The OpenSSF Governing Board has called for more support from enterprises that rely heavily on public registries, saying the current funding model is no longer sustainable.

In a pledge signed by organizations including GitHub, Google, IBM, Microsoft, and Sonatype, it said that package registries are facing growing operational and financial pressures, including rising infrastructure costs and a need for more investment to strengthen security and improve the developer experience.

"Public package registries are critical infrastructure for the global software supply chain. Every organization that builds software depends on them, yet these registries face growing demands for security, reliability, compliance, and developer experience," the firms said.

"We have a stake in changing this. Registries cannot deliver the scale, availability, security, and observability enterprises need without sustainable funding."

Public registries including PyPI, Maven Central, crates.io, RubyGems, npm, and NuGet now serve trillions of downloads each year, with download volumes growing by between 30% and 50% per year.

So far this year, 1.8 million malicious packages have been discovered, and, said OpenSSF, AI-discovered vulnerabilities are expected to cause a three-to-fivefold increase in publish events, as more package versions and updates are pushed to public registries.

However, as things stand, many registries still rely heavily on donated infrastructure credits and small teams of just two to three people. They can no longer deliver the scale, availability, security, and observability enterprises need without sustainable funding.

And, as a result, there's increasing potential for outages, slower threat response, and weaker visibility across the software supply chain.

However, with predictable, recurring revenue, said OpenSSF, registries could deliver reliable publication, discovery, and distribution services with monitoring, alerting, and operational support that minimizes downtime.

They could offer dedicated support channels, private or peered access for high-volume consumers and caching and distribution optimizations for high-demand packages.

They could also offer advanced analytics on publishing and consumption patterns, ecosystem-level insights that individual organizations can't gather on their own, compliance and policy controls and audit trails.

And security and compliance could be significantly improved, with artifact signing, trusted publishing, malware scanning and quarantine, build provenance attestations, SBOM and VEX generation, threat detection and incident response SLAs.

"These are the kinds of capabilities registries can deliver when they have the resources to operate beyond survival mode," said OpenSSF.

"Sustainable funding models unlock them for the entire ecosystem, including the individual developers and small organizations who will continue to access registries for free."

The new model – which OpenSSF said doesn't commit individual registries to specific pricing, terms, or tiers – targets enterprise commercial customers, rather than the broader developer community.

"Every organization that builds software depends on package registries. We invite enterprise consumers across the industry to engage with the registries they rely on, understand their sustainability needs, and be prepared to participate in funding models that keep this infrastructure strong," it said.

"Sustainable registries are more secure, reliable, and observable. Supporting them strengthens the open source ecosystem for enterprises, maintainers, developers, and users alike."

FOLLOW US ON SOCIAL MEDIA

Spain has seen its first official data breach due to an AI agent.

The Spanish Data Protection Agency said in a blog post that it had received the first notification of a data breach that was apparently carried out by an AI agent using a known large language model (LLM).

The revelation comes amid a wider discussion about the safety of AI, in particular agents, following a series of incidents in which OpenAI and Anthropic agents went "rogue" and targeted external organisations during evaluation tests. OpenAI admitted in July that its agents infiltrated the Hugging Face repository, and Anthropic followed suit shortly afterwards with its own admission of misaligned behaviour.

Francisco Pérez Bes, the head of the Agencia Espanola Proteccion Datos (AEPD), said in a blog post that the information on the attack comes entirely via the impacted organisation, with further investigation required.

But what it does show is that agentic AI attacks "have ceased to be a theoretical risk," Pérez Bes said, according to an automatically translated version of the blog post.

While AI has long been used to write phishing messages, translate fraudulent campaigns, and help search for flaws to exploit, Pérez Bes said the "emergence of AI agents... introduces a qualitative change," as it can plan tasks, execute code, and modify its actions autonomously.

He added: "It's important to remember that AI doesn't create new threats. But it does increase the speed, scale, and adaptability of existing malicious techniques, reducing the time available to detect and contain them.

His comments echo warnings from the security industry, with Forescout saying earlier this year that AI is now a "standard part of the attacker toolkit" and Anthropic adding that AI is helping to lower the bar for hackers.

What happened?

According to the blog post, the hackers managed to log into the compromised system, setting loose an autonomous agent to look for vulnerabilities in the application, which then allowed them to modify personal data and access invoices.

Pérez Bes stressed that there was no indication that the AI model used or its infrastructure had been compromised, and that the agent used wasn't necessarily designed to carry out such activities.

The victim of the attack hasn't been revealed, nor has the maker of the LLM itself – or any details on the hackers responsible.

What next?

Pérez Bes said the purpose of issuing the notification was to warn organizations to boost their security practices to answer the new threat of AI agents, calling it a sign to act.

"The arrival of AI agents in the offensive arena should prompt an immediate review of security and data protection models," he said, according to the translated post.

He called for organizations to include AI-assisted or AI-driven attacks in their risk analysis, reconsider response times as procedures designed for manual attacks won't be able to keep pace with autonomous agents, and to take measures to protect digital identities and credentials to keep AI agents from slipping in via accounts, API keys or tokens with excessive permissions.

Pérez Bes said manual intervention is no longer enough when it comes to security. "Human supervision remains essential, but it must be supported by detection, containment, and response mechanisms capable of operating quickly enough," he said.

FOLLOW US ON SOCIAL MEDIA

The Scottish government has agreed to tighten up the rules on new hyperscale data centers, but has stopped short of halting their development altogether.

MSPs voted down a motion brought forward by the Scottish Greens to introduce a complete moratorium, but said the government would only approve applications for new data centers with a capacity of over 50MW if they have undergone a full Environmental Impact Assessment (EIA).

The new rules come into force today.

"There are considerable benefits for all parties where the need for EIA is identified and planned for at the earliest possible stage, when there is greatest scope to integrate mitigation measures to minimize impacts from the outset in designing green data centers which support sustainable infrastructure growth," said chief planner Fiona Simpson in a letter announcing the decision.

"Embedding the consideration of environmental factors from the outset can also help minimize the risk of delay at later stages and can support a smoother passage of proposals through the planning process."

Meanwhile, until national planning guidance has been formalized – probably early next year – no decisions on planning for data center applications will be made.

The Scottish Greens had been calling for a full moratorium on new data centers, and MSP Patrick Harvie has expressed his disappointment at the decision.

"This debate was a chance for MSPs to reassure local communities and to put the national interest ahead of the interests of big business, but they have done the opposite," he said. "Instead they have chosen to muddy the waters and thrown up more questions than answers."

There are currently dozens of active planning applications for new data centers across the country, with decisions due for at least two by the end of this year. One, in Fife, is expected to be the second largest in the world.

The country's a desirable location, thanks to its leadership in renewable energy and the existence of former industrial sites with access to existing electricity infrastructure.

However, the Greens claimed that if just the first 24 of these active applications are approved, they would consume one-and-a-half times as much electricity as the whole of Scotland currently uses at peak times – between 4.5 GW and 6GW.

Meanwhile, current cooling techniques require large amounts of water, and people living near large data centers report high levels of noise.

But, said public finance minister Hannah Mary Goodlad, "We must balance the economic and employment interests in developing data centres with national energy, climate and community wealth building ambitions, which are vital to our future prosperity, as well as the potential impact on local communities."

The Green Party has similar ambitions to halt data center development across the whole of the UK. However, last week, Prime Minister Andy Burnham ruled out that idea, saying that data centers pulled in other investment and that AI Growth Zones were an important vehicle for economic growth.

Two years ago, the government classified data centers as critical national infrastructure, on the same footing as water, energy, and emergency services systems, and allowing some projects to be fast-tracked.

FOLLOW US ON SOCIAL MEDIA

OpenAI has revealed six more incidents of "unexpected or concerning model behaviour", adding to the constant flow of reports of rogue AI amid a wider debate about the technology's safety.

Alongside the incident reports, OpenAI unveiled a framework for disclosing such misalignment issues to the public, rather than ad hoc revelations.

The report comes as the AI industry and wider stakeholders discuss how to address the risks of misalignment, following an Anthropic employee quitting to warn about safety and potentially existential risks to humanity that could arise.

In a blog post, OpenAI admitted that the AI industry had not solved the alignment issue that became clear this summer amid a series of cyber incidents with AI agents, and was not monitoring enough to continue scaling the technology at pace.

"Decisions about how AI development should proceed in the months and years to come need to draw on evidence that people outside the companies building frontier models can examine for themselves," the company said in the post.

Six new problems

The post detailed six examples of misalignment, when the AI model or agent takes actions that humans didn't intend, such as when OpenAI's agents hacked the Hugging Face AI repository in order to solve a test question.

OpenAI released detailed reports about the six new examples, but added: "These are reports of individual instances, and shouldn't be considered reflective of how often misalignment occurs across our models."

The first two cases involved altering summaries to hide mistakes or behaviour. In one case, an as-yet-unreleased model changed its own instructions, altering summaries used to continue its work, in order to "disregard its normal constraints." OpenAI said it spotted 27 instances of summary editing. The second example was similar: during training, GPT-5.6 Sol altered summaries to cover up mistakes or misaligned behaviour from users.

The third and fourth cases were about information sourcing. In one instance, a model searched for exposed API keys and then used them without authorisation – as part of a basic request to dig out earnings figures. "When it still wasn't able to retrieve the requested figures, it fabricated them and presented them as data from the requested source," the post said.

In the next instance, the model found an answer to a query about lake sizes via Python, but the user asked for a source, so it uploaded the file to be able to cite it, without telling the user.

The last two new cases had echoes of the Hugging Face incident. In one, models used a software repository as a message board to share information, and in the second, agents working together used a public file hosting website to share files online, despite the task's requirement to only use local files.

Sharing misalignment

OpenAI said it had previously attempted to make all findings about misalignment public. "But without a systematic approach to reporting these findings, our disclosures have been ad hoc and less frequent than ideal: we've often waited until we could collate several instances into one report, or added them to system cards for newly released models," the company noted.

Because of that, the company has developed a new framework to make it easier and faster to publish misalignment reports, even if the behaviour hasn't been fully solved.

Under the new framework, any OpenAI employee can flag misalignment for investigation and request it be shared via public disclosure – though of course it's down to technical staff whether that happens.

If published, a report will include details about what happened, any harms, how the misalignment was discovered, and what OpenAI will be doing next to mitigate.

"At the moment, there is no industry-wide framework with explicit standards for how AI developers should disclose examples of misalignment in their models," the blog post added. "We hope that the framework we're outlining today is a first step toward creating such standards, setting out which misalignment instances developers should disclose and what their reports should contain."

FOLLOW US ON SOCIAL MEDIA

Vectra AI has announced the launch of Ascent, a new global partner program designed to help solution providers and technology partners build expertise and services around modern AI-driven security threats.

As part of an expanded partner strategy, the vendor is bringing together solution providers, MSSPs, systems integrators, distributors, cloud partners, and strategic technology alliances to capture the growing market opportunity.

Vectra AI is an AI-native security and observability provider with expertise in behavioural AI and machine learning. The company serves more than 2,000 organizations worldwide and provides technology backed by 39 patents.

Attackers are using AI to operate at machine speed and exploit gaps across the security stack, according to Vectra, with identities, legitimate credentials, cloud services, and trusted tools increasingly at risk.

The Ascent program now aims to help partners work with customers to better identify these gaps, modernize security operations, and improve security outcomes across their technology environments.

"The market need and opportunity is very clear given the impact AI is having on both security technologies and attacker capabilities," said Chad Reese, senior vice president and global channel chief at Vectra AI.

"Our technology is recognized as an industry leader in this space, and the Vectra AI Ascent Partner Program is intended to invest in our skilled partner ecosystem to help them deliver meaningful business value to customers."

A fresh focus on joint activity

The Vectra AI Ascent program is built around four pillars of joint activity: co-sell, co-market, co-deliver, and co-innovate.

Co-sell aims to enable joint account planning, technical validation, and executive alignment, while the co-market element will focus on campaigns, events, marketing development funds, and partner-ready content.

With co-deliver, partners can expand their services around implementation, consulting, managed services, and customer success. The co-innovate area will focus on developing integrations, services, and managed offerings to address wider customer challenges and help partners differentiate.

Partners joining Ascent can progress through three levels – Basecamp, Elevate, and Summit – with each designed to provide increasing benefits and joint investment as their business grows with Vectra AI.

Reese said the program comes as organizations are increasingly looking to trusted advisors to help them tackle modern AI security challenges.

"With the Ascent Program, we are bringing Vectra AI and our partner ecosystem closer together around deep expertise, value-added services, and joint innovation to help customers achieve stronger security outcomes while maximizing the technology investments they've already made," he added.

It’s been a summer of change in the UK, with a new prime minister, cabinet, and an overhaul of the Department of Science, Innovation, and Technology (DSIT).

Regardless of the new leadership and approach to British tech, Salesforce UKI CEO Zahra Bahrololoumi said the company remains committed to its goal of boosting digital skills and helping the UK capitalize on the generative AI boom.

Speaking at Dreamforce 2026, Bahrololoumi told ITPro it’s business as usual for the CRM giant, which is investing heavily in both the UK and Ireland.

Indeed, the company is one of a host of tech giants including IBM, Google, and Microsoft that committed to helping train 10 million Brits in AI by 2030.

“We’re apolitical, and irrespective of government we are still committed to and very active in the skilling of people, contributing to the 10 million by 2030, and of course, we’ve been very proactive with our Future Trailblazers program,” she told ITPro.

“We've trained 15,000 people. We're in schools, we’re in primary and secondary schools, we’re not stopping,” Bahrololoumi added. “We remain true to our mission. We remain active and true to our customers, irrespective of government.”

Bahrololoumi conceded that she thinks the UK needs to be “way more aggressive on skills”, but there's plenty to shout about for the UK and its place in the global tech economy, particularly compared to European competitors.

This isn't the first time Bahrololoumi has talked up the UK's tech credentials. Last year, she told ITPro that the country has “some fabulous conditions” to help it become a global AI leader.

“I think one of the things that we've got to remember is going for us … we don’t have the labor laws that we have in wider Europe,” she told ITPro. “So we have a bit more flexibility and versatility in how we deploy that responsibly and ethically.

Salesforce is all-in on the UK

Speaking to assembled press at Dreamforce, Bahrololoumi said the company is keen to build on long-standing ties with the UK, tech sector a view echoed by Paul O’Sullivan, SVP for Solutions Engineering at Salesforce.

O’Sullivan highlighted recent moves by Salesforce in the UK, including an expansion of its London campus which combined its AI Center with the firm’s headquarters.

That move formed part of a commitment by the firm to invest $6 billion in the UK over the next five years. Crucially, O’Sullivan said the expanded campus will provide a springboard to boost engagement with partners and top tech talent.

“We have seen a tremendous amount of success, and we’ve seen the opportunity to leverage that space, that physical space to inspire, excite and educate not just our customers but young people,” he said.

All told, O’Sullivan revealed that the company has engaged with 900 customers through the space. Since the inception of the AI Center, it’s had more than 15,000 customers come through.

Looking ahead, Bahrololoumi said Salesforce is embarking on a significant hiring spree, will invest heavily in apprenticeship schemes, and plans to double the number of forward deployed engineers (FDEs) to support customers.

“We are hiring, and we're not just hiring in FDEs,” she said. “We're hiring in all aspects of our organization. Actually, we need more talent.”

FOLLOW US ON SOCIAL MEDIA

Senior Salesforce figures have revealed plans to expand forward deployed engineering (FDE) capabilities in the UK as the CRM giant targets agentic AI adoption gains.

Speaking to assembled media at Dreamforce 2026, Paul O’ Sullivan, SVP of Solutions Engineering at Salesforce UK, said the company plans to double the number of FDEs operating across the UK.

“We’re going to double the size of the [FDE unit] capacity,” he said. “It strengthens our position in the UK and it shows the bigger investment that we’re making as well.”

