AI Sec Watch

In May 2026, overall cyber-attack numbers dropped slightly month-over-month, but ransomware (malware that locks files and demands payment to unlock them) surged 48% compared to the previous year, and AI-powered risks to data security continued growing. Security researchers warn that the temporary decrease in total attacks doesn't mean organizations are actually safer, since threats are shifting toward more damaging methods.

Apple announced several AI features at its WWDC conference that largely replicate capabilities already available in competitors' products, such as chatbots for questions, text creation and summarization tools, and image generation. The company's main pitch is delivering these existing AI features to iPhone and iPad users rather than introducing genuinely new AI innovations.

This article discusses Donald Trump's push for AI growth in the US and highlights a contradiction where Anthropic, an AI safety company, is advocating for a pause on AI advancement while simultaneously filing to go public on the stock market. The piece covers various AI-related developments including OpenAI's public offering plans, Apple's new AI features, and concerns about the rapid expansion of AI datacenters.

AI-powered coding tools prioritize speed and ease of development over security, often resulting in apps with unprotected identities and known vulnerabilities. Atsign's AI Architect product addresses this by making all identities invisible to attackers through cryptographic protection (using advanced encryption to hide identities), so even if vulnerabilities exist in the code, attackers cannot exploit them because they cannot identify the resources to attack.

Apple announced new AI features at its developer conference, claiming they are more private than competitors' AI systems. The company promises that its cloud processing (AI tasks handled on remote servers) is as private as on-device processing (AI running directly on your device), even though some tasks will now run on Google's servers.

Apple announced updates to its voice assistant, including a redesigned Siri AI with new voices and conversational abilities, while also confirming partnerships with Nvidia and Google to run some AI features on their chips. OpenAI filed confidentially with the SEC for a potential initial public offering (IPO, the process of a private company becoming publicly traded), joining other tech companies preparing to go public. The Agriculture Department confirmed additional cases of screwworm in Texas, a pest the U.S. had previously worked to eliminate.

Nextdoor engineers use Codex (an AI coding assistant) to shift from writing code step-by-step to focusing on desired outcomes, allowing individual engineers to build features end-to-end across multiple platforms rather than specializing in one system. This productivity boost has made engineering faster, so the main bottleneck is now deciding what to build strategically rather than how to build it. Codex also helps with debugging complex issues in systems like Rust databases and Kubernetes by persistently investigating problems and finding root causes.

Researchers at the University of Toronto created a proof-of-concept AI worm that uses a locally hosted open-weight LLM (large language model, an AI trained on broad text data and released publicly) to autonomously explore networks, generate custom attacks for each target, and replicate itself without human help or relying on commercial AI services. Unlike traditional worms with fixed exploits that stop spreading when patched, this worm generates new attack strategies at runtime by reasoning about what it finds on each host, successfully compromising about 62% of a test network in seven days. The worm's ability to read newly published vulnerability advisories means that patching known bugs alone cannot stop it, since the AI can discover and exploit new attack paths that weren't in its training data.

Cybercriminals are increasingly using AI-themed social engineering (manipulating people into revealing sensitive information or taking harmful actions) to distribute malware, steal credentials, and commit fraud by impersonating popular AI platforms like ChatGPT and Claude. Both Microsoft and Google have documented how attackers are adapting traditional phishing (deceptive emails/messages designed to steal information) and impersonation tactics to exploit employees' growing use of AI tools and cloud services, rather than developing entirely new attack techniques. Security researchers warn that the threat has shifted from technical vulnerabilities to the human layer, where employees' trust and behavior become the target.