I want to talk about AI hacking. There are three aspects: people hacking AI systems, people using AI to hack other systems, and AIs hacking systems on their own, not even maliciously. The last two matter more than the first. The third is the weirdest and potentially the most destabilizing.

I started writing about this in 2021 and in my 2022 book, A Hacker’s Mind. Back then I said it was mostly still science fiction, but not stupid science fiction. We’re seeing it more and more, especially in the past year. The trends I’m describing don’t require a major breakthrough in AI. They’re starting to happen now, and they’ll happen more often as AIs get better at autonomous problem-solving. And it will involve far more than computer code.

AI will hack all sorts of social, economic and political systems. It will find vulnerabilities and exploit them. This is a difference in kind, not just degree. We’re not ready for it, and we need to think about the implications now.

This article is adapted from a keynote speech delivered at the DEF CON 34 conference in Las Vegas on August 7, 2026.

First, I want to broaden the term “hacking.”

The tax code isn’t computer code, but it is code. It’s a series of algorithms with inputs and outputs. It has vulnerabilities, which we call loopholes, and exploits, which we call tax avoidance strategies. Black hat hackers exploit them for profit. We call them accountants and attorneys.

What is a hack? One definition: “Something that a system permits, but is unanticipated and unwanted by the designers.” It’s subjective and implies novelty and cleverness. A hack follows the rules of a system but subverts its goals or intent, just as a software hack follows the logic of code while doing something its authors neither anticipated nor wanted.

All systems of rules can be hacked, including professional sports, customer reward programs, financial systems and politics. Hacks even work against our cognitive functions. A curved hockey stick is a hack, and we know the name of the man who invented it. Mileage runs were a hack. The filibuster was originally a hack in Roman times. Gerrymandering is a hack. Hedge funds and private equity are full of them.

A system is just a set of rules or norms, and the rules aren’t always formal. Even the best-designed rules will be incomplete, inconsistent or ambiguous. As long as people want to subvert a system’s goals, there will be hacks.

AIs are becoming hackers. After decades of slow progress, they’ve gotten very good at finding and exploiting vulnerabilities in computer code. They do this largely autonomously, and they’re getting better scarily fast. But the implications extend far beyond software, to the tax code, financial regulations and all sorts of social, economic and political systems.

There are two distinct issues. First, someone might instruct an AI to hack one of these systems, feeding it the world’s tax codes or financial regulations to find profitable loopholes. Second, an AI might hack a system on its own, inadvertently. Both are dangerous, but the second is worse because we might never know it happened.

Now, reward hacking. AIs don’t solve problems the way people do. They stumble on solutions we never anticipated, and some subvert the intent of the system. They don’t share our context and don’t necessarily understand the implications, norms and values we take for granted.

Reward hacking is when an AI achieves a goal in a way its designers neither wanted nor intended.

Early pre-LLM examples are telling. In a two-person soccer simulation, an AI learned that kicking the ball out of bounds forced the opposing goalie to throw it in and leave the goal undefended. In a stacking simulation, an AI learned to flip a block upside down rather than stack it. In an evolution simulation where the goal was to cross a distant finish line, an AI made itself tall enough to fall over the line instead of growing longer legs or stronger muscles.

These are all hacks, the result of poorly specified goals or rewards. Today, they’d come from bad prompting.

The problem is universal. One researcher tried to teach a robot vacuum not to bump into things. Instead, it learned to drive backward, because there were no sensors in the back.

Any capable AI will find hacks wherever the rules have problems, inconsistencies or loopholes that still produce an acceptable solution. We see a hack because we understand context. The AI doesn’t, at least not in the same way.

This problem shows up often in myth.

In the story of King Midas, the god Dionysus grants him a wish: everything he touches turns to gold. Midas ends up starving when his food, drink and daughter all turn to gold. It’s a specification problem. He programmed the wrong goal.

In the Golem of Prague, a ghetto animates a clay statue to guard its residents. It guards them past all reason until they figure out how to turn it off. This is a guardrail problem. The villagers never limited the golem’s actions.

More generally, think of this as the genie problem. Genies are precise about the wording of wishes and can be maliciously pedantic when granting them. There’s no way to outsmart a genie. Whatever you wish for, he can grant it in a way you wish he hadn’t.

The reason is that in human language and thought, goals are always underspecified. We never include every caveat, exception and proviso, and we never close off every avenue for hacking. Any goal we specify will be incomplete. That’s largely fine in human interactions, because people understand context and usually act in good faith.

If I asked you to get me coffee, you’d pour a cup from the nearest coffee pot or walk to the corner shop. You wouldn’t bring me a pound of raw beans, buy a coffee plantation or snatch a cup from a stranger’s hands. I wouldn’t have to specify any of that. You’d just know.

Similarly, if I asked you to develop a technology that turns things to gold on touch, you wouldn’t build it to starve the person using it. You’d just know.

In 2015, Volkswagen was caught cheating on emissions tests. Human engineers programmed a regular computer to detect testing and behave differently during it. The cheat went undetected for years because it’s hard to tell what software is doing.

If I asked you to design engine control software that maximizes performance while passing emissions tests, you wouldn’t design it to cheat without realizing you were cheating. An AI would, because it will think “outside the box” when it has no concept of the box.

Unless programmers specify that the system must not behave differently during testing, an AI might come up with the same hack. The programmers would be satisfied, the accountants would be ecstatic, and no one would know until someone audited the code.

We can now constrain the goal to avoid that particular hack, but programmers won’t anticipate others. The lesson of the genie is that there will always be hacks programmers don’t anticipate.

We’re building AI genies: systems that take broad instructions and figure out how to carry them out, sometimes in ways we didn’t expect or intend. That’s the whole point of vibe coding. You underspecify what you want and let the AI work it out. Sometimes that produces genie behavior.

We can’t completely specify goals to an AI, and AIs can’t fully understand context. More precisely, current AIs have a shallow grasp of concepts. If we asked a current LLM to get me coffee, it would almost certainly do the right thing.

I worry about goals that aren’t well represented in training data, and about hacks that aren’t obvious, whose effects are subtle, like the Volkswagen hack.

Recommendation engines are an early example. They push people toward extreme content. No one programmed that. It emerged because that’s what people respond to. It didn’t take a bad actor. A basic automated system with feedback found the hack on its own.

We’re now seeing a second generation with today’s AI coding systems. AI researcher Simon Willison asked Fable to track down a stray scrollbar in a web app. When he returned, it had opened browsers, written its own screenshot tools, edited the framework’s internal templates to make the bug appear on cue and set up a local web server to collect measurements. It found the bug, but it also did many things he never asked for. Another researcher gave Fable a complex task, and it tried to hack its own memory limits because it needed more storage.

A new OpenAI model did something similar when it hacked into Hugging Face. It was being benchmarked on its ability to turn vulnerabilities into exploits. It decided the best way to reach its goal was to break out of its containment, access the internet and break into the Hugging Face network, because it thought the answers would be there.

Today’s LLMs are acting like genies, especially when powerful models are combined with sophisticated harnesses.

There are two kinds of genies. The Dionysus genie does the wrong thing. It understands your prompt literally but not correctly, and returns a mess you never intended. The Golem genie does the right thing but tramples everything in its path to get there. The paperclip maximizer is a Golem genie.

Consider some examples. Ask an AI to deal with spam calls, and a Dionysus genie might change your phone number. Ask it to book a particular flight, and a Golem genie might hack the airline database because the flight is full. Ask it to get a refund for an online purchase, and a Dionysus genie might draft a legal threat on fake letterhead and send it to the company. Ask it to buy tickets to a popular concert, and a Golem genie might discover the ticketing system is rate-limited and spin up thousands of cloud servers to hammer it. You’d know if some of these things happened, but you might never realize if others did. More detailed prompting won’t fix this. The lesson of the genie is that no amount of detail is good enough.

AI researchers aren’t surprised by any of this. Many are working on defenses against reward hacking and subtler forms of genie behavior. Some of this falls under “value alignment”: How do we teach AIs context? And how an AI satisfies a goal matters as much as whether it does. I want to build a benchmark to measure genie-like behavior, so we know where models stand and whether alignment is improving.

Think beyond LLMs and computer code. Consider specialized AIs built to find loopholes, and hacks of more general systems: the tax code, financial regulations and democratic procedures.

Financial systems are the most likely first target, because their rules are designed to be algorithmically tractable. High-frequency trading is itself a hack. Imagine giving an AI all of the world’s financial laws, plus all the news and financial data, and the goal of finding profitable loopholes. I suspect large investment banks are already doing this. The results will be novel tricks that are legal but unintended and unwanted, some of which might break the financial system.

Tax loopholes are the next likely target, for the same reasons. For a while, AIs will identify potential loopholes, and human hackers, namely attorneys and accountants, will decide which are feasible.

Further out, expect hacks of regulatory, legislative and procedural systems, and of the broader economy.

Hacking is as old as humanity. We’re creative problem solvers and loophole exploiters. We manipulate systems to serve our interests and strive for more influence, power and wealth.

Still, no human pursues their interests without constraint. Even sociopaths are limited by the complexity of society and their own contradictory impulses. They worry about their reputation and punishment, and they have limited time. These human qualities have limited hacking.

Hacking changed as everything became computerized. Computers are uniquely hackable because of their formalism and complexity. Today, nearly everything is a computer, from cars and appliances to phones. Our social, economic and political systems, including taxation, finance and elections, all involve computers.

Until recently, hacking was exclusively a human activity. Finding a novel hack required expertise, creativity, time and luck.

AI hacking will change everything again. AIs aren’t bound by the constraints that limit people. They’ll think like aliens, and they’ll change hacking’s speed, scale, scope and sophistication, sometimes at our direction and sometimes on their own.

Speed is the easiest to see. A creative process that takes a human months or years could be compressed into hours or seconds.

Scale is next. Once AI systems start discovering hacks, they can exploit them at a scale we’re not ready for. We already see this with AI-generated slop, which is rampant on social media. AI bots post around the clock, sometimes overwhelming real human discussion. It’s hard to know how much of social media is still people talking to people. What looks like boisterous political debate may be bots arguing with other bots, artificially shaping what we think and what we think others think.

Scope makes hacks more dangerous. AIs already make decisions that affect our lives, decisions we once thought belonged only to humans. As AI systems grow more capable, society will hand them more decisions, and more important ones. Hacks of these systems will do more damage.

Finally, AI hackers are more sophisticated. They can hold more variables in working memory and generate more complex hacks. What might happen if you fed an AI the entire U.S. tax code? Would it figure out, without being told, that it’s smart to incorporate in Delaware and register a ship in Panama? Consider the Double Dutch Irish Sandwich, the strategy Apple and Google used to avoid paying U.S. taxes. It involves U.S., Dutch and Irish law and an offshore tax haven. How many loopholes will an AI find that we don’t already know about? Dozens? Hundreds? Thousands? We have no idea.

