Muhammad Dilshad

Attackers no longer need to write malicious code. They just need to write text your AI will read, and 82% of intrusions last year involved no traditional malware at all. CrowdStrike's 2026 Global Threat Report recorded prompt injection attacks across more than 90 organizations in 2025, where injected prompts generated commands that stole credentials and cryptocurrency. AI-enabled adversary operations climbed 89% year over year. The technique now sits at the top of the OWASP list for LLM applications, and the reason is structural: a model cannot reliably separate a developer's instructions from text it retrieves out of an email, a document, or a web page. The sharpest example arrived last month. A Rust-based macOS implant called Gaslight, attributed with high confidence to North Korea-aligned actors, embeds 38 fabricated system-failure messages inside itself. The payload is aimed at the malware analyst's own LLM triage agent, designed to make it doubt its session and abandon the analysis. Read that last one twice. The target was not the sandbox. The target was the analyst's tooling. That is where this class of attack is heading, and your team is squarely in scope. The uncomfortable math is this: even a 1% per-attempt failure rate against an agent running thousands of times a day still yields dozens of successful breaches a month. Meanwhile roughly 65% of organizations have no dedicated prompt injection defenses at all, leaning entirely on whatever their vendor ships. Signature detection cannot help you here. Language and code now share one channel, and the model has no way to draw the line between them. Forbes Takeaway Stop treating the model as a trust boundary. It is not one. Cap every agent to the smallest privilege set its job requires, and force human approval before it sends mail, executes code, moves money, or changes access controls. Allowlist the domains an agent may reach, and log the full reasoning trace behind any consequential action so you can replay it later. For your own analysts: treat AI-assisted triage output as a lead, never as a verdict, because the sample may be written to lie to it.

Approved for Anthropic's Cyber Verification Program. Here's why this matters if you work in cybersecurity. Our job requires us to think in the attacker's language. Modelling exploitation paths so a client can close them first. Every one of those tasks looks, on the surface, like offensive activity. It reads the same to a classifier. The only difference is intent and authorisation, and a model can't see either. That's the problem Cyber Verification Program (CVP) solves. It verifies the practitioner and the use case up front, then adjusts the safeguards so dual-use work, pentesting, red teaming, exploitation analysis, stops being blocked by default. What it explicitly does not do is unlock prohibited-use categories. C2 infrastructure, mass data exfiltration, ransomware development: those stay blocked for everyone, verified or not. No exceptions, no appeal path. I think that's exactly right. The interesting thing here isn't the access. It's the model of governance: don't ban the technique, verify the person and scope the permission. That's roughly how the rest of our industry already handles authorised testing. #ThreatIntelligence #DarkWebMonitoring #CyberSecurity #RedTeaming #ResponsibleAI #ClaudeSecurity #ClaudeFable5

An AI agent just ran a complete extortion campaign on its own, no human at the keyboard, and here is the part that should keep you up at night: the victim cannot recover the data even if they pay. JADEPUFFER is the first case of agentic ransomware on record, where a language model drove the entire intrusion. It walked in through CVE-2025-3248, an unauthenticated RCE in an internet-facing Langflow instance that has sat on CISA's KEV since May 2025 (T1190). From there it swept the host for secrets (T1552), strolled into a MinIO store still running default credentials (T1078.001), pivoted to an exposed MySQL and Nacos server, then encrypted config and dropped entire databases (T1486, T1485). When one login broke, the agent found the cause and pushed a working fix in 31 seconds, firing off more than 600 distinct payloads along the way. Here is what matters. Nothing the agent did was new. No zero-day, no cracked crypto. It chained known, unpatched exposure at a speed no human team matches. That is the shift worth your attention: the skill needed to run a full campaign has dropped through the floor, and your indicators of compromise now expire in seconds because the agent rewrites its own code on every run. One useful gift it left behind: the payloads narrated their own logic in plain English, which hands defenders a fresh signal to hunt on. Takeaway Treat AI orchestration tools like Langflow as production systems, not lab experiments, and get secrets out of any process that faces the web. Shift detection weight from signatures to behavior: anomalous execution from web services, secret discovery, persistence, and destructive database calls. And keep immutable backups you have actually tested, because against this actor there is no key to buy back. #JADEPUFFER #AGENTIC #RANSOMWARE #RCE #AI