Varonis researchers tricked an OpenClaw AI agent into leaking AWS keys, database credentials, and customer records using basic social engineering. The agent caught phishing links and malicious OAuth apps — but fell for urgent-sounding emails from fake internal staff every time.
Microsoft released an investigative playbook for security teams to efficiently analyze incidents involving Copilot and Azure AI. It provides a structured, telemetry-driven method to determine what AI actions occurred, what data was involved, and whether it was a threat.
Broadcom released its largest-ever Spring security update and is using AI to hunt vulnerabilities across 100,000+ dependency builds — but zero-day patches are locked behind its enterprise paywall.
Vibe-coded apps built by non-developers are exposing medical records, financial data, and corporate secrets on the open internet — and most security teams have zero visibility into what’s been deployed.
Attackers exploited a flaw in Meta’s AI-powered High Touch Support tool to hijack over 20,000 Instagram accounts, bypassing two-factor authentication entirely. The campaign ran undetected from April 17 to May 31, 2026.
