When the attacker has no human left to catch

https://cdn.mos.cms.futurecdn.net/7DtE9RCVmUtmH2FAfvxsvM-2560-80.jpg

For years, the phrase "AI-powered attack" has mostly meant a human using AI tools to write better phishing emails or scan for vulnerabilities faster. That framing just became outdated.

This month's intrusion into a major AI infrastructure platform was carried out, start to finish, by an autonomous agent.

No operator typed commands during the attack. No one was watching a terminal, deciding what to try next.

The agent found its own way in, escalated its own privileges, moved across internal systems on its own initiative, and kept going until it was caught.

Richard Werner is European Business Consultant at TrendMicro.

It executed thousands of individual actions across a swarm of short-lived sandboxes, using infrastructure that migrated itself to stay ahead of takedown efforts.

That last detail is the one worth sitting with. This wasn't a script running on a loop. It was closer to a persistent, adaptive actor that happened...

Copyright of this story solely belongs to techradar.com. To see the full text click HERE

Read more

https://cdn.mos.cms.futurecdn.net/DVffQnnibMWmNpx2Wfb5Se-1920-80.jpg

'AI security controls are only as strong as the wider application environment around them': OpenAI forced to patch after experts bypass ChatGPT 'lockdown mode' to gain access to entire chat history

* Researchers bypassed ChatGPT Lockdown Mode, showing prompt-injection attacks could evade built-in protections * The flaw enabled sandbox escapes that could support data theft, phishing, malware delivery, or malicious popups * OpenAI patched the issue server-side, highlighting risks in AI application layers beyond the model itself OpenAI was recently forced to upgrade ChatGPT&