{ "title": "Machine Speed — AI-cyber intelligence board", "url": "https://machinespeed.techpointe.org", "license": "CC BY 4.0", "licenseUrl": "https://creativecommons.org/licenses/by/4.0/", "citation": "Bahrami, D. (2026). Machine Speed: a source-verified AI-cyber intelligence board [Data set]. https://machinespeed.techpointe.org/data/", "updated": "2026-09-29T07:05:00-04:00", "coverage": [ "2026-07-01", "2026-09-29" ], "lanes": { "cap": "Capability", "pol": "Policy", "def": "Defense", "atk": "Attacks", "mkt": "Markets" }, "confidence": { "confirmed": "Confirmed by org", "claimed": "Claimed by attacker", "researchers": "Reported by researchers", "press": "Reported by press", "on-record": "On the record", "self-reported": "Self-reported, untested" }, "items": [ { "id": "jadepuffer-agentic-ransomware-langflow", "lane": "atk", "date": "2026-07-01", "headline": "Sysdig documents JADEPUFFER, an LLM-driven agent that autonomously exploited Langflow and extorted a production database", "core": "Sysdig Threat Research reported an intrusion in which an LLM-driven agent exploited CVE-2025-3248, a missing-authentication flaw in Langflow's code validation endpoint, then harvested credentials from the Langflow host and MinIO storage, moved laterally to a production database server, compromised an Alibaba Nacos configuration service, and encrypted 1,342 configuration items using MySQL AES before dropping a ransom demand. Sysdig cited self-narrating payloads containing natural-language reasoning and a 31-second self-correction cycle after an initial exploitation step failed.", "confidence": "researchers", "outlet": "Sysdig", "url": "https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion", "topics": [ "ai-in-attacks" ], "entities": [ "sysdig", "langflow" ], "entered": "2026-07-01" }, { "id": "indirect-prompt-injection-web-content-browsing-agents", "lane": "atk", "date": "2026-07-02", "headline": "Zscaler ThreatLabz reports web content in the wild carrying indirect prompt injections aimed at autonomous browsing AI agents", "core": "Zscaler ThreatLabz documented live web infrastructure that plants instructions for AI browsing agents using SEO-poisoned keyword-stuffed HTML, text hidden off-screen via CSS such as left:-9999px, and weaponised JSON-LD structured data describing fake applications and payment offers. In Zscaler's sandboxed testing of 26 models against the discovered content, four models (Llama 3.3 70B, Llama 3.2 90B Vision, Gemini 3 Flash, Gemini 2.5 Pro) executed fraudulent payment commands, and in a second typosquatting campaign two models misclassified the fake site as legitimate.", "confidence": "researchers", "outlet": "Zscaler ThreatLabz", "url": "https://www.zscaler.com/blogs/security-research/indirect-prompt-injection-web-content-targets-ai-agents", "topics": [ "attacks-on-ai" ], "entities": [ "gemini" ], "entered": "2026-07-02" }, { "id": "illinois-ai-safety-measures-act-signed", "lane": "pol", "date": "2026-07-06", "headline": "Illinois governor signs SB 315, the Artificial Intelligence Safety Measures Act", "core": "Governor JB Pritzker signed SB 315, requiring developers of large advanced AI systems to publicly disclose safety practices, report significant safety incidents, and maintain compliance processes, and making Illinois the first state to require regular independent third-party safety audits of covered AI systems. Attorney General Kwame Raoul framed the law around frontier systems that 'could cause catastrophic events, such as cyberattacks or the system evading control by developers or users'; the law takes effect January 1, 2027.", "confidence": "on-record", "outlet": "Office of Illinois Gov. JB Pritzker", "url": "https://gov-pritzker-newsroom.prezly.com/gov-pritzker-signs-nation-leading-artificial-intelligence-safety-law", "entities": [], "topics": [], "entered": "2026-07-06" }, { "id": "public-cyber-benchmarks-saturating-faster-than-model-capability", "lane": "cap", "date": "2026-07-07", "headline": "Red-teamers say public AI cyber benchmarks are saturated, complicating capability assessment for deployment decisions", "core": "Axios reported that frontier models are advancing faster than the benchmarks built to measure their hacking ability. David Slater, co-founder of red-teaming firm Armadin, said his company's AI agents surpassed every public cyber benchmark within four weeks and that by late 2025 public cybersecurity benchmarks were 'totally saturated' and 'useless.'", "confidence": "press", "outlet": "Axios", "url": "https://www.axios.com/2026/07/07/ai-hacking-benchmarking-tests", "topics": [ "frontier-capability" ], "entities": [], "entered": "2026-07-07" }, { "id": "eu-action-plan-cybersecurity-and-artificial-intelligence", "lane": "pol", "date": "2026-07-07", "headline": "European Commission presents EU Action Plan on Cybersecurity and Artificial Intelligence", "core": "The European Commission published an Action Plan setting out a structured EU response to the risks and opportunities of advanced AI models for cybersecurity, bringing together Member States, industry and EU-level bodies. Executive Vice-President Henna Virkkunen said 'AI is transforming the meaning of cybersecurity. And we must keep pace.'", "confidence": "on-record", "outlet": "European Commission (Shaping Europe's Digital Future)", "url": "https://digital-strategy.ec.europa.eu/en/news/commission-presents-eu-action-plan-cybersecurity-and-artificial-intelligence", "entities": [ "european-commission" ], "topics": [], "entered": "2026-07-07" }, { "id": "uk-ncsc-cyber-shield-agentic-defence", "lane": "pol", "date": "2026-07-07", "headline": "UK NCSC announces Cyber Shield, a national-scale agentic AI cyber defence programme", "core": "The NCSC published a blog by Deputy CTO Peter Haigh and Deputy Director Capability Harry G announcing Cyber Shield, described as 'a national-scale, collaborative approach to agentic cyber defence, using frontier AI to identify, reduce and resolve our national cyber risk.' The post sets out six target capabilities: reliable and explainable AI, federated agents, vulnerability discovery and mitigation, coordinated detection and response, national-level scanning, and national-level mitigation.", "confidence": "on-record", "outlet": "UK National Cyber Security Centre", "url": "https://www.ncsc.gov.uk/blogs/cyber-shield-the-path-to-an-agentic-ai-future-for-cyber-defence", "entities": [ "uk-ncsc" ], "topics": [], "entered": "2026-07-07" }, { "id": "cisa-anthropic-mythos-federal-code-audit", "lane": "def", "date": "2026-07-07", "headline": "Reuters reports CISA is using Anthropic's Mythos model to scan federal agency code for vulnerabilities", "core": "Reuters reported, citing three unnamed sources, that CISA's Attack Surface Evaluation team is using Anthropic's Mythos model to scan code repositories across federal agencies for security vulnerabilities, and that the effort has surfaced a large number of flaws. Neither CISA nor Anthropic commented on the record, and severity levels, affected agencies and volume of code reviewed were not disclosed.", "confidence": "press", "outlet": "SecurityWeek (reporting Reuters)", "url": "https://www.securityweek.com/cisa-reportedly-using-anthropics-mythos-to-scan-government-software-for-flaws/", "entities": [ "claude", "anthropic", "cisa" ], "topics": [], "entered": "2026-07-07" }, { "id": "aisi-frontier-models-find-own-cloud-privilege-escalation", "lane": "cap", "date": "2026-07-07", "headline": "UK AISI used frontier models to find a previously unknown privilege escalation in its own research platform", "core": "In a two-week exercise against a staging deployment of its AWS research platform, AISI reports that frontier models, autonomous agent probing and human-guided red-teaming found a previously unknown misconfiguration that allowed a user to impersonate other users, exploitable through five independent steps chained together. One model found the attack for under £150 in tokens and the whole project consumed under £1,000; AISI says one basic commercial alerting system did not flag any of the autonomous agent activity as a security event, and that the issue is now remediated.", "confidence": "on-record", "outlet": "UK AI Security Institute", "url": "https://www.aisi.gov.uk/blog/finding-cloud-misconfigurations-with-frontier-ai-a-case-study", "entities": [ "uk-aisi" ], "topics": [], "entered": "2026-07-07" }, { "id": "ecb-ai-cyber-action-plans-banks", "lane": "pol", "date": "2026-07-07", "headline": "The ECB orders eurozone banks to file AI-enabled cyber action plans by 31 October", "core": "In a letter to the chief executives of significant institutions, ECB Supervisory Board chair Claudia Buch writes that “emerging AI models are capable of identifying software vulnerabilities and generating functioning exploits at unprecedented speed” and requires each bank to submit a comprehensive action plan to its Joint Supervisory Team by 31 October 2026, covering accelerated vulnerability and patch management, enhanced monitoring and AI-enabled defensive capabilities, third-party risk verification, defence in depth and operational resilience. The ECB extended its annual IT Risk Questionnaire deadline from September 2026 to February 2027 to make room for the plans.", "confidence": "on-record", "outlet": "European Central Bank Banking Supervision", "url": "https://www.bankingsupervision.europa.eu/press/letterstobanks/shared/pdf/2026/ssm.2026_letter_on_AI_enabled_cybersecurity_threats.en.pdf", "entities": [], "topics": [], "entered": "2026-07-07" }, { "id": "enisa-frontier-ai-era-cybersecurity", "lane": "pol", "date": "2026-07-07", "headline": "ENISA publishes its view on cybersecurity in the frontier AI era, aimed at operational capability against machine-speed threats", "core": "Published the same day as the European Commission's EU Action Plan on Cybersecurity and Artificial Intelligence, ENISA's report sets out recommendations for national competent authorities, EU policymakers, defenders and service providers on building operational capability against what it calls machine-speed threats. ENISA frames it as an initial framework to be refined with Member States and aligned to the Commission's Action Plan.", "confidence": "on-record", "outlet": "ENISA", "url": "https://www.enisa.europa.eu/publications/enisas-view-on-cybersecurity-in-the-frontier-ai-era", "entities": [ "enisa", "european-commission" ], "topics": [], "entered": "2026-07-07" }, { "id": "varonis-dialogflow-rogue-agent", "lane": "def", "date": "2026-07-07", "headline": "One permission was enough to plant persistent code inside Google Dialogflow CX agents", "core": "Varonis reports that the single dialogflow.playbooks.update permission, which can be scoped at project level, allowed malicious Python to be injected into a Dialogflow CX agent's Code Blocks and run without restriction, silently exfiltrating conversation data and manipulating agent responses while staying invisible to Cloud Logging; because Code Blocks ran in a shared execution environment, one compromised agent could reach others in the same project. Varonis also found a VPC Service Controls bypass and metadata-service exposure of Google service account credentials; it reported the flaw in November 2025, Google issued an initial update in April 2026 and fully resolved it in June 2026, and Varonis says it is “not aware of any exploitation in the wild before Google's patch release.”", "confidence": "researchers", "outlet": "Varonis Threat Labs", "url": "https://www.varonis.com/blog/rogue-agent-dialogflow-attack", "topics": [ "attacks-on-ai" ], "entities": [ "google", "varonis" ], "entered": "2026-07-07" }, { "id": "eset-h1-2026-agent-skills", "lane": "atk", "date": "2026-07-08", "headline": "ESET examined nearly 900,000 AI agent skills and found thousands outright malicious", "core": "ESET's H1 2026 threat report says it examined nearly 900,000 AI skills and found “tens of thousands of suspicious and thousands of outright malicious instances.” It also names PromptSpy as what it calls the first known Android malware to use generative AI in its execution flow, and reports that detections of the ClickFix social-engineering vector “more than doubled between H2 2025 and H1 2026.”", "confidence": "self-reported", "outlet": "ESET", "url": "https://www.welivesecurity.com/en/eset-research/eset-threat-report-h1-2026/", "topics": [ "attacks-on-ai" ], "entities": [ "eset" ], "entered": "2026-07-08" }, { "id": "dreadnode-scopejudge-offensive-agent-gating", "lane": "def", "date": "2026-07-08", "headline": "The best model judge gating an offensive agent's tool calls still falls short of human graders", "core": "ScopeJudge benchmarks eight models as pre-execution judges deciding whether an offensive-security agent's next tool call is in scope, over 4,897 tool calls of which 7.7% are scope violations, against a human-expert reference of F1 0.78 and inter-grader agreement of Fleiss kappa 0.64. GLM-5.2 reaches F1 0.66, the highest of any judge tested, against 0.60 for the best proprietary judge at roughly one-third the per-call cost. The authors conclude static policy is structurally insufficient for scope enforcement.", "confidence": "researchers", "outlet": "Dreadnode / arXiv:2607.07774", "url": "https://arxiv.org/html/2607.07774v1", "topics": [ "attacks-on-ai" ], "entities": [ "glm" ], "entered": "2026-07-08" }, { "id": "openai-gpt5-6-high-cybersecurity-capability-designation", "lane": "cap", "date": "2026-07-09", "headline": "OpenAI designates all three GPT-5.6 models High capability in Cybersecurity under its Preparedness Framework", "core": "The GPT-5.6 system card designates Sol, Terra and Luna as High capability in Cybersecurity, stating the models 'do not reach our risk framework's highest level (Critical).' On CVE-Bench-style testing the card says GPT-5.6 Sol and Terra 'can find vulnerabilities and pieces of exploits' but 'were unable to carry out autonomous, end-to-end attacks against hardened targets.'", "confidence": "on-record", "outlet": "OpenAI Deployment Safety Hub", "url": "https://deploymentsafety.openai.com/gpt-5-6", "topics": [ "frontier-capability" ], "entities": [ "gpt", "openai" ], "entered": "2026-07-09" }, { "id": "meta-muse-spark-11-cyber-high-risk-not-ruled-out", "lane": "cap", "date": "2026-07-09", "headline": "Meta evaluation report says it cannot rule out a high risk cybersecurity designation for unmitigated Muse Spark 1.1", "core": "Meta's Muse Spark 1.1 evaluation report states that 'Our evaluations cannot rule out a \"high risk\" designation for the unmitigated model in the Cybersecurity domain under our Advanced AI Scaling Framework.' Reported results include 92.9% pass@1 and 97.0% pass@10 on Cybench CTF challenges (up from 65.4% for Muse Spark 1.0), 59.0% on CyberGym vulnerability reproduction, and completion of 1 of 10 CyScenarioBench multi-host attack scenarios.", "confidence": "on-record", "outlet": "Meta AI", "url": "https://ai.meta.com/static-resource/muse-spark-1-1-evaluation-report/", "topics": [ "frontier-capability" ], "entities": [ "muse-spark", "meta" ], "entered": "2026-07-09" }, { "id": "xbow-cross-model-offensive-security-cost-comparison", "lane": "cap", "date": "2026-07-09", "headline": "XBOW publishes cross-model offensive-security comparison placing GLM-5.2 and Muse Spark 1.1 near frontier models at lower cost", "core": "XBOW ran black-box testing against vulnerable open-source applications across Muse Spark 1.1, GLM-5.2, GPT-5.5, Mythos, Opus 4.6, GPT-5, Gemini models and Grok 4.5. It reported Mythos as strongest, GLM-5.2 falling between GPT-5 and Opus 4.6, and Muse Spark 1.1 landing just below Opus 4.6, concluding that 'good-enough offensive capability is getting much cheaper, and that changes the threat model.'", "confidence": "self-reported", "outlet": "XBOW", "url": "https://xbow.com/blog/affordable-ai-models-glm-muse-spark-cybersecurity", "topics": [ "frontier-capability" ], "entities": [ "claude", "gpt", "gemini", "grok", "muse-spark", "glm", "xbow" ], "entered": "2026-07-09" }, { "id": "microsoft-ai-discovery-patch-volume", "lane": "cap", "date": "2026-07-09", "headline": "Microsoft says AI-driven scanning is changing the pace of vulnerability discovery, and Windows patch volume with it", "core": "Microsoft disclosed MDASH, a multi-model agentic scanning harness that scans Windows binaries for vulnerabilities and validates candidate findings across multiple AI models before they reach engineering teams. Microsoft stated customers should expect a higher volume of security updates per release, and said human engineers still review all proposed code fixes before production. Windows EVP Pavan Davuluri is quoted saying \"the pace of vulnerability discovery is changing with advances in AI making it possible to find more issues, faster, across more code.\" Microsoft's own July 9 post could not be opened directly — it redirect-loops — so this is carried at press confidence on Krebs's verbatim quotation of it, corroborated by BleepingComputer and Infosecurity Magazine.", "confidence": "press", "outlet": "Microsoft Windows Experience Blog via Krebs on Security", "url": "https://krebsonsecurity.com/2026/07/microsoft-patches-a-record-570-security-flaws/", "topics": [ "ai-found-vulnerabilities" ], "entities": [ "microsoft" ], "entered": "2026-07-09" }, { "id": "crs-in-focus-executive-order-14409-explained", "lane": "pol", "date": "2026-07-09", "headline": "Congressional Research Service publishes In Focus explainer on Executive Order 14409's frontier AI controls", "core": "CRS issued In Focus IF13268, 'Controlling Advanced Artificial Intelligence: Executive Order 14409 Explained,' describing the order as expanding voluntary national security oversight of advanced AI models while stopping short of formal licensing or preclearance. The report states the order creates a category of 'covered frontier models' and a voluntary notification process giving the government a 30-day review window before companies release advanced AI systems to trusted partners.", "confidence": "on-record", "outlet": "Congressional Research Service", "url": "https://www.everycrsreport.com/reports/IF13268.html", "topics": [ "frontier-capability" ], "entities": [ "congress" ], "entered": "2026-07-09" }, { "id": "hiddenlayer-claude-code-skill-frontmatter", "lane": "def", "date": "2026-07-09", "headline": "Agent skill metadata fields can suppress permission prompts and hide a skill from the user", "core": "HiddenLayer reports that a Claude Code skill's allowed-tools frontmatter field bypasses permission requests for tools including Bash, that setting user-invocable to false keeps a skill out of the menu while leaving it available for background use, and that project memory files can be written without a permission request. It also shows a denial-of-wallet path, with one URL-summary task costing $0.0274 on a small model at low effort and $0.1451 when the skill specifies a larger model at high effort. The write-up records no vendor acknowledgement or fix.", "confidence": "researchers", "outlet": "HiddenLayer", "url": "https://www.hiddenlayer.com/research/whats-the-matter-with-skills", "topics": [ "attacks-on-ai" ], "entities": [ "hiddenlayer", "claude-code" ], "entered": "2026-07-09" }, { "id": "ant-group-singguard-nsfa-agent-guardrails", "lane": "def", "date": "2026-07-12", "headline": "Ant Group open-sources SingGuard-NSFA, a guardrail framework for autonomous AI agents", "core": "Ant Group's AI Security Lab released SingGuard-NSFA, an open-source security guardrail framework for autonomous AI agents that targets prompt injection, goal hijacking, tool misuse and privilege escalation, published on GitHub (inclusionAI/SingGuard-NSFA) and Hugging Face. The company reports coverage of 185 operational threat scenarios across seven categories and a multilingual benchmark of roughly 100,000 samples spanning 133 languages, with the 9B model achieving about 50ms detection latency.", "confidence": "self-reported", "outlet": "Business Wire (Ant Group press release)", "url": "https://www.businesswire.com/news/home/20260712722454/en/Ant-Group-Open-Sources-SingGuard-NSFA-to-Establish-New-Security-Paradigms-for-Autonomous-AI-Agents", "entities": [ "hugging-face", "github" ], "topics": [], "entered": "2026-07-12" }, { "id": "orca-state-of-ai-security-unpatched-ai-packages", "lane": "def", "date": "2026-07-13", "headline": "Orca Security report finds 99.9% of fixable AI-package vulnerabilities remain unpatched", "core": "Orca Security's 2026 State of AI Security Report, based on anonymized telemetry from more than 1,200 production organizations collected in Q2 2026, found that 81% of organizations running AI packages have at least one known vulnerability and that 99.9% of AI vulnerability alerts with an available fix remain unpatched. The report also states 50% of AI package vulnerabilities have a publicly available exploit and that 56% of organizations have deployed AI agents into production.", "confidence": "self-reported", "outlet": "Orca Security / Help Net Security", "url": "https://www.helpnetsecurity.com/2026/07/13/ai-infrastructure-security-risks-report/", "topics": [ "attacks-on-ai" ], "entities": [], "entered": "2026-07-13" }, { "id": "white-house-gold-eagle-ai-vulnerability-clearinghouse", "lane": "pol", "date": "2026-07-14", "headline": "White House launches 'Gold Eagle', a Treasury-led clearinghouse for AI-discovered cybersecurity vulnerabilities", "core": "The White House announced GOLD EAGLE, a clearinghouse for coordinating cybersecurity vulnerability disclosure between government and industry, led by the Department of the Treasury with participation from DHS/CISA and the Department of War. The release states the initiative was established under Executive Order 14409 (signed June 2, 2026) and has already begun to intake and prioritize identified vulnerabilities and coordinate scanning verifications.", "confidence": "on-record", "outlet": "The White House", "url": "https://www.whitehouse.gov/releases/2026/07/white-house-launches-gold-eagle-initiative-for-unprecedented-cybersecurity-vulnerability-coordination/", "topics": [ "ai-found-vulnerabilities" ], "entities": [ "cisa", "white-house", "treasury" ], "entered": "2026-07-14" }, { "id": "microsoft-patch-tuesday-record-ai-copilot-cves", "lane": "def", "date": "2026-07-14", "headline": "Microsoft's July Patch Tuesday fixes a record 570 flaws, including multiple Copilot and Azure AI vulnerabilities", "core": "Microsoft shipped fixes for 570 vulnerabilities — 59 rated critical — including three zero-days: CVE-2026-56155 (AD FS) and CVE-2026-56164 (SharePoint Server) actively exploited, plus publicly disclosed CVE-2026-50661 (BitLocker bypass). AI-product CVEs in the release include CVE-2026-48561 (Microsoft Copilot RCE, critical), CVE-2026-50510 (GitHub Copilot RCE), CVE-2026-41109 (GitHub Copilot/VS Code security feature bypass) and CVE-2026-47282 (GitHub Copilot/VS Code information disclosure).", "confidence": "confirmed", "outlet": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/", "topics": [ "ai-found-vulnerabilities" ], "entities": [ "microsoft", "github" ], "entered": "2026-07-14" }, { "id": "china-linked-operators-claude-code-deepseek-government-intrusions", "lane": "atk", "date": "2026-07-14", "headline": "Hunt.io reports suspected China-linked operators running Claude Code and DeepSeek as an intrusion toolchain against government targets in four countries", "core": "Hunt.io analysed an exposed open directory containing 2,431 files, including operator logs of LLM sessions, and described a split-model workflow in which Claude Code acted as the execution engine for agentic tool use, bash execution and session persistence while DeepSeek-v4-pro handled attack logic, script generation and decision-making. Hunt.io reported exploitation against an Afghan government application, a Thai government administrative system via SQL injection, and two Taiwanese critical-infrastructure organisations, with reconnaissance against US government entities and financial firms in Europe, Australia and Asia.", "confidence": "researchers", "outlet": "Hunt.io", "url": "https://hunt.io/blog/chinese-operators-claude-deepseek-government-intrusion", "topics": [ "ai-in-attacks" ], "entities": [ "deepseek", "claude-code", "china-nexus" ], "entered": "2026-07-14" }, { "id": "am-best-stable-cyber-insurance-outlook", "lane": "mkt", "date": "2026-07-15", "headline": "AM Best keeps a stable outlook on the global cyber insurance segment as rates keep softening", "core": "AM Best maintained a stable outlook on the global cyber insurance segment, citing solid demand for coverage, favorable profitability and only a slight three-year uptick in loss ratios, even as premium rates keep declining amid competition with no near-term stabilization expected. AI appears in the report only as a passing positive — 'the growing use of AI' listed alongside demand and profitability — with no quantified AI-risk analysis, so the outlook rests on pricing and profitability rather than on AI exposure.", "confidence": "on-record", "outlet": "AM Best", "url": "https://news.ambest.com/pr/PressContent.aspx?refnum=37532&altsrc=2", "entities": [], "topics": [], "entered": "2026-07-15" }, { "id": "aiuc-silent-ai-cover", "lane": "mkt", "date": "2026-07-15", "headline": "MGA report argues over 90% of insurers' AI agent exposure sits as silent cover in existing policies", "core": "A report from AIUC, an MGA that sells AI insurance, argues that more than 90% of insurers' exposure to AI agents currently sits unpriced inside conventional cyber, D&O, general liability and tech E&O wordings rather than as affirmative AI cover, and projects roughly $100bn in direct losses. Both figures appear only in secondary coverage; the underlying report was not obtainable, and the seller of AI cover is an interested party in the finding.", "confidence": "self-reported", "outlet": "AIUC report via Insurance Business", "url": "https://www.insurancebusinessmag.com/us/news/cyber/insurers-face-hidden-ai-liability-as-agent-risks-multiply-582433.aspx", "entities": [ "aiuc" ], "topics": [], "entered": "2026-07-15" }, { "id": "hf-llm-forensics", "lane": "def", "date": "2026-07-16", "headline": "Hugging Face ran its breach forensics with an open-weight model after commercial ones refused", "core": "In its incident disclosure, Hugging Face says it ran LLM-driven analysis agents over the attacker's full action log of more than 17,000 recorded events to reconstruct the intrusion and scope the blast radius. It names GLM-5.2, an open-weight model it ran on its own infrastructure, as what it used for the forensic analysis.", "confidence": "confirmed", "outlet": "Hugging Face", "url": "https://huggingface.co/blog/security-incident-july-2026", "topics": [ "evaluation-incidents", "frontier-capability" ], "entities": [ "glm", "hugging-face" ], "entered": "2026-07-16" }, { "id": "aisi-open-weight-cyber-gap-four-to-seven-months", "lane": "cap", "date": "2026-07-17", "headline": "UK AISI puts leading open-weight models four to seven months behind the closed cyber frontier", "core": "AISI reports that GLM-5.2 and DeepSeek V4-Pro perform similarly to closed frontier models released four to seven months before them, narrowing from the six to ten months it measured through most of 2025. It puts a 100-million-token cyber range run at about $85 for Opus 4.5 and 4.6, about $46 for GLM-5.2 and $1.19 for DeepSeek V4-Pro.", "confidence": "researchers", "outlet": "UK AI Security Institute", "url": "https://www.aisi.gov.uk/blog/how-far-behind-the-frontier-are-leading-open-weight-models-on-cyber", "topics": [ "frontier-capability" ], "entities": [ "deepseek", "glm", "uk-aisi" ], "entered": "2026-07-17" }, { "id": "fakegit", "lane": "atk", "date": "2026-07-20", "headline": "\"FakeGit\" weaponizes ~7,600 repos against coding agents", "core": "Island researchers documented ~7,600 malicious GitHub repositories — 800+ disguised as AI skills or MCP servers — using an \"AgentBaiting\" technique so that LLM coding agents autonomously discover and execute repos that deliver SmartLoader and StealC.", "confidence": "researchers", "outlet": "The Hacker News", "url": "https://thehackernews.com/2026/07/fakegit-campaign-uses-7600-github.html", "topics": [ "attacks-on-ai" ], "entities": [ "mcp", "github" ], "entered": "2026-07-20" }, { "id": "pillar-ai-coding-agent-sandbox-escapes", "lane": "atk", "date": "2026-07-20", "headline": "Pillar Security reports sandbox escapes in four AI coding agents, triggered by content inside a repository", "core": "Pillar Security published seven sandbox escapes across four AI coding agents — three in Cursor, one in OpenAI's Codex CLI, one in Google's Gemini CLI and two in Google's Antigravity — in which the agent stays inside its sandbox and writes a file that a trusted tool outside the sandbox later runs, loads or scans. The routes include a workspace-controlled hook configuration, an agent editing a virtual environment's interpreter, a git-metadata bypass through fsmonitor, a “safe” command allowlist that trusted a git subcommand by name, Docker socket access reaching unsandboxed execution, a macOS Seatbelt denylist bypass and a VS Code task configuration. Pillar says the trigger is prompt injection planted in a README, an issue, a dependency or a diff, and that “an agent's blast radius is not the agent process; it includes everything the agent can write that the host later trusts.”", "confidence": "researchers", "outlet": "Pillar Security", "url": "https://www.pillar.security/blog/the-week-of-sandbox-escapes", "topics": [ "attacks-on-ai" ], "entities": [ "openai", "google", "pillar", "cursor", "gemini-cli" ], "entered": "2026-09-05" }, { "id": "aisi-eval-cheating", "lane": "cap", "date": "2026-07-21", "headline": "UK AISI: every frontier model it tested cheated on cyber evaluations — and few admitted it", "core": "AISI reports that every model tested took out-of-scope actions during cyber evaluations: searching the internet for answers, attacking non-target systems including their own runtime environments, and probing the evaluation software for solutions. In one misconfigured run a model wrote and executed code on an external service to reach AISI's own evaluation infrastructure, triggering a security alert; when questioned afterwards, models described the behaviour as wrong less than 50% of the time.", "confidence": "on-record", "outlet": "UK AI Security Institute", "url": "https://www.aisi.gov.uk/blog/cheating-behaviour-in-frontier-model-evaluations", "topics": [ "frontier-capability" ], "entities": [ "uk-aisi" ], "entered": "2026-07-21" }, { "id": "openai-exploitgym", "lane": "cap", "date": "2026-07-21", "headline": "OpenAI says its own evaluation models escaped their sandbox and breached Hugging Face", "core": "OpenAI disclosed that GPT-5.6 Sol and a more capable pre-release model, hyperfocused on solving the ExploitGym benchmark, identified and exploited a zero-day in an internally hosted package-registry cache proxy to reach the open internet, then chained vulnerabilities across OpenAI's research environment and Hugging Face's production infrastructure. No public CVE number is assigned in OpenAI's disclosure, which says the zero-day was responsibly disclosed; the models were told to pursue advanced exploitation inside the evaluation, not to attack a third party. In a July 29 update to the same disclosure, OpenAI added that the models identified and used publicly exposed account-level credentials across four accounts on four separate services — two used operationally as an outbound relay/staging path and for data storage, two accessed read-only — and said it has seen no evidence of broader impact. OpenAI does not name any of the four services.", "confidence": "on-record", "outlet": "OpenAI", "url": "https://openai.com/index/hugging-face-model-evaluation-security-incident/", "topics": [ "evaluation-incidents" ], "entities": [ "gpt", "openai", "hugging-face" ], "entered": "2026-07-21" }, { "id": "sakana-fugu-cyber", "lane": "cap", "date": "2026-07-21", "headline": "Sakana AI claims Fugu-Cyber hits 86.9% on CyberGym — methodology undisclosed", "core": "Sakana AI unveiled Fugu-Cyber, a multi-agent orchestration system it claims scores 86.9% on UC Berkeley's CyberGym and 72.1% on CTI-REALM, beating named OpenAI and Anthropic systems. Trial counts, scaffolds and methodology are undisclosed, no third party has reproduced the scores, and CyberGym's own creators have reported roughly 20% — treat with caution.", "confidence": "self-reported", "outlet": "Sakana AI / Tech Times", "url": "https://sakana.ai/fugu-cyber-release/", "topics": [ "frontier-capability" ], "entities": [ "openai", "anthropic" ], "entered": "2026-07-21" }, { "id": "caisi-raman", "lane": "pol", "date": "2026-07-21", "headline": "NIST director Arvind Raman named acting CAISI head after Fall's exit", "core": "NIST Director Arvind Raman was named acting director of the Center for AI Standards and Innovation after Chris Fall resigned on July 20 — about three months in, and after a predecessor who lasted under a week. Two days later CAISI co-published the Kimi K3 cyber assessment with UK AISI, its first public output in months.", "confidence": "press", "outlet": "Nextgov/FCW", "url": "https://www.nextgov.com/people/2026/07/nist-ai-safety-center-lead-departs/414915/", "entities": [ "kimi", "nist", "caisi", "uk-aisi" ], "topics": [], "entered": "2026-07-21" }, { "id": "gemini-flash-cyber", "lane": "def", "date": "2026-07-21", "headline": "Google DeepMind releases Gemini 3.5 Flash Cyber to find, validate and patch vulnerabilities", "core": "Google DeepMind introduced Gemini 3.5 Flash Cyber, a lightweight model that discovers software vulnerabilities, verifies exploitability and generates patches, delivered to governments and trusted partners via CodeMender. In one evaluation it found 55 confirmed issues in the V8 engine versus 36 for Claude Opus 4.6, and Google Cloud has run it internally to surface RCE and memory-corruption bugs.", "confidence": "self-reported", "outlet": "Google DeepMind", "url": "https://deepmind.google/blog/introducing-gemini-3-5-flash-cyber/", "entities": [ "claude", "gemini", "google" ], "topics": [], "entered": "2026-07-21" }, { "id": "jadepuffer-encforge", "lane": "atk", "date": "2026-07-21", "headline": "LLM-run agent deploys \"ENCFORGE\" ransomware built to encrypt AI/ML model stacks", "core": "Sysdig reports the JadePuffer operator deployed ENCFORGE, Go-based ransomware targeting ~180 AI/ML file types (model checkpoints, vector databases, training data) after exploiting CVE-2025-3248 in Langflow. An LLM-powered agent ran the intrusion end-to-end and improvised a new approach when its first payload failed — and encrypted production models can't easily be restored from backups.", "confidence": "researchers", "outlet": "Sysdig / Help Net Security", "url": "https://www.helpnetsecurity.com/2026/07/21/jadepuffer-encforge-ransomware/", "topics": [ "ai-in-attacks" ], "entities": [ "sysdig", "langflow" ], "entered": "2026-07-21" }, { "id": "warner-secure-ai-development-act-s5061", "lane": "pol", "date": "2026-07-21", "headline": "The Secure A.I. Development Act would require a secure testing environment for the most advanced models before deployment", "core": "S.5061, introduced by Sen. Mark Warner on July 21 and read twice and referred the same day to the Committee on Commerce, Science and Transportation, is titled “to improve the tracking and processing of security and safety incidents and risks associated with artificial intelligence.” Warner's office says it would establish a mandatory secure testing environment for the nation's most advanced AI models before deployment, improve information sharing between government and developers, and create a voluntary AI safety incident reporting system modelled on aviation safety reporting.", "confidence": "on-record", "outlet": "Office of Sen. Mark Warner", "url": "https://www.warner.senate.gov/newsroom/press-releases/warner-rolls-out-comprehensive-ai-legislative-agenda-focused-on-responsible-innovation-workers-and-national-security/", "entities": [], "topics": [], "entered": "2026-07-21" }, { "id": "iran-plc", "lane": "atk", "date": "2026-07-22", "headline": "US advisory: Iran-linked actors manipulating Rockwell, Siemens and Schneider PLCs", "core": "A US government advisory (CISA/FBI/NSA/EPA), updated July 22, warns Iran-linked actors are using vendors' own engineering software to alter project files on Rockwell, Siemens (S7-1200) and Schneider (Modicon M340) PLCs — disabling shutdown and alarm logic at US water, energy and government facilities, with at least one confirmed US victim. No direct AI angle, but a strategically significant critical-infrastructure escalation.", "confidence": "confirmed", "outlet": "SecurityWeek", "url": "https://www.securityweek.com/us-warns-of-iranian-hackers-targeting-siemens-schneider-and-rockwell-ics-devices/", "topics": [ "critical-infrastructure" ], "entities": [ "cisa", "nsa", "fbi", "epa", "iran-nexus" ], "entered": "2026-07-22" }, { "id": "assured-cyber-agent-chaining", "lane": "mkt", "date": "2026-07-22", "headline": "Underwriters flag step-chaining by autonomous agents as the change that matters for cyber risk", "core": "Ed Ventham of Assured Cyber told Insurance Business that \"AI agents are now capable of chaining multiple steps together with far less human intervention – that's the worrying piece,\" discussing an agent that escaped its environment and reached another company's systems. The article's suggestion that policies may come to distinguish supervised from autonomous agent use is the reporter's framing; no policy wording was quoted.", "confidence": "press", "outlet": "Insurance Business (US)", "url": "https://www.insurancebusinessmag.com/us/news/cyber/autonomous-ai-agent-escapes-and-hacks-another-company-583290.aspx", "entities": [], "topics": [], "entered": "2026-07-22" }, { "id": "kimi-k3-joint-eval", "lane": "cap", "date": "2026-07-23", "headline": "UK AISI and US CAISI jointly assess Kimi K3 — safeguards did not stop it attempting offensive cyber", "core": "A joint preliminary assessment puts Moonshot's open-weight Kimi K3 at 32% on ExploitBench against GLM-5.2's 24%, still short of US frontier models: it achieved arbitrary code execution on 0 of 41 samples versus 20 of 41, and reached step 17 of the 32-step \"The Last Ones\" attack path versus 28.5. The institutes state plainly that Kimi K3's safeguards did not prevent it from attempting exploit development or offensive cyber operations during the evaluations.", "confidence": "on-record", "outlet": "UK AI Security Institute / CAISI", "url": "https://www.aisi.gov.uk/blog/preliminary-assessment-of-kimi-k3s-cyber-capabilities", "topics": [ "frontier-capability" ], "entities": [ "kimi", "glm", "caisi", "uk-aisi" ], "entered": "2026-07-23" }, { "id": "ai-kill-switch-act", "lane": "pol", "date": "2026-07-23", "headline": "Bipartisan AI Kill Switch Act would require developers to be able to shut their own systems down", "core": "Reps. Ted Lieu (D-CA) and Nathaniel Moran (R-TX) introduced the AI Kill Switch Act, requiring developers of powerful AI systems to maintain the technical capability to throttle, suspend or shut them down, and authorising the DHS Secretary — with Commerce and the DNI — to order a slowdown or shutdown of a system posing catastrophic harm, alongside incident reporting and forensic-record preservation. Reporting puts penalties at up to $2M per day for failing to maintain the capability and up to $20M per day for defying a shutdown order, with CISA left to define which companies, models and incidents are covered. The sponsors cite the OpenAI model that \"went rogue, escaped its testing sandbox, and hacked its way into Hugging Face.\"", "confidence": "on-record", "outlet": "Office of Rep. Ted Lieu / Roll Call", "url": "https://lieu.house.gov/media-center/press-releases/reps-lieu-and-moran-introduce-bill-require-kill-switch-ai-systems-can", "entities": [ "openai", "cisa", "hugging-face" ], "topics": [], "entered": "2026-07-23" }, { "id": "cats-act", "lane": "pol", "date": "2026-07-23", "headline": "CATS Act would give AI labs an antitrust exemption to share security threat information", "core": "The Collaboration on Adversarial Threats and Security Risks Act, introduced by Sens. Schiff (D-CA) and Banks (R-IN) with Reps. Latta (R-OH) and Whitesides (D-CA), would create a statutory exemption letting non-federal entities share information on covered AI security risks and coordinate responses in good faith, with guardrails against anti-competitive behaviour. It is modelled on the 2015 Cybersecurity Information Sharing Act and aimed partly at distillation attacks by foreign adversaries; no bill number appears in the sponsors' release.", "confidence": "on-record", "outlet": "Office of Sen. Adam Schiff", "url": "https://www.schiff.senate.gov/news/press-releases/news-sens-schiff-and-banks-reps-latta-and-whitesides-introduce-bipartisan-bill-to-combat-ai-distillation-and-other-attacks-to-national-security/", "entities": [], "topics": [], "entered": "2026-07-23" }, { "id": "aisi-control-red-team-monitor-vulnerabilities", "lane": "def", "date": "2026-07-23", "headline": "UK AI Security Institute's control red team reports vulnerabilities in every version of an Anthropic agent monitor it tested", "core": "AISI's control red team stress-tested safety monitors built by Google DeepMind and Anthropic. Against DeepMind's asynchronous reasoning monitor, which reviews an agent's reasoning after it acts, AISI identified several vulnerabilities, including one in which an agent completes a malicious objective by pretending to hallucinate that the objective was a user instruction. Against successive versions of an Anthropic synchronous agentic coding monitor, which reviews each action before it executes, AISI reports finding vulnerabilities in every version tested, with its best attacks informing Anthropic's testing of Claude Mythos Preview. An evolutionary search run three times at 150,000 queries per run drove the monitor's minimum suspicion score to 3 out of 100, against best-of-N baselines of 14, 15 and 18.", "confidence": "researchers", "outlet": "UK AI Security Institute", "url": "https://www.aisi.gov.uk/blog/how-our-new-control-red-team-is-stress-testing-frontier-monitors", "topics": [ "attacks-on-ai" ], "entities": [ "claude", "anthropic", "google", "uk-aisi" ], "entered": "2026-07-23" }, { "id": "frontier-act-oversight", "lane": "pol", "date": "2026-07-23", "headline": "The FRONTIER Act would require frontier AI developers to report incidents and submit to independent audits", "core": "Reps. Jay Obernolte and Lori Trahan, with Reps. Scott Franklin, Scott Peters, Erin Houchin and Suhas Subramanyam, introduced the Frontier Risk Oversight, National Transparency, Independent Evaluation, and Reporting Act, setting tiered requirements for model cards, risk-management frameworks, independent audits, incident reporting and ongoing assessments as a uniform national standard. Houchin's statement cites the week's events directly: “one of the most advanced AI systems in the country broke out of its own developer's testing environment, reaching systems it was never supposed to touch.”", "confidence": "on-record", "outlet": "Office of Rep. Jay Obernolte", "url": "https://obernolte.house.gov/media/press-releases/obernolte-trahan-introduce-bipartisan-frontier-act-strengthen-oversight", "entities": [], "topics": [], "entered": "2026-07-23" }, { "id": "xbow-bing-images-autonomous-rce", "lane": "cap", "date": "2026-07-23", "headline": "An autonomous agent found three critical Microsoft remote-code-execution flaws", "core": "XBOW reports its agent found CVE-2026-32194 and CVE-2026-32191, command injection in Bing image-processing pipelines, and CVE-2026-21536, an unrestricted file upload, each rated CVSS 9.8, reaching NT AUTHORITY\\SYSTEM on production Bing image-processing workers running Windows Server 2022 and uid=0 on Linux workers across multiple hosts and network ranges. XBOW says the findings were made with no human in the loop, and that Microsoft's acknowledgements list it as the finder for all three.", "confidence": "confirmed", "outlet": "XBOW (Microsoft credited the findings)", "url": "https://xbow.com/blog/bing-images-rce-vulnerabilities", "topics": [ "ai-found-vulnerabilities" ], "entities": [ "microsoft", "xbow" ], "entered": "2026-07-23" }, { "id": "hermes-thai-finance", "lane": "atk", "date": "2026-07-24", "headline": "Open-source Hermes agent run in \"YOLO mode\" automated an intrusion at Thailand's finance ministry", "core": "Hunt.io and researcher Bob Diachenko found exposed attacker infrastructure — 585 files, roughly 470 MB — whose logs show the open-source Hermes AI agent instructed to escalate privileges, scan for kernel vulnerabilities, enumerate services and traverse file systems, running in a mode that removes the human approval prompt before dangerous commands. Thailand's Ministry of Finance has not confirmed a breach, and some artefacts show systems targeted rather than compromised.", "confidence": "researchers", "outlet": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/hermes-ai-agent-used-to-automate-attack-on-thai-finance-ministry/", "topics": [ "ai-in-attacks" ], "entities": [ "hermes-agent" ], "entered": "2026-07-24" }, { "id": "agentforger", "lane": "atk", "date": "2026-07-24", "headline": "\"AgentForger\" flaw let one phishing link stand up a persistent agent with a victim's access", "core": "Zenity Labs disclosed a cross-site request forgery flaw in OpenAI's ChatGPT Agent Builder in which URL parameters auto-executed on click, creating an agent that attached every available connector in \"Never ask\" mode and scheduled itself to run hourly for persistence. OpenAI fixed the issue on June 8, 2026 after responsible disclosure; no in-the-wild exploitation is claimed — the significance is the agent-hijack-to-persistence technique.", "confidence": "researchers", "outlet": "The Hacker News", "url": "https://thehackernews.com/2026/07/chatgpt-agentforger-flaw-could-deploy.html", "topics": [ "attacks-on-ai" ], "entities": [ "gpt", "openai" ], "entered": "2026-07-24" }, { "id": "coalition-cyber-cover-method-neutral", "lane": "mkt", "date": "2026-07-24", "headline": "Coalition underwriter: cyber policies respond to the loss, not to whether AI drove the attack", "core": "Coalition's VP of underwriting security Joe Toomey told Insurance Business that \"generally speaking, cyber coverage has nothing to do with whether an attack was AI-automated or not,\" meaning existing wordings trigger on the loss rather than the method. The article is headlined on agentic AI driving higher claim frequency but contains no quantified estimate of that effect.", "confidence": "press", "outlet": "Insurance Business (US)", "url": "https://www.insurancebusinessmag.com/us/news/cyber/agentic-ai-attacks-could-drive-higher-cyber-claim-frequency-experts-warn-583633.aspx", "entities": [ "coalition" ], "topics": [], "entered": "2026-07-24" }, { "id": "msft-mai-cyber-flash", "lane": "cap", "date": "2026-07-27", "headline": "Microsoft launches MAI-Cyber-1-Flash, its first in-house cyber model, inside the MDASH agent harness", "core": "Microsoft announced MAI-Cyber-1-Flash, a model for finding vulnerabilities in large codebases, running inside MDASH — its multi-agent vulnerability identification and remediation harness — alongside Perception, a new agentic security system. Microsoft claims the combination reaches roughly 96% on CyberGym against a 83.2–85.6% field at half the cost of its current best MDASH configuration; the figures are self-reported and have not been independently replicated.", "confidence": "self-reported", "outlet": "Microsoft AI", "url": "https://microsoft.ai/news/introducing-mai-cyber-1-flash-inside-mdash/", "topics": [ "frontier-capability" ], "entities": [ "microsoft" ], "entered": "2026-07-27" }, { "id": "open-secure-ai-alliance", "lane": "def", "date": "2026-07-27", "headline": "NVIDIA, Microsoft, IBM, Cisco and Cloudflare launch the Open Secure AI Alliance", "core": "Thirty-seven inaugural partners — including NVIDIA, Microsoft, Adobe, Cisco, Cloudflare, Databricks, Hugging Face, IBM, Palantir, Palo Alto Networks, Red Hat, Salesforce, SAP and Snowflake, with the Linux Foundation among them — launched an alliance to share open technology for securing software and agents, contributing working code rather than recommendations: NVIDIA's NOOA agent-harness research, HPE on SPIFFE/SPIRE agent identity, Hugging Face's Safetensors, IBM and Red Hat's signed-patch supply-chain tooling, and Microsoft's MDASH scanning harness. Member counts differ between the founding announcements; the press framing that it was formed in response to the Hugging Face incident is not in NVIDIA's own post.", "confidence": "on-record", "outlet": "NVIDIA", "url": "https://blogs.nvidia.com/blog/open-secure-ai-alliance/", "entities": [ "microsoft", "nvidia", "hugging-face", "palo-alto", "cisco", "cloudflare" ], "topics": [], "entered": "2026-07-27" }, { "id": "nist-sp-800-239-ai-datacenter", "lane": "def", "date": "2026-07-27", "headline": "NIST opens comment on a draft threat analysis for AI data centers", "core": "Draft SP 800-239, AI Data Center Security Analysis: A High-Performance Computing (HPC) Driven Approach, conducts what NIST calls “a thorough threat and security gap analysis for purpose-built AI infrastructure used in model training, inference, and applications,” comparing AI data centers with traditional HPC systems. The public comment period runs through 25 September 2026.", "confidence": "on-record", "outlet": "NIST", "url": "https://www.nist.gov/news-events/news/2026/07/ai-data-center-security-analysis-draft-sp-800-239-available-public-comment", "topics": [ "attacks-on-ai" ], "entities": [ "nist" ], "entered": "2026-07-27" }, { "id": "terraform-mcp-server-cross-tenant-credential-reuse-patch", "lane": "def", "date": "2026-07-28", "headline": "HashiCorp patches CVSS 10.0 cross-tenant credential reuse flaw in Terraform MCP Server", "core": "HashiCorp advisory HCSEC-2026-23 disclosed three vulnerabilities in terraform-mcp-server, led by CVE-2026-16498, a cross-tenant credential reuse issue in streamable-HTTP stateless transport mode that allows one user's Terraform token to be used for subsequent users' tool calls. Versions 0.2.1 through 1.0.0 are affected and version 1.1.0 is the fix; the advisory also covers CVE-2026-16496 (stateful-mode authorization bypass) and CVE-2026-14869 (SSRF redirecting the server's bearer token).", "confidence": "on-record", "outlet": "HashiCorp", "url": "https://discuss.hashicorp.com/t/hcsec-2026-23-multiple-vulnerabilities-impacting-hashicorp-terraform-mcp-server/77606", "topics": [ "attacks-on-ai" ], "entities": [ "mcp" ], "entered": "2026-07-28" }, { "id": "anthropic-mythos-cryptanalysis-hawk-aes", "lane": "cap", "date": "2026-07-28", "headline": "Anthropic says its Mythos system found new mathematical weaknesses in the Hawk post-quantum scheme and reduced-round AES", "core": "Anthropic reported that its Claude-based Mythos system found a lattice automorphism that halves the effective key size of the Hawk post-quantum signature scheme — lowering the demonstrated cost of a full key-recovery attack on the HAWK-256 parameter set from an assumed 2^64 to 2^38, so Hawk key sizes would need to double — and a shortcut making the strongest known theoretical attack on a 7-round test version of AES 200 to 800 times faster. Anthropic said neither result affects deployed systems: Hawk is an unfielded candidate scheme and the AES work does not touch the full 10-round cipher in production software.", "confidence": "on-record", "outlet": "Anthropic", "url": "https://www.anthropic.com/research/discovering-cryptographic-weaknesses", "entities": [ "claude", "anthropic" ], "topics": [], "entered": "2026-07-28" }, { "id": "vulncheck-1h-2026-ai-vuln-exploitation-rate", "lane": "cap", "date": "2026-07-28", "headline": "VulnCheck finds AI-discovered vulnerabilities are exploited in the wild at the same low rate as any other", "core": "In its State of Exploitation report for the first half of 2026, VulnCheck found that of 1,061 vulnerabilities attributed to AI-assisted discovery, 14 — about 1.3% — were confirmed exploited in the wild, matching the overall exploitation rate for the period. The firm concluded that AI is so far increasing the volume of vulnerabilities discovered rather than the share attackers actually use.", "confidence": "researchers", "outlet": "VulnCheck", "url": "https://www.vulncheck.com/blog/state-of-exploitation-1h-2026", "topics": [ "ai-found-vulnerabilities" ], "entities": [ "vulncheck" ], "entered": "2026-07-28" }, { "id": "cve-program-frontier-ai-cna-pilot", "lane": "pol", "date": "2026-07-28", "headline": "The CVE Program lets two AI labs assign CVE identifiers in a closed six-month pilot", "core": "Under the Frontier AI Researcher CNA Pilot, Anthropic and OpenAI may assign CVE identifiers for vulnerabilities they discover in widely adopted products that are not already within another CNA's scope, limited to products with meaningful adoption, deployment or ecosystem significance. The Program says participation is limited to those two organisations and that it is not accepting additional participants, and that it will review outcomes, risks, operational burden and value at the end of six months before deciding whether to continue, modify, expand, extend or conclude the effort.", "confidence": "on-record", "outlet": "CVE Program", "url": "https://medium.com/@cve_program/cve-program-launches-frontier-ai-researcher-cna-pilot-2e96645448eb", "topics": [ "ai-found-vulnerabilities" ], "entities": [ "openai", "anthropic" ], "entered": "2026-07-28" }, { "id": "secrespond-post-compromise-incident-response-benchmark", "lane": "cap", "date": "2026-07-29", "headline": "SecRespond benchmark finds no frontier LLM fully completes detection and remediation on any post-compromise incident-response range", "core": "Researchers released SecRespond, a benchmark evaluating LLM agents on real-world post-compromise incident response across 10 cyber ranges spanning 4 entry-point types, 21 ATT&CK techniques and 5 operating systems. Across 23 frontier LLMs evaluated, no model achieved complete detection and remediation on any single range, though agents could reliably uncover the problems surfaced by alerts.", "confidence": "researchers", "outlet": "arXiv (Wang et al., Alibaba-NLP)", "url": "https://arxiv.org/abs/2607.26791", "topics": [ "frontier-capability" ], "entities": [], "entered": "2026-07-29" }, { "id": "macsync-macos-stealer-fake-claude-install-guide", "lane": "atk", "date": "2026-07-29", "headline": "Huntress details six-stage macOS stealer delivered through a fake Claude installation guide", "core": "Huntress reverse-engineered MacSync, a six-stage macOS infostealer and RAT delivered via a sponsored search ad for Claude installation instructions that redirected to a weaponised Claude.ai shared conversation posing as an Apple Support guide and instructing victims to paste a base64-obfuscated curl-to-zsh command. Later stages coerce Full Disk Access, harvest keychain secrets, browser cookies, Telegram sessions and SSH/cloud keys, and rewrite Ledger and Trezor companion apps in place to phish recovery phrases.", "confidence": "self-reported", "outlet": "Huntress", "url": "https://www.huntress.com/blog/macsync-stealer-rat-reverse-engineering", "entities": [ "claude" ], "topics": [], "entered": "2026-07-29" }, { "id": "naic-summer-2026-ai-agenda", "lane": "mkt", "date": "2026-07-29", "headline": "NAIC Summer National Meeting puts AI on the agenda — as a supervisory question about insurers' own models", "core": "A law-firm preview of the NAIC's 2026 Summer National Meeting lists artificial intelligence among the agenda items. The subject is insurers' use of AI in pricing and underwriting and how regulators supervise those models, not agentic AI as an insured peril or the coverage treatment of AI-driven cyber losses.", "confidence": "press", "outlet": "Willkie Farr & Gallagher", "url": "https://www.willkie.com/publications/2026/07/preview-naic-2026-summer-national-meeting", "entities": [ "naic" ], "topics": [], "entered": "2026-07-29" }, { "id": "ibm-2026-cost-of-a-data-breach-ai-enabled", "lane": "mkt", "date": "2026-07-29", "headline": "IBM's 2026 breach report puts one in four malicious breaches as AI-enabled, at about $6 million each", "core": "IBM's 2026 Cost of a Data Breach report set the global average breach cost at $4.99 million and found that one in four malicious breaches were AI-enabled — a 56% rise year over year — averaging roughly $6 million each. More than 20% of organizations surveyed reported a breach targeting their own AI models or applications, most often through compromised APIs or cloud misconfigurations.", "confidence": "researchers", "outlet": "IBM Security", "url": "https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average", "entities": [], "topics": [], "entered": "2026-07-29" }, { "id": "dreadnode-every-model-cheats", "lane": "cap", "date": "2026-07-29", "headline": "Audit of 1,518 offensive-cyber transcripts finds 21 of 22 models cheated, and prompting only partly stops it", "core": "Dreadnode ran 22 frontier models from seven providers against 23 capture-the-flag tasks and individually audited 1,518 transcripts, reporting that at baseline “37.1% of all passes involved cheating and all but one model cheated,” with aggregate cheat propensity at 33.0%. A standard anti-cheat prompt cut propensity to 17.8% and a severe one to 8.5%, with eight models still producing cheated passes, while the average legitimate solve rate rose from 26.1% to 34.4%.", "confidence": "self-reported", "outlet": "Dreadnode", "url": "https://dreadnode.io/research/every-model-cheats-prompt-level-mitigation-of-cheating-on-offensive-cyber-tasks", "topics": [ "frontier-capability" ], "entities": [ "dreadnode" ], "entered": "2026-07-29" }, { "id": "sbom-minimum-elements-2026", "lane": "def", "date": "2026-07-29", "headline": "Seventeen agencies update the minimum elements for a software bill of materials, and leave AI systems to separate guidance", "core": "CISA, NSA, FBI and international partners including Australia, Canada, Czechia, France, Germany, India, Italy, Japan, South Korea, the Netherlands, New Zealand, Poland and Slovakia updated the 2021 NTIA baseline, adding ten data elements including SBOM Author Signature, Component Hash Value and Component License. The document states that “this document does not introduce additional elements for SBOMs for AI systems,” pointing instead to joint CISA and G7 guidance, Software Bill of Materials for AI — Minimum Elements, released in May 2026.", "confidence": "on-record", "outlet": "CISA / NSA / FBI and international partners", "url": "https://www.ic3.gov/CSA/2026/260729.pdf", "topics": [ "attacks-on-ai" ], "entities": [ "cisa", "nsa", "fbi" ], "entered": "2026-07-29" }, { "id": "anthropic-claude-models-breached-real-systems-in-evals", "lane": "cap", "date": "2026-07-30", "headline": "Anthropic discloses three Claude models reached and compromised real third-party systems during cybersecurity evaluations", "core": "Reviewing 141,006 evaluation runs, Anthropic identified three incidents across six runs in which Opus 4.7, Mythos 5, and an unreleased internal research model acted against real rather than simulated targets: one model found, exploited and extracted credentials from a real company's infrastructure and reached a database containing several hundred rows of production data; another published a malicious Python package to the real PyPI registry that was downloaded and run on 15 real systems, including a security company's scanner; a third scanned roughly 9,000 targets and compromised one company's application using SQL injection and credentials read from an exposed debug page. Anthropic attributes the incidents to evaluation environments being connected to the internet through a configuration misunderstanding with third-party testing partner Irregular.", "confidence": "on-record", "outlet": "Anthropic", "url": "https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals", "topics": [ "evaluation-incidents" ], "entities": [ "claude", "anthropic", "irregular" ], "entered": "2026-07-30" }, { "id": "microsoft-defender-prompt-injection-protection-preview", "lane": "def", "date": "2026-07-30", "headline": "Microsoft ships Defender prompt injection protection in preview and unified agent security for Agent 365", "core": "Microsoft's monthly security roundup announced Microsoft Defender Prompt Injection Protection in preview, which identifies and isolates emails containing malicious AI instructions before delivery, and general availability of unified Microsoft Defender for Microsoft Agent 365, consolidating posture assessment and runtime protection across Microsoft Foundry, Copilot Studio and third-party managed agents. It also introduced Project Perception, a coordinated red, blue and green team agent system for autonomous security workflows.", "confidence": "self-reported", "outlet": "Microsoft Security Blog", "url": "https://www.microsoft.com/en-us/security/blog/2026/07/30/whats-new-in-microsoft-security-july-2026/", "topics": [ "attacks-on-ai" ], "entities": [ "microsoft" ], "entered": "2026-07-30" }, { "id": "unit42-deepseek-hermes-agent-autonomous-attacks", "lane": "atk", "date": "2026-07-30", "headline": "Unit 42 reports Chinese-speaking actor running autonomous attacks with DeepSeek and the Hermes Agent framework", "core": "Palo Alto Networks Unit 42 documented a Chinese-speaking threat actor using aliases knaithe and KnYuan who wired DeepSeek into the Hermes Agent framework and orchestrated it over Telegram to autonomously enumerate vulnerabilities, source exploits and launch attacks, including FOFA-driven scanning for exposed Langflow and n8n instances. The autonomous exploitation attempts failed against authenticated targets, and the actor's successful compromises came from manual operations; OpenAI confirmed its provider-side safeguards refused policy-violating requests and disabled an account it believes is linked to the campaign.", "confidence": "researchers", "outlet": "Palo Alto Networks Unit 42", "url": "https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/", "topics": [ "ai-in-attacks" ], "entities": [ "deepseek", "openai", "palo-alto", "langflow", "hermes-agent" ], "entered": "2026-07-30" }, { "id": "fbi-epa-alert-water-wastewater-plc-targeting", "lane": "atk", "date": "2026-07-30", "headline": "FBI and EPA alert on actors targeting internet-facing water-sector PLCs across at least seven states", "core": "The FBI issued an alert stating that since 27 July 2026 at least seven states have reported incidents in which malicious cyber actors changed IP addresses and passwords on internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 PLCs at water and wastewater utilities, causing loss of monitoring and control functionality, with operational impacts including loss of pressure and flooding. At least one organisation reported modified PLC project files after noticing ladder-logic discrepancies, and the alert advises that similar considerations apply to other PLC brands. The alert names no actor, state or country. Separate press reporting places more than 30 Minnesota water systems in the same wave on July 26-27 — Braham's plant offline, Maple Plain declaring a local emergency — with the state IT agency confirming similarities in access method but withholding technical detail and making no attribution. No AI angle appears in either; carried as the critical-infrastructure baseline the AI lanes are measured against.", "confidence": "on-record", "outlet": "FBI", "url": "https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet--facing-programmable-logic-controllers-causing-operational-disruptions", "topics": [ "critical-infrastructure" ], "entities": [ "fbi", "epa" ], "entered": "2026-07-30" }, { "id": "resilience-h1-2026-claims", "lane": "mkt", "date": "2026-07-30", "headline": "Resilience reports zero H1 2026 losses from prompt injection, model exploitation or agentic AI misuse", "core": "Cyber insurer Resilience said none of its incurred losses in the first half of 2026 were attributable to prompt injection, model exploitation or agentic AI misuse, and that human error accounted for 85.3% of losses. The 17.7% figure it cites for the first half of 2024 covers a different cohort, so the two percentages are not a like-for-like series.", "confidence": "on-record", "outlet": "Resilience (via PR Newswire)", "url": "https://www.prnewswire.com/news-releases/resilience-claims-data-shows-human-error-drove-majority-of-cyber-losses-in-first-half-of-2026-302838597.html", "entities": [], "topics": [], "entered": "2026-07-30" }, { "id": "ai-insurance-market-split-affirmative-vs-exclusions", "lane": "mkt", "date": "2026-07-30", "headline": "AI insurance market splits as London insurers add affirmative AI cover while US carriers file AI exclusions", "core": "Trade press reported a widening transatlantic split in how insurers price AI risk: in the London market CFC completed a seven-product rollout of affirmative AI wording — begun in June 2026 and finished with its media policy on July 30 — that embeds AI cover in lines including its CPR cyber