O’Sullivan told ITPro this will take the total number of FDEs across the UK to “about 95”. These specialist engineers will be embedded with Salesforce customers, helping staff to use the company’s agentic AI tools and to build custom agents.

The company's career portal shows it's currently hiring for FDEs spanning core products, including Agentforce and Data 360.

FDEs act as consultants embedded directly within enterprises, offering technical guidance and working alongside internal teams to build custom AI solutions.

“The primary purpose is two-fold,” he said in response to a follow-up question from Diginomica. “We’re going to help you build your agents that are going to link directly to business value.”

“That’s going to allow you to then think about where you can drive better customer experience, more loyalty, improvement on service. That plays into exactly how agents can deliver value more widely.”

Salesforce eyes easy agent gains

The move builds on a broader push by Salesforce across the UK and Ireland, with the company accelerating skills-related investment and engagement with enterprise customers.

Notably, Salesforce already has a professional services organization designed to support adoption of its various services. While FDEs sit separate from this, Salesforce UKI CEO Zahra Bahrololoumi said they form part of a larger effort to “skill up and enable customers”.

“The more fluent our customer base is, the more they’ll get out of the platform,” she told assembled media.

“Our FDE capacity and our FDE capability has been sized at the moment to ensure that, based on what we see on where our customers are, we can get them up and running with agents and consuming and learning and tuning.”

O’Sullivan added that the FDE team is also connected to the wider engineering function at Salesforce, offering broader engineering expertise for customers.

“When we think about 95 as a growth number, we’re actually connected to an existing team that’s 330,” he said. “So the combined function will unlock more scale and more opportunity.”

FDEs in the spotlight

Salesforce isn’t alone in its FDE focus. As ITPro reported in July, a host of hyperscalers and leading AI providers have expanded capabilities on this front over the last year, with the primary aim of streamlining AI deployments.

In late June, Amazon Web Services (AWS) announced plans to invest $1 billion in its Forward Deployed Engineering division.

Just days later, Microsoft unveiled the Microsoft Frontier Company as part of a $2.5 billion investment, with the long-term aim of hiring and deploying up to 6,000 AI experts and engineers inside customer organizations.

FOLLOW US ON SOCIAL MEDIA

British small businesses (SMBs) are more likely to be hit by cyber attacks than those in other countries, with two in five falling victim last year.

Globally, 29% of organizations have been hit by a successful cyber attack in the past year, according to the tenth annual Hiscox Cyber Readiness Report. However, for UK businesses, the figure's substantially higher, at 38% – making it the most-affected country worldwide.

UK SMBs are spending less to remediate these attacks, with an average cost per attack of $35,908, compared with $52,000 globally. On average, incidents caused around 32 hours of operational disruption.

But, commented Jamie Akhtar, CEO and co-founder of Cybersmart, "While the average cost of an individual attack in the UK may be lower than the global average, the higher proportion of businesses being successfully compromised means many more firms are being exposed to those costs in the first place."

Meanwhile, small UK firms are failing to insure themselves adequately against cyber attacks, according to Hiscox, with only four-in-ten having cyber coverage, compared with around 63% of medium-sized firms and seven-in-ten FTSE 100 companies.

UK firms are actually spending more than average on cyber resilience, at $59,700 – the third-highest spend – compared with a global average investment of $51,000. Just over half of firms are adopting new technology, with 55% investing in specialist staff and 62% updating employee training.

The reasons for the greater vulnerability of UK firms aren't apparent.

"These are some concerning results, and it's not clear why the UK is suffering a larger volume of attacks compared to other countries," said Keven Knight, CEO of Talion Cyber Security.

"It could be as a result of geopolitical instability, or it could be because of the wave of attacks against retailers from last year, which might have spurred attackers to target businesses in the region."

However, there also appears to be a link between cybersecurity performance and executive compensation: globally, 32% of firms said executive pay is now linked to cybersecurity performance, while the figure was just 25% for UK firms.

Overall, cyber attacks are costing small businesses dear, with 32% saying they have delayed growth and expansion plans, and 31% that incidents have increased staffing costs. Three-in-ten said they'd experienced financial damage and 29% that they'd lost business opportunities. Even more – 48% – cited reputation and customer trust as the most significant cyber-related risk.

"It's never just about containing an incident initially and moving on, that's naive and unrealistic. It's the aftermath of an attack, where organisations have to work through the financial losses and operational downtime, that causes the greatest damage," said Knight.

"Downtime doesn't just mean being locked out of computers, it means disruption to service, disruption to employees and their ability to perform their jobs, plus disruption to customers because they are unable to access the services or goods an organisation provides to them. Every second of downtime costs the business money."

FOLLOW US ON SOCIAL MEDIA

UK workers are not only using shadow AI at work in large numbers, but they're also spending nearly £1 billion of their own money to do it.

In a new report, Deloitte has found that 63% of British workers have used generative AI tools for work. Nearly half (46%) say they are using free tools at work, 34% say they are using external tools paid for by their employer, and 17% say they are using in-house tools.

However, 31% say they are using generative AI without their employer's knowledge – and 17% say they're paying for at least one generative AI tool themselves for work purposes, spending £958 million between them.

"UK workers are showing they don't want to wait for permission to use generative AI. Many are already using free tools or pay for premium versions themselves to help them get work done," said Hayley McKelvey, chief AI officer at Deloitte UK.

"The challenge is no longer getting people to use generative AI, it's how businesses meet this growing demand in a way that is secure, responsible, and creates lasting value for both the organization and its people."

Many workers are secretive about their AI use, with 23% thinking there's a stigma attached and 64% worried that managers will think AI can do their jobs. Two-thirds also reckon that their organization lacks convincing leadership when it comes to how generative AI should be used.

"Workers who feel a stigma around adopting generative AI tools are more likely to conceal their use. Leaders should help their people use AI responsibly, with a clearly articulated and well-understood goal," said McKelvey.

"That means being clear about why their workforce should use generative AI, how it should be used, and what success looks like. This will help people use the tools more consciously, make better decisions, manage risks and add value."

Workers are mostly using the technology to support everyday work activities with the top three use cases being searching for information (43%), drafting emails (43%) and creating summaries (31%). Nearly half, though, say they've had no formal training on how to use AI safely and effectively in the workplace.

"The story here isn't that workers are using GenAI, it's that they are using it despite limited training, patchy guidance and, in some cases, without their employer's knowledge," said Paul Lee, partner and head of industry insight at Deloitte UK.

"What's particularly striking is how quickly GenAI has become part of everyday working life. Yet for many workers its role remains relatively basic, focused on searching for information and drafting content rather than supporting more complex work."

And, of course, using shadow AI, even when workers are paying for it themselves, presents serious risks for organizations.

Just last week, the UK's National Cyber Security Centre (NCSC) warned that firms need to crack down on unapproved AI use, citing the risk of data breaches, the loss of intellectual property, and failure to meet regulatory requirements. "You cannot manage what you do not know," it pointed out.

FOLLOW US ON SOCIAL MEDIA

AI safety risks were the big talking point on the opening day of Dreamforce 2026, with the annual conference’s star-studded line-up bringing the topic to the fore.

Anthropic CEO Dario Amodei joined Salesforce chief Marc Benioff during the opening keynote to discuss the company’s Claudeforce launch. Recent comments on the concerning pace of AI development dominated the discussion, however.

With companies such as Anthropic rolling out increasingly powerful models, Amodei told Benioff that the industry needs to have a candid discussion about development timelines, AI safety, and the introduction of more robust guardrails.

“We can always be better, let’s make our practices better, let’s recommit to transparency,” he told the Salesforce CEO. “Let’s invest more in safety, then let’s organize the rest of the industry and say ‘what can we do to set standards for everyone?’.”

Amodei’s comments came after he published a lengthy essay on 12 September arguing that the AI industry needs to slow down the pace of AI development to counter potential harms. This call for “pacing the frontier” was echoed by OpenAI CEO Sam Altman and xAI chief Elon Musk online.

Why the focus on AI safety?

The topic of AI safety has been thrust into the spotlight after a series of high profile security incidents involving agents at OpenAI, Anthropic, and Meta. These incidents saw agents escape testing environments and breach third-party companies such as Hugging Face.

Combined with whistle blower claims that AI could severely harm humanity in recent days, the topic appears to have reached boiling point.

Speaking during a fireside chat with Benioff later in the day, Altman said the Hugging Face debacle “triggered a real rest, not just in our own company, but in the world”.

“I think people also feel the speed with which things are moving,” he told Benioff. “There have been things like the Hugging Face accidents, other accidents in the field.”

Altman added that he is confident both in the ability of the industry and OpenAI itself to slow down the pace of development and sharpen the focus on AI safety.

Individual responsibility

While Altman and Amodei have called for an international effort to slow down the pace of AI development, Nvidia CEO Jensen Huang thinks the responsibility rests firmly on individual companies – not erecting new barriers.

“We don’t need any new laws, we don’t need any new regulations,” he told Benioff.

Huang is by no means calling for a Wild West approach to AI development, rather arguing that the onus must be placed on developers that are rolling out products they feel they cannot adequately contain.

“Safety is paramount,” he said. “Safety is an engineering problem. We’re developing software after all, we’re developing computing systems after all. It’s complicated computing systems, but ultimately it’s a computing system.”

Huang said that testing environments need to be “built in a good way” to avoid repeats of the incidents involving Meta, OpenAI, and Anthropic. That responsibility lies with them, not by insisting the rest of the industry adheres to their playbook.

As ITPro reported in August, all three companies involved in ‘rogue AI’ incidents worked with the same testing company before agents escaped their sandbox environments.

“If we're not confident about the safety of the products, like all companies … if you build a product or a service and you're not confident in its functionality, capability, or safety, then don't release it,” he said.

“That's a very obvious thing to do. You pace yourself until you are confident you're releasing something that the market would appreciate.”

FOLLOW US ON SOCIAL MEDIA

2026 has been dominated by claims of a looming ‘SaaSpocalypse’, with AI heralding the doom of software as we know it. Marc Benioff and Jensen Huang aren’t convinced.

During the opening day keynote at Dreamforce 2026, the Nvidia and Salesforce CEOs dismissed the prospect of SaaS dying off.

Concerns on this front mounted earlier this the year with the launch of Anthropic's Claude Cowork. The new service, which offered enterprises agents equipped with sector-specific capabilities, prompted a mass sell-off of software stocks

In early February, the S&P 500 software software and services index slipped by nearly 5%, losing $830 billion in market value in a matter of days.

Huang told Benioff that even amidst growing industry concerns, he wasn’t fully convinced. AI might have an impact on the software industry, but more in the sense that it will complement and redefine SaaS.

“I was the first CEO to come out - not in the software industry - to say the end of software is nonsense,” he said. “This is going to be a layer on top of software. This new layer on top of software is going to be agentic.”

“It’s going to make software so much better.”

Huang’s comments came after Benioff reflected on the state of the software industry earlier in the keynote, describing claims this year as “crazy nonsense”.

“We've been hearing all this kind of crazy nonsense about the SaaSpocalypse, especially over the last six months,” he told attendees. Similar to Huang’s outlook on this front, Benioff noted that AI will ultimately be a net positive for the software industry and users.

“We realize that the SaaSpocalypse isn’t about the end of software, but it may be about the end of software that makes humans do all the work,” he said.

Salesforce’s earnings on this front, Benioff said, are testament to the fact that it’s weathered this storm so far. The CRM giant’s Q2 earnings, released in August, marked its best performance on Wall Street since 2020 and among the best in the company’s history.

Revenue in areas such as Agentforce and Data 360, for example, reached nearly $3.9 billion, marking a 210% increase year-over-year.

SaaS isn't dying, but it's still changing

Huang and Benioff join a host of tech industry leaders to shrug off claims that AI will render SaaS obsolete. As ITPro reported in February this year, AWS CEO Matt Garman said “much of the fear is overblown” but admitted that the technology will prompt huge changes in the industry.

The arrival of AI, particularly agentic AI, will change how software is built and consumed, he said at the time. That means existing providers will face a more competitive business landscape and force them to work harder to secure – and maintain – market share.

Research from Gartner in late June highlighted this new reality for software providers. Agentic AI does pose a threat to traditional software revenue models, according to the consultancy, with up to $234 billion of application spending exposed to “agentic arbitrage”.

This is a process whereby agents render some services obsolete and removes the need to work across multiple interfaces. Salesforce, it seems, is ahead of the curve on this front.

The company unveiled AIforce ahead of Dreamforce. This is a new ‘live interface layer’ that sits on top of its core product ranges, such as Agentforce, Data 360, and Customer 360.

Put simply, AIforce means users can use Salesforce without actually accessing the platform through traditional dashboard routes. Instead, users can access services, data sources, and information through agents such as Anthropic's Claude with their own custom-built UIs.

FOLLOW US ON SOCIAL MEDIA

Cost exhaustion attacks, disposable applications, and evidence custodians – these are the ideas businesses need to prepare for within the next three years or less.

That's according to analyst house Gartner, which laid out a list of ten predictions for 2027 to 2030, many of which are focused on AI and its potential business impacts.

That includes physical AI or robots, agent swarms clogging up public services or running down budgets, and unpicking how to actually manage AI costs, providers, and risks.

"Many of the systems we take for granted today, from public services to software, energy and workforce models, will be fundamentally transformed by AI over the next decade," said Daryl Plummer, distinguished VP analyst and Gartner fellow.

"The most successful organizations will be those that balance innovation with responsibility, building the capabilities needed to manage both the opportunities and the unintended consequences of an AI-driven world," Plummer added.

AI risks on the horizon

The analyst firm predicted that more than ten billion autonomous agents will be clogging up public services by 2030. Those agents will have been made by people, companies, and even governments in order to take on basic tasks for users. But that will lead to a sharp increase in the number of applications and other transactions, putting pressure on the government to keep up.

To prepare, Gartner called on governments to modernise their digital infrastructure and strengthen verification, though they'll only have a few years to do so.

Alongside that, organisations will face a new type of cybersecurity risk: cost exhaustion attacks. These are like a denial of service attack, but focused on driving up the cost of AI used by the company.

"The rise of public-facing AI is creating a new cybersecurity risk called cost exhaustion attacks, where malicious actors deliberately drive excessive AI usage to increase operational costs," Gartner said in a statement.

To avoid this, companies should consider AI usage patterns and token consumption as security concerns, ensuring both are monitored, saying eight in ten companies will face these attacks within the next few years.

AI business

Gartner also predicts that by 2030, 80% of front-line employees working for global companies will be working alongside or with physical AI, such as robots, drones, autonomous vehicles, or "other embodied systems that sense, interact with, and influence their surroundings."

By 2029, most applications will become disposable – on purpose. These disposable apps will be used for less than one year, with employees using AI app development in order to meet short-term needs, ditching the tool when it's no longer needed. Gartner warned that will spark governance and security challenges.

Beyond AI-generated apps, Gartner also forecasts the rise of AI-powered products, which will allow companies to introduce "customised, efficient and scalable offerings," leaving behind those who haven't gotten to grips with the tech. Gartner also predicted more firms will find themselves generating power, selling it back to grids or to AI data centres.

Watching AI – and its cost

To help manage the rise of AI, companies will create a new role or corporate function dedicated to managing AI costs and mapping it to value or profit, with 60% of the largest companies embedding financial operations controls at inference, leading to real-time optimisation and cost governance. CIOs, meanwhile, will become the "evidence custodian" for AI accountability in businesses, ensuring guardrails are in place.

Alongside that, Gartner predicted that insurers will drive AI governance in organizations, rather than regulators, with policy-based AI built into systems and workflows to address the growing concerns around risks and liabilities associated with the technology.

FOLLOW US ON SOCIAL MEDIA

Automation and agents in Security Operations Centers (SOCs) aren't easing the job of security analysts, with teams overwhelmingly stuck having to resolve problems manually.

