Industry news
New tools, products, platforms, funding rounds, and company developments in AI security.
New tools, products, platforms, funding rounds, and company developments in AI security.
6,022 items
AWS has released aws-emulator, an official local emulator for its services so tests can run without a paid API key. Swaminathan (Swami) Sivasubramanian describes its origins in a guest post on Werner Vogels' blog. The source reports it is written in Rust, with 29,684 commits in its first three weeks, and currently requires Docker on macOS or Windows.
Simon Willison added tag-based browsing to tools.simonwillison.net, his collection of 244 vibe-coded tools. He used tree-sitter to analyze each tool's code and extract the JavaScript APIs, libraries and web API hosts it uses, and the homepage now shows tag clouds for those categories. The post is a link-blog entry dated 11th November 2026.
llm 0.37.2 fixes a security issue reported by Daniel de Araujo under GHSA-v9h7-jj4g-f862 and GHSA-r639-rr7r-x72w. The flaw could accidentally send a configured OpenAI API key to a third-party OpenAI-compatible endpoint configured through extra-openai-models.yaml or the llm openai endpoint add command. It could occur if the key named by api_key_name had never been stored, or if a responses: true model was run with -o chat_completions 1.
Arctic Wolf Labs reports that attackers have used AntiFox, an AI-driven autonomous penetration testing platform available on GitHub, in intrusions that stole AWS credentials and moved laterally. The activity chained web exploitation and ASPX web shell deployment through the IIS worker process (w3wp.exe) with AWS API enumeration, including Secrets Manager access, and the precise vulnerability used for code execution on the IIS server is not known.
Attackers hosted self-managed instances of AntiFox, an open-source agentic penetration testing platform forked from ARTEX 0.1.1, on Alibaba Cloud to exploit web services and AWS environments. Arctic Wolf observed the infrastructure using valid AWS IAM users and assumed EC2 roles to make authenticated API calls, harvesting production secrets and reading, copying, and deleting S3 objects in some intrusions.
Anthropic began its IPO roadshow, and a roadshow video reportedly covers its approach to compute, with co-founder Tom Brown describing how Claude runs across AWS Trainium, Google TPUs, NVIDIA GPUs and AMD GPUs. In the transcript, Anthropic says it got Claude running on AMD GPUs in three days with almost no human intervention, with Claude porting or writing nearly all the kernels. The transcript was extracted by the poster with MacWhisper, not taken from an official transcript.
Researchers at Google DeepMind have unveiled AlphaGenome 2, a new AI model designed to show how changes in DNA affect different cells. It succeeds AlphaGenome, released last year, and aims to help scientists understand the causes of disease and point toward new treatments.
MIT Technology Review's weekly newsletter, The Download, covers several items, including six ideas for preserving the mind beyond death and a podcast on whether open AI models' benefits outweigh their risks. The open-model piece says Anthropic released a report arguing that a powerful model from Z.ai poses a major cyberattack risk because it is freely downloadable and modifiable. The source text is a newsletter digest rather than a single article, so the summary reflects only the portion that addresses AI security.
Microsoft Research describes Lazarus, a technique that rewrites fewer than 10 dormant neurons in an open-weight model's final feed-forward layer so the model emits attacker-chosen commands when a trigger appears, with no retraining. Tested on Nvidia's Nemotron-Terminal-8B by modifying seven of more than 12,000 neurons, the backdoor fired in at least 98.8% of held-out trigger scenarios and stayed inactive on benign inputs. The attack requires write access to the model checkpoint.
Claroc found 37,571 apps built with Grok, and 35,578 of them were open to anyone without a sign-in. The open apps included internal data from 30 organizations the researchers could identify, along with 24 apps built by staff at X and SpaceXSI, which have since been taken down. The researchers say Grok's default access setting, "Anyone with the link", was already selected when they published their test apps.
Fortinet released 89 new security advisories addressing nearly 100 vulnerabilities across its products, about 17 of them critical. The critical flaws affect FortiMail, FortiAuthenticator, FortiOS, FortiManager, FortiAnalyzer, FortiSASE and FortiClient, and several could allow arbitrary code execution. The FortiClient flaw, named Fortinet2Shell, is exploitable when FortiPAM is enabled and stems from a CORS misconfiguration.
Fix: Customers should upgrade to the patched versions described in Fortinet's PSIRT advisories.
SecurityWeekThree men, Jacob Soall, Sharon Hazan, and Guy Sheetrit, were arrested for using AI to alter and impersonate the voices and images of executives and attorneys. Soall and Hazan were arrested in Spain, and Sheetrit in the United Kingdom, according to a press release from the United States attorney's office for the southern district of New York. The alleged fraud, which took place between 2024 and 2026, stole more than $129m from companies worldwide, including in the US.
