Australia's Signals Directorate says attackers are using stolen AI API keys, tokens and hijacked sessions to get into organisations' AI services. Its guidance tells customers to protect those credentials themselves. In one reported case, a stolen key ran up about US$600,000 in model credits over three weeks.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+15
- Incentives
- Insufficient
- Confidence50
The 90-day action plan drafted by Pakistan's Cyber Security Working Committee dates guidance for provincial CERTs, a critical infrastructure declaration framework and a cyber warfare escalation matrix. The federal CERT itself gets three years.
Reality
- Evidence38
- Adoption8
- Hype gap+30
- Incentives62
- Confidence45
Apple's September 14 releases close 273 unique vulnerabilities across ten advisories, with no exploitation reported. Fleet managers have to pick which lane to patch on, and the 26.7 build leaves out about 56 of the fixes that ship in iOS 27.
Reality
- Evidence74
- Adoption55
- Hype gap+18
- Incentives40
- Confidence72
The Australian Signals Directorate has published guidance placing agentic AI's enforcement point in the harness, the software layer that decides which tool calls run and with what permissions. Its remedies are configuration and logging.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+12
- Incentives28
- Confidence65
CVE-2026-69836 scored 10.0 and allowed unauthenticated remote code execution against Microsoft's identity service, and because the fix landed server-side, no customer ever had a version to check or a window to schedule.
Reality
- Evidence28
- Adoption15
- Hype gap−35
- Incentives
- Insufficient
- Confidence30
The breach notice rules out credit card details and confirms names, mobile numbers, order totals and postcodes. The second list is the one that makes a refund-scam call work.
Reality
- Evidence44
- Adoption
- Insufficient
- Hype gap−12
- Incentives62
- Confidence46
Guild Group's Mohammad Arif argues enterprise AI security is an access and accountability problem, not a working-group task. The published interview never names who owns the outcome.
Reality
- Evidence20
- Adoption
- Insufficient
- Hype gap+28
- Incentives42
- Confidence34
France's DGFiP confirmed tax and property data exposure for 678,000 filers while GitLab fixed an unauthenticated project-deletion bug. Both arrived with figures a team can act on.
Reality
- Evidence48
- Adoption42
- Hype gap+12
- Incentives44
- Confidence52
This week's disclosures turned on human trust and third-party exposure: social engineering at Levi Strauss, warehouse disruption at CEVA Logistics, and an AI agent that walked through an auth gap.
Reality
- Evidence38
- Adoption46
- Hype gap+18
- Incentives55
- Confidence42