The HackWednesday archive
Security analysis, incident lessons, and practical guides for teams working with AI. Search the archive or choose a topic.
AI in Security
Microsoft's April 22 AI security update shows that AI-discovered vulnerabilities will not just create more findings; they will force defenders to connect patching, exposure management, detections, and prioritization much faster.
AI-assisted Awaiting editor review
Cloud
Vercel confirmed unauthorized access to certain internal systems while hackers claimed to be selling stolen data. Security teams should avoid panic, but immediately review activity logs, rotate exposed environment variables, harden sensitive variables, and check GitHub, npm, and deployment tokens.
AI in Security
Claude Opus 4.7 is built for stronger coding and agentic workflows. Recent Chrome V8 vulnerability news shows why security teams should prepare for AI-assisted exploit reasoning, faster browser patch validation, and tighter controls around outdated Chromium runtimes.
Cloud
A practical GitHub security checklist for teams: branch protection, rulesets, secret scanning, push protection, Dependabot, CodeQL, GitHub Actions hardening, least-privilege access, OIDC, and SECURITY.md.
AI in Security
Recent reporting on an AI-assisted intrusion campaign against Mexican government systems shows why security teams should measure how quickly attackers can turn exposed services, stale credentials, and raw data into action.
AI-assisted Awaiting editor review
AI in Security
OpenAI is expanding Trusted Access for Cyber and introducing GPT-5.4-Cyber, making verified identity, trust signals, and staged rollout a central pattern for powerful defensive AI security tooling.
AI-assisted Awaiting editor review
AI in Security
Trivy is excellent at finding known vulnerabilities, misconfigurations, secrets, and SBOM risk. OpenAI-style agentic security workflows can help teams turn that scanner output into prioritized, reviewable remediation without treating AI as the source of truth.
AI in Security
Anthropic's Claude Mythos Preview and Project Glasswing are a warning shot for enterprise security teams: AI-driven vulnerability discovery is moving toward machine speed, and companies need secure sandboxes, patch pipelines, and executive governance before attackers copy the playbook.
AI in Security
Anthropic's April 2026 Project Glasswing launch is a signal that AI-assisted vulnerability discovery may soon outpace the industry's ability to triage, disclose, and patch the bugs it finds.
AI-assisted Awaiting editor review
AI in Security
The next wave of AI attacks will compress recon, phishing, code abuse, and privilege escalation into much faster cycles. Security teams should stop trying to block every agentic tool outright and instead adopt secure sandboxing, runtime controls, and evidence-first review.
Incident Response
When a breach takes down identity, admin access, or critical systems, companies need a tightly controlled recovery path to restore essential services without improvising under pressure. The answer is not a hidden backdoor. It is a secured, tested break-glass architecture.
AI in Security
NIST's February 2026 work on AI agent identity and authorization is a timely signal that the real enterprise risk is no longer model output alone, but what agents are allowed to do, prove, and audit once they start acting.
AI-assisted Awaiting editor review
