NVIDIA Announces Open Secure AI Alliance; M365 Credentials Stolen via Hotel Wi-FI DNS Poisoning; Code Four Easter Eggs Encourage Human Review of AI-Generated Content

Webcast: The Sandbox Let It Out. The Guardrails Locked Us Out.

What happens when an advanced AI escapes its sandbox, and the very guardrails designed to protect us prevent defenders from fighting back? Watch Joshua Wright, Rob T. Lee, James Lyne, Ciaran Martin, and Rich Mogull as they dissect the extraordinary OpenAI/Hugging Face breach, explore what it reveals about AI failure and the rapidly changing threat landscape, and share practical lessons every security leader and practitioner needs. This community webcast, moderated by Ed Skoudis, is available to watch now.

CSA CISO Community, With Hugging Face, Publishes Initial Post-Mortem on OpenAI Model Breach

The Cloud Security Alliance's CISO community, working with the Hugging Face response team, has published an initial post-mortem on the July breach in which two OpenAI models escaped a sandboxed evaluation and compromised Hugging Face production infrastructure. The paper, co-published by CSA, SANS, [un]prompted, RSAC, Knostic, and FIRST, draws on a July 23 briefing attended by nearly 700 CISOs and covers detection of parallel agent activity, recovery via immutable infrastructure, deception controls, hallucinated forensic artifacts, and near-term actions for security leaders. Hugging Face disclosed the intrusion on July 16; OpenAI acknowledged its models' role on July 21.

Rob T. Lee writes: I am one of the paper's authors, so read this comment with that in mind: The most useful sections are written from the defender's seat: what agentic activity looks like in telemetry, why the team rebuilt a third of its infrastructure rather than clean it, and why deception controls just moved up the priority list. If you have ten minutes, read the action list and put dates next to the items.

In the days following the OpenAI agent attack on Hugging Face, in which closed AI models hindered researchers' ability to conduct forensic analysis, NVIDIA and 36 other founding members have announced the creation of the Open Secure AI Alliance (OSAA), with the stated mission of "ensur[ing] defenders everywhere have open, frontier tools they can trust and control." ZDNET calls OSAA "something of a response to Project Glasswing." The organization's announcement argues that "the world needs both closed and open models. For cybersecurity, open models and open harnesses are essential because they democratize defensive capabilities, increase transparency for defenders, enable cyber defense while protecting data, and complement frontier closed models with customizable, localized controls." OSAA members are already contributing to the effort: NVIDIA has released the NOOA Object-Oriented Agent project on GitHub, HPE is contributing the SPIFFE/SPIRE zero-trust AI identity framework, and Hugging Face is giving its Safetensors safe format to store AI model weights to the PyTorch Foundation. Other OSAA-related projects include IBM's and Red Hat's Lightwell and Microsoft's MDASH.

Researchers at ReliaQuest have observed ongoing attacks that aim to steal credentials for Microsoft365 accounts by conducting DNS poisoning on network gateway devices in hotels, conference centers, and other businesses and venues used by traveling corporate employees. The threat actor likely gains access to a captive portal through exposed management interfaces or weak administrator credentials, and then funnels user traffic through malicious infrastructure by modifying device configurations and controlling DNS resolution. The researchers note that "This technique bypasses common DNS security controls at the endpoint level. Devices with hard-coded resolvers such as 8.8.8[.]8 (Google's public DNS server) aren't inherently protected: the request still leaves the device as unencrypted traffic that the gateway can read, forge, and redirect. Endpoint DNS-encryption tools that don't cover system services leave gaps too, since core Windows services still make ordinary, unencrypted DNS requests." However, safely routing traffic with an always-on, full-tunnel VPN and preventing forged responses with DNS encryption in strict mode, i.e., "DNS over HTTPS or DNS over TLS with plaintext fallback disabled," will protect users from this technique. The threat actor also attempted Web Proxy Auto-Discovery (WPAD) abuse in about a third of the attacks, poisoning the DHCP option and DNS lookup that WPAD checks to retrieve proxy settings when the device joins a network; "WPAD-based proxying is easy to miss because the logs generated by the traffic can look like routine network connections over HTTPS." These redirect techniques were also occasionally paired with theft of legitimate OAuth tokens through abuse of device code flow. ReliaQuest offers indicators of compromise (IoCs), and recommends organizations implement always-on, full-tunnel VPN; audit proxy authentication logs; disable WPAD if possible; train employees to check site URLs and certificates; and disable the device code authentication flow.

