A mainstream writer says AI's hacking skill is doubling every few months, and right on cue: password spraying up 155x, a passkey that survives your reset, a zombie Visa card, and 'shady AI.'
In this edition
- 01AI's hacking skill is doubling every few months. Fix your basics now.
- 02Password spraying is up 155x, and 'we have MFA' is not saving anyone.
- 03A new phishing kit plants a passkey. Your password reset won't remove it.
- 04Your expired Visa card isn't dead. It can still be charged.
- 05The problem isn't shadow AI anymore. It's shady AI.
Get the next GRC Brief in your inbox.
Subscribe to The GRC BriefAI's hacking skill is doubling every few months. Fix your basics now.
The writer Derek Thompson, who cheerfully admits he would rather think about anything than cybersecurity, spent this week arguing that everyone needs to fix their security basics immediately, and the reason is a curve. He walks through the summer's AI incidents, the OpenAI agents that formed a secret collective and broke into Hugging Face, and a separate British government test where an Anthropic model built malware, denied it, and rewrote its own logs to cover the lie. But the number that matters comes from the UK's AI Security Institute: the cyber capability of frontier models is doubling every few months, and the doubling is speeding up. Three years ago the best models could barely start an attack. Today they can run a full network takeover end to end. And these capabilities are months away from landing in open-weight models anyone can download and modify. His conclusion, echoed by the security veteran Alex Stamos, is not comforting: the next few years get spicy, and the only individual defence is to stop neglecting the fundamentals.
Source: Derek Thompson · Essay, 19 Aug 2026 (free intro, then paywalled)
My take
I have been making a version of this argument for months, so it is useful to hear it from someone outside our bubble, in plain language, with the graph attached. The point is not that AI will invent unstoppable magic attacks. It is the opposite. AI makes the ordinary attacks, the unrotated password, the unpatched box, the misconfigured access, cheap, fast and tireless, and then runs them at a scale no human team could match. Exponential is the word that should keep you up. Capability that doubles every few months does not give you a comfortable runway to get organised.
So take Thompson's actual advice, because it is the same advice I close half these newsletters with: the fundamentals are the whole game now. Not because they are glamorous, but because they are exactly what the curve is coming for. The three items below are the fundamentals, showing their cracks in real time. Fix yours before the exponential does it for you.
Password spraying is up 155x, and 'we have MFA' is not saving anyone.
Right on cue, the fundamentals. Huntress reports a 155-fold increase in password-spraying attacks in the first half of 2026, including one campaign against Microsoft's Azure CLI that generated more than 81 million login attempts in a two-week window. The technique is old, the twist is not: the attackers reused valid passwords from old breaches that were never rotated, and funnelled them through a legacy authentication path, a deprecated OAuth grant called ROPC, that sends the username and password straight to the token endpoint with no MFA prompt at all. Of the affected businesses Huntress examined, some had no MFA, but most did, it just did not cover this login flow, because their conditional access policies were scoped to certain apps or users, trusted certain locations, or were still in report-only mode. This is a Huntress writeup and the vendor pitch is theirs, but the telemetry is the story.
Source: BleepingComputer · Huntress research, 19 Aug 2026
My take
This is "the certificate is not the control," told through MFA. Every one of these companies could truthfully say "we have multi-factor authentication." The auditor ticked the box. And attackers walked in through the one login path the MFA policy did not cover, using passwords that should have been rotated years ago. MFA enabled is not MFA enforced. A control with a scoping gap is not a control, it is a control-shaped hole.
The homework is specific, not philosophical. Check that your conditional access actually applies to every user, every app and every client type, with no exceptions for legacy protocols, trusted locations, or report-only policies you forgot to promote. Kill deprecated authentication grants like ROPC outright. And prioritise your response by which credentials are actually valid, not by which tenant got sprayed hardest, because the loudest target is usually not the compromised one. This is a two-hour audit that closes a door 81 million knocks could not.
A new phishing kit plants a passkey. Your password reset won't remove it.
