Rethinking security for the age of AI

Microsoft Security Blog coverage highlights emerging AI security governance, global AI red teaming, evolving phishing and Teams-based social engineering, ACR Stealer campaigns using ClickFix lures, least-privilege controls for AI agents, the AsyncAPI npm supply-chain compromise, and ShinyHunters-associated OAuth abuse against SaaS applications. The collection describes active threats involving credential and token theft, malware delivery through compromised packages and CI/CD workflows, identity abuse, and social engineering. No specific CVE identifiers are provided.