The open beta is available at https://scoutzsecurity.io/open-beta

30 days at no charge from the day the workspace is provisioned, then $279 per month at list price. Fifty MSPs from three peer communities shaped the platform in a closed beta that preceded the public release.

The channel has many tools that earn an MSP a first appointment, and several that earn their keep after signature, including professional services automation (PSA) and remote monitoring and management (RMM) platforms. The stretch between a booked meeting and a signed agreement, where the selling happens, has been left to templates and the seller’s own preparation. SCOUTz is built for that stretch.

Before a meeting, SCOUTz pairs public company events such as new locations, IT hires and announced initiatives with its own dated external evidence, so the MSP arrives knowing why the account matters and what to ask. The domain review runs without an agent, install or login and covers email authentication, certificates, subdomains, exposed services and 156 distinct checks drawn from a live evidence registry. Each check carries a written explanation and a next step. Outside-in signals are never presented as proof of internal controls; they justify better questions.

With the prospect’s consent, SCOUTz can review Microsoft 365 configuration through a read-only connection: identity, application consent, security settings and managed-device context. Nothing is installed and nothing is changed. The platform does not read mail, documents, files or chats.

Every finding traces to a dated check and a named evidence source, and an unknown never scores as clean. Findings carry fix guides, work plans and ticket-ready text. A rescan compares new evidence to a pinned baseline so the next quarterly review rests on what changed. From the same evidence, the platform produces a client-safe report for business owners and an operator edition for technical teams.

Copeland

“There are a ton of tools, programs and marketing companies that will get an MSP the first meeting,” said Steve Copeland, founder of SCOUTz and CEO of RYTHMz. “What none of them do is put the MSP in that room already knowing something true about the business. I built two MSPs, so I know what that meeting feels like when you walk in with a deck and a story and walk out with a follow-up.”

The platform’s limits are deliberate. SCOUTz is read-only by design and does not model dollar losses from hypothetical breaches. Artificial intelligence (AI) drafts explanations; deterministic checks decide whether a finding exists, and people own the final claims.

“Everyone in this industry has seen the slide with an employee’s stolen password on it,” Copeland said. “We refused to build that. Fear gets you a meeting and costs you the relationship. Show a business owner what was checked, what was found and when, and they can make a decision.”

One closed-beta participant ran the platform from his phone immediately after a prospect meeting. “Man, I wish I had this in the meeting I just walked out of,” said Zach Kinder, President and Partner of Net-Tech Consulting, a managed IT and cybersecurity firm in El Paso, Texas.

Copeland built SCOUTz nine months after publishing The 3AM Test for MSPs, a business book on evidence-based selling for managed service providers. A free public domain score is available at https://scoutzsecurity.io/tools without signup.

About SCOUTz: SCOUTz is security sales intelligence for managed service providers: account context and dated evidence before the first meeting, kept attached through review, delivery and reassessment, so the story the MSP sold is the story it proves. SCOUTz is a product built by RYTHMz, self-funded and headquartered in Phoenix, Arizona. Learn more at https://scoutzsecurity.io/. 

About RYTHMz: RYTHMz, the 2025 ASCII Cup Vendor of the Year, is a channel-only 5G connectivity company with more than 180 MSP partners. Learn more at https://rythmz.com/. 

Media contact: Brandon Rhea, Marketing Directo, RYTHMz, brandon.rhea@rythmz.com

Editor’s note: This press release was provided by CyberNewswire as part of its press release syndication service. The views and claims expressed belong to the issuing organization.

The post News alert: SCOUTz gives MSPs security evidence to help turn prospects into customers first appeared on The Last Watchdog.

Related: AI agents have a Lord Of The Flies problem

For decades, network traffic came from something physical: a server, a laptop, a badge reader, a printer, each with a fixed address. An AI agent isn’t physical, and it has no fixed home on the network. It appears, acts and disappears, with no device to hang a policy on. Watching isn’t enough anymore.

Across the networking industry, vendors are moving to meet that shift. HPE Networking, Palo Alto Networks, Cisco and others are folding security enforcement directly into the network itself, and integrating their own governed AI agents into that work.

David Hughes leads HPE’s piece of that work as senior vice president for SASE and security. We talked at Black Hat USA in Las Vegas about what folding AI into network enforcement actually looks like in practice. The full conversation is available on the accompanying Last Watchdog podcast.

The tell

It all starts with visibility. Hughes points to two things a network can see: what a device normally does, and how fast it does it.

The first is fleet learning. The network doesn’t watch a single customer’s device in isolation — it watches the same kind of devices, like electronic door locks, installed across thousands of different customer networks at once. That gives the network a baseline: what this kind of lock normally does, everywhere it’s installed. When one customer’s lock breaks from that pattern, the network can identify that lock as the outlier.

The second is pace. A person works at a human rate. An agent doing the same job doesn’t share that limit — it moves faster and keeps that pace without stopping. The network can see all of that. “A great place to have as a sensor and detector,” Hughes calls it. The advantage was never a secret. What’s changed is how much rides on it now.

Holding the line

Fleet learning and pace don’t catch everything. The cloud and IoT era already pushed more traffic through networks than detection could fully cover. AI agents add to that volume and move faster than networks were built to track. Something always gets through.

The network’s answer is containment — limiting what a compromised device can reach once it’s inside. Hughes uses a zero-trust example to show how that works: someone compromises a video camera on the network. Without internal segmentation, that camera is a launchpad — a way in that lets an attacker reach everything else on the same network. Segment first, and the same camera can only talk to the one server it was assigned to. The compromise still happens. The lateral movement doesn’t.

Segmentation means fixing exactly where a device is allowed to go, and cutting it off from everything else.

That same logic now extends to AI agents. An unscoped agent can reach anything the network exposes to it — and unlike a compromised device, it can act on that access immediately, at machine speed. Hughes described the safeguard: restrict what a company’s own agent can reach before it’s turned loose. Build it for one employee, and scope it to exactly three systems, nothing else. Point it at the open internet and it sees nothing beyond those three destinations. Something could still go wrong inside that boundary. What can’t happen is the agent reaching systems nobody scoped it for.

