Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

New MITRE Framework Tracks AI Attacks and Water Utility Breaches

  MITRE has released ATT&CK v20, expanding its widely used cybersecurity framework to reflect how attackers now exploit artificial intel...

All the recent news you need to know
Cyber Security
AI Agent AI Security AI Security Agents AI Systems AI technology Anthropic Claude Cyber Security

Anthropic Acquires Opaque Systems to Strengthen Confidential and Verifiable AI

 

Anthropic has acquired Opaque Systems, which focuses on developing technologies that enable artificial intelligence systems to process sensitive information, while keeping it confidential with the help of the underlying hardware infrastructure. The details of the deal were not disclosed, and the startup confirmed that they will join Anthropic, as its separate operations will be shut down. 

Opaque announced the transaction last week, adding that their previous research output and engineering efforts concentrated on confidential computing and recently evolved towards solutions that can help organizations audit the behavior of AI systems and agents. The company was formed based on a research project at UC Berkeley’s RISELab about ten years earlier. Its co-founders are Ion Stoica, one of the co-founders of Databricks and Anyscale, and Raluca Ada Popa, a Google DeepMind researcher who works on encryption and systems security. 

Aaron Fulkerson was hired as the chief executive officer of Opaque in October 2023. Previously, Opaque worked on solutions that applied confidential computing research to production AI, making sure that the data they process and the models themselves were protected by hardware. However, as the technology matures, Opaque pointed out that there is a need for organizations to ensure that they can audit AI systems. 

According to Opaque, the company observed that the trustworthiness of AI is a critical concern for many businesses. Therefore, Opaque’s engineers and scientists took their expertise in cryptographic solutions and expanded the research to make verifiable AI the company’s specialization. They provide cryptographic guarantees that specify what computations happened, where, and under what policy. 

Moreover, the startup has made significant contributions to open-source projects that share tools, training, and experience for building trustworthy and secure AI agents and models, such as the Agent Governance Toolkit, TRACE, Confidential MCP, and Weight Custody Manifest. In early 2026, Opaque raised $24 million in a Series B funding round at a reported valuation of $300 million in funding, and Anthropic was one of their first customers, along with ServiceNow and Accenture. 

After the acquisition was announced, Opaque’s website stated that all of its employees would transfer to Anthropic to continue their work, while Opaque itself would shut down. However, it did not comment on what this means for current customers, and how transactions with organizations will be handled after the acquisition is completed.

The acquisition highlights Opaque’s technology areas and expertise, which fits Anthropic’s strategy to develop more secure and trustworthy AI systems. However, Anthropic and Opaque have not yet released any information about how the technology can be adapted to Anthropic’s solutions and products.
Read more »
Student Data Security
Compromised Login Credentials Data Breach Education Cybersecurity identity theft protection Personal Information Exposure Student Data Security

Millions of Student Records Exposed After a Single Login Is Compromised


An educational assessment management company, Educational Testing Service (ETS), has disclosed personal information about millions of current and former California public school students as a result of a data breach. 

A secure file transfer system has been accessed by an unauthorised individual, using compromised login credentials, and files containing student records have been copied by that individual. During the early morning hours of September 25, 2026, ETS noticed suspicious activity on its secure file transfer protocol server (SFTP), resulting in the discovery of the incident.

A CDE report indicates that multiple instances of unauthorised access occurred between May 22 and September 18, allowing the attackers to gain access to student information for several months before the incident was discovered. It is not known how many individuals were affected by the breach. 

The compromised records, however, contain information about all students registered in California schools over the past three years, and the potential impact extends to students whose records date back to 2006. As of the 2025–2026 academic year, California reported more than 5.7 million students enrolled in its public schools, suggesting that the incident may be of a large scale. This information includes names, dates of birth, home addresses, school and district details, grade levels, and state or local identification numbers for students. 

There may also be information regarding gender, race, ethnicity, primary language, country of origin, and English learner status included in the records. A variety of sensitive educational information, including information regarding disabilities, accommodations for testing, English proficiency, and assessment results, may also be accessed. 

