Welcome to the first AI for Defenders, and what a week to start. We launched the community a few days ago, and honestly, we’re humbled by how many of you showed up, commented, and said “I’m in.” Thank you. This newsletter is the every-two-weeks half of the deal: a five-minute read of what actually moved for defenders in the AI space, the signal pulled out of the noise.
It’s just getting started, and it’ll grow with every issue (more on how you shape that at the end). One thread ran through these two weeks, and it’s the right one to open on: the AI assistants and agents we’ve been rolling out are now part of our attack surface, and defenders are starting to write the playbooks for it.
What the industry’s doing
-
Copilot ‘SearchLeak’ lets an attacker steal data in one click (Dark Reading). A three-stage chain (a prompt injection to start, then an HTML-rendering race condition and a Bing SSRF) turned Microsoft 365 Copilot into a one-click exfiltration tool. It’s patched now (CVE-2026-42824), but it belongs to a whole new class of hidden-URL injection bugs. If you’ve rolled an AI assistant out across your tenant, this is what “the assistant is the attack surface” looks like in production, not in a research demo.
-
The FBI disrupted an AI-powered phishing service running a million URLs (BleepingComputer). Phishing-as-a-service is now industrialized with AI, at a volume built to overwhelm detection tuned for a slower adversary. Worth seeing the shape of the upgraded attacker before you next touch your filters.
-
Attackers are using the AI hype itself as bait (Microsoft). Fake “AI tool” installers and spoofed AI brands are the new hook. A user-awareness angle you can pass to your people this week: the AI gold rush is a lure as much as it is a tool.
-
Patch Tuesday hit a record 206 CVEs, and AI gets the blame (Dark Reading). AI-accelerated vulnerability discovery is reshaping the patch firehose. The idea worth keeping: a patch cadence built for a slower world is the gap now.
-
CISA rewrote federal patching timelines for the AI era (Dark Reading). A three-day clock for the worst flaws, framed explicitly around how fast AI-driven exploitation now moves. Even outside the mandate, it’s a useful benchmark for “how fast is fast enough now.”
From the community
The work we want to amplify: practitioners showing what they tried, what broke, and what they learned.
-
Microsoft’s updated taxonomy of failure modes in agentic AI. A year of red-teaming agents, written up as a framework you can hold your own designs against. It’s a concept to lift and reuse, not a product pitch, and exactly the kind of “here’s what we learned breaking things” we’re here for.
-
Unit 42: Trust No Skill, on AI agent supply chains (Palo Alto). Those third-party agent “skills” are an unaudited supply chain running inside your enterprise. Concrete guidance on verifying them before they execute.
-
An AI agent (OpenClaw) got phished, and spilled user data (BleepingComputer). A phishing test against an email-handling agent showed how one config choice decides whether it leaks. There’s a reusable idea in here: phish your own agents before someone else does.
-
A path-traversal flaw in AI dev platform Langflow is being exploited (BleepingComputer). CVE-2026-5027 is live in the wild. The reminder: the AI tooling you build on is internet-facing software with its own CVEs. Inventory your AI build stack like any other exposed service.
On the show
No episode yet, the podcast lands later this year. For now the conversation is right here and in your replies, which is exactly where we want to start.
One idea to take with you
If you’re defending an AI assistant or agent, resist the urge to treat a prompt-injection guard as the control. A single pre-filter is brittle, and this fortnight’s stories (SearchLeak, the phished agent) are what happens when that one guard is the whole plan. So layer it: least privilege on what the assistant can read and reach, an allowlist for where it can send data, and logging of what it actually did, so getting past any one layer isn’t game over. Defense in depth was always the answer. It just has a new surface now.
Send us your week
This is issue 001, and the whole point is that it grows with the community. If you’ve been building something with AI in defense, broke something interesting, or there’s a topic you want us to dig into next, hit reply or send us a message. The best things in here will come from you.