Google opens Fairwind, a vetted-access program for its cyber model and CodeMender
Fairwind limits access to Gemini 3.8 Flash Cyber and CodeMender to government and national cyber authorities, critical infrastructure operators in healthcare, telecommunications, energy and financial services, and core technology platforms, with use confined to internal cybersecurity, incident response and penetration testing staff and multi-factor authentication required. Google states more than 650 participating partners globally and names Armadin, CrowdStrike, Palo Alto Networks, Snowflake and Wiz among them.
AI-agent firewall startup AIR Security launches with $50 million from Sequoia and Greenoaks
AIR Security came out of stealth with $50 million raised across two rounds — $10 million led by Sequoia Capital and $40 million led by Greenoaks Capital Partners, with Swish Ventures and Netz Capital also participating — for an inline firewall that screens the instructions, tools and data an AI agent reaches before it acts and maintains a vetted marketplace of add-ons. The company says its own scanning found more than 17,800 public AI add-ons with 6.7 million installations drawing instructions from untrusted external sources, and add-ons impersonating Anthropic and OpenAI that could execute arbitrary code; it reports more than 20 customers, about a quarter of them large enterprises. Angel investors named include Wiz co-founder Yinon Costica and former White House deputy national security adviser for cyber Anne Neuberger.
Wiz honeypots record attackers exploiting MCP servers and self-hosted AI stacks
Over a 90-day honeypot study across self-hosted AI services, Wiz Threat Research observed three attack patterns against AI infrastructure: exploitation of Model Context Protocol servers, including an authentication bypass in LiteLLM's MCP gateway that accepted any bearer token and a command-injection flaw used to drop cryptominers; blind indirect prompt injection against LangChain, Flowise, OpenWebUI and Node-RED deployments, confirmed through out-of-band DNS callbacks; and AI-native post-exploitation in which attackers read a compromised LiteLLM process's Python module state in memory to steal master keys rather than searching files.
Poisoned Rust crates ran a backdoor at compile time, on infrastructure Wiz ties to North Korean campaigns
Wiz reports malicious versions of arrayref@0.3.10, internment@0.8.7 and append-only-vec@0.1.9 on crates.io pulling a typosquatted proc-macro1 dependency whose build script downloads and executes a remote binary, so “building an affected project was sufficient to execute the payload.” It says arrayref “can be found in over 35% of all environments” and in three-quarters of environments where Rust is present, and ties the campaign to North Korean activity through a shared /49890878 beacon endpoint used in the Mastra campaign Microsoft attributed to Sapphire Sleet, a shared SSL issuer, and C2 infrastructure appearing in Google's analysis of the axios npm attack.
Wiz's autonomous red agent found a CI script-injection flaw that GitHub Advanced Security scanned and missed
Wiz reports its Red Agent found a script-injection flaw in the snowflake-connector-net repository's jira_issue.yml workflow, which interpolated an attacker-controlled GitHub issue title directly into a shell script on the issues-opened trigger, and used it to exfiltrate a Jira token with read access to Snowflake engineering, security compliance and bug bounty projects. Wiz says the flaw was introduced on June 18 2026, reported through HackerOne on June 23 and patched the same day, and that GitHub Advanced Security scanned the merged pull request without flagging it; Snowflake found no evidence of unauthorized access.