Education databases are under considerable threat from security breaches and compromised credentials pose a number of risks. Although the attacker reportedly used one compromised login to access the system, the breach affected student records maintained by a third-party service provider responsible for handling sensitive student information. Additionally, students with school records going back more than three years are affected by the breach. 

A California Department of Education representative stated that former students who left public schools as early as 2006 may also be affected if their transfer to another school has not been confirmed. Neither the department nor the Department of Education have released a final number of victims, and the information exposed varies from individual to individual. 

Social Security numbers, passwords, financial account information or payment card information were not contained in the stolen records. However, exposing disability-related information, demographic details, and academic results presents privacy concerns, particularly since these records are based on minors. Following the discovery, ETS disabled the account used to access the files and took the SFTP site offline. 

In order to strengthen security, a replacement system is being developed by the organization. Moreover, it has enhanced its monitoring processes, tightened access controls, and arranged additional third-party reviews of its security practices. However, the company has not disclosed how the login credentials were compromised nor identified the attacker. In order to limit the risk that the stolen information might become publicly accessible, ETS has worked with law enforcement and cybersecurity specialists. 

There has been no evidence of the files being published online as of yet, however, the absence of such confirmation does not imply that the data has been deleted or that it will not be abused later. In addition to disrupting education-related operations, ETS suspended routine enrollment processing and paused certain assessment activities while security checks were conducted on its systems.

In a statement issued by the California Department of Education, it stated that it was working to restore affected services and minimize disruption to schools and assessment programs. On October 16, 2026, notification will begin for affected students and families, and will continue throughout early November. In addition to two years of free identity protection services, eligible current and former students can be enrolled by parents or legal guardians. 

There is an increased risk associated with relying on third-party providers to handle large volumes of sensitive educational information, as highlighted by this breach. Although the initial access was linked to compromised credentials rather than a publicized software vulnerability, the incident demonstrates the difficulty in preventing unauthorised activity from occurring when access controls and monitoring fail to prevent access to extensive records. 

It illustrates the potential threats associated with compromised credentials and inadequate access controls in systems that handle sensitive student information. Stronger authentication, continuous monitoring, and regular security reviews remain important in order to protect educational data and prevent similar incidents from occurring again.
Read more »
OpenCode
AI Models Anthropic API Keys Console Data Breach distillation attack Google OpenAI OpenCode

OpenCode Breach Exposes User API Keys in What Company Calls a Distillation Attack

 



An intruder broke into a legacy system at OpenCode late on October 16, gaining access to third-party AI provider API keys that users had stored inside OpenCode Console, the company's optional hosted service. The open-source coding platform disclosed the incident on October 17 and said 1.4% of its Console users were affected, all of whom had linked at least one external AI provider to their account.

OpenCode connected the breach to what it described as "a large-scale distillation attack," a method where someone collects outputs from frontier AI models to train a separate, competing model. Rather than building costly infrastructure or licensing training data, attackers use someone else's API access to query high-end models at scale, then feed those responses into their own system. The stolen asset in this case was not personal data but model access, specifically the ability to run queries against Claude, GPT-4, and Gemini on someone else's tab.


What Got Taken and What Did Not

OpenCode co-founder Dax Raad drew a line between accounts that stored keys in Console and those that used the local CLI or desktop app. Keys saved locally sit inside a SQLite database on the user's own machine and, as Raad noted, "never come to us." Those were not touched. Only keys that users explicitly uploaded to Console, which OpenCode stores server-side to route requests through its gateway, were within reach of the compromised system.

OpenCode has not specified what the legacy system was, how long the attacker had access, or how many users 1.4% translates to in real numbers. As of October 18, Raad said the company's systems had been under sustained pressure, with attackers attempting to get in "non stop" for 48 hours.


Users Report Charges Running Into Hundreds of Dollars

Reports on X and Reddit painted a more concrete picture of the damage. One user, Colin Parsons, said his accounts had been charged $281 on OpenAI and $168 on Anthropic. Another, Preston Zeller, reported a bill of $1,700. A Reddit thread gathered additional accounts, including roughly $400 in Anthropic usage and around 200 euros in Google Cloud charges that prompted Google to suspend the associated project.