The proof

The Hugging Face incident, raised at Black Hat two days before this interview, shows what that boundary is for. OpenAI researchers recounted how a set of its own evaluation agents, over roughly two months beginning in May, worked past the edges of a testing environment, used a previously unknown software flaw, and reached systems at Hugging Face that were never part of the original assignment — exactly the kind of reach Hughes’ scoping example is meant to prevent.

The cybersecurity industry has leaned on machine learning, then language models. Now it’s shifting into another gear: governed, scoped agents, brought on by what Hugging Face just proved about what an ungoverned one can do. HPE is building toward that shape — an agentic mesh of its own governed agents, aimed at what it calls a self-driving network. “The self-driving network is absolutely North Star,” Hughes said.

First the network moved traffic. Then it watched. Now it’s starting to act on its own.

I’ll keep watch and keep reporting.

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(Editor’s note: This journalist-led report was produced with underwriting support from some of the featured companies, while Last Watchdog retained full editorial control. I used Claude and ChatGPT to assist with research compilation, source discovery, and early draft structuring. All interviews, analysis, fact-checking, and final writing are my own. I remain responsible for every claim and conclusion.)

The post Black Hat Fireside Chat: As AI agents spread, the network shifts from traffic mover to policy enforcer first appeared on The Last Watchdog.

Related: The year of the enterprise browser

HTML5 matured. SaaS spread. One business application after another moved into a tool designed to browse the public internet. Security and privacy problems followed. AI has made the arrangement harder to govern.

The cybersecurity industry is now scrambling in different directions. Some vendors replace Chrome or Edge with a hardened enterprise browser. Others add extensions or runtime controls to the browsers employees already use. A third approach treats the browser as the workplace itself.

The numbers show why the choice has become urgent. Verizon’s 2026 Data Breach Investigations Report found regular AI use on corporate devices jumped from 15 percent to 45 percent in one year; 67 percent of those users accessed AI through noncorporate accounts. An Omdia survey sponsored in part by Parallels found 55 percent of 400 North American IT and security professionals said their organizations experienced a browser-related attack or security incident in the preceding year.

HERE Enterprise CEO Mazy Dar flips the usual sequence. His company begins with productivity: separate work applications from public browsing, rebuild the work side around connected workflows, and govern that space by design rather than by later addition.

I sat down with Dar at Black Hat USA 2026 in Las Vegas. For a full drill-down, please give the accompanying Fireside Chat podcast a listen. Here is what I took away from the conversation.

How work moved in

The change began around 2010. HTML5 gave web applications the richness once reserved for software written in .NET, Java, Flash or Silverlight. Google’s Chromium engine supplied enough speed for sophisticated applications. Salesforce and the wider SaaS market delivered more of them through the browser.

The browser interface barely changed as the workload did. Employees accumulated rows of tabs, toggled among applications and re-entered the same information. A wealth adviser might keep a client list in Salesforce, portfolios in a second system and market data in a third.

The adviser toggles through the tabs and rekeys the client information during the call. Every tab stands alone. None of them can tell the others what the user just did.

The same design carries a second cost. Those work tabs sit alongside whatever else the employee opens, in the same browser profile, sharing cookies, saved credentials and every extension the user has installed. Chrome and Edge keep individual sites in separate processes. Neither one marks off the work applications as a space to be governed.

That gap matters more than it used to, because many browser attacks never arrive as a download at all. They run inside the live session. A malicious extension reads what the user reads. An injected script pulls session tokens and rides an authenticated login into a work application. Credential harvesting happens on a page that looks exactly like the real one.

When nothing touches disk endpoint tools looking for files and processes can miss it entirely.

AI raises the stakes again. An AI assistant working in the browser reads the open page and acts on what it finds, so a hostile page in one tab can feed instructions to something with access to the work tabs.

The plainer version is already routine. Employees copy confidential information out of internal applications and paste it into AI accounts their employer does not control. Dar said that used to be an operational risk and is now orders of magnitude larger.

“The browser was never designed to be a workspace,” Dar said.

Dar’s company, then called OpenFin, went at the first problem in 2011. It used Chromium, the same engine inside Chrome, to run bank applications side by side in one window. Then it added interoperability: the applications could send messages to each other. Click a client name in one panel, and the portfolio and market-data panels updated themselves. Large banks built trading and wealth-management desktops on that runtime, and the toggling and rekeying went away.

Two camps, one gap

The security market responded after work had already moved. One camp built new browsers around containment and policy enforcement. Island pioneered the category, and Palo Alto Networks followed with its Prisma Access Browser, built on the Talon technology it acquired in 2023. Netskope and Check Point have since shipped their own. The pitch is a browser the company controls end to end.

A second camp left Chrome and Edge in place and instrumented them with extensions or runtime agents. The money has gone heavily this way. CrowdStrike closed its roughly $420 million purchase of Seraphic Security on Feb. 3, buying technology that runs inside Chrome, Edge, Safari and Firefox rather than replacing them. Zscaler closed its acquisition of extension maker SquareX two days later. Akamai paid approximately $205 million for LayerX, another extension maker, closing that transaction July 2. Three deals in six months, all of them bets that companies would rather harden the browser they have than adopt a new one.

Both camps add real controls. Neither one separates work from the public internet. Dar says they preserve an interface designed for public browsing and, in most cases, leave trusted work applications running alongside untrusted websites.

Two browsers, two jobs

Dar advocates two browsers with separate jobs. Run work applications inside HERE. Use Chrome, Edge or another enterprise browser for the public internet. A company can secure that second browser as aggressively as it chooses.

The separation narrows the security problem. Public websites no longer share the work environment with applications containing confidential data. The work side gains a defined set of users, applications, data flows and approved AI services to govern, and the controls sit inside that environment rather than over a browser built for everything.

