Companion page for When the Hackers Have AI: Cybersecurity for Executives and Boards by Fas Mosleh. These are the sources behind the Notes at the back of the book, chapter by chapter. Links were checked in November 2026. If one has moved, search for the title.
Chapter 1 · Monday, 9:07 a.m.
- Anthropic GTG-1002 espionage campaign (coverage)
- Jaguar Land Rover attack and attribution (The Next Web, summarizing the New York Times)
- CrowdStrike research on agentic AI campaigns
- IT Brief UK on CrowdStrike’s findings
- “Vibe hacking” extortion case (Malwarebytes)
- Stryker material impact (Cybersecurity Dive)
- Norsk Hydro (Microsoft)
- Norsk Hydro first-quarter cost (Business Insurance)
Chapter 2 · The Collapse
- Verizon DBIR 2025, small businesses and ransomware (Infosecurity Magazine)
- Verizon DBIR 2026 for small businesses (Cyber Readiness Institute)
- Coveware quarterly ransomware reports
- Coveware Q3 2025 (SecurityWeek)
- Chainalysis on 2025 ransomware payments (The Record)
- Sophos, State of Ransomware 2026
- Ransomware downtime costs for manufacturers (Comparitech data)
- Veeam: many who pay don’t get their data back (TechRadar)
- CDK Global dealer losses
- Mexican government breach (Engadget)
- CrowdStrike 2026 Global Threat Report
- FBI 2025 Internet Crime Report (HSToday)
- Unit 42, data stolen in 72 minutes
- Unit 42 (SecurityBrief)
- Anthropic, Project Glasswing initial update
- Palo Alto Networks, frontier AI update, May 2026
- HackerOne on exposure debt
- Five Eyes call to action on AI preparedness
- Co-op revenue loss (Infosecurity Magazine)
- M&S cost of the attack (The Register)
- EU agency confirms ransomware behind airport disruption
Chapter 3 · AI in 20 Minutes
- Model Context Protocol (Anthropic)
- KELA 2026 mid-year AI threat report (Unite.AI)
- Anthropic disables models to comply with export controls (Fortune)
- Export restrictions lifted (Axios)
- Lawyers fined over ChatGPT citations (Bloomberg Law)
Chapter 4 · Faces, Voices and Lies
- UK energy firm voice clone, 2019 (WSJ report via KnowBe4)
- UAE $35 million voice-clone fraud (Gizmodo, on Forbes’s report)
- Arup deepfake (CNN, syndicated)
- Singapore multinational deepfake (Singapore Police Force)
- Singapore Prime Minister deepfake (The Sun, Malaysia)
- WPP deepfake attempt (The Guardian, via PressReader)
- LastPass deepfake call (LastPass blog)
- Ferrari deepfake attempt (Fortune, on Bloomberg’s report)
- KnowBe4 fake IT worker (KnowBe4 blog)
- Anthropic August 2025 threat report, incl. North Korean IT workers (The Register)
- US shuts down laptop farms (The Hacker News)
Chapter 5 · Malware That Writes Itself
- Google GTIG, threat actor usage of AI tools
- Google GTIG, AI adversarial use (February 2026)
- Anthropic vibe-hacking extortion (Dark Reading)
- Anthropic threat intelligence report, September 2026
- Check Point AI Security Report 2026 (Unite.AI)
- VoidLink, AI-built malware (BleepingComputer)
- LiteLLM and Mercor (SecurityWeek)
- OWASP GenAI exploit round-up, Q1 2026
Chapter 6 · The Autonomous Intruder
- Anthropic GTG-1002 (The Register)
- Mexico (Engadget)
- CrowdStrike agentic campaigns
- Anthropic threat intelligence report, September 2026
- Taiwan government agencies (Focus Taiwan)
Chapter 7 · Finding the Holes First
- Project Glasswing initial update
- Glasswing: 10,000 vulnerabilities and the patching problem (Security Affairs)
