Here Come the AI-Generated BEC Scams
Messages delivered through legitimate third-party email infrastructure had C-suite sender display names, custom signatures, and direct approval notes.
All topics
AI
58 Posts
TeamPCP Arrests, the QTFY Attacks, and the OpenAI Post-Mortem
This week we discuss the two arrests in Australia of alleged members of the TeamPCP cybercrime group that has targeted the open source ecosystem, the US government’s disclosure of intrusion activity by the Chinese QTFY threat actor, and finally the long report from OpenAI on the Hugging Face incident.
Linux Foundation Backs New TRACE AI Security Standard
TRACE aims to help prove that sensitive data in organizations is being handled “according to policy” by AI agents and open weight models.
The Challenge of Hacking Back, the Origins of ExploitGym, and Water Plant Attacks
This week we discuss the new White House memo on using private sector operators in offensive cyber operations, Lindsey’s deep dive into the origins of the ExploitGym AI benchmark, and the rash of attacks on water utilities in the U.S. Links Inside ExploitGym: https://decipher.sc/2026/08/20/inside… White House memo: https://www.whitehouse.gov/presidenti… OpenAI post: https://openai.com/index/the-defender…
Inside ExploitGym: How Researchers Are Measuring AI Agent Exploitation Capabilities
A research collaboration, directed by UC Berkeley, led to the development of ExploitGym, a large-scale benchmark for measuring AI agents’ abilities to develop exploits. Here’s the story of how ExploitGym came to be.
MLflow Bug Actively Exploited to Steal Credentials
This flaw allows remote, unauthenticated attackers to read sensitive data from internal network services or cloud metadata endpoints.