AI Security Weekly Midweek Edition– May 14, 2025

-AI-powered cyberattacks may hit within the next 12 months, warns Mandiant’s founder-Republican proposal seeks to block states from regulating AI for the next decade-Google rolls out on-device scam detection using AI — no cloud, no delay-Microsoft patches five zero-days amid 70+ vulnerabilities this May

Author

Andres Guillen
May 14, 2025

A Federal Power Play: States May Lose AI Reg Control

Washington’s new angle? Kill the patchwork. In a sweeping provision stuffed inside a reconciliation bill, federal lawmakers want to block state-level AI regulation for a decade. If passed, it could wipe out over 500 state proposals to curb everything from deepfakes to AI impersonations of performers.

Editor’s Take: Centralization might streamline compliance, but also risks stifling innovation at the edges. States often act faster than the feds. In cybersecurity, speed is survival — the same goes for AI policy. Losing local momentum could slow vital regulatory sandboxes.

Google’s AI Bodyguard: Scam Detection Goes Local

While some vendors chase the AI hype dragon, Google puts on-device smarts to work. Their Messages app now scans for scams—crypto shills, phony job offers, deepfake flattery—right from your phone. There is no server-side lag, and no snooping your inbox.

Editor’s Take: Privacy-conscious engineering meets practical defense. This should be the model for AI security features: edge-based, transparent, and fast. It’s a nod to both user dignity and modern threat landscapes.

Microsoft’s May Patches: Five Zero-Days Walk Into a Bar

It’s that time again. Microsoft dropped fixes for more than 70 vulnerabilities this week, including five attackers actively exploiting in the wild. If you’re still playing the “test and wait” game with patches, you're gambling against known weapons.

Editor’s Take: CISOs: build a patch culture that doesn't rely on heroics. Automate where possible, tier based on exploitability, and prioritize based on asset criticality. Please don’t wait for an adversary to prioritize them for you.

Final Word

The headlines scream urgency, but beneath them is a simple truth: AI isn’t coming for cybersecurity. It’s already here, reshaping offense and defense alike. This is no time for spectatorship. We’re past the moment of polite curiosity.

Call to Action: Subscribe to AI Security Weekly to stay one step ahead of the hype and the real threats shaping tomorrow’s battlefield.

Sources