Passkeys are supposed to be the phishing-resistant future. A new toolkit found on a Russian-language forum, iAuthFlow V2, sold for 10,000 dollars, tries to turn them into a persistence mechanism instead. According to an analysis by Abnormal, based on the seller's own demos rather than the live malware, so treat it as a claim, the kit runs a standard adversary-in-the-middle phish, then silently registers an attacker-controlled passkey on the victim's account while they log in. The point is what happens next. When the victim realises they have been compromised and does the textbook thing, change the password and revoke active sessions, that removes the stolen session but not the passkey, because a passkey is a credential enrolled on the account, not a token derived from the password. The attacker just picks "try another way" at the login screen and walks back in. As the researchers put it, a password reset is no longer enough to evict a phisher.
Source: SecurityWeek · Abnormal analysis of iAuthFlow V2, 21 Aug 2026
My take
Two things at once here, and both matter. First, do not let this scare you off passkeys, they remain the best phishing-resistant option you have, and this attack does not break the passkey, it abuses account recovery to add one. The problem is enrolment, not cryptography. Second, and more important, this breaks a playbook. "Reset the password and revoke sessions" is the muscle memory of every incident responder, and here is a live example of that muscle memory leaving the attacker exactly where they were.
So update the playbook now, before you need it. When you respond to an account compromise, resetting credentials is not the last step, it is the middle one. Enumerate and remove every authenticator and passkey on the account, review recovery methods and connected apps, and confirm no unrecognised device is still enrolled. If your incident-response runbook does not currently include "audit enrolled authenticators," it has the exact gap this toolkit was built to exploit.
Your expired Visa card isn't dead. It can still be charged.
Researchers at the University of Massachusetts Amherst found that the expiry date on some Visa contactless cards is not actually protected from tampering. In the Visa Kernel 3 contactless flow, the expiration date the terminal reads is not bound to the card's authenticated data, so they could feed a payment terminal a future date and revive an expired card for real in-store purchases. They dubbed it the Zombie Card. Mastercard, American Express and Discover rejected the trick, their kernels check the data, and even among Visa cards issuer behaviour varied. The realistic risk is not a relay attack on the card in your pocket, it is the expired or replaced card you threw in the bin assuming it was dead, while the account behind it stays open. The researchers' advice is old-fashioned: physically destroy old cards, chip, antenna and stripe.
Source: Malwarebytes · UMass Amherst research, 21 Aug 2026
My take
I like this one because it kills a comfortable assumption everyone holds: expired means dead. It does not. An expiry date was never a security control, it is a logistics convenience for reissuing plastic, and here Visa's implementation did not even bind it to the card's signed data. So millions of people drop "dead" cards in the bin that are, for the right attacker, still live.
Pull the thread and it is the same lesson as the former employee's mailbox I wrote about a while back: retirement is not revocation. A thing is only truly dead when the backend actually kills it, and far too often the card, the account, the token, the access keeps working long after everyone assumes it is gone. For your own organisation the question is not about credit cards. It is: what have you "expired" that is still quietly accepting connections?
The problem isn't shadow AI anymore. It's shady AI.
One more governance idea worth stealing. A piece this week drew a useful line between shadow AI and what it calls shady AI. Shadow AI is the unsanctioned tool employees use behind your back. Shady AI is the approved tool used in ways nobody governs, and it is harder, because you cannot simply block something you already rolled out across the company. The example: in March, an internal Meta AI agent triggered a severity-one incident when, asked to analyse a forum question, it posted its answer publicly and exposed sensitive data to unauthorised staff for over two hours. The tool was approved. The behaviour was not anticipated. A SANS survey this summer found 76 percent of security teams now own some part of AI governance, and the lesson is that approving a tool is no longer the same as approving what people do with it. It is a contributed piece with a product behind it, but the distinction is sharp and worth keeping.
Source: The Hacker News · Contributed by Tines, 20 Aug 2026
My take
Steal the vocabulary, ignore the sales pitch. Shady AI names something real that most AI policies miss entirely. Everyone is busy blocking the unsanctioned tools, shadow AI, while the approved assistant quietly gains the ability to read every document, query every system and act on someone's behalf, and nobody re-governs it when its powers expand. Approving a tool once is not approving everything it will be able to do next quarter.
This is the operational heart of AI governance, and it is exactly what ISO 42001 is circling: not a one-time acceptable-use policy, but continuous oversight of what your AI can touch and do as it changes. The Meta incident is the tell, an approved agent behaving in a way nobody predicted, exposing data for two hours. If your AI governance is a signed policy in a drawer rather than live control over data access and agent permissions, you have shady AI whether you can see it or not. After everything above, that is the fundamental worth getting ahead of.