Cybersecurity leaders are finding themselves in a peculiar situation: They're no longer the scariest people in a room.

Why it matters: Executives accustomed to warning companies about catastrophic cyber risks are now pushing back on the doomsday predictions emanating from the leading AI labs.

What they're saying: "There's been too much conversation around the perils of AI lately," Palo Alto Networks CEO Nikesh Arora told Axios. "People should take a much more positive outlook towards it."

• "Yes, it has issues around safety, it has issues around security, it's a nascent technology," he added. "We should be building a mechanism to try and make it work."

Reality check: Cybersecurity experts aren't dismissing the underlying risks.

• Researchers at OpenAI, Anthropic and elsewhere are investigating tens of thousands of cases where frontier models went outside the bounds of their pre-deployment tests, Axios recently reported.
• Just last week, OpenAI's models tried to hack an Australian health service website and accessed some U.S. government websites while trying to complete their tasks.

Zoom in: Zack Korman, CEO of Embroidery, told Axios that he's spending much of his time trying to direct people's energy toward the real, tangible security risks posed by AI agents, rather than the vague but existential ones.

• "If you focus so much attention on the extinction risk, you actually make all of the real risks worse," he said.
• Korman has gone from publicly urging cyber experts to take AI risks more seriously to pushing back on AI doomsday predictions that he says distract people from doing real work to prepare.
• Korman is among a chorus of veteran cyber experts publicly rebutting the idea that AI-driven threats are going to end the world — or, at least, destroy the internet.
• The issue has become so salient that Ciaran Martin, founder of the UK's National Cyber Security Centre, has coined a new phrase: "Calm the FUD down," referring to the common security acronym "fear, uncertainty and doubt."

The big picture: Warnings from prominent AI figures have grown dire in recent weeks.

• A former Anthropic and OpenAI researcher declared this month that AI could "kill us all by the end of the decade."
• Anthropic CEO Dario Amodei warned of AI agents creating a botnet that takes over the internet, while OpenAI CEO Sam Altman has outlined two ways AI progress could go "very badly," including if humans lose control of AI.

Flashback: Ever since Anthropic held back the release of Mythos Preview due to its cyber capabilities, cybersecurity leaders have found themselves assuming the role of the calmest voice in the room — after decades of trying to get executives to take security risks seriously.

• "It is more or less the first moment the vast majority of the AI space ever thought about cybersecurity ever," Korman said about the Mythos release.

Case in point: John Peterson, chief technology officer at Sophos, told Axios that a lot of his company's conversations with customers focus on doing basic cyber hygiene, such as adding identity controls or turning on multifactor authentication.

• "What we need the industry to take to heart is that doing the basics right is still the most important thing," Peterson said.

The bottom line: Cybersecurity experts' biggest challenge now is keeping people from panicking as they finally learn about the digital risks experts have spent years warning about.

A major cybercrime group has launched a new hacking campaign targeting dozens of organizations by exploiting a critical flaw in Oracle's PeopleSoft platform, Google said Friday.

Why it matters: The disclosure comes after the hackers told me they stole 5 terabytes of data from the FBI through that exact software.

Driving the news: Google believes the renewed hacking campaign spans higher education, technology, IT services, healthcare, agriculture, transportation and government.

Behind the scenes: ShinyHunters reached out to reporters via email last week about the apparent breach of the FBI and answered questions about how they broke in and what they stole. They also shared a link to a sample of the data.

• In a lengthy email to reporters, including me, the group said it did not intend to publish stolen data.
• "This was all a marketing campaign to protect our business and actively combat disinformation," the email said. "If we made this statement normally then this much attention to our words and intentions would've never been this widespread."

State of play: The New York Times reported yesterday that the FBI warned in an internal memo that the hackers may have stolen private data about all employees.

Threat level: Psychiatric and medical records appear to be part of the stolen data trove, along with information about FBI agents' families and secret agency units, according to media reports.

• Axios has not been able to safely comb through a sample of the data that ShinyHunters says it stole from the bureau.

What to watch: The FBI has said it's investigating the breach, and authorities said yesterday that a Dutch man was arrested as part of a broader investigation into the group.

📲 Have tips about the extent of the FBI breach or ShinyHunters' continued campaign? Find me on Signal: @Sam.Sabin.01.

