2026年5月25日、Patrick McKenzie氏は、LLM（大規模言語モデル）が生成した公開文書で、専門的な関連性が明確であり、人間の作者不在による実用性の低下を一切感じさせないものに初めて出会ったと報告。これはmsuiche氏のエージェントがサプライチェーン攻撃のクラスター分析について執筆したブログ記事であり、AIによる成果物が実務レベルで通用する節目となった。
A new wave of the Shai-Hulud malware campaign has compromised approximately 600 NPM packages, targeting developers by embedding malicious code into open-source dependencies to steal credentials and sensitive data.
Researchers discovered a critical authentication bypass vulnerability (CVE-2026-9058) in Poland's Social Insurance (ZUS), eCourt, and eHealth systems. The flaw, linked to improper e-signature validation, could allow unauthorized access to sensitive citizen and medical data. Security experts warn that unpatched systems pose a serious risk of cyber chaos.
The FTC fined Cox Media $4.5 million for claiming it could use AI to eavesdrop on phone microphones to target ads, a practice the company marketed to clients but never actually deployed.
A developer describes being targeted in a sophisticated malware campaign likely linked to North Korea (DPRK), involving fake job offers and malicious code designed to compromise their system.
Researchers discovered a new supply chain attack targeting 34 packages across NPM, PyPI, and crates.io, with over 100 malicious versions published. The packages deploy a "TrapDoor" crypto stealer designed to exfiltrate cryptocurrency wallet credentials and sensitive data from infected systems.