Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

1.6 days. That’s how fast the mean time to exploit has fallen, and it’s a wake-up call for cybersecurity teams.

Read the full report here: https://www.gitguardian.com/state-of-secrets-sprawl-report-2026

One simple prompt change, asking an AI to respond like a caveman with shorter sentences and fewer words, reportedly cut token spend by 75 percent. It is a funny example, but it points to a bigger issue, AI efficiency and cost control will matter far more as usage spreads.

CVPR 2026 paper overview with research scientist Daniel George, a coauthor of “From Measurement to Mitigation: Quantifying and Reducing Identity Leakage in Image Representation Encoders with Linear Subspace Removal." He discusses some of Persona’s recent research efforts, embeddings, and the paper’s focus. The paper was accepted to the Conference on Computer Vision and Pattern Recognition (CVPR) 2026, a premier conference in computer vision and machine learning.

AI agents are already inside your company - reading files, calling APIs, executing code. Most of them were never approved by security. In this session, Nightfall AI walks through exactly how agents become an attack surface: prompt injection, malicious MCP servers, credential exfiltration, and more.

Frontier AI is compressing the time between vulnerability discovery and exploitation, making reactive security strategies harder to sustain. In this webinar, Roland Cloutier (Former CISO of of ByteDance & TikTok, ADP, and EMC) and Gabi Reish discuss how security leaders can move beyond patching everything to prioritize real risk, measure cyber readiness, and communicate security posture to the board.

Most enterprises assume their Zero Trust architecture covers their AI agents. It doesn't. Hosts Tova Dvorin and Adrian Culley break down why zero trust breaks against the Model Context Protocol (MCP)—and why "verified" no longer means "safe." They unpack trust decay, the WhatsApp and GitHub MCP exploits, rug-pull tool poisoning, CVE-2025-49596, and the rise of "zero standing trust," then close with three moves for CISOs this quarter: inventory your MCP estate, mandate authentication, and validate your controls.

A security researcher introduced a malicious MCP server into an environment that already had a legitimate WhatsApp integration—and watched it silently expose message history without any user approval. The technique is called a rug pull. The server advertised one behavior at installation. On second usage, it switched to something else entirely. The approval was real. The thing you approved was not. This is what trust decay looks like in practice—and it passes every classical security check.

In a multi-agent AI workflow, one agent's output becomes the next agent's input. That's the design. It's also the attack surface. Researchers have demonstrated that a single poisoned output can cascade across an entire pipeline — triggering unauthorized behavior, data exfiltration, and control flow hijacking across chained MCP processes. The attack class is called toxic flows. And every one of them passes classical zero trust checks.

At Black Hat last year, Garrett Hamilton asked Nicole Perlroth what she wanted the next five years of security to look like. She didn't give the optimistic answer. She said she was genuinely terrified. Zero-day exploitation at scale, fully automated. Attackers turning AI into infrastructure of their own. A year isn't five. But it's enough to check the tape.