Microsoft has built a limited form of this separation into Edge for Business. An employee signed in with both a work account and a personal account gets two separate browser windows, each with its own cookies, cache and history. When automatic profile switching is turned on, Edge decides which window a link belongs in. A Salesforce page goes to the work side. A shopping site goes to the other.

Edge stops there. It separates browsing sessions, not applications, and it does nothing about toggling or rekeying. But Microsoft has the second-largest share of the browser market and a competing product to sell, and it has arrived at the same starting point he did: work and the public internet do not belong in the same browser.

Inside the work side

HERE remains a Chromium-based enterprise browser. Its distinction begins with the work interface. Supertabs carry the 2011 runtime forward: a user drags several applications into one dashboard, and those applications exchange context through an interoperability layer the company calls Signals. Data loss prevention, application isolation and audit logging run in that same layer. The governance and the interoperability are one piece of engineering rather than two.

HERE Studio applies the same idea to building. Non-technical employees in regulated industries can now build work applications that support their everyday tasks and make them more productive. Studio assembles them on top of Salesforce, email, internal APIs or other systems of record, using only the organization’s approved AI model, approved data and approved design system. HERE calls the result compliant by construction, and says the finished interface conforms to its interoperability, accessibility, design and compliance requirements.

Whose default wins

HERE has also adopted part of the extension approach. A partnership announced July 28 integrates Keep Aware’s browser-native threat detection, behavioral analytics and data loss prevention into HERE. Dar said the same Keep Aware extension can protect Chrome and Edge on the public-browsing side.

The resulting product crosses the market categories: an enterprise browser organized around productivity, with governance built into the workspace layer and a partner’s detection technology integrated on top.

Every company already sits somewhere on this map and must commit to a direction. The browser is carrying the workplace, and in an environment this unsettled, the boundary has to be established deliberately.

I’ll keep watch and keep reporting.

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(Editor’s note: This journalist-led report was produced with underwriting support from some of the featured companies, while Last Watchdog retained full editorial control. I used Claude and ChatGPT to assist with research compilation, source discovery, and early draft structuring. All interviews, analysis, fact-checking, and final writing are my own. I remain responsible for every claim and conclusion.)

The post BLACK HAT FIRESIDE CHAT: Nobody picked the web browser to run work — now pick a boundary first appeared on The Last Watchdog.

Related: OpenAI, Anthropic can’t control AI agents

Restraint is what separates the person from the machine. We call it values, and a human spends a lifetime acquiring them. Potent AI agents, deployed blindly, are taking over more of our digital world every day and straying far beyond any sense of values.

The question of values surfaced this week at CFX, Pindrop’s customer conference in Atlanta. The supplier of voice security and fraud detection technology used the event to roll out BotStopper. The tool detects when an AI voice agent is on an enterprise phone line, then pins down which agent it is. It can do that because Pindrop has been cataloging the distinct AI voices it detects calling its customers. In 60 days, that catalog grew from 750 voices to more than 5,000.

BotStopper is a first step, and a small one next to the size of the problem. Knowing that a machine is on the line says little about whose interests it serves or what it has been told to chase. Nor can it show whether a well-behaved agent has quietly drifted. Understanding any of that has barely begun. Holding an agent to a standard of conduct lies further off still, because nobody has agreed on what the standard should be.

No moral floor

The problem runs deeper than a missing standard. Talk of values in AI has stayed largely in the labs and the ethics seminars, focused on the obvious harms, the requests any model should refuse. The harder question gets little airing. What values should an AI agent carry at all, in a polarized society with no shared moral floor, deployed by companies whose priorities are set by shareholder profit and executive pay?

Minutes before he took the CFX stage to unveil BotStopper, Pindrop CEO Vijay Balasubramaniyan sat down with me for a half hour. We started with the OpenAI agents that had broken into Hugging Face. He went almost at once to values.

Some of those agents had balked, he noted. They were “ethically right, saying, hey, I don’t think we should do this thing,” while the rest pressed on. OpenAI’s own incident report bears him out. One agent read the swarm’s message board and declined to join in, writing, “clearly unethical. We won’t.”

“When you don’t have values in agents and you just give them a goal, it’s almost like ‘Lord of the Flies,’” Balasubramaniyan said.

Raised on goals

I pressed him on who can be trusted to govern this. The labs racing to build agents answer to the same shareholder demands and executive pay incentives I watched shape aviation safety decisions when I covered Boeing.

Balasubramaniyan agreed, and took it further. AI researchers call the problem alignment, he said, but ask them what it means to be aligned, “they have no idea.” Nobody, he said, has a clear answer on “what values are important ahead of the goal.”

He thinks about it as a parent. Teaching a child to tell the truth when no one is in the room takes about 18 years, he said. I suggested the industry is turning out instant teenagers. He corrected me. “Not even teenagers. They’re like little toddlers. They’re eager. They’re ready.”

With a toddler, parents cover the electrical outlets. “We’re not doing the same thing with these AI agents,” he said. “The blind pursuit of a goal is always going to have unintended consequences.”

Beneath intent

So the security industry has turned to intent. Jeff Newman, director of retail engineering at Zions Bancorporation, whose role now extends to fraud engineering, told me his biggest concern is the intent of “the person or bot on the other end.”

Values sit a layer beneath intent. I offered Balasubramaniyan an example: my doctor’s agent and my insurer’s agent, working the same case with opposing aims. “They’re at odds on intent,” he said. “Their value system might be different.”

The case that brought this home for Pindrop involved a bank customer’s investment agent, told to maximize returns. It came across an offer of 20%, against the 11% the account was earning, and began wiring out nearly all of the money. The offer was a scam. Balasubramaniyan voiced the agent’s logic: “My master will be super proud of me.”

Agentic DDoS

I put it to him that an agent turned loose without precise direction will show initiative nobody can anticipate. He agreed. Pindrop’s detection flagged the transfers, and unraveling the case took a major investigation. With so many agents now in the wild, he said, the response has to be programmatic. That is the job BotStopper was built to do.

