CISOs debate how much AI autonomy to allow in security centers
Security leaders at a recent roundtable discussed how much autonomy to give AI systems in security operations centers. As teams test AI agents to investigate alerts and suggest responses, questions remain about when humans should have final control, and what limits to place on AI actions like disabling accounts or blocking traffic. Participants emphasized the need for oversight, clear boundaries on AI authority, and safeguards to reverse unintended actions.
- AI agents can now investigate security alerts
- CISOs discussed limits on AI decision-making
- Risks include unintended business disruptions
- Human oversight and reversal mechanisms seen as essential
Sources covering this
More in Cybersecurity
Microsoft releases record number of security patches
Microsoft released updates to fix at least 974 security vulnerabilities across Windows and other products, its largest patch release to date. The update includes critical flaws, some already being exploited, and over 100 rated as dangers that could let attackers seize control of systems. The unprecedented volume is partly due to the use of AI for vulnerability detection, but experts warn that rapid growth complicates efforts to test and deploy fixes.
OpenAI pledges $1 billion for AI cyber defense program
OpenAI has pledged $1 billion in credits to help organizations defending critical U.S. infrastructure—including water utilities, electric grids, local governments, banks, and nonprofits—access its AI-powered cybersecurity tools, training, and support. The "Daybreak for Frontline Defenders" initiative aims to help these sectors strengthen their defenses as AI-driven cyberattacks become more advanced. OpenAI says it will expand the program to partner countries in the coming weeks.
Liquid Network exploit creates $320 million in unbacked bitcoin
Attackers exploited a software bug in Blockstream's Liquid Network, a Bitcoin sidechain, creating about 4,000 unbacked Liquid Bitcoin (L-BTC) and withdrawing $320 million. The attackers identified themselves as white hat hackers and have returned most funds, retaining around $47 million. According to Blockstream, the incident did not involve compromised multisig keys but was caused by a vulnerability in recent node software.
Cisco Secure Firewall vulnerabilities exploited in active attacks
Cisco Talos reports active exploitation of two vulnerabilities in its Secure Firewall Management Center software. One flaw, rated critical, lets remote attackers bypass authentication and gain root access, while a second allows login with low privileges; both can be combined for further attacks. Exploitation is attributed to both state and criminal groups, including ransomware operators. Cisco urges customers to install released patches immediately.