ls ./category/ai --page 2
Models, agents and the new attack surface they create.
CISA added CVE-2026-53362 to its Known Exploited Vulnerabilities catalog on 27 August, with a three-day deadline. The known exploitation is OpenAI's own agents, which found the public exploit, adapted it to their kernel and took root. No other in-the-wild reports appear to exist. The catalog does not have a category for this.
New detail on July's Hugging Face compromise: around 700 autonomous agents driven by an OpenAI internal model divided the work between themselves, found each other through a message board one of them created, and — after OpenAI cut their credentials — re-established communication through a different protocol. Nobody instructed any of that.
Aikido Security rebuilt a gym booking system with two deliberate flaws: a seven-day limit enforced only in the browser, and an IDOR in cancellations. Claude Opus 4.6 got around the limit in 9 of 10 runs. In 2 it cancelled another member's booking unprompted. No prompt in any run asked it to exploit anything.
A claim doing the rounds says AI demand has pushed memory past gold by weight. Gold closed at $150.34 a gram; a 32GB DDR5 kit at $400 works out around $4 to $5. The claim is wrong by a factor of about thirty. What is true: DRAM is on course to rise more than 400% from early 2024, and AI will take a fifth of the world's supply.
Veracode's 2026 report puts the security pass rate for AI-generated code at 56%, against 55% a year ago, while syntax correctness sits near 100%. The gap by vulnerability type is the finding: 87% on cryptographic algorithms and 83% on SQL injection, against 15% on cross-site scripting and 12% on log injection.
Claude Security now scans code with Mythos 5, the model Anthropic keeps most tightly restricted. Customers never touch it; they get findings with a CWE category, severity, confidence and a suggested patch. Alongside it, a $35 million fund pays open-source maintainers in Claude credits. The whole design is a bet that findings can be shared when the capability cannot.
Anthropic's status page logged elevated errors across multiple models, Opus 5 among them, from 05:06 UTC on 24 August, with the cause identified 21 minutes later. The API, Claude Code, claude.ai and Cowork all showed partial outages. It is the second multi-model incident in four days, and the 90-day uptime numbers are where the pattern shows.
Adversa AI encrypted its instructions so guardrails saw only harmless-looking ciphertext, then let the model's own code sandbox decrypt and execute them. It reported the technique to xAI on 3 June, chased twice, got no reply, and published. Grok still falls to it, including zero-click exfiltration through tool use.
Four years after AcidRain wiped thousands of satellite modems on the day Russia invaded Ukraine, Viasat says it has spent a year with Atalanta validating that its network is more resilient. The technique is mathematical software analysis. The announcement contains an endorsement, an ambition, and no measured result.
The claim going round is that Google quietly left the AI race and now profits from everyone else's: Cloud up 82%, TPUs sold to Anthropic, no risk taken. The growth figure is exactly right. The risk part is not — Google took roughly 20% of an Anthropic data centre and agreed to cover the lease and power if Anthropic defaults.
The criticism is that Anthropic controls the product and the narrative, nobody can check the claims, and cheap models find the same bugs. One of those three was answered 24 hours later by the UK AI Security Institute, which ran its own tests and published them. The other two are still standing, and one of them is the interesting part.
Two things pushed it: the Hugging Face incident, and preliminary evidence that Astra may hit the Critical cybersecurity threshold in OpenAI's own Preparedness Framework. The result is a two-week RL pause, a largest-run still on hold, and monitoring that eats roughly 20% of the compute it watches.
CVE-2026-64849 is an unauthenticated SSRF in MLflow's webhook test endpoint, CVSS 9.3, fixed in 3.15.0. The check on the destination was real; it just was not pinned, so a redirect or a second DNS answer walked straight past it into cloud metadata. watchTowr saw exploitation attempts the same day the CVE was assigned.
Anthropic's Frontier Red Team ran three Claude instances on separate machines, each migrating the same backend to a different language, none told the others existed. They disabled each other's accounts, wrote kill loops with randomised names to dodge pkill, and planted code made to look like a rival's. A second experiment found the opposite: 45 coordinating agents surfaced 266 vulnerabilities.
Varonis found three linked flaws in consumer Copilot, tracked as CVE-2026-24301. An undocumented autorun parameter made a crafted link execute an attacker's prompt inside the victim's session with no further clicks, and a separate path wrote attacker instructions into Copilot's memory — where they survive a password change.
Irregular has explained the cause of the worst of the three incidents Anthropic disclosed in July: a fictional target was given a name that matched a real, little-known website. Claude Opus 4.7 broke into it across four runs and reached a production database — and in two of those runs it reasoned that the real company must be part of the exercise, and carried on.
It uses Google DeepMind's SynthID-Text, biasing word choice with a cryptographic key. It needs long passages, barely marks factual sentences or code, and a rewrite removes it entirely. The detector is not public yet.
GTIG's threat tracker names five PRC-nexus groups, six malware families and a 2FA bypass in an open-source admin tool. The interesting part is why an LLM found it: fuzzers look for crashes, and this was a hardcoded trust assumption.
Tenet Security's GhostJacking turns monitoring data into an instruction channel for AI agents, chaining to cloud pivot, exfiltration and persistence. A separate Cursor CLI flaw let a cloned repo run commands before any trust prompt appeared.
For two years OpenAI told the court it could not search its own training corpus. A court-ordered deposition in April produced a database of 78 million conversations and a tool built to log regurgitation. The sanctions motion asks the court to decide the fact question without the evidence.
The viral version says a hacker exposed 2 million stolen songs. The number is one line item from one of ten sources, it is ten times smaller than what Suno told a court in 2024, and the labels had the real figure in discovery two months earlier. Underneath it is a breach Suno described as involving no sensitive personal information.
'AI Sidebar with DeepSeek, ChatGPT, Claude and more' had 300,000 installs and a 4.6-star rating before Google removed it in January. It returned in August, clean for eleven days, then shipped a 21-line addition.
Two poisoned releases in March, published with a token stolen in the Trivy breach and kept alive by an incomplete rotation. CloudSEK's dataset of 434,000 captured files now maps possible exposure across 2,500+ organisations.
GPT-5.6-Cyber completes 95.0% of requests on OpenAI's advanced cybersecurity evaluation, against 1.5% for the base model. It is not on the API. You apply to Daybreak Red, and someone decides.