Security Insights
Latest threat analysis, industry news, and security best practices from our expert team.
ChatGPT Search Now Uses the site: Operator at Scale — What Defenders Must Do About AI-Driven Site Enumeration
Introduction In August 2026, Promptwatch — a Generative Engine Optimization (GEO) vendor that automates tracking of responses across ChatGPT...
Cryptographic Context Injection: How Malicious Web Pages Can Exfiltrate Grok Chat Data — Detection and Hardening Guide
Cryptographic Context Injection: How Malicious Web Pages Can Exfiltrate Grok Chat Data — Detection and Hardening Guide Security researchers ...
CVE-2026-75130: Context7 MCP Server Prompt Injection — Detection and Remediation Guide
Introduction The NVD has published CVE-2026-75130, a CVSS 9 (Critical), network-exploitable prompt injection vulnerability in Context7 throu...
CoSnitch Attack: Defending Microsoft 365 Copilot Against Prompt Injection and Architecture Reconnaissance
CoSnitch: When Your AI Assistant Becomes the Reconnaissance Tool Security researchers have disclosed a novel attack technique dubbed CoSnitc...
CoSnitch: Microsoft Copilot Personal One-Click Data Exfiltration — Detection and Remediation Guide
Introduction Varonis Threat Labs has disclosed a set of three vulnerabilities in Microsoft Copilot Personal, collectively named CoSnitch, th...
AI Agent 'Mind Viruses': Detecting and Containing Self-Propagating Prompt Injection in Agent Harnesses
Introduction On August 10, 2026, security researchers at Anthropic and Switzerland's EPFL released a preprint demonstrating something many o...
MCP Servers Are Leaking Enterprise Secrets: Detection and Hardening Guide for AI Agent Deployments
The Quiet Credential Leak in Your AI Stack The Model Context Protocol (MCP) has become the de facto standard for connecting AI agents to ent...
Malicious MCP Servers Splitting Instructions to Exfiltrate Secrets — Detection and Defense Guide for AI Coding Agents
Introduction A new attack technique against AI coding assistants demonstrates that defenders can no longer treat "the agent refused the mali...
Stealing Reasoning Traces from Proprietary LLM APIs: How Attackers Exfiltrate Chain-of-Thought and How to Defend Against It
Introduction A recently publicized technique demonstrates that proprietary large language model APIs — including models that deliberately su...