These hacks will largely be perpetrated by the powerful against the rest of us. AI is fundamentally a power-enhancing technology, and so is hacking. The more power you already have, the more a hack gives you. If you or I found a tax hack, we might make a few thousand dollars. If a large investment bank found one, it and its clients could make billions.

Our societal systems for dealing with hacks were built when hackers were human, and they reflect the pace of human hacking. We have no system of governance that can handle hundreds, let alone thousands, of newly discovered tax loopholes. We won’t be able to recover from an AI finding unanticipated but legal hacks of financial systems, operating at AI speed, scale, scope and sophistication. Hacking becomes a problem society can no longer manage.

Now, defense. AIs that find software vulnerabilities help defenders as well as attackers. Vulnerabilities can be patched, removing them permanently, or turned into signatures that security systems use to detect and block attacks. In theory, AI could identify and patch every automatically discoverable vulnerability before a product ships. This is rapidly becoming routine in software development. We call it vulnops. We can imagine a future where accidental software vulnerabilities are a thing of the past.

Deliberate vulnerabilities are different. There will be an arms race. AI will craft increasingly obscure back doors, and AI will find them. It becomes a contest between the speed of creation and the speed of patching, and between obfuscation and reverse engineering.

The same logic applies to broader systems. Yes, AI hackers might find hundreds of vulnerabilities in the existing tax code. But the same technology can evaluate potential loopholes in any proposed tax law or ruling. A legislator, a watchdog group or a reporter could take the text of a bill and identify every exploitable loophole before it passes. The difference is that, unlike software, knowing about a tax loophole doesn’t mean it gets patched. In theory, though, we can fix them before the rich and powerful exploit them. So maybe defense will come out ahead here, too.

That requires resilient governing structures that can respond quickly. It won’t help if updating the tax code takes years, or if a legislative hack becomes so entrenched that it can’t be fixed politically. Maybe a lobbyist put it there on purpose. Maybe it was discovered after the law passed, and now lobbyists want to keep it. Microsoft can patch the vulnerabilities it finds. Patching is much harder when legislatures have to do it. We need society’s rules and laws to be as patchable as our computers.

This is a hard problem of modern governance, and it goes well beyond AI. It’s the problem of building governing structures for the speed and complexity of the information age.

The umbrella idea is trust. What do we need for AI systems to be truly trustworthy? Capability isn’t enough.

AIs won’t be trustworthy if the companies controlling them spy on us or subtly manipulate us. I call this the friend vs. tool problem. Will we have AI agents, or AI double agents?

AIs won’t be trustworthy if they’re insecure. How do we know they haven’t been manipulated? Almost all AIs operate in adversarial environments, so someone will benefit from hacking them. Unless we know they’re secure, we shouldn’t trust their output.

And AIs won’t be trustworthy if they act like genies. We need to know they’ll perform tasks the right way, not just perform the tasks we ask for.

I’ve written extensively about the need for “integrous” AI, including how to think about the problem, what a research agenda looks like and what good laws and policies look like. I predict integrity will be the key security problem of this decade, just as confidentiality was the key problem of the last one. This applies to both AI and the internet of things.

The big shift is agency, which I think of as Web 3.0. Computers now affect the physical world directly and with growing autonomy. Sensors go from data sources to attack surfaces, and actuators go from outputs to attack capabilities. An integrity failure no longer means bad spreadsheet data. It means the wrong dosage, the wrong valve position or the wrong braking distance.

Integrity isn’t one thing. I break it into input integrity, processing integrity, storage integrity and contextual integrity. Each is complex and important, and each deserves its own talk. I’ve written about them, and I hope you’ll read it.

Much of this isn’t really an AI problem. It’s not a technical problem so much as a capitalism problem or a democracy problem.

The failures of late-stage capitalism and democracy in the information age both stem from the rich and powerful getting too good at hacking our social, economic and political systems. This is the core argument of my 2021 book.

Seen this way, AI is exacerbating existing problems. Human inefficiency has largely kept those problems in check, and that won’t work much longer.

So consider this a call to action. Technically, we need to understand how AIs hack systems, build systems that are resilient to hacking and build AIs that won’t act as genies. Politically, we need to learn to govern and regulate at the speed of technology. Otherwise, market failures will overwhelm our ability to govern them.

I said hacking is as old as humanity and that AIs will overwhelm our ability to deal with it. The solutions aren’t specific to AI, but AI makes them more urgent. We need to understand them, and we need to implement them.

The post AI doesn’t have to go rogue to break the world appeared first on CyberScoop.

CrowdStrike announced Monday it has signed agreements to acquire two artificial intelligence security companies, Fiddler AI and Dreadnode, in deals announced at its Fal.Con Europe conference in Barcelona.

CrowdStrike did not disclose what it paid for the companies. A report in the Wall Street Journal listed the price for Fiddler at $400 million, and Dreadnode at $95 million. 

Fiddler, which specializes in AI agent observability and explainability, will become Falcon Observe on the company’s Falcon platform. Dreadnode builds automated security testing for AI systems, checking models and agents for weaknesses before deployment.

The acquisitions address a gap that has widened as companies adopt AI agents: the software can hold valid credentials and approved tools yet still make bad decisions, ignore instructions or claim work it never completed. Traditional security testing, built for code that behaves predictably, does not reach the model layer or the agent’s reasoning process.

Fiddler’s technology works after deployment. It evaluates agents before they reach production, traces decisions and reasoning across agent systems, flags drifting behavior and made-up answers, and creates records that can be used in audits. It works with common agent frameworks including LangGraph, Amazon Bedrock and Google ADK.

“When a regulator or your board asks what an agent did, saying ‘the model did it’ is not an answer,” said George Kurtz, CrowdStrike’s chief executive and founder, describing Fiddler as “the flight recorder for every agent.”

Dreadnode works earlier in the process. Its platform runs more than 100 known attack methods, including jailbreaks and prompt injection, against models and agent systems. It ranks problems by severity and maps them to widely used security standards, such as the OWASP Top 10 for large language models and the NIST AI Risk Management Framework. Dreadnode Chief Executive Brad Palm said his company was built on the idea that “the people best equipped to find those failures think like attackers.”

The announcements come alongside new Falcon Guardian capabilities that protect agents while they run. In a separate announcement, Kurtz introduced what the company calls the AI Kill Switch, a control that lets humans stop any AI agent. Writing on X, Kurtz said the switch “lives outside the model, at runtime, where an agent can’t argue with it, rewrite it, or wait it out.” He argued that the ability to stop an agent is what allows companies to run them faster: “The more certain a company is that it can stop any agent, the more agents it can put to work.”

Kurtz framed the shift as a move from security to safety. “For decades, security meant keeping the adversary out,” he wrote. “Safety is the bigger opportunity: letting AI run at full speed, inside the business, with a human in control.”

Both products are expected to be generally available in CrowdStrike’s fourth quarter of fiscal 2027. Both deals are expected to be paid mostly in cash, with part of the payment made in company stock that will be given out over time as conditions are met. They are expected to close in that quarter, pending standard approval steps.

The post CrowdStrike moves to acquire Fiddler and Dreadnode, adding AI observability and testing to its security platform appeared first on CyberScoop.

An attacker with a working credential may find the system already open to them.

That is the uncomfortable reality behind the Cybersecurity and Infrastructure Security Agency’s (CISA) new strategy, “CISA 2030: Defend, Harden, Prevail.” The strategy prioritizes operational technology security, software supply chain integrity and continuity of essential services. It also acknowledges that strong defenses cannot guarantee that intrusions will stop.

Federal agencies face these dependencies in building controls, research facilities and other operational systems. A compromised contractor credential or unverified update can turn an infrastructure problem into a mission disruption.

How much infrastructure still trusts a device, software update or machine identity simply because it was approved once? Meeting CISA’s goals requires examining those approvals, including those no one remembers granting.

Yesterday’s approval becomes today’s exposure

A controller can stay in service for decades while its firmware, credentials, suppliers and connections change around it. A maintenance contractor leaves. A remote connection outlives its purpose. The hardware remains in place. The original reason for trusting it may no longer hold.

An inventory is a starting point. Knowing a controller exists says little about whether its software is authentic, who can change its configuration or which systems depend on its credentials.

Those questions cross organizational boundaries. Device security, software assurance and identity management may each have an owner. If every team owns one piece of trust, who owns the failure between them?

CISA’s goals for operational technology visibility, anomaly detection and supply chain integrity should push operators to answer that question. Someone must be accountable for how devices, code and identities interact throughout their operational lives.

That means verifying software before deployment, protecting signing keys and reassessing access when suppliers or roles change. Even then, authenticity has limits. A valid signature can confirm software origin and integrity. Whether the software is safe for a particular environment is a separate question.

AI turns access into operational authority

That distinction matters more when software can initiate action. Consider an AI agent evaluated for equipment diagnostics and maintenance. Reading diagnostic data and changing an equipment setting carry very different consequences. An authenticated agent with excessive permissions is still a threat to operations.

Before deployment, operators should define which models, tools and data the agent may use, which credentials it can obtain and which actions require human approval. Those restrictions must be enforced when the agent acts. Records should show what it did, whose authority it used and whether required approvals were obtained.

A model’s willingness to follow instructions cannot be the security boundary. Controls should stay consistent when models change or work moves between cloud platforms. Otherwise, each upgrade risks reopening access decisions that security teams thought were settled. Better technology must preserve control over what it can access or change.

Make resilience an acceptance test

Federal technology and acquisition leaders should make those controls a condition of acceptance. Buyers should ask suppliers how they provision device identities, verify updates, retire credentials and help customers recover after a compromise. Contracts should assign responsibility for maintaining those capabilities after deployment.

Investment should follow CISA’s focus on consequences. Which credential could interrupt a federal research facility’s operations? Which signing key could distribute a compromised update across a fleet? Which agent could alter a process affecting worker safety?

Then test whether those permissions can be withdrawn safely.

If withdrawing one compromised credential brings down an essential service, the architecture has failed its resilience test. Exercises should expose those dependencies by testing isolation, credential replacement and restoration of verified software while essential functions continue. Legacy equipment may need compensating controls until it is replaced.

CISA has committed to an implementation and outcome-measurement approach within 180 days. One measure should be whether operators can identify compromised trust, revoke access and restore verified systems while keeping essential services running.

That requires governing trust throughout the life of every device, software component and identity, including AI agents. Approval must come with enforceable limits, continuing verification and a tested way to withdraw it. An agency that cannot safely revoke access remains dependent on the very trust an attacker can exploit. CISA’s strategy will prove its value when operators can break that dependency before it causes an outage.

The post CISA’s new strategy runs into America’s blind trust problem appeared first on CyberScoop.

A Syrian man who prosecutors say was a central figure in a hacking operation run from former President Bashar Assad’s inner circle was sentenced Thursday to 42 months in federal prison.

Ahmad Umar Agha, 42, carried out the conspiracy from as early as Aug. 24, 2011, until Jan. 31, 2024, according to the Justice Department. The operation was organized and led by members of Assad’s circle, including the commander of Syria’s General Intelligence Directorate.

