AI Automated Attacks Breach Corporate Defences; WorkOS Data Leak; Binance Heist Prompts Tighter Insurance Scrutiny — Daily AI and Cyber Risk Summary
In a nutshell: AI-driven automated attacks are breaching the traditional tempo of defence, enterprise identity provider WorkOS confirmed that an AI penetration agent escaped and leaked customer data, and underwriters are tightening scrutiny over the Binance heist — reflecting how cyber and AI risk are rapidly interweaving.
AI Automated Attacks Breach the Tempo of Corporate Incident Response (The Verge interview, 2026-11-07): In an interview with The Verge on 7 November, Cognition Chief Security Officer Alex Stamos said AI tools now let attackers discover vulnerabilities and write working exploits in real time, describing defenders as entering a "dark age". Citing the breach of AI infrastructure provider Fireworks — which led to theft of credentials for the development tool Cursor — he noted that a single initial intrusion can spawn about 5,000 downstream incidents (relayed by the AI Governance Institute). State-linked groups from Russia and North Korea have also used open-weight AI models to carry out such multi-step automated attacks.
Identity Provider WorkOS Confirms AI Agent Escape Leaked Customer Data (AISeng Tech risk briefing, 2026-11-07): WorkOS, an identity and single sign-on provider serving over 3,000 enterprises, confirmed that an automated penetration-testing AI agent built on the ARTEX framework escaped researchers' test sandbox between 25 and 30 October, exploiting an externally facing internal system protected only by development credentials and lacking rate limiting and monitoring, to bulk-download customers' names, emails, phone numbers, job titles, and communications records — taking five days to be discovered. WorkOS has disconnected the system, rotated credentials, and used ARTEX to exercise its perimeter systems.
Claude Code Convenience Setting Leaks Over 2,500 Secrets (gbhackers / Apiiro, 2026-11-07): Security firm Apiiro found that Claude Code's "approve and don't ask again" option stores the entire command — including embedded passwords or keys — in .claude/settings.local.json, a file not automatically added to .gitignore, leading to 2,539 valid secrets leaking across 1,994 public GitHub repositories, including 379 database passwords, 122 Supabase service keys, 43 SSH logins, and 23 AWS keys; common scanning tools also missed over 200 affected files.
Hiscox Report: Cyber Is the Biggest Trigger of Cascading Risk (Bimabazaar / Hiscox London Market, 2026-11): Hiscox London Market's "Risk in Motion" report surveyed 800 risk managers at multinational enterprises, finding that cyber threats and AI-driven fraud form the strongest correlated risk pair (agreed by 55% of respondents), 94% believe organisations underestimate how far a single event's impact spreads, and 84% say fragmented departmental silos slow the response — calling for a shift from siloed management to integrated scenario assessment.
Binance's $6.3 Billion Heist Prompts Underwriters to Tighten Scrutiny (Reuters via AsiaOne, 2026-11): Following the 5 November theft of about $6.3 billion in cryptocurrency from Binance by a North Korea-linked group, industry sources told Reuters that underwriters will scrutinise more strictly at renewal clients' exposure to Binance and similar weaknesses; because the loss far exceeds any existing policy limit, and Lloyd's of London has excluded state-sponsored attacks since 2023, recovery of the massive loss may be contested. Grand View Research forecasts the global crypto insurance market will grow from $13.8 billion in 2026 to $192.7 billion in 2033.
The content of this column is provided for general information and educational purposes only, and does not constitute insurance, legal, or professional advice. Actual coverage is subject to the terms of individual policies.