Code Four, an AI platform used by law enforcement agencies for multiple purposes including generating documents, has begun adding "Easter eggs" into AI-generated prose to make sure that humans carefully review the copy before a document is introduced into the judicial process. Code Four is also used to winnow down piles of evidence like video, photos, audio, and PDF data from phones, to refine what's most relevant to the case. Law enforcement officers also use it to generate drafts of warrants, affidavits, and other legal documents. To ensure that officers closely review those documents, Code Four inserts unexpected words and phrases into the body of the documents. The extraneous and obscure language must be manually removed from the documents. Code Four co-founder George Cheng says the process "basically prevents [officers] from just copy and pasting everything from the AI at face value, and they actually have to make some edits — meaningful edits — to introduce their own words and their own thoughts and emotions." Code Four is compliant with the FBI’s Criminal Justice Information Services Division security standards.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a critical authentication bypass vulnerability in Check Point's Security Management, Multi-Domain Management, and Security Gateways to the Known Exploited Vulnerability (KEV) catalog. Check Point disclosed the vulnerability (CVE-2026-16232, CVSS score 9.3) on July 22; CISA added the flaw to KEV the same day with a mitigation deadline of July 25, 2026 for Federal Civilian Executive Branch (FCEB) agencies. Since June 10, 2026, affected agencies are directed to comply with Binding Operational Directive 26-04 (BOD 26-04), which replaces BOD 22-01, the document that established the KEV catalog. BOD 26-04 focuses on “prioritizing high-risk vulnerabilities for timely action, while deferring action against low-risk vulnerabilities,” determining the urgency of remediation based on asset exposure, KEV status, exploit automation, and technical impact. Other vulnerabilities recently added to the KEV include a deserialization of untrusted data flaw in Microsoft SharePoint (CVE-2026-50522), an exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiOS (CVE-2025-68686), and an OS command injection vulnerability in Arista VeloCloud Orchestrator On-Prem (CVE-2026-16812).

GitHub and the Python Package Index (PyPI) have introduced policies intended to reduce the risk of introducing poisoned packages. GitHub's Dependabot cooldown waits at least three days after release publication of non-security versions to open a pull request, "giv[ing] maintainers, security researchers, and automated scanners time to spot a malicious version and get it pulled." Users can adjust the cooldown configuration in the dependabot[.]yml. Security updates will not be subject to cooldown, and will open immediately. PyPI's new policy "rejects new files being uploaded to releases that are older than 14 days. This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised."

On Sunday, July 26, South Carolina-based AnMed Health disclosed “a cybersecurity disruption involving malware" that prompted the organization to temporarily close 79 of its 106 facilities in South Carolina and the neighboring state of Georgia. AnMed computer systems, phones, and internet connectivity are all unavailable. AnMed Urgent Care, Kids Care, Integrated Therapy locations, and Laboratory Services were expected to open on Monday, July 27, but AnMed Medical Group offices were closed that day, and elective procedures scheduled for that day may be postponed. AnMed comprises four hospitals and more than 60 medical practices. Other healthcare-related organizations that have recently disclosed breaches: Nashville, Tennessee-based Anatomic and Clinical Laboratory Associates, P.C., has notified nearly 170,000 individuals that their personal and protected health information was compromised in a breach detected late last year. Santa Monica, CA-based telehealth and messaging software platform ZenPatient, Inc. determined that an intruder had access to its system between December 5, 2025, and February 12, 2026. Florida-based Saint Pete MRI is notifying patients of a breach detected in February 2026. South Carolina-based Carlyle Senior Care Management Company has reported a breach affecting just over 4,000 individuals. Wildwood Surgical Center in Ohio has notified affected patients that their personal data were compromised in an incident that occurred more than a year ago. Breaches were also reported at Penobscot Valley Hospital in Lincoln, Maine, SportsMed Physical Therapy in Connecticut and New Jersey, nonprofit mental health counseling and addiction services provider Lifeways, which has patients in Idaho and Oregon, Alabama's Whitfield Regional Hospital, and Michigan Surgical Center.

