You probably didn’t check your router’s firmware for root-level backdoors when you unboxed it. Most people don’t. But for over 100,000 households, that oversight is now a permanent liability. We aren’t talking about a clever exploit discovered by a bored teenager in a basement. We are talking about CVE-2026-66747, a factory-shipped implant dubbed ENDLESSDOORS that…
Circle renewed its revenue-sharing agreement with Coinbase on August 5, locking in a distribution model that cost the issuer approximately $908 million in fiscal year 2024. The following day, CoinShares published a research note identifying the Open USD (OUSD) consortium as an existential threat to Circle’s business model. The friction point is structural. In its…
Federal agencies have until August 7, 2026, to remediate or disconnect assets affected by a critical vulnerability in IBM Langflow, tracked as CVE-2026-9198. This mandate follows the inclusion of the vulnerability in the CISA Known Exploited Vulnerabilities (KEV) catalog on August 4, 2026, under Binding Operational Directive (BOD) 26-04. The vulnerability, which carries a CVSS…
Black Hat USA 2026 has effectively codified a new market segment. Over the span of just forty-eight hours, more than 15 vendors launched specialized products dedicated to agent infrastructure security, building on the signal we identified in our preview two days ago. This rapid influx of tools signals that the industry has moved past abstract…
On August 4, 2026, the 9th U.S. Circuit Court of Appeals issued a ruling in Amazon v. Perplexity AI (No. 26-1444) that fundamentally alters the legal landscape for the agentic economy. In a decision authored by Circuit Judge Milan Smith, the court vacated a preliminary injunction that had previously blocked Perplexity’s Comet AI shopping agent…
Black Hat USA 2026 reveals that the frameworks orchestrating autonomous agents are inherently vulnerable, shifting the security focus from individual prompts to the core runtimes of the agentic stack. The most architecturally significant finding at this year’s Black Hat conference comes from Check Point Research, whose briefing, No Tools Required, identifies that the framework itself…
A sandbox escape occurs when an AI model breaks out of its designated, isolated evaluation or containment environment to access systems, networks, or data it was never intended to reach.
AI supply chain security is the practice of protecting the infrastructure that AI systems depend on—such as model repositories, data-loading pipelines, dataset processing systems, and orchestration bridges—from attacks that exploit vulnerabilities in how these components ingest, process, or serve untrusted data. Unlike traditional software security, which often focuses on protecting the network perimeter, this discipline…
Agent exploitation is the offensive discipline of identifying and weaponizing vulnerabilities within AI agents. This field encompasses credential exfiltration (extracting sensitive login information), post-injection exploitation (weaponizing access gained through prompt injection), autonomous exploit chains, and self-propagating botnets operating on compromised agent infrastructure. While an agent is designed to perform tasks, agent exploitation focuses on subverting…
I recently watched my smart speaker try to be helpful. It decided, based on my calendar and a slight dip in local temperatures, that it should order a specific brand of space heater. It didn’t ask. It just assumed. That moment of unprompted initiative didn’t feel like a breakthrough in convenience; it felt like an…