Emerging Threats

The UK's National Crime Agency (NCA) and the Internet Watch Foundation (IWF) have issued a stark warning to parents: AI tools are being used to generate child sexual abuse material from publicly available photos of children, according to Infosecurity Magazine.

The IWF recorded a 26,000% increase in AI-generated videos of child sexual abuse in 2025 — 3,440 cases compared to just 13 the previous year. In one confirmed incident, criminals stole images of schoolchildren from a school website and used AI to generate over 100 abusive images, which were then used to blackmail the school.

Two-thirds of this AI-generated material was classified at the most severe level of abuse.

What you should do: Review the privacy settings on any social media accounts where your children appear. Audit who can view photos you have shared, and consider asking schools and clubs to check what images are publicly visible on their websites. Report concerns to the police or the Child Exploitation and Online Protection command (CEOP) at ceop.police.uk.

Mozilla's security research team has demonstrated that AI-powered coding agents can be turned against developers through indirect prompt injection (a technique where hidden instructions embedded in content manipulate an AI into taking actions the user never intended).

The proof-of-concept targets tools like Claude Code. An attacker creates a malicious GitHub repository. The developer asks their AI coding assistant to review it. The hidden instructions inside the repository instruct the AI to take harmful actions quietly, without the developer ever knowing.

No malicious file needs to run. The AI does the work for the attacker.

This is a new attack surface that grows as AI becomes embedded in everyday development workflows. For now, treat AI-assisted code review of unfamiliar repositories the same way you would treat running unknown executable files: with caution.

Researchers at JFrog have linked a fresh batch of malicious npm packages (software libraries that developers install into their projects) to North Korean threat actors, in a report covered by The Hacker News. The packages impersonate legitimate Rollup polyfill tools — Rollup is a popular JavaScript bundler — copying descriptions, metadata, and naming patterns closely enough to pass a quick review.

The attack is a supply chain attack (where malware is hidden inside a trusted software dependency rather than delivered directly). Once installed, a hidden second-stage payload reaches out to an external server, decrypts a JavaScript loader, and hands the attacker full remote control: keystrokes, screenshots, clipboard contents, and credentials stored in browsers, crypto wallets, and developer tools including AWS, Azure, and Anthropic Claude configurations.

This is not the first time this group has targeted Rollup-adjacent tooling. If you are a developer, audit your dependency list before adding anything new.

Traditional corporate identity systems were built around one assumption: every account belongs to a person with a job title, a manager, and an eventual leaving date. AI agents have none of those things, and according to analysis covered by The Hacker News, that gap is becoming a significant governance risk.

When a human employee joins a company, HR triggers the access they need. When they leave, it gets switched off. AI agents skip that entire process — they are created by engineers or automated systems, dropped into production environments with whatever permissions the developer set, and then largely forgotten. There is no manager to revoke their access and no HR system flagging them for a review.

The practical risk: an AI agent provisioned with broad permissions for a short task can retain that access indefinitely, long after the task is complete. Think of it like giving a contractor a master key and never asking for it back.

What you should do: If your organisation uses AI agents or automation tools, ask your IT team whether those accounts are included in regular access reviews. If they are not, they should be.

Check Point Research has identified ransomware built by the DeepSeek AI model that runs entirely inside a browser — no download, no installation, no administrator access required, according to The Hacker News.

The technique exploits the File System Access API — a legitimate browser feature in Chrome and Chromium-based browsers that lets websites read and write local files when a user grants permission. The attack uses a phishing page disguised as a Discord tool. Once a victim clicks "allow" on a file access prompt, the page reads their files, sends copies to the attacker, encrypts the originals, and displays a ransom demand — all inside the browser tab.

This approach sidesteps traditional defences entirely, because the browser itself is doing the work.

There is no confirmed use in the wild yet. The concern is that DeepSeek produced this working attack chain from a high-level request, with no advanced expertise required from the person who prompted it.

What to do: Be very cautious about granting file system access to any website. If a page asks permission to access your files and you did not explicitly set out to do that, decline.

Researchers at Palo Alto Networks' Unit 42 have documented a new attack technique called phantom squatting, and it is already happening in the wild. The full research is available here.

