Reconstructing AI activity in investigations

A set of Microsoft Security Blog posts covering recent high-risk activity and defensive guidance across AI, software supply chain, CI/CD, and ransomware. Key items: a telemetry-driven playbook to reconstruct AI activity in Microsoft 365 Copilot and Azure AI; threat actors using AI branding as social‑engineering lures; a prompt‑injection flaw in the Claude Code GitHub Action that could expose workflow secrets (responsible disclosure and mitigations by Anthropic); an updated taxonomy of failure modes for agentic AI from a year of red teaming; the Miasma npm supply‑chain campaign that backdoored