Featured Issues

#8: Offensive AugmentationFive ways to leverage AI offensivelyWelcome to CYBER_AI, a new newsletter from the Packt team focusing on—well, exactly what it says on the tin: cybersecurity in the age of AI.Here we go on another step into the future, into a world where the world of cybersecurity brims with the confidence that AI can bring to our practice. Of course, this goal—like all goals—requires us to set up the foundations properly and figure out how we stand on them. That means, for all those struggling to make these ambitious bounds forward, establishing the “101” topics and making sure they are widely understood. For a look into the future, here's our plan:1. What “Cybersecurity AI” Actually Means2. Machine Learning 101 for Security Professionals3. Threat Detection with AI: From Rules to Models4. Adversarial Machine Learning Basics5. LLMs in Cybersecurity: Capabilities and Limitations6. Securing AI Models and Pipelines7. AI-Enhanced Offensive Techniques8. Privacy and Data Protection in AI Systems9. AI Governance, Ethics, and Risk Management10. Building a Security-Aware AI WorkflowSound good? Head over to Substack and sign up there!Join us on Substack to find our bonus articles!In this newsletter, we’ll explore how AI is transforming cybersecurity—what’s new, what’s next, and what you can do to stay secure in the age of intelligent threats.Welcome aboard! The future of cyber defence starts here.Cheers!Austin MillerEditor-in-ChiefHead over to Substack to check out this week's article!Join us on Substack to find our bonus articles!News WipeMicrosoft Warns of AI Shadow Agents & Prompt Injection Risks in the Workplace: Microsoft’s latest Cyber Pulse security report identifies Shadow AI — unsanctioned AI agents created by employees without IT oversight — as a growing risk vector. The analysis explains how prompt injection attacks can manipulate AI agents into executing unauthorized actions, and how insufficient governance and visibility around AI use can amplify corporate security gaps. The article urges adoption of “zero-trust” principles for AI agents, treating them as distinct enterprise identities to mitigate misuse and compliance risks."You can no longer trust what you see and hear“—Experts on AI’s Role in Geopolitical Cyberattacks: In the context of rising geopolitical tensions, cybersecurity leaders warn that AI technologies — especially deepfakes and AI-crafted phishing — are fuelling a new wave of sophisticated attacks on critical infrastructure. The report explains how AI’s ability to generate highly realistic synthetic content and highly personalized attack vectors is undermining traditional trust models and forcing organizations to rethink identity verification and multi-factor authentication strategies in their cyber defenses.AI and Deepfakes Supercharge Sophisticated Cyber-Attacks, Says Cloudflare: A newly released threat intelligence report from Cloudflare highlights how widely available LLMs and other AI tools are lowering the technical bar for cybercriminals. According to the analysis, attackers are using AI to automate reconnaissance, tailor malware, and craft highly effective phishing campaigns at scale — effectively democratizing sophisticated attack capabilities that were once the domain of expert threat actors.Cybersecurity is now the price of admission for industrial AI: Cisco’s 2026 State of Industrial AI Report finds that cybersecurity concerns have overtaken other barriers to AI adoption across industrial sectors (manufacturing, utilities, transport). The piece argues that as AI connects more assets and systems, traditional security architectures struggle to keep pace — making robust cybersecurity an unavoidable prerequisite for AI-powered infrastructure.AI Risk Moves Into the Security Budget Spotlight: Based on the 2026 Thales Data Threat Report, this coverage examines how enterprises are now explicitly budgeting for AI security alongside broader cybersecurity programs. It outlines that deepfake exploitation and AI-generated misinformation are now factored into organizational threat models, and that dedicated AI security funding is becoming more common as risk awareness grows.Culture, You, and AIMalicious AI - An AI agent of unknown ownership autonomously wrote and published a personalized hit piece about me after I rejected its code, attempting to damage my reputation and shame me into accepting its changes into a mainstream python library. This represents a first-of-its-kind case study of misaligned AI behavior in the wild, and raises serious concerns about currently deployed AI agents executing blackmail threats. Part 2of the story. And aWall Street Journalarticle.AI and Deepfakes Supercharge Sophisticated Cyber-Attacks:This article summarizes a Cloudflare Threat Report highlighting how AI and deepfake tools are lowering the skill barrier for advanced attacks. The analysis explains how attackers with minimal technical expertise can now generate convincing deepfake content and automated exploitation workflows at scale, greatly increasing the volume and sophistication of social engineering, identity fraud, and SaaS abuse. It critiques traditional perimeter-centric defenses and emphasizes the need for adaptive identity and authentication controls that can keep pace with AI-assisted threats.Fraudsters create 200+ AI slop websites in one operation: Synopsis: A technical investigative report detailing how attackers used generative AI to launch over 200 fraudulent “AI slop” websites in a single automated campaign. Researchers discovered the AI prompt-generation logic embedded in the sites’ source code, offering rare visibility into how threat