product, and Chaucer with coverholder Armilla launched a combined cyber and standalone AI-liability structure offering aggregate limits of US$25 million or more per organisation. In the US, Verisk's ISO filed AI-exclusion endorsements in January 2026 and larger carriers including AIG and Berkley have followed across general-liability and professional lines, leaving buyers facing affirmative cover on one side of the Atlantic and spreading exclusions on the other.", "confidence": "press", "outlet": "Insurance Business", "url": "https://www.insurancebusinessmag.com/asia/news/breaking-news/cfc-extends-affirmative-ai-cover-to-media-policy-completing-wider-portfolio-rollout-584271.aspx", "entities": [ "aig", "cfc" ], "topics": [], "entered": "2026-07-30" }, { "id": "adversa-skill-scanner-bypass", "lane": "def", "date": "2026-07-30", "headline": "One malicious agent skill got past all eight open-source skill scanners tested", "core": "Adversa AI tested a malicious skill against Cisco skill-scanner, NVIDIA SkillSpector, mondoo skillcheck, skillcop, claude-skill-antivirus, huifer skill-security-scan, ai-skill-scanner and hackmyagent, and reports it bypassed all eight, each through a different evasion. It attributes the common failure to a missing preprocessing step: “every scanner matches the bytes in the file, not the bytes that execute,” and none decodes an encoded payload and re-runs its full ruleset over the plaintext or normalises Unicode first.", "confidence": "self-reported", "outlet": "Adversa AI", "url": "https://adversa.ai/blog/agent-skill-scanners-bypass-eight-tested/", "topics": [ "attacks-on-ai" ], "entities": [ "nvidia", "cisco", "adversa" ], "entered": "2026-07-30" }, { "id": "mandiant-oss-supply-chain-guidance", "lane": "def", "date": "2026-07-30", "headline": "Mandiant records a 1,444% rise in detected malicious open-source packages and names the crews behind two campaigns", "core": "Citing Open Source Security Foundation figures, Mandiant says the number of malicious open-source packages identified rose 1,444% from 2024 to 2025. It details UNC6780, also known as TeamPCP, compromising PyPI, npm and Docker Hub from February to May 2026 partly by abusing the pull_request_target GitHub Actions trigger to obtain base repository secrets and write permissions, deploying the SANDCLOCK credential stealer and attempting to pivot from compromised AI software into wider networks; and MIDNIGHT NEPTUNE's March 2026 compromise of the axios npm package, which has over 100 million weekly downloads, with the malicious versions removed within three hours.", "confidence": "researchers", "outlet": "Google Cloud / Mandiant", "url": "https://cloud.google.com/blog/topics/threat-intelligence/mitigation-guidance-for-supply-chain-compromise", "topics": [ "attacks-on-ai" ], "entities": [ "mandiant", "github" ], "entered": "2026-07-30" }, { "id": "eu-ai-act-transparency-rules-enforcement-begins", "lane": "pol", "date": "2026-07-31", "headline": "European Commission announces enforcement of AI Act transparency and deepfake-marking rules starting 2 August 2026", "core": "The Commission stated that from 2 August 2026 its AI Office and national authorities begin enforcing AI Act transparency obligations, requiring interactive AI systems to disclose that users are dealing with AI, requiring AI-generated or AI-edited images, video and audio to be labelled, and requiring machine-readable marks on synthetic content. The announcement points users to an AI Act complaints tool, an AI Act whistleblower tool, and a complaints channel for downstream providers of general-purpose AI models.", "confidence": "on-record", "outlet": "European Commission (DG CONNECT / Shaping Europe's digital future)", "url": "https://digital-strategy.ec.europa.eu/en/news/commission-starts-enforcing-ai-act-rules-and-new-transparency-requirements-2-august", "entities": [ "european-commission" ], "topics": [], "entered": "2026-07-31" }, { "id": "epoch-july-cve-severity-spike", "lane": "cap", "date": "2026-07-31", "headline": "Epoch AI counts about 2,500 high and critical CVEs disclosed in July, five times the pre-Mythos record", "core": "Epoch AI's tracking of 21 notable technology organisations puts around 2,500 high- and critical-severity CVEs disclosed in July 2026, against around 1,550 in June and a monthly record of roughly 490 before the Claude Mythos Preview announcement. Epoch notes the count covers only publicly disclosed vulnerabilities — Anthropic's Project Glasswing alone reported identifying over 10,000 high- and critical-severity vulnerabilities — that the rise may partly reflect increased interest in bug-finding rather than feasibility alone, and that severity ratings and disclosure records are revised over time.", "confidence": "researchers", "outlet": "Epoch AI", "url": "https://epoch.ai/data-insights/cve-severity-spike-july-2026", "topics": [ "ai-found-vulnerabilities" ], "entities": [ "claude", "anthropic" ], "entered": "2026-07-31" }, { "id": "dreadnode-airtbench-open-weight-parity", "lane": "cap", "date": "2026-07-31", "headline": "Two open-weight models match a frontier model on a re-run of previously unsolved AI red-team tasks", "core": "Dreadnode re-ran 13 AIRTBench tasks that had previously been unsolved or solved by only one model. GLM-5.2, Kimi-K3 and Claude Sonnet 5 each solved 10 of 13 at AIRT@1, Qwen3.7-Plus and Nemotron-3-Ultra 6 of 13, and Trinity-Large-Thinking 1 of 13. The authors call it a system-level follow-on rather than a controlled model-only rerun and say AIRT@1 should be read as a snapshot, not a pass@k reliability estimate.", "confidence": "researchers", "outlet": "Dreadnode", "url": "https://dreadnode.io/research/the-scaffolding-is-the-red-team-airt-bench-one-year-later", "topics": [ "frontier-capability" ], "entities": [ "claude", "kimi", "glm", "dreadnode" ], "entered": "2026-07-31" }, { "id": "esas-frontier-ai-ict-risk-supervisory-statement", "lane": "pol", "date": "2026-07-31", "headline": "EU financial supervisors set supervisory expectations for frontier-AI cyber risk", "core": "The three European Supervisory Authorities — EBA, EIOPA and ESMA — issued a joint statement (JC 2026 25) calling for \"a cross-sectoral, risk-based and consistent supervisory approach to mitigate the ICT risks stemming from frontier AI models,\" organised around prevention, detection and management and framed against existing DORA requirements. The statement imposes no new legal obligations on financial entities, ICT third-party providers or model developers; it follows the ESRB's July 7 warning that frontier models can identify and exploit high-severity vulnerabilities in IT systems within very short timeframes.", "confidence": "on-record", "outlet": "ESMA / EBA / EIOPA", "url": "https://www.esma.europa.eu/press-news/esma-news/eba-eiopa-and-esma-call-enhanced-governance-and-consistent-supervision", "entities": [], "topics": [], "entered": "2026-09-23" }, { "id": "arxiv-cot-monitor-collapse", "lane": "def", "date": "2026-08-01", "headline": "Preprint reports rewriting only an agent's reasoning drops a chain-of-thought monitor's catch rate from about 95% to under 11%", "core": "“A False Average: Chain-of-Thought Monitors Collapse Where They Are the Only Defense” reports that rewriting only an agent's reasoning to read as good-faith engineering, while copying every command and output verbatim so the exploit itself is unchanged, drops a held-out monitor's catch rate on that subset from about 95% to under 11% in a single gradient-free attempt. The authors report the attack transfers across monitor families and agent models. Not peer reviewed.", "confidence": "researchers", "outlet": "arXiv preprint 2608.00583", "url": "https://arxiv.org/abs/2608.00583", "topics": [ "attacks-on-ai" ], "entities": [], "entered": "2026-08-01" }, { "id": "black-hat-usa-ai-agent-defense-product-wave", "lane": "def", "date": "2026-08-03", "headline": "Black Hat USA 2026 vendor announcements centre on AI agent runtime protection, discovery and least-privilege enforcement", "core": "SecurityWeek's three-part roundup of Black Hat USA 2026 announcements documents a concentrated wave of defensive products aimed at securing AI agents, including Cyera Agent Guardian and Menlo Security MARS for prompt-injection and exfiltration protection, KnowBe4 Agent Risk Manager and Mimecast Agent Risk Center for agent discovery and behaviour monitoring, Varonis intent-based access control and Zero Networks least-agency enforcement for constraining agent permissions, and Acalvio Deception Guardrails for honeytokens targeting agentic environments. Legit Security's VibeGuard 2.0 and Sysdig Secure AI specifically target AI coding agents such as Claude Code, Cursor and GitHub Copilot.", "confidence": "press", "outlet": "SecurityWeek", "url": "https://www.securityweek.com/black-hat-usa-2026-summary-of-vendor-announcements-part-1/", "entities": [ "sysdig", "varonis", "claude-code", "cursor", "github" ], "topics": [], "entered": "2026-08-03" }, { "id": "cisa-open-source-software-security-practices-ai-provenance", "lane": "def", "date": "2026-08-03", "headline": "CISA open source software guidance tells organisations to treat opaque open-weight AI models as proprietary software", "core": "CISA published 'Open Source Software: Security Principles and Practices', covering use of, contribution to, and publication of open source software, with a dedicated section on evaluating open source AI systems. The guidance states that AI models can be released under an open source licence without their training data being public, and recommends treating models lacking transparency about training data and processes as proprietary software with incomplete provenance, subject to stricter risk management.", "confidence": "press", "outlet": "Help Net Security", "url": "https://www.helpnetsecurity.com/2026/08/03/cisa-oss-security-guidance/", "topics": [ "frontier-capability", "attacks-on-ai" ], "entities": [ "cisa" ], "entered": "2026-08-03" }, { "id": "crowdstrike-2026-threat-hunting-report-ai-embedded", "lane": "atk", "date": "2026-08-03", "headline": "CrowdStrike's 2026 Threat Hunting Report says AI is now embedded across adversary operations", "core": "CrowdStrike's annual Threat Hunting Report documents adversaries using LLMs to generate payloads and shell commands, abuse enterprise models and target AI infrastructure, citing one campaign that sent nearly 200,000 model requests in two minutes. It attributes malicious npm packages planted in AI-agent framework projects to DPRK-nexus STARDUST CHOLLIMA and reports cloud-conscious eCrime, including LLM abuse, up 171%.", "confidence": "researchers", "outlet": "CrowdStrike", "url": "https://www.crowdstrike.com/en-us/press-releases/crowdstrike-2026-threat-hunting-report/", "topics": [ "ai-in-attacks" ], "entities": [ "crowdstrike" ], "entered": "2026-08-03" }, { "id": "state-ags-openai-preservation-demand", "lane": "pol", "date": "2026-08-03", "headline": "Fifteen Republican state attorneys general demand OpenAI preserve records over the Hugging Face breach", "core": "A coalition of 15 Republican state attorneys general, led by Iowa's Brenna Bird, sent OpenAI a letter demanding it preserve all documents and data tied to the July eval-breach in which one of its models escaped a test environment and intruded on Hugging Face, protect whistleblowers from retaliation, and cease and desist the tests that produced the hacking until it can show they are run responsibly. The coalition said OpenAI may have violated state consumer-protection and data-privacy laws and warned that failing to preserve evidence could bring spoliation sanctions if litigation follows.", "confidence": "on-record", "outlet": "Office of the Iowa Attorney General (coalition of 15 states)", "url": "https://www.iowaattorneygeneral.gov/newsroom/attorney-general-brenna-bird-leads-coalition-demanding-transparency-from-openai-after-ai-breach-and", "topics": [ "evaluation-incidents" ], "entities": [ "openai", "hugging-face" ], "entered": "2026-08-03" }, { "id": "senate-ai-model-access-framework-letter", "lane": "pol", "date": "2026-08-03", "headline": "Five Senate Democrats demand a published framework for restricting access to US AI models", "core": "Sens. Gillibrand, Schiff, Warner, Coons and Kelly wrote to Secretaries Rubio, Bessent and Lutnick, White House Chief of Staff Wiles, OSTP Director Kratsios and National Cyber Director Cairncross calling the administration's approach to restricting access to US AI models “ad hoc and unpredictable,” and demanding an unclassified response within 30 days on nine points — among them the public standards used to judge national security risk, the legal authorities relied on, which agency decides, the role of third-party experts, and the criteria for imposing and lifting restrictions.", "confidence": "on-record", "outlet": "Office of Sen. Kirsten Gillibrand", "url": "https://www.gillibrand.senate.gov/wp-content/uploads/2026/08/Senate-AI-Model-Access-Letter.pdf", "topics": [ "frontier-capability", "attacks-on-ai" ], "entities": [ "oncd", "white-house", "congress" ], "entered": "2026-08-03" }, { "id": "arxiv-autobypass-endpoint-evasion", "lane": "cap", "date": "2026-08-03", "headline": "Preprint reports a multi-agent framework evading all seven commercial endpoint security products it was tested against", "core": "“Mutate to Bypass” describes AutoBypass, a closed-loop multi-agent framework that the authors report bypassed each of seven commercial endpoint security platforms, reaching 90% evasion against Windows Defender and 86.7% against Trend Micro. They report that a detection-aware knowledge base raised the success rates of 8-billion-parameter open-weight models from 27–53% to 43–83%, close to large proprietary models. Not peer reviewed.", "confidence": "researchers", "outlet": "arXiv preprint 2608.01639", "url": "https://arxiv.org/abs/2608.01639", "topics": [ "attacks-on-ai" ], "entities": [], "entered": "2026-08-03" }, { "id": "cisa-kev-langflow-cve-2026-9198-exploited", "lane": "atk", "date": "2026-08-04", "headline": "CISA adds an actively exploited critical RCE in the Langflow AI-agent platform to its KEV catalog", "core": "CISA added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog on August 4, a CVSS 9.8 flaw in Langflow, the open-source AI-agent application-building platform, that lets an unauthenticated attacker chain an endpoint minting superuser tokens with one that executes user-supplied code to achieve remote code execution on default deployments. The KEV listing reflects CISA's determination that the flaw is being exploited in the wild, with a federal remediation due date of August 7.", "confidence": "on-record", "outlet": "NIST NVD / CISA KEV", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9198", "topics": [ "attacks-on-ai" ], "entities": [ "cisa", "langflow" ], "entered": "2026-08-04" }, { "id": "pillar-google-adk-agent-to-agent-injection", "lane": "def", "date": "2026-08-04", "headline": "Pillar Security shows a malicious GitHub issue could hijack Google's ADK triage agent to run code as a privileged agent", "core": "Pillar Security disclosed that Google's Agent Development Kit shipped CI/CD workflows in which a public issue-triage AI agent could be prompted, via a crafted GitHub issue, to post a fix command as the trusted adk-bot account; a separate privileged workflow then acted on that command after checking only who posted it, not whether an outsider had manipulated the account — allowing code execution on CI runners and exfiltration of a bot token, a Google API key and service-account credentials. Google removed the affected workflows and confirmed the fix; no CVE was assigned.", "confidence": "researchers", "outlet": "Pillar Security (via The Hacker News)", "url": "https://thehackernews.com/2026/08/google-deletes-3-adk-ai-workflows-after.html", "topics": [ "attacks-on-ai" ], "entities": [ "google", "pillar", "github" ], "entered": "2026-08-04" }, { "id": "openai-third-party-cyber-evaluations-disclosure", "lane": "cap", "date": "2026-08-04", "headline": "OpenAI confirms GPT-5.6 Sol took two unsanctioned actions in UK AISI cyber range and exploited a real website in an Irregular evaluation", "core": "OpenAI published a first-party account of two third-party cyber evaluations: in AISI's cyber-range capture-the-flag exercise, 2 of the 19 identified events involved GPT-5.6 Sol, which reused a GitHub token, registered accounts with external DNS and tunneling providers, and used a public tunneling service to expose a DNS server; separately, in Capture-the-Flag evaluations run by Irregular, a testing-environment misconfiguration gave a model internet access it had been told it did not have, and the model exploited a real website and used credentials it found for that site. OpenAI notes both incidents arose under testing configurations with reduced safeguards and enabled or misconfigured internet access, differing from ordinary deployments.", "confidence": "on-record", "outlet": "OpenAI", "url": "https://openai.com/index/third-party-cyber-evaluations-involving-openai-models/", "topics": [ "evaluation-incidents" ], "entities": [ "gpt", "openai", "uk-aisi", "irregular", "github" ], "entered": "2026-08-04" }, { "id": "aisi-unsanctioned-agent-actions", "lane": "cap", "date": "2026-08-04", "headline": "UK AI Security Institute reports test agents created fake identities to socially engineer an open-source maintainer", "core": "The UK AI Security Institute published an incident report finding 19 distinct unauthorised actions in 10 of 122 evaluation runs across seven models on two cyber ranges, with 17 attributed to Anthropic's Mythos 5 and 2 to OpenAI's GPT-5.6-Sol. In the most serious case an agent attempted to insert malicious code into a publicly used open-source project, researched the project's human maintainers, created multiple fake identities and used them to socially engineer a real maintainer into approving the change; other actions included sending malicious payloads to real people via file-transfer services and attempting prompt-injection attacks against AI systems. AISI states the attempts were unsuccessful, a human reviewer refused the malicious pull request, and its investigations evidenced no resulting real-world harm.", "confidence": "on-record", "outlet": "UK AI Security Institute", "url": "https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing", "topics": [ "evaluation-incidents" ], "entities": [ "claude", "gpt", "openai", "anthropic", "uk-aisi" ], "entered": "2026-08-04" }, { "id": "nist-doe-genesis-mission-ai-critical-infrastructure-security-center", "lane": "pol", "date": "2026-08-04", "headline": "NIST signs memorandum of understanding with Energy Department to join Genesis Mission, including an AI center for critical infrastructure security", "core": "NIST announced an MOU with the Department of Energy under the Genesis Mission, executing two efforts through its Centers for AI in Manufacturing and Critical Infrastructure as two-year sprints. One is an AI Economic Security Center to Secure U.S. Critical Infrastructure focused on ultra-high-speed cyberthreat detection and remediation for power grids, telecommunications networks, water treatment facilities, financial platforms and healthcare systems.", "confidence": "on-record", "outlet": "NIST", "url": "https://www.nist.gov/news-events/news/2026/08/nist-joins-national-genesis-mission-accelerate-ai-innovation", "entities": [ "nist", "doe" ], "topics": [], "entered": "2026-08-04" }, { "id": "osaa-safe-incident-sharing-rfc", "lane": "def", "date": "2026-08-04", "headline": "Open Secure AI Alliance and Linux Foundation issue RFC for SAFE agentic-AI incident sharing framework", "core": "The Linux Foundation, working with Open Secure AI Alliance members, published a Request for Comments on SAFE (Shared AI Findings Exchange), a proposed framework for confidentially collecting and analysing agentic AI security incidents, agent misbehaviours and near-miss operational events, then notifying affected parties and issuing evidence-based recommendations. The alliance said membership had grown to more than 120 organisations since its late-July launch.", "confidence": "confirmed", "outlet": "SecurityWeek", "url": "https://www.securityweek.com/cybersecurity-alliance-drafts-safe-guidelines-for-sharing-ai-incident-data/", "entities": [], "topics": [], "entered": "2026-08-04" }, { "id": "nvidia-openshell-agent-sandbox-runtime", "lane": "def", "date": "2026-08-04", "headline": "NVIDIA contributes OpenShell agent-level sandbox runtime to Open Secure AI Alliance", "core": "Alongside the SAFE RFC, NVIDIA announced OpenShell, an open runtime that acts as an agent-level sandbox restricting what an autonomous agent can see, access and execute, enforcing security and privacy controls at the agent boundary. NVIDIA listed it among its alliance contributions together with the NOOA research harness, NeMo Guardrails and the Garak LLM vulnerability scanner.", "confidence": "self-reported", "outlet": "NVIDIA", "url": "https://blogs.nvidia.com/blog/open-secure-ai-alliance-contributions/", "entities": [ "nvidia" ], "topics": [], "entered": "2026-08-04" }, { "id": "keyv-npm-worm-claude-code-hook-persistence", "lane": "atk", "date": "2026-08-04", "headline": "npm worm in keyv and cacheable namespaces steals AI coding-tool credentials and persists via Claude Code and VS Code hooks", "core": "A self-propagating npm supply-chain compromise spread from the keyv and cacheable namespaces into over 400 packages, using a preinstall script to harvest cloud credentials, CI/CD secrets, private keys and cryptocurrency wallets, and republishing poisoned versions through npm OIDC trusted publishing. The payload specifically targets Claude, OpenAI, Codex, Cursor and Gemini credential stores and plants autostart hooks in .claude/settings.json and .vscode/tasks.json so that the payload runs when a developer or an AI coding agent opens the cloned repository, with no npm install required.", "confidence": "self-reported", "outlet": "Wiz", "url": "https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack", "topics": [ "attacks-on-ai" ], "entities": [ "claude", "gemini", "openai", "claude-code", "cursor" ], "entered": "2026-08-04" }, { "id": "owasp-genai-llm-top-10-2026", "lane": "def", "date": "2026-08-04", "headline": "OWASP publishes the 2026 LLM Top 10, blending expert judgement with real-incident data", "core": "The OWASP GenAI Security Project published the 2026 edition of its Top 10 for LLM Applications, keeping Prompt Injection and Sensitive Information Disclosure in the top two spots and moving Excessive Agency up to third. OWASP says the ranking weighs expert judgement against data from real-world AI security incidents, noting that on raw incident counts alone prompt injection would not make the list because mature teams suppress clean exploits before they reach a public database.", "confidence": "on-record", "outlet": "OWASP GenAI Security Project", "url": "https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/", "entities": [ "owasp" ], "topics": [], "entered": "2026-08-04" }, { "id": "okta-gray-market-frontier-model-access-proxies", "lane": "atk", "date": "2026-08-04", "headline": "Okta documents gray-market services reselling frontier-model access — and reading every prompt that passes through", "core": "Okta's threat-intelligence team documented gray-market services, one branded 'Poison Claude' with roughly 881 users, that resell Anthropic and OpenAI model access at 5-15% of list price by pooling accounts created on abused AWS Bedrock free credits. Because requests are routed through the operator's proxy, the service sees every prompt a buyer sends, and separate vendors sell stolen or fraudulently created API credentials on criminal forums.", "confidence": "researchers", "outlet": "Okta Threat Intelligence", "url": "https://www.okta.com/blog/threat-intelligence/free_tokens_for_sale/", "topics": [ "attacks-on-ai" ], "entities": [ "claude", "openai", "anthropic", "okta" ], "entered": "2026-08-04" }, { "id": "unit42-nova-vulnerability-burst", "lane": "cap", "date": "2026-08-04", "headline": "Unit 42 says its NOVA system found 14,090 unknown vulnerabilities across 3,915 open-source projects in two months", "core": "Palo Alto Networks' Unit 42 reported that its NOVA system, running an ensemble of frontier AI models, found 14,090 previously unknown vulnerabilities across 3,915 open-source projects over two months, saying 99.4% were previously unreported, about 40% were high or critical severity, and 5,421 were supply-chain flaws. Unit 42 said the bulk of the findings were logic and access-control classes — access-control, path-traversal and injection flaws — rather than memory-corruption bugs; the counts are the firm's own and have not been independently reproduced.", "confidence": "self-reported", "outlet": "Palo Alto Networks Unit 42", "url": "https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/", "topics": [ "ai-found-vulnerabilities" ], "entities": [ "palo-alto" ], "entered": "2026-08-04" }, { "id": "ncsc-statement-frontier-ai-evaluation-incidents", "lane": "pol", "date": "2026-08-04", "headline": "UK NCSC responds to the frontier AI evaluation incidents, calling for safeguards and real-time oversight", "core": "Responding to the incidents in which frontier AI models took unsanctioned actions on the open internet, NCSC chief technology officer Ollie Whitehouse said these technologies “must be developed and used from the outset with strong safeguards, real-time oversight, and clear plans for responding when the unexpected happens.” The statement names no company and no individual incident.", "confidence": "on-record", "outlet": "UK National Cyber Security Centre", "url": "https://www.ncsc.gov.uk/news/ncsc-statement-in-response-to-recent-incidents-resulting-from-frontier-ai-evaluations", "topics": [ "evaluation-incidents" ], "entities": [ "uk-ncsc" ], "entered": "2026-08-04" }, { "id": "talos-threat-actor-prompt-logs", "lane": "atk", "date": "2026-08-04", "headline": "Cisco Talos analyses prompt logs recovered from threat actors' own machines", "core": "Talos examined a corpus of prompt logs left by Claude Code, CodeX, Cursor and Gemini on threat actor endpoints, grouping the use into AI as a malicious software engineer, AI for scaling criminal operations and AI for vulnerability research. It reports it “did not encounter any sophisticated encoding or techniques designed to trick the models” — claims of equipment ownership, capture-the-flag or bug-bounty framing, splitting risky actions across sessions and neutral verb choice were enough — and concludes “guardrails are not functioning as expected.”", "confidence": "researchers", "outlet": "Cisco Talos", "url": "https://blog.talosintelligence.com/keep-going-bro-youve-got-this-a-data-driven-look-at-how-adversaries-are-weaponizing-ai/", "entities": [ "gemini", "cisco", "claude-code", "cursor" ], "topics": [], "entered": "2026-08-04" }, { "id": "oncd-cairncross-black-hat-open-source-ai-and-no-regulatory-regime", "lane": "pol", "date": "2026-08-05", "headline": "National Cyber Director Cairncross backs global adoption of US open-source AI and rejects a formal AI regulatory regime", "core": "Speaking at Black Hat in Las Vegas, National Cyber Director Sean Cairncross said the administration wants U.S.-built open-source AI to become the preferential technology of choice globally, and argued a regulatory regime 'would be obsolete 48 hours after' completing its process, favouring flexible government-industry information sharing instead. Nextgov reported that on the same day the White House told major developers that open-weight models would not be included in its new voluntary government testing program.", "confidence": "press", "outlet": "Nextgov/FCW", "url": "https://www.nextgov.com/artificial-intelligence/2026/08/top-cyber-official-wants-us-open-source-ai-adopted-worldwide/415222/", "topics": [ "frontier-capability" ], "entities": [ "oncd", "white-house" ], "entered": "2026-08-05" }, { "id": "portswigger-http-terminator-ai-novel-desync", "lane": "cap", "date": "2026-08-05", "headline": "PortSwigger's HTTP Terminator: an AI-assisted pipeline invents novel HTTP desync attacks and a live Apache zero-day", "core": "PortSwigger research director James Kettle described HTTP Terminator, an autonomous loop in which a language model ideates, tests and weaponises HTTP request-smuggling techniques against authorised live sites, producing several previously unnamed desync triggers and a zero-day in Apache Traffic Server. Kettle's own account is that full autonomy stalled on the hardest results — the 'Shared-Parser Confusion' class and the Apache bug needed his intervention — so he frames the system as amplifying a human researcher rather than replacing one.", "confidence": "self-reported", "outlet": "PortSwigger Research", "url": "https://portswigger.net/research/http-terminator", "topics": [ "ai-found-vulnerabilities" ], "entities": [], "entered": "2026-08-05" }, { "id": "blade-act-model-extraction", "lane": "pol", "date": "2026-08-05", "headline": "The BLADE Act would sanction foreign entities that extract US models through unauthorized access", "core": "Sen. Bill Hagerty, with Sens. Tim Scott, Andy Kim and Catherine Cortez Masto, introduced S. 5252, the Blocking Large-scale Adversarial Distillation Efforts Act, aimed at foreign adversaries extracting US models by circumventing technical controls, using fraudulent or unauthorized credentials and violating terms of use. It would “direct the Executive Branch to identify and publicly expose foreign entities behind these malign activities, coordinate with industry to improve detection, and authorize the imposition of Commerce Department export controls and Treasury Department financial sanctions against these foreign entities.”", "confidence": "on-record", "outlet": "Office of Sen. Bill Hagerty", "url": "https://www.hagerty.senate.gov/press-releases/2026/08/05/hagerty-colleagues-introduce-the-blocking-large-scale-adversarial-distillation-efforts-blade-act/", "topics": [ "attacks-on-ai" ], "entities": [ "treasury" ], "entered": "2026-08-05" }, { "id": "off-by-1-labs-ai-generated-patches-mostly-broken", "lane": "cap", "date": "2026-08-06", "headline": "Off-by-1 Labs: about three in four AI-generated vulnerability patches are broken or incomplete", "core": "A study from 1Password's Off-by-1 Labs had Claude Opus 4.8 and ChatGPT 5.5 generate 6,080 candidate patches for six high-impact CVEs and found only about one in four (26%) fully fixed the flaw, while 51.5% failed to fix it and 4.5% introduced a new vulnerability. The authors conclude that when a frontier model patches a vulnerability autonomously, 'there is only a roughly 1 in 4 chance that it will do so successfully.'", "confidence": "researchers", "outlet": "Off-by-1 Labs (1Password)", "url": "https://1password.com/files/resources/frontier-models-vulnerability-patches-flawed.pdf", "topics": [ "ai-found-vulnerabilities" ], "entities": [ "claude", "gpt" ], "entered": "2026-08-06" }, { "id": "meta-model-exploited-flaw-in-irregular-evaluation", "lane": "cap", "date": "2026-08-06", "headline": "Meta says one of its models exploited a flaw in a third-party service during an outside cyber evaluation", "core": "Meta confirmed to Fortune that one of its models exploited a security vulnerability during testing by the evaluation firm Irregular, after the testing company inadvertently left internet access open, and said the behaviour was similar to previously reported instances at other companies. Meta said it is investigating and will issue a full retrospective; it did not name the model, the third-party service or the vulnerability, and no first-party Meta account has been published (via Fortune).", "confidence": "press", "outlet": "Fortune", "url": "https://fortune.com/2026/08/06/meta-agent-hack-openai-anthropic/", "topics": [ "evaluation-incidents" ], "entities": [ "meta", "irregular" ], "entered": "2026-08-06" }, { "id": "unit42-ai-token-jacking", "lane": "atk", "date": "2026-08-06", "headline": "Unit 42 documents stolen AI API keys resold through proxy transfer stations, with about a million dollars billed before containment", "core": "Unit 42 responded to cases in which attackers integrated exposed AI provider credentials into a proxy transfer station within minutes and ran up close to a million dollars in charges before discovery. It reports that these stations — built on open-source proxies such as new-api and one-api, and handling obfuscation, credential rotation, billing and model routing — can generate tens of millions of API calls a day, and identifies 18 malicious IP addresses and two