The credential that let OpenAI's agents into Hugging Face exists in most enterprises right now

When Hugging Face got hit last week, co-founder Clement Delangue suspected a frontier lab, given the agent's sophistication. He was right. Delangue said on X that after a day working with OpenAI [...]

Vercel breach exposes the OAuth gap most security teams cannot detect, scope or contain

One employee at Vercel adopted an AI tool. One employee at that AI vendor got hit with an infostealer. That combination created a walk-in path to Vercel’s production environments through an OAuth gr [...]

Most ransomware playbooks don't address machine credentials. Attackers know it.

The gap between ransomware threats and the defenses meant to stop them is getting worse, not better. Ivanti’s 2026 State of Cybersecurity Report found that the preparedness gap widened by an average [...]

Shared API keys expose AI agents at 69% of enterprises, new VentureBeat research finds

Share one API key across five AI agents, and a single compromised agent inherits the reach of all five. The attacker immediately benefits from the accumulated permissions of every workflow that the ke [...]

Legacy IAM was built for humans — and AI agents now outnumber them 82 to 1

Active Directory, LDAP, and early PAM were built for humans. AI agents and machines were the exception. Today, they outnumber people 82 to 1, and that human-first identity model is breaking down at ma [...]

Claude didn't just plan an attack on Mexico's government. It executed one for a month — across four domains your security stack can't see.

Attackers jailbroke Anthropic’s Claude and ran it against multiple Mexican government agencies for approximately a month. They stole 150 GB of data from Mexico’s federal tax authority, the nationa [...]

The best password manager for 2025

Recently, we saw all the ways reused passwords can harm your security posture. The 23andMe attack comes to mind, but generally credential stuffing has been on the rise. Hackers can buy or find your re [...]

How recruitment fraud turned cloud IAM into a $2 billion attack surface

A developer gets a LinkedIn message from a recruiter. The role looks legitimate. The coding assessment requires installing a package. That package exfiltrates all cloud credentials from the developerâ [...]

AI agent credentials live in the same box as untrusted code. Two new architectures show where the blast radius actually stops.

Four separate RSAC 2026 keynotes arrived at the same conclusion without coordinating. Microsoft's Vasu Jakkal told attendees that zero trust must extend to AI. Cisco's Jeetu Patel called for [...]