Security Boulevard

Palo Alto Networks is in advanced talks to acquire Clutch Security, an early-stage startup securing autonomous AI agents, for roughly $500 million in cash plus milestone-based earnouts, a 50-times-ARR multiple on a company valued at just $85 million in January 2025.

The premium reflects an escalating arms race to secure non-human identities, since AI agents operate on API keys, service accounts, tokens and certificates that often act without human oversight or expiration dates, and Clutch's Identity Lineage platform maps those agents to their deployers and tools while blocking unauthorized access to production.

Find out more about the deal talks and the consolidation sweeping identity security: buff.ly/gLL9wsn

#Cybersecurity #PaloAltoNetworks #AIAgents #IdentitySecurity #InfoSec

OpenAI has released GPT-6 Cyber, a specialized model that finds software vulnerabilities and helps security teams develop fixes before hackers exploit them, restricted to vetted cybersecurity professionals because its capabilities cut both ways.

It has already produced working exploits for 948 Linux kernel vulnerabilities, including 588 previously unknown flaws, and identified 81 high-severity Firefox bugs Mozilla is now patching, at a research cost of $1.2 million that hints at the compute bill for large-scale AI security testing.

Here is the full story on the safeguards, the benchmarks and the access programs around it: buff.ly/9dLS7nb

#Cybersecurity #OpenAI #AISecurity #VulnerabilityResearch #InfoSec

A bank's service provider, a hosting security tool's update channel, a certificate authority's internal portal and the developer platforms holding AI access tokens were all the way in this week, and trusted intermediaries are the story the past seven days tell.

Two actively targeted flaws in widely deployed developer tooling round out the list, with more than 1,000 internet-exposed GitLab servers still unpatched against a max-severity flaw now in CISA's Known Exploited Vulnerabilities catalog.

The full after-action roundup of all ten incidents, and the takeaway for each: buff.ly/HorPCvc

#Cybersecurity #DataBreach #SupplyChainSecurity #InfoSec #AIAgents

Google Threat Intelligence Group and Mandiant say LLMjacking is maturing into a business with a division of labor, where one crew breaks in and another runs LLM Mixers that resell stolen model access, all while the victim organization gets the bill.

Unlike the gradual bleed of cryptojacking, it spikes fast, with one threat group racking up more than $100,000 in fraudulent charges in a single day, and researchers expect actors to favor it over traditional resource theft.

The report's breakdown of initial access, monetization and defensive controls is here: buff.ly/07oijfp

#Cybersecurity #LLMjacking #AI #CloudSecurity #InfoSec

Imagine a company gets hacked and hires a law firm to manage the response, and months later the affected individuals sue the company and add its lawyers as defendants for helping keep them in the dark, a materially different claim from the familiar one about a firm failing to secure data on its own systems.

Colorado's strict privity rule in Baker v. Wood makes that distinction sharp, since foreseeable effects on another person do not automatically create a professional obligation to that person, and the deeper concern is that a company confronting a breach needs candid advice about uncertain facts, overlapping deadlines and possible defenses rather than lawyers hedging against every customer who might later sue.

See where the privilege ends and the duty question begins: buff.ly/KdxVMXV

#Cybersecurity #LegalTech #DataBreach #Privacy #InfoSec