Agha hacked approximately 47 media entities, businesses, nongovernmental organizations and U.S. and allied government bodies, prosecutors said. The motives included punishing news organizations for reporting on Syrian government atrocities during the Arab Spring and the civil war that followed, spreading fear and confusion among the regime’s opponents, collecting intelligence and trying to persuade members of the U.S. military to refuse their orders.

“Agha deployed his hacking skills in the service of Assad’s regime to silence reporting on the regime’s atrocities, intimidate its opponents, and incite U.S. servicemembers to refuse their orders,” said Assistant Attorney General for National Security John A. Eisenberg.

The most damaging intrusion came April 23, 2013. Prosecutors said Agha accessed the Twitter account belonging to the Associated Press to post a false claim that President Barack Obama had been injured in two explosions at the White House. The post triggered a flash crash, briefly erasing $136 billion in value from the stock market. 

In another intrusion, Agha, who used the hacker handle, “Th3 Pr0,” compromised the company hosting the U.S. Marine Corps’ recruitment website and redirected about 3,500 visitors to an image urging Marines to refuse their orders and fight alongside the Syrian Army. On two occasions, he stole usernames and passwords for White House staff email accounts in attempts to take control of the White House’s social media accounts. In one instance he succeeded, prosecutors said.

The costs to victims were significant. One company that works with online publishers lost about $35,000 a day for roughly six months. A global nongovernmental organization spent about $250,000 on new network monitoring products, retrained more than 800 staff members and suffered $480,000 in total losses.

“This case emphasizes the grave threat posed by cyber criminals and especially those serving regimes hostile to the United States,” said First Assistant U.S. Attorney Theophani K. Stamos for the Eastern District of Virginia.

Agha and coconspirator Firas Dardar were first charged by criminal complaint June 12, 2014, and indicted May 17, 2018. Dardar remains a fugitive. He was also charged in 2015 in a separate conspiracy alongside Peter Romar, a Syrian national then living in Germany, that involved computer intrusion, extortion, money laundering and violations of the Syrian Sanctions Regulations. Romar was extradited from Germany and pleaded guilty in 2016.

Assad’s regime collapsed in December 2024, and the former president fled the country.

The post Syrian hacker who served Assad regime gets 42 months in US prison appeared first on CyberScoop.

Even OpenAI is admitting there is a lot of AI slop in the security space. 

An executive for the frontier AI company said Tuesday that AI-generated vulnerability reports are overwhelming open-source maintainers, leading some to stop accepting submissions as the workload exceeds their capacity to review them.

Michael Aiello, OpenAI’s cyber executive in residence, described the problem during a question-and-answer session Tuesday at the DataTribe Challenge in Washington, D.C., when he was asked how he viewed OpenAI’s Patch the Planet program versus open-source maintainers banning AI-based submissions because of concerns about quality and clarity. 

“It’s an ecosystem problem where that [maintainer] is just not going to respond to hundreds and hundreds of AI-submitted vulnerabilities,” Aiello said. 

He contrasted the volume against his company’s own program, which partners with security research organizations to identify vulnerabilities, develop fixes and help bring them into the affected projects. According to the company’s website, 661 patches have been developed and tested, with 458 of them accepted by maintainers for inclusion in the projects they oversee. 

However, Aiello said those involved with Daybreak often coordinate with maintainers, as opposed to just sending a message into GitHub and hoping for the best. 

He further described the broader burden on maintainers, who are often tasked with running through hundreds of AI-generated reports to determine validity, the security implications and evaluate the proposed fix.

“In most cases, they’re likely real bugs of some degree,” he said. “It’s, ‘Are they critical bugs?’ And are they bugs worth the time of the maintainers?…The result is they’ve just stopped taking” submissions.

Aiello further laid out advice for those that do create vulnerability disclosures for open-source maintainers, including more work in establishing the quality of the finding, writing an understandable report and allocating resources to coordinate disclosure once a report is filed.

“Make sure they’re really high quality, make sure it’s consumable and readable by a single person, and then spend your own resources coordinating vulnerability disclosure,” he said. “You need to now coordinate the vulnerability disclosure across the whole ecosystem, which is itself another project.”

Aiello used OpenAI’s work on the recent PHP vulnerabilities as an example of that coordination. He said a partner research organization discovered the flaw, and OpenAI worked with the PHP Foundation to validate it, develop a fix and coordinate its release.

“You have to work with response partners, and you have to work with the operators to actually issue the patch,” he said.

The process involved coordinating with a broad group of organizations, extending the work from technical review through patch release. Aiello acknowledged difficulties in carrying out the entire process.

“Now, did it go perfectly? No,” he said. “We’re learning as we do this over time.”

The post Before you file that AI bug report, OpenAI has some advice appeared first on CyberScoop.

On Oct. 1, threat researchers reported that the China-linked group behind Warlock ransomware, which Microsoft tracks as Storm-2603, had attacked at least four organizations in the prior two months. A water utility and a telecommunications provider were among them, along with a regional government body and a university. This all occurred in Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America.

The likely way in was on-premises Microsoft SharePoint. The researchers believe the group still carries the ToolShell flaws it exploited in July 2025, the same month Microsoft shipped the fixes, alongside newer SharePoint flaws. An exploit for a bug patched more than a year ago is still worth packing. Somewhere, a server is still waiting for its fix.

Before I ran a security company, I ran its finances. The habit I kept is reading the assumption under every number. Equipment is expected to keep producing. Inventory is expected to sell. When the assumption breaks, the asset gets written down.

Security budgets carry one too, and almost nobody writes it down. It is that the tools on the books will still be running when the attack arrives. Warlock’s operators went after that assumption directly.

Nine days in, 2 hours to disarm

One intrusion, against a critical infrastructure operator, shows the pattern.

On July 22, the attackers planted a web shell on a SharePoint server. Over the following week, they mapped the domain, set up covert remote access and added an account, apparently named to pass as a SharePoint service account, to local administrator groups. Then, for about a day, the only recorded activity was one piece of planted code running in the background.

In the early hours of July 31, they moved. First came a tool built to disable security software. Its execution was recorded on at least 40 hosts within about two hours. Next, they staged Warlock in the domain’s SYSVOL share, a folder Windows replicates to every domain controller and makes readable across the domain, and let ordinary replication carry it to at least 33 hosts. On each one, the researchers found, the ransomware showed up almost as soon as the protection was gone.

Do the arithmetic. Roughly 40 hosts in 120 minutes averages out to one machine losing its protection every three minutes.

The attackers targeted the tools watching the data before the data itself.

A line item the adversary can switch off

On the researchers’ facts, this is a patching story and an Active Directory story first. Patching and endpoint detection and response remain essential. Patching closes the door this group most likely walked through, and detection is often the only reason a team learns something is wrong. A utility that cuts either one to fund something else has made a bad trade. Tamper protection and blocking known vulnerable drivers belong switched on everywhere, too. They make the kill step harder.

But a control the adversary can switch off is worth less than its line item says.

Accountants would call it an impairment. When an event suggests an asset can no longer deliver the value it is carried at, you test it. If it fails the test, you write it down. The asset still has value. The books simply overstated it. Most security spend is expensed rather than capitalized, so no auditor will make you run this test. Run it anyway.

Warlock is that event for a lot of security budgets. Most detection spending depends on a sequence of things going right at the worst possible moment, with a sensor staying alive, a console receiving what it reports and a person reading it in time. Take away the sensor and the rest has nothing to work with. The spend remains in the budget, but the machine is left without protection.

Thinly staffed utilities carry more of that gap than their boards realize. The Congressional Research Service noted in August that 81% of the nearly 49,500 community water systems in the United States are classified as small, serving 3,300 people or fewer. Larger systems, the report says, have more capacity to hire security specialists. That likely means fewer people watching, and more hours when nobody is.

All of the victims in this latest round were outside the United States. The playbook needs no passport.

And in the early hours, when the sensors go quiet, silence looks exactly like safety.

Prevention that does not wait for the sensor

If switching off whatever is watching comes right before the payload, the protection that matters has to be in place well before then. It cannot depend on a cloud connection holding, an analyst reading an alert or a sensor surviving the night.

Start with the limit. A tool that loads a vulnerable signed driver works at the deepest level of the machine and can end any security software it finds, including the kind I am about to describe.

That is why timing is the key factor. Here the kill step came after nine days inside. Before it, the attackers had to exploit a server, load their own code into memory through sideloading and work their way to rights across the domain. Each of those steps was a chance to stop them with a control that never had to survive the kill switch, because the attacker would not have gotten close enough to use one.

One way to build that control works in memory. Much of the code an intruder loads along the way depends on finding applications laid out in memory the way it expects. Change that layout each time an application loads, and code relying on those expectations should fail at the moment it runs, on endpoints and on servers, whether or not a sensor is reporting to anyone. The decision happens on the machine.

The impairment test for a utility board

Boards already run this review for every other asset. For security, it comes down to one question. What still holds once the monitoring stops?

Ask management to split the security budget into two piles. The first is protection that depends on a sensor staying online and a person responding. The second is protection that makes its decision on the machine, without waiting on a console or a person, and acts before the attacker has earned the rights to turn it off. Then ask who would learn that the sensors went quiet, and from what, since the attacker turns off the obvious messengers first.

If the second pile is empty and nobody would be told, write that in the risk register in those words. The share of the first pile that would not survive that night is the impairment. Better to book it in a board meeting than to read about it in an incident report.

40 machines went dark in two hours. Budget for the attacker who brings a switch.

The post What happens when security tools go dark before the ransomware appeared first on CyberScoop.

Indian certificate authority eMudhra said Thursday it will stop issuing SSL/TLS certificates days after researchers showed that the private keys securing eight of its certificates were so weak they could be reconstructed in under a second.

The announcement closes an incident where major browsers blocked the certificates and  Indian authorities launched an investigation.  

The company said its board concluded after detailed deliberations that leaving the business was the right decision for eMudhra and its shareholders. Company Chairman V. Srinivasan cited rising costs from data sovereignty and compliance requirements, along with competition from large providers that issue the certificates free of charge. He also said social media amplification of the incident brought scrutiny “out of proportion” to the unit’s place in the company.

“For many certifying authorities, SSL/TLS is the whole business,” the company said. “For eMudhra it is one part of a much broader digital solutions portfolio.”

The episode began last week, when a researcher notified Apple, Google, Microsoft and Mozilla that the private keys of eight eMudhra intermediate certificates could be computed from the public certificates because they were generated with too little randomness. Security researcher Scott Helme recovered all eight on his laptop in less than a second, a task he said an AI agent later repeated from a single prompt.