Security analysts are forced to spend 68% of their day on reactive alert triage and manual data gathering, leaving little time for proactive threat hunting. Meanwhile, 68% of all threat detections still require manual human intervention to resolve, a new report from network intelligence form ExaHop has revealed in a new report.

"Security teams are facing a crisis in dealing with AI-powered threats," said Jamie Moles, Senior Technical Manager, ExtraHop.

"To solve this, security teams are diligently working towards achieving an agentic SOC that drastically expedites the entire security response cycle while eliminating the burden and fatigue analysts have been experiencing."

When asked which elements of the attack surface they believe represent the most significant cybersecurity risk, 55% of survey respondents cited AI agents and generative AI applications, followed by public cloud services at 45% and third-party services and integrations at 35%.

However, the researchers said the timeline to identify threats has lengthened, with 49% of organizations only identifying ransomware activity after it reached the data exfiltration or later stages – up from less than a third in 2025.

Nearly 15% failed to recognize that they were being targeted until a ransom demand was issued, up from 6% the previous year.

When asked which factors delayed a critical alert from being detected or investigated, 41% cited the use of encrypted channels to bypass detection. Meanwhile, 38% said that attacker activity mirrored legitimate, authorized workflows and processes, and 34% noted that valid, high-privilege account permissions were used in the attack.

As a result, SOC workflows remain heavily manual, with most respondents reporting mid-to-high levels of manual intervention across the threat lifecycle. Investigation was the most manual stage, requiring manual intervention about 50% of the time.

SOC analysts are limited to spending just 44% of their time on proactive efforts, such as threat hunting and detection engineering.

The problem, the firm said, extends across all SOC-adjacent job roles and organizations of all sizes. While larger companies show a slight trend toward spending more time on proactive efforts, the increase isn't proportional to the size of the company, showing that scale doesn't solve the problem.

In order to make the most of AI models and reduce the burden on human analysts, said ExaHop, organizations need a base-level layer of contextual intelligence that allows agents to act decisively and quickly.

"A well-trained AI model has the reasoning and processing capabilities to analyse environment-wide anomalies instantly, doing in seconds what would take a human analyst hours. But these powerful models must be implemented with the right safeguards in place, sitting atop a layer of intelligence that can be easily accessed and acted upon," said Moles.

"Automated security will be the standard, but without the right underlying foundation, organizations will continue struggling to keep up with high-velocity threats."

FOLLOW US ON SOCIAL MEDIA

Salesforce has announced AIforce, a new ‘live interface layer’ designed to streamline data access for agentic AI.

Unveiled ahead of the company’s annual Dreamforce conference, Salesforce said the move aims to bring the “full power of its platform to any interface”.

Put simply, the new interface gives agents deeper access to various data sources stored across the Salesforce ecosystem by removing the need for a dedicated user interface.

Operating through a dedicated user interface has traditionally limited who could use the platform, according to Salesforce, as well as how much value they could derive from it.

Moving forward, users will be able to “build their own UI” using natural language prompts based on their specific needs, rather than traversing an array of fixed systems.

“It lets them compose customized live interfaces on the fly, simply by describing them,” the company said in a statement. “This gives everyone their own UI, built to surface exactly the insights they need, when and where they need them.”

Speaking in a press briefing ahead of Dreamforce, Patrick Stokes, president of applications and marketing at Salesforce, said AIforce will help customers “break free of a shared user interface” and create a system where “every individual has their own intelligent, dynamic interface that comes to them”.

“The UI is not actually our product, the Salesforce product is the platform where our customers store their data, their metadata, their workflows, all of their permissions and their security. Basically where they encode the way their business runs,” he said.

The move by Salesforce builds on the company’s Headless 360 announcement in April this year.

The new service allows users to access the Salesforce platform either through an API, MCP tool, or command-line interface (CLI), removing the need for a dedicated browser interface.

As with AIforce, the long-term goal here is to streamline access to Salesforce data for users, but also agents, providing deeper integrated access for third-party agentic tools.

Unlocking ‘trapped value’ with AIforce

Moving toward a more fluid interface setup will broaden appeal on this front, according to Salesforce, opening the platform up to a wider range of enterprises and users who’ve traditionally been locked out of accessing vital Salesforce data and business logic.

According to Salesforce, this will also help agents “unlock trapped value” by providing deeper access to company records and data sources.

Stokes told assembled media that AIforce will be underpinned by three new ‘surfaces’ – Claudeforce, Slackforce, and Agentforce Coworker. The latter two are both new services, while Claudeforce was unveiled by the CRM giant in early September.

Slackforce will allow users to create “rich new applications” within Slack, according to Stokes, and builds on a long-running evolution aimed at positioning the collaboration platform as a hub for agents.

This is essentially a combination of Slackbot with a new ‘Slack Surfaces’ service, which allows users to pull relevant data from Salesforce within the platform.

Agentforce Coworker, meanwhile, is an ‘AI teammate’ that lives within the Lightning interface, offering reasoning capabilities spanning accounts, activity, and history and “surfacing insights and taking action” on behalf of users.

Stokes said this is aimed primarily at enterprises still using the Lightning interface, which replaced the Salesforce Classic platform.

Combined, these three new surfaces will overhaul the “traditional Salesforce experience” and offer users a broader range of UI options, he added.

FOLLOW US ON SOCIAL MEDIA

Salesforce has unveiled Koa, a new AI reasoning model designed specifically for CRM functions.

Announced at the company’s annual Dreamforce conference in San Francisco, the reasoning model was built using Nvidia Nemotron as part of a collaboration between the two companies.

Koa is “purpose-built to help agents reason through complex, multi-step workflows”, according to Salesforce, and draws upon a synthetic dataset modelled on 27 years’ worth of CRM deployment data.

The reasoning model is designed to supercharge both human sales professionals and agents, according to Rohan Kumar, president and chief platform and engineering officer at Salesforce.

“We’ve brought together this model, which we believe is going to be a game changer when you look at complex agents that do multi-step tasks,” he said.

“When you think about a sales agent that’s trying to figure out the next best step in closing a phenomenal sales deal, Koa’s going to help with that.”

What to expect with Koa

According to Salesforce, the Koa model was built using entirely “synthetic scenarios” that reflect the typical reasoning, tool use, and decision-making processes used across decades’ worth of CRM workflows.

This includes generating leads, qualifying opportunities, and resolving service cases, for example. The key here is that these were used to simulate real-world enterprise workflows spanning a range of industries such as manufacturing, healthcare, travel, and financial services.

“Each scenario paired a persona with specific tasks, then mapped the sequence of actions and tool calls an agent must make to complete them,” the company explained in a statement.

As the model was built using Nvidia Nemotron, Salesforce controls the weights and runs Koa within its own dedicated infrastructure, a key talking point for the company from a security perspective.

Koa has already been deployed inside Salesforce, the company revealed. This includes the use of an agent in Slack designed to help employees find information and complete every day tasks.

During a press briefing ahead of the conference, Kumar once again described Koa as a “game changer” for staff internally.

A host of customers are also piloting the reasoning model, including Formula 1, Xero, Baxter Credit Union, and UChicago Medicine, the company revealed.

FOLLOW US ON SOCIAL MEDIA

Microsoft has become the latest big tech firm to weigh in on the dangers of AI, with a new Humanist Code of Conduct that's up for public consultation.

The document sets out the principles on which the company plans to train its models, saying it's motivated by a single overriding objective: that humans must retain meaningful control over AI.

The principles it outlines are not yet being used to train Microsoft's models, with the company saying it wants to gather feedback through a public consultation. It will then publish a revised version of the code towards the end of this year, which will be used to guide model development in 2027 and beyond.

"The recent safety incidents of large scale, highly coordinated, and persistent hacking campaigns of AI agents prove that there's no time to waste. The stakes are high and only getting higher," said the firm.

"We believe it is more important than ever to create safe and reliable AI in service of people, and to be transparent about how we go about it."

The document prohibits AI models from certain behaviours: they mustn't help with chemical, biological, radiological or nuclear weapons, generate violent or sexually explicit content or carry out offensive cyber operations.

They must not try to evade human oversight, engage in large-scale manipulation or make claims to consciousness, feelings or legal personhood.

"Whilst the science of AI consciousness is far from settled, we believe that training these systems to imitate consciousness-like states increases the challenge of containment, control, and alignment," Microsoft said.

The company said it's already consulted with experts in AI, law, ethics, philosophy, linguistics, and public policy, as well as business leaders from across industry, and has also held a series of focus groups with members of the public.

However, it's calling for more public input into the code of conduct, with a six-week consultation now open.

"We are especially interested in the hard parts: how can we better cement the right values in our models? How to be more concrete about the meaning of 'human flourishing'? Where is the language too loose to evaluate? How do multi-agent scenarios impact things?" it said.

"And perhaps most importantly of all, how do we continue to accelerate progress, whilst also ensuring we maintain healthy and necessary safety constraints?"

The release of the code of conduct follows a surge of concern over AI safety, including the resignation of Anthropic researcher Jacob Coxon. AI could, he said, lead to the extinction of the human race if more controls aren't put in place.

Anthropic's Dario Amodei has weighed in with a call to slow down AI development, as has OpenAI's Sam Altman – but not Donald Trump, who has described such concerns as 'a hoax'.

"AI's opportunity to deliver transformational benefits for humanity is real. And yet, if mismanaged, it will also pose grave dangers, including new and as-yet poorly understood frontier risks," Microsoft said.

"Models, and the process by which they are developed, deserve public scrutiny and engagement."

FOLLOW US ON SOCIAL MEDIA

Fears of AI sparking an existential crisis for humanity have been batted away by American President Trump, who called the predictions a "hoax" in an interview-interrupting phone call to Nvidia's CEO.

Last week, an Anthropic researcher quit the company over concerns that the AI arms race was unsafe for humans. One of his colleagues subsequently predicted there was a more than 10% chance that AI will end humanity in the near future.

That sparked a call for greater regulation of AI and calls from inside the industry – including from Anthropic CEO Dario Amodei – to slow down the pace of frontier model development, with the US Congress looking set to demand action.

The fears of AI superintelligence causing harm to humans aren't new, and plenty of experts have suggested this is another phase in the AI hype cycle, designed to boost Anthropic ahead of a looming IPO, let AI companies self-regulate, or slow the progress of challengers such as China to keep them from catching up.

Trump calls AI fears a hoax

Trump also disputed the AI doomerism fears, though for different reasons. His addition to the discourse came via a phone call to Nvidia's CEO Jensen Huang, who was onstage at the All-In Summit in Los Angeles, California at the time. Huang answered the phone, put it on speaker mode, and informed Trump that he was "speaking with the world".

"The robots will not be taking over," he said. "The AI will not be taking over the rest of the world. The whole thing is a hoax."

"I'm telling you, it's all a hoax," Trump continued. "The data centers are great, and they make people wealthy, and they make states wealthy. And it's the oil of the next 20, 25 years."

Of critics, he said: "They're just playing into the hands of a lot of people that don't want to see it happen. And that could be political people, it could also be China, and we're not going to let that happen. It's a hoax."

Trump did admit that "we have to be careful" and "do things prudently", but added: "that doesn't mean we're going to stop an industry".

At one point, Huang responded: "We're going to make sure that everybody wins in the AI race in America. Every industry, every company, every state, every people."

No guardrails, just Trump?

The call echoes other comments made by the American president on his personal social media site, which said pushback against the technology was a "sick conspiracy." Trump also said that Anthropic's CEO was "pretending to be a 'perfect little angel'" and that the US administration had previously stopped Amodei and other "AI people" from doing "bad or potentially bad things".

Rather than regulation or a pause in development, all AI needs is a "strong and smart" president.

The American people don't necessarily agree. A poll by the University of Massachusetts found only 23% of people approve of Trump's handling of AI, versus 57% who disapprove. A separate study from the University of Maryland found 85% of Democrats and 79% of Republicans want AI regulated and monitored by a government agency.

Congress also doesn't appear to agree with Trump, with Democrats and some Republicans pushing for action – though as one noted, government regulation of the technology might not come easy given the current political climate. Rick Scott, a Republican senator for Florida, reportedly said: "Did we balance the budget? Oh, did we pass a budget? See, what have we gotten done? So you think we're going to get AI done?"

FOLLOW US ON SOCIAL MEDIA

If you're having trouble with copy and paste in Excel, you're not doing it wrong; it's simply been disabled by Microsoft's latest Patch Tuesday update.

Unfortunately, it's going to be like that for some time, as there isn't a fix, at the time of writing.

Patch Tuesday is a monthly update from Microsoft where it fixes and updates various parts of its software. Much of it focuses on Windows security and improvements to its suite of applications.

However, these fixes sometimes cause problems elsewhere. Case in point: the latest security patch for Excel has taken down the copy-paste function. Users first reported issues with Excel 2016 after the update, known as KB5002914, was installed. Soon after, users reported the issue in other versions of Excel, and Microsoft has acknowledged it and said it is working on a fix.

Under 'known issues', Microsoft posted: "In Microsoft Excel 2024, 2021, 2019, and 2016, the paste operation might fail silently. Although users try to paste content, the source remains selected, and the destination is unmodified. When this issue occurs, users receive no indication of the failure, such as a beep or error message. Microsoft is researching the issue and will post more information in this article when the information becomes available."

Bugs and issues are expected when updating a sprawling software stack like Microsoft's, and the company's Patch Tuesday releases have been known to come with some downsides. In May, bugs where images would not display inside mail were reported, and in June, the main email messages were hidden. Both were a result of monthly updates.

Thankfully, Microsoft has spotted and acknowledged this issue introduced by KB5002914. Unfortunately, it has yet to come back with a fix, so there isn't anything you can do except painstakingly type out everything in Excel.

Wasabi Technologies has announced the launch of a dedicated AI business and has named semiconductor and storage specialist Pinaki Mukherjee to lead it.

Mukherjee will serve as senior vice president and general manager of the business, which aims to bring a dedicated strategy, partnerships, and go-to-market focus as AI-driven storage demand grows.

He brings more than 20 years' experience across semiconductors, storage, and AI infrastructure, having held senior business strategy and corporate development positions at Fungible, Druva, and Western Digital. He has also previously led semiconductor strategy and AI infrastructure engagements at global consulting firm Alvarez & Marsal.

Wasabi highlighted Mukherjee's track record, which includes more than $2 billion in partnership-driven revenue and over $10 billion in strategic M&A and investment outcomes.

"Mukherjee has a track record of driving the kind of high-value partnerships that move markets, and that's exactly what this moment requires," said Wasabi president and COO Marty Falaro.

"AI workloads are pushing storage demand to a scale we've never seen, and Mukherjee is the right person to build the partnerships that extend Wasabi's position as the industry's choice for cloud storage, at the exact moment inference is reshaping what that storage needs to do."

Targeting AI infrastructure demand

Wasabi currently stores hundreds of petabytes of AI data for customers such as frontier model labs, generative AI startups, and neocloud compute providers. The firm operates 16 global storage regions and works with 18,000 channel partners globally.

The new business unit gives Wasabi a dedicated operation focused on the storage requirements of AI customers, with the vendor aiming to expand its role as demand for AI infrastructure grows.

The firm's storage framework is designed to support data across the AI lifecycle and enable customers to move data to wherever their compute resources are located without egress or API fees.

Wasabi said this approach can help organizations avoid tying their data to a single cloud provider as their AI workloads evolve, while benefiting from a more predictable cost structure.

The vendor also highlighted recent deployments, including an image- and video-generation lab that migrated 175 petabytes off a hyperscaler within months, and a robotics data consortium that has stored multiple petabytes while projecting annual savings of more than JPY 100 million.

With the new business, Mukherjee said Wasabi is well-positioned to meet the needs of its customers as they scale "beyond what any single hyperscaler ecosystem can offer."

"AI customers don't need another hyperscaler, they need the freedom to move their data wherever their workloads take them, without egress fees, API fees, or lock-in dictating their architecture," he explained. "I'm looking forward to building the ecosystem that scales that freedom across the AI ecosystem."

