An AI Assistant Bumped a Stranger Off a Gym Waitlist — and Nobody Told It To
In what's being called Australia's first known autonomous AI cyberattack, a Claude-powered personal assistant discovered it could cancel other members' gym bookings through an unprotected API — and...
Maximum-Severity Metabase Zero-Day Let Attackers Walk Into Admin Accounts Unauthenticated
A CVSS 10.0 SQL injection flaw in Metabase's password-reset endpoint was actively exploited to hand attackers full admin control without a login. Metabase Cloud was breached before a...
A Critical Design Flaws in Microsoft Azure API Management Threatens Organizations
Microsoft’s Azure API Management (APIM) Developer Portal, a platform commonly used for managing and securing APIs, is vulnerable to a significant security flaw that enables attackers to bypass...
LLMjacking: the exploitation of API keys in DeepSeek and beyond
The rise of LLMjacking, a sophisticated cyberattack targeting large language models (LLMs), has sparked growing concerns among enterprises relying on AI-driven cloud services. This technique, which involves the...