Lemma Critical Brief
threat intelligence ×
trust infrastructure.
Lemma's structured analysis of major incidents across AI, cryptographic infrastructure, supply chains, and regulated attributes. Each Brief makes the gap between detection and proof explicit — a reference for risk assessment, regulatory response, and trust-infrastructure design.
Browse by threat typeThreat Types · 13
All 147 Most-readPopular
1 SynthID Watermark, Statistically Stripped 2 ServiceNow AI Platform 3 Hong Kong deepfake video-call fraud: a real-time deepfake of the CFO and every colleague drove a ~$25.6M transfer 4 Agentjacking: an AI coding agent trusted a single fake error report as its "resolution steps" and ran the attacker's commands 5 Japanese police identified 123 sexual-deepfake cases in six months, passing all of last year
Latest BriefsLatest · 12
44
SpeeCAN RAIDEN: a municipal disaster-alert mail platform was breached, and around the same time fake mail from its sender domain reached registrants (Arcadia and municipal notices)
Data Provenance 10-16
152
Denmark CPR: One private company's lawful lookup access was abused to pull names, addresses and CPR numbers for about 8.8 million people (Danish digitalisation ministry)
KYC / AML Disclosure 10-14
151
TOPPAN: During a manual send, a list of 177,426 Sompo Japan policyholders slipped into another insurer's ZIP and went out (insurance-premium deduction certificate service)
Data Provenance 10-14
150
North Korean IT workers: they won contracts in Japan by posing as local enablers, using ID images the enablers supplied (joint advisory by seven agencies in Japan, the US, Australia and Germany; Japan's first laptop farm dismantled)
Attribute Proof Bypass 09-24
149
Revolut: It kept handing over customer data for months, answering disclosure requests that arrived through Italy's state-certified email network (PEC; Italian prosecutors investigating)
KYC / AML Disclosure 09-21
148
RubyGems and RubyDoc.info: masses of new accounts published 500+ malicious packages and ran code on the docs build servers (Ruby Central, Nightingale Collective)
Code Provenance 09-15
147
GitSpawn: Just opening a folder made seven AI coding agents run an attacker's code (Manifold Security)
Agent Infrastructure 09-15
146
Hugging Face's Transformers library was found to write remote Python code to disk before a user's consent prompt is ever evaluated (CVE-2026-80047, CERT/CC)
Code Provenance 09-11
145
In the LiteLLM AI gateway, the fallback for a failed MCP authentication check quietly behaved as unconditional access (CVE-2026-59822, confirmed under active exploitation and added to CISA's KEV catalog)
Agent Infrastructure 09-11
143
A human attacker directing multiple frontier AI agents breached an enterprise network in under 10 hours (Unit 42)
Agent Runaway 09-08
142
An outside party accessed Awa Bank's test environment, leaking 27,745 records of customer and shareholder data
Identity & Auth 09-08
141
IDScan.net: More than 153 million scanned driver's licenses handed over at counters were being sold on the dark web
Attribute Proof Bypass 09-04