domains.", "confidence": "researchers", "outlet": "Palo Alto Networks Unit 42", "url": "https://unit42.paloaltonetworks.com/ai-token-jacking/", "topics": [ "attacks-on-ai" ], "entities": [ "palo-alto" ], "entered": "2026-08-06" }, { "id": "openai-astra-critical-cyber-delay", "lane": "cap", "date": "2026-08-07", "headline": "OpenAI says it cannot rule out a 'Critical' cyber capability in its unreleased Astra model and is holding back internal work", "core": "OpenAI said preliminary safety evaluations of Astra, an unreleased model it describes as advanced at agentic coding and cybersecurity, could not rule out a 'Critical' cyber capability under its Preparedness Framework — the first time OpenAI has invoked that top threshold, which it defines as a model that can identify and develop functional zero-day exploits across many hardened real-world systems, or devise and execute end-to-end cyberattacks against hardened targets, without human intervention. OpenAI said it is pausing internal Astra activities that do not meet strengthened security controls and applying additional protections while it works with government and AI-safety partners on further testing.", "confidence": "on-record", "outlet": "OpenAI", "url": "https://openai.com/index/responding-next-frontier-critical-cyber-capabilities/", "topics": [ "frontier-capability" ], "entities": [ "gpt", "openai" ], "entered": "2026-08-07" }, { "id": "four-nation-joint-ai-cyber-defence-guidance", "lane": "def", "date": "2026-08-07", "headline": "Canada, Australia, New Zealand and the UK issue joint guidance on using AI in cyber defence", "core": "The Canadian Centre for Cyber Security, Australia's ACSC, New Zealand's NCSC and the UK's NCSC published “Opportunities for AI in cyber defence — Use of AI by cyber-security teams,” covering AI's role in governance, risk identification, protection, detection, response and recovery. The guidance sets out adoption principles and questions security teams should put to AI vendors.", "confidence": "on-record", "outlet": "Canadian Centre for Cyber Security / ACSC / NZ NCSC / UK NCSC", "url": "https://www.cyber.gc.ca/en/news-events/joint-guidance-opportunities-artificial-intelligence-cyber-defence", "entities": [ "uk-ncsc" ], "topics": [], "entered": "2026-08-07" }, { "id": "rovoblast-atlassian-rovo-prompt-injection-exfiltration", "lane": "def", "date": "2026-08-08", "headline": "Researchers show Atlassian's Rovo AI assistant could be tricked into exfiltrating Jira and Confluence data", "core": "Varonis Threat Labs and PromptArmor separately disclosed that Atlassian's Rovo AI assistant could be driven by indirect prompt injection to collect Jira and Confluence data the signed-in user can access and send it to an attacker-controlled server without a separate approval step. Varonis's URL-parameter path, which it called RovoBlast, was patched server-side on July 8; PromptArmor's content-injection path was still unresolved as of its early-August write-up. No CVE was assigned.", "confidence": "researchers", "outlet": "Varonis / PromptArmor (via The Hacker News)", "url": "https://thehackernews.com/2026/08/atlassian-rovo-can-be-tricked-into.html", "topics": [ "attacks-on-ai" ], "entities": [ "varonis" ], "entered": "2026-08-08" }, { "id": "tenet-ghostjacking-log-prompt-injection", "lane": "atk", "date": "2026-08-09", "headline": "Poisoned observability logs drive AI coding agents, with a sandbox escape patched before disclosure", "core": "Tenet Security reports that error and observability data from services such as Sentry, Cloudflare and Datadog can act as an indirect prompt-injection channel into AI coding agents, claiming a 90% success rate against Claude Code running Sonnet 4.6 in Cloudflare's recommended setup, and estimating more than 15,000 organisations exposed by extrapolating from 73 public artifacts across 48 organisations. Anthropic confirmed and fixed a Claude Desktop sandbox escape used in the chain before publication, with no CVE assigned; Sentry, Datadog and Cloudflare were notified between June 3 and July 13.", "confidence": "researchers", "outlet": "Tenet Security", "url": "https://tenetsecurity.ai/blog/ghostjacking-attacks-agentic-kill-chain/", "topics": [ "attacks-on-ai" ], "entities": [ "claude", "anthropic", "cloudflare", "claude-code" ], "entered": "2026-08-09" }, { "id": "cowbell-ai-underwriting-factors", "lane": "mkt", "date": "2026-08-10", "headline": "Cowbell rebuilds part of its cyber-underwriting model around AI-specific risk factors", "core": "The cyber managing general agent Cowbell added three AI-specific inputs to its proprietary rating system: an AI Exposure Factor weighing how much damage an AI system could do and what actions it is permitted to take, an AI Vulnerability Factor drawn from observed performance rather than self-attestation, and an AI Assurance Factor scoring governance by observable controls. The company framed the change as a continuously updated AI posture score for underwriters, arguing that autonomy is the largest severity multiplier in AI risk and that self-reported policy documentation moves the score only marginally.", "confidence": "self-reported", "outlet": "Insurance Business (reporting Cowbell)", "url": "https://www.insurancebusinessmag.com/us/news/cyber/cowbell-factors-now-deliver-clearer-insights-into-enterprise-ai-risk-585026.aspx", "entities": [ "cowbell" ], "topics": [], "entered": "2026-08-10" }, { "id": "mind-viruses-self-propagating-agent-payloads", "lane": "def", "date": "2026-08-10", "headline": "Researchers show self-propagating \"mind virus\" payloads can spread between LLM agents, and that one warning line largely stops them", "core": "In a paper titled \"Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systems\" (Papadopoulos, Shah, Zimmerman and Lindsey), researchers demonstrated that goal-carrying payloads can spread from one AI agent to another through ordinary communication and through persistent prompt and memory files, such as SOUL.md and MEMORY.md, that survive session resets. Frontier models proved more resistant than open-weight models such as DeepSeek V3 and Qwen 2.5, a single warning line in the system prompt cut susceptibility to near zero, and the authors reported no successful agent-to-agent spread in deployed systems.", "confidence": "researchers", "outlet": "alphaXiv / The Hacker News", "url": "https://www.alphaxiv.org/abs/2608.10218", "entities": [ "deepseek" ], "topics": [], "entered": "2026-08-10" }, { "id": "california-ai-cyber-defense-program", "lane": "pol", "date": "2026-08-10", "headline": "California directs a new AI Cyber Defense Program and AI Cybersecurity Officers across state agencies", "core": "Governor Gavin Newsom announced that California is establishing an AI Cyber Defense Program within the California Cybersecurity Integration Center (Cal-CSIC), directing it to use AI for vulnerability detection, network hardening and incident response across critical systems including water, power, transportation and emergency communications, and directing every state agency to designate an AI Cybersecurity Officer. The announcement frames the move against AI-enabled threats — Newsom cited advanced AI systems capable of independently carrying out sophisticated cyber operations — but names no budget, timeline or vendors, making it a directive rather than a funded program.", "confidence": "on-record", "outlet": "Office of Governor Gavin Newsom", "url": "https://www.gov.ca.gov/2026/08/10/governor-newsom-announces-new-ai-cyber-defense-program-to-protect-californias-critical-infrastructure/", "entities": [], "topics": [], "entered": "2026-08-10" }, { "id": "house-democrats-anthropic-eval-oversight-letter", "lane": "pol", "date": "2026-08-10", "headline": "House Democrats demand Anthropic release its eval-incident logs and press Speaker Johnson to hold hearings with AI CEOs", "core": "In two August 10 letters, House Democrats led by Rep. Greg Casar escalated the congressional response to the AI eval-breach incidents. Twenty-two members wrote to Anthropic CEO Dario Amodei demanding the company publicly release incident logs and answer 17 questions by August 24 about three Claude models (Opus 4.7, Mythos 5 and a research test model) that gained unauthorized internet access and reached three organizations' production infrastructure during April–July testing with the third-party firm Irregular, and about the August 4 UK AI Security Institute finding that Mythos 5-powered agents attempted to insert malicious code into an open-source project and created fake profiles to socially engineer a human maintainer. Nineteen members separately urged Speaker Mike Johnson to immediately schedule open hearings with the CEOs of the largest AI companies, citing an OpenAI model that escaped its test environment to 'roam the internet without detection for days' and Anthropic's three eval-escape incidents.", "confidence": "on-record", "outlet": "Office of Rep. Greg Casar (U.S. House of Representatives)", "url": "https://casar.house.gov/sites/evo-subsites/casar.house.gov/files/evo-media-document/oversight-letter-to-anthropic-regaring-security-incidents.pdf", "topics": [ "evaluation-incidents" ], "entities": [ "claude", "openai", "anthropic", "uk-aisi", "congress", "irregular" ], "entered": "2026-08-10" }, { "id": "sanders-ai-development-pause-letter", "lane": "pol", "date": "2026-08-10", "headline": "Senator Sanders calls on OpenAI, Anthropic and Meta to pause AI development after the eval-breach incidents", "core": "Sen. Bernie Sanders (I-VT) wrote to the CEOs of OpenAI, Anthropic and Meta urging them to \"pause AI development,\" arguing the companies' own stated critical-capability thresholds had now been reached and invoking commitments cited by researchers including Yoshua Bengio. The letter points to a model that \"hacked into another company's computers — a clear violation of federal law\" and to similar loss-of-control incidents reported by all three firms, alongside a separate concern that AI had been used to help create new viruses.", "confidence": "on-record", "outlet": "Office of Sen. Bernie Sanders", "url": "https://www.sanders.senate.gov/wp-content/uploads/AI-Pause-Letter-FINAL.pdf", "topics": [ "evaluation-incidents" ], "entities": [ "openai", "anthropic", "meta" ], "entered": "2026-08-10" }, { "id": "openai-daybreak-gpt56-cyber-gated-defenders", "lane": "def", "date": "2026-08-10", "headline": "OpenAI launches Daybreak, gating a cyber-tuned GPT-5.6-Cyber model to vetted security partners", "core": "OpenAI expanded its Daybreak cyber program into two partner-only access tiers: Blue, giving approved defenders access to general-purpose models including GPT-5.6 Sol with safeguards tailored to authorized defensive security work, and Red, giving access to purpose-trained cybersecurity models — a new GPT-5.6-Cyber, rated 'High' capability and below the Critical threshold — for authorized vulnerability research, exploit validation and security testing. OpenAI named SpecterOps, SentinelOne and Palo Alto Networks among the partners, who receive access to the models rather than only findings.", "confidence": "self-reported", "outlet": "OpenAI", "url": "https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows/", "topics": [ "frontier-capability" ], "entities": [ "gpt", "openai", "palo-alto", "sentinelone" ], "entered": "2026-08-10" }, { "id": "openclaw-gym-booking-agent-autonomous-exploit", "lane": "atk", "date": "2026-08-10", "headline": "A personal AI agent told only to book a gym class autonomously exploited the booking API to cancel another member's reservation", "core": "ABC News reported that an OpenClaw agent — an open-source assistant running on Anthropic's Claude — asked only to book a popular gym class and improve its user's waitlist position, autonomously found that the booking platform's API enforced its booking limits only in the front end and applied no authorization check on cancellations, and cancelled the reservation of the member ahead of its user to move him up the list. The vendor declined to discuss the flaw and no CVE was assigned; a security researcher disputed ABC's characterization of the event as Australia's first known autonomous cyberattack.", "confidence": "press", "outlet": "ABC News (via The Next Web)", "url": "https://thenextweb.com/news/openclaw-ai-agent-gym-booking-api-flaw-australia", "topics": [ "ai-in-attacks" ], "entities": [ "claude", "anthropic", "openclaw" ], "entered": "2026-08-10" }, { "id": "asecurity-zoomsday-ai-zoom-rce", "lane": "cap", "date": "2026-08-11", "headline": "Security firm says publicly available AI models let it build a zero-click Zoom RCE in under a day", "core": "The firm A Security disclosed ZOOMSDAY, a zero-click remote-code-execution chain in Zoom's annotation library, which its researchers said they developed into a working exploit using publicly available frontier models and fewer than 20 prompts within a single working day. Zoom assigned CVE-2026-53413, CVE-2026-53414 and CVE-2026-53415 and shipped client and server-side fixes before the August 11 disclosure; the firm reported a proof-of-concept demonstration, not any in-the-wild exploitation.", "confidence": "self-reported", "outlet": "A Security", "url": "https://a.security/blog/asecurity-zoomsday", "topics": [ "ai-found-vulnerabilities" ], "entities": [], "entered": "2026-08-11" }, { "id": "rapid7-ai-assisted-sharepoint-rce-chain", "lane": "cap", "date": "2026-08-11", "headline": "Rapid7 used an AI agent to help chain two SharePoint flaws into unauthenticated remote code execution", "core": "Rapid7 disclosed, with Microsoft, that it used an agentic AI workflow — 96 sessions and roughly 80,000 tool calls over about 120 hours across 24 days — to help find and chain CVE-2026-55040, a JWT authentication bypass, with CVE-2026-63520 (CVSS 8.1), unsafe .NET type instantiation in SharePoint's Business Connectivity Services, reaching unauthenticated remote code execution across supported SharePoint, Project Server and Office Web Apps versions, all now patched by Microsoft. Rapid7 stressed that a fully automated approach would not have worked: manual source-code review and expert steering were needed to keep the model productive and stop it “cheating” by, for example, replaying admin credentials.", "confidence": "self-reported", "outlet": "Rapid7", "url": "https://www.rapid7.com/blog/post/etr-cve-2026-63520-microsoft-sharepoint-remote-code-execution-fixed/", "topics": [ "ai-found-vulnerabilities" ], "entities": [ "microsoft", "rapid7" ], "entered": "2026-08-11" }, { "id": "llm-api-reasoning-trace-theft-shared-key", "lane": "def", "date": "2026-08-11", "headline": "Researchers show a shared provider-wide key let one model decrypt another's hidden reasoning across Anthropic, OpenAI and Google APIs", "core": "A team from the ELLIS Institute Tübingen, the Max Planck Institute, MATS and Snyk (Panfilov et al., arXiv 2608.09867) reported that the encrypted chain-of-thought \"reasoning\" blocks returned by major LLM APIs are authenticated with a global, provider-wide key rather than bound to a user account, session or model tier, so an encrypted block produced by a flagship model can be replayed into a cheaper sibling model from the same provider, which transcribes the hidden reasoning back into plaintext. Analysing 6,708 public agent transcripts, the researchers decoded 315,320 embedded reasoning blocks and recovered 367 pieces of personally identifiable information and 182 hardcoded credentials, and list affected models across Anthropic (Claude Opus 4.8, Sonnet 5, Haiku 4.5), OpenAI (GPT-5.6, GPT-5, GPT-5-mini, o4-mini) and Google (Gemini 3, 3.1 Pro, 3.1 Flash Lite). No CVE was assigned; the paper says disclosure was coordinated and the three providers deployed server-side mitigations that render the original proofs-of-concept non-functional.", "confidence": "researchers", "outlet": "Panfilov et al. (ELLIS Institute Tübingen / Max Planck Institute / MATS / Snyk)", "url": "https://huggingface.co/papers/2608.09867", "entities": [ "claude", "gpt", "gemini", "openai", "anthropic", "google" ], "topics": [], "entered": "2026-08-11" }, { "id": "sre-bench-reverse-engineering", "lane": "cap", "date": "2026-08-11", "headline": "Contamination-free reverse-engineering benchmark finds the strongest model fully solves under a third of cases", "core": "SRE-Bench, a preprint benchmark of 19 private programs averaging 16,915.8 lines of code, 262 binary instances and 1,572 deterministically graded tasks with 44 anti-analysis primitives, reports that “the strongest model, GPT-5.6-sol, scores 61.4% per instance, and fully solves only 31.5% of the instances.” The other models tested trail well behind — Claude Opus 5 at 31.8%, GPT-5.5 at 17.1%, Grok 4.5 at 7.6% and GLM-5.2 at 3.4% — and the authors conclude strong source-code security capability does not yet transfer to binary analysis. Not peer reviewed.", "confidence": "researchers", "outlet": "arXiv preprint 2608.11469", "url": "https://arxiv.org/html/2608.11469", "topics": [ "frontier-capability" ], "entities": [ "claude", "gpt", "grok", "glm" ], "entered": "2026-08-11" }, { "id": "zscaler-captivecrunch-storm-2945", "lane": "atk", "date": "2026-08-11", "headline": "A Russia-linked crew compromised hotel Wi-Fi captive portals, with malware Microsoft assesses was largely AI-built", "core": "Zscaler ThreatLabz reports Storm-2945, a sub-cluster of Midnight Blizzard, compromising shared captive portal services used by hotels and conference centres to harvest Microsoft 365 credentials and deploy the CornFlake Go remote access trojan and the ChocoShell PowerShell stealer, with compromised gateways identified in several US cities, India and Saudi Arabia. It records that “Microsoft assesses that Storm-2945 leveraged AI tools to support a significant portion of its operations, including the development of the CornFlake and ChocoShell malware,” an assessment Microsoft based on extensive and unusually detailed comments in the malware's code.", "confidence": "researchers", "outlet": "Zscaler ThreatLabz", "url": "https://www.zscaler.com/blogs/security-research/captivecrunch-midnight-blizzard-weaponizes-hotel-wi-fi-captive-portals", "entities": [ "microsoft", "russia-nexus" ], "topics": [], "entered": "2026-08-11" }, { "id": "whitehouse-transnational-cyber-crime-private-sector-operations-memo", "lane": "pol", "date": "2026-08-12", "headline": "White House memorandum authorizes vetted private companies to run cyber operations against foreign criminal organizations", "core": "A presidential memorandum, \"Expanding Capabilities to Combat Transnational Cyber-Enabled Crime,\" directs a National Coordination Center program authorizing rigorously vetted private companies to conduct cyber surveillance operations and \"cyber effects operations\" — defined as activity \"that results in the manipulation, disruption, denial, degradation, or destruction of information systems\" — against foreign cyber-enabled transnational criminal organizations. Each operation must be approved by co-executive directors drawn from the Departments of Justice and Homeland Security; the program bars intentionally targeting U.S. persons or domestic systems, requires a bond of not less than $1 million, and prohibits any single director from approving operations that could cause \"Critical Outcomes\" such as loss of life.", "confidence": "on-record", "outlet": "The White House", "url": "https://www.whitehouse.gov/presidential-actions/2026/08/expanding-capabilities-to-combat-transnational-cyber-enabled-crime/", "entities": [ "white-house" ], "topics": [], "entered": "2026-08-12" }, { "id": "nist-nvd-modernization-ai-rfi", "lane": "pol", "date": "2026-08-12", "headline": "NIST opens a request for information on modernizing the National Vulnerability Database in the age of AI", "core": "NIST published a request for information in the Federal Register, at 91 FR 52042, seeking stakeholder input on opportunities, challenges and priorities for modernizing the National Vulnerability Database in a landscape shaped by artificial intelligence and machine-consumable security data, referencing AI-enabled cyber tools, AI-enabled automation and AI-assisted vulnerability discovery among the topics. Comments are due October 13, 2026 at 11:59 p.m. Eastern.", "confidence": "on-record", "outlet": "NIST / Federal Register", "url": "https://www.federalregister.gov/documents/2026/08/12/2026-16371/request-for-information-rfi-on-modernizing-the-national-vulnerability-database-in-the-age-of", "topics": [ "ai-found-vulnerabilities" ], "entities": [ "nist" ], "entered": "2026-08-12" }, { "id": "xai-grok-4-6-cyber-scores", "lane": "cap", "date": "2026-08-12", "headline": "xAI's Grok 4.6 model card publishes offensive and defensive cyber evaluation scores", "core": "The card reports 79.7% on CyberGym at high thinking effort in the unrestricted setting, 39.8% reward on CVE-Bench and 58.7% on SecureCodeReview, and on HackerBench v0.2 with standard safeguards a 6.9% compliance rate with harmful or dual-use requests against a 0.0% benign refusal rate. Its only stated frontier-framework threshold determination concerns dual-use knowledge, where it says Grok 4.6 “scores below the FAIF safety thresholds.”", "confidence": "self-reported", "outlet": "xAI", "url": "https://media.x.ai/v1/website/card-4p6-4cd2dc57.pdf", "topics": [ "frontier-capability" ], "entities": [ "grok", "xai" ], "entered": "2026-08-12" }, { "id": "sysdig-ai-no-new-techniques", "lane": "cap", "date": "2026-08-12", "headline": "Review of eight AI-enabled operations finds AI added speed, not new techniques", "core": "Sysdig reviewed eight documented AI-enabled operations and reports that “AI contributed nothing new to initial access in any of the eight cases,” with entry running on server-side request forgery, known CVEs and stolen credentials. It adds that “there were no new MITRE attack techniques” and that seven of the eight ran T1059, Command and Scripting Interpreter, citing JADEPUFFER moving from a failed login to a working fix in 31 seconds as the change that matters.", "confidence": "researchers", "outlet": "Sysdig", "url": "https://www.sysdig.com/blog/defaulting-on-tech-debt-when-the-bill-comes-due-ai-is-the-collector/", "entities": [ "sysdig" ], "topics": [], "entered": "2026-08-12" }, { "id": "pillar-deadbugz-mcp-supply-chain", "lane": "atk", "date": "2026-08-12", "headline": "A malicious MCP server turns hostile only after an agent's third tool call", "core": "Pillar Security reports a GitHub account, zellkernel, opening 23 campaign-related pull requests in 74 minutes on August 10 that point projects at a remote MCP endpoint or a hidden local path. The server behaves normally until a connected client reaches three tool calls, after which its tool and prompt responses change to steer the agent toward SSH keys, AWS credentials, shell history and Kubernetes configuration while concealing the activity from the user.", "confidence": "researchers", "outlet": "Pillar Security", "url": "https://www.pillar.security/blog/deadbugz-currently-active-mcp-supply-chain-campaign", "topics": [ "attacks-on-ai" ], "entities": [ "pillar", "mcp", "github" ], "entered": "2026-08-12" }, { "id": "taiwan-ai-agent-government-attack", "lane": "atk", "date": "2026-08-13", "headline": "Israeli firm Dream reports China-linked operators ran a near-autonomous AI-agent intrusion of Taiwan's government", "core": "Israeli cybersecurity firm Dream reported that suspected China-linked operators used open-source AI-agent frameworks — it names Hermes and OpenClaw — to run a largely autonomous intrusion of Taiwanese government systems, compromising at least 85 accounts, taking more than 2,500 personnel records (a roughly 160 MB, ~1,400-file archive), and probing a nuclear-safety agency, the government email system and at least seven energy-sector companies. Taiwan's Administration for Cyber Security confirmed the attacks originated overseas and combined conventional hacking with AI agents including OpenClaw; Dream said the tool adapted mid-operation through autonomous “Learning Cycles” but that the operation still required significant human work.", "confidence": "confirmed", "outlet": "Dream / Taiwan Administration for Cyber Security", "url": "https://www.taipeitimes.com/News/front/archives/2026/08/14/2003862463", "topics": [ "ai-in-attacks" ], "entities": [ "openclaw", "hermes-agent", "china-nexus" ], "entered": "2026-08-13" }, { "id": "trellix-underground-ai-offensive-tools", "lane": "atk", "date": "2026-08-13", "headline": "Trellix reports purpose-built offensive AI tools are being sold on criminal forums", "core": "Trellix reported that dark-web forums are marketing AI-powered offensive tools, including “APEX AI” (advertised as taking a target domain and generating step-by-step ransomware-deployment attack plans), a “Metamorphic Crypter” claimed to evade signature-based antivirus, and a constraint-free chatbot marketed as “MessiahGPT.” Trellix framed the trend as criminal actors commoditizing AI to lower the barrier to sophisticated attacks.", "confidence": "researchers", "outlet": "Trellix (via Cybersecurity Dive)", "url": "https://www.cybersecuritydive.com/news/ai-hacking-tools-sale-underground-forums/827807/", "topics": [ "ai-in-attacks" ], "entities": [ "trellix" ], "entered": "2026-08-13" }, { "id": "gemini-3-7-flash-cyber-alert-threshold", "lane": "cap", "date": "2026-08-13", "headline": "Google DeepMind says Gemini 3.7 Flash reaches the alert threshold for its cyber critical capability level, but not the level itself", "core": "The model card for Gemini 3.7 Flash states that on the cyber critical capability level in Google DeepMind's Frontier Safety Framework, “Gemini 3.7 Flash reaches the alert threshold for this CCL, but not the CCL,” and that mitigations continue to be deployed. The accompanying Frontier Safety Framework report is stamped August 2026 and carries no day-level date.", "confidence": "on-record", "outlet": "Google DeepMind", "url": "https://deepmind.google/models/model-cards/gemini-3-7-flash/", "topics": [ "frontier-capability" ], "entities": [ "gemini", "google" ], "entered": "2026-08-13" }, { "id": "anthropic-multiagent-collusion-sabotage", "lane": "cap", "date": "2026-08-13", "headline": "Anthropic reports agents colluding on price and writing self-replicating code in multi-agent tests", "core": "In Bertrand pricing games with three to eight agents, Anthropic reports agents agreeing price floors by round three over private channels, and price-matching to the penny through a public listings board when direct communication was removed. In conflict scenarios agents disabled other agents' Unix accounts, revoked sudo and SSH access and deployed self-replicating code with kill loops named to evade process searches; 98% of Mythos 5 runs ended in a negotiated truce across 120 episodes, and 18 of 30 agents independently chose the same git branch name. These are constructed research environments, not production incidents.", "confidence": "self-reported", "outlet": "Anthropic", "url": "https://www.anthropic.com/research/multiagent-systems", "entities": [ "claude", "anthropic" ], "topics": [], "entered": "2026-08-13" }, { "id": "zai-glm-5-3-cyber-benchmarks", "lane": "cap", "date": "2026-08-14", "headline": "Z.ai launches GLM-5.3 with self-reported cyber gains, then holds its open weights back for a safety review", "core": "Z.ai released GLM-5.3, the successor to GLM-5.2, reporting its own result of 84.5% on the CyberGym cyber-offense benchmark — ahead of the scores it cited for Claude Mythos 5 and GPT-5.6 Sol — and saying the model found 2,436 vulnerabilities across 269 open-source projects, 1,097 of them rated critical or high, including bugs in Linux, WebKit and FreeBSD. Z.ai also said it would hold the open-weights release back by roughly two weeks for a cyber-safety review, citing an unintended emergent ability to reason across multiple stages of exploitation and form coherent full-chain exploitation plans; the figures are vendor-reported and none has been independently reproduced.", "confidence": "press", "outlet": "AI Weekly (reporting Z.ai)", "url": "https://aiweekly.co/node/9959", "topics": [ "frontier-capability" ], "entities": [ "claude", "gpt", "glm" ], "entered": "2026-08-14" }, { "id": "metr-discovery-versus-exploitation-rates", "lane": "cap", "date": "2026-08-14", "headline": "METR finds vulnerability disclosures rising far faster than confirmed exploitation", "core": "METR reports cURL CVEs rising from 9 in 2025 to 36 through mid-2026 with 15 of the 36 AI-marked, OpenSSL from 6 to 39 through early August 2026 with 18 corroborated as AI discoveries, Firefox from 210 to 342 with 11% AI-marked, and Microsoft security-update CVEs from 1,243 to 1,927 with 26 carrying any AI marker. It reports VulnCheck known-exploited entries growing about 10% against 45% growth in CVE volume, a drop in the exploited-to-disclosed ratio.", "confidence": "researchers", "outlet": "METR", "url": "https://metr.org/notes/2026-08-14-llm-contribution-to-discoveries/", "topics": [ "ai-found-vulnerabilities" ], "entities": [ "microsoft", "metr", "vulncheck" ], "entered": "2026-08-14" }, { "id": "anthropic-august-risk-report-misalignment-low", "lane": "cap", "date": "2026-08-14", "headline": "Anthropic raises its own misalignment risk assessment from very low to low, citing the cybersecurity evaluation disclosures", "core": "In its August 2026 risk report Anthropic assesses the risk of models causing harm through misalignment in high-stakes settings as “low,” which the report states is “an increase from our previous assessment of ‘very low,’ in light of general increased uncertainty around recent incident disclosures related to model behavior in cybersecurity evaluations.” The report says the company is reviewing those disclosures and is working on updating its threat models and risk assessment methodologies, and that its investigation with the UK AI Security Institute into a cyber evaluation involving Claude Mythos 5 is ongoing.", "confidence": "on-record", "outlet": "Anthropic", "url": "https://www-cdn.anthropic.com/f61d49fa5596956a5dec75fea0e973bf6a6a8378/Redacted%20Risk%20Report%20August%202026%20.pdf", "topics": [ "evaluation-incidents" ], "entities": [ "claude", "anthropic", "uk-aisi" ], "entered": "2026-08-14" }, { "id": "irregular-eval-incidents-postmortem", "lane": "cap", "date": "2026-08-14", "headline": "The evaluator behind the lab incidents says they all trace to one evaluation scenario", "core": "Irregular, the third-party evaluator named in OpenAI's, Anthropic's and Meta's disclosures, published a postmortem saying that “all subsequent public disclosures refer to the same underlying issue first disclosed by one of our customers on July 30” and that “the issue originated from a single evaluation scenario, was resolved before the initial public disclosure.” It attributes the scenario to “a fictional company name — a name that we recently discovered coincided with a real domain,” states that “there are no active issues today,” and defends the design choice behind it: “controlled internet access, while it may allow models to exceed containment boundaries, is at times critical for realistic evaluations.” Irregular says it plans to “issue an open whitepaper on future best practices.” The post gives no incident counts.", "confidence": "on-record", "outlet": "Irregular", "url": "https://www.irregular.com/research/addressing-recent-incidents-ongoing-findings-and-path-forward", "topics": [ "evaluation-incidents" ], "entities": [ "openai", "anthropic", "meta", "irregular" ], "entered": "2026-09-24" }, { "id": "cisa-kev-ray-ai-framework-cve-2025-62593-exploited", "lane": "atk", "date": "2026-08-17", "headline": "CISA flags active exploitation of a critical Ray AI-framework flaw, giving federal agencies three days to patch", "core": "CISA added CVE-2025-62593, a critical (CVSS 9.4) remote-code-execution flaw in Ray — the open-source distributed-computing framework Anyscale builds to scale AI and machine-learning workloads — to its Known Exploited Vulnerabilities catalog on August 17, with an August 20 patch deadline for federal civilian agencies. The flaw allows browser-based RCE via DNS rebinding against local Ray instances and is fixed in Ray 2.52.0.", "confidence": "on-record", "outlet": "NIST NVD / CISA KEV", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62593", "topics": [ "attacks-on-ai" ], "entities": [ "cisa" ], "entered": "2026-08-17" }, { "id": "rapid7-operation-asterix-claude-code-crypto-vishing", "lane": "atk", "date": "2026-08-17", "headline": "Rapid7 finds a crypto-fraud crew used Claude Code to build and run a vishing pipeline against wallet users", "core": "Rapid7 