5 min read
News Brief Fireworks AI says billing data, secrets, datasets and incomplete model weights were affected, with evidence linking an LLMjacking group. A second intrusion followed on 23-24 October.
llmjacking
5 min read
News Brief Wiz counts at least nine AI developer platforms that disclosed incidents in October 2026, several pointing to stored credentials. Wiz saw stolen AWS keys used for large-scale Bedrock abuse. Root causes differ by platform and many are unconfirmed.
5 min read
News Brief Symantec's AI honeypot captured the full instruction set of an agent that finds exposed LLM endpoints, hijacks them as its reasoning engine and runs up to 100,000 unattended steps of scanning, exploitation and Monero mining.
6 min read
Research A Wake Forest University empirical study found 282 of 444 iOS AI apps expose exploitable LLM credentials through network traffic. Three months after responsible disclosure, 72% remained vulnerable.
4 min read
News Brief Sysdig researchers have documented a threat actor weaponising misconfigured Ollama model servers as the reasoning engine for an autonomous multi-stage penetration testing framework called VAPT, marking a significant shift in how stolen AI compute is being used.
4 min read
Threat Actors Sysdig caught a threat actor using a misconfigured Ollama instance as the reasoning engine for an automated offensive pentesting framework — a significant escalation from credential theft to weaponised AI infrastructure.