AI Security

14 analyses from Devence Lab

September 13, 2026 · 2 min read

Click rate stopped measuring what phishing tests think it measures

SecurityWeek reports new research across 2.47 million simulated phishing attacks arguing that click rate no longer predicts compromise. Once AI writes the emails, click rate mostly measures how good the email was, not how alert your staff are.

September 13, 2026 · 2 min read
Your model registry runs on the same software CISA just flagged as under attack
CISA added five actively exploited flaws in JFrog Artifactory, ConnectWise ScreenConnect and MikroTik RouterOS to its known-exploited list this month. Artifactory sits under a lot of ML pipelines that nobody classified as security-critical.
September 13, 2026 · 2 min read
A million personalised fraud emails in three days breaks a defence industry's core assumption
Dark Reading reports a threat actor generated a million personalised fraud emails in three days. Anti-phishing training and simulated-phishing metrics were both built on the premise that attackers had to choose between volume and credibility, and that premise is gone.
September 13, 2026 · 2 min read
Your SOC's fastest-growing alert source is not an attacker. It is your own staff.
A new class of alert is growing faster than any other in enterprise security operations centres, and it isn't triggered by attacks on AI. It's the ordinary footprint of an organisation using it, and most detection rules aren't built to tell the difference.
September 13, 2026 · 2 min read
1.8 million apps were already scanned for secrets. Assume yours was one of them.
Security researchers have documented hardcoded secrets in Android apps for years as a slow, manual research exercise. Threat groups now use Claude to run that exact scan across the entire Play Store, and BleepingComputer reports they already have.
September 13, 2026 · 2 min read
Account bans stop misuse of the model. They don't stop the system already built with it.
Anthropic's September threat report banned the operator behind a Mali surveillance platform monitoring 25 million SIM cards — but the system runs on local models on-premises, and the ban never touched it. That gap is the finding, not the ban.
September 11, 2026 · 2 min read
200,000 exposed MCP servers is what happens when a protocol ships before its threat model
Fourteen CVEs and six figures of exposed instances in a single quarter. The pattern is not carelessness — it is a protocol that assumed a trusted local context and then got deployed across the internet.
September 11, 2026 · 3 min read
Three labs shipped cyber models in one week. The capability is not the story.
Google, Anthropic and OpenAI all put offensive-capable security models behind access programmes in early September. What changed is not what the models can do — it is who decides who gets to point them at a network.
September 10, 2026 · 2 min read
Tool poisoning works because the model cannot tell a description from an instruction
The OWASP MCP Top 10 puts tool poisoning at A1. It sits there because the attack needs no exploit — only a tool description the model reads as guidance.
September 10, 2026 · 2 min read
A CVSS 10.0 in an agent framework is a different kind of vulnerability
CVE-2026-79696 landed a maximum-severity score against Google Cloud's Agent Development Kit for Python. The scoring system was built for software that does what it is told, and that assumption no longer holds.
September 9, 2026 · 2 min read
Prompt injection stopped being a content problem the moment it reached RCE
Disclosed flaws in developer tooling chain injected HTML to a rewritten MCP configuration to arbitrary command execution, with no further user interaction. That chain changes the severity conversation.
September 9, 2026 · 2 min read
Guardrails that run on a CPU change where you can put them
Lasso Security's LEAP claims transformer-free detection in under five milliseconds on ordinary CPUs. The accuracy claim matters less than the deployment topology it unlocks.
September 8, 2026 · 2 min read
The security question is not what your AI reads. It is what it can do.
Microsoft frames the shift as tools moving from reading to acting. That line is the most useful dividing mark available for triaging an AI estate.
September 7, 2026 · 2 min read
Six MCP incidents, one pattern: the credential outlived the task
Read the disclosed incidents together and the common factor is not a protocol flaw. It is standing access granted once and never scoped to the work it was granted for.

Click rate stopped measuring what phishing tests think it measures

Your model registry runs on the same software CISA just flagged as under attack

A million personalised fraud emails in three days breaks a defence industry's core assumption

Your SOC's fastest-growing alert source is not an attacker. It is your own staff.

1.8 million apps were already scanned for secrets. Assume yours was one of them.

Account bans stop misuse of the model. They don't stop the system already built with it.

200,000 exposed MCP servers is what happens when a protocol ships before its threat model

Three labs shipped cyber models in one week. The capability is not the story.

Tool poisoning works because the model cannot tell a description from an instruction

A CVSS 10.0 in an agent framework is a different kind of vulnerability

Prompt injection stopped being a content problem the moment it reached RCE

Guardrails that run on a CPU change where you can put them

The security question is not what your AI reads. It is what it can do.

Six MCP incidents, one pattern: the credential outlived the task

We share findings with partners operating in the same constraint space.