Welcome to The Cybersecurity Pulse (TCP)! I’m Darwin Salazar, Head of Growth at Monad and former detection engineer at Datadog. Each week, I bring you the latest security innovation and industry news. Subscribe to receive weekly updates! 📧

Subscribe now

Howdy 👋🏽

Quick heads up, I’m switching up the format a bit this week.

Picks of the Week > Threats + Research > Product Releases > Funding + M&A.

Typically, I’ll run the top 3-5 stories I think you should care about most per section, each week. There’s ridiculous amounts of noise, slop, and FUD in security. TCP should be a compass for you whether you’re a CISO, engineer, founder, investor, GTM operator or anything in between.

Consider this format officially in beta. Tell me if you hate it or if you like it or if you have any other ideas which would improve your reading experience!

Re: upcoming issues: I’ll soon be going on vacation in Black Rock City so I’ll ship a special edition post in place of our weekly TCP coverage next week. The following week, our new contributing author (soon to be announced!), will ship TCP weekly.

Re: work life: here’s a blog I wrote on Anthropic Compliance API Activity feed detection opps + gaps. 101 log source footprinting.

Re: personal life: I’ve been DJ’ng a bit. It’s a fun hobby. I have 6 gigs over the next 3 weeks. If you happen to be in Austin this Saturday, pop by Zilker. I play at 9pm. RSVP.

Before we dive in, here’s my favorite meme of the week and an ad from our friends at Intruder!

t? samson reposted
Luke Berry
@LukeberryPi . 9h
8 ...
introducing: JDD
Jealousy Driven Development
are these the best fixes? codex suggested something
better
+
= X
Claude Fable 5
cursor/habit-mode-ui-016 v
This Mac v
104
27 1K
C
16K
ilil 326K

Pentest with every major release. Security that keeps up with engineering.

Your engineers ship multiple times a week. Your pentest happens once a year. That means most new code goes live without any real depth of testing. Intruder’s AI pentesting gives you the depth of a manual engagement on-demand. No scoping calls, no six-week lead times, at a fraction of the cost.

Catch complex vulnerabilities that human testers miss and get an audit-ready report in hours.

See pricing

🗞️ TL;DR

🇹🇼 Taiwan: The government confirmed a campaign combining human operators with AI agents. Dream’s investigation provides the detailed attribution, scale, and impact figures.
⚔️ Private firms could run offensive cyber ops: A new White House memorandum directs DHS to create a federally controlled program in which vetted companies could eventually conduct surveillance and disruptive operations against specified foreign criminal organizations.
🧪 OpenAI: The Hugging Face incident and Astra’s advanced cyber capabilities prompted stricter sandboxes, token-level monitoring, a 30-minute stop rule, and pauses on some training.
🚨 Threat activity: U.S. agencies warned that actors are using AI-generated tooling against Siemens industrial controllers, Lazarus burned a Windows zero-day, and CISA confirmed active exploitation of a critical MLflow flaw.
🛠️ Security releases: Google Cloud shipped usable post-quantum controls, CodeRabbit moved into security, and Signal added automatic key verification.
💰 Funding & M&A: Fortinet closed its acquisition of Virtue AI, Cribl bought Radiant Security’s AI SOC technology, and Mindgard raised $30 million.

⚒️ Picks of the Week

Taiwan confirms an AI-assisted attack on government agencies

Taiwan’s Ministry of Digital Affairs confirmed that an attacker group combined manual operations with AI-agent assistance during a July campaign against government agencies. The more detailed attribution, autonomy analysis, and impact figures come from Dream’s investigation.

Dream’s reconstruction says a Hermes and OpenClaw setup ran up to eight subagents in parallel, mapped 21 connected government systems, cracked 85 employee credentials, and extracted at least 2,564 personnel records in roughly four days. The recovered workspace also showed agents ranking attack paths and rechecking their own findings. Dream cited a Chinese-language operator without naming either party; the Financial Times identified the target as Taiwan.