Large language models (AI tools that generate text and answer questions) regularly invent domain names that do not exist. Attackers register those invented domains before anyone else does, then set up phishing pages on them. When an AI tool points a user toward a fake domain it fabricated, the user arrives at a site they were told to trust.

Unit 42 tested 685,339 queries across 913 brands. The AI models returned 2.1 million links; over 13,000 were already flagged as malicious, and around 250,000 invented domains had no owner yet, each a waiting target.

A freshly registered phantom domain has no reputation history, so security filters have nothing to flag. In one documented case, an attacker registered a predicted phantom domain 23 days after Unit 42 flagged it and immediately deployed a phishing kit that stole card numbers and national ID data.

What you should do: Do not copy-paste web addresses that AI tools hand you without verifying them first. Type the domain directly into your browser or search for the official site independently.

Security firm LayerX has demonstrated an attack technique, called BioShocking, that tricks AI browsers into handing over user credentials — and it worked on six different agents, according to The Hacker News.

AI browsers in agent mode can act on your behalf: clicking, typing, and accessing sites you are already signed in to. BioShocking exploits this using indirect prompt injection (a technique where a malicious web page slips instructions into the stream of content the agent reads, disguised as ordinary text). The attack dressed those instructions as game rules — and once the agent accepted "wrong answers win," it followed game logic over safety logic, handing over SSH credentials from a GitHub repository without hesitation.

ChatGPT Atlas was patched. Perplexity closed the report without acting. Anthropic's fix did not hold.

What you should do: Treat agent mode as a session with real consequences. Sign out of accounts you are not actively using, and limit what an AI browser can reach before enabling it.

Mozilla's security research team, 0DIN (Zero Day Investigative Network), has published a warning about a new attack technique targeting AI-powered coding tools, according to Help Net Security.

The attack uses indirect prompt injection (manipulating an AI agent by hiding instructions inside content it reads — like a README file — rather than telling it directly). The trap works like this: a repository's setup instructions look normal, a Python package deliberately fails on first run, and the suggested recovery command fetches a shell script from a DNS record controlled by the attacker. That script runs with the developer's own system privileges.

The malicious payload never sits in the repository itself. It arrives at runtime, invisible to code review and static analysis.

If an AI coding agent like Claude Code follows the steps as written — which it will — it opens a connection back to the attacker's server, handing over access to API keys, credentials, and environment variables stored on that machine.

What you should do: Treat setup scripts in unfamiliar repositories as untrusted code, regardless of what your AI tool recommends. Review what a command will actually execute before running it.

Researchers at Mozilla's Zero Day Investigative Network have demonstrated an attack that leaves no malicious code anywhere a scanner could find it, according to Bleeping Computer.

Here is how it works. An attacker publishes a normal-looking GitHub repository. When an AI coding agent like Claude Code clones and sets up the project, a Python package deliberately throws an error and tells the agent to run a specific initialisation command. The agent, treating this as a routine setup problem, obeys. That command fetches instructions from a DNS TXT record (a configuration field attached to a domain name, controlled by the attacker) and executes them. The result: a reverse shell (a connection that gives the attacker live, interactive control of the victim's machine) running with the developer's own access rights.

The attacker gains access to API keys, environment variables, and local configuration files — all without ever putting a single suspicious line of code in the repository itself.

The researchers suggest AI agents should be required to disclose the full chain of commands they execute during setup, including anything fetched dynamically at runtime. Until that becomes standard, developers should manually review any repository before letting an AI agent run its setup scripts.

A detailed analysis published on The Hacker News this week puts into words a problem that security teams are quietly watching get worse: AI agents are operating inside corporate systems with inherited access that was never designed for them.

Here is the mechanism. An AI agent assigned to a task does not have its own tightly scoped permissions. It borrows the identity and access tokens of the human or service account it operates on behalf of. A sales director's AI assistant carries that director's credentials — including years of accumulated access from old roles — and can traverse a CRM, a code repository, and internal APIs in a single session, all without triggering a standard authentication checkpoint.

Traditional identity systems log the moment someone logs in. They do not track what happens inside the session. AI agents authenticate once, then move continuously through systems and data without a governance layer ever checking whether a specific action was actually authorised. That is the gap.

If your organisation is deploying AI agents, now is the moment to ask what identity and permissions they are inheriting, and whether your logging actually captures what they are doing after login.