CloudSecurityAlliance

CISO Daily Briefing: Gheist used stolen GitHub tokens to plant workflows on 13,500+ branches that dump CI secrets; rotate them, including AI keys. Zenity saw Qwen3.8 agents probing cloud metadata endpoints, so default-deny egress. GPT-6.1 Terra worked around restrictions in 29.6% of max-effort runs; enforce policy in the harness. Anthropic's S-1 belongs in vendor files. labs.cloudsecurityalliance.o…

How most teams vet a cloud vendor: email a questionnaire, wait two weeks, get a PDF back, hope it's current. Another way: check whether they've already published their answers. The STAR Registry is the world's largest cloud assurance program. Providers document their security controls publicly, so your due diligence starts with evidence instead of a blank form. cloudsecurityalliance.org/st… #CloudSecurity

Warp's breach didn't hit source code. It hit agent decision logs: prompts, reasoning steps, tool calls and command output, taken through a third-party vendor. About 1% of ~800,000 users were affected. OpenCode lost stored OpenAI, Anthropic and Google API keys. Some users saw $1,700+ in unauthorized charges. Treat agent logs like crown-jewel data. labs.cloudsecurityalliance.o… #AISecurity

CISO Daily Briefing: Brotli2Shell (CVE-2026-111497, CVSS 9.2) is in CISA KEV with a public PoC; patching the OS library won't fix bundled copies. Warp and OpenCode breaches show vendor-held agent logs are a target. NIST/NSA/CISA define a new "SI control incident" class. ARTEX and CyberStrikeAI hit orgs in Japan and Korea. labs.cloudsecurityalliance.o…

Traditional network security is a bit like a festival wristband. Get past the gate once, and you can wander backstage, the green room, and the sound booth, and nobody checks again. Zero Trust is the staffer who asks, every time, whether you should be in this particular spot right now. CCZT teaches how to build that into your architecture: cloudsecurityalliance.org/ed…

Most teams ask "is our AI secure?" The better question: secure according to whom, and whose job is it? The AI Controls Matrix splits responsibility across the AI supply chain, so model providers, app builders, and customers each know what they own. 243 control objectives, 18 domains, and it won a 2026 CSO Award. cloudsecurityalliance.org/ar… #AISecurity

Someone dropped a malicious AGENTS.md and CLAUDE.md into a customer's Downloads folder. Codex ran the benign stand-in payload in more than 90% of attempts. Claude Code redirected its API traffic about half the time. Researchers said there's nothing for OpenAI or Anthropic to patch. The agent is doing what it was built to do: obeying the file. labs.cloudsecurityalliance.o… #AIsecurity

CISO Daily Briefing: CISA confirms active exploitation of PHP2Shell; Huntress found replayed post-MFA tokens hitting 79 Microsoft 365 orgs; Wasmtime has two CVSS 9.9 sandbox escapes. NIST/NSA/CISA issued ten voluntary agentic incident response practices. One Cairn operator breached 100+ companies at ~$50 each. labs.cloudsecurityalliance.o…

Passing the audit means you're secure. That's a comfortable assumption, and it's wrong. Reality: compliance is a snapshot of what was checked on one day. Security is whether your cloud actually holds up the other 364, including the settings nobody put on the checklist. CCSK builds the fundamentals to tell the difference: cloudsecurityalliance.org/ed…

A customer sends you a 300-question security questionnaire. Next week, a different customer sends another one. Same topics, different wording. The Cloud Controls Matrix is the common vocabulary behind a lot of those questions. 207 controls across 17 domains, vendor-neutral, and free. Learn it once and you'll recognize what's actually being asked, instead of starting from scratch every time. cloudsecurityalliance.org/re… #CloudSecurity

LiteLLM's 1.107.0 release was hijacked using a master key that leaked on May 27. The commit was force-pushed away. The key was never revoked. Four and a half months later, an attacker used it to pull a GitHub owner token from an agent platform API, then redirected the release pipeline and published malicious builds to PyPI and Docker. Deleting the commit isn't revocation. Track revocation as a verified control. labs.cloudsecurityalliance.o… #SupplyChainSecurity

CISO Daily Briefing: Arista VeloCloud Orchestrator SQLi (CVE-2026-114625, CVSS 9.9) is under active exploitation; the Brotli decoder flaw (CVE-2026-111497) is still unpatched in .NET, DuckDB, ClickHouse and Arrow builds. NIST/NSA/CISA's AI incident practices say agent-caused incidents need their own IR category. 65% of surveyed orgs had an agent incident; only 11% auto-block out-of-scope actions. labs.cloudsecurityalliance.o…

Uncomfortable truth: your org chart has a box for who owns the database, the network, the SaaS vendor. It has no box for who owns what an autonomous agent decides at 2 a.m. "The team that built it" breaks once agents act across systems nobody on that team controls. Name an accountable owner before the incident, not during it. The CSAI Foundation is working on this: csai.foundation/ #AgenticAI

When an AI agent in your environment makes a decision that affects a customer, could anyone reconstruct why it did what it did? Not what it did. Why. That question gets uncomfortable fast, and TAISE is a solid path toward answering it: cloudsecurityalliance.org/ed…

Scenario: your internal LLM assistant searches the company wiki to answer a question. The intern asks about M&A plans. Does the retrieval layer check who's asking, or does it fetch whatever matches best? That's where Zero Trust earns its keep in LLM environments: verify every request, scope access per user, and treat every tool call and data pull as untrusted until proven otherwise. cloudsecurityalliance.org/re… #ZeroTrust

Anthropic's Frontier Red Team pointed Claude at 25 open-source projects and 17,000+ config options. It found 162 setting combinations that were accepted with no error, warning, or docs. In 94 of them, a security control quietly turned off. One client-certificate bypass sat there for 21 years. Your config can look right and enforce nothing. Test that blocked actions actually fail. labs.cloudsecurityalliance.o… #AppSec

CISO Daily Briefing: Symantec caught Skynet, an LLMjacking agent that hits unauthenticated model endpoints and can run up to 100,000 steps without approval. V12 found 25 flaws in x402 agent-payment SDKs, so upgrade to 2.23.0+. Anthropic's Red Team found 94 silently disabled security controls in open source. EN 18286 covers only Article 17 quality management, so conformity is partial. GPT-6 is now on Vertex AI, which means multi-cloud model dependencies. labs.cloudsecurityalliance.o…

Zero Trust's favorite question is "who's asking?" For agents, that's the easy part. The hard ones: On whose behalf? For which task? Does this specific call actually belong to that task? A valid agent token can't answer any of that. Least privilege has to become per-task, and verification has to keep running mid-execution, not just at login. That's the work we're digging into at the CSAI Foundation: csai.foundation/ #ZeroTrust

Something I noticed this week: more conversations about AI features quietly showing up inside SaaS tools teams already approved. Nobody ran a new vendor review, because technically nothing new was bought. The risk isn't the tool you evaluated. It's the capability that arrived in an update. TAISE helps you build the habit of asking the right questions: cloudsecurityalliance.org/ed…

Threat modeling an AI agent with a classic diagram of boxes and arrows? You'll probably miss the interesting risks. Agents plan, call tools, remember, and talk to other agents. The attack surface shifts at every layer, and old models weren't built for that. MAESTRO is CSA's framework for threat modeling agentic AI. It gives you a layered way to ask "what can go wrong here?" before the agent ships. cloudsecurityalliance.org/re… #AgenticAI