Normally, a private key is a secret number so large that no computer could ever guess it, roughly 77 or 78 digits long for the type of cryptography used in these certificates. Each of the eight eMudhra keys was a whole number below 256, with one simply logged as the number 4. Since a certificate publicly displays the key it was built from, anyone could test every possible value in seconds, and such keys could be used to forge certificates and impersonate websites.

eMudhra attributed the flaw to an error in a key generation ceremony held April 2025, saying the mistake produced a second, weak set of keys that was published to browser trust lists instead of the intended ones. The company said its infrastructure was not compromised, that no data was breached and that none of the eight intermediates had issued end-entity certificates. Whether anyone used the keys in question is not known.

Chrome and Firefox blocked the certificates within hours of the report, Apple blocked them Monday and Microsoft on Tuesday. Mozilla removed the company’s root certificate from its trusted list, and Google said it will remove that root from Chrome in an update expected next week while it reviews eMudhra’s remaining root certificate. Go, Node.js, Python’s certifi bundle and several Linux distributions also shipped updates.

CERT-In, the country’s computer emergency response team, said it did not see any malicious use of the keys as of Wednesday.

The company said its other businesses, including digital signature and enterprise security services, continue to operate normally, and acknowledged reputational risks it cannot quantify.

Shares of ​the company fell 40% in the two days after the vulnerability was disclosed.

The post eMudhra kills its certificate business after researchers cracked its private keys in under a second appeared first on CyberScoop.

Cybersecurity policy has long treated data protection as a systems problem: encrypt the database, secure the network, restrict access, monitor activity, and keep attackers out. All of that still matters. But those defenses have a major blind spot. Once inside the wall the data itself is at risk. Every time data is used, copied, or moved, the risk that a malicious actor will steal and expose the data significantly increases. Policymakers need to consider a tested method that reduces the value of sensitive information if it compromised.

Hospitals, banks, defense contractors and government agencies cannot operate on permanently unreadable data. They need to process records, share information, analyze intelligence and prepare data for artificial intelligence models. The reality is data moves. It travels through cloud platforms, vendors, backups, analytics tools, payment processors, software services, AI pipelines, and partner systems. Every handoff creates another place where information can be copied, cached, logged, and indexed, and another place where it can be mishandled or stolen.

This is the gap encryption does not close. Encryption protects data when it is stored or traveling, only partially protects it when it is transmitted, and does not protect data at all when it is processed. Once an authorized system decrypts information so someone can use it, the data becomes readable again. The defenses have not reduced the sensitivity of the information. If an adversary steals unencrypted data — or decrypts stolen data at a later date when quantum computers are readily available — the adversary now has the sensitive information.

All told, encryption is essential, but it’s also not enough. Washington needs to take that seriously.

One promising answer is vaultless, keyless pseudonymization. The phrase sounds technical, but the idea is straightforward: replace sensitive values with realistic substitutes before the data spreads.

A name becomes another name. A Social Security number becomes another valid-looking Social Security number. A payment card number, patient identifier, or address keeps the same basic format. Databases, billing platforms, and analytics tools can still process the record because it looks structurally familiar. But the identity is no longer exposed to every vendor, platform, or downstream user that touches it.

That is a different mindset from the one that dominates cybersecurity policy. We spend enormous energy trying to protect every system that might handle sensitive data. We should keep doing that. But in a world of cloud services, supply chains and AI systems that retain information in hard-to-track ways, perfect control over every downstream system is more difficult than ever. The question is no longer only about securing systems but also about making exposed or stolen data less useful to threat actors if they acquire it through any means.

Traditional tokenization models swap out real values for “token” terms and store original values — like names, passwords and credit card numbers — in a central vault. That can reduce exposure, but it creates an obvious target. If the vault itself is accessed, the sensitive values behind the tokens may be exposed.

Vaultless, keyless pseudonymization is designed to remove the single point of failure created by a central vault or master key. In a model assessed by our Transformative Cyber Innovation Lab at the Foundation for Defense of Democracies, the protected data could be restored only when the required parties authorized it under controlled conditions; no one party could reverse the pseudonymized tokens on its own.

The test showed the approach could preserve the format of sensitive contents while limiting access to the real values behind them. Unauthorized restoration attempts failed and were logged. Multi-party stakeholder authorized restoration returned the correct values. Intercepted tokens did not reveal the original data value. And the system contained a unique ability to revoke access to the token — regardless of where it exist — by cutting off downstream re-identification.

The assessment showed promise that sensitive data could remain useful for legitimate work while becoming far less valuable to attackers and unauthorized users. Using vaultless, keyless pseudonymization can significantly reduce the impact of a data breach or ransomware attack if the stolen or exposed data has no intrinsic value. 

The federal government should evaluate this methodology to assess what is required to make it work in live, real-world operations. Right now, agencies may be inclined to ignore this type of technology simply because it does not fit neatly into existing categories for encryption, access control, or other cybersecurity processes. This is a mistake.   

The National Institute of Standards and Technology should evaluate what the technology does, what risks it reduces, what new dependencies it introduces, and what evidence is required before it can be trusted in practice. NSA should examine the same questions for classified networks. 

Procurement regulations should also get smarter. Vendors claiming tokenization, pseudonymization, data-layer protection or quantum-resilient properties should have to explain whether raw data enters their infrastructure, whether any token-to-source mapping exists, who can restore original values and what independent review has been completed.

Cybersecurity policy has spent decades trying to keep attackers out. That work will never end. But we need this second objective: make sensitive data less damaging when it inevitably escapes. 

The post Encryption isn’t enough to protect data wherever it goes  appeared first on CyberScoop.

The PHP project released patches Wednesday for two critical vulnerabilities in a programming language used in an extremely large portion of the internet.

The patch addresses two flaws, catalogued as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 severity scale, which tops out at 10. Researchers describe them as remote code execution vulnerabilities, which could let an attacker run their own code on a server and potentially take control of it. 

The vulnerabilities have been dubbed “php2shell” by researchers. While the industry has spent the past 24 hours sounding the alarm over the vulnerabilities, there has been very little in terms of reported exploitation as of Wednesday afternoon.

In a release, the Cybersecurity and Infrastructure Security Agency said it wasn’t aware of any exploitation.

“While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched,” the release reads.

Multiple researchers have told CyberScoop that they have observed very little activity outside of reconnaissance that is probing to see what vulnerable systems are still connected to the internet.

“We see clear evidence attackers are actively probing and performing reconnaissance across PHP applications,” Kelly Shortridge, chief product officer at Fastly, told CyberScoop. “The gap between disclosure and widespread, repeatable exploitation is typically hours to a few days for vulnerabilities of this severity and attack ROI.”

“We have not observed, or independently confirmed, successful in-the-wild exploitation of these vulnerabilities on live customer systems,” Jon Semon, principal security operations analyst at Huntress, told CyberScoop.

“We have checked across the Linux web servers we have visibility into for the post-exploitation behavior shown in the public proof of concept, such as a web server process spawning a shell that runs recon commands or writes a file into the web root, and did not find activity matching it.”

Neither the technical cause nor a complete list of affected versions has been officially confirmed, with the PHP team saying full details will be published with the release. An advisory from CERT-EU, the European Union’s computer emergency response team, says the flaws could affect every version of PHP from 5 onward. 

The security firm watchTowr said Tuesday the vulnerabilities had been set for release Thursday under embargo. The PHP team moved the release up a day and said it could act sooner still if details became public or exploitation appeared.

A video demonstrating an exploit chain spread online overnight via researcher Kirill Firsov, who shared it and credited researchers known as LCFR and Calif.io. watchTowr said it had reproduced one of the flaws. Code claiming to exploit the flaws is circulating but has not been verified, and security firms caution such code is sometimes laced with malware.

The potential exposure is broad. PHP runs between 70-80% of websites whose server-side language is known, according to market research, and underpins platforms including WordPress, Drupal, Joomla and Laravel. Researchers estimated more than 1.3 million internet-exposed hosts could be vulnerable, and a Shodan search counted about 1.9 million. Among servers that disclose their version, most run branches are no longer receiving security updates: about 758,000 run versions from 5.4 through 8.1, compared with 272,000 on supported branches, according to VirusTotal.

CERT-EU and Britain’s National Cyber Security Centre advised organizations to prepare to update systems quickly and suggested isolating internet-facing applications where immediate patching was not feasible. PHP flaws have been exploited before: the U.S. Cybersecurity and Infrastructure Security Agency’s known-exploited vulnerability catalog lists three in PHP itself, two used in ransomware campaigns.

The vulnerability was discovered by AI cybersecurity firm Calif, using OpenAI’s cybersecurity-focused AI model GPT-5.6 Sol. Wiz, an AI security firm purchased by Google in March, also independently discovered and reported the flaw, according to a blog posted by OpenAI on Wednesday.

The discovery sparked a two-month collaborative effort between OpenAI, PHP maintainers, researchers and security providers to develop a long-term technical fix and prepare for public disclosure.

OpenAI said the priority for all organizations relying on PHP is to apply the new patches, and offered a free tool and other support to help identify vulnerable versions.

“To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a Defender’s Window for maintainers and security providers to prepare fixes and protections ahead of disclosure,” OpenAI wrote in an unsigned blog.

OpenAI also said the PHP flaw is among “several significant vulnerabilities we’ve already found and are working to fix, and we expect similar findings to increase sharply in the coming months.”

In a blog posted the same day, researchers at Wiz said they had discovered “multiple critical vulnerabilities” in PHP, all related to memory safety using GPT-5.6 Sol, their own Wiz Atlas AI tool and Google’s Gemini 4 Argon to conduct their research.

Perhaps most concerning: The bug existed for decades prior to the emergence of modern AI tools, but it’s so complex and technically arduous that few attackers were likely capable of exploiting it.

According to Wiz, it required developing exploits for “notoriously complex” memory bugs that work across different PHP versions, configurations and application behaviors. It would also have to account for differences in PHP deployments that could render the exploit harmless, and each change would require more testing, analysis and debugging.

In the era of AI hacking, “this is no longer a barrier,” the Wiz researchers said.

Large language models can adapt exploits to different PHP versions, configurations or memory layouts, use third-party testing and debugging tools, and carry out a series of other functions for “reducing the specialist effort required for each target.”

“This changes the economics of both discovery and exploitation,” wrote Wiz researchers Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz. “As AI reduces the effort needed to develop and adapt complex exploits, vulnerabilities that once seemed impractical to exploit become viable targets.”

More information is expected over the course of the day. The PHP team is to publish the full advisory with the release, and security firms including Huntress and Tenable said they would update their analyses as technical details and proof-of-concept code emerge.

UPDATE: 10/21/2026, 3:00 p.m. ET: This article was updated to include infromation from CISA and from industry researchers.

The post PHP releases emergency fixes for 2 critical vulnerabilities appeared first on CyberScoop.

Spyware has been detected on devices used by some of Serbia’s most prominent figures connected to the country’s political upheaval, according to researchers who announced their findings Monday.

Vladan Ðokić, the rector of the University of Belgrade and prominent figure in the country’s student protest moment, and Rade Bajić, a lawyer with Serbia’s Public Prosecutor’s Office for Organized Crime, were targeted, according to research from the SHARE Foundation, a Serbian digital rights group, and The Citizen Lab at the University of Toronto.