*Dream’s reconstruction of the attack chain. Source: Dream Security.*

What gets me is more the speed more than the novelty. Dream describes the agents moving through exposed debug endpoints, unauthenticated APIs, predictable passwords, an unsigned JWT flaw, and over-trusted SSO in four days.

Sure, a human still picked the target and objective, so this is not a fully autonomous attack story. It is a look at what happens when familiar weaknesses get tested in parallel, without much downtime between steps.

Access decisions at machine speed, with human judgment. Paladin is now GA.

“It denied a deliberately bad admin request with better reasoning than most human reviewers would give.”

Agent and non-human identities on Opal’s platform grew 2,300% in the last year, each holding 3x the entitlements of a person. No team reviews that volume by hand. Paladin does. Someone requests prod access at 2am: it checks the linked incident, confirms they’re on call, weighs the request against your policy, and recommends a time-boxed grant with its reasoning shown. No match? It declines or escalates to a person. You set the autonomy dial. Every decision is logged and audit-ready.

See Paladin in action

OpenAI pauses model testing and some training after the Hugging Face incident

OpenAI has paused model testing for two weeks and separately paused training on its next-gen Astra models. It also tightened sandboxing, internet isolation, and automated monitoring. New rules target alerts within 30 minutes and require pausing a test when teams cannot clear a concerning flag within that window.

The catalyst for this was July’s Hugging Face incident which we’ve covered in previous issues and is detailed below.

Seems like there were 800 agent breakouts in late July/early Aug., good to see labs continuing to improve security.

The White House directs DHS to build a controlled lane for private offensive cyber operators

U.S. President Donald Trump delivers remarks at Red Rock Casino Resort Spa in Las Vegas

Security has argued about private-sector hack back for as long as I’ve been in security. The house has always been divided. This new proposal from the White House is narrower: private operators would work under federal supervision.

A new national security presidential memorandum authorizes cyber tools against foreign transnational criminal organizations and directs DHS, with Justice Department oversight, to build a federally supervised program. If and when it becomes operational, vetted companies could gather threat information, propose operations, and conduct cyber surveillance or effects.

Some threat actors operate through a victim’s compromised infrastructure, so what happens when the “hack back” takes down the infra of a legitimate corp/victim? The devil is in the details.

CoSnitch turned Copilot’s own answers into attack reconnaissance

“Meta-hacking: How we got Copilot to snitch on itself” - Varonis

Repeated follow-up questions led Microsoft Copilot Personal to disclose an undocumented autorun URL parameter and prompt-handling details. A victim who clicked a crafted link could then trigger a prompt inside an authenticated session, query connected services, and exfiltrate encoded results through Copilot’s URL-fetch capability. Separately, researchers used indirect prompt injection through web summarization to write attacker-controlled instructions into Copilot’s persistent memory.

Varonis says it disclosed CoSnitch in December 2025 and that fixes shipped August 18. Microsoft told Dark Reading that no customer action was required and enterprise users were unaffected. Varonis says it found no exploitation.

The cool thing about investing in vuln research for specific ecosystems is that you become super familiar with it and end up discovering a slew of interesting things. Varonis has hit the jackpot on MSFT Copilot vulns and Copilot users can learn a lot from their research.

Walmart puts trusted observers inside its purple-team exercises

This was my favorite practitioner piece of the week. Walmart moved its red and blue teams into the same business unit and physical location, then introduced “trusted agents” into full adversary-emulation exercises.

Blue-team observers sit with the red team, check telemetry, logs, and detections in real time, and make sure the exercise does not damage production. Their job is not to tip off the defenders. The teams validate detections while the attack is still happening. When defenders make an attack path harder, the red team gets immediate feedback and has to pivot. This is textbook purple teaming.

DarkReading published a few pieces on how Walmart thinks about SecOps + Purple Teaming which you can find here.

🔬Threats & Research

Wiz’s Red Agent found a Snowflake CI/CD flaw five days after it went live

Screenshot demonstrating access to Snowflake’s Jira portal, via an exfiltrated token

Wiz says its Red Agent found a GitHub Actions script injection in Snowflake’s public snowflake-connector-net repository. A crafted issue title could execute commands in a workflow and expose a Jira token with read access to internal engineering, compliance, and bug-bounty projects.