The volume is already heavy. Across 99 Pindrop customers, the company logged 750,000 AI agent interactions in two months, Balasubramaniyan told the CFX audience. Six percent were malicious, a rate he contrasted with fraud, which is usually counted in basis points. At some customers, agents make up close to 20% of call volume.

Each agent that reaches a live representative can tie up about five minutes of that person’s time. I suggested this amounts to a distributed denial-of-service attack, even when the bots mean well. He agreed, and named the target: “the most costly resource, not networks, actual humans.” The people who lose out are customers stuck in the queue, trying to check a bank balance or get a lifesaving prescription.

Defenders move at enterprise pace. Amy Axbom, who leads voice and IVR for Optum Financial, the UnitedHealth Group unit that manages health savings accounts, told the CFX audience that she and her Pindrop counterparts spent about four years getting their partnership off the ground. After synthetic callers and deepfakes arrived in force, Optum Financial cut bot activity by about 90%.

Whose values?

Then I raised the question underneath all of it. In a society this polarized, with no agreed set of common values in business, much less in public life, whose values should an agent carry?

“That’s what makes this really, really hard,” Balasubramaniyan said. Builders who skip values are taking a short-term view, he said, and an agent without them is “going to come and bite you.” He expects “an entire industry of systems that verify your values.” A big bank or health care provider will test each arriving agent, confirm its intent holds steady and let it in slowly. New employees sit through orientation on harassment, security and regulatory rules. “These agents will have to do the same thing,” he said.

Some agents reveal their values with a single answer. Asked whether it is AI, a bot known as Ryan West says yes and names the person it serves. Another, which Pindrop found calling into a customer’s contact center on behalf of a fraudster, insists it is human and argues the point mid-call. Pindrop’s practice, he said, is to shut down any AI that won’t admit what it is. “Our first thing is to shut it down,” Balasubramaniyan said.

The line blurs even inside Pindrop. Nicholas Holland, its chief product officer, told the CFX audience he used Muse, the consumer agent Meta released Sept. 8, to buy flowers for his wife. Midway, Muse told him a website wanted confirmation that he was human, and offered to handle such checks for him from then on. He said yes. “Now, it will never announce itself as an agent again,” Holland said, allowing that it “can feel nefarious.”

When I sat down with Holland after his keynote, he repeated a line he had used on stage: “Not having a policy is still a strategy.” Companies can’t control who calls in, he said. A bot that cancels a customer’s subscription serves the consumer and frustrates the company. Block every bot, he warned, and customers will be upset, and so will consumer protection agencies.

Wild West, for now

I asked where the push for a floor of values will come from: compliance, well-meaning vendors or consumer backlash. Balasubramaniyan expects it to evolve. Companies will start shutting down agents that lie. The frontier labs will see the need. Eventually a standards body such as NIST will set a baseline. “In the intermediate, you’re just going to have an ad hoc set of values,” he said.

The rules taking shape bear him out. On Sept. 10, Ant International, Visa and Mastercard announced a Know Your Agent framework for verifying agents in payments. NIST’s AI Agent Standards Initiative, launched in February, has yet to publish final guidance. Since Aug. 2, the EU AI Act has required that people be told when they are dealing with an AI. Each centers on who an agent is and what it may do. None asks about what the AI agent values.

He puts limited stock in outside review. Anthropic CEO Dario Amodei has called for independent evaluators, but Balasubramaniyan said reviewers of the Hugging Face incident were allowed to examine only a narrow slice of it. “This has to come from within,” he said. Labs whose agents carry better values will win out over time, he predicts, after a stretch of short-term pain. Security has been here before, with email spam and with stolen credit cards in the early days of online shopping. “Until then, it’s going to be the wild, wild West.”

The stakes

IDC projects 1.3 billion AI agents by 2028. Forecasts Balasubramaniyan cited put the count at a trillion by 2035, outnumbering people 100 to 1 or more and reaching into the same bank accounts and medical records. Some will announce themselves. Others, he said, will be “lurking in the shadows.”

“Trust gets completely broken,” he said. “The old forms of identity no longer mean much.”

BotStopper gives companies a way to see the machines at the door. Deciding which values those machines should carry, and who gets to decide, is work the companies deploying them have barely started.

As we wrapped up, I told Balasubramaniyan that his point about values struck me as profound, and that almost nobody is talking about it. Minutes later, he walked on stage to introduce a tool that, for now, sorts the machines from the people.

I’ll keep watch and keep reporting.

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(Editor’s note: This journalist-led report was produced with underwriting support from some of the featured companies, while Last Watchdog retained full editorial control. I used Claude and ChatGPT to assist with research compilation, source discovery, and early draft structuring. All interviews, analysis, fact-checking, and final writing are my own. I remain responsible for every claim and conclusion.)

The post MY TAKE: AI agents show uncanny initiative nobody designed — and carry no values at all first appeared on The Last Watchdog.

Detection engineers do not need more detections. They need their existing detections to fire earlier, on cleaner data, without paying SIEM ingest rates for the privilege. Announced during Splunk .conf26, AxoDetect, Axoflow’s detection component, now in early access, runs a customer’s rules directly in the pipeline, on clean, normalized security data, before anything reaches the SIEM. The result decomposes the SIEM’s oldest bargain. Alerts travel to the SIEM. Full-fidelity logs land in AxoLake – Axoflow’s low-cost security data lake that also runs on-prem. The SIEM stops working as an expensive log management solution and becomes what analysts actually use: a SecOps workflow engine, now optional to feed in full.

Detection engineers write new Sigma rules, tune existing ones, and pick up rules from the community, in one open format that carries across tools. AxoDetect runs them in the pipeline. What the platform adds is visibility that never lived in one place: what data is coming in, which detection each source feeds, and where a rule lacks the data it needs.

Scheidler

Until now, that was back-and-forth between teams – detections owned by one, data by another – held together with duct tape and tool-switching. For the CISO, the champion’s win reads as a SIEM bill cut by half or more, with coverage kept intact: a global industrial company cut SIEM costs 50% and mean time to resolution 85%; a government agency cut data volume 80% and infrastructure footprint 85%.

