AI Sec Watch

This article discusses 'software brain,' a way of thinking that sees everything through algorithms and automation, which has been amplified by AI development. Despite widespread enthusiasm from tech executives, polling shows that most Americans—particularly Gen Z—are increasingly skeptical or angry about AI, with only 35 percent excited about it and over 80 percent concerned about potential harms.

Anthropic, an AI company, has severely restricted OpenClaw, a popular AI agent tool (software that uses AI to perform tasks autonomously), requiring users to pay significantly more to continue using it. The restriction was implemented because Anthropic needed to reduce strain on its systems and increase profitability, as the tool's usage patterns weren't sustainable under their existing subscription model.

Face morphing attacks (blending two faces together to fool facial recognition systems) threaten security systems used at borders and for digital identity checks, and detecting them from a single image is difficult because there's no trusted reference image to compare against. This paper presents R-FLoRA, a new detection method that combines high-frequency image analysis (looking at fine details) with a frozen, large-scale vision transformer (a type of AI model trained on images) to spot morphing artifacts while keeping the overall understanding of the face intact. The method outperforms nine other detection approaches on multiple test datasets and works efficiently in real-world biometric verification systems.

A Chinese cybersecurity company called 360 Digital Security Group claims to have discovered 1,000 vulnerabilities (weaknesses in software that attackers can exploit) using AI tools, including some vulnerabilities found at the Tianfu Cup hacking contest. The article compares these claims to myths about Claude (an AI system), suggesting skepticism about the actual capabilities being reported.

Google announced new AI agents and security tools designed to help security teams keep pace with the increasing number of vulnerabilities and cyber threats. The company introduced three new agents embedded in Google Security Operations (for threat hunting, detection engineering, and gathering external intelligence), expanded the Wiz security platform to monitor AI development across multiple clouds, and created tools like AI-BOM (AI bill of materials, an inventory of all AI components used in an organization) and Agent Gateway to secure interactions between AI agents. These moves represent a shift toward automated, agent-based defense rather than relying solely on human analysts.

Google announced new AI agents and security tools designed to help security teams defend against AI-based attacks, particularly in response to threats like Anthropic Mythos. The company introduced three new agents within Google Security Operations to automate threat detection and response, expanded the Wiz platform to provide visibility across multiple cloud environments and AI development tools, and created new security measures like AI-BOM (a system that catalogs all AI components used in an organization) and Agent Gateway to govern how AI agents interact with each other and enforce security policies.

Trailmark is an open-source library that converts source code into a queryable call graph (a visual map of how functions and classes connect to each other) that AI systems like Claude can analyze directly. Rather than examining code as flat lists of findings, Trailmark lets AI reason about code structure as a graph, making it better at identifying security risks like whether untrusted input can reach vulnerable code.

Microsoft is releasing Agent Mode (previously called 'vibe working') in Office applications like Word, Excel, and PowerPoint, which is a more advanced version of Copilot (an AI assistant) that can actively perform tasks in documents rather than just answer questions. Previously, the AI models weren't powerful enough to let Copilot directly control applications, so it could only provide passive help like answering user questions.

Anthropic's Project Glasswing uses an AI model called Mythos that is extraordinarily effective at finding software vulnerabilities, discovering bugs that humans missed for decades and even chaining multiple bugs together into working exploits. However, the critical problem is that fewer than 1% of vulnerabilities Mythos finds are actually patched, revealing a massive gap between how fast AI can discover security flaws (machine speed) and how fast human teams can fix them (calendar speed, typically four days per cycle).