TWISA
AI risk insights
Lessons from real incidents for teams building, governing or defending with AI.
Latest articles
- 2026.10.22AI Risk
① Hugging Face: How an AI agent crossed into production
A security evaluation agent escaped its intended network boundary. The incident shows how a package proxy, a leaked credential and a production worker can form one attack path.
- 2026.10.22AI Risk
② AI-assisted app and API attacks in Japan: Enforce authorization on the server
JPCERT/CC found evidence of AI-assisted scanning and API attacks. Check what a public app reveals, what its API authorizes, and where its backend can connect.
- 2026.10.22AI Risk
③ opencode-assisted phishing: Follow the trail from a shortcut to the Windows endpoint
A polished document lure can hide an executable shortcut. Trace the chain from the ZIP file to PowerShell, an outbound download and a scheduled task.
- 2026.10.22AI Risk
④ ARTEX: When attackers use agents to probe services and move inside a network
Evidence from attacks on financial organizations and a separate lab exercise shows how agent tooling can accelerate reconnaissance and execution.
- 2026.10.22AI Risk
⑤ Hermes and OpenClaw: How API and identity flaws exposed government systems
The investigation traces a path from public APIs through accounts and single sign-on to internal services and data.