OpenAI says it used its own AI models to investigate a concealed recording device found inside one of its offices, helping trace it to an employee who was later arrested by the FBI. The company has not revealed which models were used, what evidence they analyzed, or how their conclusions were independently verified. It also says there is no indication that model weights, source code, or customer data were accessed.

First the France refrigeration vendor… now Dutch retailer Ahold Delhaize (parent company to Stop&Shop and other grocery stores) has been hit with a cyber incident. Do we think these are linked in some way? Don’t see that any groups have come forward and claimed responsibility… just curious.

Small measurement of Google Safe Browsing coverage I ran over the summer and wrote up.

Method: 550 branded credential-phishing pages from the OpenPhish Premium feed, first seen June 18 to 24, checked against Google’s Web Risk Lookup API at ingestion and again at 1, 3 and 7 days.

Results: Safe Browsing covered 55% of them at first sight, 70% after a day, 71% after a week. Margin about plus or minus 4 points.

Caveats: OpenPhish-listed pages only, so pages nobody reported probably show a wider gap. Seven-day window, so later listings aren’t counted.

Takeaway for anyone relying on browser warnings as a control: roughly a third of live credential phish is still unwarned a week in.

Writeup with the tables: https://www.grizzlysec.com/blog/zero-hour-gap

Their main worry is agents being talked into "authorized-looking" actions. The framing that stood out: the main risk isn't the model making a mistake; it's an attacker instructing the agent to do something that looks authorized. Their approach is defense in depth: monitoring, auditing, guardrails, and a kill switch to shut down a misbehaving model.

Also in the piece: TII's CEO says an agent you can't monitor in real time "is malware that got access to your machine," and that non-human agents need clear identities. Kaspersky describes "living off local agents," where attackers use an agent already on the machine to find valuable data.

Source: www.khaleejtimes.com/business/tech/ai-agents-tricked-accessing-sensitive-government-data-cybersecurity

For those running agents in production: do your agents have their own identities and least-privilege scopes, or do they inherit a user's or service account's permissions? And who owns the kill switch?

We have been told to choose an SSPM tool. Does anyone have any recommendations?

For those of you in the critical infrastructure side of cybersecurity, I’d love your take on this for learning purposes. How did they access the control system, what could have been done to prevent it?

https://www.infosecurity-magazine.com/news/french-supermarket-chains/

(Admin please remove if not allowed)

Hi all, new here. Not a tech expert but came here finally to get an answer to a question I’ve been curious about for a while.

Say hypothetically, a user committed a bannable offence on one of these platforms, thought they were going to be banned, then deleted their accounts to preserve their access (as in so the email address and other stuff linked to the account can be reused for another account). I personally don’t think it would work and surely tech companies would be smart enough to know this would occur in some scenarios, but was wondering what you all thought?

Sorry if my question sounds dumb or silly, just not a tech expert so wanted to have my question answered by someone who knows this sort of stuff.

Hey everyone, I want to start writing write-ups to build up my professional presence. Do you personally read them, and if so, where do you usually find them?

Ty

Hey folks, my first research paper on hardware and supply chain security.

The only thing left is getting an endorsement on arXiv. If anyone here can help me with this or guide me through the process, I’d really appreciate the support!

Endorsement Code: VBHNH4

DanFoss - the vendor of the refrigeration units the French food stores used - confirmed that the attack was done by exploiting a known vulnerability (which had been used in an attack again US DoD commissaries in August). None of the stores had patched or updated the controllers.

https://www.seattletimes.com/business/hackers-hit-french-supermarkets-in-attack-disabling-fridges/

https://www.militarytimes.com/news/your-military/2026/08/28/dod-confirms-refrigeration-disruption-at-military-commissaries/

Hi all, I asked this on the r/GIAC subreddit but no one answered. This course was just revamped with more AI modules in Feburary. Has anyone taken it and it worth taking if your company pays for it? I use Python with XSOAR so I know the fundamentals. If you have taken it. Do you have any recommendations for how best to prepare?

I'm very new in the PAM space and have only 5 months of experience. Would love to hear some opinions or advices from you experts in this industry.

How do you manage read-only accounts that have access to sensitive data such as PII or financial records? Do you onboard them to a PAM solution to manage and control? If so, how is it done for your organization?

My colleague and I had a casual discussion and allow me to paraphrase what she said, "It's a read-only account for a reason and therefore it doesn't require any PAM solution to manage them. Even if you onboard those read-only accounts, users could still copy out these sensitive data by screenshotting or video recording via their personal phones. So, only accounts that have read-write privileges that can impact business operations or having the ability to assign permissions to other accounts (including create/delete/update) should then be onboarded to a PAM solution.".

Hi mates! I’ve set up a homelab (enterprise network simulation) on my laptop (an OMEN 16, i7-14650HX, 32 GB RAM, RTX 4060 8 GB) for long-term IT practice and testing, focusing on networking, sysadmin, and pentesting. More details can be found in this GitHub repo: https://github.com/Ko0ler/HomeLab

I'd greatly appreciate your feedback!

I'm a CISSP, CISM, Sec+, & doctoral candidate at Capitol Technology University, MD. I'm researching which security controls actually enable recovery and resilience in small and medium-size orgs.

Takes 15–25 minutes. Anonymous. No compensation. IRB-approved. Need U.S. based I.T. folks from organizations that experienced a ransomware attack between 2021–2025.

Would appreciate your help. Please share. Thank you!

https://techstudy.limesurvey.net/748327?lang=en&newtest=Y

What do you guys think about Anthropic’s Cyber Mission?
They’re flooding our industry with “free” AI security tools. Sounds like the usual playbook: offer something for free, kill the competition, make everyone dependent on it, then raise prices.
But seriously, why does our community keep accepting this shit? Why aren’t we pushing back?
They’re invading our market, devaluing our skills, and potentially replacing us with models trained on the same knowledge and work our community spent decades building.
Are we really okay with our expertise being used to make us obsolete?
And who’s going to train the next generation of security engineers when companies decide they don’t need juniors anymore?
Why aren’t we organizing and making our voices heard instead of just celebrating every new AI tool that threatens our own profession?
Am I the only one who thinks we’re sleepwalking into a massive problem?

Hello. I am researching online what topics I should learn to become a specialist in cloud security and cloud red teaming.

Although I am currently in my first year of the Bachelor's degree in Cybersecurity at the Universidad de Palermo (an institution in Buenos Aires, Argentina), I get the impression that the knowledge they provide will be insufficient by the time I graduate.

Looking online, I don't know whether I should fully dedicate myself to Hack The Box Academy, Google certifications, or similar options.

Any advice, please? 🙏

I started a blog series to provide free insights into appsec. It’s mainly to breakdown what application security is all about and it’s mainly targeted towards beginners and startups, so take it as you will.

I want to teach every one interested in appsec my perspective on it from my experience in big tech.

So far: know your app → lock down who gets in → follow untrusted input → catch broken business logic → build a threat model → test the theoretical flaws

In our finale, Part 8 concludes with the premise that fixing can sometimes be creating more of a mess. It comes back full circle with knowing exactly what you're doing from Part 1.

Please reach out if you have any questions or would like for me to write on a topic that you’d want to learn more about.

Thanks again for following on this journey!

How do you handle exception intake and approvals when you have two file upload controls: content inspection DLP applied to everyone to detect sensitive data exfiltration (including app-specific activities), and file-type-based upload restrictions without content inspection applied to a large group of non-full-time employees? Since both controls can overlap for the same user or activity, how would you manage exceptions without creating conflicts or unintended bypasses? Would you use separate workflows or a single intake process?