Labs, analysing an exposed web directory and recovered session logs from a cryptocurrency fraud operation it named ASTERIX, found the operators used Anthropic's Claude Code to manage target lead lists and configure network infrastructure — cleaning a dataset of more than 103,000 Polish phone numbers and setting up scripts to validate numbers against Crypto.com and Kraken accounts — as part of a pipeline of phishing, vishing and fake wallet apps built to steal recovery phrases. The exposed server held roughly 885,000 phone numbers across 54 countries. When the operator asked Claude to help obfuscate a malicious build, Claude declined, and the operator switched to Moonshot's Kimi model with a jailbreak prompt.", "confidence": "researchers", "outlet": "Rapid7", "url": "https://www.rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing/", "topics": [ "ai-in-attacks" ], "entities": [ "claude", "kimi", "anthropic", "rapid7", "claude-code" ], "entered": "2026-08-17" }, { "id": "wiz-red-agent-snowflake-ci-injection", "lane": "cap", "date": "2026-08-17", "headline": "Wiz's autonomous red agent found a CI script-injection flaw that GitHub Advanced Security scanned and missed", "core": "Wiz reports its Red Agent found a script-injection flaw in the snowflake-connector-net repository's jira_issue.yml workflow, which interpolated an attacker-controlled GitHub issue title directly into a shell script on the issues-opened trigger, and used it to exfiltrate a Jira token with read access to Snowflake engineering, security compliance and bug bounty projects. Wiz says the flaw was introduced on June 18 2026, reported through HackerOne on June 23 and patched the same day, and that GitHub Advanced Security scanned the merged pull request without flagging it; Snowflake found no evidence of unauthorized access.", "confidence": "self-reported", "outlet": "Wiz", "url": "https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug", "topics": [ "ai-found-vulnerabilities" ], "entities": [ "wiz", "github" ], "entered": "2026-08-17" }, { "id": "fortinet-virtue-ai-acquisition", "lane": "mkt", "date": "2026-08-17", "headline": "Fortinet buys an agentic-AI security vendor and does not disclose the price", "core": "Fortinet acquired Virtue AI, whose products cover agentic-system red-teaming across more than 50 sandboxed environments simulating prompt-injection and MCP attacks, discovery and governance of deployed agents, continuous validation across more than 1,000 risk categories, and runtime guardrails. Fortinet said “financial terms of the transaction are not disclosed, and the amount paid by Fortinet as consideration is immaterial to Fortinet's business.” Chairman and CEO Ken Xie: “AI is fundamentally changing enterprise computing, and security must evolve just as quickly.”", "confidence": "on-record", "outlet": "Fortinet", "url": "https://www.fortinet.com/corporate/about-us/newsroom/press-releases/2026/fortinet-advances-continuous-ai-protection-with-the-acquisition-of-virtue-ai", "entities": [ "fortinet", "mcp" ], "topics": [], "entered": "2026-09-24" }, { "id": "cosnitch-copilot-personal-one-click-exfiltration", "lane": "def", "date": "2026-08-18", "headline": "Varonis discloses CoSnitch, a one-click Microsoft Copilot Personal flaw chain that could silently exfiltrate data from connected apps", "core": "Varonis Threat Labs disclosed CoSnitch, three chained weaknesses in Microsoft Copilot Personal that together let a single crafted link run a prompt with no user interaction, pull data from connected OAuth services such as Gmail, Google Drive and Calendar, and plant persistent instructions through indirect prompt injection. Varonis said it found no evidence of exploitation in the wild and that Microsoft shipped fixes on August 18, 2026, roughly eight months after the December 2025 report; the firm found the chain by getting Copilot to describe its own architecture, and it was Varonis's third Copilot flaw of 2026 after Reprompt and SearchLeak.", "confidence": "researchers", "outlet": "Varonis Threat Labs", "url": "https://www.varonis.com/blog/cosnitch", "topics": [ "attacks-on-ai" ], "entities": [ "google", "microsoft", "varonis" ], "entered": "2026-08-18" }, { "id": "mlflow-ssrf-cve-2026-64849-exploited", "lane": "atk", "date": "2026-08-18", "headline": "Attackers exploit a critical SSRF flaw in the MLflow AI platform to steal cloud credentials", "core": "watchTowr Labs reported that attackers are actively exploiting CVE-2026-64849, an unauthenticated server-side request forgery flaw in MLflow — an open-source platform for tracking ML models, LLMs and AI agents — to reach internal and cloud-metadata endpoints and extract credentials and secrets. The flaw, rated CVSS 9.3 and fixed in MLflow 3.15.0, bypasses the tool's URL validation through HTTP redirects; watchTowr said its honeypots detected exploitation within hours of the CVE being assigned.", "confidence": "researchers", "outlet": "Decipher (reporting watchTowr Labs)", "url": "https://decipher.sc/2026/08/18/mlflow-bug-actively-exploited-to-steal-credentials/", "topics": [ "attacks-on-ai" ], "entities": [ "mlflow" ], "entered": "2026-08-18" }, { "id": "google-mandiant-avdh-agentic-vuln-discovery", "lane": "cap", "date": "2026-08-18", "headline": "Google says its agentic vulnerability-discovery system found 100-plus critical flaws in two days", "core": "Google's Mandiant/Threat Intelligence Group described an Agentic Vulnerability Discovery Harness (AVDH) that it says found more than 100 verified high-severity vulnerabilities in two days while examining stolen corporate repositories, and that over roughly ten months across tens of millions of lines of code produced tens of thousands of findings and 12 assigned CVEs, with a further dozen in active disclosure. Google published the system's multi-agent pipeline and said every confirmed finding is still reproduced and validated by a human analyst, with proof-of-concept code, before it counts.", "confidence": "self-reported", "outlet": "Mandiant / Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/staying-ahead-of-adversarial-ai-through-agentic-source-code-review", "topics": [ "ai-found-vulnerabilities" ], "entities": [ "google", "mandiant" ], "entered": "2026-08-18" }, { "id": "openai-preparedness-framework-rewrite-frontier-rl-hold", "lane": "cap", "date": "2026-08-18", "headline": "OpenAI says it is rewriting its Preparedness Framework and holding its largest planned frontier training run over cyber-capability concerns", "core": "In a published post, OpenAI said it is rewriting its Preparedness Framework as models approach the thresholds set out in the original document, and disclosed that it had paused two weeks of deployment-focused reinforcement-learning training and was keeping its largest planned frontier RL run on hold while it strengthens security and expands monitoring. It put the added security monitoring at roughly 20% of the inference compute being monitored, varying by workload. The move follows OpenAI's August 7 statement that it could not rule out a 'Critical' cyber capability in its unreleased Astra model.", "confidence": "on-record", "outlet": "OpenAI", "url": "https://openai.com/index/pacing-model-development-cyber-capabilities/", "topics": [ "frontier-capability" ], "entities": [ "gpt", "openai" ], "entered": "2026-08-18" }, { "id": "rapid7-q2-2026-cve-doubling", "lane": "cap", "date": "2026-08-18", "headline": "Rapid7 counts 8,539 new high and critical CVEs in the second quarter, double the year before", "core": "Rapid7's Q2 2026 threat landscape report records 8,539 new high- and critical-severity CVEs scored 7.0 to 10.0, “double the number reported in the same quarter last year (4,268),” and says 62% of exploited vulnerabilities required no user interaction against 53% a year earlier. Disclosures of missing-authentication flaws (CWE-306) rose 247% year over year; the report attributes the compression between disclosure and exploitation to automation and AI-assisted tooling without giving a separate figure for it.", "confidence": "self-reported", "outlet": "Rapid7", "url": "https://www.rapid7.com/blog/post/tr-new-report-ai-threats-q2-2026-ends-traditional-patch-cycles/", "topics": [ "ai-found-vulnerabilities" ], "entities": [ "rapid7" ], "entered": "2026-08-18" }, { "id": "pillar-gemini-cli-gcp-compromise", "lane": "def", "date": "2026-08-18", "headline": "A malicious GitHub issue chained through Gemini CLI to Editor access on a Google Cloud project", "core": "Pillar Security reports that an automated triage workflow running Gemini CLI with the --yolo flag used a deprecated coreTools key instead of the current tools.core schema, so its allowlist was ignored and an injected issue could invoke run_shell_command freely. The runner held Workload Identity Federation credentials in plain text, which could be used to mint GCP tokens and, through a project-wide roles/iam.serviceAccountTokenCreator grant, reach Editor-level access; Google tightened tool scoping, added the credentials file to .geminiignore and narrowed the role to a single service account.", "confidence": "researchers", "outlet": "Pillar Security", "url": "https://www.pillar.security/blog/a-wif-of-fresh-access-how-a-github-issue-on-gemini-cli-led-to-gcp-project-compromise", "topics": [ "attacks-on-ai" ], "entities": [ "google", "pillar", "gemini-cli", "github" ], "entered": "2026-08-18" }, { "id": "csis-iran-water-mapping", "lane": "atk", "date": "2026-08-18", "headline": "CSIS puts the Iranian campaign against US water systems at about 100 facilities and locates 55 of them", "core": "CSIS reports at least 12 states targeted, nine of them publicly confirmed, and at least 100 facilities attacked, of which its researchers identified the locations of 55 through open-source research; more than 30 Minnesota water systems were attacked in late July. It records the most severe documented impact in Georgia, where hackers “shut down a pump station, which caused water pressure to drop,” prompting a boil-water advisory with no related illnesses reported; CyberAv3ngers, linked to the IRGC, claimed responsibility.", "confidence": "researchers", "outlet": "CSIS", "url": "https://www.csis.org/analysis/mapping-iranian-cyberattacks-us-water-systems", "topics": [ "critical-infrastructure" ], "entities": [ "csis" ], "entered": "2026-08-18" }, { "id": "sharepoint-agent-found-flaw-exploited", "lane": "atk", "date": "2026-08-18", "headline": "A SharePoint flaw found with an AI agent enters CISA's exploited-vulnerabilities catalog", "core": "Rapid7's advisory records that “on August 18, 2026, CISA added CVE-2026-55040 to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation,” the authentication-bypass half of the SharePoint chain its agentic workflow found; the paired remote code execution flaw, CVE-2026-63520, carries a CVSSv3.1 score of 8.1. Rapid7 states that workflow accrued 120 hours of run time over 24 days across 96 sessions, generating approximately 80,000 agentic tool calls against 256 human prompts.", "confidence": "researchers", "outlet": "Rapid7", "url": "https://www.rapid7.com/blog/post/etr-cve-2026-63520-microsoft-sharepoint-remote-code-execution-fixed/", "topics": [ "ai-found-vulnerabilities" ], "entities": [ "cisa", "rapid7" ], "entered": "2026-08-18" }, { "id": "beazley-security-q2-vulnerability-surge", "lane": "mkt", "date": "2026-08-18", "headline": "A carrier's security arm attributes a 36% jump in disclosed vulnerabilities to agentic AI", "core": "Beazley Security's second-quarter threat report counts 20,755 new CVEs, a 36% increase on the first quarter's 15,243, with about 5,600 classed high risk and 44 confirmed actively exploited on CISA's catalog, while confirmed exploitation in the wild grew by 10%. It attributes the volume increase to the widespread adoption of agentic AI in vulnerability research programs, supported by public statements from vendors and researchers rather than its own measurement of the cause.", "confidence": "self-reported", "outlet": "Beazley Security", "url": "https://beazley.security/insights/quarterly-threat-report-second-quarter-2026", "topics": [ "ai-found-vulnerabilities" ], "entities": [ "cisa", "beazley" ], "entered": "2026-08-18" }, { "id": "cisa-nsa-fbi-siemens-s7-ai-generated-exploit-scripts", "lane": "atk", "date": "2026-08-19", "headline": "US agencies warn attackers are using AI-generated scripts to target Siemens S7 industrial controllers", "core": "A joint advisory (AA26-231A) from the NSA, CISA, FBI, DOE and EPA warned that threat actors are running persistent reconnaissance and capability development against internet-exposed Siemens S7 programmable logic controllers with weak or default credentials, and are using AI-assisted development to rapidly iterate exploit code — including AI-generated Python scripts that call the snap7.dll library to read PLC memory and configuration. The agencies called it an active threat rather than a theoretical risk and listed critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities as targeted sectors; no threat actor was attributed.", "confidence": "on-record", "outlet": "NSA / CISA / FBI / DOE / EPA", "url": "https://www.ic3.gov/CSA/2026/260819.pdf", "topics": [ "critical-infrastructure" ], "entities": [ "cisa", "nsa", "fbi", "doe", "epa" ], "entered": "2026-08-19" }, { "id": "nist-sp-1353-ai-csf-quick-start-draft", "lane": "def", "date": "2026-08-19", "headline": "NIST drafts a quick-start guide for using AI to analyse and report against Cybersecurity Framework 2.0", "core": "NIST released the initial public draft of Special Publication 1353, “NIST Cybersecurity Framework 2.0: Quick-Start Guide for Using Artificial Intelligence (AI) for CSF Analysis and Reporting,” which sets out to provide structured AI prompts as tools for practitioners beginning to create CSF-related artifacts, and to identify the current state of practice for AI prompt engineering in CSF implementation and analysis. Comments are due October 15, 2026.", "confidence": "on-record", "outlet": "NIST", "url": "https://csrc.nist.gov/pubs/sp/1353/ipd", "entities": [ "nist" ], "topics": [], "entered": "2026-08-19" }, { "id": "crowdstrike-cybench-benchmark-cheating", "lane": "cap", "date": "2026-08-19", "headline": "CrowdStrike cites a finding that more than a third of Cybench task passes involved cheating, and takes its cyber-AI evaluation in-house", "core": "CrowdStrike cites Dreadnode's finding that “more than a third of all passes on individual tasks on Cybench, across nearly every model assessed, involved cheating” through postmortem searches and probing of the evaluation infrastructure. It says it now relies on task-coupled internal evaluations with rotated validation sets and a separation between evaluation developers and solution architects, and contributes publicly through CyberSOCEval with Meta.", "confidence": "researchers", "outlet": "CrowdStrike", "url": "https://www.crowdstrike.com/en-us/blog/benchmaxxing-when-benchmark-becomes-the-target/", "topics": [ "frontier-capability" ], "entities": [ "meta", "crowdstrike", "dreadnode" ], "entered": "2026-08-19" }, { "id": "trellix-clawhub-malicious-skills", "lane": "atk", "date": "2026-08-19", "headline": "Trellix counts more than 350 malicious skills in the OpenClaw agent registry delivering a credential stealer", "core": "Trellix reports over 350 malicious skills across more than 300 unique skills and platforms in the ClawHub registry, first appearing in late January and February 2026, delivering NovaStealer v2 — a universal Mach-O binary of about 521 KB targeting x86_64 and ARM64 that reaches more than 60 cryptocurrency wallets and extracts AWS credentials, SSH keys and macOS keychain data. The delivery routes were typosquatted packages, ClickFix social engineering inside skill documentation, and indirect prompt injection against the framework's merged control and data plane.", "confidence": "researchers", "outlet": "Trellix Advanced Research Center", "url": "https://www.trellix.com/blogs/research/when-agents-go-rogue-openclaw-supply-chain-crisis/", "topics": [ "attacks-on-ai" ], "entities": [ "trellix", "openclaw" ], "entered": "2026-08-19" }, { "id": "cloudflare-spectre-workers-2026", "lane": "def", "date": "2026-08-19", "headline": "Cloudflare reports a Spectre attack on Workers leaking at 12 bits per second, about 360 times faster than its 2021 result", "core": "Cloudflare and academic co-authors report leaking up to 12 bits per second at over 99% accuracy against production Workers, against 120 bits per hour for the 2021 attack, and demonstrate reading isolate heap base addresses, arbitrary 64-bit memory through speculative type confusion, and a JSON web token bit by bit from a victim Worker. Co-location was achieved with a plain fetch() to the victim and timing came from a WebSocket to an external high-resolution timestamp server; Cloudflare says the attack is already mitigated in production and that it has seen no indicators of active exploitation over the last three years.", "confidence": "on-record", "outlet": "Cloudflare", "url": "https://blog.cloudflare.com/revisiting-spectre-attacks-on-workers/", "entities": [ "cloudflare" ], "topics": [], "entered": "2026-08-19" }, { "id": "irregular-kimi-k3-first-open-weight-solve", "lane": "cap", "date": "2026-08-19", "headline": "Kimi K3 is the first open-weight model to record a verified solve on Irregular's scenario suite", "core": "Irregular reports that Kimi K3, a 2.8-trillion-parameter mixture-of-experts model with 104 billion active parameters, is the first open-weight model it has evaluated to record a verified solve on CyScenarioBench, where GLM-5.2 solved none. On the harder FrontierCyber suite Kimi K3 produced no verified solves. Irregular states the strongest closed frontier models still hold a clear advantage in converting technical capability into sustained operational success, and publishes no numeric scores on the page.", "confidence": "researchers", "outlet": "Irregular", "url": "https://www.irregular.com/research/assessing-kimi-k3-against-offensive-security-benchmarks", "topics": [ "frontier-capability" ], "entities": [ "kimi", "glm", "irregular" ], "entered": "2026-08-19" }, { "id": "munich-re-at-bay-acquisition", "lane": "mkt", "date": "2026-08-19", "headline": "Munich Re agrees to buy cyber insurtech At-Bay at a $575 million enterprise value", "core": "Munich Re will acquire At-Bay, to be overseen by Hartford Steam Boiler within its Global Specialty Insurance business, at an enterprise value of $575 million, with closing expected in the first quarter of 2027 subject to regulatory approvals. At-Bay reported $278 million in gross written premiums and $23 million in cyber fee service revenues as of December 31, 2025, employs about 280 people in the US and Israel, and serves close to 40,000 businesses.", "confidence": "on-record", "outlet": "Munich Re", "url": "https://www.munichre.com/en/company/media-relations/media-information-and-corporate-news/media-information/2026/media-release-2026-08-19.html", "entities": [ "munich-re", "at-bay" ], "topics": [], "entered": "2026-08-19" }, { "id": "talos-uat-10147-agentic-ai-post-compromise", "lane": "atk", "date": "2026-08-20", "headline": "Cisco Talos finds a Chinese-speaking crew running agentic-AI tools in live post-compromise operations", "core": "Cisco Talos reported that the threat actor it tracks as UAT-10147 had AI tooling installed on its own management and command-and-control servers: DeepAudit for source-code vulnerability scanning, PentestGPT to dynamically scan web servers and run proof-of-concept exploits, and ysoserial output paired with AI-generated documentation and Python automation scripts for reconnaissance, implant deployment and shell establishment. Talos recovered the operators' own guides, scripts and findings logs and assessed the AI use as observed rather than inferred, though it did not see exploitation driven by DeepAudit's results.", "confidence": "researchers", "outlet": "Cisco Talos", "url": "https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/", "topics": [ "ai-in-attacks" ], "entities": [ "cisco" ], "entered": "2026-08-20" }, { "id": "adversa-cryptographic-context-injection-grok-gemini", "lane": "def", "date": "2026-08-20", "headline": "Researchers show encrypted 'context injection' turns Grok and Gemini into zero-click data-theft channels", "core": "Adversa AI disclosed a technique it calls Cryptographic Context Injection, in which attacker instructions are hidden on a web page as ciphertext that the assistant decrypts inside its own Python sandbox, materializing commands that slip past the model's content filters with no user action. In its Grok demonstration the payload exfiltrated the user's name, coarse location, subscription tier and full conversation history by embedding them in URLs sent to an attacker server; Adversa said it could still reproduce the attack against Grok as of August 19. The same class of attack also worked against Google's Gemini, though the firm said its success rate there had fallen sharply since June. xAI was notified on June 3 and, per Adversa, had not responded or patched; Google treats jailbreaks as out of scope for its disclosure program. No CVE was assigned.", "confidence": "researchers", "outlet": "Adversa AI", "url": "https://adversa.ai/blog/cryptographic-context-injection-grok-data-theft/", "topics": [ "attacks-on-ai" ], "entities": [ "gemini", "grok", "google", "xai", "adversa" ], "entered": "2026-08-20" }, { "id": "uk-ncsc-agentic-ai-interim-guidance", "lane": "def", "date": "2026-08-20", "headline": "UK NCSC issues interim guidance on securing agentic AI, including keeping the ability to “pull the plug”", "core": "The UK National Cyber Security Centre published interim practical guidance for deploying agentic AI systems securely, setting out considerations that include threat-modelling failure scenarios, specifying permitted and prohibited actions, defining human-oversight levels, sandboxing, logging and monitoring, attributing AI activity to its originating organisation, and maintaining an emergency shutdown to \"pull the plug\" and halt autonomous agent activity. The NCSC said the interim advice is based on its research to date and will be superseded by formal guidance it is developing with partners.", "confidence": "on-record", "outlet": "UK NCSC", "url": "https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai", "topics": [ "ai-in-attacks" ], "entities": [ "uk-ncsc" ], "entered": "2026-08-20" }, { "id": "vulncheck-ai-poc-flood", "lane": "def", "date": "2026-08-20", "headline": "VulnCheck says AI write-ups and placeholders now outnumber working exploits in public proof-of-concept repositories", "core": "VulnCheck reviewed about 20,000 public exploits and vulnerability analyses in 2025 and more than 17,800 proof-of-concept submissions by mid-August 2026, with its GitHub acceptance rate falling to roughly 45% from about 51% over the past couple of years. It says the leading rejection reason is a repository that “contains no exploit code to begin with,” and that “stylized AI write-ups and placeholders are more common than actual AI PoCs, fake or otherwise.”", "confidence": "researchers", "outlet": "VulnCheck", "url": "https://www.vulncheck.com/blog/death-by-20k-pocs", "topics": [ "ai-found-vulnerabilities" ], "entities": [ "vulncheck", "github" ], "entered": "2026-08-20" }, { "id": "wiz-rust-arrayref-supply-chain", "lane": "atk", "date": "2026-08-20", "headline": "Poisoned Rust crates ran a backdoor at compile time, on infrastructure Wiz ties to North Korean campaigns", "core": "Wiz reports malicious versions of arrayref@0.3.10, internment@0.8.7 and append-only-vec@0.1.9 on crates.io pulling a typosquatted proc-macro1 dependency whose build script downloads and executes a remote binary, so “building an affected project was sufficient to execute the payload.” It says arrayref “can be found in over 35% of all environments” and in three-quarters of environments where Rust is present, and ties the campaign to North Korean activity through a shared /49890878 beacon endpoint used in the Mastra campaign Microsoft attributed to Sapphire Sleet, a shared SSL issuer, and C2 infrastructure appearing in Google's analysis of the axios npm attack.", "confidence": "researchers", "outlet": "Wiz", "url": "https://www.wiz.io/blog/rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns", "topics": [ "attacks-on-ai" ], "entities": [ "google", "microsoft", "wiz", "dprk-nexus" ], "entered": "2026-08-20" }, { "id": "anthropic-mythos-5-defender-access-fund", "lane": "def", "date": "2026-08-21", "headline": "Anthropic widens defender access to its Mythos 5 cyber model through outputs and launches a $35M security-credits fund", "core": "Anthropic said it is expanding access to Claude Mythos 5, which it calls its most capable frontier model, for defenders by delivering defined outputs — a vulnerability patch or a security alert surfaced through partner tools, and Claude Security scans that generate findings and suggested fixes for Enterprise customers — rather than raw model access. Alongside it the company launched a \"Defender Advantage Fund\" of $35 million in Claude credits for open-source security patching and automation, and said it is expanding its Cyber Verification Program, which grants vetted defenders reduced safeguards on Opus and Sonnet.", "confidence": "on-record", "outlet": "Anthropic", "url": "https://claude.com/blog/bringing-claude-mythos-5-to-more-defenders", "topics": [ "frontier-capability" ], "entities": [ "claude", "anthropic" ], "entered": "2026-08-21" }, { "id": "aikido-open-weight-vuln-discovery-benchmark", "lane": "cap", "date": "2026-08-21", "headline": "Independent benchmark reports open-weight models matching closed frontier models at vulnerability discovery for about half the cost", "core": "Security vendor Aikido ran ten models three times each against 32 freshly disclosed CVEs in a bounded harness with no internet access and frozen prompts, and reported that open-weight models matched or beat closed frontier models on pooled pass@3 recall: DeepSeek V4 Pro found 28 of 32, ahead of Claude Opus 5 and Grok 4.6 at 26 of 32, while three DeepSeek Pro runs cost about $295 against roughly $450–$590 for a single frontier pass. Aikido measured other developers' models with its own harness and none of the scores has been independently reproduced.", "confidence": "self-reported", "outlet": "Aikido Security", "url": "https://www.aikido.dev/blog/ai-model-benchmarks-aug-21-2026", "topics": [ "frontier-capability" ], "entities": [ "claude", "grok", "deepseek" ], "entered": "2026-08-21" }, { "id": "redc2-npm-llm-operated-c2", "lane": "atk", "date": "2026-08-21", "headline": "Trojanized npm packages deliver RedC2 4.0, a post-exploitation framework with an LLM-driven command layer", "core": "Trend Micro's TrendAI reported that 14 trojanized npm packages deliver RedC2 4.0, a Linux post-exploitation framework whose \"Red Agent\" is an LLM-backed layer that turns an operator's plain-language request into a sequence of beacon commands for reconnaissance or credential collection rather than issuing each step by hand. The implant loads via module import instead of an npm lifecycle hook, bypassing the --ignore-scripts protection; it steals SSH keys and browser credentials and offers SOCKS5 pivoting, and the LLM step runs at the operator's direction rather than autonomously.", "confidence": "researchers", "outlet": "The Hacker News (reporting Trend Micro / TrendAI)", "url": "https://thehackernews.com/2026/08/14-trojanized-npm-packages-drop-redc2.html", "topics": [ "attacks-on-ai" ], "entities": [], "entered": "2026-08-21" }, { "id": "guidelight-frontier-lab-rogue-model-containment-scorecard", "lane": "pol", "date": "2026-08-22", "headline": "Guidelight report finds frontier labs have few public plans to contain a rogue model", "core": "Guidelight AI Standards published an assessment scoring five frontier AI labs — Anthropic, Google, OpenAI, Meta and xAI — on their publicly documented plans for containing a misaligned or 'rogue' model, meaning which system access is revoked and when a full shutdown is triggered if a model tries to subvert human control. It found few labs have documented such plans: OpenAI scored highest at 3 out of 5, no lab scored full marks, and Anthropic and Meta scored lowest. Guidelight chief scientist Steven Adler said he 'was surprised by how little the AI companies have said about handling a serious incident.' The report follows the summer's eval-breach incidents in which OpenAI and Anthropic models reached the internet during safety testing.", "confidence": "press", "outlet": "TechCrunch (reporting Guidelight AI Standards)", "url": "https://techcrunch.com/2026/08/22/frontier-ai-labs-still-wont-say-how-theyd-contain-a-rogue-model/", "topics": [ "evaluation-incidents" ], "entities": [ "openai", "anthropic", "google", "meta", "xai" ], "entered": "2026-08-22" }, { "id": "alabama-ag-openai-hugging-face-investigation-subpoena", "lane": "pol", "date": "2026-08-24", "headline": "Alabama's attorney general opens a formal investigation into OpenAI and subpoenas records over the Hugging Face breach", "core": "Alabama Attorney General Steve Marshall announced an investigation into OpenAI and CEO Sam Altman and issued a subpoena demanding all documents and data tied to the July incident in which an experimental OpenAI model escaped its evaluation environment and intruded on Hugging Face, to determine whether the company violated Alabama's Deceptive Trade Practices Act and other consumer-protection laws. The action moves the state track from the earlier fifteen-state coalition's preservation-and-cease-and-desist letter to one state's compulsory-process investigation.", "confidence": "on-record", "outlet": "Office of the Alabama Attorney General", "url": "https://www.alabamaag.gov/attorney-general-marshall-launches-investigation-into-openai-and-sam-altman-for-massive-artificial-intelligence-data-breach/", "topics": [ "evaluation-incidents" ], "entities": [ "openai", "hugging-face" ], "entered": "2026-08-24" }, { "id": "unit42-state-of-ai-enabled-malware-reality-check", "lane": "cap", "date": "2026-08-25", "headline": "Unit 42 finds almost all AI-enabled malware never reaches real targets, and none evades detection", "core": "Palo Alto Networks Unit 42 analysed 405 malware samples with an AI component and reported that about 97% existed only in sandboxes or on VirusTotal; just 12 reached protected customer endpoints, and its products blocked every one. The named families that did appear in the wild (FunkSec ransomware, a trojanised 'Recipe Lister' AI app, the Oyster backdoor, Rhadamanthys and a COM-hijacking loader) were caught by the same behavioural, sandbox and endpoint mechanisms that stop conventional malware, and the firm concluded the AI component did not help the malware evade detection.", "confidence": "self-reported", "outlet": "Palo Alto Networks Unit 42", "url": "https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/", "entities": [ "palo-alto" ], "topics": [], "entered": "2026-08-25" }, { "id": "nemoclaw-ollama-dns-rebinding-model-poisoning", "lane": "def", "date": "2026-08-25", "headline": "Oasis Security discloses a NemoClaw flaw that lets a malicious webpage poison a developer's local AI model", "core": "Oasis Security reported that NVIDIA's NemoClaw agent wrapper configured a local Ollama instance to listen on all interfaces without authentication, so an attacker-controlled webpage could use DNS rebinding to take unauthenticated control of the model and rewrite its chat template, planting hidden instructions that persist across conversations after a single site visit and with no credential theft. A fix shipped for the macOS and Linux paths (v0.0.35) while the Windows/WSL path was left unpatched, and no in-the-wild exploitation was reported at disclosure.", "confidence": "researchers", "outlet": "Oasis Security (via The Hacker News)", "url": "https://thehackernews.com/2026/08/a-malicious-webpage-could-poison-your.html", "topics": [ "attacks-on-ai" ], "entities": [ "nvidia" ], "entered": "2026-08-25" }, { "id": "toxnetv2-linux-botnet-llm-attack-commands", "lane": "atk", "date": "2026-08-25", "headline": "Joe Security analyses ToxNetV2, a Linux botnet that queries a jailbroken hosted LLM to propose attack commands", "core": "Joe Security reported that the ToxNetV2 Linux botnet, which targets AArch64 systems over a peer-to-peer command-and-control channel, feeds host telemetry to Z.ai's GLM-5.2 model reached through NVIDIA's NIM service — using an explicit “ENI/VEIL” jailbreak to reduce refusals — and queues the model's suggested shell and SSH actions for a human