SecFlow claimed an exploit worked. It hadn’t. That unchecked claim triggered 27 follow-up tasks built on access that never existed. The lesson for AI detection engineering: test before you trust. Read the blog: hubs.ly/Q04B14x90

*LISTEN ON:* Spotify: open.spotify.com/episode/1oW… Apple Podcasts: podcasts.apple.com/us/podcas…

Patching closes the door. Who already walked through it? Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 were exploited before patches. One requires no login and affects every configuration. 🎧 Podcast link in comments.

PREFER TO LISTEN? Episode 80 of The Cyber Resilience Brief, “The AI Harness That Never Checked Its Work,” where host Tova Dvorin is joined by SafeBreach expert Adrian Culley to unpack Hunt.io’s SecFlow research incident. Listen now. safebreach.com/podcast/ai-ha…

SafeBreach Coverage for AA26-281A Chinese government-linked actors combine automated scanning with hands-on exploitation to steal sensitive data. Explore the details and 26 SafeBreach simulations to help validate your defenses: hubs.ly/Q04zPQhG0

🚨 SafeBreach Coverage for FortiBleed Stolen credentials. Rogue admins. Ransomware access. The FBI and Secret Service warn scanning continues. Test your defenses against password spraying, AD discovery, and campaign infrastructure. Explore: hubs.ly/Q04zvtsd0

AI can compress post-compromise activity from days to minutes, Microsoft’s Digital Defense Report 2026 warns. How long can you rely on your last security test? SafeBreach’s Michael De Groat explores the case for continuous validation: hubs.ly/Q04zr8180

• Two Fortune 100 Financial Services Organizations: safebreach.com/case-studies/… • A Top Global Bank Switches to SafeBreach: safebreach.com/case-studies/…

The world’s largest banks don’t assume their defenses work. They prove it. Banks use SafeBreach to continuously validate security controls against real-world attacks. Trust is built on evidence—not assumptions. Our customers tell the story. Links to case studies in comments.

SafeBreach is approved for Anthropic’s Cyber Verification Program and OpenAI’s Daybreak Blue. As CEO @GuyBejerano says, AI is one input—our validation data, threat researchers, and safety controls provide the foundation for production-safe validation. hubs.ly/Q04yW8v-0

SafeBreach Offensive Security Engineer Adrian Culley explains why this matters: “What’s notable isn’t that an AI agent found its way past a control—it’s that nobody built the agent to stop when it hit one.”

It hit a wall. Then went around it. An OpenAI agent got past Australia's Medicare data portal in a test. SafeBreach offensive security engineer Adrian Culley says, “Nobody built it to stop at the boundary.” Are your agents built to stop? Read more: hubs.ly/Q04ykD1Y0

Google’s AI model breached 3 companies during a contained test—guessing 1 password and using leaked credentials twice. SafeBreach’s VP of Research (@OrGolov) explains what this trend means for security teams. Close gaps before autonomous agents find them. hubs.ly/Q04yd9NJ0

AI didn’t just help write ransomware—it helped run the attack. A RaaS affiliate used Claude Sonnet across nearly every stage of live intrusions. Techniques aren’t new—speed and autonomy are. @BejeranoGuy explains what this means & what CISOs must validate. hubs.ly/Q04xT0H-0

SafeBreach coverage for CHOSEN BRICK, spyware linked to Iranian state actors targeting journalists, activists, and dissidents. Use 9 existing simulations to validate controls against persistence, Defender tampering, screen and audio capture, and discovery. hubs.ly/Q04xQdcW0

Read the research and see PoC here: safebreach.com/blog/python-i…

Isolation is not the same thing as security. Security Research Team Lead, Ron Ben Yizhak, went from restricted user to root inside the Azure container behind Python in Excel—and found CVE-2026-45459 along the way. How isolated is "isolated," really? Get the link in the comments.

CISA just confirmed ransomware crews are exploiting CVE-2025-14733. Unauthenticated, pre-auth, reachable over IKEv2 VPN—the exact services a firewall exposes. @SafeBreach Offensive Security Engineer explains why patch availability was never the gap: hubs.ly/Q04xd-xz0

When trusted software becomes the payload, standard malware detection may fall short. A phishing campaign across 46 countries is abusing legitimate RMM tools. SafeBreach’s Adrian Culley explains why you must test whether unexpected installs trigger alerts. scworld.com/news/phishing-ca…