US intelligence agencies have accused six Chinese AI firms of using large-scale distillation attacks to extract billions of tokens from leading American AI models.
Non-human identities like service accounts and AI agents have overtaken phishing as the leading route for attackers to enter enterprises, according to SpyCloud.
Meta has introduced Muse, a personal AI agent capable of performing autonomous tasks like booking travel and negotiating, using secure virtual machines to isolate user data.
Threat actors are using infostealer malware like Lumma and Vidar to harvest session tokens, enabling them to bypass MFA and hijack premium AI services.
Researchers have identified a new attack vector called "workflow identity hijacking" that allows threat actors to exploit authorisation flaws in enterprise AI pipelines.