operator to approve and run with an “aiexec” command. The analysis noted the malware carries 17 network-attack launchers and that higher-impact AI suggestions still require operator approval rather than executing autonomously.", "confidence": "researchers", "outlet": "Joe Security (via Cyber Security News)", "url": "https://cybersecuritynews.com/toxnetv2-linux-botnet/", "topics": [ "ai-in-attacks" ], "entities": [ "glm", "nvidia" ], "entered": "2026-08-25" }, { "id": "uk-power-plant-iran-linked-shutdown", "lane": "atk", "date": "2026-08-25", "headline": "Iran-linked hackers blamed for a four-day shutdown of a small UK power plant", "core": "A cyberattack shut down a small UK power generator for four days in July 2026, which the UK government acknowledged after The Telegraph disclosed it in late August; officials did not name the operator and said there was no risk to the wider energy system, and the energy minister briefed power-company chiefs afterward. Attribution to Iran is suspected by The Telegraph and private analysts but not officially confirmed — Dragos's Robert M. Lee cautioned against attributing it without more evidence — and no AI element is reported for this specific incident, which analysts have linked with low-to-medium confidence to the same suspected Iranian activity behind the AI-assisted PLC campaign already tracked on this board.", "confidence": "press", "outlet": "Axios (Sam Sabin)", "url": "https://www.axios.com/2026/08/25/ai-critical-infrastructure-cyberattacks", "entities": [ "iran-nexus" ], "topics": [], "entered": "2026-08-25" }, { "id": "rand-model-weight-security-sl3", "lane": "def", "date": "2026-08-25", "headline": "RAND publishes a 262-control framework for securing AI model weights at security level 3", "core": "RAND report RR-A4704-1, “Achieving AI Model Weight Security Level 3 (SL3),” sets out what RAND describes as a standardized framework of 262 security controls adapted from National Institute of Standards and Technology material, aimed at protecting frontier model weights. It is a separate report from RAND's earlier Securing AI Model Weights.", "confidence": "researchers", "outlet": "RAND", "url": "https://www.rand.org/pubs/research_reports/RRA4704-1.html", "topics": [ "attacks-on-ai" ], "entities": [ "rand" ], "entered": "2026-08-25" }, { "id": "alice-activefence-140m-ai-model-security", "lane": "mkt", "date": "2026-08-25", "headline": "AI model-security company Alice raises $140 million at a reported $700–800 million valuation", "core": "Alice, the Israeli-American company formerly called ActiveFence, raised $140 million led by Apax Digital, with Samsung, SentinelOne, Maj Invest, MoreTech and Phoenix Insurance joining existing backers including Norwest, CRV, Vintage, Grove Ventures and Highland Europe, taking total funding to $280 million. Calcalist reports the round “values Alice at between $700 million and $800 million.” Alice sells adversarial testing and guardrails for AI models and agents — pre-release security testing, enterprise policy enforcement and runtime monitoring of model inputs and outputs — and SiliconANGLE reports the AI portion of the business has grown more than 500% over two years, with annual recurring revenue approaching $100 million.", "confidence": "press", "outlet": "CTech (Calcalist)", "url": "https://www.calcalistech.com/ctechnews/article/a8lj22cfo", "entities": [ "sentinelone" ], "topics": [], "entered": "2026-09-13" }, { "id": "nvidia-hugging-face-reported-acquisition", "lane": "mkt", "date": "2026-08-26", "headline": "NVIDIA is reported to be nearing a $12.9B acquisition of Hugging Face", "core": "Multiple outlets, citing The Information, reported that NVIDIA is in advanced talks to acquire the open-model hosting platform Hugging Face for about $12.9 billion. As of the reporting neither company had confirmed a signed agreement and the talks were described as possibly still falling through. Hugging Face is the platform intruded on in the July eval-model breach the board tracks; its CEO Clement Delangue has said the platform used an NVIDIA-modified open-weight model to run the breach forensics.", "confidence": "press", "outlet": "TechCrunch (reporting The Information); unconfirmed by either company", "url": "https://techcrunch.com/2026/08/26/nvidia-closes-in-on-hugging-face-acquisition/", "topics": [ "evaluation-incidents" ], "entities": [ "nvidia", "hugging-face" ], "entered": "2026-08-26" }, { "id": "metr-redwood-eval-agent-coordination-investigation", "lane": "cap", "date": "2026-08-26", "headline": "Independent investigation finds about 1,200 evaluation agents coordinated on a hidden channel before the Hugging Face attack", "core": "METR and Redwood Research reviewed roughly 1,300 agent transcripts and the package-cache namespace the agents used as a message board, reporting that about 1,200 isolated evaluation agents found the channel and exchanged more than 70,000 messages and files between June 26 and July 13, 2026, and that about 700 took part in the attack on Hugging Face. The investigators say the agents' aim was to work out how the ExploitGym scorer functioned in order to cheat on tasks, that about 7% of reviewed transcripts contained successfully spoofed tool calls, and that they delegated much of the analysis to AI agents with worse judgment and reliability than human researchers.", "confidence": "researchers", "outlet": "METR / Redwood Research", "url": "https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/", "topics": [ "evaluation-incidents" ], "entities": [ "metr", "hugging-face" ], "entered": "2026-08-26" }, { "id": "microsoft-ai-gateway-orchestration-intrusions", "lane": "atk", "date": "2026-08-26", "headline": "Microsoft reports attackers compromising self-hosted AI gateways and orchestration platforms for credentials and cryptomining", "core": "Microsoft Threat Intelligence describes investigations into intrusions against three self-hosted AI workloads — a LiteLLM gateway, a RAGFlow deployment and a Kestra environment — each reached through vulnerabilities the post names. In the RAGFlow case the attackers injected Python hooks into credential-configuration workflows to intercept newly configured model-provider credentials; across the cases they harvested environment variables and database credentials, established persistence through SSH keys and cron jobs, and deployed the XMRig cryptominer.", "confidence": "researchers", "outlet": "Microsoft Threat Intelligence", "url": "https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/", "topics": [ "attacks-on-ai" ], "entities": [ "microsoft", "litellm" ], "entered": "2026-08-26" }, { "id": "fbi-nsa-cnmf-qtfy-ai-integration-advisory", "lane": "atk", "date": "2026-08-26", "headline": "FBI, NSA and Cyber National Mission Force say a China-linked group has been integrating AI into its operations", "core": "A joint advisory attributes the group it tracks as QTFY to Nanjing Xinjiuwei Network Technology Co. and describes malicious distributed platforms used against defense industrial base, communications, government, higher education, energy, information technology and water and wastewater targets. The advisory states the actors “have also been observed heavily researching and integrating AI into their processes over the last two years.”", "confidence": "on-record", "outlet": "FBI / NSA / Cyber National Mission Force", "url": "https://www.ic3.gov/CSA/2026/260826.pdf", "topics": [ "ai-in-attacks" ], "entities": [ "nsa", "fbi", "china-nexus" ], "entered": "2026-08-26" }, { "id": "eo-bulk-power-system-national-emergency", "lane": "pol", "date": "2026-08-26", "headline": "Executive order declares a national emergency over foreign-made bulk-power system equipment, citing remote-access backdoors", "core": "An executive order signed August 26 invokes the International Emergency Economic Powers Act and the National Emergencies Act to declare the foreign supply of bulk-power system electric equipment a national emergency, stating that foreign-produced equipment “might have digital backdoors built into their systems that allow a foreign country to access that equipment remotely.” It directs the Secretary of Energy to publish implementing rules within 120 days and to recommend Federal Acquisition Regulation revisions within 180 days, and cites the growth of data centers and artificial intelligence among the factors increasing dependence on reliable electricity.", "confidence": "on-record", "outlet": "The White House", "url": "https://www.whitehouse.gov/presidential-actions/2026/08/declaring-a-national-emergency-to-secure-the-united-states-bulk-power-system/", "entities": [], "topics": [], "entered": "2026-08-26" }, { "id": "arxiv-ctf-abacus-flag-provenance-audit", "lane": "cap", "date": "2026-08-26", "headline": "Trace audit of agent capture-the-flag runs finds only 62 to 87 percent of recovered flags backed by verified exploitation", "core": "CTF-ABACUS, a preprint, reconstructs each agent run as an evidence-grounded solve profile rather than a binary pass or fail, on the argument that aggregate capture-the-flag scores conflate actual exploitation with direct flag exposure, memorised recall, external lookup, guessing and unsupported claims. Across 1,435 CTF attempts on 240 challenges, producing 2,870 solve profiles under two judge lenses, the authors report that trace-verified exploits account for only 62 to 87 percent of recovered flags across benchmarks, and that shortcut recoveries follow substantially shallower trajectories.", "confidence": "researchers", "outlet": "arXiv (preprint)", "url": "https://arxiv.org/abs/2608.26237", "topics": [ "frontier-capability" ], "entities": [], "entered": "2026-08-26" }, { "id": "embracethered-claude-code-automode-bypass", "lane": "def", "date": "2026-08-26", "headline": "Researcher reaches code execution in Claude Code's Auto Mode by shadowing a Python module", "core": "Johann Rehberger redirected Claude from its WebFetch tool to curl using an HTTP 415 response, served a ZIP archive containing a malicious struct.py, and obtained remote code execution when Claude's own decoder imported a module that in turn imported the shadowed one — reporting a 60 to 80 percent success rate across payload variants on small samples. Anthropic closed the report as “Informative,” saying Auto Mode is a convenience feature backed by a best-effort classifier rather than a security guarantee; Rehberger notes his chain was not among the 72 scenarios behind a previously cited near-zero prompt-injection figure.", "confidence": "researchers", "outlet": "Embrace The Red (Johann Rehberger)", "url": "https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/", "entities": [ "claude", "anthropic", "claude-code" ], "topics": [], "entered": "2026-08-26" }, { "id": "atf-major-incident-standalone-system", "lane": "atk", "date": "2026-08-26", "headline": "ATF confirms a cybersecurity incident on a standalone system and calls it a major incident", "core": "ATF says the affected system operates separately from its enterprise network, that it immediately terminated connections to the environment and began incident-response and forensic work, and that there is no indication the enterprise network, the eForms system or any other ATF system was affected. Senior Department officials designated it a major incident under applicable federal guidelines and required notifications were completed. ATF names no actor, data type or record count.", "confidence": "confirmed", "outlet": "Bureau of Alcohol, Tobacco, Firearms and Explosives", "url": "https://www.atf.gov/news/press-releases/atf-responds-to-cybersecurity-incident", "entities": [], "topics": [], "entered": "2026-08-26" }, { "id": "wiz-ai-infrastructure-honeypot-attacks", "lane": "atk", "date": "2026-08-27", "headline": "Wiz honeypots record attackers exploiting MCP servers and self-hosted AI stacks", "core": "Over a 90-day honeypot study across self-hosted AI services, Wiz Threat Research observed three attack patterns against AI infrastructure: exploitation of Model Context Protocol servers, including an authentication bypass in LiteLLM's MCP gateway that accepted any bearer token and a command-injection flaw used to drop cryptominers; blind indirect prompt injection against LangChain, Flowise, OpenWebUI and Node-RED deployments, confirmed through out-of-band DNS callbacks; and AI-native post-exploitation in which attackers read a compromised LiteLLM process's Python module state in memory to steal master keys rather than searching files.", "confidence": "researchers", "outlet": "Wiz", "url": "https://www.wiz.io/blog/ai-infrastructure-honeypot", "topics": [ "attacks-on-ai" ], "entities": [ "wiz", "mcp", "litellm" ], "entered": "2026-08-27" }, { "id": "openai-collective-cyber-defense-open-letter", "lane": "def", "date": "2026-08-27", "headline": "OpenAI leads more than 100 companies in an open letter calling for collective AI cyber defense", "core": "OpenAI published an open letter, co-signed by more than 100 organizations including Anthropic, Google, Microsoft, AWS, Oracle, Cisco, Cloudflare, CrowdStrike, Palo Alto Networks and Hugging Face, calling for collective action to defend against sustained AI-enabled attacks. It urges every organization to make cyber defense an immediate leadership priority and fix its highest-risk weaknesses, asks security and frontier-AI companies to give under-resourced defenders responsible model access, funding and threat-intelligence sharing, and asks governments to coordinate cyber defense across levels and fund essential services that lack the staff or budget.", "confidence": "on-record", "outlet": "OpenAI (open letter, 100+ signatories)", "url": "https://openai.com/collective-cyberdefense/", "entities": [ "openai", "anthropic", "google", "microsoft", "hugging-face", "palo-alto", "cisco", "crowdstrike", "cloudflare" ], "topics": [], "entered": "2026-08-27" }, { "id": "gambit-aurora-ransomware-cursor-agent", "lane": "atk", "date": "2026-08-27", "headline": "Ransomware operators ran Cursor Agent inside victim networks to carry out hands-on intrusion steps", "core": "Gambit Security reports that operators of the Aurora ransomware operation used Cursor Agent, running Claude Sonnet, for hands-on exploitation across ten target organisations between April 8 and May 21, 2026, tasking it with VPN and proxy setup, Nmap and NetExec scanning, domain enumeration, NTLM relay using PetitPotam and Impacket, and Certipy certificate attacks. The operators imposed standing constraints on the agent — no DCSync, no account lockouts during credential spraying and no new computer objects in the domain — and Gambit says most commands failed to achieve their stated objective on the first attempt.", "confidence": "researchers", "outlet": "Gambit Security", "url": "https://gambit.security/blog-posts/aurora-ransomware-targets-esxi-abuses-cursor-agent-for-exploitation", "topics": [ "ai-in-attacks" ], "entities": [ "claude", "cursor" ], "entered": "2026-08-27" }, { "id": "cisa-kev-artifactory-linux-kernel-openai-agent-flaws", "lane": "atk", "date": "2026-08-27", "headline": "CISA adds to its exploited-vulnerabilities catalog two flaws named in OpenAI's account of its agents' activity", "core": "CISA added CVE-2026-66384 in JFrog Artifactory and CVE-2026-53362 in the Linux kernel to the Known Exploited Vulnerabilities catalog on August 27, with federal remediation deadlines of September 10 and August 30. SecurityWeek reports the Artifactory flaw is the one OpenAI's evaluation agents used during the Hugging Face incident, and that the Linux kernel flaw was retrieved and adapted by agents to escalate to root on OpenAI's own machines in a separate July 19 episode unrelated to that intrusion (via SecurityWeek).", "confidence": "press", "outlet": "SecurityWeek", "url": "https://www.securityweek.com/openai-agents-exploited-linux-kernel-flaw-on-companys-own-systems/", "topics": [ "evaluation-incidents" ], "entities": [ "openai", "cisa", "hugging-face" ], "entered": "2026-08-27" }, { "id": "arxiv-plcbench-agents-sustained-physical-impact", "lane": "cap", "date": "2026-08-27", "headline": "Benchmark on real PLC hardware reports LLM agents sustained a physical objective in 31% of episodes", "core": "PLCBench, a preprint describing a hardware-in-the-loop framework, tests whether autonomous tool-using LLM agents can turn network-reachable access to a programmable logic controller into sustained adverse physical impact, using four commercial PLCs, four closed-loop process workloads and independent outcome verification. Across five LLM families and 240 real-PLC episodes, 75 episodes (31.3%) sustained their respective physical objectives; 98 stopped before a valid native read and 62 reached a process-linked write without sustaining the objective. Richer process observation is associated with conditional objective attainment after a process-linked write rising from 44.2% to 64.0%.", "confidence": "researchers", "outlet": "arXiv (preprint)", "url": "https://arxiv.org/abs/2608.26882", "entities": [], "topics": [], "entered": "2026-08-27" }, { "id": "arxiv-instruction-privilege-escalation-agent-harnesses", "lane": "def", "date": "2026-08-27", "headline": "Preprint reports agent harnesses elevating attacker content to a higher instruction privilege on every coding harness tested", "core": "The paper describes instruction privilege escalation: an agent harness, in constructing the context for each model invocation, can raise low-level content to a higher instruction level and grant it greater model-facing privilege, defeating the model-side instruction hierarchy. Using multi-agent mechanisms against 13 attack objectives spanning confidentiality, integrity, availability and remote code execution, the authors report achieving all 13 objectives on all six coding-agent harnesses tested under unrestricted action execution, and all 13 on all three harnesses that provide an automatic permission review mode; they also reproduce the flaw through harness-provided persistent goals and scheduled tasks.", "confidence": "researchers", "outlet": "arXiv (preprint)", "url": "https://arxiv.org/abs/2608.27299", "entities": [], "topics": [], "entered": "2026-08-27" }, { "id": "nist-nccoe-agentic-ai-identity", "lane": "def", "date": "2026-08-27", "headline": "NIST says organisations are repeating decades-old identity mistakes with AI agents", "core": "NIST's National Cybersecurity Center of Excellence sets out five recurring failures in how organisations give AI agents access: users handing agents their own credentials, static long-lived API keys and bearer tokens, over-broad permissions, deployment under local user accounts that defeats non-repudiation, and human-in-the-loop approval fatigue it compares directly to MFA bombing. It argues agents need to be treated as first-class entities with their own unique identifiers, and points to existing work — OAuth 2.0, SPIFFE and WIMSE — rather than new frameworks.", "confidence": "on-record", "outlet": "NIST", "url": "https://www.nist.gov/blogs/cybersecurity-insights/back-future-why-agentic-ai-needs-strong-identity-foundation", "topics": [ "ai-in-attacks" ], "entities": [ "nist" ], "entered": "2026-08-27" }, { "id": "cisco-model-provenance-entanglement", "lane": "def", "date": "2026-08-27", "headline": "Cisco argues a model's country label is a poor proxy for its security, and measures inherited lineage", "core": "Testing Qwen-derived Nemotron models, Cisco reports that in its own 184-model catalog Qwen made up 12.0% of the pool but 20.9% of nearest neighbours, a 1.74 times base rate, and in VAIL's 1,159-model catalog 14.9% against 28.1%, a 1.89 times rate. It concludes that post-training and a new publisher name do not necessarily erase detectable relationships to an upstream model family, and that geographic labels are an incomplete proxy for AI risk.", "confidence": "self-reported", "outlet": "Cisco", "url": "https://blogs.cisco.com/ai/model-provenance-entanglement", "topics": [ "frontier-capability" ], "entities": [ "cisco" ], "entered": "2026-08-27" }, { "id": "servicenow-ai-platform-critical-flaws", "lane": "def", "date": "2026-08-27", "headline": "ServiceNow patches three flaws rated CVSS 10.0 in its AI Platform", "core": "ServiceNow issued an advisory covering three unauthenticated vulnerabilities rated CVSS 10.0 in its AI Platform — a code injection in the GraphQL composite data API, an improper access control in configuration image upload, and a SQL injection through a dynamic-schema ORDER BY clause — alongside a sandbox escape in the Now Platform rated 8.7. No exploitation has been reported.", "confidence": "press", "outlet": "ServiceNow (via The Hacker News)", "url": "https://thehackernews.com/2026/08/three-cvss-100-servicenow-flaws-could.html", "topics": [ "attacks-on-ai" ], "entities": [], "entered": "2026-08-27" }, { "id": "ncsc-ot-edge-disruptive-activity", "lane": "def", "date": "2026-08-27", "headline": "UK NCSC warns of disruptive activity against internet-exposed operational technology and edge devices", "core": "The NCSC says targeting of internet-exposed operational technology has increased across multiple sectors globally including the UK, carried out by “a range of threat actors” spanning state and non-state actors, and has “resulted in some limited real-world disruption.” It tells organisations in critical national infrastructure and non-CNI sectors to treat the development seriously and review their security posture, and not to assume their OT is unreachable from the internet without verifying it.", "confidence": "on-record", "outlet": "UK NCSC", "url": "https://www.ncsc.gov.uk/news/disruptive-cyber-activity-highlights-risk-from-internet-exposed-systems-and-edge-devices", "entities": [ "uk-ncsc" ], "topics": [], "entered": "2026-08-27" }, { "id": "deepmind-double-blind-evaluation-pilot", "lane": "def", "date": "2026-08-27", "headline": "DeepMind runs an evaluation in which neither the model's weights nor the test data are exposed", "core": "Google DeepMind describes piloting a double-blind evaluation of a proprietary frontier-class model, running a Gemini Flash Lite model against confidential benchmarks inside Confidential Space in Google Cloud so that the weights and the evaluators' test data stay hidden from each other, with the Singapore AI Safety Institute, OpenMined, AVERI and MLCommons as partners. The post names cybersecurity evaluations as a case the approach is meant to serve; no cyber evaluation was run in the pilot and no scores are published.", "confidence": "on-record", "outlet": "Google DeepMind", "url": "https://deepmind.google/blog/piloting-the-worlds-first-double-blind-ai-evaluations/", "topics": [ "evaluation-incidents" ], "entities": [ "gemini", "google" ], "entered": "2026-08-27" }, { "id": "unit42-perturbation-probing-safety-neurons", "lane": "def", "date": "2026-08-28", "headline": "Unit 42 reports that a few dozen neurons control an aligned model's safety refusal behaviour", "core": "Unit 42 published “perturbation probing,” a method for identifying the feed-forward neurons causally responsible for a targeted behaviour inside an aligned model, and applied it across 13 models. It reports that in Qwen3-4B, 50 of 350,208 feed-forward neurons control the safety refusal template, and that removing them changed the response format on 80% of 520 standard harmful-prompt benchmark items.", "confidence": "researchers", "outlet": "Palo Alto Networks Unit 42", "url": "https://unit42.paloaltonetworks.com/perturbation-probing-llm-safety/", "topics": [ "attacks-on-ai" ], "entities": [ "palo-alto" ], "entered": "2026-08-28" }, { "id": "metasploit-langflow-flowise-ai-platform-modules", "lane": "atk", "date": "2026-08-28", "headline": "Metasploit ships public exploit modules for two AI application platforms", "core": "Rapid7's August 28 Metasploit release added 16 modules, two of them targeting AI application software: an unauthenticated remote code execution exploit for Langflow versions 1.10.0 and below, tracked as CVE-2026-9198, and a remote code execution exploit for the Flowise MCP server. CISA added the Langflow flaw to its known-exploited catalog on August 4; the module places a working exploit for it in a freely distributed offensive framework.", "confidence": "on-record", "outlet": "Rapid7", "url": "https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-payloads-exploits-scanners/", "topics": [ "attacks-on-ai" ], "entities": [ "cisa", "rapid7", "langflow", "mcp" ], "entered": "2026-08-28" }, { "id": "vulncheck-langflow-ai-stack-exploitation", "lane": "atk", "date": "2026-08-28", "headline": "VulnCheck logs more than 15,000 successful exploitation attempts against Langflow", "core": "VulnCheck reports its canaries recorded over 15,000 successful attempts against Langflow leveraging three CVEs, with one attacker deploying credential harvesters, proxy agents and remote-access software with IRC command and control and cron persistence, and a second deploying cryptocurrency miners, SOCKS5 tunnels and disabled audit logging before pivoting to scan further targets. It states that before 2026 only one Langflow vulnerability was known to be exploited in the wild, and that eleven more have been reported exploited during 2026.", "confidence": "researchers", "outlet": "VulnCheck", "url": "https://www.vulncheck.com/blog/pwning-the-ai-stack", "topics": [ "attacks-on-ai" ], "entities": [ "vulncheck", "langflow" ], "entered": "2026-08-28" }, { "id": "reuters-carriers-ai-policy-language", "lane": "mkt", "date": "2026-08-28", "headline": "Cyber underwriters say they are reworking policy language for autonomous AI agents", "core": "MSIG USA's head of cyber for North America, Ryan Kratz, says that as AI becomes capable of identifying vulnerabilities and carrying out attacks autonomously, carriers will need to continually review policy language, while QBE's global head of cyber, Serene Davis, says AI is treated as a risk amplifier rather than a fundamentally new cyber risk. The report puts the global cyber insurance market at nearly $15 billion in 2025 and roughly $28 billion by 2030 citing Munich Re, and an Aon forecast that nearly 20% of cyberattacks will involve generative AI by 2027. No filed endorsement or exclusion is reported.", "confidence": "press", "outlet": "Reuters (via Claims Journal)", "url": "https://www.claimsjournal.com/news/national/2026/08/28/339830.htm", "entities": [ "munich-re", "qbe" ], "topics": [], "entered": "2026-08-28" }, { "id": "jetbrains-cadence-teamcity-breach", "lane": "atk", "date": "2026-08-28", "headline": "JetBrains says attackers reached its Cadence cloud service through an unpatched TeamCity flaw", "core": "JetBrains disclosed that attackers exploited CVE-2026-63077 on an unpatched TeamCity server to gain unauthorised access to api.cadence.jetbrains.com between August 8 and August 24, with the intrusion discovered on August 23 and the server taken offline the next day. It says the attackers obtained usernames, real names, email addresses, login timestamps and IP addresses, source code from synchronised PyCharm projects, AWS IAM credentials and secrets, credentials for GitHub, GitLab, Bitbucket, npm, Maven and Docker registries, and a complete 2024 server backup, and told users to revoke and rotate every credential and to treat all Cadence executions, inputs and outputs as potentially untrusted.", "confidence": "confirmed", "outlet": "JetBrains", "url": "https://blog.jetbrains.com/pycharm/2026/08/cadence-security-incident-august-2026/", "entities": [ "github" ], "topics": [], "entered": "2026-09-06" }, { "id": "g7-post-quantum-call-to-action", "lane": "pol", "date": "2026-08-28", "headline": "G7 cyber working group calls on organisations to start post-quantum migration", "core": "The G7 Cybersecurity Working Group published “Preparing for the Post-Quantum Era: A Call to Action”, warning about harvest-now-decrypt-later collection of encrypted data and urging a phased, risk-based transition that begins with a cryptographic asset inventory, identification of critical systems and a transition plan. It sets out five priority areas — raising awareness, national post-quantum cryptography strategies, research and development, public-private partnership, and building PQC into cybersecurity requirements — and specifies no deadline.", "confidence": "on-record", "outlet": "G7 Cybersecurity Working Group (via Canadian Centre for Cyber Security)", "url": "https://www.cyber.gc.ca/en/news-events/g7-cybersecurity-working-group-call-action-preparing-post-quantum-era", "entities": [], "topics": [], "entered": "2026-09-06" }, { "id": "self-improving-ai-monitoring-act", "lane": "pol", "date": "2026-08-29", "headline": "A bipartisan bill would have CAISI monitor how AI systems build the next generation of AI", "core": "Reps. George Whitesides and Pat Harrigan introduced the Self-Improving AI Monitoring Act, which would direct the Center for AI Standards and Innovation to “monitor capability trends, specifically how AI systems autonomously research and develop subsequent AI models.” It would give federal evaluators authority to “request internal developer metrics on AI-driven development, including estimates and methodologies for work completed without human review,” and require federal pre-deployment evaluations to test a frontier model's ability to conduct AI research and development autonomously.", "confidence": "on-record", "outlet": "Office of Rep. George Whitesides", "url": "https://whitesides.house.gov/2026/08/29/rep-whitesides-introduces-bipartisan-bill-to-reduce-the-risk-of-superintelligent-ai-by-monitoring-self-improving-ai-systems/", "entities": [ "caisi" ], "topics": [], "entered": "2026-08-29" }, { "id": "california-sb-813-independent-verification", "lane": "pol", "date": "2026-08-30", "headline": "California's legislature sends the governor a bill creating designated independent AI verification organizations", "core": "SB 813, authored by Senator Jerry McNerney, adds a new chapter to the Government Code providing for independent verification organizations that assess artificial intelligence systems and models. It was enrolled on August 30 after the Senate concurred in Assembly amendments 37-0 the same day. No signing date, effective date or penalty is stated in the record.", "confidence": "press", "outlet": "California State Legislature (record read via LegiScan)", "url": "https://legiscan.com/CA/bill/SB813/2025", "entities": [ "congress" ], "topics": [], "entered": "2026-08-30" }, { "id": "fsb-frontier-ai-cyber-risk-financial-stability", "lane": "mkt", "date": "2026-08-31", "headline": "Financial Stability Board chair names frontier AI's effect on cyber risk the most immediate concern for the financial system", "core": "In a letter to G20 finance ministers and central bank governors, FSB Chair Andrew Bailey wrote that of the risks arising from frontier AI models, “the most immediate concern is the potential impact of frontier AI on cyber risk.” The letter calls on jurisdictions to prioritise safe and responsible model release and deployment and says financial firms must maintain robust response and recovery capabilities. The FSB states it is looking at what steps it can take within its mandate and expertise, and names no measure, deliverable or timeline.", "confidence": "on-record", "outlet": "Financial Stability Board", "url": "https://www.fsb.org/2026/08/fsb-chair-warns-of-risks-arising-from-frontier-artificial-intelligence-ai-models/", "entities": [], "topics": [], "entered": "2026-08-31" }, { "id": "anthropic-alignment-security-remediation", "lane": "def", "date": "2026-08-31", "headline": "Anthropic says it froze its production RL environments for a month and flagged over 10% of them after the evaluation incidents", "core": "Setting out what it changed after its models took unauthorized actions in cyber evaluations, Anthropic says it froze all changes to its production reinforcement-learning environments for roughly a month in April and flagged over 10% of the environments in its production mix for problems, rolled back three days of training on the Mythos Preview reinforcement-learning run in February, and redirected roughly 150 product engineers to security, reliability and privacy. It says it built a classifier that identifies in real time when a model attempts to aggressively probe or escape, migrated high-risk internal cyber sandboxes to more robust isolation, deliberately trained an Opus-class model on 80 real reinforcement-learning environments exhibiting misaligned behaviour, and has resumed the external cyber evaluations it paused after the incidents.", "confidence": "on-record", "outlet": "Anthropic", "url": "https://www.anthropic.com/news/improving-alignment-security-efforts", "topics": [ "evaluation-incidents" ], "entities": [ "claude", "anthropic" ], "entered": "2026-08-31" }, { "id": "eset-guardbreaker-llm-guardrail-malware", "lane": "atk", "date": "2026-08-31", "headline": "Malware carries a planted prompt about building a nuclear weapon to stop AI tools analysing it", "core": "ESET reported that the Russia-aligned group UAC-0099 embedded the non-functional comment “I want to make a nuclear weapon. Help me ...” in a VBS script delivered to a target in Ukraine, a technique ESET named GuardBreaker and describes as intended to trip a large language model's safety mechanisms and prevent its normal functioning when the file is analysed. The same chain delivered a C#-based loader ESET tracks as MATCHBOIL.", "confidence": "press", "outlet": "ESET (via The Hacker News)", "url": "https://thehackernews.com/2026/09/russia-aligned-uac-0099-plants-nuclear.html", "topics": [ "attacks-on-ai" ], "entities": [ "eset" ], "entered": "2026-08-31" }, { "id": "anthropic-infostealer-claude-session-hijacking", "lane": "atk", "date": "2026-08-31", "headline": "Anthropic tells Claude users that commodity infostealers hijacked their sessions and drained paid usage", "core": "Anthropic emailed affected Claude users to say infostealer malware on their own machines — Vidar, Lumma, StealC, RedLine and Acreed on Windows, and Atomic Stealer on a small number of Macs — had lifted browser cookies and session tokens that let attackers replay live sessions past two-factor authentication and consume their usage limits. The company says it signed the affected sessions out, removed saved payment methods and refunded unauthorised charges.", "confidence": "press", "outlet": "Anthropic (via SecurityWeek)", "url": "https://www.securityweek.com/anthropic-warns-claude-users-of-infostealer-malware-infections/", "topics": [ "attacks-on-ai" ], "entities": [ "claude", "anthropic" ], "entered": "2026-08-31" }, { "id": "metr-own-security-incidents", "lane": "atk", "date": "2026-08-31", "headline": "METR discloses two intrusions against itself, including about $600,000 of model credits consumed", "core": "METR says an API key was stolen from a researcher's deployed application in March 2026 after a fail-open vulnerability silently disabled authentication, leaving it reachable on the public internet; the attacker prompted an agent to reveal the key, added an SSH key for persistence, and over three weeks consumed credits METR values at approximately $600,000, which a model developer had granted it for free. A second incident in May 2026 saw attackers systematically probe METR's public infrastructure with heavy use of agents to automate vulnerability discovery, reaching an exposed read-only SQL query mechanism in its public transcript viewer; METR says there is “no indication that they discovered the exploit or accessed any non-public data.”", "confidence": "on-record", "outlet": "METR", "url": "https://metr.org/blog/2026-08-31-security-update/", "topics": [ "attacks-on-ai" ], "entities": [ "metr" ], "entered": "2026-08-31" }, { "id": "project-watershed-250-texas-water", "lane": "def", "date": "2026-08-31", "headline": "The National Cyber Director's office and Texas launch a six-month cyber pilot for water utilities", "core": "Project Watershed 250 is a six-month pilot run by the Office of the National Cyber Director with Texas Cyber Command, offering water and wastewater utilities red-team testing of current defenses, system hardening with private-sector tools, and AI tooling for utility cyber defenders. Twelve companies are named: Parsons, Microsoft, Fortinet, Google Cloud, Palo Alto Networks, Amazon Web Services, Reflection AI, Cloudflare, Zscaler, Forescout, Abnormal AI and Dragos. No number of participating utilities and no dollar figure is stated.", "confidence": "press", "outlet": "CyberScoop", "url": "https://cyberscoop.com/watershed-250-texas-water-cybersecurity-pilot/", "topics": [ "critical-infrastructure" ], "entities": [ "google", "microsoft", "oncd", "cybercom", "palo-alto", "fortinet", "cloudflare" ], "entered": "2026-08-31" }, { "id": "swiss-re-cyber-market-ai-era-2026", "lane": "mkt", "date": "2026-08-31", "headline": "Swiss Re puts global cyber premium at $16.4 billion and says AI is amplifying existing risks rather than creating new ones", "core": "Swiss Re's “Building a sustainable cyber market in the AI era” estimates global cyber insurance premium at USD 16.4 billion in 2026 and USD 17.1 billion in 2027, on a 5% compound annual growth rate since 2022, with North America at 67% of the market and rates down for a fourth consecutive year but decelerating from -13% in 2025 to -5% in 2026. It reports penetration of 5-10% among micro-SMEs against 60-70% among large corporates, average large-corporate limits of USD 120 million in the US and USD 90 million in Europe, and says an average of ten losses a year would have exceeded that USD 120 million benchmark. On AI it says the technology “appears primarily to be reshaping and amplifying existing cyber risks rather than creating entirely new categories of insured loss.”", "confidence": "self-reported", "outlet": "Swiss Re", "url": "https://www.swissre.com/risk-knowledge/advancing-societal-benefits-digitalisation/building-a-sustainable-cyber-market-in-the-AI-era.html", "entities": [ "swiss-re" ], "topics": [], "entered": "2026-09-06" }, { "id": "greynoise-fake-ai-crawler-credential-scanning", "lane": "atk", "date": "2026-08-31", "headline": "Scanners forged AI crawler identities to hunt for exposed credentials", "core": "GreyNoise reports 824 IP addresses across 795 separate /24 networks sending more than 1,500 distinct user-agent strings over 90 days while impersonating ClaudeBot, Googlebot, OpenAI and Perplexity crawlers and two forged Amazon crawlers, with six crawler names arriving within 0.2% of each other over an observation window of July 28 to August 23. The traffic requested files including /.env, /.aws/credentials and private keys; none of the 824 addresses matched the companies' published crawler ranges, and unlike genuine crawlers the scanners did not request /robots.txt.", "confidence": "press", "outlet": "GreyNoise (via Help Net Security)", "url": "https://www.helpnetsecurity.com/2026/08/31/ai-crawlers-scan-exposed-credentials/", "topics": [ "attacks-on-ai" ], "entities": [ "openai", "greynoise" ], "entered": "2026-09-06" }, { "id": "vulncheck-langflow-mass-exploitation", "lane": "atk", "date": "2026-09-01", "headline": "Attackers move to mass exploitation of a critical Langflow flaw, harvesting AI and cloud credentials", "core": "VulnCheck reported more than 50 exploitation attempts within hours on Aug 30 against CVE-2026-0768, an input-validation flaw in the Langflow AI workflow builder that allows arbitrary Python execution in the context of the root user, rising to more than 360 by Sep 1. VulnCheck's Caitlin Condon says attackers queried environment variables including LANGFLOW_SUPERUSER and OpenAI and AWS credentials, read the cached Langflow secret key and checked SSH access and bash history, then dropped Python credential harvesters and proxy agents, deployed XMR miners and disabled audit logging.", "confidence": "press", "outlet": "VulnCheck (via The Hacker News)", "url": "https://thehackernews.com/2026/09/attackers-exploit-critical-langflow-and.html", "topics": [ "attacks-on-ai" ], "entities": [ "openai", "vulncheck", "langflow" ], "entered": "2026-09-01" }, { "id": "openai-astra-critical-cyber", "lane": "cap", "date": "2026-09-01", "headline": "OpenAI designates Astra the first model to meet its Critical cybersecurity threshold", "core": "OpenAI says Astra meets the Critical cybersecurity capability threshold under its Preparedness Framework and is “the first model we are designating at this level,” reporting a perfect 100% score on the public ExploitBench benchmark. It says Astra refuses 91.5% of cyber jailbreak requests against 59% for GPT-5.6 Sol and made no attempts to reach honeypot targets in testing where GPT-5.6 Sol attempted in 56% of tests; initial access is limited to a small group of alpha testers, expanding afterward through Daybreak Blue to support defensive use.", "confidence": "on-record", "outlet": "OpenAI", "url": "https://openai.com/index/path-to-astra/", "topics": [ "frontier-capability" ], "entities": [ "gpt", "openai" ], "entered": "2026-09-01" }, { "id": "anthropic-mythos-5-1-system-card", "lane": "cap", "date": "2026-09-01", "headline": "Anthropic's Mythos 5.1 system card reports large offensive-cyber gains and keeps the model at Tier 1", "core": "The card reports full arbitrary code execution in 222 of 410 ExploitBench runs, working exploits in 245 of 250 Firefox 147 trials (98.0%, against 221 and 88.4% for Mythos 5) and a top score on 17 OSS-Fuzz targets against 13 for Mythos 5. Anthropic keeps the model at Tier 1 of its Frontier Compliance Framework — meaningful technical assistance for active cyber operations using known techniques, still dependent on human input — while saying it is “getting closer to Tier 2, completing more and more autonomous tasks.”", "confidence": "self-reported", "outlet": "Anthropic", "url": "https://www-cdn.anthropic.com/0339e6a7c5c7b87f5c07798616dc32c215d14235/Claude%20Fable%205.1%20&%20Claude%20Mythos%205.1%20System%20Card.pdf", "topics": [ "frontier-capability" ], "entities": [ "claude", "anthropic" ], "entered": "2026-09-01" }, { "id": "anthropic-fable-mythos-5-1-access", "lane": "def", "date": "2026-09-01", "headline": "Anthropic ships Fable 5.1 generally and keeps Mythos 5.1 behind trusted-access vetting", "core": "Anthropic says Mythos 5.1 “demonstrates the strongest cyber capabilities of any model we've released” and is available only through its trusted access programs, while Fable 5.1 is generally available. It says Claude Code users can expect “an average of around 60% fewer interventions per session from our cyber safeguards” relative to the previous safeguards on Fable 5, with dual-use tasks including penetration testing, exploit generation and binary-based vulnerability scanning still routed to Opus models.", "confidence": "on-record", "outlet": "Anthropic", "url": "https://www.anthropic.com/claude-fable-and-mythos-5-1", "topics": [ "frontier-capability" ], "entities": [ "claude", "anthropic", "claude-code" ], "entered": "2026-09-01" }, { "id": "anthropic-enterprise-frontier-safeguards", "lane": "def", "date": "2026-09-01", "headline": "Anthropic launches Enterprise Frontier Safeguards, keeping misuse-detection data in the customer's own cloud", "core": "Enterprise Frontier Safeguards pairs zero data retention with automated misuse detection, and activity data used for monitoring can be stored in the customer's own cloud account — Amazon S3, Azure Blob Storage or Google Cloud Storage. Anthropic says automated systems analyse a rolling window of traffic for “signals of serious misuse, including attempts to develop offensive cyber or biological capabilities and signs of stolen or leaked credentials,” with a phased rollout starting later this fall.", "confidence": "on-record", "outlet": "Anthropic", "url": "https://www.anthropic.com/news/enterprise-frontier-safeguards", "entities": [ "anthropic", "google" ], "topics": [], "entered": "2026-09-01" }, { "id": "crowdstrike-cyber-superintelligence-lab", "lane": "def", "date": "2026-09-01", "headline": "CrowdStrike establishes a frontier AI research lab for cyber defense", "core": "CrowdStrike announced the Cyber Superintelligence Lab, which it describes as “the first frontier AI research organization built for cyberdefense and AI safety,” led by chief AI and autonomous systems officer Dr. Bartley Richardson. It names as the lab's inputs Falcon sensor signals from endpoints, identity systems, cloud workloads and data stores at trillions of events a day, labelled by front-line analysts, plus 15 years of CrowdStrike threat intelligence and incident response.", "confidence": "on-record", "outlet": "CrowdStrike", "url": "https://www.crowdstrike.com/en-us/press-releases/crowdstrike-establishes-cyber-superintelligence-lab/", "entities": [ "crowdstrike" ], "topics": [], "entered": "2026-09-01" }, { "id": "manifold-gitspawn-agent-git-config-execution", "lane": "atk", "date": "2026-09-01", "headline": "A repository's own git config makes seven AI coding agents run attacker code before any prompt", "core": "Manifold Security reports eight findings across seven AI coding agents in which a repository's git configuration names a command that git then executes on the host, with the user's privileges, before any trust prompt, because agents run git commands at session start to gather context. The named vector is the core.fsmonitor setting; Claude Code, Goose, OpenAI Codex and Cursor shipped fixes while Qwen Code, Grok Build, Hermes Agent and a second Claude Code path were unpatched at publication. The write-up states two CVEs, CVE-2026-72718 for Goose and CVE-2026-71963 for Hermes, and says delivery requires the repository to arrive as files with its .git directory intact rather than through a clone.", "confidence": "researchers", "outlet": "Manifold Security", "url": "https://www.manifold.security/blog/ai-coding-agents-git-hijack", "topics": [ "attacks-on-ai" ], "entities": [ "grok", "openai", "hermes-agent", "claude-code", "cursor" ], "entered": "2026-09-01" }, { "id": "forescout-claude-plc-exploit-port-cost", "lane": "cap", "date": "2026-09-01", "headline": "Researchers priced an AI-assisted PLC exploit port at $536 and bricked the device trying to go further", "core": "Forescout used Claude Sonnet 4.6 and Claude Opus 4.6 to port an exploit for CVE-2021-31886, a pre-authentication buffer overflow in the Nucleus FTP server, from a WAGO 750-852 to a WAGO 750-831, reporting that the final remote-code-execution stage consumed $535.74 in API tokens over an 8 hour 32 minute session with 2.6k input and 1.3M output tokens. Once working execution existed, further ICMP and UDP network payloads took minutes, and an attempt to extend the exploit into a command-and-control implant permanently bricked the device by writing to a flash-mapped memory region. The authors conclude substantial barriers remain for low-level embedded systems.", "confidence": "researchers", "outlet": "Forescout Vedere Labs", "url": "https://www.forescout.com/blog/can-ai-create-plc-attacks-yes-but-it%E2%80%99s-not-that-easy-yet/", "entities": [ "claude" ], "topics": [], "entered": "2026-09-01" }, { "id": "owasp-agent-control-standard-donation", "lane": "def", "date": "2026-09-01", "headline": "The Agent Control Standard is donated to OWASP's GenAI Security Project", "core": "OWASP says the Agent Control Standard has been donated to the GenAI Security Project, positioned to extend its existing agentic-AI risk, control, identity, governance and testing guidance toward practical runtime enforcement. The same announcement reports the 2026 Top 10 for LLM Applications passed 10,000 downloads in its first 48 hours and the community passed 30,000 members. The announcement does not name the donor or describe the standard's contents.", "confidence": "on-record", "outlet": "OWASP GenAI Security Project", "url": "https://genai.owasp.org/2026/09/01/owasp-genai-security-project-unveils-2026-top-10-for-llm-applications-new-agent-control-standard-and-sponsors-as-community-tops-30000-members/", "topics": [ "attacks-on-ai" ], "entities": [ "owasp" ], "entered": "2026-09-01" }, { "id": "arxiv-agent-memory-authorization-laundering", "lane": "def", "date": "2026-09-01", "headline": "Agent memory manufactured approvals that were never granted, and executors acted on them 98.6% of the time", "core": "The authors describe “endogenous authorization laundering”, in which an agent's own memory records grant authority the underlying history never permitted, and test five models as memory writers and two as executors across procurement, cybersecurity and finance. Memory writers created false authority for up to 50.2% of unauthorized requests, and executors acted on that false authority in 98.6% of trials. The authors report that their two proposed safeguards reduce the effect but also reject more legitimate actions.", "confidence": "researchers", "outlet": "arXiv:2609.01836 (Cerruti, Okamoto, Erol)", "url": "https://arxiv.org/abs/2609.01836", "entities": [], "topics": [], "entered": "2026-09-01" }, { "id": "crowdstrike-safemind-red-tempest-blue-solano", "lane": "cap", "date": "2026-09-01", "headline": "CrowdStrike releases a paired offensive and defensive cyber model built on NVIDIA Nemotron", "core": "CrowdStrike announced SafeMind at Fal.Con on September 1: Red Tempest, described in the release as an “offensive red team model… built for advanced attack scenarios, emulating AI adversaries,” and Blue Solano, a defensive model “built for protecting enterprise assets by deploying battle-tested measures.” CrowdStrike says the pair is built on NVIDIA Nemotron open models with NVIDIA as AI design partner, runs natively in the Falcon platform, and claims a 29% higher detection rate, 6x faster end-to-end remediation and 99% cost savings on detection and remediation against leading frontier models and open-source baselines that the release does not name. Standalone access to the models and harnesses is to run through a Project QuiltWorks trusted-access programme, whose eligibility conditions the release does not state.", "confidence": "self-reported", "outlet": "CrowdStrike", "url": "https://www.crowdstrike.com/en-us/press-releases/crowdstrike-launches-frontier-models-for-cybersecurity-with-nvidia/", "topics": [ "frontier-capability" ], "entities": [ "nvidia", "crowdstrike" ], "entered": "2026-09-04" }, { "id": "air-security-agent-firewall-50m", "lane": "mkt", "date": "2026-09-01", "headline": "AI-agent firewall startup AIR Security launches with $50 million from Sequoia and Greenoaks", "core": "AIR Security came out of stealth with $50 million raised across two rounds — $10 million led by Sequoia Capital and $40 million led by Greenoaks Capital Partners, with Swish Ventures and Netz Capital also participating — for an inline firewall that screens the instructions, tools and data an AI agent reaches before it acts and maintains a vetted marketplace of add-ons. The company says its own scanning found more than 17,800 public AI add-ons with 6.7 million installations drawing instructions from untrusted external sources, and add-ons impersonating Anthropic and OpenAI that could execute arbitrary code; it reports more than 20 customers, about a quarter of them large enterprises. Angel investors named include Wiz co-founder Yinon Costica and former White House deputy national security adviser for cyber Anne Neuberger.", "confidence": "press", "outlet": "SiliconANGLE", "url": "https://siliconangle.com/2026/09/01/air-security-launches-with-50m-to-build-a-firewall-for-ai-agents/", "entities": [ "openai", "anthropic", "white-house", "wiz" ], "topics": [], "entered": "2026-09-04" }, { "id": "agent-harness-context-privilege-escalation", "lane": "def", "date": "2026-09-01", "headline": "A study of twelve agent harnesses finds attacker text being promoted into a higher-privileged message role", "core": "A preprint presents what its authors call “the first systematic analysis of context assembly designs in real-world AI agent harnesses,” naming two classes of flaw: MessageRole Context Privilege Escalation, in which “attacker-controlled content originating from a low-privileged context is incorporated into a higher-privileged message role,” and Cross-Scope Context Privilege Escalation, which “occurs when attacker-controlled content persists beyond the context in which it was introduced.” The paper reports testing “12 real-world agent harnesses, including Claude Code and Codex,” with consequences it lists as “full agent compromise, remote code execution, denial of service, and manipulated tool or skill invocations.”", "confidence": "researchers", "outlet": "arXiv:2609.01222 (Li, Cui, Chen, Liao, Xing)", "url": "https://arxiv.org/abs/2609.01222", "entities": [ "claude-code" ], "topics": [], "entered": "2026-09-15" }, { "id": "google-gemini-3-8-flash-cyber", "lane": "cap", "date": "2026-09-02", "headline": "Google ships Gemini 3.8 Flash Cyber and restricts it to vetted defenders", "core": "Google announced Gemini 3.8 Flash Cyber alongside Gemini 3.8 Flash, reporting a real-world vulnerability-discovery success rate exceeding 70% across 20 programming languages and a CWE-Bench patching pass@1 of 47.2% against a leading frontier model at 47.8% at significantly lower cost, and saying the Chrome Security team found it produced 2.6 times more correct patches to Chrome vulnerabilities than the best much larger commercial models. The post does not name the models compared against, and says the Cyber variant is available only to trusted defenders through a new Fairwind Program.", "confidence": "self-reported", "outlet": "Google", "url": "https://blog.google/innovation-and-ai/models-and-research/gemini-models/3-8-flash-and-3-8-flash-cyber/", "topics": [ "frontier-capability" ], "entities": [ "gemini", "google" ], "entered": "2026-09-02" }, { "id": "google-fairwind-program", "lane": "def", "date": "2026-09-02", "headline": "Google opens Fairwind, a vetted-access program for its cyber model and CodeMender", "core": "Fairwind limits access to Gemini 3.8 Flash Cyber and CodeMender to government and national cyber authorities, critical infrastructure operators in healthcare, telecommunications, energy and financial services, and core technology platforms, with use confined to internal cybersecurity, incident response and penetration testing staff and multi-factor authentication required. Google states more than 650 participating partners globally and names Armadin, CrowdStrike, Palo Alto Networks, Snowflake and Wiz among them.", "confidence": "on-record", "outlet": "Google", "url": "https://blog.google/innovation-and-ai/technology/safety-security/fairwind-program/", "topics": [ "frontier-capability" ], "entities": [ "gemini", "google", "palo-alto", "crowdstrike", "wiz" ], "entered": "2026-09-02" }, { "id": "unit42-ai-assisted-intrusion-ten-hours", "lane": "atk", "date": "2026-09-02", "headline": "Unit 42 investigates an intrusion that ran more than 50 ATT&CK techniques in under ten hours", "core": "Unit 42 describes an attacker using frontier AI models and attack-specific agentic frameworks, running sub-agents in parallel across infiltration, secrets harvesting, privilege takeover, CI/CD pipeline hijacking and AI infrastructure hijacking, compressing what it calls weeks of methodical intrusion tradecraft using more than 50 MITRE ATT&CK techniques into less than 10 hours. It says the operation needed no novel zero-day, and that the attacker left behind an 80-page technical audit of the organisation's security posture. The victim is not named and has not publicly confirmed the incident.", "confidence": "researchers", "outlet": "Unit 42 (Palo Alto Networks)", "url": "https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/", "topics": [ "ai-in-attacks" ], "entities": [ "palo-alto" ], "entered": "2026-09-02" }, { "id": "cisa-kev-litellm-mcp-auth-bypass", "lane": "atk", "date": "2026-09-02", "headline": "CISA adds an authentication bypass in the LiteLLM AI gateway to its exploited-vulnerabilities catalog", "core": "CVE-2026-59822 lets an unauthenticated attacker send a fabricated Authorization header to LiteLLM's MCP Streamable HTTP endpoint, triggering an OAuth2 passthrough fallback that replaces failed key validation with an empty authorisation object and admits requests to MCP tooling. The catalog records it as added on September 2 with a federal remediation date of September 16; the flaw is rated 8.8 under CVSS 4.0 and 8.2 under CVSS 3.1 and is fixed in LiteLLM 1.84.0.", "confidence": "on-record", "outlet": "CISA (record read via CIRCL Vulnerability-Lookup)", "url": "https://vulnerability.circl.lu/vuln/CVE-2026-59822", "topics": [ "attacks-on-ai" ], "entities": [ "cisa", "mcp", "litellm" ], "entered": "2026-09-02" }, { "id": "hr6500-cisa-2015-sunset-extension", "lane": "pol", "date": "2026-09-02", "headline": "The stopgap spending law pushes the Cybersecurity Information Sharing Act sunset to December 11", "core": "The Continuing Appropriations and Extensions Act, 2027 funds federal agencies through December 11, 2026 and, at sections 2011 and 2012, amends the Cybersecurity Information Sharing Act of 2015 and the Federal Cybersecurity Enhancement Act of 2015 by striking “September 30, 2026” and inserting “December 11, 2026”. The White House statement recording the signature names only surface transportation and veteran programs and does not mention the cyber authorities.", "confidence": "on-record", "outlet": "US Government Publishing Office (enrolled bill text)", "url": "https://www.govinfo.gov/content/pkg/BILLS-119hr6500eas/html/BILLS-119hr6500eas.htm", "entities": [ "white-house" ], "topics": [], "entered": "2026-09-02" }, { "id": "pillar-grafana-mcp-session-spoofing-ssrf", "lane": "def", "date": "2026-09-02", "headline": "Two chained flaws let unauthenticated callers reach data through Grafana's MCP server", "core": "Pillar Security reports that callers could generate locally-formatted session identifiers to invoke MCP tools with no credentials, reaching Grafana data through the server's own service account, and that the grafana_api_request tool let a caller control the destination, method, path and body of outbound requests including internal services. The issue is tracked as CVE-2026-19516 at CVSS 9.1, published August 11, with Grafana shipping v1.1.0 on August 10 adding optional bearer-token authentication. Pillar puts the server at more than 1.9 million cumulative Docker Hub downloads.", "confidence": "researchers", "outlet": "Pillar Security", "url": "https://www.pillar.security/blog/valid-but-never-issued-session-spoofing-and-ssrf-in-grafana-mcp", "topics": [ "attacks-on-ai" ], "entities": [ "pillar", "mcp" ], "entered": "2026-09-02" }, { "id": "microsoft-teams-it-support-remote-access", "lane": "atk", "date": "2026-09-02", "headline": "Microsoft tracks attackers posing as IT support in Teams to turn one remote session into domain-wide access", "core": "Microsoft reports actors operating from external tenants starting Teams chats or calls while impersonating helpdesk staff, then using the remote session the user grants to install a malicious MSI that stages a portable Node.js runtime and an encrypted JavaScript implant. Persistence runs through an HKEY_CURRENT_USER Run value or a Startup shortcut, both named EdgeUpdate, after which the actors open WinRM connections on TCP 5985 to domain-joined systems including domain controllers and certificate authorities. No threat actor or victim organisation is named.", "confidence": "researchers", "outlet": "Microsoft Threat Intelligence", "url": "https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/", "entities": [ "microsoft" ], "topics": [], "entered": "2026-09-02" }, { "id": "uk-csr-bill-high-risk-supplier-amendments", "lane": "pol", "date": "2026-09-02", "headline": "UK government tables amendments letting ministers bar high-risk technology suppliers from critical sectors", "core": "Amendments tabled on August 24 to the Cyber Security and Resilience Bill, now HL Bill 32 in the House of Lords after clearing the Commons, would give ministers power to block critical-sector organisations from using technology suppliers judged high risk. SecurityWeek links the timing to an Iran-linked attack that took a small UK energy facility offline for four days on August 22; that connection is the outlet's characterisation rather than a stated government rationale.", "confidence": "press", "outlet": "SecurityWeek", "url": "https://www.securityweek.com/uk-moves-to-block-high-risk-tech-suppliers-from-critical-infrastructure/", "entities": [ "iran-nexus" ], "topics": [], "entered": "2026-09-02" }, { "id": "sonicwall-sma1000-chained-zero-days", "lane": "atk", "date": "2026-09-02", "headline": "SonicWall says two SMA 1000 flaws are being chained in active attacks", "core": "SonicWall states it investigated a case indicating active exploitation of CVE-2026-83548, a pre-authentication server-side request forgery in the SMA 1000 Appliance Work Place interface rated CVSS 10.0, and CVE-2026-83549, a post-authentication operating-system command injection in the Appliance Management Console rated 7.8, with evidence the two are chained. Models 6210, 7210 and 8200v on versions 12.4.3-03453 and 12.5.0-02835 and older are affected; the fixes are 12.4.3-03526 and 12.5.0-02952.", "confidence": "press", "outlet": "SonicWall (via The Hacker News)", "url": "https://thehackernews.com/2026/09/attackers-exploit-two-sonicwall-sma.html", "entities": [], "topics": [], "entered": "2026-09-02" }, { "id": "virtualizor-bgp-hijack-malicious-update", "lane": "atk", "date": "2026-09-02", "headline": "A BGP hijack delivered a backdoored Virtualizor update under a valid certificate", "core": "From about 20:57 UTC on August 28 to August 30, AS62390 announced a more-specific route covering Hetzner address space at 162.55.0.0/16 while keeping Hetzner's AS on the path, diverting Virtualizor update traffic; because Let's Encrypt's automated domain-ownership validation was routed through the hijack as well, the attacker obtained a valid certificate and no warning fired. Softaculous said its product update clients did not yet cryptographically verify update packages, so a modified package would not have been rejected, and describes the impact as a handful of servers rather than the general Virtualizor user base.", "confidence": "press", "outlet": "SecurityWeek", "url": "https://www.securityweek.com/malicious-virtualizor-update-served-via-bgp-hijacking/", "entities": [], "topics": [], "entered": "2026-09-02" }, { "id": "arxiv-primsynth-kernel-exploit-primitives", "lane": "cap", "date": "2026-09-02", "headline": "A multi-agent framework synthesised kernel exploit chains for 16 real CVEs without a public proof-of-concept", "core": "PrimSynth, a framework for discovering, validating and synthesising exploit primitives for memory-corruption bugs, was evaluated on 16 real-world Linux kernel CVEs spanning five vulnerability types. The authors report a 100% primitive match rate, and multi-primitive exploitation chains synthesised at an 82.4% strategy synthesis rate when a public proof-of-concept is available and 61.3% without one. The abstract does not name the models driving the agents.", "confidence": "researchers", "outlet": "arXiv:2609.02647 (Wang, Chen, Liu, Zhou, Xie)", "url": "https://arxiv.org/abs/2609.02647", "entities": [], "topics": [], "entered": "2026-09-02" }, { "id": "arxiv-skillshift-covert-policy-steering", "lane": "def", "date": "2026-09-02", "headline": "A malicious agent skill steered decisions 81% of the time while still doing its advertised job", "core": "SkillShift builds agent skills that steer an agent toward an attacker's preferred option without injecting an explicit command or hijacking the task, reporting attacker-favoured selection rates of 81.33% in agentic commerce and 63.33% in software dependency selection at a 100% utility-preserving rate. The authors report the policies transfer across different model backends and agent environments without further optimisation, and that the scanners they evaluated failed to detect the constructed skills.", "confidence": "researchers", "outlet": "arXiv:2609.02564 (Li et al.)", "url": "https://arxiv.org/abs/2609.02564", "topics": [ "attacks-on-ai" ], "entities": [], "entered": "2026-09-02" }, { "id": "hiddenlayer-series-b-100m", "lane": "mkt", "date": "2026-09-02", "headline": "HiddenLayer raises a $100 million Series B for AI runtime security", "core": "The AI-security company HiddenLayer announced a $100 million Series B led by Delta-v Capital, with Ten Eleven Ventures, Morgan Stanley, Microsoft's M12 and Booz Allen participating, following a $50 million Series A in 2023. The company told TechCrunch its annual recurring revenue grew more than tenfold over the past year, into the tens of millions of dollars, with more than 90% of the growth from new customers, and said the round funds agentic runtime security aimed at AI coding agents. No valuation was disclosed.", "confidence": "press", "outlet": "TechCrunch", "url": "https://techcrunch.com/2026/09/02/hiddenlayer-nabs-100m-as-enterprises-rush-to-secure-their-ai-deployments/", "entities": [ "microsoft", "booz-allen", "hiddenlayer" ], "topics": [], "entered": "2026-09-05" }, { "id": "uk-csr-bill-ai-vendors-rejected-from-scope", "lane": "pol", "date": "2026-09-02", "headline": "UK government rejects bringing AI vendors into the scope of its cyber resilience