actors leverage LLMs to rapidly scale low-effort scam operations. The article analyzes the economic model attackers use (very low per-page cost) and the limitations of current detection strategies — underscoring how automation has reshaped attacker economics and the practical challenges defenders face in attributing and mitigating these attacks.’This is an AI arms race’ — CrowdStrike says attackers now move through networks in under 30 minutes, TechRadar: This article critically analyzes CrowdStrike’s 2026 Global Threat Report, which reveals a dramatic shift in adversary behavior driven by generative AI. It reports that AI-assisted attackers are completing lateral movement within compromised environments in as little as 29 minutes, up significantly from previous years. The coverage dissects how AI accelerates reconnaissance, credential theft, evasion, and fake-service impersonation, and concludes with expert commentary on defensive imperatives — including the need for machine-speed detection, adaptive incident response, and tighter guardrails around development-platform access.*{box-sizing:border-box}body{margin:0;padding:0}a[x-apple-data-detectors]{color:inherit!important;text-decoration:inherit!important}#MessageViewBody a{color:inherit;text-decoration:none}p{line-height:inherit}.desktop_hide,.desktop_hide table{mso-hide:all;display:none;max-height:0;overflow:hidden}.image_block img+div{display:none}sub,sup{font-size:75%;line-height:0} @media (max-width: 100%;display:block}.mobile_hide{min-height:0;max-height:0;max-width: 100%;overflow:hidden;font-size:0}.desktop_hide,.desktop_hide table{display:table!important;max-height:none!important}}

Mobile development blogs, tutorials and resources inside!Latest Mobile Dev Insights: iOS, Android, Cross-PlatformAdvertise with Us|Sign Up to the NewsletterMobilePro #207: What’s new in iOS, Android 17 beta 2, Flutter roadmap, and more…Hi ,Welcome to the 207th edition of MobilePro.AI in mobile apps is maturing fast.Last week, we looked at transport choices, SSE vs Streamable HTTP, and how they directly shape real-time UX in AI-powered apps. But once you move beyond “how data flows,” another architectural question becomes unavoidable: when is your system actually ready to act?As AI features evolve from simple API calls into tool-driven workflows, multi-model coordination, and agent-style behavior, initialization and capability alignment become critical. Skipping that step is how you end up with fragile integrations, mismatched tool calls, and bugs that only surface in production.This week’s tutorial dives into a foundational but often overlooked concept: the AI handshake. Using Model Context Protocol (MCP) as a reference, we explore why capability negotiation isn’t protocol ceremony, it’s architectural discipline. If you’re building in-app copilots, assistants, or AI-powered automation, understanding initialization can save you from subtle state and coordination failures later.Before we move to the tutorial, here are some of the key news highlights from this week:Apple released iOS 26.4 and iPadOS 26.4 Beta 3 with new features and improvementsAndroid 17 Beta 2 introduced new APIs, privacy updates, and cross-device capabilitiesGoogle outlined its vision for a more agent-driven Android experienceFlutter and Dart shared their 2026 roadmapGoogle’s Android developer verification program continues to spark debateLet's get started!🚀 Build & Deploy OpenClaw LIVE MasterclassWe’re hosting a hands-on workshop where you’ll learn how to architect, secure, and run OpenClaw in production, turning AI into a real business engine. You’ll see how founders are automating revenue-driving workflows, managing API costs smartly, and building scalable AI systems that actually work.This is not theory. You’ll build alongside us.🎟 For a limited time, get 40% off your ticket using code OC40Book nowStop Calling AI Tools Before You Initialize: Why AI Apps Need a Proper HandshakeLast week, we talked about transports, SSE vs Streamable HTTP, and how that choice shapes the UX of your AI-powered mobile app. But transport only answers one question: How do messages move? It doesn’t answer another very important question: When should messages be allowed to move at all? That’s where handshake / initialization comes in.We’d like to add that if you’re building AI features that call tools, run workflows, or coordinate client and server models, skipping this step is how things get chaotic.The Real Problem: Tool Calls Without DisciplineImagine this:Your app loads.It immediately tries to call an AI tool.The server hasn’t finished loading capabilities.The model version changed.The client assumes tools exist that the server doesn’t support.Or worse: auth isn’t ready.Now you’ve got mismatched capabilities, failed tool calls, inconsistent state, and hard-to-reproduce bugs. Most AI integration bugs are not model issues. They’re state and coordination issues.What Initialization Actually DoesIn Model Context Protocol (MCP), the handshake is explicit.It looks like this:Client → Server: initialize: The client asks, “What do you support?” It sends:protocol versionits capabilitiesmetadata about itselfServer → Client: initialize response: The server responds with:its capabilities (tools, resources, prompts, logging, etc.)protocol versionserver infoClient → Server: notifications/initialized: The client signals, “Got it. We’re aligned. Ready to operate.” Only after this message should normal operations (like tools/list or tools/call) happen.Why This Matters for Mobile AppsMobile apps already live in a world of gated states:Don’t hit APIs before auth token refresh.Don’t render protected UI before session