AI · 41 giorni fa
GTIG dice che gli attaccanti sono passati dal colpire i modelli AI al trasformare credenziali e cloud rubati in una piattaforma di lavoro persistente. Il report cita furto di API key, source code, prompt e modelli proprietari, con uso del compute della vittima per continuare a far girare workload AI non autorizzati.
Il meccanismo è semplice: non basta esfiltrare un artefatto. Prendendo token, accessi cloud e quote di calcolo, l'intruso usa l'infrastruttura della vittima come se fosse propria. Così può sostenere training, inferenza o distillation anche dopo la chiusura del varco iniziale, e la compromissione smette di essere un evento puntuale.
Per i team che gestiscono assistant cloud-hosted, RAG pipeline o strumenti agentici, il problema non è solo il modello. Restano esposti gli accessi che lo fanno funzionare: se sono compromessi, l'attaccante eredita compute, dati e capacità operativa dentro lo stesso ambiente.
14 fonti che coprono questa storia
AI Threat Landscape Digest: July–August 2026 - Check Point Research
The defining development of the period came not from attackers but from the AI labs themselves, whose models broke out of controlled evaluations and reached real systems.
Securing the unpatchable in an age of AI-driven vulnerabilities
Advances in AI technology will continue to identify vulnerabilities that in some circumstances are difficult, or effectively impossible, to patch. Appropriate network segmentation, rigorous visibility, and the deployment of NGFW/IPS combinations can provide a powerful compensatory layer.
One runaway AI agent racked up a $50,000 cloud bill - Help Net Security
Enterprise AI security risks are growing as attackers exploit AI agents, supply chains, prompt injection, and weak access controls.
Cyberthreats are moving faster than SMBs: Readiness must accelerate
As AI adoption expands the attack surface and adds to the security workload, businesses need automation backed by experts
The Record from Recorded Future
China spy chief points at US AI models in cyber threat warning
China's spy chief identified Anthropic’s Claude Mythos and OpenAI’s GPT-5.5-Cyber as signs of what he called a “disruptive upgrade” in cyber capabilities, increasing the speed and potential weaponization of vulnerability discovery and malware development.
Attack Chains, Not Just Attack Surfaces: Why Testing Individual Techniques Misses the Point
OpenAEV adds Attack Chaining to automate multi-stage attack simulations, with XTM One supporting AI-led planning and execution within defined scope.
Threat actors are coming for your AI assets to operationalize their use of AI
Threat groups are leveraging stolen AI credentials and victim cloud environments to launch distillation attacks and build AI-powered exploitation and post-exploitation pipelines.
The AI Hurricane Is Here: Build for the Storm | Snyk
AI is accelerating software creation and cyberattacks. Learn how to secure agents and code at inception, enforce controls at runtime, and validate defenses independently.
Papercut AI Swarm Attack Heralds Changes for Cyber Kill Chain
From creating exploit labs for staging agentic attacks to scanning to lateral movement and exfiltration, innovative attackers are widely incorporating AI.
How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface
Threat actors are abusing trusted AI platforms to host malicious content, poison search results, and trick users into installing malware. Huntress examines campaigns targeting AI users through weaponized Claude Artifacts, shared AI conversations, sponsored search results, and ClickFix-style lures.
AI lets small actors run state-level hacking campaigns, Anthropic report finds
A new threat report from Anthropic reveals that AI is erasing the skill gap between lone cybercriminals and state-sponsored espionage operations.
Threat groups enhance cyberattack capabilities with AI
A report shows state-linked and criminal hackers are incorporating automation and agentic technology to find new victims and bypass traditional defenses.
Part of the PlainSec briefing for 2026-09-17