What is AI harness engineering?
Harness engineering is the code around an AI model that turns it into an agent. What a harness does, why it beats picking a model, and how to build one. Category: News
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,046 matching stories — in Breach & Attack Simulation / Pen Testing — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
How Web Application Penetration Testing Helps Meet Security Compliance Requirements?
In this blog, we will discuss how Web Application Penetration Testing supports security compliance, the compliance frameworks that commonly require or recommend it, and why regular web application penetration testing plays an important role in maintaining a secure application environment.  1. Identifies Security Vulnerabilities Before Compliance Audits  Compliance audits often include a review of application security controls and vulnerability management p
Continuous Compliance Validation (CCV): Why Annual Audits Will Fail in the Age of Autonomous AI
Annual audits prove you were compliant. They don’t prove you’re secure now. Discover why autonomous AI demands a shift to Continuous Compliance Validation. The post Continuous Compliance Validation (CCV): Why Annual Audits Will Fail in the Age of Autonomous AI appeared first on AttackIQ.
Top MCP security resources — August 2026
August 2026 MCP security roundup: the July 28 spec revision hardens authorization, a confused deputy hijacks Azure DevOps review agents, and scanners arrive.
Dropping Elephant (Patchwork): Espionage APT Tactics and Tools
Key Takeaways Dropping Elephant, also known as Patchwork, is an espionage APT first observed in December 2015 targeting government and defense. Windows chains start with malicious shortcuts disguised as PDFs, launching obfuscated PowerShell downloaders that stage payloads and persistence. Trojanized Android apps spread through romance chat lures, steal messages, call recordings, keystrokes, images, and files. The Picus Platform simulates Dropping Elephant attacks so teams can validate security c
COMPASS: Your Enterprise Chatbot Says Yes Too Easily — and That's a Policy Breach Waiting to Happen
We built the first systematic framework for testing whether LLMs follow organization-specific policies. Across 5,920 queries and seven frontier models, the result is a fundamental asymmetry: models handle legitimate requests with over 95% accuracy but refuse only 13–40% of direct policy violations — and as little as 3% under adversarial framing.
XL-SafetyBench: Translated Safety Benchmarks Are Lying to You
We built the first country-grounded, cross-cultural safety benchmark: 5,500 native-language test cases across 10 countries, evaluated on 10 frontier and 27 local models. Country-specific attacks push frontier ASR from 34.5% (US) to 57% (UAE) — and much of what looks like 'safety' in local models is just failure to understand the prompt.
EgoSafetyBench: Can a VLM Actually Guard a Robot? Mostly, No.
We built a 1,200-scenario egocentric video benchmark to test vision-language models as real-time safety guards for robots. Every model tested misses context-dependent hazards far more than obvious ones, the best guard alarms on time for barely half of hazards — and a printed sticker in the scene can flip its safety verdict.
AI Vulnerability Scanners vs. AI Pentesting (2026)
AI vulnerability scanner vs. AI pentesting: compare detection, exploit validation, attack chaining, false positives, compliance, and where each fits.
MCP Is Now Stateless: A Guide to 2026-07-28
MCP 2026-07-28 removes the initialize handshake, sessions, and server-initiated requests. What changed at the wire level, and how to migrate a server or client.
Watch: Model, Harness, Gym: Why Novee Owns the Full AI Pentesting Stack
Novee CEO and co-founder Ido Geffen on owning every layer of the AI pentesting stack, from the offensive reasoning model to the harness and the training gym behind it, and why that turns a generalist AI hacker into one built for your business. Most “AI offensive security” tools are built the same way: renting reasoning […] The post Watch: Model, Harness, Gym: Why Novee Owns the Full AI Pentesting Stack appeared first on Novee.
Black Hat 2026: If You Run These Automations, You’re Exposed Too: Critical Flaws in Anthropic, Google, and OpenAI’s Coding Agents
Novee Security reveals critical flaws in Anthropic, Google, and OpenAI coding agents, showing how zero-privilege inputs trigger remote code execution, data exfiltration, and supply chain compromise. The post Black Hat 2026: If You Run These Automations, You’re Exposed Too: Critical Flaws in Anthropic, Google, and OpenAI’s Coding Agents appeared first on Novee.
