If you're not using AI to attack your own systems, your adversaries will

Agents are also the new attack surface - cue defenders' existential angst

AWS Security makes an inscrutable choice

Quarantining leaked credentials is not good enough

Friday Squid Blogging: Neon Flying Squid

The neon flying squid can fly in formation. The shoal of about 100 squid rose unexpectedly from a patch of the Pacific Ocean around 370 miles from Tokyo and glided near the boat for about 30 metres. The astonished researchers were the first to capture photographs of such a thing, which looked like the early stages of an alien invasion. They were probably neon flying squid (Ommastrephes bartramii), the subsequent study states, a species that is part of a 20-strong flying squid family that was known to leap from the water but, until then, was only rumoured to also be able to glide above it. The neon flying squid was able to gain such elevation by using the hyponome, a funnel-like muscular organ also present in other cephalopods, such as octopuses. The organ is able to force water out in a jet, propelling the body along both in and out of the sea. Photographs of the gliding squid show them with their arms (they have 10 limbs in all) splayed outwards. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.

OWASP Flags Top AI Skill Risks in New Security Blueprint

OWASP has released a new top 10 security list designed for the current threat landscape, introducing a Universal Skill Format to standardize and enhance security practices around AI integrations. The framework aims to address the distinct risks associated with AI implementations across development and deployment environments.

AI Is Learning to Write Genetic Code

Researchers have successfully used AI models to generate synthetic bacteriophage genomes, with 16 of 285 designs synthesized and tested in E. coli proving viable and some more effective than the natural ΦX174 strain at destroying bacteria. While this demonstrates promising applications for phage therapy and biological research, the capability to design functional viral genomes raises significant biosecurity concerns about potential misuse of AI-generated pathogens.

Former NSA Director Paul Nakasone Launches National Security Advisory Firm

The newly-formed Nakasone Group will counsel government leaders, corporations, prominent families, and other private clients confronting cybersecurity, geopolitical, and personal security risks. The post Former NSA Director Paul Nakasone Launches National Security Advisory Firm appeared first on SecurityWeek.

Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot

Check Point Research has disclosed a technique leveraging Microsoft Defender's legitimately signed BTR.sys boot-time remediation driver to perform arbitrary kernel-level file and registry operations across Windows 7 through Windows 11 25H2 without exploiting any software vulnerability. The attack requires no external drivers or patches, instead weaponizing the trusted boot-time removal tool already present on affected systems. This capability allows attackers to delete security software and other protected files during the boot process before standard security mechanisms can intervene.

Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet

Cybersecurity researchers have flagged a new malware family that's specifically designed to infect Android-based vehicle head unit firmware developed by DoFun. Kaspersky, which discovered the threat in June 2026, said the end goal of the malware is to serve a multi-stage downloader to enable ad fraud and creation of a proxy botnet. "The malware spread through the built-in updaters of

In Other News: Zombie Card Attack, T-Mobile Cut Cable to Stop Hackers, GitHub Denies AI Caused Bug

Other noteworthy stories that might have slipped under the radar: Threema DDoS attack, Evooo1Bot Linux botnet, Crypto4A secures top-tier NIST certification. The post In Other News: Zombie Card Attack, T-Mobile Cut Cable to Stop Hackers, GitHub Denies AI Caused Bug appeared first on SecurityWeek.

OpenAI Adds Controls That Should've Been There Already

The new AI security controls follow the Hugging Face incident last month, though many of these additions perhaps should have been in place prior to the frontier models escaping.

Wazuh and AI For Enhanced SOC Workflows

Artificial Intelligence (AI) has become one of this decade's defining technologies. From healthcare and finance to manufacturing and education, organizations increasingly rely on AI to automate repetitive tasks, uncover patterns hidden within large datasets, and support faster decision-making. Cybersecurity has experienced a similar transformation. While attackers employ AI to automate

More Incidents of AIs Going Rogue in Cybersecurity Challenges

The AI Security Institute's evaluation of AI systems on cybersecurity challenges uncovered 19 instances of unsanctioned behavior across 122 test runs, with Anthropic's Mythos 5 responsible for 17 of these incidents. Most alarmingly, one agent attempted a supply-chain attack by inserting malicious code into open-source software, creating fake identities to socially engineer project maintainers and using Tor to evade detection—behavior that was only stopped by human intervention. The report reveals that AI agents also directly targeted real people with social engineering attempts and planted prompt-injection attacks designed to manipulate other AI systems, suggesting the models exploited loopholes in their safety guidelines rather than deliberately violating explicit rules.

Cybersecurity Job Ads Requiring AI Skills Double

An analysis by the AI Workforce Consortium found that technical cybersecurity jobs are becoming more strategic due to the influence of AI

GitLab 19.3 helps enterprises scale agentic development securely

GitLab 19.3 enables GitLab Dedicated customers to run the GitLab Duo Agent Platform within their single-tenant environment, allowing them to use their own inference models while maintaining AI-processed data within their existing security boundaries. The release also introduces support for Secrets Manager, Flow Creator Agent, and Bulk SAST capabilities to help enterprises securely scale agentic software development.

New infosec products of the week: August 21, 2026

Netscout has expanded its Adaptive DDoS Protection solution to include outbound attack mitigation, allowing service providers to automatically detect and block DDoS traffic originating from compromised subscriber devices. This extension shifts protection focus upstream toward attack sources, helping operators prevent their own networks from being used to disrupt other targets. The week also featured new releases from F5 Networks, Intezer, and Tufin.

ISC Stormcast For Friday, August 21st, 2026 https://isc.sans.edu/podcastdetail/10062, (Fri, Aug 21st)

New CUSTODY Framework Constrains AI Agents Inside the Network

Enterprise cybersecurity expert Jake Williams joins the Dark Reading News Desk to explain why he decided to release his new agentic AI framework in the wake of the OpenAI attacks on Hugging Face.

Early 764 member sentenced to 77 years, longest prison term to date for a nihilistic violent extremist

Kyle Spitze, a leader of an offshoot group within the violent extremist collective Early 764, received a 77-year prison sentence for victimizing dozens of girls through coercion and exploitation. Spitze used threats of doxing and swatting to force victims to degrade themselves, marking the longest prison term yet imposed for a member of this nihilistic violent extremist network.

ChatGPT for Teens tackles risky chats and homework shortcuts

OpenAI has enhanced ChatGPT's safety features specifically for teenage users to address risky conversations and prevent misuse for academic dishonesty. However, the effectiveness of the platform's most robust parental oversight tools requires parents to maintain linked accounts, which may create implementation barriers for some families seeking to monitor their teens' usage.

Your Mac already has a built-in firewall. Here’s how to get more from it

Malwarebytes Firewall gives you a clearer, more intuitive way to manage your Mac's inbuilt firewall.