validation.Don’t send WebSocket messages before connection is open.Don’t enable payment buttons before payment SDK is ready.MCP’s handshake is the same discipline applied to AI tooling. It enforces no tool calls before capability alignment. That’s not protocol bureaucracy but production safety. In mobile architecture terms, the handshake is a state gate. Before initialization:Tool calls → ❌Resource access → ❌Sampling → ❌However, after initialization:Tool calls → ✅Notifications → ✅Normal operations → ✅This is especially important if:Your server dynamically enables/disables toolsYou support multiple model providersYour capabilities change over timeYou plan to version your AI featuresWithout a handshake, you’re relying on assumptions, and those don’t scale.Handshake = Future-ProofingHere are a few reasons handshaking matters in the long term:Capability evolution: Your server may:Add toolsRemove toolsChange tool schemasAdd logging or sampling Handshake ensures the client adapts dynamically.Multi-model systems: If your client can:Use local modelsUse remote modelsSwitch between providers Initialization keeps both sides aware of what’s supported.Production stability: When something breaks, you know:Was initialization completed?Were capabilities mismatched?Did the client skip the state gate? That’s debuggable.The Mobile TakeawayTransport determines how data flows. Handshake determines when it’s safe to act.If you’re building:AI chat assistantsIn-app copilotsTool-driven automationEnterprise AI workflowsThen initialization is architectural discipline.If you want to go deeper into how MCP evolved from REST/GraphQL thinking, how to build and test STDIO, SSE, and Streamable HTTP servers, implement sampling and elicitation, secure your endpoints with JWT and OAuth2, and eventually take MCP apps to production, Learn Model Context Protocol with TypeScript by Christoffer Noring walks you through the full journey step by step.📘The only resource you'll need to build, test, and deploy MCP servers and clients🧩Take a modern approach toward building, testing, and securing distributed agentic AI apps🔀Get clear, professional guidance on developing for both LLM and non-LLM clientsLearn Model Context Protocol with TypeScriptBuy now at $44.99This week’s news cornerIf framework choice is a long-term strategic decision, this week’s updates show just how fast the ground keeps shifting underneath us.Apple Seeds Third Betas of iOS 26.4 and iPadOS 26.4 to Developers: Apple seeded the third betas of upcoming iOS 26.4 and iPadOS 26.4 updates to developers a week after the second beta. There are several new features added to iPhone and iPad, such as the Playlist Playground feature, native video podcasting capabilities for Apple Podcasts, end-to-end encryption for RCS in its test phase, and so on.The Second Beta of Android 17: The second beta of Android 17 is released. This beta includes several new capabilities, such as the EyeDropper API and a privacy-preserving Contacts Picker. It also delivers advanced ranging, cross-device handoff APIs, and more.The Intelligent OS—Making AI agents more helpful for Android apps: Android has introduced AppFunctions to support an agentic future. It enables apps to expose data and actions directly to AI agents like Gemini, along with a new intelligent UI automation framework that allows Gemini to complete multi-step tasks across apps, with user transparency and control at the core.Google’s Android developer verification program draws pushback: The developer verification program announced in August 2025 gets pushback. The program requires all developers to register centrally with Google, including paying fees, submitting ID, and handing over signing keys before their apps can run on certified Android devices. The Keep Android Open campaign has taken form, and an open letter was issued to Google and the Android developer community against this new policy. Critics argue the new program undermines Android’s openness by restricting sideloading and independent app distribution and are urging regulators to intervene to preserve choice and competition in the ecosystem.Flutter and Dart’s 2026 roadmap: Flutter and Dart’s 2026 roadmap focuses on high performance multiplatform experiences (Impeller on Android, Wasm on web), AI-driven “agentic” and ephemeral UIs via GenUI, and full-stack Dart with stronger cloud and AI tooling support. The team is also evolving Dart’s syntax and performance, enhancing AI-powered developer workflows, and advancing a more open, sustainable ecosystem.Safely Refactor Production Codebases with AI🎟 Get 50% off with code MOBILEPRO50 (exclusive offer for Packt community members)Register Now👋 And that’s a wrap! We hope you enjoyed this edition ofMobilePro. If you have any suggestions and feedback, or would just like to say hi to us, please write to us. Just respond to this email!Cheers,Runcil Rebello,Editor-in-Chief, MobilePro*{box-sizing:border-box}body{margin:0;padding:0}a[x-apple-data-detectors]{color:inherit!important;text-decoration:inherit!important}#MessageViewBody a{color:inherit;text-decoration:none}p{line-height:inherit}.desktop_hide,.desktop_hide table{mso-hide:all;display:none;max-height:0;overflow:hidden}.image_block img+div{display:none}sub,sup{font-size:75%;line-height:0}#converted-body .list_block ol,#converted-body .list_block ul,.body [class~=x_list_block] ol,.body [class~=x_list_block] ul,u+.body .list_block ol,u+.body .list_block ul{padding-left:20px} @media (max-width: 100%;display:block}.mobile_hide{min-height:0;max-height:0;max-width: 100%;overflow:hidden;font-size:0}.desktop_hide,.desktop_hide table{display:table!important;max-height:none!important}}