Supply Chain Security stories

Check Point says Anthropic's Claude Code can quietly stash credentials in .claude/settings.local.json, which may be published in public npm packages.

LevelBlue says unsanctioned AI agents are slipping into enterprise systems, creating a hidden governance and security blind spot for businesses.

Google Cloud expands AI security with new agents, Wiz integrations and fraud defences as it targets faster, more automated cyber attacks.

Cambridge Wireless sets out a 2026 conference agenda spanning AI, cyber resilience, quantum networking and industrial automation.

Zscaler joins Anthropic's Project Glasswing to test Claude Mythos Preview in software scans, as the firm pushes zero trust against AI-driven attacks.

HackerOne unveils h1 Validation as vulnerability reports surge 76% and AI tools speed up discovery, leaving firms struggling to triage real threats.

CIS, Astrix and Cequence publish AI security guides for large language models, autonomous agents and MCP environments.

SUSE and NVIDIA unveil an enterprise AI stack aimed at regulated sectors, offering on-premise control, governance and sovereignty for production use.

Chainguard and Cursor strike partnership to embed verified open source dependencies into AI coding, aiming to curb supply chain risks at machine speed.

Tenable warns a GitHub Actions bug in Microsoft's Windows-driver-samples repo could let attackers run code and steal secrets via public issues.

BlackBerry survey finds government and infrastructure security chiefs relying on WhatsApp for sensitive talks despite major misunderstandings over encryption.

AI models that can hunt and chain software flaws are forcing boards to rethink cyber defences, while scrutiny grows over Anthropic's MCP design risks.

Cyber Scheme extends professional standards to firms with new company accreditation backed by UK council benchmarks and procurement access.

LangWatch releases open-source AI red-teaming framework to expose hidden vulnerabilities in production agents through multi-turn attack simulations.

Proofpoint says a cargo theft gang spent weeks inside a decoy network, probing banking, fleet payment and load board systems for fraud.

Sysdig says companies are increasingly leaning on automated defence as AI-driven attacks accelerate, with machine identities now dominating cloud access.

Anthropic's Mythos spots corporate network attacks in hours, while security experts warn unmanaged AI agents are becoming a critical enterprise risk.

FIRST conference in Scottsdale draws 500-plus as security leaders and AI firms debate vulnerability disclosure, CWE's role and CVE's future.

OpenAI expands Trusted Access for Cyber with Bank of America, BlackRock and others, backing defenders, researchers and open-source security teams.

GitLab 18.11 rolls out AI agents for security remediation, pipeline setup and delivery analytics, plus new spending caps on GitLab Credits.