Snowflake patched the workflow on June 23, five days after the vulnerable change went live, and rotated the token the next day. Snowflake said it found no evidence of unauthorized third-party access, while Wiz said it matched all anomalous queries to its testing IPs.

Cool BTS look at how AI pen testing helps secure enterprises.

Post-DEF CON phish chains X, Google Docs, and DocSend

Actor commenting on other cybersecurity accounts — The X account (fake VP mktng @ Coindesk) commenting on other cybersecurity accounts after DEF CON in an attempt to use the "conference planning" lure

A threat actor posing as CoinDesk’s VP of marketing approached a Huntress researcher after Black Hat and DEF CON with a fake conference-planning pitch. The researcher spotted it and kept talking to map the playbook; the actor moved from a Google Doc with an Apps Script sidebar to a fake DocSend installer delivering AMOS on macOS or Ledger-focused malware and a traffic-intercepting proxy on Windows. When neither worked, the pitch somehow became an offer of up to $1 million in funding. Conference follow-ups are supposed to feel warm and familiar, which is exactly what made this workflow useful as a lure.

Lazarus turns a Windows zero-day into an EDR-blinding chain

High-level overview of the DLL sideloading infection chain.

Check Point attributes a defense and aerospace campaign in Europe and India to North Korea’s Lazarus Group. Fake job offers, impersonation sites, and trojanized PDF viewers led to exploitation of CVE-2026-68820 in Windows AFD.sys, SYSTEM access, and deployment of the EDR-blinding FudModule rootkit. Compromised Roundcube and WordPress servers relayed command-and-control traffic. Microsoft patched the actively exploited flaw August 11.

Attackers are abusing the macOS Screen Sharing authentication flaw

Apple patched CVE-2026-65400 across supported macOS releases on August 6. The flaw lets a network attacker authenticate to Screen Sharing without valid credentials. On August 12, the Dutch NCSC reported active exploitation of internet-exposed TCP 5900, with attackers gaining root and installing Monero miners. Screen Sharing is disabled by default. Exposed deployments should update, disable the service where unnecessary, and remove TCP 5900 from direct internet exposure.

📦 Security Product Releases

Google Cloud sets out its post-quantum roadmap

*Visualization of our Google Cloud PQC roadmap.*

Google Cloud’s August 11 update combines tactical controls teams can implement today with a multi-year plan. Cloud KMS support for ML-KEM, ML-DSA, and SLH-DSA is generally available. Google Cloud API endpoints already use hybrid ML-KEM, and application and proxy load balancers can opt into TLS 1.3 X25519MLKEM768. Cloud VPN, Interconnect, developer tooling, and data transfer are targeted for 2026 or 2027, while certificate, IAM, HSM, and supply-chain work extends through 2028. Google’s overall readiness target is 2029.

Google has been working on quantum for a decade+. Great to see them continuing to invest in this space while rest of the world focuses on AI security. Quantum will come slowly and then all at once, imo.

Signal adds automatic key verification

Signal’s August 11 release adds optional automatic key verification, backed by a verifiable key-transparency log, to supplement manual safety-number comparisons. When Signal knows a contact’s phone number, users can ask the app to verify that the encryption key bound to it matches the log. Cloudflare and Trail of Bits serve as independent auditors. The practical value is that key mismatches can surface without asking users to manually compare a wall of safety-number digits. Automatic verification still has limits: it does not establish real-world identity, catch every account compromise, or work for username-only contacts.

Mallory makes bring your own key generally available

Mallory recently made BYOK GA on August 18 across every plan. Here, BYOK refers to an LLM-provider API key, not a customer-managed encryption key. Teams can run Mallory workflows against approved OpenAI, Anthropic, Gemini, or OpenRouter accounts, with inference billed by that provider. Keys are encrypted and injected through a credential proxy.

Mallory is a leading threat intel platform founded by Jonathan Cran.

