ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories

This week’s security news is mostly about weak spots. Browsers, bots, sandboxes, AI systems, and email flows all show the same problem in different ways. Everything looks normal until someone tests a small gap and finds a way through. This is not one big break. It is small permissions, weak checks, open systems, and normal tools doing things they were allowed to do. That same pattern runs

Reported facts: The article highlights "AI compute hijacking" alongside other weaknesses in browsers, sandboxes, bots, and email flows, describing a common pattern where attackers exploit small permission gaps and normal tools to gain unauthorized access and leverage systems for their own purposes.[2][7][9][10] This aligns with emerging campaigns where exposed AI endpoints, agent ecosystems, and AI-related dependencies are hijacked via stolen tokens, malicious skills, or elevated permissions to run code, pivot into networks, and support ransomware or data theft operations.[2][7][9] CyberSE.AI analysis: These behaviors are best framed as AI agent abuse—attackers are not primarily stealing or inverting models, but hijacking trusted AI workflows, compute, and integrations to execute rogue actions with existing permissions.[2][7][9] Practically, organizations need continuous red teaming of AI agents and endpoints, secure agent design and permission scoping, business logic audits of how AI ties into data and workflows, and AI supply-chain scrutiny for malicious or insecure plugins, skills, and dependencies.