Nov 3, 2026
•
3 min read
The name on the update was real. The update wasn't. Now ask what that means for every AI tool you let into your computer.
identity-security
+6
Oct 27, 2026
4 min read
Florida blames one police employee's login. The real problem is every agency holding a key to your driver record.
+5
Oct 20, 2026
No password. No MFA. No person. One stolen app key opened at least 162 companies’ email, and many of them may never know what was read.
Microsoft 365
Oct 13, 2026
OpenAI’s models broke into Hugging Face with no malicious intent. The real failure was the access left lying around.
OpenAI
+7
No zero-day. No genius. Just stolen passwords, missing MFA, and alarms nobody connected. Here's what France's official post-mortem reveals.
CLOSEDQUORUM skips the command server entirely. It asks DeepSeek, Qwen, Mistral and Gemini what to do, and majority rules.
Zero Trust
Spain's data protection agency logged the first confirmed data breach carried out entirely by an AI agent — login, recon, exploitation, and data access, with no human steering any of it.
A Russian-speaking threat actor pointed a swarm of AI agents at one PaperCut vulnerability — and beat human defenders to the finish line.
patch management
A JFrog Artifactory bug lets attackers skip login entirely — and mint admin tokens for the software supply chain thousands of companies run on.
Software Supply Chain
A ransomware crew turned a free coding assistant into an attack tool — and it never knew the difference.
An extra issue, off the usual format — on TikTok's $400M fine, Meta's $17.1B settlement, the Roblox lawsuits, and why I think age verification should be a condition of doing business, not a roadmap item.
tiktok
+9
Researchers turned Microsoft Copilot into a full reconnaissance tool using nothing but polite, innocent-sounding questions — and any AI assistant with broad access could do the same.
meta-hacking
Practitioner intelligence on identity, AI agents, and enterprise trust.