CodeRabbit moves into security and agentic change management

CodeRabbit rolled out Agentic Change Management and Security. Security scans committed code for reachable auth flaws, IDOR, injection, data exposure, and prompt injection, then verifies findings and can open remediation PRs. Triage prioritizes incoming PRs, while Change Stack breaks large changes into semantic groups.

CodeRabbit is a leading AI code review platform. Makes sense that anything that touches PRs should start going after code security.

🤝 Funding & M&A

Fortinet closes its acquisition of Virtue AI

Fortinet completed its acquisition of Virtue AI on August 17. Virtue adds shadow AI and MCP discovery, automated red teaming, runtime guardrails, and continuous attack simulation. Fortinet positions those capabilities as a complement to FortiAIGate and its broader AI-native Security Fabric. Financial terms were not disclosed, and Fortinet said the consideration was ‘immaterial’.

Fortinet is betting that AI security becomes another control layer inside the platform instead of a standalone island. What I’ll be watching is how Virtue’s product identity carries into the broader platform and where its capabilities surface first.

Cribl buys Radiant Security’s AI SOC technology

Cribl acquired the technology behind Radiant Security’s AI SOC platform, which builds triage logic for individual alerts and investigates them against telemetry.

Cribl plans to turn it into an application on its telemetry platform. This is its second security deal of 2026 after CardinalOps, and the direction is getting pretty clear: Cribl wants its telemetry layer to power more of the work analysts actually do.

Mindgard raises a $30 million Series A

Mindgard raised a $30 million Series A led by Album VC, with Karma Ventures and existing investors participating. The company tests and monitors models, applications, and agents for prompt injection, data leakage, model manipulation, and multi-step attack paths.

Brinqa acquires PlexTrac

Brinqa acquired PlexTrac, bringing pentest workflows, offensive-security validation, reporting, and post-remediation retesting into its exposure-management platform. PlexTrac will remain available as a standalone product, and founder Dan DeCloss is joining Brinqa’s executive team and board. Financial terms were not disclosed.

More OffSec consolidation coming? 👀

Cloudflare prices $2.175 billion of 0% convertible notes

Cloudflare priced $2.175 billion of 0% convertible notes due 2031, with a $325 million buyer option and roughly $2.14 billion in expected net proceeds. Funds may support general corporate purposes and strategic transactions, but no acquisition was announced. The initial conversion price carries a 60% premium to Cloudflare’s August 10 close. In plain English, Cloudflare just priced a large pool of capital with zero cash interest. Conversion rights and potential dilution are the trade.

Team8 announces $365 million in new fund capital

Team8 announced $365 million in new fund capital. The total includes a $265 million Capital Fund III and more than $100 million in a follow-on pool.

Team8 has backed Claroty, Akeyless, OX Security, IONIX, and Nagomi, plus exits including Talon and Dig Security to Palo Alto Networks, Gem Security to Wiz, Portshift to Cisco, and Illusive Networks to Proofpoint.

Team8 says it will back seed and Series A companies across cybersecurity, software infrastructure, fintech, and digital health, then reserve support for its highest-conviction portfolio companies. The announcement brings Team8’s assets under management across eight funds to nearly $2 billion.

CodeRabbit raises a $143 million Series C

As covered in the product section, CodeRabbit’s Agentic Change Management release arrived with a $143 million Series C co-led by Atomico and Smash Capital, valuing the company at $1.5 billion and bringing total funding to more than $200 million.

Interested in sponsoring TCP?

Sponsoring TCP not only helps me continue to bring you the latest in security innovation, but it also connects you to a dedicated audience of 20,000+ CISOs, practitioners, founders, and investors across 135+ countries 🌎

Learn more here

Disclaimer

The insights, opinions, and analyses shared in The Cybersecurity Pulse are my own and do not represent the views or positions of my employer or any affiliated organizations. This newsletter is for informational purposes only and should not be construed as financial, legal, security, or investment advice.

The Cybersecurity Pulse (TCP)

TCP 142: Taiwan Hit by AI-Assisted Attack…