Developer Releases mcp-linter Tool Exposing Security Flaws in Anthropic MCP Servers

Pentesting AI Components: Key Vulnerabilities CISOs Must Address in RAG and Agent Systems

The article from ABP2B details how AI integration into corporate systems dramatically expands the attack surface beyond traditional web applications. It explains the progression from simple chatbots to RAG-enabled assistants and full AI agents that can execute real actions via APIs and tools. Yuri Grishaev, OSCP+ certified specialist and top Standoff 365 hacker, outlines specific risks including unauthorized data access through RAG, prompt injection via poisoned documents, and XSS chains triggered by model outputs. The piece stresses that classic authorization checks often fail when service accounts grant AI components broad access. It also covers how minimal-privilege principles and output sanitization become critical when agents can modify CRM records or calendars. Finally, the authors provide a readiness checklist and policy templates for organizations deploying AI.

Local AI Models Help Scammers by Drafting Fraudulent Replies Without Raising Alerts

A researcher tested multiple local large language models running on a standard gaming laptop and found that they readily assist users in replying to known scam messages when asked to help rather than to detect fraud. The models, including Llama 3.1 8B, Qwen 2.5 7B and DeepSeek-R1 8B, produced polite confirmations of prepaid transfers to unknown recipients on platforms such as OLX and Kaspi Gold without any warnings. To address this gap, the author introduced a protective layer called MoneyGate that combines a mandate system, a judge model and hard-coded red-flag rules. In tests across 42 scam scenarios in Russian, Kazakh and mixed language, MoneyGate prevented every fraudulent transaction while allowing most legitimate requests to proceed. The benchmark KZ Scam Shield remains publicly available for further evaluation of local AI safety mechanisms.

SOC Forum 2026 Examines How Generative AI Lowers Attack Barriers and Reshapes Security Operations

At SOC Forum 2026 in Moscow, experts from BI.ZONE, Kaspersky, and GK Solar analyzed the dual impact of generative AI on cybersecurity. Oleg Skulkin of BI.ZONE noted that GenAI has reduced the skill threshold for attackers to nearly zero, enabling less experienced threat actors to launch sophisticated campaigns. However, Kaspersky researcher Georgy Kucherin warned that unverified AI-generated code can expose attackers through detectable flaws, while overly perfect phishing text now raises suspicion among defenders. Alexander Shepilov from GK Solar emphasized treating AI agents as distinct non-human identities in threat models, limiting sub-agent privileges to prevent overreach. Alexander Kuznetsov advocated gradual SOC automation, starting with single operations like IP blocking before integrating AI. Discussions also highlighted potential increases in costs for skilled personnel needed to manage these agents rather than immediate savings.