Payload Podcast 010 - Olaf Hartong

Payload Podcast with Olaf Hartong! Live Tuesday, July 28 at 3pm ET.

Inside Astaroth's New Spambot Component

The Sandbox Let It Out. The Guardrails Locked Us Out.

This month, an OpenAI model, running inside a sealed evaluation with its safety limits turned down, found a previously unknown flaw, broke out on its own, and took control of Hugging Face's live systems over a weekend. No human directed it. For years, industry leaders across the field warned this day would come. The disclosures suggest it has arrived. The harder story is what happened next. When Hugging Face's responders went to investigate, the frontier models they reached for refused to run the analysis, so they pivoted to a self-hosted, open-weight model instead. Offensive research ran unrestricted while the defensive response hit a compliance blocker. This is a policy story as much as a technical one. SANS faculty and staff, joined by voices from public policy and industry governance, will work through what it changes: AI testing standards, lab resilience, how we model attacker intent, who gets trusted access and who decides, and what defenders should build now, while nothing is on fire.

Bugs in Hugging Face Diffusers Bypass Custom Code Safeguard

Three vulnerabilities in Hugging Face's diffusers library allow attackers to execute arbitrary code on systems that load a malicious model repository, effectively circumventing the platform's custom code safety protections. The bugs enable remote code execution when users interact with compromised models, posing a significant risk to machine learning practitioners who download and run models from untrusted sources on the Hugging Face platform.

AI-Assisted Bug Hunt Uncovers Linux Kernel 0-Day in net/sched

Researchers leveraging AI-assisted analysis discovered a use-after-free vulnerability in the Linux kernel's net/sched subsystem that enables privilege escalation to root. This 0-day finding demonstrates the emerging capability of machine learning tools to identify complex memory corruption flaws that might otherwise evade traditional code review methods.

What the OpenAI and Hugging Face Incident Means for Defenders

As AI agents become more autonomous, understanding behavior is becoming even more important. The OpenAI and Hugging Face incident highlights why behavioral security is foundational to securely deploying AI in the enterprise.

Phishing Dominates as Initial Entry Method for Cyber-Attacks, as Hackers Hone Evasion Techniques

Phishing continues to be the primary attack vector for initial network compromise, according to analysis of real-world incident response cases by Cisco Talos. The research highlights that threat actors are actively refining evasion techniques to bypass security controls and increase the effectiveness of phishing campaigns.

Microsoft Launches Flurry of AI Security Initiatives to Combat AI-Enabled Threats

Microsoft has introduced an agentic security system designed to assist cyber defenders, along with its first AI model specifically built for cybersecurity applications. These initiatives represent the company's response to the emerging threat landscape where AI is being weaponized by attackers.

How we use /goal to find bugs in Patch the Planet

Codex's /goal feature achieved breakthrough results in the Patch the Planet initiative, discovering critical vulnerabilities in widely-audited open-source projects like Rust, curl, and zlib by combining AI-driven bug hunting with precise outcome definition rather than prescriptive instructions. The technique's success hinges on three key practices: letting Codex draft its own goal prompts based on threat models, defining desired outcomes with exacting specificity while avoiding step-by-step instructions, and assigning single focused objectives to each agent rather than competing goals. This approach enabled a single engineer to uncover vulnerabilities across major projects, including a soundness hole in Rust 1.98 and potential privilege-escalation bugs

Coca-Cola Reveals Subsidiary Fairlife Suffered Data Breach

Coca-Cola's dairy subsidiary Fairlife has disclosed a data breach resulting from a ransomware attack that led to the theft of company data. The disclosure reveals the incident occurred recently, though specific details about the scope of exposed information remain limited in the announcement.

NVIDIA’s Open Secure AI Alliance Is Missing Some Big Names

NVIDIA has launched a new Open Secure AI Alliance to build an “open defense stack for agents”

New CREST AI Standards to Deliver AI-Enabled Pentesting Accreditation

CREST has introduced new AI standards designed as optional add-on requirements for cybersecurity service providers seeking to demonstrate responsible AI usage in their operations. These standards will enable accreditation specifically for AI-enabled penetration testing services, allowing qualified providers to differentiate themselves through certified responsible AI practices.

OpenAI Models Hacked Hugging Face | BHIS In Focus

How an internal AI security test became one of the biggest cybersecurity stories of the year. Join John Strand and guests for a special live episode of BHIS In Focus as they analyze the reported OpenAI security incident involving Hugging Face. We'll cover what happened, what we know so far, and what security professionals should be watching next. Join us and fellow attendees for Live Chat in the Black Hills Infosec Discord server: Join the Black Hills Infosec Discord Server! in the #🔴live-chat channel.

Did an AI Really Hack Hugging Face?

Microsoft unveils AI security tools it says outperform competing platforms

Microsoft says tools cost less than competing ones and outperform them, too.

OpenAI accidentally Hacked Hugging Face - BHIS - Talkin' Bout [infosec] News 2026-07-27

Join us LIVE on Mondays, 4:30pm EST. A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.

27th July – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 27th July, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Nichirei, a Japan-based frozen-food supplier and logistics company, has experienced a ransomware attack that disrupted shipping operations and affected approximately 5,000 customers. KFC Japan warned of possible shortages. Nichirei confirmed personal data theft, […] The post 27th July – Threat Intelligence Report appeared first on Check Point Research.

When Guardrails Break: Why Securing AI Requires Behavioral Detection and Autonomous Containment

Traditional security controls were built for predictable systems. AI is different. This blog explores why behavioral detection and explainable autonomous containment are essential security layers for managing AI risk without slowing innovation.

SourTrade Malvertising Campaign Secretly Builds Malware in the Browser

SourTrade operators are running a malvertising campaign that impersonates legitimate cryptocurrency and trading platforms to deliver infostealers directly within victims' browsers. The campaign employs novel techniques to construct and execute malware in-browser, avoiding traditional file-based detection methods. This approach allows attackers to steal sensitive information while remaining hidden from conventional security tools.

Ransomware Groups Increasingly Deploy EDR Kill Techniques

Ransomware groups are increasingly adopting endpoint detection and response (EDR) kill techniques as part of their attack strategies, according to Halcyon's latest quarterly report. Despite an overall decline in ransomware attack volume, adversaries are deploying more sophisticated obfuscation methods that pose greater challenges for defensive tools and security teams to detect and mitigate.