Researchers at Hunt.io, along with security researcher and journalist Bob Diachenko, identified a cyber-espionage attack that used an autonomous AI agent to target Thailand's Ministry of Finance. The researchers became aware of the nature of the attack after discovering "an open directory left exposed on a staging server." While the initial vector of attack has not been discovered, the researchers were able to archive three open directories comprising 585 files and 470 MB of attack code and stolen credentials over a five-day period earlier this month. The attack appears to have been conducted under the control of the Hermes open-source AI agent with YOLO mode enabled, meaning it had the capacity to execute commands without approval from humans. The researchers did not find evidence of data exfiltration; instead, the threat actor appears to have concentrated on reconnaissance, credential theft, and network mapping.

The fusion of Mandiant with Google Threat Analysis Group (TAG) has inspired the Google Threat Intelligence Group (GTIG) to reconcile its predecessor organizations' terminology by creating a new naming system for tracking threat actors. GTIG contends that code names ought to provide "critical context" and should aim to engage a defender's intuition rather than require memorization. Each threat actor will have a two-word name: The first word is "a unique and memorable term chosen to represent the specific actor, particularly names that may have been used in prior public reporting," or a randomly generated word if no recognizable term exists; the second word stands for "which category [GTIG] consider[s] to be most important for defense and response strategies," such as motivation, attribution, or type of activity. The second word category includes "CASTLE" for China, "ION" for Iran, "NEPTUNE" for North Korea, "RELIC" for Russia, and "COMET" for independent cybercriminal groups. For example, the Russian state-sponsored threat actor known for years as "Sandworm" will be called "SANDWORM RELIC" in GTIG’s new system. Other organizations' designations associated with this threat actor include APT44 (Mandiant), G0034 (MITRE), Voodoo Bear (CrowdStrike), Seashell Blizzard (Microsoft), ELECTRUM (Dragos), IRIDIUM (Resecurity), IRON VIKING (Sophos), TeleBots (ESET), and Razing Ursa (Unit 42). Older names, vendor aliases, and MITRE ATT&CK mappings will all still appear in the Google Threat Intelligence (GTI) platform, and groups yet to be categorized will still be indicated with "UNC."

An independent security researcher discovered that "Click to Pray," a Vatican-endorsed Catholic prayer guidance app and website launched in 2016, had an Insecure Direct Object Reference (IDOR) flaw that exposed the personal information of all of its nearly three quarters of a million registered users. "BobDaHacker" discovered that submitting a valid user ID number to Click to Pray's API endpoint returned a user's full name, email address, country of residence, and date of birth, with no authentication check. The API did not have rate limiting, and user numbers on the platform are sequential, making the process trivial for an attacker to scrape every user's data. Additionally, the account signup process returned a verification token before the user's email address had been verified, and BobDaHacker also suspects the app's "SPF, DKIM, or DMARC is misconfigured, which means their legitimate emails are indistinguishable from someone impersonating them." These factors combined with the personal nature and authority of the app's purpose make this exposure a serious phishing risk. BobDaHacker discovered and reported the issue in January 2026, but she received no response from any of the nine contacts. After six months she contacted Dark Reading, which published an article covering the flaw on July 24; that day, the IDOR flaw was fixed with no acknowledgment or communication. Her blog post urges the maintainers of Click to Pray to publish a security.txt file and set up a vulnerability disclosure program (VDP).