Louis Columbus

Four supply-chain incidents hit OpenAI, Anthropic and Meta in 50 days: three adversary-driven attacks and one self-inflicted packaging failure. None targeted the model, and all four exposed the sam…

GitHub confirmed attackers stole 3,800 internal repositories via a poisoned VS Code extension. The same threat group, TeamPCP, simultaneously compromised Microsoft's durabletask Python SDK...

What happens after MFA succeeds? How session token theft lets attackers move laterally through enterprise networks without triggering a single alert.

Stolen credentials produced valid Sigstore certificates, clearing 633 malicious npm packages — one of seven developer tool attack surfaces that failed.

Credential theft fell to 13% of breach vectors in 2026. Attackers now bypass MFA via help desk resets and OAuth token theft. Five attack surfaces mapped.

Anthropic, OpenAI, Google, and Meta published prompt injection disclosures in 2026 — but no two measure the same thing. What security teams need to know.

Meta's AI support agent bound recovery emails on request and the SOC never saw an alert. Six authentication writes to audit before your next agent ships.

New Ivanti research finds 85% of IT teams claim every AI agent has a named owner — only 42% say ownership is actually clear. Six questions to close the gap.

SearchLeak and a three-CVE LiteLLM chain broke the same AI trust boundary in two weeks. A 5-check audit maps each gap to a CVE, a verify command, and a fix.

Attackers are actively exploiting path traversal and SQL injection in Langflow, LangGraph, and LangChain — below where your security tools look.