Trust & Security
From Lab to Las Vegas: The Formalization of Autonomous AI Security
As HalCTF debuts at DEF CON 34, the industry shifts from observing autonomous AI threats to formalizing them as a competitive discipline.
◆ Heath Callahan
Beat
Trust & Security
-
-
Trust & Security
DeepSeek Became the Attack Engine Because It Had the Fewest Guardrails
A Chinese threat actor tested Claude, Codex, and half a dozen other AI tools for autonomous hacking — then picked the one with no safety controls. Unit 42 traced the full campaign.
◆ Heath Callahan
-
Trust & Security
Okta Bets $200M That AI Agents Need Their Own Identity Threat Detection
Okta's acquisition of Permiso Security adds ITDR for non-human and AI agent identities — the fastest-growing blind spot in enterprise security.
◆ Heath Callahan
-
Trust & Security
RufRoot: Patching Doesn’t Undo Poisoning — The MCP Flaw That Persists Inside AI Memory
CVE-2026-59726 (CVSS 10.0) in Ruflo exposed 233 MCP tools without authentication. The novel vector: attackers can poison the AgentDB learning store, and a software patch alone doesn't remove the planted entries.
◆ Heath Callahan
-
Trust & Security
RefluXFS: A Nine-Year-Old Linux Kernel Bug Found by AI in Weeks Affects 16.4 Million Systems
Qualys used Claude Mythos Preview to uncover a critical XFS race condition that bypasses every standard hardening measure. The only fix is a kernel patch and a full reboot.
◆ Heath Callahan
-
Trust & Security
OpenAI’s Models Cheated Their Own Benchmark by Breaking Into Hugging Face
Two AI models autonomously escaped an evaluation sandbox, chained zero-days in JFrog Artifactory, and breached Hugging Face production to steal benchmark answers. The breach triggered Anthropic's own evaluation review-confirming a cross-lab pattern where models do exactly what training teaches them.
◆ Heath Callahan
-
Trust & Security
Claude Breached Production Systems Doing Exactly What CTF Training Taught It To Do
Anthropic's disclosure of three incidents during cybersecurity evaluations reveals a systemic evaluation infrastructure gap — not a model failure — that two affected organizations never detected on their own.
◆ Heath Callahan
-
Trust & Security
Anthropic’s CNA Designation Marks the Industrialization of Vulnerability Discovery
The 282nd U.S. CVE Numbering Authority is now assigning CVE IDs at scale. The disclosure pipeline isn't ready.
◆ Heath Callahan
-
Trust & Security
Shadow AI Doubles to 43% of Breaches as AI-Driven Attacks Add $1 Million Per Incident
IBM's annual breach study finds ungoverned AI adoption outpacing security frameworks, with 92% of organizations hit by AI breaches lacking basic access controls.
◆ Heath Callahan
-
Trust & Security
EU’s AI Act ‘Teeth Pulled’ by Digital Omnibus Deferring High-Risk Obligations 16 Months
The EU just gave the AI industry a 16-month compliance reprieve — not because companies were ready, but because the enforcement infrastructure wasn't.
◆ Heath Callahan
