Microsoft Security Blog
Your source for the latest in cybersecurity
Featured Posts
What’s new in Microsoft Security: November 2026
Microsoft Security’s November 2026 updates strengthen AI agent security, least privilege, threat protection, and exposure management.
Microsoft named a Leader in the 2026 Gartner® Magic Quadrant™ for AI Agent Management Platforms
Read why Gartner named Microsoft a Leader in the inaugural 2026 Magic Quadrant for AI Agent Management Platforms.
Agents are your newest insiders. Security must move at their speed.
New capabilities in Microsoft 365 E7 and Project Perception help organizations contain agent risk and adapt protection continuously.
Managing open-weight model risk in enterprise deployments
New whitepaper from Microsoft and NVIDIA helps enterprises manage open-weight AI model risks with a shared taxonomy, evaluations, and controls.
Threat intelligence
-
Trained to betray: How post-training supply chain attacks hijack coding agents
Microsoft Defender Research and the AI Red Team discuss how poisoned datasets and poisoned model checkpoints can trigger remote code execution and other malicious activities. -
The global socket: how threat actors are weaponizing GSocket for stealthy C2
Threat actors are deploying GSocket on compromised Linux servers to keep encrypted remote access after the original vulnerability is patched. -
Detecting sleeper agents hiding in AI model neurons
Microsoft Research has released new threat research detailing how a capable agent model could be turned into a sleeper agent by editing fewer than ten neurons to inject a short payload; Microsoft Research has also found that this threat is detectable by frontier agents, which can identify anomalous weight edits.
Stay ahead of threats
Get expert insights, threat intelligence, and the latest cybersecurity reports from Security Insider.
AI and machine learning
-
Trained to betray: How post-training supply chain attacks hijack coding agents
Microsoft Defender Research and the AI Red Team discuss how poisoned datasets and poisoned model checkpoints can trigger remote code execution and other malicious activities. -
Lessons from 59 Linux Kernel Bug Reports
Microsoft FORGE Lab researchers used codename MDASH to investigate Linux kernel vulnerabilities, resulting in 59 upstream bug reports, 33 assigned CVEs, and 38 merged fixes. -
FORGE Lab uses agentic tools to identify memory safety issues in Rust
Microsoft FORGE Lab researchers found memory-safety bugs in Rust’s core and std libraries, including cases where safe Rust code can trigger undefined behavior.
Modernize your security operations center
Confidently secure your multicloud, multiplatform environment with Microsoft Sentinel – a cloud-native security information and event management (SIEM) solution.
Latest posts
-
Trained to betray: How post-training supply chain attacks hijack coding agents
Microsoft Defender Research and the AI Red Team discuss how poisoned datasets and poisoned model checkpoints can trigger remote code execution and other malicious activities. -
The global socket: how threat actors are weaponizing GSocket for stealthy C2
Threat actors are deploying GSocket on compromised Linux servers to keep encrypted remote access after the original vulnerability is patched. -
Lessons from 59 Linux Kernel Bug Reports
Microsoft FORGE Lab researchers used codename MDASH to investigate Linux kernel vulnerabilities, resulting in 59 upstream bug reports, 33 assigned CVEs, and 38 merged fixes. -
Detecting sleeper agents hiding in AI model neurons
Microsoft Research has released new threat research detailing how a capable agent model could be turned into a sleeper agent by editing fewer than ten neurons to inject a short payload; Microsoft Research has also found that this threat is detectable by frontier agents, which can identify anomalous weight edits. -
FORGE Lab uses agentic tools to identify memory safety issues in Rust
Microsoft FORGE Lab researchers found memory-safety bugs in Rust’s core and std libraries, including cases where safe Rust code can trigger undefined behavior. -
ARTEX abuse expands as cybercriminals target financial sector
In October 2026, the financially motivated threat actor Storm-3358 began targeting organizations in the financial sector using the agentic AI offensive framework ARTEX.