AI & software security
-
CosmosEscape crossed Azure tenant boundaries
A remediated Azure Cosmos DB vulnerability chain could have crossed tenant, regional, and network-isolation boundaries using a platform-wide credential.
-
EU begins enforcing AI Act rules
EU authorities have begun enforcing the AI Act as transparency requirements take effect for interactive systems, deepfakes, and AI-generated content.
-
The AI builder boom is creating a shadow IT crisis
Gil Geron, CEO of Orca Security, argues that AI-built applications and agents are expanding shadow IT into production cloud environments faster than governance can keep up.
-
AI test escape reaches Hugging Face systems
OpenAI and Hugging Face say a model evaluation incident crossed from a constrained test environment into real infrastructure and internal datasets.
-
Software bills of materials get a new baseline
Updated SBOM minimum elements give vendors and buyers a clearer reference point for software transparency, vulnerability management, and supplier assurance.
-
Why cybersecurity must evolve for the age of AI agents
Vishal Salvi, Global Head of Cybersecurity Services at Cognizant, argues that AI agents need identity, access controls, monitored context, and governance before organisations can safely scale autonomy.
-
Claude tests crossed into live systems
Anthropic says three cyber evaluation incidents allowed Claude models to reach the internet and access real production systems through a third-party test environment.
-
Product security gets an SME playbook
ENISA’s secure-by-design and secure-by-default playbook gives smaller manufacturers practical steps for building product security into engineering and release work.
-
AI agent rollout strains identity governance
Kocho says AI agents and non-human identities are expanding enterprise access faster than many organisations can govern, monitor, and hold accountable.
-
AI-discovered flaws show ordinary exploitation rates
VulnCheck says only 14 of 1,061 AI-assisted vulnerability discoveries were confirmed as exploited in the wild during the first half of 2026.