Five AI attacks. The same three blind spots. by Lucie Cardiet

This report reviews five 2025–2026 intrusion cases that illustrate how existing techniques—exposed credentials, unauthenticated APIs, weak JWT handling, SSO pivots, and self-replicating npm malware—are being accelerated or composed by AI-assisted tooling and agentic frameworks; it identifies three detection gaps (activity that looks legitimate, authentication that succeeds, and invisible lateral movement), documents concrete indicators (bursty API requests, rapid 401→200 shifts, parallel authentications, unexpected model usage), and recommends enumerating public front-end assets, validating token algorithms and federation trust, inventorying AI tooling, and prioritizing behavioral correlation over payload hunting.