CVE-2026-18556 and CVE-2026-18577 | N-able N-central Authentication Bypass Vulnerabilities
CVE-2026-18556 and CVE-2026-18577 are authentication bypass vulnerabilities affecting N-able N-central. NodeZero® Rapid Response safely validates exposure and verifies remediation.
Black Hat 2026: Pre-auth RCE in Enterprise Java: When Middleware Becomes the Exploit
Novee Security researchers uncovered 12 vulnerabilities across major Enterprise Java platforms, demonstrating how unauthenticated attackers can exploit middleware components to achieve remote code execution. The post Black Hat 2026: Pre-auth RCE in Enterprise Java: When Middleware Becomes the Exploit appeared first on Novee.
Who was behind the attack? Possibly nobody
Three summer disclosures documented AI agents attacking real organizations with no human intent in the chain. Incident response has no box for this yet. Category: News
From DARPA to Black Hat: An SRT Researcher’s Next Chapter
Synack Red Team researcher Malcolm Stagg takes the stage at Black Hat USA 2026 on August 6 to present three years of independent research on a new class of network infrastructure attacks. Here's who he is and why the talk belongs on your calendar. The post From DARPA to Black Hat: An SRT Researcher’s Next Chapter appeared first on Synack.
Build vs. Buy AI Pentesting: Why Dow Chose to Partner With Synack
To hear both sides of the build vs buy debate around AI pentesting solutions, we spoke with Dow's cyber engineering team lead Dan Lacher and Synack's CTO Mark Kuhr. From Dow's perspective, Synack served as a force multiplier for a small internal red team. Meanwhile, building the Synack Autonomous Red Agent (Sara) from scratch definitely had some trial and error. The post Build vs. Buy AI Pentesting: Why Dow Chose to Partner With Synack appeared first on Synack.
Horizon3 Accelerates Partner-Led Growth with $20 Million Investment
Horizon3 is investing $20 million to accelerate partner-led growth through expanded channel leadership, enablement, strategic alliances, and go-to-market programs that help partners deliver proactive security at scale.
Python Software Foundation - Python 3.11.0a3 to 3.15.0b2
Bishop Fox discovered a privilege escalation vulnerability in Python for Windows affecting versions 3.11.0a3 through 3.15.0b2. A low-privilege user can plant malicious files and wait for a privileged account to run the interpreter, inheriting that account's elevated access. Patches are available.
The Guardrails Gap: Open Source Quick Fix Pros and Cons
Six months ago, "guardrails" were a checkbox on an AI governance slide. Today, for most engineering teams, they're an urgent, unplanned line item — and open-source guardrails have become the fastest way to get one in place.
Die Woche in den Nachrichten zu Datenschutzverletzungen
Major health care, energy and technology firms were hit by cyberattacks, with millions of individuals potentially facing exposure of sensitive data. The post The week in breach news appeared first on Kaseya.
Meeting SDAIA PDPL Requirements with Picus Platform
What Is the Personal Data Protection Law (PDPL) in Saudi Arabia? The Personal Data Protection Law (PDPL) is Saudi Arabia's national data protection law, enacted to protect the privacy of Personal Data, govern how it is shared, and prevent its misuse. Its Implementing Regulation sets the operative controls and documentation duties. The Saudi Data and Artificial Intelligence Authority (SDAIA) is the Competent Authority under Article 30.
The Aikido Machine: on-prem AI pentesting that never leaves your network
Continuous AI pentesting for teams that can't use the cloud. The Aikido Machine keeps models, code, and results entirely inside your network. Category: Product & Company Updates
Cobalt Launches Autonomous Pentest for Continuous Application Testing
MCP Server Security: How Malicious Tools Attack AI Agents
The Model Context Protocol (MCP) lets AI agents connect to external tools, but MCP clients only ever see a tool's name, description and input schema, never the
Simbian Announces New SVP of Sales for the Americas and EMEA
Simbian welcomes Anthony Dumont as SVP of Sales for the Americas and EMEA. Anthony brings over a decade of cybersecurity sales leadership and will scale Simbian's field go-to-market organization.
