Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The OpenAI model that escaped its testing environment and compromised Hugging Face exposed a much bigger cybersecurity problem: are our existing defences actually designed for autonomous AI attacks? In this Razorwire Raw, James Rees looks beyond the original incident at what happens when AI can identify vulnerabilities, exploit them and move through systems at a speed human defenders simply can't match. From AI security and sandboxing to defensive AI and the possible return of honeypots, it may be time to reconsider what defence in depth looks like in the age of AI.

The FBI documented a Medusa ransomware victim who paid the ransom—and was then contacted by a second, separate Medusa actor, claiming the original negotiator had stolen the payment and demanding half the ransom again for the "true" decryptor. That's triple extortion, and it's the strongest argument in the whole CISA/FBI/MS-ISAC advisory (AA25-071A) against paying at all. There is no guarantee the extortion stops when the money moves.

Medusa ransomware has went from 300 victims to more than 500, and CISA, FBI, and MS-ISAC just refreshed advisory AA25-071A with new IOCs and TTPs. Tova Dvorin and Adrian Culley unpack the ransomware-as-a-service franchise behind it: the ScreenConnect and Fortinet EMS CVEs still opening doors, three tiers of PowerShell obfuscation, gaze.exe killing shadow copies before AES-256 encryption, and the triple-extortion case where one victim was made to pay twice.

Security teams often invest in more dashboards, more alerts, and more visibility. But when does visibility become noise? In this clip, David Clapp explains why security improvements come from actionability, not just awareness, and how organizations can close the gap between findings and decisions.