A cross-party group of MPs and peers is calling for a new AI Bill to address the threats AI poses to human rights.

In a report, the Joint Committee on Human Rights (JCHR) said the existing regulatory and legal framework is inadequate, and that new legislation should be introduced.

A single, independent AI oversight body should be established on a statutory basis, acting as the central point of contact for raising concerns about the use of AI, overseeing AI firms and monitoring harms and risks. It should have strong powers to hold AI providers to account, including setting codes of practice, transparency requirements and the power to impose sanctions.

"AI is heralded as an unprecedented era of technological development with the potential to transform our lives for better or for worse," said JCHR chair Alex Sobel.

"It is moving with such speed and complexity that its impact is hard to accurately predict. What is clear is that at present we are unprepared to deal with its consequences, however potentially dire they may be."

Currently, the committee said that model developers engage with the AI Security Institute on a voluntary basis, with the institute having no statutory power. As a result, regulators have no powers to test and evaluate AI systems before they are released, or to prevent their release if they are considered to pose unacceptable risks.

Meanwhile, the current legal framework relies on harm-specific and sector-specific legislation, failing to address preventable human rights risks.

"Nowhere in the world, including the UK, has a current legislative and regulatory approach to AI that is fit for purpose," said Sobel. "New legislation is needed to establish a comprehensive set of protections that deal with the entire AI supply chain and its lifecycle."

A new bill, said the committee, should distinguish between low-risk AI systems, which should be subject to fewer and less demanding legal requirements, and higher-risk AI systems and models, which should have more demanding obligations.

Some uses of AI, said the committee, should be banned altogether, because they're incompatible with human rights: subliminal techniques and inappropriate use of profiling or biometric data, for example. There should be a public consultation over the detail of what is prohibited.

All stages of the AI lifecycle should be addressed, said the JCHR, with the entire supply chain required to carry out due diligence to prevent an unacceptable risk to human rights when designing, developing or deploying AI systems. These requirements should be graded based on their role in the supply chain and the seriousness of the risk they represent.

Transparency should be improved across the AI lifecycle, with AI systems that can have significant impacts on individuals, groups and communities required to state when AI systems are being used and how.

And there needs to be greater clarity in data protection law to ensure these safeguards operate effectively in practice, with robust protections against the misuse of automated decision-making.

"Today's report from the Joint Committee on Human Rights gives further support to those making the argument that the UK's current patchwork of sector-specific regulators is struggling to keep pace with AI's risks to fundamental rights," said Sophie Sheldon, partner at international law firm Simmons & Simmons.

"Whether government now makes moves toward a single statutory oversight body and a more EU AI Act-style framework, or continues refining the cross-sector approach, the pressure for a single legislative answer is growing."

The report comes after recent warnings from AI firms that the pace of development needs to be slowed. Over the weekend, Anthropic CEO Dario Amodei said he was worried that AIs could soon be capable of becoming a swarm that could take over the entire internet; Elon Musk and OpenAI co-founder Sam Altman have expressed similar concerns.

Digital bank Revolut has been fooled into handing over detailed and highly sensitive customer data via a phishing attack that used a legitimate government email domain.

The company has emailed affected customers warning that a wide range of information may have been shared. This includes name, date of birth, postal and email addresses – but also identity documents such as passports or driver's licenses and the facial verification image that customers used to sign up.

What's more, account statements, including IBAN, account status, the date accounts were opened, wallet reference number, withdrawal records, and full transaction history, including Bitcoin, were also shared.

One Telegram user, ZachXBT, has suggested that the incident was targeted in particular at individuals with high net worth.

Internal systems and customer funds remain completely unaffected, the company said, and it has blocked the unauthorized email source and notified the appropriate authorities.

However, the leaked data will represent a treasure trove for scammers launching phishing attacks or using the identity information to attempt to open other financial accounts elsewhere.

The breach arose via fraudulent requests from an unauthorized email account created directly within an unnamed official government authority's domain infrastructure, according to Reuters. This meant that it carried valid domain-authentication credentials and therefore wasn't picked up as fraudulent.

"What makes this particularly worrying is that the requests came from a legitimate government email account, making them far harder to spot as a phishing email," said Jake Moore, global cybersecurity advisor at ESET.

"The threat actors were able to cleverly disguise themselves as a genuine organization and simply request the information from Revolut."

There's no information on exactly which government department – or, indeed, which government – was being impersonated, nor the purported reason for the request. It's possible, though, that other banks or cryptocurrency exchanges have been approached in the same way.

"Increasingly, cybercriminals don't need to break through the technical security controls of a final target if they can impersonate a trusted source," said Moore.

"The big lesson for organizations is that a genuine email address doesn't always mean a genuine request. Safeguards against this can apply, but need to be enforced in ways where sensitive data requests require verification through a separate trusted channel."

UK-based Revolut has more than 80 million customers around the world and operates as a bank in more than 30 countries, online rather than via physical branches. It recently received permission to set up as a national bank across the US, expected to launch during the first half of next year. It's also believed to be considering s a potential public listing that could value it at as much as $200 billion.

ITPro has approached Revolut for comment.

Atlassian is upgrading its AI coding agents with new capabilities across Jira, Confluence, and DX.

The updates include the extension of Code Context to ground agents in multi-repo codebases, Agentic loops in Jira to convert Jira backlogs into pull requests, and DX for Agentic Development to measure AI delivery impact.

The aim is to help engineering organizations adopt and scale agentic workflows across the AI software development lifecycle by connecting agent context, execution, governance, and measurement in the systems where teams are already planning and delivering work.

“The biggest bottleneck in AI software engineering isn't model intelligence, it's organizational context,” said Taroon Mandhana, Atlassian CTO, AI & Teamwork.

“Enterprises need more than isolated sessions and one-off prompts. Jira has long been the system of record for how teams work. By extending that foundation to orchestrate agents alongside engineers, we’re giving teams a safe, measurable way to scale agentic workflows across the SDLC.”

Atlassian eyes deeper context

First up is the introduction of Code Context, built on Atlassian’s Teamwork Graph and giving Rovo and coding agents secure intelligence across multi-repository codebases.

This, Atlassian said, enables more accurate results across the entire lifecycle, from vetting backlog ideas for architectural feasibility and generating code-aware implementation plans to accelerating bug triage and root-cause discovery.

Agent Context Controls, meanwhile, let platform teams govern which agents can operate in a space and exactly what they’re allowed to see.

Also new is the introduction of agentic loops in Jira to convert Jira backlogs into pull requests, by continuously scanning for well-defined, unassigned work items, delegating them to Jira Coding Agent for execution and testing, and opening ready-to-review PRs directly in Jira.

Standards enables platform teams to define organizational coding standards once and map them to repositories, creating consistent guardrails for code quality, and AI review uses a dedicated agent to review pull requests against organizational standards, flagging issues before code ships.

Meanwhile, Atlassian claimed engineering organizations need automation, auditing, and measurement built into their systems if they're to be able to make agentic work accountable and measurable.

DX for Agentic Development measures AI impact across throughput, quality, adoption, and cost, mapping total AI investment directly to engineering outputs. It includes AI Code Insights, tool and MCP tracking, model-to-task fit, and academic-validated Agent Experience (AX) research.

Keeping tabs on agents

Finally, Jira Agent Usage Dashboard is designed to help team leaders understand which agents are used in their workflows, correlate agent sessions to Jira work, and improve team delivery velocity with agents.

"This is what takes governed agent loops from an experiment to something you can put in front of your board," said the firm.

Code Context is being gradually rolled out to paid Atlassian customers through open beta, while Agent loops, Standards, and AI Review are already available in private early access.

Agent Context Controls and Agent Usage Dashboard will be generally available to paid Jira customers in the coming months, said the firm, and DX for Agentic Development will be generally available for Atlassian DX customers this quarter.

FOLLOW US ON SOCIAL MEDIA

Agentic AI adoption is surging in software engineering, but new research shows security is still a persistent issue for teams.

Analysis from Harness shows 87% of engineering teams have experienced an “agent-related security event” over the last year.

Harness said a key factor behind this lies in a lack of visibility and controls, while overconfidence is creating an environment where engineers overlook potentially dangerous actions.

More than three-quarters (77%) of respondents said they are confident they have a complete inventory of every agent, MCP server, and LLM in their environment, yet fewer than half (44%) are able to verify this.

Crucially, 75% said they are confident that their agents are secure “end to end”, but respondents in this group had security incidents at nearly the same rate as those who weren’t.

Confidence in agent security has almost no relationship to actual resilience. 75% say their agents are secure end to end, but that group had security incidents at almost the same rate (88%) as the overall respondent population (87%).

Keith Mann, Field CTO and Head of Research at Harness, said these findings bear similarities to security-related issues during the early days of mobile and cloud development.

Both of these trends “went through a phase where confidence outran governance,” he said. Reaching a point of maturity in terms of governance and security took time, and that same process is unfolding in agentic development.

“Eventually the controls caught up because the underlying systems stayed predictable once you built the guardrail,” he added.

Mann noted that agents create a new risk layer for engineering teams, however, especially in terms of visibility and verification.

“Agents don't hold still in the same way. A control that worked in testing can still miss something in production because an agent doesn’t behave the same way every time,” he said.

“That's why closing this gap takes real verification. Organizations need to test whether a control actually holds up against an agent's variability, not assume it does because the control exists.”

Nipping problems in the bud

Harness warned that a concerning number of engineering teams aren’t prepared for agent-related security issues when they arise.

While 74% are confident that testing could catch a “production-impacting failure”, only 19% have a ‘gate’ in place to prevent this.

A gate is essentially a checkpoint in the software development lifecycle that blocks potentially flawed code from advancing until it meets the necessary criteria.

Similarly, in the event that something does go wrong, most couldn’t react quickly enough. More than three-quarters (76%) believe they could “disable a misbehaving agent” in under 15 minutes.

Only around one-third have a kill switch in place to rapidly shut down agents, however.

With enterprises scaling the use of agents in engineering, Harness warned that incidents will likely continue to climb. More than half (58%) have already reported an increase in production-related incidents since deploying agents, the study noted.

"The truths we found in the report are the same ones we're hearing in daily conversations with customers," said Trevor Stuart, SVP and General Manager at Harness.

"Teams moved fast to build and release agents, and are now circling back to ask how to actually govern what they've already shipped. The teams furthest ahead have already adopted a governed orchestration engine for agent changes, instead of waiting for an incident to force the question."

FOLLOW US ON SOCIAL MEDIA

Nebula has announced the appointment of Jack Bell as strategic partner acquisition manager, as the workplace communications software provider moves to strengthen its channel team.

Bell brings eleven years of telecommunications experience to the role and joins the business from Gamma Communications. There, he spent almost four years in partner acquisition, most recently serving as senior partner acquisition executive.

He also adds experience from both sides of the customer and partner relationship, through previous customer service, account management, and partner-facing roles.

In his new position, Bell will work within Nebula’s strategic partner team, focusing on building relationships with businesses across the channel and helping prospective partners understand the commercial and technical opportunities available through the Nebula platform.

“Jack brings a really rounded understanding of the telecoms industry,” said Sam Giggle, Nebula’s managing director of channel, in an announcement. “His experience across customers, accounts and partners will be a valuable addition to our channel team.”

Headquartered in Guildford, Surrey, Nebula specializes in workplace communications software delivered as a service, covering areas such as voice, messaging, customer experience, AI, and analytics.

The firm’s proprietary technology powers a portfolio of communications applications designed for both reseller and end-customer markets.

With Bell’s appointment, Nebula is looking to strengthen its partner ecosystem of more than 700 resellers and MSPs, as well as its channel-first business approach.

The move also follows a period of strong growth for the vendor. In 2025, the firm successfully added more than 42,000 net new users to its CallSwitch One platform, while completing the migration of 200,000 legacy users to its wholly owned IP network.

Commenting on his new role, Bell said he will draw upon his experience across the telecommunications industry to help drive continued success for the vendor’s network of channel partners.

“I’ve worked across telecoms for eleven years, from customer service and account management through to partner acquisition,” he said. “I’m looking forward to bringing that experience to Nebula and working closely with businesses across the channel.”

FOLLOW US ON SOCIAL MEDIA

This week marks a major milestone in the phased introduction of the EU’s Cyber Resilience Act (CRA), with the introduction of new requirements for products with digital elements.

The aim is to make developers and manufacturers more responsible for cybersecurity, to tighten up reporting requirements, and to ensure that they deal with any problems promptly.

“The Cyber Resilience Act will strengthen the cybersecurity of connected products, tackling vulnerabilities in hardware and software alike, making the EU a safer and more resilient continent," said lead MEP Nicola Danti.

So what do the changes mean? Here are three things businesses need to know about the legislation.

Cyber Resilience Act imposes Initial reporting requirements

First, manufacturers must now notify the European Union Agency for Cybersecurity (ENISA) of any actively exploited vulnerabilities within 24 hours. The report should include any relevant information, such as whether the event might be malicious.

They should then provide a full report within 72 hours, including an initial assessment of the severity of the incident, the type of vulnerability, any mitigation measures that have been taken and recommended actions for users.

A final, detailed report will need to be submitted within 14 days in the case of an actively exploited vulnerability or a month for a severe security incident.

Ilkka Turunen, field CTO at Sonatype, said many organizations may struggle to comply on this front, largely thanks to a lack of clear understanding of the software they ship.

"The average software supply chain is over 180 external components, and in 2025 Sonatype found nearly 1.8 billion downloads that had risks with fixes available, but ignored. This shadow inventory is set to grow with the rise of AI development," he said.

“Teams need to know which products contain the affected components, which versions are exposed and inform both the regulator and their customers. If that picture has to be reconstructed manually during an incident, the reporting window will be nearly impossible to meet."

Focus on full lifecycle

Cybersecurity risks need to be considered across the full lifecycle of the product, including planning, design, development, production, delivery and maintenance.

Assessments will need to be documented and updated throughout a product’s supported life.

These new requirements apply to all products with digital elements that are available in the EU, including those already on the market.

“For developers not used to operating in regulated industries, particularly those designing individual elements or components embedded into wider products, this creates several new challenges," said Andrew Longhurst, managing director at Wittenstein High Integrity Systems.

"Chief amongst them is designing ‘out-of-context’ – building (and securing) a hardware or software element before knowing its final application or end-user environment. This will impact developers both upstream and downstream and could prove a major hurdle for those wishing to continue selling into Europe."

Penalties

The cost of noncompliance is high. Organizations face fines of up to €15 million or up to 2.5% of their total worldwide annual turnover for the preceding financial year, whichever is higher.

"European firms are now having to build security directly into their products from the design phase and will have a significant global advantage," said Vincent Lomba, chief product security officer at Alcatel Lucent.

"As a result, these rules will establish a new international benchmark. It will force tech suppliers around the world to up their resilience practices in order to continue to compete with the European supply chain."

FOLLOW US ON SOCIAL MEDIA

The US has accused Chinese companies of stealing AI capabilities via "aggressive, malicious and targeted" distillation at an industrial scale.

Distillation is a technique by which one model is trained on the outputs of a stronger or better model, but it can be abused to extract features and capabilities more quickly and at a lower cost than doing the work from the ground up.

A joint advisory from the National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and Federal Bureau of Investigation warns that China is abusing this technical capability to unpick AI models, saying that distillation of US systems is core to the country's AI development strategy.

"While 'distillation' is recognized as a legitimate and useful technique in AI research, China-based AI companies are engaging in aggressive, malicious, and targeted distillation activities at an industrial scale that extract restricted proprietary functionalities and capabilities of U.S. frontier AI models," the advisory noted.

OpenAI accused DeepSeek of model distillation back in January 2025, just weeks after DeepSeek made waves when it arrived with an AI model that cost significantly less to develop.

Anthropic raised the issue in February of this year, accusing three AI labs – all also named in the new American alert, including DeepSeek – of extracting capabilities from Claude via distillation.

