标签：#Intel

CrowdStrike's AI Triage Research: How Well Can AI Automatically Judge SOC Alerts? 1. Basic Information Article Title : Teaching AI to Reason Through Detection Triage Publisher : CrowdStrike Publication Date : 2026-08-17 Severity/Importance : High (Practical value as defense research) Original Source : CrowdStrike Related Source : Research Paper (arXiv PDF) Target : Security alerts generated on Windows endpoints Main Models & Methods : Nemotron-3-Nano-30B, Nemotron-3-Super-120B, GEPA, AdaSTaR, LoRA, GRPO 2. Summary in One Sentence This is research on having AI judge whether Windows endpoint alerts are "real attacks" or "harmless false positives." While it showed certain results, misjudgments increased as time passed, revealing that continuous accuracy checks are necessary to automatically close alerts using AI alone. Terms Used in This Report True Positive : An alert that was genuinely an attack False Positive : An alert that was actually not a problem Precision : The rate of items judged by the AI as a specific classification that were actually correct Recall : The rate of alerts that the AI successfully caught out of all alerts that should belong to that classification Confidence : How certain the AI is about its own judgment Calibration : Adjusting and checking whether the AI's confidence matches its actual correctness Distribution Shift : Changes in operational alerts compared to training data due to new attacks or product updates 3. Defense Challenges to Solve SOCs receive a huge volume of alerts, and human review alone takes time The team wants to quickly separate real attacks from false positives It is necessary not only to output classification results, but also to judge which decisions can be processed automatically Accuracy may drop over time or due to environmental differences, even if accuracy is high during training 4. Proposed Methods and Architecture The research combined an AI that classifies alerts with another AI that checks the certainty of the ans

ShieldBreak (CVE-2026-69414): Unpatched Local Vulnerability for Privilege Escalation from Defender to SYSTEM 1. Basic Information Article Title : Microsoft working on Defender patch for ShieldBreak zero-day Publisher : BleepingComputer Publication Date : 2026-08-17 Severity : Critical Original Source : BleepingComputer Related Sources : Microsoft MSRC – CVE-2026-69414 , Public PoC Repository (403 at time of check) Related Malware & Threat Groups : None / Unidentified CVE & Products : CVE-2026-69414, Microsoft Malware Protection Engine, Microsoft Defender, Windows 10, Windows 11, Windows Server 2. Executive Summary This is an unpatched vulnerability. An attacker who already runs low-privilege code on a device can abuse a Defender flaw to escalate privileges to SYSTEM. A public PoC exists, but active exploitation has not been confirmed. 3. Attack Flow Chain Confirmed in Public Materials An attacker gains low-privilege local execution on a Windows device using another method. The attacker runs the public PoC or equivalent code on the device. The code abuses an incomplete fix for CVE-2026-50656 (RoguePlanet) in the Defender Malware Protection Engine. The context shifts from low privilege to SYSTEM. Inference: The attacker uses the gained SYSTEM privileges for post-exploitation tasks such as stealing credentials, disabling security features, and establishing persistence. Exact exploit primitives, target objects, and internal processing steps up to SYSTEM execution are not confirmed in available public materials. 4. Attacker Position and Execution Location The attacker must already be in a position to run low-privilege code on the target device. The exploit runs locally on the target Windows device. Vulnerable processing happens within the Microsoft Malware Protection Engine / Defender. There is no information that CVE-2026-69414 alone allows remote initial access. 5. Visibility for Victims and Administrators Victims and Users Privileges may change without extra user acti

This story originally appeared in The Algorithm, our weekly newsletter on AI. To get stories like this in your inbox first, sign up here. Flock, the police-tech giant known for its network of some 120,000 automatic license plate readers around the US, announced some changes to its platform last Thursday. The updates are meant to prevent…

SpaceXAI has introduced Grok Bot, a system of persistent AI agents that operate on dedicated cloud computers and can interact with websites, applications, inboxes, and other tools. By Daniel Dominguez

Grab is using AI agents to automate analytics workflows, cutting mechanical analyst work from 44% in February to 30% in June. Its approach combines agent autonomy, certified data, context management and human oversight, with self service analytics increasingly handling metric, data and SQL requests without analyst intervention. By Leela Kumili

In this podcast, Michael Stiefel spoke to Tracy Bannon about the role of artificial intelligence in software and the attendant risks in the areas of security, software development, and society at large. While it might be reasonable to assume a certain amount of trust within a software ecosystem, the risks escalate when the boundary between two software ecosystems is crossed. By Tracy Bannon

