⚡️ This Week in AI: AI security becomes an execution-layer problem

[Askal]

This week’s AI security news is about operational control: how defenders map AI-enabled attacks, govern frontier models, secure agentic platforms, and reduce real-world abuse from ransomware tooling to deepfake scam calls. The through-line is clear: AI risk is no longer confined to model behavior. It now runs through tools, agents, identities, workflows, policy, and everyday user interactions.

Let’s get into it.

Anthropic Maps a Year of AI-Enabled Cyber Threats

Anthropic analyzed 832 accounts banned for malicious cyber activity and mapped the behavior against MITRE ATT&CK. The findings show attackers using AI deeper in the attack lifecycle, including lateral movement, account discovery, privilege escalation, and multi-step orchestration.
🔗 Read the analysis

AI-Built Ransomware Toolkit Automates EDR Evasion

Sophos found that a threat actor used Cursor and Claude Opus agents to help build a ransomware toolkit for Active Directory discovery, payload development, and EDR evasion testing. The AI was not acting autonomously inside victim environments, but it accelerated malware R&D and helped turn offensive research into working tooling faster.
🔗 Read the coverage

White House Signs AI Innovation and Security Executive Order

The White House issued an executive order on advanced AI innovation and security, including cyber defense priorities, a cybersecurity clearinghouse, and a voluntary framework for government access to covered frontier models before release. The order links frontier model governance directly to cyber capabilities and critical infrastructure defense.
🔗 Read the executive order

Microsoft Build Puts Agent Security Into the Developer Stack

At Build 2026, Microsoft announced a broad agent platform push, including Agent 365, local agent sandboxing, ASSERT for policy-driven safety evaluation, the Agent Control Specification, and Codename MDASH for agentic security testing. The announcements show agent governance, containment, and runtime controls moving into the default developer platform.
🔗 Read the Build roundup

Google Adds Android Protection Against AI Deepfake Scam Calls

Google introduced fake call detection for Phone by Google, designed to verify whether a call is actually coming from a saved contact’s device. As voice cloning and number spoofing make impersonation scams harder to detect, Android is adding real-time verification at the call layer.
🔗 Read the Google Security blog

OpenAI Releases Frontier AI Governance Blueprint

OpenAI published a blueprint for U.S. frontier AI governance, calling for a federal framework, a stronger CAISI, and broader resilience planning for national security and public safety risks. The proposal reflects a growing push to treat model capability, cyber risk, and democratic oversight as connected governance challenges.
🔗 Read the blueprint

ICYMI: Check Point Defines the AI Defense Plane

AI has become a new enterprise execution layer, spanning employees using AI tools, applications embedding AI, and agents that access data, call APIs, and take action. Our AI Defense Plane brings discovery, protection, governance, and assurance into one operating model so security teams can control the full path of AI behavior, not just isolated prompts or models.
🔗 Read the article

From AI-enabled attack chains to deepfake scam calls and frontier model governance, this week shows how quickly AI security is becoming an architecture problem. The model still matters, but the real challenge is controlling the execution layer around it: the tools, permissions, data flows, safeguards, and human decisions that determine what AI can actually do.

See you next week!