Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In July 2025, an AI agent reviewed a support ticket, queried a production database, and leaked integration tokens directly to the attacker watching the thread. Months earlier, another AI followed "hidden instructions" in a public repository, exfiltrating private code into a visible pull request. In both cases, the AI wasn't broken; it simply obeyed the attacker instead of the developer.

Another ping. And another. Employees are urgently logging IT tickets, trying to figure out why their trusted SaaS writing assistant subscription has expired. Meanwhile, your InfoSec team is frantically looking through the avalanche of alerts across the network, scouring vendor policies, and digging into procurement records to determine exactly when the organization provisioned this SaaS tool. Spoiler alert: The organization didn’t.

In May 2025, a developer using Claude with the GitHub MCP server asked their AI assistant to do something entirely routine: review the open issues in a public repository. The repository contained a malicious GitHub issue planted by a researcher demonstrating a security vulnerability. The issue contained hidden instructions. The AI read them, followed them, accessed the developer's private repositories, and posted the contents in a publicly visible pull request. No credentials were stolen.

Researchers recently analyzed 18,000 Claude Code configuration files pulled from public GitHub repositories. What they found was straightforward and alarming: developers are already installing mistyped, misconfigured, and near-identical MCP server names — often without realizing it. The human-error condition that makes typosquatting work was already present at scale before any attacker needed to exploit it.

We’ve established the new forensic reality: a massive 72.9% inventory gap exists between the vendors you monitor and those invisible to your security. We have seen the shortcomings of SSO and its inability to holistically monitor all the vendor applications your users engage with, along with a Shadow AI explosion that is compounding both issues. The era of procurement-only discovery is over. To secure the modern cyber workforce, we must pivot from "buying-based" to usage-based discovery.

In February 2026, researchers uncovered something that should give every security leader pause. A malware operation called SmartLoader, previously known for targeting consumers who downloaded pirated software, had completely pivoted its infrastructure. SmartLoaders new target was developers, and its new entry point was a protocol most security teams had never heard of. The payload delivered to victims: every saved browser password, every cloud session token, every SSH key on the machine.

Shadow IT refers to any technology—including hardware, software, cloud services, SaaS applications, or AI tools—used within an organization without the explicit approval of the IT or security department. Shadow IT is rarely malicious. It is usually the result of employees searching for a means of making their workflows more efficient. When sanctioned corporate tools are perceived as too slow, rigid, or complex, users often "self-serve" by adopting unvetted alternatives to meet their deadlines.

The classic tradeoff in cybersecurity has always been simple: more visibility at the cost of speed. But today, that tradeoff is breaking down. As attackers leverage AI to find and exploit vulnerabilities at unprecedented scale, the sheer volume of alerts is burying security teams. The result? An expanding exposure gap. It is taking longer than ever to triage and remediate threats, creating a dangerous window between when a tool pings and when a human in the SOC can actually take action.