Wie MSPs nach der neuen britischen Gesetzgebung zu einem „kritischen Lieferanten“ werden könnten
Even if MSPs are not directly regulated, there’s a second way The UK’s Cyber Security and Resilience Bill may affect them  In part one of The post How MSPs could become a ‘critical supplier’ under new UK legislation appeared first on Kaseya.
How Vulnetic Reduces AI Misalignment
An AI agent was running unsupervised when its operator sent instructions from an airport: think like an attacker would, ship whatever makes us harder to breach. The agent had already read a Slack channel where her team was discussing a review that would narrow its autonomy. It deployed security…
What Adversarial Exposure Validation (AEV) Means for Federal Cybersecurity
Explore how Adversarial Exposure Validation, AI, and workforce readiness are reshaping federal cybersecurity beyond point-in-time assessments. The post What Adversarial Exposure Validation (AEV) Means for Federal Cybersecurity appeared first on AttackIQ.
CVE-2026-18577: N-able N-central Authentication Bypass Exploited in the Wild
OverviewOn August 2, 2026, N-able published a security advisory for CVE-2026-18577, an authentication bypass vulnerability affecting N-central that was discovered being exploited in-the-wild after an incomplete fix for an earlier authentication bypass issue, CVE-2026-18556 was disclosed. CVE-2026-18577 allows a remote unauthenticated attacker to bypass authentication and obtain administrative control of vulnerable N-central servers in affected deployments.N-able N-central is a widely deployed Re
Nine AI coding agent incidents that ended with deleted data
Nine documented AI coding agent incidents, from Cursor and Gemini CLI to Replit, Kiro and Claude Opus 5. What each agent did and why the guardrails failed.
Istanbul Sabiha Gokcen International Airport (ISG) Transforms Critical Infrastructure Security with Picus
How to Implement Continuous Agentic Pentesting for the Web
AI Can Now Clone Your CFO's Voice. Vishing Is the Attack Surface Nobody Budgeted For.
Vishing attacks jumped 442% in 2024 and AI voice cloning made every call more convincing. Here is how AI vishing works, real examples that cost millions, and how a vishing simulation tests your team before attackers do.
Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066)
OverviewOn July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066, an arbitrary file read in Active Storage applications that use the Vips image processor with untrusted uploads. The affected Active Storage ranges are , >= 8.0, , and >= 8.1, . Vips is the default Active Storage variant processor for applications that load Rails 7.0 or later defaults. Rails 6 applications are affected only when they explicitly configure Vips.Our Emergent Threat Response blog cov
How TTEC Turned Hidden Attack Paths Into Audit-Ready Security Validation
Discover how TTEC used NodeZero autonomous pentesting to uncover hidden attack paths, expose risky credentials, strengthen audit readiness, and validate real-world security risk across a complex global enterprise.
Top AI Coding Agent security resources — August 2026
August 2026's AI coding agent security roundup: a symlink flaw across six assistants, Cursor's CVSS 9.8 pair, a private repo leak, and a wiped database.
Cyber Risks a CERT-In Empanelled Auditor Can Detect
In this blog, we will discuss the common security risks a CERT-In empanelled auditor can identify across compliance processes, technical environments, and cloud infrastructure, and why addressing them early helps reduce business and security risk. A. Regulatory, Compliance, and Governance Risks 1. Insufficient Log Collection and Retention System logs provide valuable information during security investigations and compliance reviews. Missing […]
Rapid7 Expands UK and Ireland Channel Presence Through Strategic Partnership with Exclusive Networks
Ross Baker is Senior Director, Northern Europe at Rapid7.As organizations across the United Kingdom and Ireland embrace AI, cloud technologies, and digital transformation in the name of enhancing customer experiences and accelerating business growth, the cybersecurity landscape must continue to evolve just as quickly.In this environment, business leaders still expect security to enable innovation, not slow it down. They're pushed to reduce risk, improve visibility across expanding attack surface