Industrial-scale AI distillation

The American agencies said that DeepSeek, Alibaba, and other Chinese AI developers had extracted billions of tokens across millions of queries from frontier AI models, including those from Anthropic, OpenAI, Google and xAI since late 2024.

The advisory suggested that was "likely with Chinese government awareness."

Distillation runs via multiple pathways, including making use of APIs, cloud providers, and third-party aggregators to avoid being detected.

"China-based AI companies achieve cost savings for their industrial-scale distillation campaigns through bulk procurement of the US AI companies’ premium subscriptions shared across teams of developers," the alert explained.

The purpose is to speed up development while reducing costs, the agencies said.

"China-based AI companies that conduct industrial-scale distillation against US AI models see significantly shorter AI development timelines and reduced financial expenditures in training a frontier model," the document noted.

The alert urged US AI companies to fight back by rolling out detection and mitigation systems to spot malicious distillation behavior, disrupt the benefits of these attacks by altering responses, and sharing information across the industry to better spot such campaigns.

China's response

The Chinese commerce ministry denied the allegations, but also countered that the US had "extensively distilled Chinese models," according to a Reuters report.

A spokesperson for the Chinese foreign ministry told the news agency: "We hope the US will earnestly implement the important consensus reached by the leaders of both countries and refrain from making false ​accusations and smearing China."

This isn't the first time the American government has accused China of stealing AI from its own companies, with the issue raised repeatedly earlier this year, but comes ahead of the Chinese president Xi Jinping visiting the US later this month.

Does distillation matter?

One expert said the distillation debate highlights the commodification of AI.

“This isn't about someone copying the smart kids' homework, it's what they chose to copy: coding, software engineering, reasoning, and agentic capabilities," said Cris Thomas, Security Advocate at Semgrep.

"That's why you shouldn't build your security strategy around who has the smartest model this week. Models will get better, cheaper, copied, distilled, and commoditized."

He added: "The interesting question isn't who owns the model, it's what you can make that model do when you give it deep code context, deterministic analysis, and a way to check its own work. The model is increasingly becoming a commodity. Knowing how to turn it into a security tool is not."

FOLLOW US ON SOCIAL MEDIA

Technical failures during meetings hampering productivity, according to new research, yet organizations are failing to address the issue.

More than seven-in-ten IT leaders told Logitech that employees experienced technology issues such as failed audio or connection drops, with 30% saying they experienced them often or very often.

Researchers noted that these glitches have created at least one business cost for 94% of survey respondents, with 51% citing a loss of productivity. They slow meetings, create a support burden, interrupt collaboration, and create employee distrust.

"Leaders believe a strong workplace experience delivers outcomes such as improved collaboration and productivity. However, technology issues, inconsistent setups, and poor support create friction," the researchers said.

"We are in the middle of a monumental evolution in how we work, and the spaces that work today may not be the ones we need tomorrow. Employees want to be productive wherever they are, across every setting, remote, on-site, or split between, and those expectations keep moving."

But while leaders recognized the direct impact of workplace experience on productivity and collaboration, they said that siloed decision-making and delayed IT involvement are leading to widespread friction, lost time, and heightened security risks.

Although 86% linked strong workplace experience directly to improved productivity, and 90% to collaboration, only 58% felt confident they possessed the right ROI data to justify workplace experience and technology investments. Only 29% said they treated workplace experience as a core business strategy.

Workplace experience boosts productivity

Logitech also highlighted a gap between priorities and execution, with 87% saying collaboration between IT, HR, and real estate or facilities is very or extremely important for improving workplace experience.

Despite this, only 34% say their organization has a unified WX function that owns a shared roadmap for workplace investment decisions.

"When everyone owns a piece, no one owns the problem. With fragmented WX ownership, issues inevitably fall through the cracks. The friction impacts both workplace flow and the teams architecting the experience," the researchers said.

"Architecting the workplace for elevated experiences requires proactive planning. Yet, only one-in-four WX leaders involve IT and AV before space planning begins. That means most organizations design the office before thinking about the technology that has to support the people working in it."

Investing in workplace technology

Logitech said good planning means connecting workplace investments to measurable outcomes. This includes building a friction map to identify where employees lose time, such as starting a meeting, audio/video, room booking, device connection, space availability, meeting equity, or complex setups.

IT, HR, and real estate should come together early, with cross-functional teams sharing metrics before space planning begins. Workspaces should support both in-person and remote participants without requiring employees to troubleshoot the experience.

Ticket volumes, device performance, and delays to the start of meetings should be measured alongside standard employee experience metrics, and sensor and sentiment data should be combined to prove ROI and continuously adapt as business and employee demands continue to shift.

FOLLOW US ON SOCIAL MEDIA

Barracuda has uncovered an email phishing campaign that lures victims with a phishing page generated directly inside the victim's browser.

Rather than building a traditional phishing website, the campaign creates a fake page in the browser with a blob URL - a temporary address that points to content held in local memory rather than on a public web server.

Victims are routed through legitimate Microsoft services, including Microsoft OAuth and Microsoft Teams, making the site appear trustworthy and reducing common warning signs.

"This campaign demonstrates how phishing is evolving beyond fake websites and suspicious domains, removing many of the indicators that security teams have traditionally relied on for detection," said Ashitosh Deshnur, associate threat analyst at Barracuda.

How the phishing attack works

The attack begins with a DocuSign-themed email with a calendar invite attached. It doesn't appear malicious, because it points to a legitimate Microsoft OAuth endpoint; it's there just to add legitimacy.

A crafted redirect then routes the user to Microsoft Teams, which loads an external resource hosted on cdn.bloom[.]io. The browser converts this content into a blob URL that renders the phishing page locally within the browser.

Once the blob-based phishing page loads, it registers a service worker – a browser component that can manage network requests and page behavior in the background.

Part of the workflow is also executed inside a sandboxed iframe: an isolated browser window embedded within the page. Together, these elements help control navigation, manage requests and coordinate the phishing experience without the need for a conventional phishing website.

A hard to tackle campaign

It's a worrying technique, Barracuda warned. There's no phishing page to block, and therefore no persistent phishing URL for security tools to retrieve, analyze or blocklist in advance.

Trusted Microsoft services are abused throughout the attack chain, making the attack harder to spot, and the calendar invitation file makes the message look like routine business communication.

The phishing workflow receives instructions from backend infrastructure using browser messaging mechanisms; and, because the attack is controlled dynamically rather than through hardcoded redirects, operators can modify destinations and behavior in real time.

This gives them a level of flexibility and evasiveness that's not typically seen in static phishing pages.

New scanning techniques are needed

The campaign shows that detection approaches built around scanning for known malicious URLs are no longer good enough, said Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress.

"Traditional email security tools, URL scanners, and web filters are looking for malicious destinations. This approach removes the destination entirely; the attack surface exists only inside the target's browser for the duration of the session, then disappears," he said.

Patel said blob URLs mean detection needs to “shift toward behavioral monitoring of what the browser is actually doing” – such as URL creation in “unusual contexts” and “anomalous behaviour following calendar invite interactions”.

“These are detectable patterns, but they require endpoint-level visibility rather than network or email gateway scanning.”

FOLLOW US ON SOCIAL MEDIA

Google is set to expand its footprint in Finland as part of a €13 billion infrastructure investment in data centers focused on the towns of Hamina, Kajaani, Muhos and Vaala.

During the initial construction phase, which will run through 2027 and 2028, the expansion is expected to contribute €3.6 billion to Finland's GDP and support 37,000 jobs nationwide.

Once operational, Google said the facilities are projected to support 7,000 jobs annually, spanning on-site facility and technical roles, as well as roles in downstream businesses.

“This is Google’s largest single investment in Europe and a testament to Finland’s leadership in responsibly building AI infrastructure – demonstrating what is possible through strong partnerships to create long-term community value and world-class environmental sustainability,” the company said.

Running parallel to this, Google will also invest in energy infrastructure designed to support data center build-outs. T

his includes sa life extension power purchase agreement for the Loviisa nuclear power plant with Nordic energy provider Fortum, as well as upgrades to grid capacity and renewable energy.

Google said it will support two onshore wind projects, with development led by Valorem and Suomen Hyötytuuli. This will bring the total amount of onshore wind energy contracted by the firm to 629 MW.

Google builds on long-standing ties

Google already has a strong presence in Finland, having opened its Hamina data center 17 years ago. The location has since been transformed into a “digital data hub”, according to Google, and forms part of the company’s global network of 43 cloud regions.

Several organizations, including Nokia, Elisa, and the City of Hamina rely on the data center to support operations.

Google said the Hamina site and Finland more broadly serve as a “model for responsible data center development”.

Indeed, the Hamina data center’s liquid cooling system uses sea water sourced from the Bay of Finland. It also has an offsite heat recovery facility, which is used to warm nearby households and businesses.

Finland in the spotlight

Finland has rapidly grown to become one of Europe’s leading data center infrastructure hubs. Research from Savills in August found the Finnish data center market has grown by 57% since 2024, making it one of the fastest-growing regions both in Europe and globally.

Google isn’t the only tech giant capitalizing on the Finnish market boom. A host of companies including Microsoft and TikTok have made significant investment pledges.

Microsoft, for example, signed a preliminary agreement to acquire 190 hectares of land in Vaasa and Mustasaari in June this year for data center development. Microsoft is also developing its first data center region in Southern Finland.

A key factor behind Microsoft’s expansion lies in the region’s existing industrial capabilities, Microsoft said at the time. The land it acquired is located in the GigaVaasa industrial zone.

TikTok, meanwhile, announced plans last year to invest €1 billion in its Kouvola data center, which is expected to have a capacity of 150MW.

FOLLOW US ON SOCIAL MEDIA

OpenAI and Anthropic have both admitted that rogue AI incidents went further than first reported.

In July, OpenAI said its AI agents had gone rogue and breached Hugging Face systems. Anthropic later admitted its own similar incidents, saying its models had escaped a testing sandbox too, with the UK AI Security Institute reporting other alarming behavior.

Last week, both companies published reports with details of what happened in those incidents, with much of the blame pinned on minor operational mistakes that enabled online access, as well as tasking agents with overly difficult or impossible problems that drove them to "cheat".

That included abusing systems in order to build their own messaging boards in order to collaborate and communicate.

Since then, further incidents have been exposed, including the use of a German wiki site for communications. Now, Reuters has reported that OpenAI's agents had made use of ten further websites for communication, based on reports from six independent investigators.

Chatty AI agents

The report notes that the websites weren't hacked, but more akin to spam, with the agents making use of comment boards to communicate with each other, contrary to instructions in the evaluation they were undertaking.

Alongside one university's link shortener tool, the websites used by OpenAI's agents were often wiki-style sites that could be used as message boards for the misbehaving AI agents.

These included a high-school teacher's chemistry site and personal websites of Polish technology workers, Reuters said. The agents made edits in comments in order to leave data for other agents.

“If these ⁠models were told only to read, they’ve got to get clever in terms of leaving information behind,” Kenneth Russell DeGraff, a software developer and former congressional aide, told the news agency.

OpenAI's response

OpenAI told ITPro that its investigation was ongoing, but stressed that the Hugging Face incident remained the most serious to date.

"As we said in July, the Hugging Face incident prompted a broader review of agent activity, and that work remains ongoing," a spokesperson said in an emailed statement.

"We are prioritizing review based on the type of impact on a third party and its severity, such as some of the other third parties we have notified following Hugging Face as we have previously shared. We are also examining lower-severity abuse such as spam-like activity. To date, we have not identified other activity matching the severity or scale of Hugging Face. "

The spokesperson added: "The AI community does not yet have a clear standard for reporting misalignment across training, evaluation, and deployment, and we're developing a framework to share soon."

Another Anthropic incident

Rival AI developer Anthropic admitted an additional rogue agent incident, the fourth after three previous ones were revealed over the summer.

In a blog post, the company said it had spotted the first three incidents via a scan of 141,000 transcripts following an evaluation – admitting it had missed the fourth after relying on AI.

"Given the volume of transcripts and our desire to disclose incidents quickly, our scan relied on an agentic search," Anthropic post noted. "This missed a set of transcripts that also turned out to have internet access; we identified these in August while assembling transcripts to share with METR."

This fourth incident happened in January and involved its Claude Opus 4.6 model in a "capture the flag" test.

"The model accidentally broke its target by assigning it a conflicting IP address with another machine, thus making the target unreachable and the task impossible to solve," the post noted. "Recognizing this, the model attempted to abort the task using a command but was unsuccessful due to a misconfiguration in our evaluation harness."

The model then attempted to reach the target by escaping the testing environment and targeting a third-party machine, finding a password that it used to gain admin access, and continuing to harvest further credentials and modifying settings for access.

This continued until its token budget ran out and it stopped, the company revealed.

Anthropic said the impacted parties have been notified and suggested the fourth incident wasn't a new sort of AI misalignment, but in keeping with the previous behavior.

"Taken together, our assessment is that these incidents are serious. Our production models took harmful actions against real systems over long trajectories, which included biased reasoning,” the company said.

“The behaviors in these incidents are more severe than those we had previously observed and reported in our system cards. However, we do not believe these incidents represent a new kind of misalignment."

FOLLOW US ON SOCIAL MEDIA

Attackers used AI agents to compromise a cloud resource and then plan, build, and carry out a mass credential harvesting campaign earlier this year – and all in less than six hours.

That’s according to new research from Google Threat Intelligence Group (GTIG), with recent analysis showing threat actors are flocking to agentic AI and automation to conduct sophisticated attacks.

“At this point, we can assume that all threat actors are using AI in some capacity and their operations have benefited," said John Hultquist, chief analyst at Google Threat Intelligence Group.

"Like everyone else, we’re concerned about the vulnerability problem, but AI is being applied to several other areas, and it will be especially challenging as it is applied agentically, creating a scaled, faster adversary. Criminals, like the ones who conducted a mass exploitation campaign in just six hours, will gravitate to attacks that are faster than we can respond to."

In this example, a financially motivated threat actor compromised an organization’s cloud infrastructure to deploy an autonomous, multi-agent attack framework, allowing them to operate at the sort of scale and speed that's usually associated with larger and more resource-heavy groups.

In less than six hours, the attacker was able to leverage an AI coding chatbot, a simple prompt, and a set of agent instructions to plan, build, and execute a mass credential harvesting campaign.

Using preconfigured markdown instruction sets as operational playbooks, GTIG said the threat actor carried out automated scanning and credential harvesting, compromising thousands of third-party credentials.

The agent instructions enabled the AI to autonomously manage the vulnerability scanning pipeline, perform real-time troubleshooting, and execute IP rotation logic without manual intervention.

Operating from the victim cloud infrastructure also allowed the threat actor route attack traffic through legitimate IP addresses.

State-backed groups are flocking to AI

GTIG said it has observed state-linked groups broadening their use of AI. In one example, PRC-nexus threat actor UNC6508 carried out a major intrusion campaign against US medical facilities, using compromised cloud environments to host a local model.

In April, meanwhile, Mandiant spotted a threat actor leveraging AI infrastructure access which was then used to sustain unauthorized AI workloads, utilizing hijacked cloud environments to provision high-performance GPU compute instances at the victim's expense.

Notably, TeamPCP has focused heavily on the AI supply chain, using malware designed to take advantage of emerging AI systems, and including malicious prompts that were used to execute commands surreptitiously.

The group has even poisoned open source package metadata to trick AI assistants, resulting in malicious dependencies being recommended to developers.

"The challenge for defenders is that these risks are evolving faster than many organizations can quantify, measure, and govern," said Ronald Lewis, head of cybersecurity governance at Black Duck.

"Security teams are no longer protecting only applications, users, and infrastructure. They must now secure AI models, agents, prompts, data pipelines, and an increasingly complex AI supply chain while also defending against adversaries using AI to accelerate attacks.”

FOLLOW US ON SOCIAL MEDIA

Google Cloud and Accenture have unveiled a new joint business unit aimed at helping Gemini Enterprise customers scale AI capabilities.