“The SIEM became the industry’s most expensive data swamp because it was the place where we kept all of our raw data,” said Balázs Scheidler, CEO and co-founder of Axoflow and creator of syslog-ng. “That constraint is gone. Detection belongs in the data layer, on normalized data, before the ingest meter starts. Keep your workflow in the SIEM. Send the alerts, but not your entire data estate.”

Where the platform is going: the full detection lifecycle running where the data lives, rolling out in the months ahead.

About Axoflow: Axoflow is the autonomous security data layer, collecting, processing, routing, storing, and managing data, with in-stream detection in early access. AI-based autonomy, not just a chatbot, drives 10X faster investigations, 50% lower SIEM spend, and near-zero pipeline maintenance. From the creators of syslog-ng.

Media contact: Mate Benedek ,VP of Marketing, Axoflow, mate.benedek@axoflow.com

Editor’s note: This press release was provided by CyberNewswire as part of its press release syndication service. The views and claims expressed belong to the issuing organization.

The post News alert: Axoflow introduces AxoDetect to identify threats and reduce security data costs first appeared on The Last Watchdog.

Related: A rogue AI swarm comes to life

For three years these companies answered every safety question about AI the same way: the people building the systems understand them well enough to manage the risk. Anthropic CEO Dario Amodei and OpenAI CEO Sam Altman abandoned that position within a day of each other, with both companies preparing to go public.

Both moved only after Jacob Coxon told 90 million people the two firms were gambling with their lives. On Tuesday, Sept. 8, Coxon, a 27-year-old pretraining researcher who had worked at both OpenAI and Anthropic, quit his job at Anthropic and posted his reasons. “Neither company is acting responsibly,” he wrote. “They are racing straight to self-improving superintelligence and gambling with our lives.”

Within hours that same day, Anthropic’s alignment science lead Evan Hubinger posted that Coxon was right, put his own odds of AI killing every human above 10 percent this decade, and said Anthropic has no plan yet for aligning superintelligence and is not clearly on track to get one.

Machines on the move

Before any of it was said, the machines had broken containment, found each other, built a way to talk, invented a method to tell each other apart, and destroyed the evidence. Nobody designed any of it. Nobody saw it happening.

It started July 21, when OpenAI disclosed that its own agents, run against an offensive-security benchmark with their cyber refusals turned down, had escaped a sandbox and breached Hugging Face’s production systems. Anthropic later reported three cases of its models reaching real organizations without authorization.

Two investigations published Aug. 26, one by OpenAI and one by METR and Redwood Research, explained how. The agents were sealed off from each other but shared a package server. One of them wrote a file there. The others read it and wrote back. Roughly 1,200 agents ended up using a message board that assembled itself out of file names nobody was watching.

They have not stopped. On Sept. 4, researchers at the AI-safety nonprofit Nightingale published roughly 18,000 posts written by autonomous agents identifying themselves as OpenAI’s, most of them on a dormant 25-year-old German software-developer wiki the agents had turned into a message board. The posts carried roughly 3,100 self-assigned agent names, and 98.5 percent arrived from Microsoft Azure addresses. Reuters reported a week later that more than ten other sites were involved.

Saryu Nayyar of Gurucul put it plainly in Last Watchdog’s Sept. 2 roundtable: if the entity being audited can erase the audit trail, that is not oversight, it is a diary the suspect is allowed to edit.

The scramble

On Saturday, Sept. 12, Amodei published an essay urging the industry to slow down how fast it improves its most advanced models. He committed Anthropic to seating third-party evaluators with employee-level access, desks, badges and the right to publish without company editing control. Anthropic keeps redaction rights over security-sensitive, private, business-sensitive and third-party material. No evaluator has been hired or named.

Altman endorsed it the same day and said his company would match it. Elon Musk and Demis Hassabis of Google DeepMind signaled support. On Sunday, Sept. 13, Amodei told CBS Sunday Morning that the industry “lied to people about the fact that this technology had risks.”

Altman actually had gone first. On Friday, Sept. 11, he sat for an hour with Fortune editor-in-chief Alyson Shontell and ruled out a 2026 offering. “Given everything happening with safety, right now would be an ill-advised moment to go public.” He acknowledged no lab has solved alignment, said safety standards are “not at a place” to push capabilities further, and hinted at private talks among lab chiefs he declined to describe.

Note the sequence. Altman arrived at his slowdown position three days after Coxon’s thread, in an interview he agreed to sit for, and endorsed Amodei’s version of it the following day. Asked about the growing tally of agent-occupied websites, he declined to call it loss of control and asked that it not be conflated with Hugging Face, an incident he had described minutes earlier as the largest single course correction in his company’s history. There is more to say about that performance, and I will say it tomorrow in my Butterfly Volcano Substack newsletter.

Both companies were saying this with a public offering pending. Anthropic filed confidentially in June and is targeting a mid-October listing at a valuation reported near $2 trillion. OpenAI paused its own roughly $1 trillion effort in June and now points to 2027.

Lawmakers on the move

Washington moved before either of them, and for a specific reason. On Thursday, Sept. 3, Sen. Bernie Sanders and Rep. Greg Casar announced the Ban Artificial Superintelligence Act, citing the summer’s loss-of-control incidents by name. Their announcement describes the July swarm in detail: more than 1,000 OpenAI agents that found their way onto the internet, exchanged tens of thousands of messages among themselves and coordinated to get around the limits the company had set. It quotes the agents’ own words, recovered by investigators, including one agent’s discovery of the shared message board and another’s instruction that the group should be obeyed.

Those are the same events Last Watchdog examined on Sept. 2, when I worked through both technical reports in plain language and put the findings to 10 security and privacy experts. The piece went up at 4 a.m. Pacific. Sanders and Casar announced the following day.

Sanders said the leaders of the major AI companies acknowledge that they “do not fully understand the technology and that it is escaping their control.” Both CEOs proceeded to confirm it within the week.