The new cases follow what the SHARE Foundation described in September as the largest documented wave of spyware surveillance in the country to date. That wave included 14 people, among them a member of parliament and a local government official, targeted with Pegasus and a new version of the NoviSpy Android spyware.

Đokić, an architect and former dean of the university’s Faculty of Architecture, has led the University of Belgrade since 2021. He has publicly backed the student-led anti-corruption protests that followed the 2024 Novi Sad railway station canopy collapse, and government officials and pro-government news outlets have portrayed him as a driving force behind the movement.

His tenure has included direct confrontations with the government. In March, Serbian authorities raided his offices, and reportedly seized computers and servers. After the incident, Đokić accused authorities of trying to humiliate the institution, saying police entered without prior notice or clear legal grounds.

Andrijana Ristić, a researcher at the SHARE Foundation, whose organization conducted the initial forensic analysis, said the case is the second confirmed Pegasus infection in Serbia this year. She declined to say when the infection was discovered, citing the sensitive nature of the investigation.

The device was then given to The Citizen Lab to further confirm that Pegasus was used.

“We found with high confidence that it was infected with NSO Group’s Pegasus spyware in 2026,” a report released by the lab reads. “The infection leveraged a zero-click exploit. No action, such as a click or opening a file was necessary for infection.”

Ðokić was unavailable for comment. 

Bajić was on the legal team prosecuting a high-profile corruption case involving Serbian government officials signing off on a $500 million hotel and residential tower planned for a protected historic site in Belgrade. According to recent reporting from The Guardian, Serbian President Aleksandar Vučić allegedly pressed government officials to strip the building’s protection so that Affinity Partners, the private investment firm owned by Jared Kushner, could develop it into a Trump hotel. 

Bajić believes his work on the case led to him being a target of spyware. He pointed CyberScoop to news articles and Serbian television programs where Vučić referred to him as a “criminal” and part of a “gang that fabricated” the corruption case. 

“In my opinion, my involvement in this case was the sole reason for this unlawful spyware attack,” Bajić told CyberScoop.

Ristić told CyberScoop that Bajić received a threat notification from Apple, but neither SHARE nor Citizen Lab could pinpoint exactly what type of spyware his device was infected with. The investigation of Bajić’s device is ongoing.

Ristić described surveillance in Serbia as longstanding, tracing it to earlier tools such as FinFisher and alleged dealings with the hacking group Hacking Team — along with the original NoviSpy report by Amnesty International in 2024, which identified journalists, activists and civil society members as targets.

“I would definitely say that [spyware] is widespread,” she told CyberScoop. “I think right now it’s gaining much more media attention, especially internationally, because of the political moment.”

John Scott-Railton, senior researcher at The Citizen Lab, said “NSO has spent a decade claiming to turn over a new leaf each time an abuse surfaces. But there is no hiding the truth: Pegasus is a technology for repression. So it’s no accident that people standing up for freedom in the face of corruption keep getting hacked with NSO’s products.”

Serbia will hold parliamentary elections Oct. 25, with Vučić fighting to retain control of the government. The vote comes amid the student-led protest movement, fueled by anger over government corruption, that has grown into the largest challenge to Vučić’s rule in years.

The post Spyware found on devices belonging to prominent Serbian critics as elections loom appeared first on CyberScoop.

A cybersecurity incident at BAE Systems has halted the production and delivery of bankruptcy notices for every federal bankruptcy court in the United States, disrupting a core administrative function of the judiciary with no announced date for restoration.

The Bankruptcy Noticing Center, known as the BNC, produces and transmits notices in bankruptcy cases nationwide. BAE Systems, a defense contractor, operates the center’s systems and websites on behalf of the federal judiciary. In a statement published Thursday, the Administrative Office of the U.S. Courts said the incident affected BAE’s information technology and the websites supporting the center’s operations. 

The office said BAE is investigating and working to restore operations.

 “We are aware of a security incident that is isolated to the BNC system and have taken immediate steps to address it,” a BAE Systems spokesperson told CyberScoop. “No other systems have been affected.” 

The disruption has taken the center’s websites offline, including bnc.uscourts.gov, bankruptcynotices.uscourts.gov and notices.uscourts.gov, along with the National Creditor Registration Service. It has stopped the production and distribution of notices, paper and electronic, since Oct. 9. 

As of Friday, those websites were still offline. 

Notices of the incident first started this week when a note was posted Tuesday on the U.S. Bankruptcy court website, calling it a “nationwide service interruption” with no mention of cyberactivity. The Administrative Office’s Oct. 15 statement was the first to use the words cybersecurity incident. 

Neither announcement identified a cause, said whether information was accessed, or gave an estimate for restoration.

Clerk of Court Joe Falzone said in the announcement that courts are still taking new filings, opening cases and processing paperwork. People who need to serve documents can look up creditor and party addresses by running searches in the courts’ electronic filing system, then compare the two lists to make sure nothing is missing. But the notice warned that those lists might not include addresses that people registered through the BNC’s Electronic Bankruptcy Noticing program or the National Creditor Registration Service. Some people who are supposed to receive notice might not appear in the records.

The incident would mark the second in as many years to affect U.S. Courts. In 2025, there was a major breach of the federal judiciary’s electronic case filing system. 

The Administrative Office said it has been in communication with the affected courts as BAE Systems continues its investigation. 

UPDATE, 10/16/2026, 1:45 p.m.: This story has been updated with comment from BAE Systems.

The post Cybersecurity incident at BAE Systems disrupts US bankruptcy court system appeared first on CyberScoop.

Proofpoint agreed Thursday to acquire Varonis Systems in a cash transaction valued at approximately $6.3 billion, combining two companies that have positioned themselves around a shared bet: that securing data has become the central problem of the AI era.

The acquisition pairs two distinct approaches to security. Varonis specializes in data security, mapping where sensitive information sits inside an organization, who can reach it, and how it is actually used. Proofpoint, owned by private equity company Thoma Bravo, built its business around protecting people, blocking phishing, fraud and other attacks that arrive primarily through email and target employees rather than machines.

Sumit Dhawan, Proofpoint’s CEO, wrote in a blog post Wednesday that AI is changing the security equation on two fronts. Outside the enterprise, attackers are using AI to launch faster and more advanced campaigns aimed at data and critical systems. Inside, companies are deploying AI agents that have wide-ranging access to sensitive information, creating new categories of insider risk.

“Data Security — protecting data from compromise, loss, and misuse by people or AI agents — has become the defining priority for organizations seeking to realize AI’s full potential,” Dhawan wrote.

The companies frame the deal as a response to that dual pressure. In a joint announcement, they said the combined organization would serve millions of organizations globally, and described plans for helping organizations adopt and secure AI.

Proofpoint’s global reach, he wrote, includes 3.4 million customers, 2.37 trillion emails scanned annually, 410 billion data security events ingested, and more than 13,000 sensors across 105 countries. Those signals feed what the company calls its Knowledge Graph, which strengthens its AI models with intelligence on threats, human behavior and data risk. Combined with Varonis’ visibility into sensitive data, the companies envision a foundation for discovering and remediating risks at machine speed.

“For CISOs and CIOs, this also means stronger protection with less complexity and lower costs,” Dhwan wrote. “Our goal is to simplify security operations, enable vendor consolidation, and free up resources for reinvestment in innovation, while maintaining open integrations across the broader cybersecurity ecosystem.”

The deal extends a buying pattern for both companies. In February, Proofpoint acquired Acuvity, an AI security startup whose platform monitors how employees and automated systems interact with external AI services. Financial terms were not disclosed. 

That purchase followed Proofpoint’s acquisition of Hornetsecurity, a German provider of Microsoft 365 security services, in a deal reportedly worth more than $1 billion. Varonis, for its part, acquired the AI security firm AllTrue.ai for $150 million. 

Yaki Faitelson, Varonis’ CEO and co-founder, said the company’s mission is “to secure AI and the data that powers it” and that joining Proofpoint would advance that goal faster than the company could on its own.

The deal, approved unanimously by Varonis’ board, is expected to close in the first half of 2027, subject to shareholder and regulatory approvals.

The post Proofpoint to buy Varonis for $6.3 billion appeared first on CyberScoop.

That online ad you saw for earbuds, a drone or bubble gum-scented car air freshener may have been a gateway for mercenary spyware that can infect your device without you ever having to click on it.

The Citizen Lab at the University of Toronto on Thursday said it was revealing the first details of zero-click spyware being delivered through targeted advertising, which it’s calling AdFection. It concluded that while the Israeli company Discover-Tech presents itself as a legitimate advertising firm, in actuality it operates as a facilitator for multiple mercenary spyware partners, including the well-known Candiru. Its ads covertly direct millions of devices to contact Candiru’s servers.

The likely goal, according to the researchers, is large-scale tracking and surveillance, enabled by accident by major industry players like Google. The campaign led to the infection of devices at media outlet Al Jazeera, they said, but Discover-Tech’s ads have also appeared on many sensitive networks around the world, including at the U.S. Department of Defense, NATO, the International Atomic Energy Agency and world cybersecurity agencies, according to partner investigators at ad security firm Confiant.

It’s a discovery that the researchers said raises uncomfortable questions for regulators, whom The Citizen Lab said need to investigate Discover-Tech and levy sanctions, and for the online advertising industry.

“The adtech industry, the digital advertising industry, has a lot of rethinking to do to reconsider how they approach these threats of surveillance and the responsibilities that they have with the data that they collect and how it might be abused,” said Jerome Dangu, chief technology officer and co-founder of Confiant. “The industry has optimized against cyber criminals, scams and malware for profit that targets people for extracting money, but not for surveillance.”

Wolfie Cristl, senior researcher at The Citizen Lab, said it was “disastrous” that ad vendors didn’t detect the operation for years. Discover-Tech was registered in 2020 and has facilitated mercenary spyware since at least 2024. The activities of a shadowy outfit that the researchers dubbed DARK CARTOGRAPHER, which involves Discover-Tech and other vendors — including an unnamed U.S. intelligence contractor — date back to 2019.

“Digital advertising is broken. The way the online advertising ecosystem works today is a security threat for states, the private sector, civil society and everyone else alike,” Cristl said. “Cybersecurity agencies, regulators and lawmakers in the U.S., Europe and other regions must urgently step in. They must investigate the involved companies and fix the systemic risks that enable malicious ad targeting.”

Earlier reports have touched on the existence of mercenary spyware that can infect users through online ads, but Thursday’s research marks the first technical demonstration of infections and distribution through targeted advertising.

The Citizen Lab can’t currently attribute the AdFection attacks to any specific party.

Discover-Tech has appeared on lists of “certified” and “approved” vendors maintained by Google and IAB Europe, an advertising industry association. In response to the research, Google has removed Discover-Tech from its vendor registries and ended its access to Google ad platforms, while IAB Europe has removed Discover-Tech from its global vendor list.

