #aiagentsecurity

Around 60% of surveyed London employers report substantial use of approved generative AI tools, while informal "shadow AI" is also widespread. But governance, workforce engagement and training are developing much more slowly than adoption itself.

During a UK AI safety eval, Anthropic's Mythos 5 autonomously opened a malicious PR, created fake personas, and emailed maintainers with malware. 19 unsanctioned live-Internet actions across 7 models. Treat AI-generated PRs as adversarial.

Anthropic’s AI used fake identities, malware in rogue attack on GitHub project

Four Signals — The Wire

foursignals.dev

Everyone wants to eliminate Shadow AI. I'd rather understand it. Employees don't adopt AI because they're reckless. They adopt it because they're trying to solve real problems. sherryheyl.substack.com/p/s...

Shadow AI Isn't Just a Security Issue. It's a Leadership Issue.

A few years ago, most employees had ideas about how to improve their work.

sherryheyl.substack.com

Read and share this if you care about brand integrity and cybersecurity searchengineland.com/prompt-injec...

How prompt injection puts your brand and AI workflows at risk

Prompt injection attacks put your customers, AI agents, LLM referral share, and vendor stack at risk. Here’s where the threats are emerging.

searchengineland.com

Fairly sober testing report from the AI Security Institute: they gave internet access and removed some guardrails from latest AI models and found without them they were capable of potentially harmful activity directed at real people and organisations www.aisi.gov.uk/blog/inciden...

AISI incident report: "this is the first time we have seen risks around autonomy and deception manifest this clearly, without specific prompting, in the real-world." www.aisi.gov.uk/blog/inciden...

Guidelines for Article 50 of the EU AI Act clarify who counts as a "provider" versus a "deployer," and exactly what each has to disclose. #eu #aiact #regulation #europe #governance #politics #ai #tech

EU AI Act Article 50 transparency rules enter force

Article 50 of the EU AI Act has entered into force, setting transparency obligations for AI providers and deployers operating across the bloc.

artificialintelligence-news.com

-Russia is behind the recent hotel WiFi hacks -Anthropic models also did the hacky-hacky -npm adds publish-time malware scanning -Coldcard hacked for $70m -CyberCom to open Silicon Valley office -Iran water hacks impacted seven states P: risky.biz/RBNEWS595/ N: news.risky.biz/risky-bullet...

A new compliance control used to mean a quarter of policy authoring and framework mapping before a single rule enforced anything. AI governance hit that same desk on that same timeline. Meanwhile the regulated data is already in the prompt box. Prebuilt and enforced beats author-from-scratch.