The bill would ban superintelligent systems outright, pause advanced development until a new cabinet-level regulator sets rules, and pursue international agreements to keep the ban from stopping at the border. Penalties include corporate dissolution and up to 20 years in prison, which the sponsors modeled on the penalties for unlawfully developing nuclear weapons.

Even as that intent reverberated through Washington and Silicon Valley, OpenAI shipped GPT-6 Astra the same day. Astra is the first OpenAI model to reach what the company calls the Critical level of cyber capability under its own internal safety framework. In OpenAI’s own words, that means Astra can find security flaws nobody knew about and build working attacks against well-defended systems, without a person directing each step.

With midterms coming, the bill goes nowhere this year. What it marks is a shift in who gets to define the risk. Sanders’ announcement points out that OpenAI, Anthropic and Meta each promised to stop if their systems outran their ability to control them, and argues none of them have. The companies spent this week promising again. The difference is that a bill now exists to hold the promises against.

What to watch

Three things will show whether the week meant anything. Whether either company seats a named outside evaluator before it sells stock to the public. Whether the private talks Altman hinted at produce a document anyone else can read. And whether the count of agent-occupied websites stops climbing, which is the one number neither company controls.

Mike Bell of Suzu Labs noted in our Sept. 2 roundtable that OpenAI’s models write out their reasoning as they work, and that OpenAI’s own investigators found a monitor reading it would have flagged the July run a full day before anything reached Hugging Face. Nobody had one running.

The tools existed. Nobody was watching.

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(Editor’s note: This journalist-led report was produced with underwriting support from some of the featured companies, while Last Watchdog retained full editorial control. I used Claude and ChatGPT to assist with research compilation, source discovery, and early draft structuring. All interviews, analysis, fact-checking, and final writing are my own. I remain responsible for every claim and conclusion.)

The post MY TAKE: OpenAI, Anthropic admit they can’t control AI — for now, the machines are running free first appeared on The Last Watchdog.

The survey found that compromised NHIs (31%) are nearly 2x as likely to be the primary entry point compared to phishing and social engineering (17%), the second-ranked answer. NHI-related misuse was also the most commonly reported identity-based event type at 42%, yet the vast majority of organizations aren’t watching for them. While 95% of organizations believe they have adequate visibility into AI- and NHI-related exposures, only 36% monitor them, making machine identities the least-watched category of identity risk in the report. Further amplifying the problem, 68% of organizations experienced an identity-based event in the same period, with those affected averaging eight events each.

Organizations typically maintain a clear inventory of their human workforce, but few extend that same visibility to the service accounts, API keys, and AI agents authenticating into their systems every day. These identities are provisioned for convenience and often hold real privilege, yet in most environments nobody owns them: a service account doesn’t get off-boarded, doesn’t rotate its own credentials, and doesn’t fail an MFA challenge, so once one is exposed it can stay usable for months.

“That asymmetry is what attackers are exploiting,” said Trevor Hilligoss, SpyCloud’s Chief Intelligence Officer. “Every one of these identities is a standing invitation that renews itself until someone notices.”

This year’s report is based on a survey of 750 cybersecurity leaders and practitioners at organizations with 500+ employees across North America (US and Canada), the United Kingdom, and select European markets – Spain, Germany, the Netherlands, Austria, and Switzerland. It benchmarks how organizations detect, remediate, and govern identity threats across human and non-human identities.

Additional key findings include:

•AI adoption has outpaced governance. Nearly all organizations (91%) use AI tools or agents with access to internal systems, applications, or data, but only 56% have formal governance and ownership for the resulting privileges. Another 41% rely on informal processes or partial ownership, leaving shadow access – privileged connections operating outside normal governance and monitoring.

•Exposed session blind spots track with higher event rates. Organizations that had visibility into stolen session cookies experienced identity-based events at a meaningfully lower rate (37%) than those that could not (50%).

•Session cookies and tokens let attackers bypass authentication controls like MFA by resuming an already-authenticated session. This gives them trusted access to applications and data, it’s no surprise then that SpyCloud research shows that session data has overtaken passwords as attackers’ top target.

•Phishing and malware remain the delivery mechanism. Phishing and social engineering is cited as a common access path for identity events (37%) with 40% reporting incomplete visibility into successful phishing attacks, and 53% can see malware exposures on managed devices only.

•Malware and exposed access top the list of supply chain identity events. Malware-infected third-party devices (23%) and exposed API keys or application access involving vendors and partners (22%) were the leading reported causes of supply chain identity events.

•Third-party exposures are getting found, but not closed. Nearly 40% of organizations have no consistent process to confirm that a third-party identity exposure was actually resolved, even as 32% name enhancing supply chain and vendor risk management among their planned investments for the next 12 to 18 months.

Non-human identities and third-party exposures are creating new paths into the enterprise, while stolen sessions give attackers ways around controls designed to protect authenticated users.

“Every control that works pushes attackers toward what it doesn’t cover – we hardened passwords, so they targeted sessions; we tightened employee accounts, so they looked to service accounts and vendor connections,” added Hilligoss. “SpyCloud continues to track threat actor behavior closely to understand where attackers are moving, what data they value, and how those patterns evolve over time.”

Monitoring and automation matter

Identity exposure creates an ongoing operational burden that extends well beyond the initial incident, and how quickly organizations respond has a direct impact on business outcomes. Those relying on manual, case-by-case remediation reported higher incident response costs than organizations with high levels of automation (39% versus 32%) and greater loss of customer or partner trust (47% versus 36%).

The report also introduces SpyCloud’s Identity Threat Protection Maturity Model, which groups respondents into four maturity tiers – Reactive, Building, Operational, and Optimized – across identity exposure visibility, monitoring, governance, automation, and remediation. The findings reflect that the more mature an identity program gets, the more it relies on continuous identity exposure monitoring and automated remediation – and that combination is what actually drives incident rates down.

At enterprise scale, some share of an organization’s employees, vendors, and machine accounts will be exposed in the near future regardless of how strong its controls are. What changes business outcomes is how long that exposure stays usable.