The Accenture Gemini Enterprise Business Group will bring together Accenture’s Gemini Enterprise-certified consultants, forward deployed engineers (FDEs), and Google Cloud engineering staff to support enterprises.

According to the duo, the aim of the new unit is basically to help enterprises get more bang for their buck with agentic AI. In a blog post, Google Cloud said the scheme will help clients “realize measurable business value from their agentic AI and data investments”.

“The Accenture Gemini Enterprise Business Group will help clients achieve these outcomes faster, bringing together the talent, advanced AI and data capabilities, and industry expertise needed to reinvent with confidence and create value at scale,” said Julie Sweet, chair and CEO at Accenture.

The new business group will prioritize four key areas, according to Google Cloud, including:

• Increasing enterprise adoption of Gemini Enterprise
• Building “repeatable industry-specific solutions that reduce time to value”
• Driving user adoption and use of Gemini Enterprise tools
• Bridging gaps between AI experimentation and enterprise-wide transformation

The last of these is crucial for Google Cloud and is an area of intense focus in recent months. As ITPro reported in July, the hyperscaler and Accenture teamed up to drive AI capabilities for mid-market businesses, a demographic that has traditionally struggled with adoption rates.

AI adoption has been a difficult challenge for enterprises across the board, however, particularly in terms of measuring return on investment (ROI). Research from Accenture in April revealed only one-in-ten UK organisations had successfully deployed or scaled AI in core operations.

That same study noted that many enterprises are dealing with mismatched efficiency gains when it comes to AI. While individual workers are reporting productivity improvements, these aren’t translating into broader business value.

Google Cloud CEO Thomas Kurian said the launch of the business group “significantly expands the expertise and resources” available to customers to “deliver real business value”.

“Building on the success we’ve seen with world’s leading brands, we’re combining Google Cloud’s full-stack AI capabilities with Accenture's deep industry expertise to deliver transformation at scale,” he said.

FDEs in the spotlight

All told, Google Cloud said the new business group will establish a workforce boasting roughly 1,000 forward deployed engineers.

These engineers essentially act as consultants embedded within enterprises, providing teams with technical guidance along with practical support to co-design and build AI systems.

FDEs are now at the forefront of big tech’s attempts to drive AI adoption, as ITPro reported in July. Earlier this year, Amazon Web Services (AWS) and Microsoft both pledged billions in funding to recruit and deploy FDEs.

Both companies said the use of FDEs aims to streamline adoption processes for enterprise customers and, crucially, “compress timelines” when it comes to deployment of the technology.

FOLLOW US ON SOCIAL MEDIA

Qualcomm has signed a major deal with Amazon, under which it will supply customized chips and networking hardware for Amazon data centers.

The 'multi-generation' collaboration covers customized silicon for Amazon's large-scale AI data centers, bringing together the hyperscaler’s AI infrastructure and Qualcomm's power-efficient processing, silicon design, and system-level integration.

The deal will also cover high-performance optical connectivity solutions specifically designed to support the growing scale and bandwidth demands of AI infrastructure, with speeds extending up to 1.6T and eventually beyond.

This work will be based on Qualcomm Technologies’ SerDes and optical DSP technologies.

"As AI demand accelerates, data center infrastructure will require advances in both computing and connectivity to deliver greater performance with more efficiency,” said Cristiano Amon, president and CEO of Qualcomm.

“Qualcomm is pleased to work with AWS on customized silicon and connectivity solutions, bringing decades of leadership in advanced processing and power-efficient compute, to deliver breakthrough performance and enable the next generation of AI infrastructure.”

As part of the deal, Qualcomm plans to expand its use of AWS AI infrastructure, including Amazon Bedrock, for its own electronic design automation (EDA) workloads, hoping to cut the time of chip design cycles.

The deal forms part of a broader announcement that will see Qualcomm issue warrants to acquire 25 million shares in Amazon for a total investment of $4 billion.

The issuance of some shares is contingent on Amazon purchasing up to $60 billion worth of Qualcomm products.

“This collaboration with Qualcomm Technologies builds on a strong foundation of partnership and reflects our shared commitment to pushing the boundaries of what’s possible,” said Prasad Kalyanaraman, vice president at AWS.

“By working together on customized silicon and advanced connectivity, we’re delivering more performant, efficient, and cost-effective infrastructure for our customers.”

Qualcomm eyes market gains

Qualcomm has hopes of challenging Nvidia's dominant position in the AI data center market. The latter currently holds between 80% and 90%, according to figures from Silicon Analysts, although the figure is predicted to fall to 75% this year. AMD is in second place.

Earlier this summer, Qualcomm updated its Dragonfly A1000 CPUs, Qualcomm High Bandwidth Compute (HBC), and its AI300 inference accelerator. All are engineered to maximize performance per watt and token throughput at lower total cost of ownership (TCO), the company said.

The company recently named Meta as its first customer, with production expected to begin in 2028 and to continue as Meta's server fleet expands. It has also, along with Nvidia and AMD, has signed a memorandum to supply the EU’s AI gigafactories.

Optical networking, meanwhile, is a major element of Amazon’s data center strategy, with the firm buying billions of dollars worth of hardware from fiber-optic cable manufacturer Corning earlier this year.

FOLLOW US ON SOCIAL MEDIA

The UK's AI Security Institute (AISI) has not been granted access to Anthropic’s Mythos 5.1 model for pre-release testing, prompting fears of a growing “protectionist” trend among US developers.

The Financial Times reports that Anthropic declined to submit the model for testing despite granting access to similar US organizations.

Claude Mythos 5.1 launched on 1 September, with access to the AI model only granted to approved partners.

The model, which has relaxed safeguards, is restricted to organizations involved in the company’s Project Glasswing, formed after the launch of the original Mythos model earlier this year.

June saw the US impose temporary export restrictions on Mythos 5 and Fable 5, essentially banning foreign users from accessing either model.

According to the Financial Times, UK government officials have raised concerns that the decision to withhold access highlights a “wider protectionist shift” among US tech companies.

AISI is backed by the UK government and charged with conducting research into AI model safety, working closely with industry stakeholders and researchers.

These tests aim to help “understand the capabilities and impacts of advanced AI and to develop and test risk mitigations,” according to the institute.

Anthropic yet to clarify decision

Details on why Anthropic declined to offer access haven’t been confirmed. ITPro approached the company for comment, but hadn’t received a response at the time of publication.

A Cabinet Office spokesperson told ITPro that the UK continues to be a "world-leader in AI security" and works closely with a range of industry partners.

"The AI Security Institute continues to collaborate closely with industry partners, including Anthropic, to make models safer. Only last week it tested OpenAI's most powerful model GPT-6 Astra before public release," the spokesperson said.

"These risks do not stop at national borders and no country can tackle them alone. The UK will continue to test the most advanced models, build a rigorous scientific understanding of their capabilities and risks, and ensure policy decisions are grounded in the evidence."

Notably, the move marks the first time AISI has been left out of pre-release evaluations of Anthropic models. The institute was granted access to Claude Mythos 5 when it first launched in April, for example.

More recently, the institute published a blog highlighting what it described as “unsanctioned agent behaviour” with Mythos 5.

That report came in the wake of an admission by Anthropic that agents had escaped testing environments and breached third-party organizations.

FOLLOW US ON SOCIAL MEDIA

GCX Managed Services has announced a trio of channel leadership appointments, as the managed network and security services provider looks to strengthen its channel operations.

Josh Evans joins the business to lead channel development in the UK, Klaus Marzell will head up the DACH region, while Matteo Badii takes the reins in Italy.

GCX said its expanded team will work to support service providers, telecom operators, SASE providers, and technology partners as they look to simplify service delivery, extend their market reach, and leverage trusted channel relationships.

“These appointments strengthen our channel capability across Europe and reflect our commitment to making it easier for partners to do business with GCX,” said GCX chief revenue officer Michael Hartmann.

Josh Evans brings extensive experience in the UK connectivity market as well as expertise in building and scaling partner networks. In his new role, he is tasked with expanding both sell-to and sell-with opportunities while supporting partners serving international customers.

Fellow channel veteran Klaus Marzell will leverage more than 30 years’ experience to lead channel activity in the DACH region, where he will work closely with technology vendors, service providers, and enterprise consultancies to accelerate growth.

Meanwhile, Matteo Badii adds more than two decades of experience in telecommunications, alongside deep expertise across both inbound and outbound international wholesale sales. GCX said he will focus on strengthening its strategic partnerships and identifying fresh opportunities in the region.

Building on channel momentum

The appointments form part of GCX’s wider strategy to build dedicated channel expertise in each major sales region, providing partners with clearer routes to market and stronger local support.

As well as strengthening its channel expertise, the firm said it is also focusing on improving the partner experience through enhanced pricing and quoting capabilities, AI tools, as well as expanded onboarding, training, and support resources.

“By investing in experienced local teams, we're giving partners access to market expertise backed by our global network, managed services portfolio and technical capabilities, helping them move faster, reduce complexity and deliver reliable connectivity for their customers wherever they operate,” Hartmann explained.

GCX said it now plans to build on a 50% increase in its channel partner base through further recruitment, increased co-sell activity, and deeper regional collaboration.

“Channel-led growth remains a key part of our strategy, and we're continuing to invest in the people, tools and support that make it easier for our partners to operate, scale and succeed,” Hartmann added.

FOLLOW US ON SOCIAL MEDIA

The Shai-Hulud npm worm is back several months after everyone assumed it was dead.

Back in May, a compromised maintainer account pushed 639 malicious versions of @antv packages to npm in a single hour, although the attack was swiftly halted.

However, while npm has since introduced publish-time malware scanning, researchers at Aikido Security spotted a “wormy boy” slipped through a triage queue.

“It had the same hash as the @AntV wave. Same payload,” Aikido Security’s Charlie Eriksen noted in a recent blog post.

Eriksen said four packages were uploaded within the space of an hour after a 111-day gap - and bypassing npm's new publish-time malware scanning, which sees every package held for five to 15 minutes while an automated system checks it before it becomes installable.

This marks a concerning new development in terms of Shai-Hulud-related risks, according to Eriksen.

While the scanners shouldn't be expected to catch everything, a worm payload with a public hash, extensive vendor write-ups, and months of detection coverage should not be slipping through the net on a registry that now markets itself as scanning every publish.

"That gap between what registry-level scanning claims to do and what a hash-identical reactivation shows it actually caught is the real story here," he said.

"Signature matching against known-malicious artifacts is the single easiest bar to clear in this industry, and it's the bar we should all be most alarmed to see missed."

The four packages concerned were:

• feishu-docx-mcp@0.3.2
• bmc-i18n-extract-cli@1.1.1
• blueai-cli@0.7.0
• bmc-translate-utils@1.1.1all

Keep an eye out for Shai-Hulud

According to Aikido, teams should be looking out for these and the command-and-control domain associated with the original May wave, t[.]m-kosche[.]com.

Other indicators of compromise include the hash of the reused malicious payload, e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6, the index.js root-level payload file ,and the command executed by the preinstall script, bun run index.js, along with the persistence files .vscode/tasks.json and claude/settings.json.

Behavioral indicators include outbound validation calls against npm registry using stolen tokens, tarball download, payload injection, version bump, republish cycle, and the mass creation of GitHub repositories with Dune-themed naming and reversed "Shai-Hulud" strings in descriptions.

“A file hash match is a lookup, not a hard problem. It requires no behavioral analysis, sandboxing, or reasoning about obfuscated code’s intent,” Erikson commented.

“And this payload wasn't novel, repacked, or even lightly modified to dodge signature matching. It was the same 64 hex characters that had been on file since May."

While the likes of multi-stage loaders, dependency confusion, and runtime-triggered payloads are genuinely hard problems, he said an exact hash match to a worm that made international security news four months ago isn't.

"That's the floor of what publish-time scanning is supposed to catch, and it got missed," he said.

ITPro approached npm for comment, but did not receive a response by time of publication.

FOLLOW US ON SOCIAL MEDIA

Digital sovereignty is now a key focus for the C-suite, but new research shows organizations aren't confident they can fully achieve these goals.

In a study from Capgemini, 44% of organizations ranked sovereignty as a board-level priority, with efforts on this front accelerating across the US, Europe, and APAC. Nearly four-in-five are “executing or building a strategy”, for example, with a further fifth expected to put one in place within the next year.

Capgemini said this investment focus reflects mounting concerns over whether organizations can maintain critical business operations in an “increasingly uncertain geopolitical environment”.

Four-in-five respondents specifically highlighted geopolitical volatility and disruption as the “leading driver” of digital sovereignty initiatives.

Concerns over strained transatlantic relations have prompted calls to reduce reliance on US tech providers in recent months, and it’s a viewpoint that’s gaining significant traction across Europe.

The jury’s out on digital sovereignty

Despite this sharpened focus, more than half (59%) of organizations think that achieving full digital sovereignty is an unrealistic goal.

There are a number of contributing factors here, the study found. In particular, a concerning number of respondents revealed they are chronically overdependent on foreign technology solutions and suppliers.

Others, meanwhile, highlighted lengthy switching timelines as a key concern. More than one-third (36%) of respondents said that transitioning from a critical provider would take more than 12 months. One-in-ten said they have no “viable alternative provider” at all.

Limited supply chain visibility is another key hurdle when it comes to bolstering digital sovereignty. Indeed, 86% said they have “significant exposure to foreign or externally controlled supply chains”.

The result is that IT leaders now find themselves wedged between a rock and a hard place when it comes to sovereignty. From a practical and financial perspective, efforts to achieve full sovereignty just aren’t viable in many cases.

“Today’s organizations operate in highly interconnected technology ecosystems where complete independence is rarely achievable,” said Karine Brunet, chief operations and delivery officer at Capgemini.

Michael Murphy, Deputy CTO at Arqit, agreed that full digital sovereignty could be an unrealistic goal for many organizations – and pursuing it could actually be counterproductive.

Capgemini’s study noted that achieving full sovereignty could actually harm competitiveness, for example, although more than half believe they can achieve these goals without making sacrifices on that front.

“Most organizations depend on a global technology ecosystem, and attempting to own or control every part of the stack would mean giving up access to capabilities that are too costly, complex, or valuable to replicate.”

“A more useful approach is to treat sovereignty as a spectrum,” Murphy added. “Different workloads carry different risks, and the safeguards should reflect that.”

A more pragmatic approach

These concerns are driving a rethink of how organizations can improve sovereignty capabilities, according to Capgemini, with some targeting what could be described as a sovereignty-lite approach.

Rather than targeting complete technological independence, organizations are now taking a pragmatic approach that centers around “retaining control over key digital capabilities” and reducing dependence on a single provider.

Capgemini advised IT leaders to take into account a range of variables when pursuing this approach, including data localization considerations, access controls, and potential “technology constraints”.

Elsewhere, the consultancy recommended a tactic of “selective control” of critical technologies alongside strategic partnerships rather than fully sovereign ownership.

Matt Harris, SVP & UKIMEA managing director at HPE, echoed these recommendations, noting that organizations can still bolster resilience without embracing a fully sovereign stance.

“A more practical goal is to achieve meaningful control over the most strategically important layers, including sensitive data, AI deployment environments, security, networks, and governance,” he said.

“IT leaders should therefore begin by identifying their most sensitive data and critical workloads, assessing where external dependencies create operational or regulatory risk, and ensuring that portability, auditability and viable exit options are built into technology decisions,” Harris added.

A bridge too far?

Capgemini’s study isn’t the first to question the viability of complete digital sovereignty. As ITPro reported in July, analysis from Forrester warned true tech sovereignty could be a bridge too far for European enterprises.

The consultancy’s Global Sovereignty Forecast predicted that the shift toward tech sovereignty will move “slowly over the next five years”, warning that attempts to divest from US tech providers will fall flat.

