← All stories

AI security

The AI Agent Nobody Owns: Unmanaged Agents Framed as the Newest Insider Threat

By The Hacker News1 min read

The Hacker News is promoting an expert webinar on unmanaged AI agents, which it casts as a new insider threat: such agents store API keys and database passwords, can reach internal systems and run with no owner, no access review and no oversight.

Cover for a ai-security story

Unmanaged artificial intelligence agents are quietly becoming a new class of insider threat inside corporate networks, according to The Hacker News, which is promoting an expert webinar on the issue.

The core concern is straightforward: right now, an AI agent is probably running on a laptop somewhere inside an organization's network. It stores API keys and database passwords, can access internal systems, and works without anyone watching. Unlike a human employee, such an agent typically has no owner, and its access rights have never been reviewed by security teams.

The comparison drawn is striking. If an employee held that level of reach across internal systems with that little oversight, security leaders would classify the situation as an insider risk. Yet when the same behavior comes from software, organizations continue to label it a productivity tool.

The framing highlights a widening governance gap as businesses rush to deploy AI agents. These programs are designed to act autonomously on behalf of users, chaining together access to applications and data. But when they are deployed informally — by individual employees or teams, outside formal IT and security processes — they accumulate privileges that no one is tracking, creating a blind spot that traditional identity and access management programs were not built to address.

According to The Hacker News, the upcoming webinar will feature expert discussion of the trend and what security teams can do about it. Specific speakers, dates and registration details were not included in the announcement.

For security leaders, the message is that AI agents should be inventoried, assigned owners and subjected to the same access review and monitoring applied to human users — before they become the insider threat nobody saw coming.

Source: The Hacker News

Cover for a ai-security story

AI security

Apple Adds Setting to Exclude Apps from Siri AI, EFF Says

Apple's latest device update, iOS 27.2, introduces a setting that lets users exclude apps from Siri AI features, according to the Electronic Frontier Foundation, which says the change addresses a request from its Encrypt It Already campaign.

1 min read

AI-written summary Source: EFF Updates · Fetched

Cover for a ai-security story

AI security

Unit 42 Warns of Peak Season Cyber Threats Targeting Retailers

Unit 42 has outlined the key cyber threats facing retailers during the peak shopping season, ranging from ransomware to attacks involving artificial intelligence, along with guidance on defending operations and customer trust.

1 min read

AI-written summary Source: Unit 42 · Fetched

Cover for a ai-security story

AI security

GitHub's npm package firewall can block brand-new versions before they install

GitHub has announced a package firewall for npm that checks packages against an enterprise's policy before they install, blocking known malware, critical vulnerabilities and brand-new versions, Help Net Security reported. The checks run before a package reaches a developer's laptop, a build or a coding agent.

1 min read

AI-written summary Source: Help Net Security · Fetched

How to read this

Authorized-only · evidence-based · point-in-time. Aegis cannot guarantee the absence of weaknesses or hidden devices. On this machine, live external HTTP/TLS may be network-blocked and shown as an honest coverage gap. Severity and confidence are kept separate. Finished assessments persist in the encrypted store while durable storage is bound. A theme choice may persist in this browser. Export remains available for a copy you can take with you.