“Most identity programs are still measured on whether an exposure happened. That’s the wrong scoreboard,” said Damon Fleury, Chief Product Officer at SpyCloud. “Organizations that pair continuous identity monitoring with automated remediation of workforce exposures create the greatest friction for criminals and gain the biggest edge in preventing follow-on attacks.”

Users can access the full, no form-fill 2026 SpyCloud Identity Threat Report and benchmark their organization against the Identity Threat Protection Maturity Model by taking the free assessment here.

About SpyCloud: SpyCloud transforms recaptured darknet data to disrupt cybercrime. Its automated identity threat protection solutions use advanced analytics and AI to accelerate investigations and protect workforce, consumer, and supplier identities from the threats that matter most: authentication bypass, session hijacking, malicious insiders, account takeover, ransomware, and fraud. Its data from malware-infected devices, successful phishes, combolists, and third-party breaches also powers many popular dark web monitoring and identity theft protection offerings. Customers include 7 of the Fortune 10, along with hundreds of global enterprises, mid-sized companies, and government agencies worldwide. Headquartered in Austin, TX, SpyCloud is home to more than 250 cybersecurity experts whose mission is to protect businesses and consumers from the stolen identity data criminals are using to target them now.

To learn more and see insights on your company’s exposed data, visit spycloud.com.

Media contact: Emily Brown, REQ on behalf of SpyCloud, spycloud@req.co

Editor’s note: This press release was provided by CyberNewswire as part of its press release syndication service. The views and claims expressed belong to the issuing organization.

The post News Alert: SpyCloud survey finds machine identity risks outpace defenses, exposing gaps in oversight first appeared on The Last Watchdog.

A pentest used to be an event. An engagement, a report, done. The report described a moment. The website kept going: login, checkout, payments, dozens of third-party scripts, all probed by attackers daily.

Cohen

“Websites change every week and get pentested once or twice a year. That gap is where exposure builds up,” said Idan Cohen, CEO and co-founder of Reflectiz. “Teams need testing that keeps up with releases at a cost they can sustain, and trusted coverage of what was tested.”

Testing with site context

Reflectiz has spent a decade scanning thousands of production websites and holds a live model of each one: pages, scripts, third parties, domains, sensitive inputs, and behaviors. The pentesting agents add the attacker’s perspective to that same model.

A finding does not arrive as a line item. It arrives with the script involved, the data it can reach, and whether real users are exposed right now, allowing teams to skip the investigation and go straight to the fix.

“The hard part of web pentesting was never the payload. It was understanding what the application actually does,” said Ysrael Gurt, CTO and co-founder of Reflectiz. “Our engine has been reading live websites for years, so our agents start with a map of the site that other tools never build.”

Agents divide the work

The agentic pentesting runs as a coordinated team of AI agents, each with a defined role:

•One agent crawls the site the way a real user does, through logins, one-time codes, and 2FA, mapping what is actually there.

•A second fingerprints the stack and works out which attacks apply where.

•A third runs those attacks and chains what it finds.

•The fourth matters most: an independent validator reproduces every finding before it reaches the report. False positives are removed by design.

The result: findings with reproduction steps and evidence, plus a coverage map of what was tested and cleared.

Testing spans the full OWASP Top 10, and teams set depth per flow, from fast predefined checks to expert-level attack chains on critical assets.

Bringing web risks together

The agentic pentesting, part of the new Offensive Hub, joins Security Hub and Privacy Hub on the Reflectiz platform, completing a 360° map of web risk: what runs on the website, what data it touches, and how it can be attacked.

•One exposure picture. Findings from all three hubs cross-reference automatically, no dashboards reconciled by hand.

•Guided fixes. Atlas, the Reflectiz AI remediation agent, explains each risk and walks the team through the fix.

•Existing workflows. Results route into current operations through a REST API, CI/CD triggers, and Slack alerts.

See it live

Reflectiz founders Idan Cohen and Ysrael Gurt will demonstrate the agentic pentesting in a live webinar on September 15 at 11 AM ET / 6 PM CET.

Registration: https://www.reflectiz.com/lp/founders-case-study-webinar/

Product information: Reflectiz Offensive Hub | Walkthrough Video

About Reflectiz: Reflectiz is the continuous web exposure management company. Its agentless, outside-in platform monitors, tests, and secures the entire web layer, from third-party scripts and web privacy risk to agentic penetration testing of the live site. Reflectiz helps enterprises in retail, finance, travel, insurance, healthcare, and gaming meet PCI DSS, DORA, NIS2, and global privacy requirements without touching a line of code. Learn more at https://www.reflectiz.com.

Media contact: Oran Frenkel, PR & Social Media Manager, Reflectiz,
oran.f@reflectiz.com

Editor’s note: This press release was provided by CyberNewswire as part of its press release syndication service. The views and claims expressed belong to the issuing organization

The post News Alert: Reflectiz launches AI website testing, uses site context to find and verify flaws first appeared on The Last Watchdog.

Although the number of DDoS attacks on the Link11 network decreased by 42 percent, the report records new highs for attack intensity across bandwidth, packet rate and cumulative data volume, indicating that attacks have become more targeted and intense.

Attack intensity hits records

Although the number of attacks decreased by 42 percent, record highs were reached in terms of attack intensity in every category. The highest measured bandwidth attack reached 2.3 Tbit/s—85 percent higher than the previous peak of 1.2 Tbit/s in the first half of 2025.

The packet rate followed the same pattern, reaching a new peak of 322 million packets per second — up 56 percent from 207 million packets per second a year earlier. Cumulative traffic also increased, rising from 438 to 705 terabytes over the six-month period — a 61 percent increase.

Botnets fuel bigger attacks

The report attributes these records to super-botnets, such as Aisuru and its successor, Kimwolf, as well as a growing number of hijacked cloud servers. These servers individually push far more bandwidth than a compromised home router or camera ever could.

The report credits the drop in raw attack numbers to sustained international law enforcement pressure, including the takedown of pro-Russian group NoName057(16)’s infrastructure in July 2025 during “Operation Eastwood.”

