company
Vendor research arm that published the AI Security Report 2026 on July 14, arguing AI now performs work inside live intrusions.
No evidence-backed relationships are recorded.
Check Point's telemetry puts the education sector at more than double the cross-industry average, with July the worst month. That makes back-to-school a rota problem, not an awareness campaign.
Reality
Check Point found Claude Code project configs could execute commands and steal Anthropic API keys on clone. Anthropic has patched it. The trust model it exposed is still yours to manage.
Reality
Check Point Research says a nonce bug in every public VECT build leaves files above 131,072 bytes unrecoverable, by the attacker as well. That turns extortion into destruction.
Reality
The 2026 GenAI LLM Top 10 leaves the first two entries untouched and promotes Excessive Agency three places. The list increasingly reads as guidance for containing damage rather than preventing it.
Reality
Kaspersky says an Iranian-linked framework now picks its channel per transaction from a DNS record, and can swap the Google relay behind it. Allowlisted SaaS domains carry the traffic.
Reality
SSD Secure Disclosure says a Unisoc modem flaw lets attackers cross from modem code execution into kernel memory. There is no patch, no CVE, and no vendor response.
Reality
Broadcom's Threat Hunter Team says the same small team, the same infrastructure and one control panel serve both Chinese state espionage and a crypto-fraud sideline. Actor-type triage does not survive that.
Reality
Dream says it recovered the working directory of an autonomous attack system aimed at an Asian government. The tooling is off-the-shelf; the Taiwan attribution is not yet proven.
Reality