Latest cybersecurity reporting from selected sources.

Microsoft Threat Intelligence identified a prompt injection pathway in Claude Code GitHub Action that allowed access to workflow secrets under specific conditions. This research examines the attack chain, responsible disclosure process, Anthropic's mitigation, and guidance for securing AI-powered CI/CD workflows. The post Securing CI/CD in an agentic world: Claude Code Github action case appeared first on Microsoft Security Blog.

A surge in real-world attacks against agentic AI systems is reshaping how we think about risk. Based on 12 months of red teaming, this update introduces seven new failure modes, from supply chain compromise to goal hijacking, and the practical mitigations teams need now. The post Updating the taxonomy of failure modes in agentic AI systems: What a year of red teaming taught us  appeared first on Microsoft Security Blog.

Severity and Reachability Metrics Also Essential for Mythos-Era Bug MitigationIf there's one thing artificial intelligence has done, it's multiply bugs, and the annual CVE Program count of new vulnerabilities is set to break records. Less apparent is how many of those AI-ferreted vulnerabilities can be turned into high-impact exploit chains - if they're exploitable at all.

Litellm PyPI breach explained: malicious versions steal cloud credentials, SSH keys, and Kubernetes secrets. Learn impact and urgent mitigation steps.

Is AI Exposing a Growing Vulnerability Risk Mitigation Gap?AI-fueled tools can help to identify medical device vulnerabilities much faster and at a higher volume than more traditional tools. But can device manufacturers and healthcare delivery organizations keep up with prioritizing and addressing a tidal wave of newly discovered flaws?

ServiceNow's Neeraj Jain on Risk Mitigation and Real-Time Data Access for AI AgentsEnterprises that embed governance from intake to deployment scale AI faster than those that bolt it on afterward. Clear frameworks mitigate risk, ensure compliance and increase operational efficiency, says Neeraj Jain, director of product management, hyperscalers and multi-cloud at ServiceNow.

Nonprofit Foundation Holds Equity, Oversight Around $130B For-Profit CorporationThe nonprofit OpenAI Foundation now controls a $130 billion for-profit arm after a recapitalization process approved by attorneys general in California and Delaware. The nonprofit retains governance authority and will fund global health and AI risk mitigation programs, backed by regulatory approval.

Context-Driven Insights, Automation Fuel Faster, Clearer Decisions for Cyber TeamsWith its acquisition of San Francisco-based startup Fletch, F5 is embedding agentic AI into its security platform to automate threat detection and response. The technology provides real-time context, filters irrelevant alerts and helps security teams prioritize urgent risks and mitigation tasks.

Apex Security Detection Tools Help Tenable Spot Accidental and Malicious AI MisuseTenable is acquiring Israeli startup Apex Security to extend AI security features that go beyond asset discovery. With user-level controls and risk mitigation for AI usage, Tenable aims to accelerate its exposure management roadmap by integrating Apex into Tenable One later this year.

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has tagged a Langflow remote code execution vulnerability as actively exploited, urging organizations to apply security updates and mitigations as soon as possible. [...]

Series B Investment to Boost AI, Expand Coverage Across IaaS, PaaS, SaaS, On-PremData security startup Sentra has raised $50 million to expand its AI-powered classification, labeling and enforcement capabilities. With enterprise interest in secure AI adoption and risk mitigation rising, the firm will grow its team and expand support for cloud, SaaS and on-prem data governance.

Deal Adds Natural Language, Multi-Agent RAG Tech to Autonomous Security PlatformTorq’s acquisition of Revrod gives it a strategic leap in autonomous security operations. The startup's multi-agent retrieval-augmented generation engine enables smarter, faster threat detection, triage and mitigation without heavy manual workflows.

Max Payout for Bug Bounty Program Up From $20,000 to $100,000OpenAI announced a cybersecurity initiative that aims to improve the resilience of its artificial intelligence systems by rewarding the discovery of critical vulnerabilities and improving threat mitigation. OpenAI raised the maximum payout for its bug bounty program from $20,000 to $100,000.

NIST has urged more research and emphasis on developing mitigations for attacks on AI and ML systems

Anthropic says its Constitutional Classifiers approach offers a practical way to make it harder for bad actors to try and coerce an AI model off its guardrails.

E-waste From Gen AI Hardware May Equal 2.5M Tons Per Year by 2030The technology powering chatbots could increase electronic trash by a thousand times by the end of the decade, warn researchers. The researchers from the Cambridge University and the Chinese Academy of Sciences suggest mitigation methods that could cut the e-waste by up to 86%.

Agency Details AI Cybersecurity Risks, Prevention, Mitigation StrategiesFinancial regulators with the state of New York on Wednesday published guidance to help organizations identify and mitigate cybersecurity threats related to artificial intelligence. The New York State Department of Financial Services said it's not imposing new requirements.

AI, Security Experts Discuss Who Defines the Risks, Mitigation EffortsAn attempt by the California statehouse to tame the potential of artificial intelligence catastrophic risks hit a roadblock when Governor Gavin Newsom vetoed the measure late last month. One obstacle is lack of a widely-accepted definition for "catastrophic" AI risks.

Experts Recommend Multimodal Biometrics as Mitigation Strategy for AI-Based AttacksWhile AI has spurred the growth of authentication controls, it has also enabled voice cloning and video deepfakes to become much more convincing. Fraud fighters are looking at adopting a multifactor authentication system using multimodal biometrics to fight against deepfakes.

Nations to Jointly Develop Evaluation Mechanisms and Risk Mitigation GuidesThe United States and the United Kingdom signed a landmark artificial intelligence agreement on Monday to work together to develop tests for the most advanced AI models and share research capabilities. The countries also committed to developing similar partnerships with other nations.