- Palo Alto Networks and Mythos (Axios)
- Palo Alto multi-model defense (Axios)
- HackerOne on running Mythos
- HackerOne brings Mythos to its products
- Google GTIG, AI vulnerability exploitation
- Security stocks after Mythos (MarketScreener)
- XBOW tops HackerOne leaderboard (XBOW blog)
- XBOW (PC Gamer)
- HackerOne 2025 report (DRJ)
- Bionic hackbots (Security Boulevard)
- HackerOne Security Research Report
- HackerOne validation product
Chapter 8 · Your AI Is an Open Door
- EchoLeak (The Hacker News)
- ForcedLeak (The Register)
- Perplexity Comet (Thurrott, on Brave’s research)
- Anthropic threat intelligence report, September 2026
Chapter 9 · Shadow AI and the Leaky Bucket
- Samsung staff leaks via ChatGPT (TechRadar)
- Samsung bans generative AI tools (Business Today)
- Microsoft: malicious AI assistant extensions
- KELA 2026 mid-year report (Unite.AI)
- LiteLLM and Mercor (SecurityWeek)
Chapter 10 · Governing AI Agents
- Hugging Face security incident
- OpenAI technical report on the incident
- OpenAI alerts 100 organizations (The Register)
- Gemini and three companies (Simon Willison, citing the WSJ)
- GitHub MCP vulnerability (Invariant Labs)
- Replit database deletion (The Register)
- Replit’s response (The Register)
- Palo Alto closes CyberArk deal (ITPro)
Chapter 11 · The AI-Powered SOC
- ISC2 2025 workforce study (Infosecurity Magazine)
- Ponemon/Crogl 2026 SecOps report (Techspective)
- IBM Cost of a Data Breach 2025 (Infosecurity Magazine)
- Gartner security spending forecast (Software Strategies Blog)
- CrowdStrike Charlotte AI AgentWorks
- Palo Alto Cortex AgentiX
- Palo Alto fiscal 2026 results
- Microsoft Digital Defense Report 2026 (Cloud Wars)
- Target ignored alerts (Senate report, NBC News)
- Vectra on alert fatigue
- Cloud Security Alliance, AI SOC alert noise
Chapter 12 · Who’s Doing What: The Defender Map
- Palo Alto Prisma AIRS 3.0
- Palo Alto completes Portkey
- Palo Alto completes Chronosphere (Channel Insider)
- Palo Alto acquires Protect AI (Constellation Research)
- Palo Alto buys Koi (FinTech Global)
- CyberArk becomes Idira (24/7 Wall St.)
- Google closes Wiz (Techzine)
- Wiz reaches $100M ARR (TechCrunch)
- HackerOne agentic system (SiliconANGLE)
- HackerOne AI red teaming
- Anthropic public bug bounty on HackerOne
Chapter 14 · Rules, Liability and Insurance
- King’s Speech 2026 and the Cyber Security and Resilience Bill (DLA Piper)
- UK ICO, reporting a breach
- UK Corporate Governance Code 2024 (FRC)
- EU NIS2 Directive
- EU DORA
- US SEC cybersecurity disclosure rules
- EU AI Act delay (Sidley Austin)
- UK ransomware payments, government response
- Swiss Re cyber insurance (Risk & Insurance)
- Merck NotPetya war exclusion (Hunton)
- Merck $1.4 billion award (SecurityWeek)
Chapter 16 and Appendix F
- Change Healthcare, CEO testimony (GovInfoSecurity)
- MGM Resorts 8-K (SEC)
- Snowflake and UNC5537 (Mandiant)
- Synnovis cost (Digital Health)
- CDK Global dealer losses (Channel Futures)
- M&S results statement (RNS)
Five sources worth following (Chapter 16)
- SANS NewsBites
- The Record
- Anthropic news and threat reports
- Google Threat Intelligence Group
- OpenAI global affairs and threat reports
- CISA Known Exploited Vulnerabilities catalog
- NACD Director’s Handbook on Cyber-Risk Oversight (2026)
- NCSC Board Toolkit
- UK NCSC
- US CISA
More free guides and updates: https://aiboom.uk