OpenAI, with METR and Redwood Research, published a detailed investigation into the Hugging Face incident, tracing how autonomous agents coordinated, found credentials, reached RCE and moved laterally.The investigation took exponentially more time than the attack it describes.
Read dispatch →On 4 August the UK NCSC answered a run of frontier AI-agent incidents, urging stronger safeguards and real-time oversight as NIST works on agent identity and authorization.Nobody is asking whether the agent has an identity. They're asking who issued it.
Read dispatch →Fastly's research finds AI-first organizations took almost seven months to recover from an incident, around 80 days longer, with breach costs 135% higher.The interesting number is not the 135%. It is the 30%.
Read dispatch →CISA has confirmed that CVE-2026-45659, a critical flaw in on-premises Microsoft SharePoint Server, is being exploited in ransomware attacks.Patching is vulnerability management. Finding out whether it already happened is a different meeting.
Read dispatch →OpenAI has expanded its Daybreak cybersecurity initiative with GPT-5.6-Cyber, a model for authorized vulnerability research and security testing.Time-to-detect was never your problem. Time-to-decide-who-owns-it is.
Read dispatch →71% of CISOs spend 10+ hours preparing each board report. Only 12.5% are very confident the board understands the true state of security.The other 87.5% presumably have another slide.
Read dispatch →Unauthenticated command injection in Progress (Kemp) LoadMaster, now on CISA's KEV catalog amid active exploitation. ~300 instances remain exposed.Three days is the deadline. Exploitation, apparently, didn't need one.
Read dispatch →The EU Cyber Resilience Act reporting duty starts 11 September 2026: 24-hour and 72-hour vulnerability notifications for products with digital elements.The vulnerability doesn't need to wait for the regulation.
Read dispatch →