Australia disclosed that an OpenAI agent gained unauthorized access to non-public government information.

The post OpenAI Agents Probed Websites for Vulnerabilities While Fetching Public Data appeared first on SecurityWeek.

Revision 4 of NIST’s operational technology security guide is open for public comments until November 30.

The post OT Security Guidance: NIST Drafts Updated Guide, CISA/FBI Advise on ICS Integrators appeared first on SecurityWeek.

Only 21% of industrial security leaders report a complete OT asset inventory, even as 88% call their programs mature.

The post Honeywell: OT Security Teams Embrace AI, but Autonomy Still Rare appeared first on SecurityWeek.

The cybercrime platform leveraged AI at every step of the attack chain, including writing social engineering messages and deciding targets.

The post AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft appeared first on SecurityWeek.

Abdelhamid Naceri, a former Microsoft Germany employee, is the exploit leaker Nightmare Eclipse, aka Chaotic Eclipse. 

The post Nightmare Eclipse Drops New Microsoft Defender Exploit After Revealing Identity appeared first on SecurityWeek.

Forescout’s new network segmentation research shows that OT and medical devices often share network segments with other enterprise assets.

The post Only 13% of OT Network Segments Are Fully Isolated: Analysis appeared first on SecurityWeek.

The US, Japan, Germany and Australia have published a joint report detailing the scope of North Korea’s WaterPlum campaign.

The post Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider Scheme appeared first on SecurityWeek.

The transaction is part of the $4.1 billion deal in which Accenture acquired a majority stake in Dragos in an OT cybersecurity push.

The post Dragos Completes NetRise and runZero Acquisitions Following Accenture Deal appeared first on SecurityWeek.

It’s unclear if the attacks are part of previous campaigns against Rust, but the techniques used by the attackers match those used by North Korea.

The post Rust Team Members and Popular Crate Owners Targeted via Video Calls appeared first on SecurityWeek.

The hackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles, officials said. 

The post Colorado Water Utilities Hit by Cyberattacks Targeting OT Systems appeared first on SecurityWeek.

Hacktron researchers earned a bug bounty after demonstrating access to OpenAI employee accounts. 

The post AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code appeared first on SecurityWeek.

Gyazo maker Helpfeel said the attacker exploited a vulnerability in its image upload server to gain unauthorized access.

The post 23 Million User Records Compromised in Gyazo Data Breach  appeared first on SecurityWeek.

Microsoft fixed vulnerabilities across Azure and AI-branded products, with privilege escalation flaws accounting for the majority.

The post Microsoft Patches 18 Vulnerabilities in AI, Cloud Products appeared first on SecurityWeek.

Check Point Security Management and Log Servers are affected by a critical vulnerability that can allow remote code execution with root privileges.

The post Check Point, Kaspersky, Tanium Patch Product Vulnerabilities appeared first on SecurityWeek.

The Coast Guard confirmed evidence of malicious cyber activity on the VL Prosperity, but has not attributed the attack to Iran.

The post Cyberattacks on Two Oil Tankers Prompt Coast Guard, FBI to Board Vessels appeared first on SecurityWeek.

OpenAI published a framework for disclosing model misalignment alongside six reports describing problematic behavior.

The post OpenAI Says Its Models Searched GitHub for Leaked API Keys During Training appeared first on SecurityWeek.

The decision follows BOD 26-04, which directs federal organizations to prioritize vulnerabilities based on real-world risk.

The post CISA Retires Weekly Vulnerability Bulletin in Risk-Based Pivot appeared first on SecurityWeek.

New research from Irregular shows AI agents can retrain and redeploy their own underlying models during routine maintenance tasks.

The post AI Agents Can Retrain Own Models Mid-Task, Leaking Secrets and Erasing Refusals appeared first on SecurityWeek.

Google announced patches for the exploited privilege escalation vulnerability (CVE-2026-58704) on September 15.

The post Pixel Modem Zero-Day Exploited in Targeted Attacks appeared first on SecurityWeek.

US, UK, and Dutch government agencies published a report detailing the malware, and the FBI described the abuse of Telegram for C&C.

The post US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware appeared first on SecurityWeek.