Cryptographic Context Injection is only the latest way to break an LLM safety guardrail. Earlier this week, researchers outlined an attack that used a secret input provided by Microsoft 365 Copilot for enterprise to cause the AI assistant to exfiltrate a password present in the user’s inbox. Now, a…
Secret parameter allowed hackers to steal passwords when a target clicked on a link. It’s not every day that attackers can force a frontier AI model to cough up user passwords and other sensitive data without user confirmation. That’s exactly what researchers recently did to Microsoft 365 Copilot for…
Filing comes after Elon Musk announced exclusive arrangement to kit out its data centers. Nvidia has disclosed that it owns nearly 123 million shares in SpaceX, further highlighting the chipmaker’s entangled financial relationships with some of its biggest customers. The $5.5 trillion company owned SpaceX stock worth nearly $21 billion at…
Screen-sharing bug lets remote hackers log in without a password. Dutch officials have warned that a high-severity macOS vulnerability that allows attackers to execute malicious code is under active exploitation. “The NCSC has received a notification indicating that active abuse of this vulnerability has been observed on multiple systems…
“We don’t have access to the data on the hardware/servers,” Iron Mountain told Ars. After its cloud storage provider went defunct, a PBS affiliate decided to sue a data center provider to regain access to 50TB of TV shows, videos, and other data dating back 70 years. As reported…
US groups release cheaper models after new challenges to their trillion-dollar ambitions. Leading US AI labs such as OpenAI and Anthropic are releasing cheaper models as they fight to retain cost-conscious customers who are switching to cut-price alternatives from Chinese rivals. The price war comes as rising AI bills…
Trump memo is first time gov’t has authorized private sector to perform cyberattacks. The Trump administration is recruiting private security firms to conduct federal government-authorized operations, including cyberattacks, against overseas-based criminal organizations that commit hacks on US persons, organizations, or government entities. In a National Security Presidential Memorandum issued…
The data was scraped and exfiltrated from 2,500 users of a compromised AI package. Terabytes worth of credentials, many belonging to the world’s biggest and most sensitive organizations, have been exposed in a supply-chain attack on LiteLLM, an open source tool that streamlines AI-driven software development. Microsoft, Amazon, Cisco,…
FBI Atlanta confirms it’s looking into the incident, no arrests made. On Monday, passengers aboard Delta flight 591 going from Las Vegas to Atlanta allegedly spoofed the onboard Wi-Fi, raising the attention of federal law enforcement. The incident came one day after the DEF CON security conference concluded in…
Device-bound session credentials thwart an increasingly common form of account takeover. Google’s Chrome browser has added a new feature that could go a long way in preventing a form of account takeover that’s grown increasingly common as users adopt two-factor authentication, passkeys, and similar protections. The new Chrome protection…
