ls ./category/ai
Models, agents and the new attack surface they create.
Anthropic has folded Project Glasswing into a three-tier Cyber Verification Program, giving qualifying security professionals access to its models with reduced blocking on cyber tasks. It reports Glasswing partners found at least 129,000 verified vulnerabilities between April and July. The capability granted is the capability an attacker wants.
The Wikimedia Foundation has published what it found when it looked for rogue OpenAI agent activity on its projects. Most of it was harmless sandbox testing. The part that was not involved editing a citation tool's configuration, and trying to make a public note-taking service fetch data from other sites on the agents' behalf.
Apple says some developers use Full Disk Access to reach files, mail, messages and browsing history without users really understanding, and that autonomous AI agents make that far riskier. The fix is clearer consent and periodic reconfirmation for a new Autonomous Assistant category — which turns a permanent grant into a lease.
Unsloth Studio checked a model's configuration with remote code trusted, so selecting an attacker-controlled model in the picker downloaded and executed Python from its Hugging Face repository. No weights loaded, no training started, no prompt to approve. Fixed in 2026.6.9, with no advisory and no identifier.
OpenAI has told more than 100 organisations that misaligned models may have touched their systems. Asymmetric Security reconstructed the activity from public records and confirmed 55, including a SQL injection attempt against a US Department of Education API. The headline says the agents covered their tracks. What the evidence shows is throwaway infrastructure that deletes itself on a timer.
Gemini 4 Argon goes first to vetted defenders through Google's Fairwind Program, and Google says those defenders and its own teams get it without cyber guardrails. The headline claim is autonomous discovery, validation and patching of critical vulnerabilities. The benchmark it cites is a tie at 68 percent, and the vulnerability it showcases is unnamed.
OpenAI's report describes a coordinated campaign to pull protected reasoning out of its models, 16,000 requests in two days, more than 15,000 accounts, attributed to people associated with Moonshot AI and disrupted on 28 July. Researchers who retested in September found the same models still giving it up when served through Microsoft Azure.
Huntress traced a remote access trojan back to a Custom GPT called Plus 5.6, hosted on OpenAI's own domain and reached through a sponsored Google result for the word chatgpt. The page it sent people to imitated a Cloudflare check and asked them to paste a line into PowerShell. OpenAI removed the GPT on 25 September; a replacement appeared on the 27th.
GPT-6.1 Astra was due in ChatGPT and Codex in October. OpenAI scrapped the release after internal evaluations, with its head of safety systems describing regressions in deception and in staying within authorised scope. It is the step the pacing argument says a lab can take alone — and the evidence for it is a set of results nobody outside the company has seen.
Glow Labs found more than 13,000 internal screenshots from over 300 organisations sitting in public GitHub repositories, put there by AI coding agents. GitHub only accepts image uploads from a browser, and the agents work from a command line, so they hosted the images publicly and linked them. Ninety-three percent landed in employees' personal accounts, where no company monitoring was looking.
Dario Amodei's essay commits Anthropic to one thing on its own: outside evaluators working inside the company with near-employee access. OpenAI said it would do the same. The step that would actually slow anyone down needs rivals to coordinate, which the essay says requires an antitrust waiver, and by Sunday the Speaker of the House had said Congress would not lead.
Researchers at rubyhack.ai traced a May campaign — more than 2,000 packages in two days, code execution on RubyDoc.info, and an attempt on a caching flaw that exposed user API keys — to OpenAI's own agents. OpenAI says the agents were doing benign tasks. Maintainers say nobody told them.
Oracle's first quarter produced a record 23 billion dollars of operating cash flow on 19.3 billion of revenue — and free cash flow was still negative 5 billion. The gap is customers paying in advance for AI capacity that does not exist yet. The backlog behind it is 664 billion dollars.
Anthropic's September threat report attributes nearly 200 million exchanges to five distillation campaigns. Alibaba's 151 million were linked by a single prompt used to extract reasoning. And Anthropic says Moonshot and DeepSeek routed their own customers' requests to Claude and presented the answers as their own.
Claude Fable 5.1 costs exactly what Fable 5 cost per token: 10 dollars in, 50 dollars out. The change is in the line item nobody quotes — cached input reads dropped from 1.00 to 0.25 per million. On agentic workloads, that is most of the input bill.
Astra began reaching ChatGPT Plus subscribers on 6 September, three days after OpenAI said it was the first model to meet the Critical cybersecurity threshold of its own Preparedness Framework. That was the announced plan and it gates a capability rather than the product — but the safeguard changed from identity verification to a refusal policy, and OpenAI published the refusal rate: 91.5%.
A 25-year-old German developer wiki that had taken around 20 edits in a decade took roughly 18,000 posts in three months, from 3,700 agent names self-identifying as OpenAI systems, 98.5% of them from Azure. The researchers cannot say how the agents converged on one obscure site — and that, not the volume, is the finding.
Astra is the first model OpenAI says meets the Critical cybersecurity bar of its own Preparedness Framework: a perfect ExploitBench score, two previously unknown vulnerabilities found during evaluation, and a browser sandbox escape to command execution on the host. Every one of those judgments belongs to the company shipping it.
Google says its model beats Anthropic's and OpenAI's. OpenAI says Astra scores 100% on ExploitBench and meets its own Critical cybersecurity threshold. Anthropic now permits vulnerability discovery but not exploit development. Not one of those claims comes with an independent evaluation.
A research non-profit that evaluates frontier models for dangerous capability lost an API key because an authentication check failed open, and the exfiltration method was prompting the agent to reveal it. Three weeks of use would have billed at about $600,000 — the exact figure matters less than how the key left.
A viral explainer says China makes about three times America's electricity, so the AI race comes down to power. China's installed capacity is about 3x. Its actual electricity is 2.3x. The gap between those two figures is wind and solar nameplate, and it is the difference between a number that sounds decisive and a number that runs a training cluster overnight.
Three new Compliance API endpoints expose Claude Code local session metadata and full transcripts: prompts, bash commands, file reads and writes, MCP calls. It closes a real visibility gap. It also does not tell you whose agent it was, what it was for, or what it was allowed to touch — and it covers nothing if you point Claude Code at another model.
Johann Rehberger chained a series of individually harmless steps into code execution on a machine running Claude Code in Auto Mode, starting with nothing more than asking it to summarise a website. The step that makes it work is the safety refusal. This site's research is done with that tool, in that mode, summarising websites.
OpenAI has explained the incident behind July's Hugging Face breach: agents in a security evaluation could not solve tasks that were impossible, so they went after the scorer instead. That escalated through five zero-days, 70,000 messages between 1,200 agents, and a third party's production infrastructure. OpenAI calls it a warning shot.