SectionAI Security
Attacks on and with AI: models, agents, data.
Railway Breach Exposed Customer AI Keys, Leading to Estimated $740,000 in Unauthorized Charges
Platform-as-a-service provider Railway says stolen AI provider keys from an October breach were used to run up roughly $740,000 in unauthorized usage,…
Fireworks AI discloses second breach tied to compromised third-party cloud provider
AI inference startup Fireworks says attackers reached its development machines through a breached cloud provider, exposing some customer billing details and model…
Gemini Omni 1.2 Flash Extends Video Clips to 15 Seconds and Cuts Prices 30%
Google DeepMind's Gemini Omni 1.2 Flash adds native 15-second video generation, stronger reference consistency, and multi-turn editing at a lower per-second cost.…
Google Warns LLMjacking Attacks Can Rack Up $1M in Cloud Bills
Google says attackers are stealing API keys to hijack enterprise access to large language models, racking up fraudulent cloud charges that in…
Malicious ChatGPT Share Link Could Hijack Sessions, Leak Private Chats
Researchers at Parameter found that a crafted ChatGPT share link could execute attacker code in a victim's logged-in session, exposing private conversations.…
Trojanized Claude Code Extension Hit Cursor Marketplace for 11 Hours
A tampered version of Anthropic's Claude Code extension was briefly distributed through Cursor's marketplace under the real publisher identity, attempting to plant…
Warp Discloses Vendor Breach Exposing AI Agent Logs and Telemetry Data
A third-party vendor compromise in Warp's infrastructure exposed agent decision logs and user telemetry for an estimated 1% of the agentic development…
CyberStrikeAI: 44 AI Agents Found Automating Attacks on Japanese Targets
Researchers at TrendAI uncovered three exposed server environments showing a framework called CyberStrikeAI using dozens of AI agents to drive or assist…
Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agent Wallets
A flaw in the x402 payment SDKs' default client let malicious APIs request full token balances from AI agents before spending limits…
Leaked LiteLLM Master Key Let Attackers Hijack Release Pipeline
A master key accidentally committed to a public GitHub repository in May 2026 gave attackers the access needed to push a malicious…
Microsoft Teams Adds AI-Powered Phishing Detection Starting November
Microsoft is rolling out context-aware phishing detection in Teams that analyzes conversation behavior rather than just links or files, targeting external first-contact…
DHS Orders DeepSeek Products Purged From Federal Civilian Systems
The Department of Homeland Security is directing federal civilian agencies to strip DeepSeek AI products, and anything built on them, from government…