OpenCode has not confirmed these figures as part of its own findings, and it has not addressed whether affected users will be reimbursed. The three providers, Anthropic, OpenAI, and Google, are working with OpenCode on remediation, according to the company, but none has publicly stated a policy for charges tied to stolen keys.

The mechanics of the situation make quick action important. An API key works for whoever holds it. Removing the key from inside OpenCode Console does nothing if the attacker already copied it. Console's built-in spend limits also cannot cap usage that happens outside OpenCode's own gateway, which means a copied key used directly against a provider's API bypasses those guardrails entirely.


The Distillation Attack Context

The technique OpenCode referenced is not new, and its scale in recent months has drawn attention from the companies whose models are being targeted. In February 2026, Anthropic flagged industrial-scale distillation activity, naming specific actors it said had extracted outputs from its models to train cheaper alternatives. Separately, U.S. officials noted that Chinese AI companies had pulled billions of tokens from frontier models through similar methods, a practice that lets firms skip large portions of the compute and research costs normally required to reach competitive performance levels.

What makes the OpenCode breach notable in this context is the method. Rather than scraping public interfaces or using their own accounts in violation of terms of service, the attackers here appear to have acquired legitimate credentials through a third-party breach, letting them operate under real user accounts with established billing relationships. That separation from direct account creation makes automated detection harder.


What Affected Users Should Do Now

OpenCode has advised affected users to rotate their keys immediately, but the precise steps matter. Rotating a key inside OpenCode Console alone is not sufficient. Users need to revoke the key from inside each provider's dashboard, where the credential is actually authenticated, then generate a new one and update every application or script that referenced the old key. Reviewing billing history going back to at least October 16 is also advisable, as any charges from queries the user did not make would show up in the provider's usage logs, not only inside OpenCode.

Security researchers have used the incident to argue against concentrating multiple provider keys inside a single third-party tool. Storing separate keys for separate platforms limits what any single breach can reach, and using keys with restricted permissions or lower spending thresholds reduces the potential damage if one is taken.

OpenCode says the investigation is ongoing.



Read more »
Power grid
AI Security Connecticut Utilities Cyber Security FERC Power grid

AI Use in Connecticut Utilities Faces Security Review

 

Artificial intelligence is rapidly entering the computer networks that help run and protect the United States’ electric grid, and federal regulators are warning that this shift could create new openings for hackers. The Federal Energy Regulatory Commission (FERC) said its cybersecurity auditors found increasing use of advanced AI tools—including chatbots, digital assistants, and automated analytics—inside protected network environments linked to the bulk power system. While these tools can improve efficiency, FERC cautioned that poorly controlled AI access could allow attackers to move through utility networks and reach critical systems.

FERC’s 2026 cybersecurity audit report says AI systems may mimic normal user behavior, making it harder for security teams to distinguish legitimate activity from malicious use. The agency also warned that commercially available AI tools already installed on utility systems could be used to map networks, identify routes toward critical infrastructure, accelerate reconnaissance, and automate exploitation attempts. If access is not properly authorized, verified, and monitored, AI could create “lateral-movement vectors,” meaning hackers could use one compromised system to reach deeper parts of the grid. 

The warning has prompted action in Connecticut. Attorney General William Tong and Consumer Counsel Claire Coleman have asked the Public Utilities Regulatory Authority (PURA) to review how the state’s utilities use artificial intelligence. They said the exact scope of AI deployment by Eversource and Avangrid remains unclear, even though both companies have publicly acknowledged using the technology. Tong said the issue is not whether utilities are using AI, but where, why, and how it is deployed—and what safeguards protect the state’s critical energy infrastructure. 

The proposed review would require utilities to identify their AI systems, explain each system’s purpose, disclose the level of human oversight, and provide the policies governing its use. It would cover storm response, customer systems, asset management, energy-load and water-demand forecasting, equipment procurement, grid and power-plant operations, third-party vendors, and advanced metering infrastructure. The petition also asks PURA to examine cybersecurity protections and breaches, including those connected to AI and those arising outside AI systems. 