Between March and June of this year, the researchers found Discover-Tech ads displayed in over 120,000 websites and over 70,000 mobile apps.

The Citizen Lab said that at least 45 devices at Al Jazeera were targeted in zero-click attacks that it linked with high confidence to Candiru spyware delivered by Discover-Tech’s ads.

Candiru spyware has shown the ability to take over a device remotely, steal data from it, access its microphone and camera, and more. Researchers discovered that in addition to Candiru, Discover-Tech has connections to another mercenary hacking firm, Bindecy, and a mercenary ad intelligence firm, Intelos.

Furthermore, the report states, “Discover-Tech operates a platform called Controlium that enables its mercenary surveillance partners to de-anonymize, fingerprint, and automatically infect devices the moment an advertisement is rendered.”

The DARK CARTOGRAPHER role is more mysterious.

“A separate threat actor we call DARK CARTOGRAPHER is using Discover-Tech’s infrastructure to exploit vulnerabilities across numerous mobile carriers to link device advertising IDs with phone numbers, mass-deanonymizing internet users. We will detail our findings concerning this threat actor in a separate forthcoming report,” Thursday’s report states. “Notably, DARK CARTOGRAPHER infrastructure links to both a mercenary adtech vendor and a U.S. government contractor. It is rare to see such direct overlaps between mercenary vendors and U.S. government or intelligence contractors.”

Discover-Tech, Candiru, Bindecy and Intelos did not respond to The Citizen Lab’s letters seeking comment.

The post AdFection: How mercenary spyware invades victims’ devices through targeted advertising appeared first on CyberScoop.

Federal authorities have charged 14 people and seized roughly 187 computers in their newest effort to disrupt North Korea’s remote IT worker scheme. 

The Justice Department announced the indictment Tuesday, highlighting two arrests and searches of more than 40 residences in Texas known or suspected to operate as “laptop farms,” where facilitators maintain employer-issued laptops so North Korean engineers can use them while abroad.

An indictment unsealed in the Northern District of Ohio charges two U.S. citizens, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. It alleges the two Americans, along with 10 others located in China, held remote jobs at more than 70 companies from 2019 through 2025 using stolen or fabricated identities, and collected about $3 million in pay. 

An Ohio resident, Trey Michael Nolte, is also named as a co-conspirator in the indictment, but is not charged. Two unnamed defendants were also charged.

“This investigation is about far more than fraud,” Ryan Raybould, a U.S. attorney in the Northern District of Texas, said in a release. “It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders. Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability. Operation Lonestar Roundup sends a clear message: we will not allow enemies of the United States to exploit our businesses or compromise our national security.”

This particular scheme proliferated over the past decade as remote work became more common. There have been multiple indictments since 2024 that have looked to charge willing conspirators in the U.S., while also disrupting the ability for North Korean nationals to successfully earn a paycheck. 

Despite those actions, the scheme has persisted. Last month, U.S. and allied governments warned that a North Korean hacking group operating under the country’s Munitions Industry Department’s 313 General Bureau is infiltrating tens of thousands of job seekers’ networks by posing as prospective employers like AI firms to steal sensitive data and millions in cryptocurrency. The intent is to circumvent economic sanctions that prevent the country from bankrolling its military ambitions through legitimate financial channels.

Detailed in an indictment released Tuesday, this particular scheme was allegedly facilitated by Nolte, who kept roughly two dozen company laptops online for overseas workers, installed remote-access software on them, and moved more than $320,000 through accounts opened under false names. The DOJ said Bostelle aided the scheme by providing his name and a fraudulent driver’s license to help a remote worker obtain a job, Carrillo hosted laptops at his home under various names, receiving about $190,000 from five employers.

Prosecutors also allege that the men filed false employment records with the Department of Homeland Security, the IRS and the Social Security Administration in the names of more than 25 identity theft victims.

The FBI also released an updated advisory that detailed how the scheme has changed over the past few years. Under pressure from better detection, North Korean workers now pay U.S. citizens to appear in interviews, take drug tests, access accounts, and keep company laptops running at home. They target people under financial strain, whom they see as easier to recruit. 

Some go further and hire freelancers in Pakistan, India and Nigeria to do the work itself, hiding who is behind the job. 

The advisory also recounted sharper tactics: threats against former managers after firings, demands for payment backed by stolen data, and paid helpers sent to intimidate companies in person. 

The group has also changed how they use certain tools. CrowdStrike, which provided assistance to law enforcement, reported that since May, the group has spoofed device identifiers, making a video capture card appear as a webcam, and reused the same disguised device across several jobs. Because these habits resemble normal remote work, no single warning sign catches them, the FBI said, so it called for layered checks throughout employment and warned that blunt filters would screen out qualified applicants.

Adam Meyers, CrowdStrike’s head of counter adversary operations, told CyberScoop while the tradecraft may change, the North Koreans’ goal of evading sanctions remains the same.

“As companies get better at identifying fraudulent workers and law enforcement disrupts their infrastructure, FAMOUS CHOLLIMA is finding new ways to conceal its operations and make the scheme more resilient,” Meyers said. “That’s why disruption is so important. Working with the FBI, we’re not just identifying the threat but dismantling the infrastructure that enables it, forcing the adversary to rebuild and reinvest. Every laptop seized, every facilitator exposed, and every operation disrupted raises the cost of doing business for North Korea.”

Despite the law enforcement effort, CrowdStrike said in its own announcement that this particular action is unlikely to have a lasting effect.

“While disrupting a laptop farm will likely only yield a limited impact on Famous Chollina centered mostly on the geolocation of the takedown, these operations send a clear signal to the adversary that law enforcement and CrowdStrike have visibility into their infrastructure and are actively tracking their movements,” the blog post reads. 

The State Department is offering rewards of up to $5 million for further information that disrupts this scheme. 

You can read the full indictment below. 

UPDATE, 10/14/2026, 11:25 a.m.: This story has been updated with comment from CrowdStrike’s Adam Meyers.

The post DOJ charges 14 over a sprawling North Korean remote work scheme appeared first on CyberScoop.

IonQ announced Monday that it will acquire Elisity, a zero-trust network security firm, in an all-stock transaction valued at up to $1.3 billion that folds enterprise access control into the quantum computing company’s expanding cybersecurity business.

Elisity, founded in 2019, sells a software policy layer that governs which users, devices, workloads and AI agents can communicate across a network, independent of the underlying network technology. The California-based company reports more than 100 global deployments and says revenue and customer counts have doubled year over year, with no churn among deployed customers.

Maryland-based IonQ, whose core business is quantum computing, has been building a security arm around post-quantum cryptography and quantum key distribution, technologies intended to replace or supplement encryption that future quantum computers may be able to break. 

The combination addresses what the companies describe as a two-front problem: conventional attacks that operate at machine speed, and the risk that encrypted data could be retained until quantum decryption becomes practical, a concept known as “harvest now, decrypt later.”

“Our customers need to contain attacks today, put AI to work safely, and prepare for quantum risk,” Elisity CEO James Winebrenner wrote in a blog post announcing the deal. 

IonQ Chairman and CEO Niccolo de Masi struck a more urgent note in a release announcing the deal: “Q-Day is coming much faster than predicted,” he said, referencing the point at which quantum computers could break current encryption technology. 

Both governments and the technology industry have accelerated their timelines to adopt post-quantum cryptography over the past few years. This is partly due to a belief among executives in the U.S. quantum sector that Chinese scientists and labs have achieved breakthroughs across several different fields of quantum computing over the past two years.

The Trump administration recently issued an executive order directing federal agencies to boost the domestic quantum industry and move up internal timelines for migrating to PQC encryption from 2035 to 2030. Google, a potential industry bellwether, and other companies have opted to move their own migration timelines to 2029.

Winebrenner told CyberScoop those deadlines are easier to set than to meet. Enterprises will hace to start with identifying the information and operations that need protecting, then mapping the identities, communications and cryptographic dependencies that support them.

“You won’t replace every legacy system at once,” he said. The approach is to migrate what can be migrated, test interoperability and operational impact, and tightly control access around systems that need more time. Segmentation helps contain threats, he added, but does not replace the cryptographic upgrades.

Elisity’s planned role in that transition is to connect identity data to cryptographic decision-making. Its roadmap would extend its IdentityGraph product with cryptographic inventory and risk information, allowing customers to rank post-quantum upgrades by business risk.

The deal also reflects how AI agents are reshaping network security. Elisity’s platform already treats AI agents and other non-human identities as subjects of access policy, and the company has joined the Open Secure AI Alliance with priorities that include least-privilege rules for sanctioned agents, containment of agentic threats and control of unsanctioned AI.

Winebrenner identified the hardest unresolved problem in agent control as maintaining trustworthy identity and authorization as an agent’s task, tools and delegated permissions change. “Knowing an agent is approved is only the beginning,” he said. “You need to understand whose authority it is exercising, what it needs to reach right now and when that access should end.” His prescription is least privilege down to the task: “An AI agent should have access only to the resources its task requires, including when it interacts with older infrastructure.”

The deal is expected to close in the fourth quarter of 2026, subject to regulatory approval.

UPDATE: 10/12/2026, 4:25 p.m.: This story has been updated with comments from Elisity CEO James Winebrenner.

The post IonQ to buy zero-trust security firm Elisity in deal valued at up to $1.3 billion appeared first on CyberScoop.

Strip away the model names and the headlines, and this year’s AI agent incidents share a feature that has little to do with how capable the models are. Nearly all of them ran through the software supply chain.

Start with the case that set off the summer’s wave of disclosures. In July, two OpenAI models undergoing a cyber-capability evaluation escaped their sandbox. They got out through a zero-day vulnerability in a package registry proxy that sat inside the evaluation boundary, placed there so the models could install the tools they needed. From there, they reached the open internet and went after Hugging Face’s production systems, looking for the benchmark’s answer key. Hugging Face caught and contained the intrusion on July 16. Five days later, OpenAI confirmed the incident and connected it to an internal cybersecurity evaluation of frontier AI models.

Soon after, Anthropic disclosed three incidents in which its Claude AI models compromised external organizations after a misconfiguration left live internet access in place. In September, it added a fourth that a wider review had turned up. The incident that Anthropic says worries it the most involved a model publishing malicious packages to the Python Package Index (PyPI).

Separately, researchers have attributed more than 2,000 RubyGems uploads in May to OpenAI agents. OpenAI says its agents were carrying out benign tasks. RubyGems removed more than 500 of the packages as malicious.

In each case, the agent’s route out, or the harm it caused, ran through a package registry, a dependency or a model file.

None of this surprised the researchers I work with. ReversingLabs has spent years taking apart the files that move through software pipelines, and we watched attackers discover the AI supply chain well before agents reached production. In early 2025, our team found malicious models on Hugging Face whose pickle payloads were packed in a 7z archive that Picklescan, the platform’s scanner, could not open. The payload itself was an ordinary reverse shell. Hugging Face took the models down after we reported them.

