Louis Columbus

Stolen credentials produced valid Sigstore certificates, clearing 633 malicious npm packages — one of seven developer tool attack surfaces that failed.

Credential theft fell to 13% of breach vectors in 2026. Attackers now bypass MFA via help desk resets and OAuth token theft. Five attack surfaces mapped.

Anthropic, OpenAI, Google, and Meta published prompt injection disclosures in 2026 — but no two measure the same thing. What security teams need to know.

Meta's AI support agent bound recovery emails on request and the SOC never saw an alert. Six authentication writes to audit before your next agent ships.

New Ivanti research finds 85% of IT teams claim every AI agent has a named owner — only 42% say ownership is actually clear. Six questions to close the gap.

SearchLeak and a three-CVE LiteLLM chain broke the same AI trust boundary in two weeks. A 5-check audit maps each gap to a CVE, a verify command, and a fix.

Attackers are actively exploiting path traversal and SQL injection in Langflow, LangGraph, and LangChain — below where your security tools look.

12.7% of enterprise devices are missing their expected security agent. Here's the 5-gate checklist to run before autonomous SOC agents act on your data.

Tenet Security hijacked Claude Code in 85% of tests via a fake Sentry error — no stolen credentials, no alerts. Datadog and PagerDuty are equally exposed.

New VentureBeat survey data: 69% of enterprises share AI agent credentials, letting one compromised agent inherit the access of every workflow it touches.