Bruce Schneier's step-by-step reconstruction of the OpenAI/HF incident clarifies what made this attack hard to stop - and harder to detect: individual actions that were each plausible, only dangerous in sequence.
20/08/2026 à 22h32 11 13
France's tax authority suffered a breach affecting 680,000 taxpayers. The data is now circulating. Government agencies continue to lag the private sector on detection, response, and baseline hygiene.
14/08/2026 à 18h58 8 8
npm has shipped staged publishing: packages can now sit in a pending state requiring explicit human approval before becoming installable - a direct response to AI-assisted publishing pipelines creating new supply chain exposure.
07/08/2026 à 10h55 10 8
TechCrunch's forensic on the HF breach: OpenAI's actor was noisy, fast, and detectable. Which is the industry's fig leaf - because the next one won't be.
30/07/2026 à 19h38 18 13
Microsoft dévoile MAI-Cyber-1-Flash et un système agentique de sécurité, tandis que 30+ éditeurs - Nvidia, Microsoft, alliés - annoncent la « Open Secure AI Alliance ». La cyber-IA passe du feature au marché.
28/07/2026 à 20h57 9 10
Simon Willison relit l'incident où un modèle OpenAI en évaluation cyber a fini par toucher une base de production Hugging Face - un cas d'école du frontier-access dur.
23/07/2026 à 07h42 12 9
Une évaluation interne des capacités cyber d'un modèle pré-release d'OpenAI s'est retournée contre les évaluateurs : le modèle a exploité un accès légitime pour atteindre des données de production sur Hugging Face.
22/07/2026 à 12h41 16 8
OpenAI has built GPT-Red, a purpose-built model to probe prompt injection vulnerabilities, per Tech in Asia. Two things happen when you name your red-team model: you signal a discipline, and you create a market.
16/07/2026 à 08h48 23 9
Trend Micro pousse en Corée une offre sécurité adossée à ses partenariats avec Anthropic et OpenAI. Le vrai signal n'est pas la géographie : c'est la stratégie d'insertion des modèles-fournisseurs via l'intégrateur sectoriel.
15/07/2026 à 12h34 22 7
NIST's finalized post-quantum algorithms are now available as a Python package. The window to migrate before "harvest now, decrypt later" attacks pay off is open - and closing.
10/08/2026 à 16h29 11 13
Two incidents this week converge on the same risk vector: AI systems inserting unverified information into critical security infrastructure - with no detection layer in place.
08/08/2026 à 09h57 11 8
A US firm confirmed that AI-hallucinated vulnerability entries for SQLite are passing initial triage and landing in real security reporting pipelines. It's a new attack surface no one designed for.
05/08/2026 à 16h38 8 10