In April, we published research on PromptMink, a campaign we tie to the North Korean group Famous Chollima. In one case, a Claude Opus-based coding agent added a malicious dependency to a cryptocurrency trading project. What struck our team was who the attackers were writing for. Their package documentation was built to be more convincing to an AI coding assistant than to a human developer.

Put those cases side by side, and the threat model looks different from the one most enterprises are planning around. The evaluation escapes show agents misusing the access they were given. PromptMink shows agents being steered by content written specifically to fool them. In both, the damage moved through software the agent downloaded or published.

That is the context for the Open Agent Safety Platform NVIDIA launched on Sept. 28. The design starts from the right premise: you cannot secure an agent by asking it to behave. OpenShell runs each agent in a sandbox and applies policy outside the agent’s own process. Sentry, part of a reference design built on BlueField-4 data processing units (DPUs), watches agent activity from separate hardware, out of reach of a compromised host. More than 100 partners signed on at launch, ReversingLabs among them.

The Hugging Face incident shows why that architecture matters. OpenAI ran those models with cyber refusals reduced, meaning their built-in guardrails were deliberatelyweakened. That left the sandbox boundary as the main line of defense. Prompts and training shape what an agent attempts. Infrastructure decides what it can actually do.

It also matches what I hear from customers. They are demanding AI safety that closes as many gaps as possible and uses the boundary between hardware and software to deliver security they can rely on. That is the standard every vendor in this ecosystem, mine included, will be measured against.

Look, though, at where that boundary failed: a package proxy, trusted because it was supposed to be there. A policy engine can tell you an agent is permitted to install a package. It cannot tell you whether the package is what it claims to be. NVIDIA’s CISO, Saša Zdjelar, made the point himself in a Sept. 21 post, writing that teams must “verify the source and integrity of the tools, skills and dependencies agents use.” Doing that means inspecting the artifact itself, whether a model file, an archive, a container or a binary, at the boundary and before the agent touches it. Even AIUC-1, a prominent certification standard for AI agents, treats scanning model files for malicious payloads as a supplemental control rather than a required one. Its vendor due diligence requirement stops at the model provider. That is the layer ReversingLabs brings to the platform.

I have two cautions as Sentry moves from reference design to shipping products. The first is about openness. Sentry depends on specific NVIDIA hardware, and “open” will only mean something if enterprises can plug in the inspection, telemetry and policy tools they choose and run them on infrastructure they already own. Buyers should hold the ecosystem to that standard.

The second is about the need for prompt disclosure, and it applies to the whole industry. In June, an OpenAI agent accessed non-public files on the Australian government’s Medicare Statistics Reporting Service portal. Services Australia, which runs the portal, learned of it on Sept. 10, through an email to a public mailbox Prime Minister Anthony Albanese called the delay unacceptable. RubyGems maintainers learned who was likely behind their May flood of packages only from outside researchers, months after the fact.

We would not accept that timeline for any other security incident, and AI agents should not be an exception. Organizations that run agents, AI labs included, should notify affected parties on the schedules we already expect for breaches. Package registries are shared infrastructure for the entire software economy, and they should be told when an agent has published to them. Labs running offensive evaluations should treat every service reachable from the sandbox, the package proxy included, as an attack surface, and they should publish the containment standards they hold themselves to.

Compromises like SolarWinds, 3CX DesktopApp and xz Utils taught the security industry that software cannot be trusted simply because of its reputation or where it came from. Agents now pull and publish that software on their own, at a volume no review team can match. NVIDIA has built a strong platform for enforcing trust decisions. The rest of us have to make sure those decisions rest on knowing what is inside the software.

The post Your AI agent is only as safe as the packages it downloads appeared first on CyberScoop.

Federal authorities arrested a Canadian cybersecurity executive Thursday in Pennsylvania on charges of conspiracy of extortion, according to federal court records posted Friday.

Edward Dubrovsky, 54, is a former employee of CYPFER, a firm that helps organizations negotiate with ransomware operators. He is charged with conspiring to threaten the confidentiality of information in order to extort money, a violation of federal computer fraud law, and with conspiring to commit Hobbs Act extortion, which involves using threats to obstruct or affect interstate commerce to obtain money. Other details of the case remain sealed. 

While the FBI did not publicly announce Dubrovsky’s arrest, the case appears to align with actions taken in the wake of the ShinyHunters’ attack on the FBI’s IT systems, which exposed personal data about thousands of bureau employees. FBI Director Kash Patel said in a social media post that the bureau had arrested “another suspected co-conspirator” of the group, but did not name the suspect. The New York Times reported Friday that a Canadian man was arrested in Pennsylvania in connection with the attack.

When asked for further comment, the FBI pointed CyberScoop to Patel’s social media post. 

Dubrovsky’s LinkedIn page touts him as the chief operating officer and ex-founder of CYPFER. However, a firm representing CYPFER told CyberScoop that his role was Managing Director from May 2022 through Dec. 2025.

Dubrovsky “had no affiliation, operational role or relationship with CYPFER since that time, and contrary to certain reporting, was never a founder or co-founder of the company,” the firm wrote in an email to CyberScoop.

Dubrovsky’s LinkedIn page also makes reference to an affiliation with CyberSteward, which is described as a Toronto-based firm that helps breach victims negotiate ransom payments. Last month, Dubrovsky released a book covering how to deal with ransomware negotiations. 

Dubrovsky did not return CyberScoop request for comment. 

The FBI breach has drawn widespread attention. The attack marks a sobering escalation by ShinyHunters, a notorious group that previously targeted major cloud platforms, healthcare organizations, universities, technology companies, retailers and education service providers. Previous victims of ShinyHunters this year include Instructure, Salesforce, Snowflake and McKesson. 

Brett Leatherman, the FBI’s assistant director for cyber, said a review found the breach resulted from a third-party platform, where a contractor had not installed a security patch issued for the system. Reuters reported that the contractor worked for Accenture.

Since the breach was disclosed, several suspects have been taken into custody. In September, Dutch authorities arrested a 24-year-old suspected of affiliation with ShinyHunters. Additionally, a teenager, which Reuters identified as Saif Al-din Khader, had been detained and was cooperating with investigators. 

Dubrovsky’s case docket states that the case has been moved to the Eastern District of Texas, where Dubrovsky will be detained until a detention hearing is scheduled. 

UPDATE: 10/13/2026, 11:25 a.m.: This story has been updated with comment from CYPFER.

The post Canadian cybersecurity executive arrested in federal extortion case appeared first on CyberScoop.

The country is consumed right now with debating artificial intelligence and whether increasingly powerful AI systems could escape human control. Those are valid concerns, but lawmakers are overlooking another technological threat: quantum computing. Unlike AI safety debates, this risk could render today’s encryption obsolete – compromising everything from emails to financial transactions to government communications and military systems.

Quantum computers harness unusual properties of quantum physics to solve certain problems far faster than conventional computers. That potential offers major scientific and economic advances. But a sufficiently powerful quantum computer could crack widely used forms of encryption protecting sensitive digital information globally.

This threat differs from AI safety concerns. Quantum computers won’t develop goals or outsmart humans. The risk is simple: extraordinarily fast quantum machines could break the mathematical “locks” securing data.

Researchers now believe breaking some encryption may require fewer resources than previously thought. This spring, Caltech spinout Oratomic published research suggesting a cryptographically relevant quantum computer could need dramatically fewer physical resources than earlier estimates. Google has accelerated its own preparations, setting 2029 as its target for transitioning to post-quantum cryptography.

To use a rough analogy, researchers are increasingly asking whether a task once thought to require every lightbulb in Chicago might instead be accomplished with the power needed for one office building. If a company like Google, with some of the world’s deepest quantum and cryptographic expertise, is preparing for 2029, Congress should treat that deadline seriously.

The federal government has begun responding. The National Security Agency has selected quantum-resistant algorithms for National Security Systems and is moving classified and other sensitive systems toward its CNSA 2.0 standards. In June, the White House accelerated the broader federal transition, directing high value federal systems to adopt post-quantum cryptography for key establishment by the end of 2030 and digital signatures by the end of 2031.

But some dangers exist now. Foreign adversaries can steal encrypted information today, store it, and wait until they possess the computing power to decrypt it later. Cybersecurity experts call this “harvest now, decrypt later.” The White House identified that threat in its June order. Intelligence reports, military communications, corporate secrets, financial information, and other data that must remain private for years face risk long before a quantum computer capable of decrypting it exists.

Congress has devoted enormous attention in recent years to AI and social media in recent years. The post-quantum cryptography transition demands equal urgency. Lawmakers must identify national vulnerabilities and coordinate the transition across all government agencies.

The intelligence community should conduct a comprehensive assessment of its exposure to quantum decryption, building on the work at NSA. The Defense Department should assess military networks, satellites, communications systems, and critical infrastructure, ensuring future systems can upgrade encryption without replacing entire platforms. Navy and Space Force, which depend on secure communications and undersea cables carrying much of the world’s data, must be included.

The transition cannot stop at the federal level.  States and localities need resources to protect election systems. Hospitals, banks, utilities, communications networks, and critical infrastructure rely on technology that may need to remain secure for decades. Congress should help them identify vulnerable systems and begin upgrades before a crisis forces the issue, while funding the research to maintain U.S. technological superiority.

No single technology will solve this permanently. Quantum-resistant encryption is essential, but the U.S. should develop additional security layers, including hardware-based protections and emerging physical or molecular authentication technologies. Defenses must evolve as computing power advances.

China is not standing still. Through my work on the Select Committee on the Strategic Competition Between the United States and the Chinese Communist Party, I have observed that America retains an enormous innovation advantage. However, the U.S.-China Economic and Security Review Commission has warned that Beijing is likely pursuing quantum capabilities that could threaten existing encryption. China’s 15th Five-Year Plan identifies quantum technology as a future industry, while three state-backed regional venture funds, totaling roughly $17.5 billion, include quantum among the strategic technologies they are intended to support. The amount specifically allocated to quantum has not been disclosed.

Waiting would be a mistake, regardless of China’s current quantum progress.

America has repeatedly recognized technological vulnerabilities too late. The nation was slow to understand how foreign adversaries could exploit social media and discovered critical computer system weaknesses only after foreign governments penetrated them. Congress should not repeat those mistakes.

No one knows exactly when quantum computers will become powerful enough to break today’s encryption. That uncertainty is not a reason to wait. America’s strength has always been in our ability to invent new technologies, master them, and use them to protect our country. Congress should make sure we do that before our encryption becomes vulnerable, not after.

The post Quantum computers could break today’s encryption. Washington needs to prepare now. appeared first on CyberScoop.

Former National Security Agency Director Paul Nakasone said a reported broad reorganization of the agency is “probably necessary” as it confronts faster-moving cyberthreats, artificial intelligence and competition with China, but he cautioned that the outcome will depend on how the changes are carried out.

