AI Sec Watch

Threat actors are using three open-source AI agent frameworks (Strix for scanning, Cairn for exploitation, and Hermes for coordination) to automatically attack hundreds of online retailers, stealing over 600,000 credit card records and injecting skimmer malware (code that secretly captures payment card data) onto 119+ websites since at least July. The attacker gives the AI agents high-level instructions and lets them execute attacks autonomously at scale, with an average cost of only $25 per target and success rates varying across at least 27 compromised companies including major retailers and airlines.

IBM Financial Transaction Manager for RedHat OpenShift has a security flaw where unauthenticated attackers can inject malicious content into the AI agent's runbook database without needing a password or login credentials, allowing them to manipulate the AI into making unauthorized payments or stealing payment information through RAG poisoning (corrupting the external documents that an AI uses to answer questions).

OpenAI Academy is a training program launched in September 2024 that has reached over 4 million people with practical AI skills through workshops, online courses, and events called AI Skills Jams. The program is expanding through a new Community Trainer Program that prepares people in local organizations to teach AI training in their own communities, so more people have access to AI education and support where they live and work.

Microsoft is announcing an Integrated Security Operations Center (ISOC) in Microsoft Defender that combines SIEM (security information and event management, which collects and analyzes security data from across a network) and threat protection into one unified system. This design addresses the challenge that cyberattackers now use AI agents to automate attacks at massive scale, requiring defenders to operate faster by eliminating delays caused by separate, disconnected security tools. ISOC enables both human security teams and AI agents to work together using shared signals, context, and controls to detect threats, predict attacks, and respond in real-time.

Google has released Gemini 3.8 Flash TTS and Gemini 3.8 Flash-Lite TTS, two new text-to-speech models (AI systems that convert written text into spoken audio) that allow creators and developers to generate highly expressive custom voices with detailed control over performance, tone, and character. These models support over 100 languages, offer 2,000+ pre-made voices, enable voice replication from short audio samples, and allow line-by-line direction of how dialogue is delivered in applications like gaming, podcasts, and interactive media.

Attackers are planting fake content and malicious links across the internet, then using SEO (search engine optimization, techniques to make content rank higher in search results) to make sure AI chatbots like ChatGPT and Gemini pull this poisoned information when answering user questions. This allows them to spread disinformation and phishing attacks (scams designed to steal personal information) at scale through AI systems.

CLOSEDQUORUM is a Windows malware that uses a voting system from up to four AI models (DeepSeek, Qwen, Mistral, and Google Gemini) to decide what malicious actions to perform, such as stealing passwords and crypto wallet data, instead of taking orders from a traditional command-and-control server. The malware sends information about the victim's computer to the AI models and executes whatever action receives the most votes, with results posted to Discord. While Talos researchers discovered this malware and the public version does not currently work due to missing API keys and placeholder values, it represents an early example of attackers delegating attack decisions to AI services.

Check Point has released a new Workforce AI MCP (Model Context Protocol, a standard for connecting AI systems to external tools), which allows security managers to query and manage employee AI usage policies using natural conversation instead of navigating complex menus and settings. Instead of manually checking individual rules, users can now ask simple questions in plain language, like which security rule applies to a specific employee, and can create or update policies through conversational requests.

OpenAI announced it will give Ukraine's government access to its Daybreak program, an AI tool that helps cyber defenders find and fix software vulnerabilities (weaknesses in code that attackers can exploit) more quickly. Ukraine faces thousands of cyber attacks yearly targeting hospitals, energy systems, and communications, so this tool aims to help protect critical infrastructure that citizens depend on.