Cybersecurity news. Short, sharp, and to the point. Identity • AI • AppSec • Cloud • MSPs Daily reporting, breaking news, scoops, and analysis.
Boston, MA
Joined November 2025
- Tweets147
- Following14
- Followers15
- Likes1
1. Copy error code
2. Paste it into ChatGPT
3. Get a fix?
If your machine is pre-pwned you're toast!
#LLMLeak shows malware uses AI chatbots to smuggle data out of a locked-down system.
No jailbreak. No rogue model. Ouch.
securitypointbreak.com/2026/…
An alleged #ShinyHunters leader was jailed. Then the group claimed it hacked the FBI anyway.
@shaundnichols digs into the murky criminal ecosystem behind the name.
securitypointbreak.com/2026/…
A flaw in MCP's Python SDK could send OAuth authorization to attackers after a user logged in via Google, Okta or Microsoft flow.
The bug is patched. The bigger issue: AI plumbing is being built fast & old trust checks are getting missed.
securitypointbreak.com/2026/…
Two AI agent security alliances in six days, solving different problems.
#Okta's Blueprint governs agents as identities. #NVIDIA's Open Agent Safety Platform says don't trust the agent, fence it.
@zpring breaks down the difference: securitypointbreak.com/2026/…
OpenAI says research agents posted 53 user-uploaded images to third-party hosting services
SPB’s review found 8 public reports since July involving OpenAI, Anthropic & Google agents reaching outside systems or data
The timeline
securitypointbreak.com/2026/…
#AIAgents #Cybersecurity
Trump says AI is now “Super Intelligence.”
3 days later, SPB found little traction: 1 State Dept. bureau switched, while AI.gov, NIST, media, Google, dictionaries & tech companies largely haven’t.
We compared it with Gulf & Lake America:
securitypointbreak.com/2026/…
#Oktane 2026 sent a clear signal: identity is moving beyond login & into AI-agent control.
@okta push spans agent identity, runtime enforcement & a kill switch. Also announced this week: #BlueprintAlliance = premise no one vendor can secure agents alone
securitypointbreak.com/2026/…
Who is really watching the AI bill? Companies are getting better at buying AI. They’re still figuring out how to track, cap and explain what it costs.
Our latest looks at hidden AI spend, right-sizing models: securitypointbreak.com/2026/… Thx: @Checkmarx #Island & #Rilian
China says it’s standard AI development. The U.S. calls it industrial-scale model extraction.
Feds say 6 Chinese AI companies extracted billions of tokens from U.S. frontier models.
The fight over where distillation ends & model theft begins:
securitypointbreak.com/2026/…
The first rule of Botnet Club?
Don’t talk about Botnet Club.
The second rule?
Definitely don’t leave your entire criminal playbook sitting in an open directory on the internet. securitypointbreak.com/2026/… via @shaundnichols reporting
2 Cisco firewall bugs. 3 attacker groups. 1 path to root.
A flaw in Cisco Secure Firewall Management Center is under active attack.
@TalosSecurity says patch now. No workaround.
@shaundnichols walks through what defenders need to know: securitypointbreak.com/2026/…
CVSS 10. No login. One web request. And attackers are already exploiting it.
@CISAgov has added a critical @gitlab flaw to its exploited-vulnerability: Researchers warn of rapid, indiscriminate attacks.
Sharp reporting from @shaundnichols: securitypointbreak.com/2026/… #GitLab
8 Vendors Weigh In on Controlling AI: Who gets to tell an AI agent, "No! Please don’t trigger doomsday”? securitypointbreak.com/2026/… Thx: E. Boehm / @Keyfactor
F. Vukovits / @delineainc
M. Leland / @island_io
D. Jenkins / @ThreatLocker
@dgreatwood / @xageinc
@cschnedler / @RilianTech
A #GitLab bug just scored a perfect 10 — on the "how badly can this go" scale.
No auth needed. Attackers didn't wait around. #CISA already added it to the exploited-in-the-wild list.
Patch. Then check if you're already too late. securitypointbreak.com/2026/… via @SecPoBr
Cisco Firewall Bug Under Attack: A CVSS 10 bug, root access & not 1 but 3 attackers already helping themselves— #Sandworm among them. #Cisco's bigger fix is coming "next week." Their advisory and Talos's post can't agree on which week. Patch anyway. securitypointbreak.com/2026/… #Cisco
China AI distillation: The US calls it industrial-scale model theft. China calls it Tuesday. Somewhere in between, "a Terms of Service agreement is not an access control" is doing a lot of work. securitypointbreak.com/2026/… #AIsecurity
#Sality survived Napster, MySpace, Vine, and one earlier takedown attempt. It did not survive @CrowdStrike simply out-peer-to-peering its peer-to-peer network. 23 years, one clever trick. securitypointbreak.com/2026/… #botnet
First rule of botnet club: don't talk about botnet club. This operator #Redis broke rule one and left the entire toolkit — logs, wallet, R&D trail — sitting in an open folder for @Huntio to find. securitypointbreak.com/2026/… #infosec
Google says attackers built and ran a full credential-harvesting campaign in under six hours — with AI agents doing the scanning, troubleshooting and stealing. securitypointbreak.com/2026/… #AIsecurity #GoogleTAG
#FinTech giant Jack Henry is the latest #ShinyHunters vishing target, days after McKesson disclosed a breach the group claims involves 284 million records. Jack Henry says it won't pay and the incident isn't financially material. securitypointbreak.com/2026/… via @SecPoBr