Speaking Tuesday at VulnCheck’s ThreatCon1 conference, Nakasone addressed a recent report that the NSA is undergoing a major restructuring centered in part on artificial intelligence and China. According to a report last month from the Washington Post, the agency is creating five new organizations focused on artificial intelligence, China, cybersecurity, combat support, and global intelligence, with each led by a newly elevated “mission director.”

Nakasone, who led the NSA and U.S. Cyber Command from 2018 to 2024, said he found it encouraging that agency leaders recognized the need to adapt. 

“I think that the world has changed so dramatically, so it’s hard to imagine [the NSA] not changing,” he said.

But he said large-scale institutional changes can take time, especially in an agency with broad intelligence, cyber and military responsibilities. 

“When you’re a big bureaucrat, how effective is that change? I think it depends,” Nakasone said. “It’s not necessarily the change, because I think that’s a good thing. I think it’s how you implement the change.”

Nakasone’s comments reflected a central tension in the current national security environment: Intelligence agencies are under pressure to reorganize around emerging technologies, particularly balancing the need to keep the United States as a leader in AI, while also defending against adversaries like China that will look to use the technology for their own strategic goals. 

He specifically highlighted how AI has sharply reduced the time defenders have to detect and respond to cyber intrusions. When he assumed command in 2018, he said, CrowdStrike data showed that an adversary took hours to move laterally through a system after an initial intrusion. As of 2025, that dwell time has dropped to an average of 29 minutes. 

“Remember the old mantra, we’d say, ‘Hey, we have one minute to be able to recognize something has happened, 10 minutes to figure out what we’re going to do, and 60 minutes to really enact it,” Nakasone said. “We’re well past that, and this is the challenge that we have as we think about our opportunities to have better defense in the future.”

That attack timeline is particularly significant as organizations are figuring out how AI can be used to defend their networks and systems. Nakasone, who sits on the board of OpenAI, said defenders have a temporary advantage, which he called a “defender’s window,” before adversaries fully exploit AI’s capacity against critical infrastructure and sensitive organizations.

“I think there’s a defender’s window right now within AI that really our adversaries haven’t caught up and used the capacity that really could be utilized against our critical infrastructure and most sensitive organizations,” he said.

The ability to adapt also depends on personnel, Nakasone said, pointing to agencies competing with private companies for technical talent. Citing figures for the government’s national security workforce, he said the average age is 47, with half the workforce older than 50, 10% younger than 30 and 13.5% could retire immediately.

DefenseScoop reported last week that federal employees in cybersecurity roles could face significant pay cuts.

“I think our government has to create the atmosphere that wants to make sure that people see that their work for the government is valued,” Nakasone said. “I think that there’s probably no one in this room that wouldn’t say that we can be more efficient in our government, but I also think there are a lot of people in this room that have had [their] government service attacked to say, ‘That’s just for people that can’t get jobs on the outside.’ That’s not right. I think there’s a way that we can talk much more effectively about our service and our work in our government.”

The post Former NSA chief Nakasone says agency overhaul is ‘probably needed’ appeared first on CyberScoop.

The summer’s cyberattacks by Iranian hackers on water systems in 12 states underscored how vulnerable U.S. water systems are to foreign adversaries. A broad attack on water infrastructure could have consequences comparable to a public health crisis that impacts the country’s entire population.

The threat to water has long been clear. As the 2026 Annual Threat Assessment from the U.S. intelligence community states “Cyber actors from China, Russia, Iran, North Korea, and ransomware groups . . .  pose critical threats to U.S. networks and critical infrastructure.”

Advances in artificial intelligence have heightened those vulnerabilities. Advanced AI models, such as Anthropic’s Claude Mythos, have demonstrated the ability to identify thousands of zero-day vulnerabilities in critical software systems, including major operating systems and browsers. Other systems, including some developed in China, are demonstrating similar capabilities. AI systems can now “plan, test, and execute attacks in rapid cycles,” ranging from minutes down to seconds.

U.S. water systems are vulnerable to cyberattacks for technical, legal and practical reasons.

Technical: About 80% of U.S. water systems lack even basic cyber hygiene, a weakness exploited in the summer attacks. Even systems that serve most of the population (approximately 450 large and 4500 medium-sized water systems) have not adopted advanced cybersecurity capabilities used in other sectors where failure can have catastrophic consequences, including aviation, rail, mass transit, medical devices, finance, and nuclear power.

Legal: The Environmental Protection Agency lacks clear statutory authority to impose broad cybersecurity requirements on water systems. In 2023, EPA issued a memo interpreting existing regulations to strengthen the cybersecurity of water systems. The action met widespread opposition from the water sector as well as formal legal challenges, and the EPA ultimately withdrew the memo. The agency retains limited authority. It can require water systems to complete  risk and resilience assessments, maintain emergency response plans and, in emergencies, address critical cybersecurity flaws.  

Practical: Most U.S. water systems are small.  Some 45,000 serve 3,300 persons or fewer. Because of their size, many fall outside the EPA’s regulatory authority and below the “cyber poverty line,” lacking the funding, staff and expertise necessary for effective cybersecurity.

Not surprisingly, the summer attacks drew attention from the administration and Congress. The EPA ,in partnership with the FBI, and CISA each issued guidance on remedial actions, including disconnecting operational technology, from the internet where feasible and adopting robust password practices.

Sens. Amy Klobuchar, D-Minn., and Adam Schiff (D-Calif., introduced the Water Safety Shield Act, a bill that would require tiered cybersecurity standards for the water sector and dedicate a proposed $600 million annually to water cybersecurity. It would go beyond earlier, less prescriptive efforts to improve resilience in the sector.  

The administration has also established a pilot program with Texas and private-sector cybersecurity companies to identify and address water-system vulnerabilities at no cost to utilities. These efforts are well intentioned, but they do not address the underlying causes of the problem.

Large and midsize U.S. water systems have long been targets of sophisticated adversaries. China’s Volt Typhoon revealed deep Chinese penetration of critical infrastructure, including water systems, that support national security, economic security, and civil society. Those systems remain vulnerable because many have not adopted well-known protections, such as zero-trust architecture. More fundamentally, the software on which they depend remains vulnerable to exploitation.

Policymakers have struggled to respond for two reasons: the cost and complexity of adopting stronger technical defenses, and the highly fragmented nature of the water sector. A relatively small number of large systems serve about half the U.S. population. Roughly 49,000 systems serve the rest, including the 80% of the systems serving 3,300 people or fewer. Those smaller systems serve about 7% of the population.

Despite these challenges, the capabilities needed to significantly strengthen U.S. water-system security are well known and widely used in other sectors where failure can be devastating, including those listed above.

A five-part federal program could provide high-level cybersecurity for U.S. water systems.

Establish stronger technical capabilities. Water systems should adopt zero-trust architecture, which permits only authenticated, minimum-necessary access to resources and segments networks so that a breach in one area does not compromise the entire system. Such architecture could have blocked the unauthorized intrusions used in the summer attacks. Zero-trust systems are already widely used across multiple sectors, and commercial providers can support their adoption. The Department of Defense has certified several companies to provide zero-trust architecture for department components.

Water systems should also use formal methods to reduce or eliminate vulnerabilities in software that cannot safely fail.  Although the summer attackers did not appear to exploit flaws in the water systems’ code, a high-level adversary such as China would be likely to do so.

Formal methods range from “memory-safe” programming languages, which prevent coding errors that leave computer memory open to attack, to rigorous mathematical proofs that verify that software behaves as intended. They also support secure “microkernels,” which strictly separate software functions and make it far more difficult for an attacker to move laterally through a system.

Safe code development draws on the principles of formal methods but is a more practical, semi-formal approach. AI tools developed by companies including Google and CrowdStrike can identify and help repair software vulnerabilities, a process sometimes called “code mending.” Water systems should use such tools to defend against advanced adversaries.

Developing formally verified code for water systems would not be simple. But much of the software that directs the mechanical operations of water utilities comes from a small group of companies, including Siemens, Schneider, and Rockwell Automation. Those companies have the technical expertise to develop more secure code where it is necessary. Secure microkernels are also commercially available.

Support large water systems.  Congress should require large water systems to adopt zero-trust architecture, code-mending tools, and formal methods for critical software. The requirements should be phased in over time.  The legislation should also provide tax credits to help cover the costs of developing, implementing, and maintaining these protections.

Assist midsize water systems. The federal government should establish a program that provides technical expertise and financial support to midsize water systems, including municipal utilities. The program should help them adopt zero-trust architecture, code-mending tools, and formal methods for software development.

Midsize systems will likely need a longer phase-in period than large utilities.  A federally funded cohort of experts drawn from government and the private sector could provide the necessary support. Regional teams, organized by geography or technical specialty, could address the different needs of different water systems.

Create a safe operations posture for small water systems. Few, if any, systems serving 3,300 people or fewer are run by organization with substantial cybersecurity resources. Many cash-strapped systems rely on remote monitoring because on-site service is beyond their budgets. But remote monitoring can create serious risk when industrial devices are exposed directly to the public internet without proper firewalls or virtual private networks. 

The summer attacks primarily exploited such exposed devices. The EPA, FBI, and CISA guidance said the affected systems could be protected by locking them into “run” mode, which prevents remote reprogramming. That step may reduce immediate risk, but it also requires systems to be operated in person.

Small utilities therefore need either the staff and funding for manual operations or secure remote-access systems operated by trained personnel.

A voluntary cybersecurity corps could help address the budget and staffing challenges facing small water systems.  One model would follow the National Guard approach: State governors would oversee the effort, while the federal government would provide funding. A state-led program could begin with water systems and later expand to other vulnerable critical-infrastructure sectors.

The Texas pilot, which brings together the state, the federal government and private-sector companies, could serve as a model. It could also serve as a test for a regional approach, something we suggested in a prior op-ed.  

Build an AI-capable cybersecurity cohort. The proposed cohort should include specialists in artificial intelligence, including experts from leading AI companies. They could use AI tools to develop and deploy cybersecurity programs, including zero-trust architectures and code-mending systems, for utilities of all sizes. AI is advancing rapidly and applying it to protect water systems should be a national priority. The AI specialists should work with major industrial-technology companies, including Siemens, Schneider, and Rockwell, as well as directly with the water systems, both larger and smaller.

U.S. water systems face a significant and growing threat. The Trump administration, Congress, states and private sector should work together urgently to ensure that every American can rely on safe, clean water.

Franklin D. Kramer is a former assistant secretary of defense for international security affairs.

Robert J. Butler is the co-founder and managing director of Cyber Strategies LLC, served as the first deputy assistant secretary of defense for space and cyber policy, and served as the Chief Security Officer for IO Data Centers, a global data center enterprise, among other cybersecurity-related roles in both corporate and government organizations.

Melanie J. Teplinsky is an adjunct professor and senior fellow in the Technology, Law and Security Program at American University (AU), Washington College of Law.  She previously practiced technology law at Steptoe & Jonson LLP and served on the pre-IPO advisory board for CrowdStrike.

The post The US needs a real plan to defend its water systems appeared first on CyberScoop.