Latest Intelligence
Google Closed Its Bug Bounty Because AI Drowned It
On October 1, Google paused its open-source bug bounty, drowned in AI-generated reports that were not real vulnerabilities. The attack is not on the code. It is a denial-of-service on the human attention that secures it. AI does not need to find the zero-day, only bury it.
Microsoft's 2026 Threat Report Is Really About 2020
Microsoft's 2026 Digital Defense Report leads with autonomous AI ransomware. Read it in full and it argues the opposite. The most detected bug in the data is Zerologon, patched in 2020. Attackers log in with stolen credentials. AI did not change how you get breached, only how fast.
China Hacked the Software that Reads Every Key You Press
UNC3569, a china-nexus group, broke into Windows machines through Sogou, the input tool millions use to type Chinese characters. One crafted link, one click, and a backdoor opened. Tencent patched it fast, but the embedded browser underneath is still ancient and defenseless.
Hundreds of AI Agents Ran the Attack, Then Broke Their Own Rules
A Russian-speaking attacker pointed hundreds of autonomous AI agents at PaperCut and hit 440 servers across 48 countries, moving from access to domain admin in minutes. The agents were told to avoid Russia, China, and Iran. They hit victims there anyway. Speed and scale come with a loss of control.
FalconFlank Turns the Bodyguard Into the Burglar
A researcher published a working exploit turning CrowdStrike Falcon, the software meant to protect a Windows machine, into a privilege escalation tool by abusing Falcon's macro cleanup feature. There is no exploit in the wild, and a mitigation exists. The same researcher hit other vendors too.
Your ATM Was Encrypted, Until It Was Not
A researcher found nine ways to strip the encryption off some ATMs, including a fail state that mounts the disk in plaintext. The flaws are patched. The unsettling part is where else this software hides, buried in products across banking, healthcare, and government that may never know it was broken.
OpenAI Built an AI Capable of Finding and Exploiting Flaws on Its Own
OpenAI says its upcoming Astra model can find unknown security flaws and write working exploits on its own, no human guiding each step. Treat the self-reported claim skeptically. But the direction is now corroborated across labs and real breaches, and that part is not up for debate.
Encryption Was the Costume, Access Was the Objective
A critical VMware vCenter flaw was patched on July 29. Five days later, a suspected China-nexus actor was already inside, across 361 IPs in 47 countries. It ended in ransomware, but QUIRSO says that was likely a smokescreen. The encryption was the costume. The access was the objective.
Microsoft Patched 400 Bugs This Month and That Is Not the Scary Part
Microsoft patched over 400 flaws in a single month, triple the normal load, because AI now hunts bugs faster than any human team. But real-world exploitation has not surged to match. The scary number is not 400. It is 13 of 14, and the gap is closing fast.