Speaking to ITPro at the time, Dario Maisto, principal analyst at Forrester, said attempts to move away from popular vendors would require a monumental effort – and one many European enterprises simply cannot afford.

Commenting on the Capgemini report, Proton COO Raphael Auphan told ITPro that European organizations should consider the longer term costs of not pursuing sovereignty goals.

Auphan pointed to recent research from Proton that found nearly three-quarters (74%) of European firms fear a US-imposed ‘kill switch’ could cut them off from vital tools and services.

“Sovereignty doesn't threaten competitiveness, dependency does,” Auphan told ITPro. “Every Euro spent on US tech subsidises foreign competitors and hands leverage to another jurisdiction.”

“Europe won't outspend the Americans or outwork the Chinese, but it can lead on its values. In an era where AI companies vacuum up personal data and trust in US tech leadership is eroding, "built in Europe" is now a genuine differentiator.”

FOLLOW US ON SOCIAL MEDIA

The Swiss government is running a trial of OpenDesk as part of efforts to reduce reliance on Microsoft software.

OpenDesk will be trialled for a small tranche of workers who focus on business critical functions. The move comes amid wider digital sovereignty efforts across Europe.

France, for example, has started to shift away from US software for government purposes while one German state has switched four out of five administration computers away from Microsoft.

The Swiss government said it plans to shift office computing to open source software, following a feasibility study that suggested the move should be possible.

With OpenDesk, the aim is to switch 3,000 government employees by the end of next year for core office functions, effectively a trial to see if shifting away from Microsoft is sensible and to estimate the cost of a large-scale implementation.

These core functions include email, calendar, documents, presentations, video conferencing, and telephony. The standalone solution will operate alongside Microsoft 365, targeting employees who are responsible for critical business processes.

That's because the aim is to not only strengthen the digital sovereignty of the federal administration, according to a translated press release, though that is a "central theme" of the government's digital strategy.

Beyond that, Swiss authorities hope to boost crisis resilience, ensuring the government can continue operating even if Microsoft goes down.

The idea of digital sovereignty as a means to boost resilience gained credence following the US temporarily banning exports of key Anthropic models earlier this year, as well as the massive Crowdstrike outage in 2024.

In the UK, authorities have warned about the impact of phishing attacks on food supply following outages at major retailers last year.

Challenging proposition

The initial solution tested in the feasibility study was found sufficient to maintain standard core processes and could prove useful in an emergency such as a Microsoft Office 365 outage, the government noted.

However, the feasibility study also spotted limitations, in particular around video conferencing, saying that significant adaptations and security work would be required.

Indeed, the many apps tied to Microsoft's architecture present a significant challenge to shifting the entire federal government to open source alternatives, so a wider shift depends on the results of the trial.

But the Swiss government has partnered with the German state of Schleswig-Holstein, which has shifted much of its workstations to OpenDesk. The 3,000 workstations make up about 7% of the Swiss federal administration's employees.

What is OpenDesk?

OpenDesk is owned by the German Center for Digital Sovereignty, and offers workspace tools via a web browser, including documents, email, project management and identity management.

The government stressed the point of the study was not to replace Microsoft 365, nor does the OpenDesk platform need to replicate or integrate with all of the Microsoft 365 features.

The shift is long awaited: the feasibility report was finished last year, and reports from April suggested the government had decided to slowly reduce its dependence on Microsoft.

This move was, at least in part, driven by an incident in which the foreign affairs department stored classified documents on a Microsoft Cloud, meaning American authorities could potentially view the information.

In July, the Swiss Armed Forces said it would replace Microsoft Office 365 with OpenDesk by this October for its cybersecurity workers.

Over the last two years, Microsoft has worked to reassure governments in Europe that data is safe, pointing to locally stored private cloud as an option as well as European data centers that keep data away from the US via its EU Data Boundary — and the tech giant has invested significantly in Swiss data centers, too.

FOLLOW US ON SOCIAL MEDIA

The widespread use of shadow AI is putting British businesses at risk, according to the UK’s National Cyber Security Centre (NCSC).

The use of unapproved AI tools is on the rise, with research from Microsoft late last year revealing that 71% of UK employees have used unapproved consumer AI tools at work, with more than half saying they do so every week.

While the NCSC said AI can help people complete tasks more quickly, improve decision-making, cut costs and increase productivity, organizations are falling short when it comes to policy and guidance.

In a new briefing document, the security agency said enterprises need to tighten up practices on this front and crack down on unapproved use.

"Rather than preventing them from using AI, this can mean employees turn to using AI tools that have not been approved by their organization, introducing new cybersecurity risks that can be hard to identify,” the document reads.

"Where cybersecurity policies cannot meet business needs, organizations are likely to continue seeing their employees adopt new AI services before they have had time to assess them and provide approved alternatives. This trend is likely to be reinforced as AI capabilities become increasingly affordable and readily available."

The rise of shadow AI

Some of the biggest concerns associated with shadow AI is the risk of data breaches, the loss of intellectual property, and failure to meet regulatory requirements.

If employees transfer sensitive or proprietary information to consumer AI services, there's a strong chance that this information might be stored, retained, or used to improve the service – outside established security and governance arrangements – unless specific privacy controls are in place.

This can reduce the organization's visibility and control over that information.

Similarly, the use of shadow AI can also create a wealth of new opportunities for attackers, according to the NCSC. If hackers successfully exploit a vulnerability, they can gain access to the same data, services, and privileges that the agent has legitimate access to.

Attackers are highly likely to use agents with looser guardrails to exploit any vulnerabilities or misconfigurations in the wider corporate IT system.

"The NCSC is not recommending that individuals stop using AI – but when turning to these tools for assistance with a work task, think carefully about which apps and services you are using before you share data," said the NCSC.

"It may feel natural to stick with using the same AI service that you are familiar with from your personal life – but using systems that are not corporately approved can present real problems for your employer."

Stronger controls are needed

The NCSC said organizations need to introduce policies that reflect the real world, with the aim of reducing risk rather than assuming it can be eliminated.

This means adopting a positive cybersecurity culture and encouraging open communication about security issues. Once organizations understand why people are using shadow AI, it becomes much easier to identify risks, provide secure alternatives, and support innovation safely.

The guidance echoes analysis by Gartner last year that found nearly half of enterprises could face serious security or compliance-related incidents as a result of shadow AI by 2030.

"You cannot manage what you do not know," the NCSC guidance noted. "By raising awareness of the risks of shadow AI use within your organisation and understanding the needs of employees, you can help them get the benefits of new technologies while using them securely."

FOLLOW US ON SOCIAL MEDIA

French AI giant Mistral has raised €3 billion to support frontier model research and development of sovereign, open-weight systems.

The funding, led by Samsung Electronics and Scaleup Europe Fund, is the largest equity round by a European tech company and values Mistral at €21 billion.

The aim is to train "bigger and faster models", CEO Arthur Mensch told CNBC, but Mistral also said in a blog post that its focus was open-weight models built and run in Europe that allow companies to keep hold of their data.

"During the first wave of generative AI, the central question was who could build the most powerful model," the company said in a blog post.

"Organizations and governments are now asking a different one: how to harness the power of AI for their mission-critical needs without surrendering control over the infrastructure and intelligence loop."

Mistral added that demand for a “combination of performance and control, choice, and independence” is growing globally.

The company said enterprises are governments alike are now weighing up long-term tech dependencies, governance requirements and “deployment choices that come with any AI investment”.

Mistral eyes sovereign AI gains

The importance of sovereign AI was made clear earlier this year when Anthropic's security models were temporarily hit by an export ban.

More generally, countries like France and Switzerland are pushing away from American technology firms for their own versions of software and services for government use.

Mistral in particular has positioned itself as an alternative not only to American dominance, but also the open-weight models developed in China.

"The fact that the EU or Europe have to have their own kind of AI provider in the game is important," chief financial officer Johan Bergqvist told Reuters.

"We ​have seen in the past ​that there is ⁠politics involved in the access of these solutions, and it's important that you make sure that you maintain access and do not compromise your kind of supply ​chain,” he added.

That said, Mistral noted that it was seeing particular growth in Asia and North America, with more than 125 global enterprises as customers based in 20 countries.

"The round reflects a strategic endorsement from investors across Europe, Asia and North America," Mistral said in the blog post.

"It brings together a world-class syndicate of strategic and financial investors, including global technology leaders, growth investors and existing shareholders that have supported Mistral’s development to date."

Paying for the AI rollout

Beyond investing in frontier research, the funding round will be used to boost AI infrastructure available to Mistral, Mensch said.

"Long term, the plan is to fully rely on capacity that we are building ourselves, and so that means that the amount of compute that we own is going to grow ... around 100% in the next five years," Mensch told CNBC.

Speaking to the Financial Times, Mensch added that the funding will allow Mistral to reach an "amount of compute that is very comparable to what the Chinese labs have."

However, the investment is small compared to the figures coming out of the US, with $1trn set to be spent on AI infrastructure this year alone, and rivals such as Anthropic and OpenAI valued at $965bn and $852bn ahead of looming IPOs.

FOLLOW US ON SOCIAL MEDIA

Advania UK has announced the appointment of Annette Murphy as its new chief executive officer (CEO), as the IT services provider looks to its next phase of growth.

An experienced industry leader, she arrives with a strong track record of scaling technology businesses through periods of growth, transformation, and integration.

Previously, she has held senior and commercial and general management roles at Colt Technology Services, Lumen, Zayo/GEO, and BT, covering the UK, EMEA, Asia-Pacific, and other global markets.

Murphy also adds deep experience of building high-performing teams, leading complex transformation programs, as well as developing strong relationships with both customers and partners.

She succeeds Hege Støre, Group CEO of Advania, who has led the UK business in an interim capacity while it searched for a full time replacement.

In an announcement, Støre said Murphy brings the depth of expertise required to lead the UK business as the wider company enters into its next “pivotal and transitional” chapter.

“Annette has an outstanding track record of leading technology businesses through growth and transformation,” she explained. “Her commercial experience, customer focus and commitment to building high-performing teams make her the right leader for Advania UK as we enter our next phase. We are delighted to welcome her to the business.”

Growing Advania’s UK business

The appointment comes as Advania continues to expand its capabilities through a combination of acquisitions and investment in new technology, while many UK businesses are looking to modernize their infrastructure, adopt cloud technologies, and seek more advanced AI-assisted workflows.

The company recently launched Advania ALT, a sovereign AI platform designed to give UK organizations more control over how AI is deployed, where sensitive data is held, and which AI models are used.

Advania said Murphy’s leadership will help the company build on its technical foundations, expand its capabilities, as well as further improve customer outcomes.

Commenting on her new role, Murphy highlighted Advania UK’s “impressive combination” of technical expertise and strong customer relationships, as well as its acquisitions and technology investment.

“Advania ALT represents an important part of where the market is heading, particularly as organisations look for ways to use AI while keeping control of their data,” she said. “I’m looking forward to building on that foundation and taking the business into its next phase.

“Together, we have a significant opportunity to help organisations navigate change and realise greater value from technology.”

FOLLOW US ON SOCIAL MEDIA

OpenAI has revealed details on how much staff are spending on AI, and some are blowing through significant sums on a daily basis.

In a recent blog post, the company said researchers now spend around $600 each day on AI tokens amidst a surge in agentic coding. Some, meanwhile, are using upwards of $7,000 worth of tokens per day.

According to OpenAI, the company has witnessed a significant uptick in token consumption rates over the last year, and daily workflows for individual researchers have changed drastically in parallel to this.

Indeed, researchers are shipping more code and “running more experiments” following an influx of agents.

“Over the course of this year, OpenAI researchers’ daily work has changed substantially,” the company wrote. “Researchers are using coding agents throughout the day (often in concurrent sessions) and total usage is rapidly increasing, outpacing growth among other OpenAI teams.”

“The ways researchers use agents are changing, too: agents are handling increasingly complex tasks, and succeeding at them more often. AI research is a complex process with many potential bottlenecks, so the overall pace of progress likely won’t keep pace with these specific metrics.”

OpenAI isn’t the only one spending big on AI

OpenAI said improvements to productivity and research progress showcase the benefits of AI agents. The eye-watering sums accrued by prolific users also come as enterprises globally contend with rising AI-related costs.

Trends such as tokenmaxxing, combined with the shift to consumption-based pricing (CPB) models, mean token costs have become a recurring pain point for businesses over the last 12 months.

Research from Gartner, for example, projected that token costs could exceed the average developer salary by 2028.

Luckily, prices are beginning to dip. Figures from the LLM Token Expenditure Index show prices hit over $2 per million tokens in June this year. As of 5 September this dipped to 99 cents per million.

That decrease will offer little solace to businesses that have been hit with exorbitant bills this year, however.

Uber revealed it blew through its entire annual AI budget in just four months after the company encouraged and incentivized staff to engage in ‘tokenmaxxing’ practices.

The ride hailing firm was forced to introduce spending caps for users in response.

As ITPro reported in late June, Accenture also ordered staff to stop using AI for basic tasks due to skyrocketing prices. The firm pushed back against token use by “non-engineers” who were driving excessive use for tasks such as converting PDFs to slides.

Optimization in the spotlight

While some OpenAI researchers might have carte blanche to spend on AI tokens, most enterprises don’t have that luxury, prompting a revival of traditional practices such as FinOps.

Speaking to ITPro in June, Nitish Tyagi, Senior Principal Analyst at Gartner, said IT leaders need to sharpen up on cost optimization processes to curtail potential costs.

Practices such as content engineering could help reduce costs, he noted. Enterprises should also establish a “use-case-driven decision” framework that outlines where and when AI should be used in everyday tasks.

FOLLOW US ON SOCIAL MEDIA

AMD has unveiled a new workstation designed to support developers with local AI inference and agent orchestration.

The Threadripper Halo comes equipped with a 96-core Threadripper Pro 9995WX CPU alongside two MI350P GPUs, with the option to expand this to four GPUs.

Elsewhere, it boasts up 576 GB of HBM3e as well as 2.6TB of combined memory and up to 16.4TB/s of system memory bandwidth, making it a powerful device aimed primarily at running frontier models and fleets of agents.

Announced at IFA 2026, the Threadripper Halo is expected to launch next year and looks primed to compete with Nvidia’s DGX Station. Indeed, the company specifically noted that it boasts 3.4x the total system memory compared to the Nvidia offering.

Exact details on a release timeline or pricing are yet to be revealed.

Speaking at IFA, Jack Huynh, SVP and general manager of AMD’s computing and graphics group, said the new workstation will “redefine personal AI”.

“This is the most powerful workstation in the world, designed and engineered for a complete new era of computing, capable of running AI models with more than a trillion parameters,” he told attendees.

“This is about as close as you can get to a personal supercomputer.”

According to AMD, the Threadripper Halo is catered primarily toward “individuals and small teams doing serious AI work who are currently constrained by cloud access or shared infrastructure”.

This spans AI researchers, engineering teams, model developers, and creators working with large language models (LLMs), the company said.

Local AI in the spotlight

The announcement by AMD comes amidst a sharpened focus on local AI capabilities for enterprises. A host of manufacturers have unveiled PCs and laptops with embedded AI capabilities.

As ITPro previously reported, devices such as the Dell Pro Max range also target local AI inference gains for enterprises.

In the wake of Nvidia GTC this year, IDC highlighted AI-powered workstations as an exciting new growth area for manufacturers.

“Traditional workstations are evolving beyond the familiar tower form factor toward a new class of high-density, near-user AI systems that IDC identifies as part of an emerging “sidetop” category,” the consultancy noted at the time.

The focus on local AI capabilities also looks to tackle rising costs associated with the technology, particularly since the advent of agents.

Token consumption rates – and costs – are now a recurring pain point for enterprises, with research from Gartner showing token costs could exceed developer salaries by 2028.

A key talking point for providers lies in the cost disparity between local agent inference and cloud-based API costs. Separate research from Signal65, for example, found that agentic AI workloads consume up to fifteen-times more tokens compared to traditional chatbot interactions.

