Tag: RedTeam
-
AI Agent Harnesses Can Change Red Teaming Results
Lasso research finds AI agent harnesses can influence red teaming performance as much as the underlying LLM. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/artificial-intelligence/ai-agent-harnesses-can-change-red-teaming-results/
-
Von selektiven Checks zur umfassenden Analyse: Deutsche Telekom nutzt KI für Cybersecurity
Management Summary KI wird zum Skalierungshebel für Cybersecurity: Die Deutsche Telekom zeigt, wie sich etablierte Sicherheitsanalysen mit GPT-5.5 Cyber von punktuellen Prüfungen auf deutlich größere IT-Umgebungen ausweiten lassen. Bestehende Security-Verfahren bleiben maßgeblich: KI ersetzt weder Red Teams noch klassische Prüfprozesse, sondern erweitert deren Reichweite und entlastet Fachkräfte bei wiederkehrenden Analyseaufgaben. Zwei praxisnahe Einsatzfelder stehen im……
-
6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026
Device code phishing – the abuse of the OAuth 2.0 device authorization grant to steal access tokens – has evolved from a niche red-team technique to an industrial-scale threat in under six months.Designed for input-constrained devices like smart TVs, printers, and so on, the device authorization login flow has been adopted by a wide range…
-
OpenSSL Fixes HollowByte Memory Exhaustion Bug
Okta disclosed HollowByte, an 11-byte OpenSSL flaw that lets remote attackers exhaust server memory and trigger denial-of-service attacks. Okta’s Red Team disclosed a denial-of-service vulnerability in OpenSSL they named HollowByte, and the attack payload is exactly 11 bytes. A remote, unauthenticated attacker sends that payload and the server allocates up to 131 KB of memory…
-
OpenSSL DoS Vulnerability Lets Remote Attackers Exhaust Server Memory With an 11-Byte Payload
A newly disclosed vulnerability reminds us how deeply our digital infrastructure relies on foundational libraries. The Okta Red Team recently discovered >>HollowByte,<< a Denial of Service (DoS) flaw in OpenSSL that allows a remote, unauthenticated attacker to force a server to allocate disproportionate memory chunks before any security handshake even begins, using a payload just…
-
OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests
Eleven bytes will make an unpatched OpenSSL server set aside up to 131 KB of memory for a message that never arrives. On the glibc systems Okta tested, that memory is gone until the process restarts.OpenSSL shipped the HollowByte fix in June with no CVE, no advisory, and no changelog entry pointing at it. Okta’s…
-
Continuous Red Teaming: Warum KI-Systeme permanent getestet werden müssen
Continuous Red Teaming: Einmalige Sicherheitstests reichen für KI nicht aus. NIST zeigt, warum Continuous Red Teaming und Runtime Protection zum neuen Standard werden. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/continuous-red-teaming-warum-ki-systeme-permanent-getestet-werden-muessen/a45790/
-
KI-Sicherheit erfordert kontinuierliches Red-Teaming
Check Point Software Technologies beschreibt ein zentrales Problem moderner KI-Sicherheit: Ein bestandener Sicherheitstest ist kein dauerhafter Nachweis für Sicherheit. Er gilt nur für ein bestimmtes System, eine konkrete Konfiguration und einen bestimmten Zeitpunkt. Produktive KI-Systeme verändern sich jedoch laufend: Modelle passen ihr Verhalten an, Prompts werden überarbeitet, Retrieval-Quellen kommen hinzu, Agenten erhalten neue Tools und…
-
OpenAI’s GPT-Red Automates Prompt Injection Testing to Harden GPT-5.6 Sol
OpenAI has disclosed details of GPT-Red, an internal automated red-teaming model that scales prompt injection vulnerability discovery with an aim to fix issues before the tools are deployed widely.”GPT”‘Red is a strong red-teamer, and our previous models are highly vulnerable to its prompt injection attacks,” the artificial intelligence (AI) company said. “We use GPT”‘Red to…
-
Pentests und Red-Team-Erfahrungen aus dem Verteidigungsumfeld – Die wahre Sicherheitslücke der Rüstungsindustrie liegt in der Umsetzung
First seen on security-insider.de Jump to article: www.security-insider.de/ruestungsindustrie-it-sicherheit-umsetzungsdefizite-pentests-a-66ef648bc9fba47fab12d5dc8113d76a/
-
