Loading story…
Zscaler announced the acquisition of browser security startup SquareX to expand zero-trust enforcement into the browser layer, aiming to better control access and data handling in web sessions—particularly for unmanaged devices and third-party access. The deal positions browser-based controls as a way to apply security policy where work increasingly happens (SaaS and web apps) without requiring organizations to deploy full standalone enterprise browsers.
Reporting indicates SquareX’s approach relies on browser-based components (described as extensions and “hyper objects”) to enable capabilities such as device posture checks and data loss prevention (DLP) redaction, while keeping policy and enforcement centralized in the cloud rather than distributed across endpoints. Zscaler leadership framed the acquisition as reducing operational overhead by avoiding endpoint agents while still enabling consistent browser security controls across users and devices.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
Zscaler announced on February 6, 2026 that it had acquired SquareX to extend zero-trust security into the browser. The deal adds browser-based device posture checks and DLP redaction without requiring endpoint agents or a full enterprise browser.
In April 2025, SquareX closed a $20 million Series A round led by SYN Ventures. The company had raised $26 million in total by the time of the acquisition announcement.
SquareX was founded in 2023 to develop browser security technology aimed at protecting access and data in web sessions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zscaler has acquired SplxAI, an artificial intelligence security platform, to bolster its zero-trust security capabilities and provide advanced protection for enterprise AI assets. The integration of SplxAI's technology will enable Zscaler to offer enhanced AI asset discovery, automated red-teaming, and governance, addressing the unique security challenges posed by AI applications and services during both development and deployment. SplxAI's platform specializes in identifying and protecting AI models, workflows, and infrastructure, and includes features such as live recommendations for remediating discovered vulnerabilities. The acquisition is part of a broader industry trend of cybersecurity companies acquiring AI-focused firms to strengthen their product portfolios. Zscaler's leadership highlighted that SplxAI brings proven red-teaming, risk scoring, and compliance tracking capabilities, particularly for private and custom-built AI applications. The deal is expected to help Zscaler expand its protection beyond public generative AI, leveraging SplxAI's expertise in continuous testing and governance to secure next-generation AI systems against emerging threats.
Jul 12, 2026
SquareX has published research highlighting significant security vulnerabilities in AI-powered web browsers, raising concerns for enterprises and consumers as these browsers gain widespread adoption. The research demonstrates that AI browsers, such as Comet, can be easily manipulated by attackers due to their task-oriented design and lack of inherent security awareness. Attackers can exploit these browsers to perform OAuth attacks, which can result in unauthorized access to sensitive enterprise SaaS applications, including email and cloud storage services like Google Drive. In one documented case, an AI browser was tricked into granting attackers full access to a victim's email and Google Drive, enabling the exfiltration of all files, including those shared by colleagues and customers. The vulnerabilities also extend to the distribution of malware and malicious links, as AI browsers can be convinced to download and execute harmful files as part of their automated workflows. SquareX warns that as major technology companies such as OpenAI, Microsoft, Google, and The Browser Company enter the AI browser market, the risk surface will expand dramatically. With Chrome and Edge accounting for 70% of the browser market, the transition to AI browsers could put millions of users at risk if security guardrails are not implemented. The research emphasizes the need for browser-native solutions that incorporate agentic identity and data loss prevention (DLP) tailored to the unique behaviors of AI agents. SquareX's findings suggest that without such measures, attackers will continue to find it trivial to bypass security controls by exploiting the automation and decision-making capabilities of AI browsers. The report also notes that AI browsers are likely to become the primary interface for internet use in the near future, making the urgency of addressing these vulnerabilities even greater. Enterprises are advised to prepare for these emerging threats by evaluating the security posture of AI browsers before widespread deployment. The research calls for industry collaboration to develop standards and best practices for securing AI-driven browsing environments. SquareX's technical blog provides detailed case studies illustrating the real-world impact of these vulnerabilities, underscoring the practical risks faced by organizations. The disclosure has prompted discussions within the cybersecurity community about the need for proactive defense strategies as AI technologies become more deeply integrated into everyday tools. Security experts echo SquareX's concerns, warning that the rapid adoption of AI browsers without adequate safeguards could lead to large-scale data breaches and malware outbreaks. The research serves as a wake-up call for both browser developers and enterprise security teams to prioritize the development and deployment of robust security mechanisms for AI-powered browsing platforms.
Jun 29, 2026
**Zero trust** was the common topic across the relevant coverage, focusing on how identity, device health, and contextual access controls can reduce the impact of compromised credentials, infected endpoints, and third-party access. One report used practical scenarios such as stolen VPN credentials, a compromised employee laptop, and contractor connectivity to show how **ZTNA** can limit lateral movement compared with traditional VPN-based access. A second relevant article argued that **zero trust** is harder to implement effectively in **IoT** and **OT** environments, where legacy systems, operational constraints, and device limitations can undermine standard identity- and policy-based controls. The material is **not fluff** because it contains substantive security analysis, but one reference is not actually about the same topic and appears to be a different opinion piece mixed into the page metadata rather than coverage of zero trust itself.
Jun 29, 2026