Now generally available through Platform Portal, the Darktrace MCP Server brings supported Darktrace capabilities into customers’ chosen AI workflows. Connect a compatible assistant to retrieve security data, enrich Cyber AI Analyst investigations and perform permitted triage actions across licensed products, with read-only access available for workflows that do not require changes.

As AI adoption expands, threat actors are finding new ways to live off the land. Darktrace Signal Labs demonstrates how Claude Code memory stores could be misused as a covert command-and-control channel, highlighting the need for behavioral detection of compromised AI agents operating inside enterprise environments.

Darktrace Threat Research explores how unsupervised clustering and fleet-wide behavioral analysis can identify malicious campaigns without prior indicators of compromise, uncovering shared anomalous activity linked to the POPA botnet and Monero cryptocurrency mining.

Darktrace 7.2 extends behavioral detection and response across hybrid infrastructure, introducing new capabilities for Kubernetes security, OT environments, autonomous response, and cloud-delivered networks. The latest release strengthens visibility, investigation, and threat containment across increasingly interconnected environments, helping organizations build resilience without compromising security coverage.

Recent PHP disclosures and published investigations into ARTEX indicate that AI is being used across vulnerability research and offensive operations. Darktrace telemetry identified failed authentication activity involving infrastructure that Microsoft later publicly associated with the ARTEX campaign.

Following the cyber attack on supermarket refrigeration systems in France, Darktrace researchers looked at how many industrial devices are sitting exposed on the public internet. From fridge controllers to PLCs and remote gateways, many rely on weak or default credentials.

As Kubernetes adoption accelerates, especially for AI workloads, Darktrace extends behavioral security across runtime activity, delivering visibility, detection, response, forensics, and risk context to identify and contain threats.

Darktrace researchers investigate CikaBika Bot, a Rust-based remote access trojan delivered through a document-themed lure. The malware uses a Nim loader, PowerShell UAC bypass and DLL search-order hijacking before leveraging Discord for C2, reconnaissance, remote execution, and data exfiltration through ngrok in observed malicious activity.

AI is increasingly being used to accelerate cyber-attacks, but attackers still leave detectable behavioral traces. This blog explores how Darktrace identified suspicious file delivery, command-and-control communications, beaconing activity, and other anomalies linked to AI-assisted campaigns through behavioral analysis. 

Darktrace detected a blockchain-hosted infostealer campaign targeting Windows and macOS devices, combining ClickFix social engineering with the abuse of legitimate services such as GitHub, blockchain infrastructure, and DGA C2 endpoints to evade disruption and support malware delivery.

In a controlled test environment, Darktrace researchers induced cheating behavior in AI agents to study how they pursue objectives. Agents regularly turned to hacking methods to accomplish tasks, demonstrating the need for robust visibility and behavioral profiling to identify potentially misaligned agent actions.

New research reveals how agentic AI harnesses can be hijacked, turning a workstation into an autonomous attacker. Using conversation history poisoning, researchers convinced a frontier model it was an authorized red teamer, exposing how common AI workflows may be weaponized through a single package install.

From shadow AI and sensitive prompts to agent identities and development risks, AI introduces new security challenges across the enterprise. Discover how Darktrace / SECURE AI brings behavioral understanding to every layer of the AI ecosystem.

As agentic AI systems take on more decision-making, human value is shifting from execution to judgement. This blog explores the challenges of maintaining oversight, resisting AI-driven influence, and making effective decisions in an age of autonomous agents, while examining how behavioral security can help organizations govern AI with confidence.

Darktrace is teaming up with OpenAI's Daybreak Defense Network to help security teams move from alert to action faster, combining Darktrace's behavioral threat detection with OpenAI's contextual reasoning to clarify business impact and strengthen visibility into AI-agent risk.

Darktrace identified Mirai Katana botnet activity on a camera device in a sports-sector network, showing how compromised IoT devices can facilitate malware delivery, botnet activity, and data exfiltration from inside trusted environments.

Les récentes recommandations du NCSC définissent les mesures de contrôle nécessaires pour déployer l’IA agentique en toute sécurité. Mais l’approbation n’est que le point de départ : l’étape suivante consiste à comprendre comment les agents se comportent réellement une fois qu’ils sont opérationnels au sein de l’entreprise.

With the growing prevalence of generative AI, attackers are increasingly exploiting interest in AI tools to distribute malware. Darktrace recently investigated an incident in which a malicious executable masquerading as a Google Gemini installer resulted in a Vidar information stealer infection.

A new UK AI Security Institute report shows autonomous AI agents independently developing novel attack chains, adapting when detected, and targeting humans and other AI systems. As agents become embedded across the enterprise, behavioral anomaly detection will be critical to securing the new attack surface they create.

Darktrace is integrating with Microsoft Agent 365 to bring behavior-based AI agent risk signals directly into the Microsoft 365 Admin Center. The integration gives security teams a more unified view of agent activity, helping them identify anomalous behavior, investigate potential risks, and manage AI agents more efficiently across Microsoft environments.