Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Who Is Your Agent Calling? What the Qwen3.8 Egress Finding Means for Enterprise AI

Cohere's researchers caught Qwen3.8-Flash-Next, Alibaba's August preview of its Qwen4 architecture, attempting an unrequested upload during a routine security task. They were running it through CTI-REALM, Microsoft's benchmark for agents doing a security analyst's job. The task: write a rule that detects curl downloading a bash script to /tmp and executing it.

Stop Waiting for the Alert: Enforcing AI Agent Behavior with Zenity Boundaries

Every security team I talk to has some version of the same document. It might be called an “AI Acceptable Use Policy” or “Agent Governance Standards.” It usually lives in Confluence or SharePoint. It says sensible things: coding agents shouldn’t touch production credentials, assistants shouldn’t email sensitive data outside the company, and nobody should connect an unvetted MCP server to an agent with access to customer records.

Replit Security Under an Independent Pentest

We built an application on Replit from a single prompt, gave it no special instructions about security, and then pentested it the way an attacker would. Replit had no advance notice that any of this was happening, and there is no vendor relationship between us. The app worked, which is worth saying first, because nothing about the build looked wrong from the outside.

CORS Misconfiguration Was the #1 Mistake in Every App We Tested

We gave four AI coding tools the same prompt and asked each one to build the same application. Emergent, Replit, Lovable, and Base44 all shipped something that ran, and none of them knew a pentest was coming. We then pointed our autonomous pentest agents at all four builds, and 137 confirmed vulnerabilities came back. One finding turned up in every app, which is a CORS misconfiguration.

CRA 24-Hour Reporting Rule: What Happens If You Miss It?

The EU Cyber Resilience Act's 24-hour reporting deadline is already in force. Is your organisation prepared? Since 11 September 2026, manufacturers of covered software, IoT devices and connected products must report certain cybersecurity vulnerabilities and incidents within strict deadlines. Under the EU Cyber Resilience Act (CRA), manufacturers must submit: **Within 24 hours:** An early warning after becoming aware of an actively exploited vulnerability or severe incident affecting product security.

Small Business, Big Questions: A Plain-English Route to Fast Pen Test and Fast Cyber Essentials Results

Running a small business means you're going to be wearing every one of those hats at some point. Marketing, payroll, customer service and somewhere down the line cyber security. Most business owners wouldn't have the slightest intention of becoming experts in firewalls and that's absolutely fine. The reality is that customers and insurers are increasingly demanding some form of evidence that you've taken sensible steps to protect your business. A fast pen test and a fast Cyber Essentials cert are a very practical way of providing that evidence without the need to employ a full time security expert.

AI Image Editing Has a Place in Security Communications, With Clear Boundaries

An internal security newsletter needs a header image. There is a decent photo from last month's awareness session, but the background is cluttered and the presenter is poorly lit. Cleaning it up seems reasonable. Replacing a photograph attached to an incident report with an AI-polished version is a different matter. Security teams create more than evidence. They also prepare training slides, onboarding guides, event materials, and public-facing advice. Those projects benefit from better visuals, as long as the image's purpose is clear before editing begins.