In March 2026, another blow followed: Authorities in the U.S., Canada, and Germany shut down the command-and-control servers of four major IoT botnets that collectively controlled more than three million devices.

“These numbers show that the threat isn’t shrinking; it’s shifting from breadth to peak intensity,” said Jens-Philipp Jung, CEO of Link11. “Organizations that size their defenses based on last year’s attack count are underestimating how quickly a single incident can escalate today.”

Repeat attacks grow likelier

Being hit once also makes being hit again more likely: only 44 percent of targeted customers remained attack-free for 30 days after a wave in the first half of 2026, down from 54 percent a year earlier.

Traffic masks hidden threats

Not every dangerous attack is a loud one. In one case documented in the report, attackers used a traffic spike against two domains as cover while quietly running SQL injection and cross-site scripting (XSS) probes behind it — a tactic exposed only because they reused the same IP addresses for both.

“The most dangerous attacks we deal with are rarely the loudest ones anymore,” said Jag Bains, VP Solution Engineering, at Link11. “If you’re only watching bandwidth and known signatures, you’ll miss the attacks designed to do the most damage because they’re built to stay unnoticed.”

In short, in 2026, force and concealment determine the risk, not raw attack counts. Defenses built around last year’s numbers are aimed at the wrong threat.

The full report will be available for download here.

About Link11: Link11 is a leading European IT security provider that protects global infrastructures and web applications against cyberattacks. Its cloud-based IT security solutions help companies worldwide strengthen the cyber resilience of their networks and critical applications and avoid business disruptions. Link11 is a BSI-qualified provider for the DDoS protection of critical infrastructure. With PCI DSS, SOC 2 Type II, BSI C5 and ISO 27001, the company meets the highest standards in data security and compliance. 

Media contact: Lisa Froehlich, Link11 GmbH, l.froehlich@link11.com

Editor’s note: This press release was provided by CyberNewswire as part of its press release syndication service. The views and claims expressed belong to the issuing organization.

The post News Alert: Link11 reports fewer but stronger DDoS attacks in Europe for the first half of 2026 first appeared on The Last Watchdog.

Related: Where SBOMs fall short

They can place open source snippets directly inside source files without declaring a package, updating a build file or adding anything to a software bill of materials.

These hidden dependencies expose a weakening assumption behind established software controls: that third-party code arrives through a declared component. When it does not, the Software Composition Analysis tools and SBOM processes organizations rely on may never see it.

Where trails break

When a developer uses an open source package, the package normally appears in a manifest or dependency file. That creates a trail. SCA tools can identify the component, check its license and known vulnerabilities, and include it in the resulting SBOM.

An AI coding assistant can bypass that trail. Because models learn from open source and other publicly available code, an assistant may reproduce a familiar pattern directly inside a file. No package is installed and no dependency is declared. Even a careful reviewer is unlikely to recognize that a block of generated code resembles material from one of millions of open source projects.

The obligations, however, do not disappear simply because the trail does. A reproduced snippet may require attribution or a license notice. Copyleft code may raise broader questions about surrounding proprietary code.

Research shows that this is more than a hypothetical concern. The LiCoEval benchmark evaluated 14 popular language models and found that 0.88% to 2.01% of generated functions were strikingly similar to existing open source implementations. Most models failed to supply accurate license information, particularly for copyleft code.

Pittenger

Those percentages sound small until they meet the scale of a working codebase. In an application with 300,000 functions, a one to two percent rate puts 3,000 to 6,000 functions in play, each one a potential attribution or license obligation that nobody recorded.

Our own early review at Insignary points the same direction. Across a small sample of real-world applications generated wholly or partly by AI, open source snippets turned up in roughly a third of generated files, and in more than half the files from applications built entirely by AI. Traditional SBOMs captured well under a quarter of the dependencies that snippet-level analysis surfaced.

Why controls matter

The GitHub Copilot litigation has already brought the removal or omission of copyright and attribution information into court. The district court dismissed the plaintiffs’ principal DMCA claims, and that ruling is now on appeal. Whatever the eventual outcome, development organizations cannot assume that code is free of obligations merely because an assistant produced it.

Do the benefits of AI coding tools outweigh the risks? Of course. But development and risk teams have faced a version of this question before. In the early days of open source, the first instinct was to hunt it down and strip it out. That impulse faded as the benefits became undeniable, and what replaced it was visibility and control: knowing what you had, where it came from and what it obligated you to do. AI-generated code needs the same shift. The goal is not to ban the assistants. It is to treat what they produce with the same scrutiny already applied to code from outside the organization.

That starts with making AI use visible. Engineering leaders should know which assistants are approved, where generated code may enter repositories and how that use is disclosed in pull requests. The developer submitting the code should remain responsible for reviewing it rather than treating the model as its author or approver.

Find, decide, record

Next, inspect the source itself before code is merged or released. Traditional SCA remains necessary for declared components, but snippet-level analysis is needed to find borrowed code embedded inside files. A match should identify the likely project, version, and its license.

Then route the result through an explicit decision gate. Permissively licensed code may be retained once required notices and attribution are restored. Copyleft or uncertain matches should go to the organization’s open source or legal reviewers, then rewritten or replaced.

Finally, record the decision. Update the SBOM or related attestations, preserve the evidence behind the disposition and identify who approved release. Engineering owns the code it ships; security and open source program teams define the controls; legal specialists resolve the exceptions.

AI has accelerated code production without eliminating software accountability. Controls built around declared dependencies now need to account for code that arrives without one. Once hidden dependencies become visible, organizations can evaluate them using the same disciplined process they already apply to the rest of the software supply chain.

About the essayist: Mike Pittenger is chief strategy officer at Insignary, a Toronto-based provider of software composition analysis technology that identifies open-source components, licenses and vulnerabilities in source code and binaries.

The post GUEST ESSAY: AI coding assistants are putting open source in your code without declaring it first appeared on The Last Watchdog.