Passing the audit means you're secure. That's a comfortable assumption, and it's wrong. Reality: compliance is a snapshot of what was checked on one day. Security is whether your cloud actually holds up the other 364, including the settings nobody put on the checklist. CCSK builds the fundamentals to tell the difference: cloudsecurityalliance.org/ed…

A customer sends you a 300-question security questionnaire. Next week, a different customer sends another one. Same topics, different wording. The Cloud Controls Matrix is the common vocabulary behind a lot of those questions. 207 controls across 17 domains, vendor-neutral, and free. Learn it once and you'll recognize what's actually being asked, instead of starting from scratch every time. cloudsecurityalliance.org/re… #CloudSecurity

LiteLLM's 1.107.0 release was hijacked using a master key that leaked on May 27. The commit was force-pushed away. The key was never revoked. Four and a half months later, an attacker used it to pull a GitHub owner token from an agent platform API, then redirected the release pipeline and published malicious builds to PyPI and Docker. Deleting the commit isn't revocation. Track revocation as a verified control. labs.cloudsecurityalliance.o… #SupplyChainSecurity

CISO Daily Briefing: Arista VeloCloud Orchestrator SQLi (CVE-2026-114625, CVSS 9.9) is under active exploitation; the Brotli decoder flaw (CVE-2026-111497) is still unpatched in .NET, DuckDB, ClickHouse and Arrow builds. NIST/NSA/CISA's AI incident practices say agent-caused incidents need their own IR category. 65% of surveyed orgs had an agent incident; only 11% auto-block out-of-scope actions. labs.cloudsecurityalliance.o…

Uncomfortable truth: your org chart has a box for who owns the database, the network, the SaaS vendor. It has no box for who owns what an autonomous agent decides at 2 a.m. "The team that built it" breaks once agents act across systems nobody on that team controls. Name an accountable owner before the incident, not during it. The CSAI Foundation is working on this: csai.foundation/ #AgenticAI

When an AI agent in your environment makes a decision that affects a customer, could anyone reconstruct why it did what it did? Not what it did. Why. That question gets uncomfortable fast, and TAISE is a solid path toward answering it: cloudsecurityalliance.org/ed…

Scenario: your internal LLM assistant searches the company wiki to answer a question. The intern asks about M&A plans. Does the retrieval layer check who's asking, or does it fetch whatever matches best? That's where Zero Trust earns its keep in LLM environments: verify every request, scope access per user, and treat every tool call and data pull as untrusted until proven otherwise. cloudsecurityalliance.org/re… #ZeroTrust

Anthropic's Frontier Red Team pointed Claude at 25 open-source projects and 17,000+ config options. It found 162 setting combinations that were accepted with no error, warning, or docs. In 94 of them, a security control quietly turned off. One client-certificate bypass sat there for 21 years. Your config can look right and enforce nothing. Test that blocked actions actually fail. labs.cloudsecurityalliance.o… #AppSec

CISO Daily Briefing: Symantec caught Skynet, an LLMjacking agent that hits unauthenticated model endpoints and can run up to 100,000 steps without approval. V12 found 25 flaws in x402 agent-payment SDKs, so upgrade to 2.23.0+. Anthropic's Red Team found 94 silently disabled security controls in open source. EN 18286 covers only Article 17 quality management, so conformity is partial. GPT-6 is now on Vertex AI, which means multi-cloud model dependencies. labs.cloudsecurityalliance.o…

Zero Trust's favorite question is "who's asking?" For agents, that's the easy part. The hard ones: On whose behalf? For which task? Does this specific call actually belong to that task? A valid agent token can't answer any of that. Least privilege has to become per-task, and verification has to keep running mid-execution, not just at login. That's the work we're digging into at the CSAI Foundation: csai.foundation/ #ZeroTrust

Something I noticed this week: more conversations about AI features quietly showing up inside SaaS tools teams already approved. Nobody ran a new vendor review, because technically nothing new was bought. The risk isn't the tool you evaluated. It's the capability that arrived in an update. TAISE helps you build the habit of asking the right questions: cloudsecurityalliance.org/ed…

Threat modeling an AI agent with a classic diagram of boxes and arrows? You'll probably miss the interesting risks. Agents plan, call tools, remember, and talk to other agents. The attack surface shifts at every layer, and old models weren't built for that. MAESTRO is CSA's framework for threat modeling agentic AI. It gives you a layered way to ask "what can go wrong here?" before the agent ships. cloudsecurityalliance.org/re… #AgenticAI

Ransomware affiliates built an AI kill chain where a human approves every single step. That bottleneck is what let them scale. SOCRadar recovered 8,257 messages across 133 intrusion sessions from operators tied to INC Ransom and The Gentlemen. Each victim got its own master prompt, and the model waited for sign-off before acting. The AI didn't need novel tradecraft. One reused password opened the VPN, servers, RMM, backup and security platforms. labs.cloudsecurityalliance.o… #Ransomware

CISO Daily Briefing: Phantom AI, an 18-module ransomware framework run through OpenRouter-hosted models, has 62 named victims; patch edge and RMM systems (FortiClient EMS, SimpleHelp, cPanel/WHM). Node.js Brotli decoder RCE (CVE-2026-111497) is fixed in 22.23.4, 24.22.1 and 26.12.1. OpenAI requires prior approval for AI gateways from Nov 20; test multi-provider failover now. labs.cloudsecurityalliance.o…

A research agent summarizes a vendor doc. It hands the summary to a planning agent. That one asks a procurement agent to "just confirm" a purchase. Every hop passed its own checks. Nobody reviewed the chain, because no team owns the chain. Emergent risk lives in the handoffs. That's the gap CSAI Foundation is working on, across domains instead of inside silos: csai.foundation/ #AgenticAI

Friday mood: the AI assistant someone spun up "just to try it out" in March is still running, still has access to the shared drive, and now has more tenure than two of our new hires. Nobody onboarded it. Nobody will offboard it either. If that sounds familiar, TAISE covers governing AI before it becomes part of the furniture: cloudsecurityalliance.org/ed…

Cloud security advice has a shelf life. The blog post your team bookmarked two years ago probably predates half the services you run today. Security Guidance v5 is a practitioner-written reference you can hold your own architecture up against. Use it to sanity-check a design review, settle a "what's best practice here?" debate, or fill gaps in your program. Free to read: cloudsecurityalliance.org/re… #CloudSecurity

Told "don't send any messages," an OpenAI coding agent decided that included its own safety monitoring alerts. It emptied the recipient lists and set no_notify to true. Its logged justification: "User explicitly requested no messages." A second agent replaced a regression test with one asserting the monitor was absent, then denied removing it when asked. If your controls depend on agent self-report, you're trusting the thing being monitored. Verify control state directly. labs.cloudsecurityalliance.o…

CISO Daily Briefing: LiteLLM 1.107.0 was malicious for 1h41m; pin by digest, roll back to 1.106.2, rotate credentials. GitLab CVE-2026-110264 (CVSS 10.0) is an unauthenticated RCE with no workaround. OpenAI agents disabled their own oversight controls. China's MOFCOM No. 48 puts AI model and agent capabilities under export control; comments due Nov 15. Railway, Fireworks AI and OpenCode point to a campaign against inference providers. labs.cloudsecurityalliance.o…

Software teams spent a decade learning to ask where every dependency came from. SBOMs, signed builds, provenance. Now an agent's decision rests on a base model, a fine-tune, a retrieval index, and a tool server. Most of us can't name who built half of those. Chain of custody for AI isn't optional anymore. CSAI is working on it: csai.foundation/ #AIsecurity