CBSE Re-Evaluation Portal Goes Live After Final Cybersecurity Clearance
The Central Board of Secondary Education has secured the final CBSE cybersecurity clearance required for its examiner-facing re-evaluation portal, allowing the reassessment of Class 12 answer scripts to move forward. The approval was granted on the night of June 6, 2026, after the completion of the final phase of cybersecurity testing conducted through an IIT-led red team…
-
CBSE Re-Evaluation Portal Goes Live After Final Cybersecurity Clearance
The Central Board of Secondary Education has secured the final CBSE cybersecurity clearance required for its examiner-facing re-evaluation portal, allowing the reassessment of Class 12 answer scripts to move forward. The approval was granted on the night of June 6, 2026, after the completion of the final phase of cybersecurity testing conducted through an IIT-led red team…
-
EDRChoker Tool Abuses Windows QoS Policies to Disrupt Endpoint Security Tools
A newly disclosed red-team tool dubbed “EDRChoker” is drawing attention across the cybersecurity community for its novel approach to disrupting Endpoint Detection and Response (EDR) visibility by abusing Windows Policy-based Quality of Service (quality of service). Unlike traditional EDR evasion techniques that rely on firewall manipulation or Windows Filtering Platform (WFP) rule injection, EDRChoker operates…
-
Zero-Click Agentic AI Attack Bypasses Human Oversight
Taxonomy of Failure Modes in Agentic AI Systems v2.0 published in April 2026, the field received more than a classification update: it got operational guidance grounded in a year of real-world red teaming that exposed how quickly agentic AI systems transform classical threat surfaces into new, high-impact attack vectors. The headline finding from those engagements…
-
Anthropic Expands Public Access to Claude Mythos AI Model
Expect to See Widespread Availability of Mythos-Level Models Within 6-12 Months. Anthropic is expanding public access to its frontier artificial intelligence model Claude Mythos to qualifying customers’ security teams on request for such purposes as vulnerability research and red-teaming, and predicts that Mythos-class models will be publicly available within 12 months. First seen on govinfosecurity.com…
-
Microsoft releases new AI red teaming tools for developers
First seen on scworld.com Jump to article: www.scworld.com/brief/microsoft-releases-new-ai-red-teaming-tools-for-developers
-
AI red teaming agents change how LLMs get tested
Adversarial probing of LLMs has piled up a sprawling toolkit over the past three years. Attack techniques with names like Tree of Attacks with Pruning, Crescendo, and Skeleton … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/05/21/ai-red-teaming-agents-research/
-
Meet Rampart and Clarity, Microsoft’s new red team combo AI agents
Microsoft’s AI red team lead talked to CyberScoop about the goals behind open sourcing a pair of security tools meant for developers and incident responders. First seen on cyberscoop.com Jump to article: cyberscoop.com/microsoft-rampart-clarity-agentic-ai-security-red-teaming-tools/
-
Microsoft Open-Sources RAMPART and Clarity to Secure AI Agents During Development
Microsoft has unveiled two new open-source tools called RAMPART and Clarity to assist developers in better testing the security of artificial intelligence (AI) agents.RAMPART, short for Risk Assessment and Measurement Platform for Agentic Red Teaming, functions as a Pytest-native safety and security testing framework for writing and running safety and security tests for AI agents,…
-
Palo Alto Networks bets on identity security for autonomous AI with Idira launch
Tags: ai, attack, business, ceo, ciso, cloud, credentials, cybersecurity, governance, identity, injection, intelligence, least-privilege, mfa, network, RedTeam, risk, soc, threat, tool, vulnerabilityCISOs navigate AI risks: For enterprises, the launch reflects a broader industry shift toward identity-centric cybersecurity models as organizations deploy generative AI tools, autonomous agents, and cloud-native applications at scale.Analysts say the growing number of non-human identities is creating operational and security challenges because many existing identity systems were originally built to manage employees and…
