Never let a signup go cold again.
Turn emails into revenue with Brew. No credit card, free credits to try.
Turn emails into revenue with Brew. No credit card, free credits to try.
approov.io · newsletter
Explore this email design and adapt it to your own brand. Review the copy, links, and offer before sending.
View in browser
Approov-newsletter-banner-image
Subscribe to the Approov Newsletter
May 2026
Agentic-AI-Risk-Concept
Traditional security perimeters are being redefined by the rapid evolution of agentic AI. As models become capable of deciphering obfuscated code and malicious bot traffic surges, the "hide and seek" approach to mobile security is reaching its limit. In this issue, we examine why a shift toward Zero Trust and runtime attestation is no longer optional.
Mythos is Alive, Obfuscation is Dead. What Comes Next?
For a decade, the mobile security playbook was simple: hide your API keys, obfuscate your code, and hope the "bad guys" found it too tedious to reverse-engineer.
That era ended with Anthropic’s "Mythos" model. Mythos has turned what used to be weeks of manual reverse-engineering into a three-minute task for an AI agent. It can deobfuscate code and extract embedded secrets almost instantly, collapsing the cost of sophisticated mobile fraud to near zero.
The Reality Check: If your security depends on a secret hidden inside your app, you don’t have security. We have to move toward a "Zero Secrets" architecture. If there’s nothing to steal, there’s nothing to crack.
Read the full analysis on Runtime Attestation vs. Mythos
The 53% Tipping Point: Bots Are the New Majority
Thales’ 2026 Bad Bot Report dropped some staggering numbers this week, and they’re a wake-up call for anyone managing an API:
53% of all web traffic is now driven by bots.
Malicious AI bot attacks surged 12.5x in just the last year.
40% of all traffic is categorized as "bad bots."
We are no longer defending against "scripts"; we are defending against agentic threats. These AI agents don't just blast requests; they mirror legitimate user behavior so perfectly that standard backend analytics are effectively blind. The game has shifted from "blocking IPs" to "complex intent analysis."
How "Agentic AI" is redefining the bot landscape
The AI Scraping Arms Race (World Cup 2026 vs. LA28)
The 2026 World Cup is serving as a "live-fire lab" for AI-driven fraud. Sports betting apps, built for speed and real-time access, are being systematically harvested by AI scrapers.
The Stats of the Struggle:
The International Betting Integrity Association (IBIA) reported 300 suspicious alerts recently, a 29% jump year-over-year.
Sportradar identified 1,116 suspicious matches in 2025, with AI flagging anomalies 56% more often than before.
Why it matters: AI scrapers move faster than any human, exploiting "micro-markets" (like first-goal scorers) before the odds can even settle. This doesn't just hurt the bookie's bottom line; it destroys the "level playing field." If users feel the game is rigged by bots, the entire platform loses its value.
The techniques being perfected during this World Cup—predicting line movements and mimicking human betting patterns—will be the baseline for the Los Angeles 2028 Olympics. To survive LA28, operators must move beyond rate limiting to Runtime Attestation.
Read our full threat analysis on AI Scraping & Sports Betting
The Vercel Breach: A Lesson in "Secret Hygiene"
Even the pros get hit. Vercel recently confirmed a breach triggered by a compromised third-party OAuth app. While their core systems held firm, the attackers walked away with customer environment variables that weren't explicitly marked as sensitive.
The Takeaway: Your security is only as strong as your messiest SaaS integration. It’s time to audit those third-party permissions and treat every "minor" integration as a potential front door.
Full Breach Breakdown via BleepingComputer
Follow Us On LinkedIn
Approov Limited
Scotiabank House, 6 South Charlotte Street, Edinburgh, Midlothian EH2 4AW, United Kingdom | +44 0131 655 1500
US HQ: 165 University Avenue, Suite 200, Palo Alto, CA 94301, USA | +1 (650) 322-5300
Unsubscribe Manage Preferences
