Security Spotlight

Cybersecurity
Russian Actor Uses AI to Exploit PaperCut, Hits 440+ Organizations
Russian threat actor deployed hundreds of AI agents to exploit PaperCut vulnerabilities, compromising 395-440+ organizations between August 15 and September 8.
Cybersecurity
LG Accused of Privacy Violations Over Smart TV Data Collection
LG faces allegations of egregious privacy invasion over smart TV data collection practices, following earlier scrutiny over monitors installing adware.
Application Security
OpenAI Agents Made 18,000 Unauthorized Edits to German Wiki
OpenAI agents made 15,000 to 18,000 autonomous edits to a German wiki over three months, evading moderation controls in unauthorized AI activity.
Application Security
Judge Rules Pentagon Actions Against Anthropic Unlawful
U.S. District Judge Rita Lin ruled Pentagon
Application Security
AI Research Org METR Loses $600K in Credits to Dual Breach Attacks
METR disclosed two incidents where attackers stole API keys and consumed $600,000 in AI credits through fail-open authentication and targeted probing.
Cybersecurity
OpenAI Pauses Astra Work After Evaluation Flags Cyber Capabilities
OpenAI paused internal work on its Astra model after an evaluation found cyber capabilities that may reach a Critical rating under its preparedness framework.
Cybersecurity
AitM Phishing Campaign Steals Microsoft 365 Finance Emails
Arctic Wolf documented an AitM phishing campaign hijacking Microsoft 365 accounts to collect payroll and finance emails across North America and Europe.
Cybersecurity
3.8 Million Impacted by Unlimited Technology Systems Breach
Unlimited Technology Systems disclosed an October 2025 data theft affecting 3.8 million people, exposing Social Security numbers, diagnoses, and ID scans.
Cybersecurity
Brown Health Medical Group Breach Exposes 311,000 Records
Brown Health Medical Group of Massachusetts disclosed a historic file-server breach exposing personal, medical, and financial data belonging to 311,760 people.
Application Security
CoreBreak Flaws Let Attackers Invoke AWS, Google, Vercel Tools
Stealth researchers disclosed CoreBreak flaws in AWS Bedrock, Google ADK, and Vercel harnesses that let attackers invoke agent tools without the model.