-
OpenAI introduces Daybreak cyber platform, takes on Anthropic Mythos
Tags: access, ai, cisco, crowdstrike, cyber, cybersecurity, defense, detection, fortinet, framework, government, malware, network, openai, oracle, penetration-testing, RedTeam, risk, software, strategy, technology, update, vulnerabilityOpenAI’s cybersecurity model stack: OpenAI is pursuing a scalable cyber defense platform strategy with Daybreak and is rolling out the initiative through three different model tiers: GPT-5.5 (default), GPT-5.5 with Trusted Access for Cyber, and GPT-5.5-Cyber.The standard GPT-5.5 model is positioned for general-purpose enterprise use cases, including developer assistance and knowledge work. GPT-5.5 with Trusted…
-
Lyrie.ai Joins First Batch of Anthropic’s Cyber Verification Program
Tags: ai, attack, ceo, cyber, cybersecurity, exploit, framework, github, Hardware, identity, infrastructure, Internet, penetration-testing, RedTeam, risk, threat, tool, vulnerability, zero-dayIdentity, who the AI agent is.Scope, what it is authorized to do.Attestation, whether it or its instructions have been tampered with.Delegation, who delegated authority.Revocation, whether that authority has been revoked.”Every AI agent on the internet today is a stranger. You don’t know who it is, what it’s authorized to do, or whether it’s been tampered…
-
Your Purple Team Isn’t Purple, It’s Just Red and Blue in the Same Room
Defending a network at 2 am looks a lot like this: an analyst copy-pasting a hash from a PDF into a SIEM query. A red team script is being rewritten by hand so the blue team can use it. A patch waiting on a change-approval window that’s longer than the exploitation window itself.Nobody in that…
-
Attackers Bypass Azure AD Conditional Access Using Phantom Device Registration
A recent authorized red team operation by Howler Cell has demonstrated a critical attack path that completely bypasses Microsoft Entra ID (Azure AD) Conditional Access. Azure Conditional Access acts as the primary gatekeeper for cloud identity security, enforcing access rules based on user location, device compliance, and calculated risk scores. However, by starting with a…
-
prompted 2026 The Parseltongue Protocol: Textual Obfuscation Methods
Author, Creator & Presenter: Joey Melo, AI Red Teaming Specialist At CrowdStrike Our thanks to [un]prompted for publishing their Creators, Authors and Presenter’s outstanding [un]prompted 2026 AI Security Practitioner content on the Organizations’ YouTube Channel. Permalink First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/05/unprompted-2026-the-parseltongue-protocol-textual-obfuscation-methods/
-
A Detailed Guide on Local Port Forwarding
In the contemporary digital world, penetration testing and red team engagements, direct access to target systems from the attacker’s machine is uncommon. Many services are First seen on hackingarticles.in Jump to article: www.hackingarticles.in/a-detailed-guide-on-local-port-forwarding/
-
Automated LLM red teaming gets a learning layer
Automated red teaming of large language models has settled into a familiar pattern over the past two years. An attacker model generates jailbreak attempts against a target … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/30/automated-llm-red-teaming-learning-layer/
-
prompted 2026 Your Agent Works For Me Now
Author, Creator & Presenter: Johann Rehberger, Red Team Director Our thanks to [un]prompted for publishing their Creators, Authors and Presenter’s outstanding [un]prompted 2026 AI Security Practitioner content on the Organizations’ YouTube Channel. Permalink First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/unprompted-2026-your-agent-works-for-me-now/
-
AI Red Teaming Is Not Equal to Prompt Injection
Why AI and Traditional Penetration Testing Must Converge As artificial intelligence red teaming evolves beyond prompt injection, security teams must combine data science, model testing and traditional penetration testing to assess risks across the full attack surface. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/blogs/ai-red-teaming-equal-to-prompt-injection-p-4106