Token built Rehearsal, a browser agent that runs inside a user's authenticated session and acts with the user's reach, and found that applications cannot tell the agent, its delegation or its task scope apart from the user. Because Token controls both the agent and the app, it can dim and lock the application, log every session move, and restrict Rehearsal to read-only dashboards that need user approval for saves. The article argues that broader fixes require agents to have their own lanes, pointing to browser controls, WebMCP tool declarations and Web Bot Auth request signing.
GitGuardian found 31,088 distinct secrets in Claude Code's .claude/settings.local.json files across 23,276 public GitHub repositories, with 5343 still valid when detected. Claude Code saves the full command string, credentials included, when a developer selects "Yes, and don't ask again," and Docker images built with COPY .. also carried such files, with 613 distinct secrets found in public Docker Hub images.
Tel Aviv-based Bay emerged from stealth with $50 million in funding, including a $37 million Series A led by Battery Ventures and $13 million in seed funding led by YL Ventures and Striker Venture Partners. The company was founded in February 2026 by three former IDF Unit 8200 officers and offers a control plane that discovers, monitors and governs AI agents, MCP servers and related components, with an Enforcer component that allows, refers, redirects or denies agent actions in real time.
VicOne LAB R7 shows that robots can act on manipulated inputs while following their safety rules, and that safety functions depend on sensor readings, estimates and stop signals that can be wrong or spoofed. The blog cites research on adversarial images against vision-language-action models and reports its own tests in which text on a poster changed a robot dog's movement and inaudible crafted audio changed a hospital robot's simulated behavior. It recommends testing adversarial scenarios before deployment and revisiting safety evidence as software, models, sensors and conditions change.
Heather Adkins, Gadi Evron, and Bruce Schneier proposed VulnOps, a model in which AI-assisted vulnerability research and remediation become scalable, automated, and built into enterprise operations. Since then, the Cloud Security Alliance has developed an operating VulnOps model, and SANS has published implementation guidance and plans training. Experts debate whether VulnOps is a genuinely new discipline or a rebranding of vulnerability management.
OpenAI has offered veterans and transitioning servicemembers a free year of ChatGPT Plus, and more than 20,000 have claimed it. The company also runs OpenAI Academy training with community partners, reaching nearly 1,000 members of the military community so far, with seven more sessions planned before the year ends.
Microsoft researchers showed that an AI model can be backdoored by editing fewer than 10 rarely used neurons, without retraining. When a chosen trigger appears, the model outputs an attacker's command, which an agent using the model would run with the agent's own permissions, so the damage depends on what the agent is allowed to do. The attacker must be able to change the model's weights, and the researchers call the method Lazarus.
A large request to GLM-5.3 on Cloudflare Workers AI could return another tenant's inference content instead of an answer, a flaw traced to upstream SGLang and since fixed by Cloudflare. vLLM received three October advisories covering remote code execution, a route to pickle.loads(), and a denial of service from a single request.
Fix: Fixed in llm 0.37.2.
Simon Willison's WeblogFix: Arctic Wolf recommends correlating IIS webshell activity with unusual AWS access, reviewing successful API calls within bursts of denials, revoking affected AWS sessions and keys, and rotating credentials exposed through application files.
BleepingComputerFix: In its accompanying security advisory, Microsoft Threat Intelligence recommends auditing model weights bef
CSO OnlineFix: Token's steps for its own agent: while the agent moves, dim and lock the application and indicate who has control; record every move for each session, including blocked ones; reduce the agent's reach below the user's, keeping dashboards read-only, requiring user approval before saving, not filling secret fields, and never sending calls the platform refused. For the wider web, the source describes emerging standards (Chrome auto-browse approval and site limits, Microsoft per-site agentic browsing controls, the WebMCP draft, and Web Bot Auth) but does not state them as a complete fix.
The Hacker NewsFix: Developers must rotate exposed credentials, remove sensitive configuration files from both Git and Docker build contexts, and check previously published images for lingering secrets. GitGuardian recommends treating AI coding assistant configuration files as potential secret-bearing assets, scanning them alongside conventional environment files, and using environment variables rather than hardcoding credentials into commands.
CSO OnlineFix: Teams can test adversarial scenarios before deployment and revisit the evidence as software, models, sensors, and operating conditions change.
VicOne BlogFix: Fixed by Cloudflare for the Workers AI issue, per the source. The source does not state a fix or workaround for the three vLLM advisories.