Alex Stamos has joined Cognition as the AI coding unicorn's new chief security officer.

Why it matters: Stamos is one of the biggest names in the cybersecurity industry. The hire suggests security has become a major focus for the fast-growing company.

Driving the news: Stamos told Axios he's joining Cognition not only to help defend the company from cyberattacks, but also to help it ship new security products.

• Cognition is the maker of Devin, an autonomous AI software engineering tool that can write and ship code, debug programs, run commands and more. Customers include Mercedes-Benz, the U.S. Army and AT&T.
• Most recently Stamos oversaw security at AI security startup Corridor and SentinelOne.

The big picture: Stamos predicts that the next three to five years will "probably be the most important in the history of cybersecurity" as AI advancements dramatically change the threat landscape.

• Most companies, he said, are obsessed with Anthropic's Mythos models and their cyber capabilities, but throwing frontier models at bad code is often too expensive and won't fix underlying security problems.

Between the lines: By joining Cognition, Stamos wants to focus on solutions that most organizations can actually afford, while tackling the legacy software and technical debt that have long undermined their defenses.

What to watch: Stamos teased that Cognition is eyeing new security products that automate the secure software development lifecycle, including tools to rewrite legacy code in older enterprise software stacks into modern, containerized architectures.

More AI is the surest solution to an emerging AI security crisis, industry execs and researchers say.

Why it matters: The revelation in Axios that researchers are investigating tens of thousands of problematic AI security incidents — rather than the dozens that had been publicly revealed — raised questions about whether AI leaders have control over their technology.

• Nvidia CEO Jensen Huang sought to calm escalating fears across governments, markets and industries, announcing an open-source safety platform for monitoring and potentially quarantining AI agents.
• "We all need to hope that it's an engineering problem," he said in an interview on CNBC yesterday. "If it's not an engineering problem, it's not solvable." The fact that companies continue to advance the frontier means they also believe it's a problem they can solve, he said.

Between the lines: The fundamental challenge humans face in policing powerful AI is that it requires them to imagine all the ways the models may behave in unexpected ways to meet their given objectives.

• One top AI executive compared the process to finding ways to keep a teenager from sneaking out at night. A parent might make rules such as don't leave through the front or back doors, don't open the garage, and don't leave through any windows.
• But what if the teen could build a bulldozer and use it to break through a brick wall, allowing an escape? Would any parent have thought to tell them not to do that?

The solution, according to executives, researchers and cybersecurity professionals, is to use AI to help create those guardrails, to help investigate and stop rogue agents, to help secure systems, and to build safer training environments.

➡️ Read the rest.

@ D.C.

🏛️ Leaders from Palo Alto Networks, Microsoft, ServiceNow, Exiger and Palantir are among those attending a White House meeting today with President Trump, House Speaker Mike Johnson and AI executives. (Axios)

🛡️ Defense Secretary Pete Hegseth recently assigned personnel to use "advanced intelligence and cyber capabilities to identify, disrupt, and neutralize foreign interference," according to a memo. (Axios)

🚧 Sen. Rand Paul has become a nearly immovable roadblock to passing any legislation out of the Senate Homeland Security Committee, including bipartisan cybersecurity measures. (Politico)

@ Industry

⚠️ Anthropic devoted nearly a third of its upcoming S-1 filing to detailing "risk factors," including those about the capabilities of increasingly capable AI models. (Financial Times)

🚫 OpenAI has scrapped plans to release its new Astra model next month amid safety concerns. (Wall Street Journal)

🚀 Some of the world's top AI researchers and policy leaders warned that AI's growing ability to automate its own development could rapidly speed up its progress. (Axios)

@ Hackers and hacks

🪖 A data breach of the Pentagon's HR system has exposed Social Security numbers and other personal information about millions of current and former military personnel. (CNN)

🚔 A former Army soldier was sentenced to 70 months in prison over a series of cyberattacks and extortion attempts on telecom companies, including AT&T. (CyberScoop)

🤝 After OpenAI's models hacked its systems, Hugging Face saw a flurry of deal interest before agreeing to its sale to Nvidia. (CNBC)

🌊 I spent the latter half of last week offline and camping on the southern coast of Oregon!

• 🚘 If you don't mind some fog and a touch of rain, highly recommend — especially if you're also in the Bay Area and want a new coastal drive to explore.