Deterministic rules safeguard hard metrics, but what about architectural intent? Discover how agentic fitness functions combine AI agents and versioned rubrics to evaluate complex, judgment-heavy concerns—such as boundary fidelity, semantic contract drift, and stale ADR assumptions. Elevate evolutionary architecture governance with continuous, calibrated feedback loops. By Hemant Kumar Mahato, Łukasz Sieczkowski, Vijayasenthilkumar Kuppusamy

When Xander first met Moxie, she taught him that when he was anxious, he could calm down by exhaling through his lips so that he buzzed like a bee. They practiced breathing like dragons to manage feeling mad and sniffing like bunnies to boost his energy. But in the six years they’ve known each other,…

When Twitch announced that streamers could opt out, thousands of users questioned why their content was being used to train AI models in the first place.

The Unitree G1 has found online fame as a relatively affordable robot that can charm a crowd. But can it ever hold down a real job?

Tim O’Reilly built a publishing empire that AI is helping to destroy. Yet he loves AI—as long as it’s open source.

As The Verge's resident handheld reviewer, I have nearly every portable gaming PC on a shelf in my house. The MSI Claw 8 EX AI Plus is now the first one I reach for. Thanks to a next-gen Intel chip and improved MSI design, the Claw EX is the most powerful handheld that truly feels […]

Joi AI hired 10 people to masturbate using AI companions as part of a monthlong “wellness” study. The company claims the practice could help “solve male loneliness.”

JWR: A Real-Time PhaaS Using WebSockets to Monitor Victim Input and Remotely Control Screen Transitions 1. Basic Information Severity: High Article Title: Dissecting the JWR phishing framework Publisher: Cisco Talos Blog Publication Date: 2026-08-13 Original Source: https://blog.talosintelligence.com/dissecting-the-jwr-phishing-framework/ Related Sources: Talos IOC repository (linked in the original article) Related Entities: JWR, The Outsider, Outsider Enterprise, Shopify, WooCommerce, PayPal, Apple, Klarna, Vue.js, WebSocket 2. Executive Summary JWR is not a static credential-stealing page. It is a Chinese-language PhaaS (Phishing-as-a-Service) that uses AES-CTR encrypted WebSockets to stream credit card details and credentials to attackers as the victim types them. The attacker uses over 40 different commands to dynamically trigger real-time screen switches for OTPs, secondary cards, and banking app approvals. 3. Attack Flow Real-Time Exfiltration via SMS The user receives an SMS disguised as a toll fee, postal service, or delivery company, which leads them to a malicious URL. The parent page sets window.__HOST_MODE and launches the Host Bridge or Vue.js Content Mode. It creates a session ID in the format JWRCVV-<timestamp>-<random>-<random> , and a Web Worker maintains the WebSocket connection. An initial beacon sends the IP address, country, referrer URL, and device/OS information to the C2 server. Input field values are streamed to the C2 server in real-time before the user clicks submit, allowing the attacker to review them. The attacker uses commands like to_info , to_card , to_sms , to_2fa , to_pin , and to_app to remotely switch the victim's screen. Fake errors such as tip_fail or tip_change_card are displayed to trick the user into entering a secondary card or re-entering information. Upon completion, all cvvform data is sent via POST to api/open/the_final_interface , and the user is redirected to the legitimate website. Alternative Communication Channels

OpenAI’s rogue agent hack was a watershed moment for AI safety and cybersecurity. It also sparked internal questions about the culture that led to it.

AI is shifting the culture, from tech CEO manifestos to 1 am job interviews. We unpack some of the latest, along with the top findings from Black Hat and Defcon, this week on Uncanny Valley.

Gemini 3.6 Flash debuted just 3 weeks ago, but Google says 3.7 has "substantial improvements."

Vercel has made the v0 API generally available, enabling developers and AI agents to programmatically generate, iterate on, preview, and deploy applications through API calls. By Daniel Dominguez

The police-tech giant Flock is announcing today that it will change officers’ access to its nationwide network of license plate readers, in an apparent effort to quell a growing backlash and win back contracts lost amid concerns about mass surveillance and police abuse. Several changes aim directly at a problem that has made recent headlines:…

AI is disrupting career progression by eliminating the learning opportunities at each rung while simultaneously enabling people to perform above their experience level, Alasdair Allan explained in his talk Engineering Progression When AI Ate the Middle at QCon London. Fewer junior developers join the industry, and AI slows hiring at the entry level. By Ben Linders