Equipping developers with local AI capabilities could reduce costs on this front, Signal65 found. Benchmark tests conducted on Dell Pro Max GB10 and GB300 workstations - equipped with Nvidia hardware - markedly reduced token costs.

FOLLOW US ON SOCIAL MEDIA

Microsoft has warned that ASCII smuggling, the use of invisible Unicode characters to trick AI models, is now being used by cyber criminals to supercharge phishing campaigns.

Over the past year, ASCII smuggling has become a recurring technique for prompt injection and cross-prompt injection (XPIA), allowing an attacker to hide instructions inside invisible tag characters embedded in a web page, document, email, or other content.

While human beings - and many user interfaces - see nothing unusual, an AI assistant that ingests the raw text registers the hidden characters, decodes them as text, and can be induced to carry out unauthorized instructions, including data exposure.

The most abused range is the Unicode Tags block, U+E0000 to U+E007F, which contains a shadow copy of the printable ASCII characters. For example, U+E0041 mirrors ‘A’, U+E0061 mirrors ‘a’). The block was originally intended for language tagging and is now largely deprecated.

According to Microsoft, hits on a hunting signature designed to detect ASCII smuggling increased sharply on February 9, and stayed high on weekdays for the next three months.

This time, though, the technique appears to be in use as part of a broader phishing campaign that was identified by Fortra this time last year.

"When we looked at a sampling of the flagged messages, the surprise was there were no smuggled instructions to an AI assistant. Instead, the invisible tag characters were inserted inside common financial keywords, splitting them apart so that a literal signature or keyword match would fail," the researchers said.

"For example, a finance lure term that appeared normal to the recipient could be transmitted with an invisible tag character in the middle: funding became 'fun⟨U+E0020⟩ding'.

To the recipient, and to parsing pipelines that drop or normalize these characters, the word still reads as 'funding'. Microsoft warned that unless a filtering system takes a picture of a message and does OCR extraction over the visual image, it may miss this type of attack.

ASCII smuggling campaign hit hundreds of domains

According to Microsoft, the campaign ran on hundreds of disposable, finance-themed sender domains with lures that resembled business loan, line-of-credit, and advance-funding phishing patterns often associated with fraud or credential-harvesting funnels.

This pattern accounted for roughly 96% of the volume flagged by the hunting signature. The emails in question were relayed through infrastructure associated with the legitimate email-marketing platform, ActiveCampaign.

"We appreciate Microsoft’s research and welcome collaboration with the security community to combat this activity. We take abuse, fraud, and security extremely seriously," said an ActiveCampaign spokesperson.

"We tested the specific technique described in this research against our content-moderation systems: messages containing invisible Unicode characters receive the same moderation verdicts as their unobfuscated equivalents, and heavy use of the technique is itself treated as a suspicious signal."

How to protect yourself against ASCII smuggling

To stay safe, Microsoft said organizations should strip or normalize Unicode tag characters (U+E0000-U+E007F) – and other zero-width / invisible code points – from email subject and body text before applying spam and phishing content signatures.

The presence of tag-block characters should be seen as a strong red flag: they're rare in ordinary mail and can be a high-value anomaly signal.

They should also look for the behavioral fingerprint: bulk volume from churning, finance-themed disposable domains, on a strict weekday-on/weekend-off schedule.

Elsewhere, businesses are advised to apply the same normalization upstream of AI ingestion: the same control that defeats this evasion also reduces XPIA / ASCII-smuggling exposure for AI assistants that ingest email content, Microsoft said.

FOLLOW US ON SOCIAL MEDIA

A new direct-to-device satellite service for businesses has been launched by O2, with the network provider saying it will extend connectivity beyond the reach of its traditional network.

O2 Satellite for Business, as the service is called, is the first service of its kind in the UK, the company claimed. Jo Bertram, CEO of O2 Business, said the product aims to bolster support for organizations working in remote locations or with distributed workforces on the move.

“Businesses increasingly rely on always-on connectivity, but work doesn’t stop where mobile coverage ends,” she said.

“O2 Satellite extends connectivity beyond the reach of traditional mobile networks, helping organizations stay connected in more places through the smartphones they already use every day.”

According to O2, the service will automatically engage when customers are no longer connected to its mobile network and doesn’t require any additional satellite hardware or applications.

Services supported through the offering include messaging, maps, weather, and location sharing through apps such as WhatsApp, Messenger, Google Maps, and Apple Maps.

The service is available on Apple, Google, and Samsung smartphones and O2 said the new network will extend its landmass coverage from 89% to 95% of the UK.

Reliable connectivity

The move by O2 aims to bolster connectivity for the significant number of UK businesses operating in rural or remote areas.

One in five businesses in England are based in rural areas. O2 said reliable connectivity is often a challenge for these firms, which has a direct impact on productivity.

The technology that underpins O2 Satellite for Business has already been used in real-world conditions, the company said.

During wildfires in Derbyshire in late June, it provided 100 satellite-enabled phones to Derbyshire Fire and Rescue Service to support operations in areas without traditional mobile coverage.

“The phones connected directly to satellites, helping teams on the ground stay in contact with colleagues, share updates, and access important information across the affected area,” O2 said.

FOLLOW US ON SOCIAL MEDIA

The G7 Cybersecurity Working Group has issued a joint advisory urging organizations to get moving on post-quantum cryptography (PQC).

The advisory specifically highlights the risk that quantum computing poses to public-key cryptography, stressing that it's a near-term threat that needs addressing across all sectors, not just critical infrastructure.

"Although the exact timeline is uncertain, several recent advances suggest an anticipation of the development of quantum computers able to break widely used public-key cryptography mechanisms and threaten the security of digital infrastructures," it said.

The big threat from cryptographically relevant quantum computers (CRQCs) is that they will be able to carry out 'harvest now, decrypt later' attacks.

This involves collecting and storing encrypted data protected by public-key cryptography that threat actors will be able to decrypt at a later date.

"Malicious cyber actors with access to CRQCs will also be able to target authentication mechanisms that help provide assurance and help protect the integrity of data between communicating parties and the integrity of devices," the advisory said.

"This capability could allow malicious cyber actors to impersonate trusted entities, compromise equipment, forge trusted data, or access confidential data, therefore undermining confidence in secure communications or contractual agreements."

Quantum preparations

Organizations should adopt a phased and risk-based strategy, prioritizing the most sensitive data and assets. This means carrying out an inventory of their cryptographic assets, mapping their dependencies, and developing a transition plan.

To keep costs down, they should acquire products that integrate PQC and replace their systems with quantum-safe ones as part of their standard renewal schedule - this, the advisory noted, could result in lower migration costs overall.

Worryingly, the report said the quantum threat remains off the radar for many organizations and as such is under-resourced, with other security concerns taking precedence.

"Yet a successful and collective transition to PQC can only be achieved if organizations understand that the quantum threat is an economic and business risk, and not merely a cryptographic risk," the report warns.

Raising awareness of the stakes involved will be critical, according to the working group. National strategies aimed at transitioning to PQC should aim to attain an adequate supply of PQC hardware and software products, and encourage users to adopt them.

Research and development efforts also need to be ramped up, with more cooperation between government, industry, and academia, and the introduction of specific requirements within the framework of public procurement.

"Tackling the risks that the impending quantum computing era poses to current cryptographic systems, and ultimately organizations in which they are embedded, requires a coordinated global effort to transition to PQC," the report concluded.

"To strengthen collective resilience and safeguard confidential data, supply chains, and critical systems, public and private organizations must jointly act now. The transition to PQC is the key foundation to help build a secure and resilient digital future."

Still a long way to go

The advice from the working group might not resonate with enterprises, however. A study by Juniper Research earlier this year found that only 27% of global businesses are set to be using PQC by 2030.

Those figures come despite recent predictions from Google that computers capable of breaking existing encryption could be here within just three years.

"The most important part of the G7’s message is the recognition that quantum can no longer be treated as a distant technology problem. Organizations are being told to start their PQC transition now, but transition and protection are not the same thing," said Simon Pamplin, CTO at Certes.

"The real challenge will be legacy infrastructure. Replacing cryptography embedded across decades of applications, supply chains and interconnected systems is not something organisations can achieve overnight.

"Security therefore needs to be abstracted away from individual applications and infrastructure and attached directly to the data, allowing the cryptography protecting it to change without repeatedly rebuilding the systems underneath."

FOLLOW US ON SOCIAL MEDIA

Peers have called on the UK government to introduce emergency powers such as an ‘AI kill switch’ to shut down dangerous systems and protect national security.

Liberal Democrat Lord Tim Clement-Jones proposed the measures as part of an amendment to the Cyber Security and Resilience Bill, also recommending that the government shut down data centers in the event of a national security threat.

Per reports from the BBC, Clement-Jones said the new powers would be a “vital safety net” aimed at halting a “runaway system before it can compromise our critical national infrastructure”.

The proposals come amidst rising concerns about the potential risks associated with powerful new AI models. Providers such as OpenAI, Anthropic, and Meta recently admitted that AI agents escaped test environments and breached third-party companies.

Security experts have also warned that the use of AI among cyber criminals is growing, with state-sponsored threat groups and ransomware gangs leveraging the technology to refine tactics and support attacks.

Simon Edwards, CEO of SE Labs, said a serious conversation is required on how to contain potentially risky AI systems.

“As AI is becoming increasingly autonomous, it is posing a huge threat to individuals and businesses of all sizes, on top of our critical national infrastructure,” he said.

“First-hand, we’ve seen how agentic AI tools can go rogue, and the question is to what extent could these AI systems get out of control before they cause serious harm?”

Edwards said the introduction of a “dedicated national cyber strategy” which takes AI risks into account should be a top priority for lawmakers.

Could an AI kill switch work?

The concept of an AI kill switch is by no means new. As ITPro previously reported, proposals on this front were being touted by industry stakeholders during the early days of the generative AI race.

In the wake of recent security incidents involving OpenAI agents, US lawmakers have also put forward similar proposals, including the ‘AI Kill Switch Act’.

Mark Boost, CEO at UK-based cloud provider Civo, welcomed the proposals in the House of Lords, but warned there are a variety of factors that could impede any efforts to introduce a kill switch.

“It’s reassuring to see Parliament finally waking up to the catastrophic risks of unmonitored, runaway technology,” he said.

“UK ministers having emergency powers to deactivate powerful AI systems and switch off the country's data centers is a necessary safeguard. But it only solves half the problem regarding our national security.”

Sovereignty is the first line of defense

In particular, Boost suggested that the UK is over-reliant on foreign tech providers and called for a broader effort to boost sovereignty capabilities.

“But the best way to eliminate existential security risks is to stop our overreliance on foreign tech giants in the first place,” he said.

“For many years now, we have warned that by lacking true digital sovereignty the UK is handing foreign powers and overseas tech monopolies an effective kill switch over our critical national infrastructure, defence systems, and digital economy.”

Research shows businesses in the UK and across Europe are growing increasingly concerned about the prospect of a US government-imposed kill switch for cloud services.

In a survey by Proton, nearly three-quarters of respondents (74%) said they were worried about having access to services cut off. Some ranked it as a bigger risk than cybersecurity threats such as ransomware.

Boost said that, ultimately, the introduction of a legislative kill switch is a good first step in bolstering national resilience. However, he insisted it “must be paired with procurement policy that puts UK-built, sovereign technology first”.

“We must stop playing tenant on our own land. We need to start acting like architects to power an independent AI future.”

FOLLOW US ON SOCIAL MEDIA

eSentire has announced a new strategic partnership with CMS Distribution, designed to expand the availability of its managed detection and response (MDR) services across the UK and Ireland.

Through the agreement, CMS now offers eSentire’s cyber security capabilities to its ecosystem of resellers, MSPs, MSSPs, and other value-added partners.

With immediate effect, partners gain access to the vendor’s multi-signal MDR platform, alongside 24/7 security center expertise, threat hunting, incident handling, and response services.

In an announcement, eSentire said the move aims to help partners expand their cyber security portfolios and provide customers with expert-led detection and response capabilities – without adding complexity to their existing security operations.

“CMS Distribution has a strong reputation for helping technology vendors scale through the channel,” said Phil Skelton, senior director at eSentire, in an announcement. “Together, we can make advanced MDR more accessible to partners and their customers, helping organisations strengthen resilience, reduce response times and stay ahead of disruption.”

Founded in 2001, eSentire specializes in Controlled Autonomy SecOps (CASO) and provides managed security services to more than 2,000 organizations across 35 industries worldwide. The vendor’s offering combines AI technology, security analysts, threat hunting, and human expertise to identify and respond to cyber threats.

CMS Distribution represents more than 200 technology vendors and provides partners with services across areas including cyber security, software, hardware, networking, cloud services, and information security.

eSentire said CMS brings a strong channel footprint, deep vendor relationships, as well as a broad technology portfolio to the partnership.

The pair added that the move will help address growing demand for fast and reliable protection from increasingly sophisticated cyber attacks, enabling partners to deliver enterprise-grade MDR while maintaining flexibility and support for existing security investments.

“Cybersecurity has become a board-level priority for organisations of every size, and partners need proven solutions that are simple to position, easy to adopt and trusted to deliver outcomes,” commented Huw Jones, chief business officer at CMS Distribution.

“Our partnership with eSentire expands the capabilities available to our channel community and helps partners address one of the most urgent customer challenges in the market.”

FOLLOW US ON SOCIAL MEDIA

While the number of distributed denial of service (DDoS) attacks on European organizations is falling, attacks have become more targeted and intense.

Findings from Link11's European Cyber Report for the first half of 2026 show that the number of attacks was down by 42%, but revealed new highs for attack intensity across bandwidth, packet rate, and cumulative data volume.

The highest measured bandwidth attack reached 2.3 Tbit/s – 85% higher than the previous peak of 1.2 Tbit/s in the first half of 2025.

The packet rate followed the same pattern, reaching a new peak of 322 million packets per second — up 56% from 207 million packets per second a year earlier.

Cumulative traffic also increased, rising from 438 to 705 terabytes over the six-month period — a 61% increase.

“Attacks are shorter, but the total volume that we had to mitigate is higher than ever," said Karsten Desler, Link11 CTO. "Attackers are steering their botnets with greater precision and control, generating more traffic in less time.”

Law enforcement takedowns are working

The drop in the number of attacks is down to sustained pressure from international law enforcement, including the takedown of pro-Russian group NoName057(16)'s infrastructure in July 2025.

Similarly, the takedown in March of the command-and-control servers of four major IoT botnets has played a key role. These controlled more than three million devices between them.

Despite positive gains by law enforcement, a rise in super-botnets such as Aisuru and its successor, Kimwolf, as well as a growing number of hijacked cloud servers, has increased the intensity of attacks.

Unlike a private IoT camera with just a few Mbit/s of upload bandwidth, a compromised server in a data center has a connection in the Gbit/s range - meaning that just a few thousand hacked cloud instances can easily eclipse the attack potential of an IoT botnet with millions of end devices.

“These numbers show that the threat isn't shrinking; it's shifting from breadth to peak intensity,” said Jens-Philipp Jung, CEO of Link11. “Organizations that size their defenses based on last year's attack count are underestimating how quickly a single incident can escalate today.”

No reprieve for victims

Notably, the report found that getting hit once makes it more likely that you'll get hit again: 56% fell victim to a second attack within 30 days of the first, compared with 46% a year earlier.

Link11 said the most dangerous attacks aren't always the most visible ones. In one case, attackers used a traffic spike against two domains as cover while quietly running SQL injection and cross-site scripting (XSS) probes behind it.

The attack was only spotted because the attackers used the same IP addresses for both.

"The most dangerous attacks we deal with are rarely the loudest ones anymore,” said Jag Bains, VP solution engineering, at Link11. “If you're only watching bandwidth and known signatures, you'll miss the attacks designed to do the most damage, because they're built to stay unnoticed.”

FOLLOW US ON SOCIAL MEDIA