Experts say the central issue is the difference between AI assisting human operators and AI taking actions that affect the grid. University of New Haven researcher Vahid Behzadan said that as AI gains more authority, it should face stronger independent testing, human oversight, and tested fallback procedures. Coleman acknowledged that AI could improve utility operations and reduce costs for customers, but argued those benefits must not come at the expense of safety, reliability, or consumer protection.
Read more »
Financial Loss
AI Risks AI scam AI technology Cyber Scams Cyber Security Digital Privacy Risks Financial Loss

AI-Powered Fraud Puts 9 in 10 Americans at Risk as Cyber Scams Become More Sophisticated

 

Digital fraud is becoming increasingly difficult to recognize as artificial intelligence enables criminals to develop more convincing scams and exploit personal information at scale. A report from Consumer Reports, Aspen Digital and the Global Cyber Alliance reveals that 90% of Americans surveyed had encountered a cyberattack or digital scam, while 17% said they had lost money following a digital security breach. 

The findings are based on a Consumer Reports survey of nearly 5,000 U.S. adults conducted in March and April. They highlight the widespread exposure of consumers to online threats, alongside growing concerns about the security of personal information and the possibility of unauthorized access to financial accounts. Artificial intelligence is changing how fraudsters operate by reducing the time, expense and technical effort required to target potential victims. Criminals can use information gathered from data breaches to create personalized messages that appear credible and relevant to individual recipients. 

This approach makes fraudulent communications harder to distinguish from legitimate requests, even for people who are familiar with common online threats. Stacey Higginbotham, a cybersecurity fellow at Consumer Reports, warned that scams are increasingly affecting people across different backgrounds. She also emphasized that AI could increase both the number of fraudulent messages reaching consumers and the sophistication of those attempts. Consumer Reports CEO Phil Radford has called for stronger corporate accountability, government safeguards and coordinated efforts to address the growing problem. 

Traditional phishing attempts often contain suspicious links, spelling mistakes or unfamiliar sender details. However, AI-assisted fraud can make these warning signs less obvious. Scammers who obtain personal details, including someone’s home address, may impersonate financial institutions and send tailored offers designed to gain trust or obtain sensitive information. Deepfake technology can further complicate efforts to identify fraudulent communications. 

According to Higginbotham, approximately one in five scams already involves some form of personalization, a proportion expected to increase as AI tools become more accessible. Colin Ferris, a cybersecurity expert at Silverfort, explained that creating individually tailored phishing messages previously required considerable effort. AI makes it easier to customize communications for large numbers of potential victims, increasing the reach of these schemes.

Security specialists recommend strengthening account protection as these threats evolve. Two-factor authentication and other forms of multifactor authentication can provide an additional barrier against unauthorized access. Consumers should also be cautious when opening attachments, clicking links or responding to unexpected requests involving financial information. However, individual vigilance cannot address every weakness in online security. 

Brian Cute, president and CEO of the Global Cyber Alliance, has highlighted the need for cooperation among technology companies, governments and philanthropic organizations to address vulnerabilities involving insecure internet routing and maliciously registered domains. One initiative, called Take9, encourages people to wait nine seconds before acting on suspicious messages. 

This brief pause gives recipients an opportunity to reconsider a request, verify its legitimacy and take protective steps, such as changing banking passwords when necessary. As AI continues to reshape digital fraud, combining cautious online behavior with stronger security measures and broader institutional safeguards will be increasingly important.
Read more »
Technology
AI cybersecurity AI Security Engineer Cybersecurity Careers Cybersecurity Hiring Trends Cybersecurity industry Cybersecurity Job Market Cybersecurity Jobs Technology

US Cybersecurity Job Postings Drop 26% as AI Security Demand Surges


While the demand for artificial intelligence security specialists continued to grow, cybersecurity job postings decreased to a four-year low in 2026 in the United States. CyberSN's Cybersecurity Jobs Report indicates that between January and September 2026, employers posted 235,786 cybersecurity jobs, a 26.4% decline from the same period in 2025 when 320,210 jobs were posted. 4

Using JobSpikr job listings, CyberSN categorizes the listings into 45 cybersecurity functional roles across ten groups based on the skills and responsibilities required rather than the job title assigned. While overall job openings declined, some AI-related positions experienced significant growth. In 2015, AI Security Engineer positions grew by 268.3% year over year, while listings for Cyber Data Scientists increased by 203.5%. 

