A fact-based update for security and risk professionals, focused on how AI is reshaping the threat landscape and the defensive stack.

Core Security Intelligence

1) Microsoft patches six actively exploited zero-days in February Patch Tuesday

Microsoft’s February 2026 security releases addressed roughly 60 vulnerabilities, including six actively exploited zero-days. Multiple independent write-ups underscore the urgency of testing and deploying the updates, especially where bypass and user-interaction paths can translate into practical compromise chains.

Source:
6 actively exploited zero-days patched by Microsoft with February 2026 updates
February 2026 Patch Tuesday coverage and zero-day context
Patch Tuesday February 2026 edition
The February 2026 security update review
Microsoft’s Valentine’s gift to admins: 6 zero-day fixes

Why it matters
Patch Tuesday is an AI security issue because exploitation pressure increases on identity, endpoint, and productivity stacks that copilots and agents depend on. Zero-days that bypass security prompts or reduce friction in execution paths create downstream risk for AI-enabled workflows and sensitive data access.

Defenses

• Prioritize patching for the exploited zero-days first, then broaden coverage to the remaining fixes based on exposure and asset criticality. Use staged rollout with rapid validation for high-risk endpoints and servers.
• Strengthen compensating controls while patching, including attack surface reduction rules, application control, and monitoring for exploit-like behaviors.
• Ensure SOC playbooks include rapid token revocation and endpoint isolation. AI-driven workflows can amplify impact once an endpoint is compromised.

Expert insight
In many environments, the most realistic AI-adjacent compromise path is still classic exploitation plus identity abuse. Patch velocity and containment speed remain the best counters to attacker iteration.

2) Cisco Talos highlights command injection risk affecting GitHub Copilot and VS Code

Cisco Talos’ Patch Tuesday analysis notes a command injection issue impacting GitHub Copilot and Visual Studio Code, emphasizing how improper character handling can lead to unauthorized command execution.

Source:
Microsoft Patch Tuesday for February 2026, Talos coverage

Why it matters
Developer copilots sit close to code, terminals, and build artifacts. Any path that turns assistant-mediated input into command execution creates a direct line from content manipulation to system impact.

Defenses

• Patch affected components promptly across developer fleets, including managed developer workstations and CI runners where applicable.
• Reduce the blast radius by tightening local privileges, controlling script execution, and restricting what tooling can invoke shells or write to sensitive paths.
• Monitor for abnormal developer tool behavior such as unexpected process spawns, suspicious child processes, or outbound connections following Copilot interactions.

Expert insight
Copilot risk is less about the model and more about the execution boundary. When assistants become orchestration layers, injection becomes an operational control-flow problem.

3) Microsoft reports AI recommendation poisoning targeting memory and personalization features

Microsoft security researchers described a trend they call AI Recommendation Poisoning, where adversaries manipulate AI memory or personalization behaviors for promotional or influence outcomes.

Source:
Manipulating AI memory for profit, the rise of AI recommendation poisoning

Why it matters
Memory and personalization are becoming default features in assistants and agents. If attackers can shape what a system remembers, they can influence future outputs, steer user decisions, and create subtle integrity failures that are difficult to detect as a traditional incident.

Defenses

• Treat memory writes as privileged events. Log them, rate-limit them, and require clear provenance for what gets stored.
• Implement integrity controls that detect unusual patterns such as repeated promotional content, suspicious repeated entities, or sudden shifts in recommended actions.
• Provide users and admins clear tools to review, prune, and reset memory, with auditable change history.

Expert insight
Recommendation poisoning is an integrity attack more than a confidentiality attack, but the business impact can be just as real. It is the kind of low-noise manipulation that security teams often miss without explicit telemetry.

Adjacent Cybersecurity Developments

4) Palo Alto Networks completes acquisition of CyberArk, emphasizes agentic identity security

Palo Alto Networks announced completion of its acquisition of CyberArk, positioning the combined capabilities around unified security for human, machine, and agentic identity.

Source:
Palo Alto Networks completes acquisition of CyberArk to secure the AI era

Why it matters
Agentic AI raises the priority of non-human identity governance. If agents and automations are not managed like privileged identities, organizations will struggle to enforce least privilege, auditability, and safe delegation.

Defenses

• Inventory non-human identities used by AI systems, including service accounts, API keys, and agent tokens. Assign owners and review schedules.
• Prefer short-lived credentials, strong secrets management, and explicit scopes per integration.
• Require full audit trails for agent actions, including what data was accessed and what changes were made.

Expert insight
The AI era increases the number of identities you must govern. Any identity program that only accounts for humans is already behind.

5) North Korea-linked group uses AI-themed lures in campaigns targeting crypto and tech

Reporting on UNC1069 describes the use of lures, social engineering, and multi-stage malware to harvest credentials and tokens, with emphasis on how attackers adapt messaging and tooling to increase success rates.

Source:
North Korea-linked UNC1069 uses AI lures to attack crypto firms

Why it matters
AI-themed lures and deepfake-adjacent persuasion tactics continue to compress the time between initial contact and credential compromise. Once session tokens are captured, AI-enabled assistants and integrated tooling can accelerate lateral movement and data access.

Defenses

• Enforce phishing-resistant MFA and bind sessions to device posture where possible to reduce token replay value.
• Harden collaboration and meeting workflows, including validation of external meeting invites and verification steps for high-risk transactions.
• Monitor for anomalous token use patterns and implement rapid session invalidation when suspicious activity is detected.

Expert insight
The most dangerous AI aspect of many campaigns is not the payload. It is the attacker’s ability to iterate persuasion faster and personalize at scale.

6) Industry leaders warn AI attacks are moving into the physical world

A SentinelOne executive warned that AI systems in real-world applications, such as robotics and autonomous systems, will become attractive targets for adversaries as multimodal manipulation becomes more practical.

Source:
Hackers are coming for AI in the physical world

Why it matters
Physical AI systems collapse cyber and safety risk into one domain. Adversarial inputs, model poisoning, and sensor manipulation can translate into real-world impact beyond data loss.

Defenses

• Expand threat modeling to include adversarial physical inputs and sensor spoofing, not just traditional network threats.
• Implement strong integrity checks on training data, model updates, and telemetry pipelines.
• Add redundant safety controls that do not depend solely on model inference, including kill switches and independent validation layers.

Expert insight
As AI moves into physical systems, the security question becomes safety-critical. That changes the acceptable risk threshold and the rigor of assurance required.

At-a-Glance Summary

Categories: Cybersecurity Blog, Cybersecurity News

Tags: Agentic AI, AI Security, Identity Security, Non-Human Identity, Patch Management, Prompt Injection, Security Engineering, Threat Intelligence, Zero-Day