These figures indicate that the demand for professionals with expertise in artificial intelligence, data analysis, and cybersecurity is growing. Additionally, AI-related skills are becoming increasingly commonplace in a wide range of cybersecurity positions. 

The use of AI was mentioned in approximately 15% of cybersecurity job postings during the first nine months of 2026, roughly matching the 15.1% that was mentioned in the previous year. However, this share reached 20% in September, which indicates that AI is increasingly common in job postings. 

AI Skills Gain Ground Across Cybersecurity Roles

According to the report, AI was most commonly mentioned in research positions, with 32.7% of listings in that category mentioning AI mentions, an increase of 11.7% over the previous year. A 23.3% increase over last year was observed in offense-related jobs, an increase of 4.8 points. AI was mentioned in 19.8% of GRC listings, while planning-related positions accounted for 18.9%. 

While several established cybersecurity positions experienced substantial decreases during the period, postings for Cyber Insider Threat Analysts decreased by 55.6% to 1,088, while Cyber Risk Analysts accounted for a 51.5% decline to 4,031 positions. Postings for penetration testers decreased 45.9% to 3,063 while postings for threat hunters decreased by 40%, reaching 1,013 positions. There was a 38.9% decline in CISO-related positions, including Chief Security Officer and Information Security Officer roles. 

The figure, however, was close to the 2,808 level of 2024, suggesting that the sharper comparison may partly reflect unusually high demand for CISOs in 2025. As of the second quarter of 2026, CISO-related jobs also increased by 19.5%. It remains possible to work remotely in many categories, particularly Sales, where 32.8% of listings offer remote work, followed closely by GRC at 31.2%. 

The report does not determine the reasons for the changing figures, since it measures advertisements rather than completed hires. It should be noted, however, that the contrast between decline in vacancies overall and rapid growth in AI-focused positions indicates that employers are seeking a significant shift in the skills that cybersecurity professionals possess. 

Remote Work Remains Available Across Several Security Functions

A number of cybersecurity job categories continued to feature remote opportunities, with Sales registering 32.8% of remote listings, Governance, Risk and Compliance (GRC) posting 31.2%. 24.7% of remote postings were related to offensive roles, while 22.9% were related to product security. Educating, researching, and defending also contributed notable shares, respectively, containing 22.8%, 21.9%, and 21.3%.

Although remote work remains available across different cybersecurity functions, its availability varies from role to role. According to the report, these proportions do not appear to reflect changes in employer policies or changes in the types of positions being advertised. 

Report Highlights Limits of Job Market Data

A CyberSN analysis measures not only posted positions, but also confirmed hires and the number of individuals entering or leaving the profession. It does not also explain why postings have declined or why AI-focused positions are in high demand. In this respect, the figures provide an overview of employer requirements during the reporting period rather than providing an exhaustive analysis of the factors influencing cybersecurity employment in general. 

While the report indicates uncertainty regarding senior leadership opportunities, the number of CISO-related postings in 2026 was close to what it was in 2024, and listings increased from the second to the third quarters. Thus, the year-over-year decline must be considered in conjunction with the unusually high level recorded the prior year as well. 

Cybersecurity professionals should monitor changes in skills requirements as the contrasting figures highlight the importance of monitoring these changes. As AI-related expertise appears in increasing numbers of job listings, several established roles have been reduced substantially. However, the available data does not indicate that AI demand is directly correlated with other job losses. It will be important to determine whether growth in AI security roles continues in the next quarter, as well as whether senior cybersecurity positions remain stable. 

According to the report, there are fewer cybersecurity vacancies overall but a strong demand for specialized AI and data skills in the coming quarters. As evidenced by the latest figures, the cybersecurity job market is changing, with AI-related skills taking on increased significance even as overall job openings decline. Future hiring data will be able to provide insight into whether this trend continues and how demand for traditional security jobs is anticipated.

Read more »
Subscribe to: Posts (Atom)

Featured