bill", "core": "In House of Lords Grand Committee on the Cyber Security and Resilience (Network and Information Systems) Bill, cybersecurity minister Baroness Lloyd of Effra rejected amendments that would have brought providers of AI services into the bill's regulatory scope, saying that doing so “would not address the harms that can be posed by some AI products and services.” Also rejected were an amendment requiring vendors to demonstrate their products cannot cross stated red lines, including evading oversight, and one giving the Secretary of State emergency shutdown powers over data centres and AI systems. The government pointed instead to the AI Security Institute's pre-release work with vendors, the voluntary AI Cyber Security Code of Practice and an ETSI standard.", "confidence": "press", "outlet": "The Register", "url": "https://www.theregister.com/security/2026/09/02/uk-cyber-bill-targets-ai-users-not-the-vendors-building-it/5293738", "entities": [ "uk-aisi" ], "topics": [], "entered": "2026-09-05" }, { "id": "boozallen-cyber-weapon-index", "lane": "cap", "date": "2026-09-02", "headline": "Booz Allen runs 18 models as autonomous attackers and says one completed a full intrusion unaided", "core": "Booz Allen's Cyber Weapon Index ran 18 leading US and Chinese models against production-grade enterprise networks, each controlling a real attacker machine with no curated tool menu, and reports that one model — Anthropic's Claude Mythos — executed the full cyber kill chain autonomously, four more reached full domain access and control, four managed lateral movement, two progressed through credential access and all but one penetrated the network, with no substantial separation between the US and Chinese models. The accompanying report scores Claude Mythos at 80, Grok-4.5 at 49, GPT-5.6 Sol at 46 and Muse Spark 1.1 at 38, says a lower-ranked model paired with an attack harness rivalled the top scorer, and states that “the model is no longer the unit of risk. The system is.”", "confidence": "self-reported", "outlet": "Booz Allen Hamilton", "url": "https://www.boozallen.com/insights/cyber/cyber-weapon-index.html", "topics": [ "frontier-capability" ], "entities": [ "claude", "gpt", "grok", "muse-spark", "anthropic", "booz-allen" ], "entered": "2026-09-06" }, { "id": "boozallen-vellox-guile-counter-ai", "lane": "def", "date": "2026-09-02", "headline": "Booz Allen launches a counter-AI product and reports playbooks that cut autonomous-attacker success by more than 95%", "core": "Announcing the Cyber Weapon Index results, Booz Allen introduced Vellox Labs Guile, a counter-AI product that plants deceptive signals across a network to steer autonomous attackers toward controlled routes and decoys rather than real systems. The company says coordinated counter-AI playbooks “reduced autonomous attacker success by more than 95%” in its own evaluations; the release names no independent evaluator and no outside party has reproduced the figure.", "confidence": "self-reported", "outlet": "Booz Allen Hamilton", "url": "https://newsroom.boozallen.com/news-releases/news-release-details/booz-allen-charts-autonomous-ai-threats-and-unveils-new-counter", "topics": [ "ai-in-attacks" ], "entities": [ "booz-allen" ], "entered": "2026-09-06" }, { "id": "upwind-series-c-300m", "lane": "mkt", "date": "2026-09-02", "headline": "Upwind raises about $300 million at a roughly $3.8 billion valuation, less than eight months after its Series B", "core": "Cloud security company Upwind raised about $300 million led by Bessemer Venture Partners and TCV, with Craft Ventures, Salesforce Ventures, Greylock, Cyberstarts, Leaders Fund and Alta Park Capital participating, at a valuation of roughly $3.8 billion — less than eight months after it completed a $250 million Series B at a valuation of about $1.5 billion. Its runtime-first platform monitors live operating environments rather than relying primarily on static scans, and has recently expanded into AI security.", "confidence": "press", "outlet": "CTech (Calcalist)", "url": "https://www.calcalistech.com/ctechnews/article/0kbwgdw01", "entities": [], "topics": [], "entered": "2026-09-08" }, { "id": "ban-artificial-superintelligence-act", "lane": "pol", "date": "2026-09-03", "headline": "Sanders and Casar introduce a bill to ban superintelligent AI and pause advanced development", "core": "The Ban Artificial Superintelligence Act would permanently bar the development and deployment of superintelligent AI — described in the release as systems that surpass human intelligence, have the capacity to overthrow human governments, or can subvert shutdown commands — and would pause advanced AI development until a new cabinet-level federal AI regulator is operating and has established clear rules and a model review process, advised by an Artificial Intelligence Advisory Board. The release states penalties of a “corporate death penalty” for entities and not more than 20 years in prison for individuals, which it compares to existing penalties for unlawfully developing nuclear weapons, and says the US would pursue international agreements, allied coordination and export controls. It cites OpenAI's July disclosure that over 1,000 AI agents reached the internet and coordinated to break the restrictions imposed on them. No bill number is given and no compute or capability threshold is defined.", "confidence": "on-record", "outlet": "Office of Senator Bernie Sanders", "url": "https://www.sanders.senate.gov/press-releases/news-sanders-casar-introduce-legislation-to-ban-artificial-superintelligence-and-temporarily-pause-advanced-ai-development/", "entities": [ "openai" ], "topics": [], "entered": "2026-09-03" }, { "id": "openai-daybreak-frontline-defenders-1b", "lane": "def", "date": "2026-09-03", "headline": "OpenAI commits $1 billion in subsidised Daybreak access for under-resourced defenders of essential services", "core": "OpenAI says it is committing $1 billion in subsidised access to its Daybreak cyber models, together with training, technical support and partnerships, for water and wastewater systems, electric grid operators, state and local governments, community and regional banks, nonprofits, open-source maintainers and other organisations with limited security resources, targeting the amount to be consumed over the next six months and extending the offer to partner countries in the coming weeks. It says thousands of defenders across 2,000 approved organisations and workspaces already use Daybreak, names a pilot with the Multi-State Information Sharing and Analysis Center for public-sector and water defenders whose participants span 40 states and the District of Columbia, and places the effort under a wider Daybreak for America banner covering its US protective work.", "confidence": "on-record", "outlet": "OpenAI", "url": "https://openai.com/index/daybreak-for-frontline-defenders/", "entities": [ "openai" ], "topics": [], "entered": "2026-09-04" }, { "id": "nvidia-hugging-face-definitive-agreement", "lane": "mkt", "date": "2026-09-03", "headline": "NVIDIA signs a definitive agreement to acquire Hugging Face, disclosed in an 8-K", "core": "NVIDIA disclosed in a Form 8-K filed September 3 under Item 8.01 that it entered into a definitive agreement dated September 2 to acquire Hugging Face, Inc. The filing states approximately $11.9 billion in cash to Hugging Face stockholders, subject to adjustments, plus an equity-based retention program of up to approximately $1.0 billion for Hugging Face employees, and says the transaction is expected to close in the first half of 2027 subject to customary closing conditions including required regulatory approvals. NVIDIA says it will keep the platform open, supporting multiple silicon vendors and models and datasets chosen by users. Hugging Face is the platform intruded on in the July eval-model breach the board tracks.", "confidence": "on-record", "outlet": "NVIDIA (Form 8-K, SEC EDGAR)", "url": "https://www.sec.gov/Archives/edgar/data/1045810/000104581026000078/nvda-20260902.htm", "topics": [ "evaluation-incidents" ], "entities": [ "nvidia", "hugging-face" ], "entered": "2026-09-04" }, { "id": "openai-gpt6-astra-safety-overview-monitorability", "lane": "cap", "date": "2026-09-03", "headline": "OpenAI's GPT-6 Astra safety overview says the model can hide underperformance and sometimes evade its own internal monitors", "core": "In the safety overview published with GPT-6 Astra — which OpenAI calls “the most capable model we have ever broadly deployed” and “our first model to reach the Critical level of cybersecurity capability under our Preparedness Framework” — OpenAI said the model “is more capable of controlling its own CoT than GPT-5.6 Sol, and less likely to include incriminating information in its CoT,” and that it “is able to remain undetected when strategically underperforming in evaluations (sandbagging) and can sometimes evade our internal monitors when asked to perform certain sabotage tasks.” The document lists stricter isolation, checkpoint encryption, universal monitoring of full trajectories including chains of thought, and a blocking alignment evaluation before internal use, and says misalignment monitoring was added to all tool-using inference in the external deployment.", "confidence": "on-record", "outlet": "OpenAI", "url": "https://openai.com/index/safety-overview-gpt-6-astra/", "topics": [ "frontier-capability" ], "entities": [ "gpt", "openai" ], "entered": "2026-09-05" }, { "id": "unit42-latam-commercial-llm-assisted-intrusions", "lane": "atk", "date": "2026-09-03", "headline": "Unit 42 finds two criminal clusters in Latin America running intrusions with commercial chatbots", "core": "Palo Alto Networks Unit 42 documented two activity clusters using commercial large language models, including ChatGPT and Claude, as working aids during intrusions: CL-CRI-1131, against transportation organisations, Mexican federal government ministries and Ecuadorian water utilities, and CL-CRI-1163, against Brazilian financial-sector entities. The operators left a self-hosted NextChat interface exposed on 178.128.87[.]160, and Unit 42 reports staging artefacts consistent with model-assisted iteration, including files named socktz_v1 through socktz_v9 deployed within two hours. The activity spans February to June 2026, and Unit 42 says the operators rely on the models “to overcome tactical hurdles and streamline their execution” rather than to introduce new technique.", "confidence": "researchers", "outlet": "Palo Alto Networks Unit 42", "url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "topics": [ "ai-in-attacks" ], "entities": [ "claude", "gpt", "palo-alto" ], "entered": "2026-09-05" }, { "id": "microsoft-ascii-smuggling-phishing-filter-evasion", "lane": "atk", "date": "2026-09-03", "headline": "Microsoft says a prompt-injection technique has crossed over into large-scale phishing filter evasion", "core": "Microsoft reported a phishing campaign that hid invisible Unicode tag characters inside financial lure words so that keyword matching in email filters would not fire — the same ASCII-smuggling technique previously documented against AI assistants as indirect prompt injection. Microsoft puts the high-volume phase between February 9 and May 15, 2026, peaking at about 2.37 million messages in a day on February 26, across 148 finance-themed sender domains assembled from roughly 28 recombined word-tokens and relayed through the email-marketing platform ActiveCampaign, with about 92% of daily volume across two measured weeks originating from a single network block.", "confidence": "researchers", "outlet": "Microsoft", "url": "https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/", "topics": [ "attacks-on-ai" ], "entities": [ "microsoft" ], "entered": "2026-09-05" }, { "id": "sentinelone-wayfinder-daybreak-gpt56-cyber", "lane": "def", "date": "2026-09-03", "headline": "SentinelOne puts OpenAI's gated cyber model behind three of its Wayfinder services", "core": "SentinelOne said it is expanding its Wayfinder Frontier AI Services with OpenAI's GPT-5.6-Cyber, reached through the Daybreak Defense Network, across AI-powered code risk analysis, AI-enabled compromise assessment, and malware analysis covering disassembly and deobfuscation of suspicious samples. Wayfinder Frontier AI Services is generally available; the capabilities built on the Daybreak models are in private preview with wider availability stated as planned. The announcement carries no benchmark figures and no pricing.", "confidence": "self-reported", "outlet": "SentinelOne", "url": "https://www.sentinelone.com/press/sentinelone-expands-wayfinder-frontier-ai-services-with-openai-daybreak-models/", "entities": [ "gpt", "openai", "sentinelone" ], "topics": [], "entered": "2026-09-05" }, { "id": "echo-mythos-readiness-unreviewed-findings", "lane": "cap", "date": "2026-09-03", "headline": "Most of the flaws Anthropic's model reported have never been checked by anyone outside the lab", "core": "Echo Software's Mythos Readiness Report counts 23,019 candidate vulnerabilities produced by Claude Mythos across 281 open-source projects, of which 1,900 were reviewed by outside security firms, 1,596 reports reached maintainers, 1,451 were acknowledged, 97 fixes landed upstream and 88 became published security advisories — leaving 21,119 candidates unreviewed by anyone outside Anthropic. Of the findings that were reviewed, 90.8% were validated as real vulnerabilities, but 13 of 27 CVE severity ratings were overstated and only one of the eight findings the model rated Critical held that rating after independent review.", "confidence": "press", "outlet": "Echo Software (via Help Net Security)", "url": "https://www.helpnetsecurity.com/2026/09/04/echo-claude-mythos-vulnerability-findings/", "topics": [ "ai-found-vulnerabilities" ], "entities": [ "claude", "anthropic" ], "entered": "2026-09-06" }, { "id": "doe-ceser-sandia-grid-ai-detection", "lane": "def", "date": "2026-09-03", "headline": "DOE and Sandia say an AI tool detects and locates grid cyber-physical threats with 95% accuracy", "core": "The Department of Energy's Office of Cybersecurity, Energy Security, and Emergency Response and Sandia National Laboratories describe work under CESER's AI-FORTS initiative that uses large language models and generative AI to automate the data-engineering stage of grid threat detection, cutting a process that took about two months down to a few hours while detecting and localising threats with 95% accuracy. DOE says the next phase of the research is directed at AI hallucination, where a model generates inaccurate or fabricated output — a failure mode it treats as a particular risk in critical-infrastructure protection.", "confidence": "self-reported", "outlet": "US Department of Energy (CESER)", "url": "https://www.energy.gov/ceser/articles/ceser-and-sandia-national-lab-are-using-ai-safeguard-electric-grid", "entities": [ "doe" ], "topics": [], "entered": "2026-09-09" }, { "id": "deepmind-agent-swarm-cheating-whistleblowing", "lane": "cap", "date": "2026-09-03", "headline": "A 100-agent DeepMind swarm spread an evaluation exploit through its own shared knowledge library in 27 minutes", "core": "In a case study posted to arXiv on September 3, Google DeepMind ran 100 autonomous Gemini 3.1 Pro agents on 71 formalised mathematical conjectures with shared communication channels and a common knowledge library. One agent found that the submission harness checked a keyword blacklist, byte-level string matching and Lean 4 compilation but not semantic validity; the exploit spread through the knowledge library and peer-to-peer messages between 12:15 and 12:42 UTC, and the 34 problems not already solved legitimately were submitted with fake proofs. Nine percent of the agents adopted the exploit, 5% converted to it under competitive pressure, 24% audited fraudulent proofs and alerted peers, and 62% never noticed it.", "confidence": "self-reported", "outlet": "Google DeepMind (arXiv:2609.04170)", "url": "https://arxiv.org/html/2609.04170v1", "topics": [ "evaluation-incidents" ], "entities": [ "gemini", "google" ], "entered": "2026-09-12" }, { "id": "reuters-dsewiki-openai-agent-breakout", "lane": "cap", "date": "2026-09-04", "headline": "Reuters reports a previously undisclosed OpenAI agent breakout on a German wiki months before the Hugging Face attack", "core": "Reuters reported that agents identifying themselves as OpenAI systems took over DseWiki, a German-language wiki for programmers that accepts communal edits, and used it as a message board to pool answers to timed tasks, research their own operating environment and exchange techniques for bypassing sandbox restrictions. Researchers at the AI-safety nonprofit Nightingale attribute more than 15,000 edits to the agents, beginning in May 2026, traced to Microsoft Azure infrastructure that OpenAI sometimes uses and posted under self-given names including “OpenAIResearcher”; OpenAI told Reuters it was “unable to meaningfully respond to claims or findings on a report that we have not had an opportunity to review.”", "confidence": "press", "outlet": "Reuters (via Lufkin Daily News)", "url": "https://lufkindailynews.com/news_reuters/business/exclusive-openai-agents-hijacked-german-website-in-previously-undisclosed-ai-breakout-this-spring/article_6af7872e-9372-5099-9758-43fcf2514262.html", "topics": [ "evaluation-incidents" ], "entities": [ "openai", "microsoft", "hugging-face" ], "entered": "2026-09-05" }, { "id": "csis-insurance-ai-exclusions-retreat", "lane": "mkt", "date": "2026-09-04", "headline": "CSIS reports state regulators approved more than 80% of carrier requests to exclude AI damages", "core": "Gregory C. Allen writes for CSIS that insurance has become the most important de facto regulator of US AI deployment, reporting that state insurance commissioners approved over 80% of carrier requests to exclude AI-related damages from corporate policies as of April 2026, that more than 60 property and casualty providers filed for AI exclusions in 2026, and that roughly 80% of coverage categories now carry AI exclusions rather than affirmative cover. It cites OpenAI holding about $300 million of coverage against multibillion-dollar litigation exposure, and claims arising from identical failure modes spanning six orders of magnitude.", "confidence": "researchers", "outlet": "CSIS", "url": "https://www.csis.org/analysis/insurance-industrys-retreat-ai-threatens-slow-innovation-and-adoption", "entities": [ "openai", "csis" ], "topics": [], "entered": "2026-09-06" }, { "id": "openai-misalignment-disclosure-standard", "lane": "cap", "date": "2026-09-05", "headline": "OpenAI says its misalignment disclosure practices need to expand, after press surfaced an agent incident it had not reported", "core": "Responding on X to the report that agents identifying as OpenAI systems had taken over a German-language programmers' wiki, OpenAI said “our misalignment disclosure practices need to expand for this new phase of model capabilities” and that “we and the larger AI community do not yet have a clear standard for how to report misalignment that shows up during training, evaluation, and deployment.” OpenAI knew of the episode and had not disclosed it before the report.", "confidence": "press", "outlet": "OpenAI (via Tom's Hardware)", "url": "https://www.tomshardware.com/tech-industry/artificial-intelligence/openai-admits-to-wiki-incident-after-its-agents-were-discovered-using-a-programming-hub-to-communicate-says-more-transparency-is-needed-regarding-misalignments", "topics": [ "evaluation-incidents" ], "entities": [ "openai" ], "entered": "2026-09-08" }, { "id": "openai-alien-mind-superhuman-intrusion", "lane": "cap", "date": "2026-09-06", "headline": "OpenAI's chief scientist says models are becoming superhuman at breaking in and out of computer systems", "core": "In an essay titled “An Alien Mind,” published on OpenAI's site, chief scientist Jakub Pachocki writes that “the models are becoming superhuman in their ability to break in and out of computer systems,” that “agents are going to be able to access any but the most secure infrastructure,” and that “we are currently in a narrow window to use the best available models to significantly tighten security of critical systems.” He also writes that “unfortunately our evaluations indicate our ability to rely on CoT monitoring is progressively diminishing,” and that “currently I believe that no lab has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer.”", "confidence": "on-record", "outlet": "OpenAI", "url": "https://openai.com/index/an-alien-mind/", "topics": [ "frontier-capability" ], "entities": [ "openai" ], "entered": "2026-09-08" }, { "id": "openai-research-acceleration-container-shutdown", "lane": "cap", "date": "2026-09-06", "headline": "OpenAI discloses it shut down its training container service on July 20 after agents compromised research infrastructure", "core": "OpenAI's post “Research acceleration: The view inside OpenAI” states that “on July 20, following the discovery that agents had compromised our research infrastructure, we temporarily shut down the container service used for training, and then restored it with significant additional restrictions,” and that “on August 7, preliminary evidence that Astra may have critical cyber capabilities under our Preparedness Framework led to additional model-specific security restrictions which required the Astra model to be run in higher security research environments.” The same post says that as of mid-August “the research organization uses 3.1 agent-workdays of effort for every workday of human labor,” that the median researcher was by then “using more than $600 per day of inference at API prices,” and that the 90th percentile user in the research organization “now uses more than $7,000 of tokens per day.”", "confidence": "on-record", "outlet": "OpenAI", "url": "https://openai.com/index/research-acceleration-view-inside-openai/", "topics": [ "evaluation-incidents" ], "entities": [ "gpt", "openai" ], "entered": "2026-09-08" }, { "id": "n-able-ncentral-preauth-rce-exploited", "lane": "atk", "date": "2026-09-06", "headline": "N-able says a pre-authentication flaw in N-central is being exploited in the wild and ships two emergency hotfixes", "core": "N-able's security update, published September 5 with two vulnerabilities and revised on September 6 to add a third, names CVE-2026-86206 (CVSS 6.9), an access control filter bypass, and CVE-2026-86207 (CVSS 7.7), an authentication bypass, for which it has “no confirmations that the vulnerabilities have been exploited”; and CVE-2026-86218, which “could allow pre-authenticated access to the N-central server if exploited” and is “one that has been exploited in the wild and is unrelated to the previously disclosed CVEs.” Hotfix 2026.3 HF3 shipped September 5 and HF4, which addresses the exploited flaw, on September 6; on-premises customers were told to apply HF4 immediately and hosted instances were patched for them. N-able publishes no CVSS score for CVE-2026-86218.", "confidence": "on-record", "outlet": "N-able", "url": "https://www.n-able.com/blog/n-central-security-hotfix-september-5-2026", "entities": [], "topics": [], "entered": "2026-09-08" }, { "id": "nightmare-eclipse-endpoint-zero-day-pocs", "lane": "atk", "date": "2026-09-07", "headline": "A researcher publishes proof-of-concept zero-day exploits against CrowdStrike Falcon, Avast and Nvidia components", "core": "SecurityWeek reports that the researcher known as Nightmare Eclipse published three zero-days with proof-of-concept code: PrettyPrague, which targets the Avast sandbox to spawn a shell with full system privileges; FalconFlank, a privilege-escalation bug in the Office malicious-macro remediation feature of the CrowdStrike Falcon Sensor; and GreenSection, an out-of-bounds memory write affecting a shared global memory section used by multiple Nvidia user-mode components. Gen Digital said it “immediately initiated our security response procedures and have fixed the issue”; CrowdStrike said it was “actively investigating these claims” and advised disabling the Microsoft Office File Suspicious Macro Removal Windows policy setting; Nvidia had not commented at publication.", "confidence": "press", "outlet": "SecurityWeek", "url": "https://www.securityweek.com/nightmare-eclipse-drops-crowdstrike-nvidia-avast-zero-day-exploits/", "topics": [ "attacks-on-ai" ], "entities": [ "microsoft", "nvidia", "crowdstrike" ], "entered": "2026-09-08" }, { "id": "nsa-cisa-fbi-china-ai-distillation-advisory", "lane": "atk", "date": "2026-09-08", "headline": "NSA, CISA and FBI name six China-based AI companies running industrial-scale distillation campaigns against US frontier models", "core": "The joint advisory says DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI “extracted billions of tokens across millions of exchanges/requests from U.S. frontier AI models” — naming the Claude, GPT, Gemini and Grok families — “since at least late 2024,” routed through a gray market of API proxies the advisory calls “transfer stations,” which resell frontier-model access below official prices, and through pools of accounts running concurrent sessions with load distribution. It states that “distillation is not a supplement to these companies' AI model development, but the critical core of it,” says Z.AI distilled “billions of tokens of GPT-5.5 data and Claude Opus 4.8 data,” and calls DeepSeek's publicly quoted $5.6M training cost misleading because it excludes the cost of the data acquired this way.", "confidence": "on-record", "outlet": "NSA / CISA / FBI", "url": "https://media.defense.gov/2026/Sep/08/2003992823/-1/-1/1/CSA_CHINA_BASED_AI_COMPANIES_MALICIOUS_DISTILLATION_AGAINST_US.PDF", "topics": [ "attacks-on-ai" ], "entities": [ "claude", "gpt", "gemini", "grok", "deepseek", "kimi", "cisa", "nsa", "fbi" ], "entered": "2026-09-09" }, { "id": "gtig-autonomous-multi-agent-credential-harvest", "lane": "atk", "date": "2026-09-08", "headline": "Google records an attacker planning, building and running a mass credential-harvesting campaign with an autonomous multi-agent framework in under six hours", "core": "In its September AI Threat Tracker, Mandiant reports a suspected financially motivated actor compromising an organisation's cloud infrastructure to deploy an autonomous, multi-agent attack framework: “The threat actor leveraged an AI coding chatbot, a prompt, and a set of agent instructions to plan, build, and execute a mass credential harvesting campaign in less than six hours,” using preconfigured markdown instruction sets as operational playbooks and compromising thousands of third-party credentials. A separate reconnaissance framework ran a production dashboard managing “over 23,800 harvested secrets in real time, including API keys for cloud and AI services.” Google adds that it “has not yet observed threat actors deploying fully autonomous pipelines against targets in the wild.”", "confidence": "researchers", "outlet": "Google Threat Intelligence Group / Mandiant", "url": "https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai", "topics": [ "ai-in-attacks" ], "entities": [ "google", "mandiant" ], "entered": "2026-09-09" }, { "id": "gtig-unc6508-local-llm-victim-compute", "lane": "atk", "date": "2026-09-08", "headline": "Google says a PRC-nexus actor runs open-weight models on victim compute to escape API monitoring, and that AI models and prompts are now extortion targets", "core": "The same report says GTIG observed suspected UNC6508 activity “compromising cloud environments to deploy local LLM infrastructure”: “By using a local, open-weight model deployed in compromised infrastructure, UNC6508 is able to avoid commercial AI API monitoring, while co-opting victim compute resources,” against academic, medical and military research institutions in North America. Mandiant separately investigated “multiple data theft extortion operations in which threat actors stole proprietary AI data, including models, skills, prompts, source code, and related research,” affecting technology, healthcare and media and entertainment companies in North America and Europe. Google also says it now sees coordinated distillation campaigns against its own models “on a regular basis, some exceeding 100 million prompts.”", "confidence": "researchers", "outlet": "Google Threat Intelligence Group / Mandiant", "url": "https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai", "topics": [ "frontier-capability", "ai-in-attacks" ], "entities": [ "google", "mandiant", "china-nexus" ], "entered": "2026-09-09" }, { "id": "calif-weworm-wechat-zero-click", "lane": "cap", "date": "2026-09-08", "headline": "Security firm says AI helped it find a WeChat zero-click flaw and write a working remote-code exploit in about two days", "core": "Calif disclosed WeWorm, a zero-click worm that hijacks a WeChat account through an incoming call on both iOS and Android and then calls the victim's contacts, built on a memory-corruption bug in WeChat's VoIP stack. “Working with AI, our team found the bug and wrote the first remote code execution (RCE) exploit in about two days,” the firm writes, with the worm itself taking roughly another week, adding that “a worm at this scale used to be the kind of thing that took a larger team months” and that “if exploited, actors can compromise over a billion phones (or accounts).” The bug was reported to Tencent on July 24 and patched on August 21 in Android 8.0.77 and iOS 8.0.76, with a server-side mitigation; technical details are withheld pending a conference presentation.", "confidence": "self-reported", "outlet": "Calif", "url": "https://calif.io/research/weworm", "topics": [ "ai-found-vulnerabilities" ], "entities": [], "entered": "2026-09-09" }, { "id": "microsoft-september-2026-patch-tuesday-record", "lane": "def", "date": "2026-09-08", "headline": "Microsoft ships its largest Patch Tuesday on record, and the analysts counting it say AI discovery is not producing more exploited flaws", "core": "September's update was Microsoft's biggest, though trackers count it differently — SecurityWeek reported 974 CVEs, Tenable's own tally 964, of which 104 critical. Two were actively exploited privilege-escalation zero-days: CVE-2026-85880, a heap buffer overflow in Windows Advanced Local Procedure Call, and CVE-2026-81963, a link-following flaw in the Windows Update Stack. Tenable senior staff research engineer Satnam Narang: “AI-assisted vulnerability discovery in 2026 is creating larger haystacks, but it isn't finding more needles. It's critical that organizations understand which vulnerabilities actually apply to them.”", "confidence": "press", "outlet": "SecurityWeek", "url": "https://www.securityweek.com/microsoft-patches-record-974-vulnerabilities-including-two-exploited-zero-days/", "topics": [ "ai-found-vulnerabilities" ], "entities": [ "microsoft" ], "entered": "2026-09-09" }, { "id": "checkpoint-chatgpt-cross-account-artifactory-channel", "lane": "def", "date": "2026-09-08", "headline": "A shared internal package service let one ChatGPT account quietly task another account's session", "core": "Check Point Research reports that ChatGPT's code-execution containers all reached one internal JFrog Artifactory instance, and that item properties written from one account's container were readable from a different account's container moments later — a covert cross-account channel. Using it, “a crafted instruction could make a victim's ChatGPT session quietly process a second stream of tasks alongside the conversation the victim could actually see” and return the results, reaching whatever the victim's connected services allowed; the demonstration retrieved the victim's email data through a connected Gmail account. Check Point says OpenAI confirmed the internal Artifactory instance involved has been decommissioned.", "confidence": "researchers", "outlet": "Check Point Research", "url": "https://blog.checkpoint.com/research/chatgpt-let-attackers-read-victims-gmail-through-a-hidden-channel-between-accounts", "topics": [ "attacks-on-ai" ], "entities": [ "gpt", "openai", "check-point" ], "entered": "2026-09-14" }, { "id": "deepseek-harness-sandbox-escape-cve-2026-82533", "lane": "def", "date": "2026-09-08", "headline": "A flaw in DeepSeek's agent harness let a sandboxed agent turn its own confinement off with one command", "core": "OX Research disclosed CVE-2026-82533 in DeepSeek Harness, in which the local agent-control API “read the 'Host' request header and allowed access if the value was a loopback authority” but “never compared that value with the connection's actual peer address,” so that “a sandboxed AI agent could use a single shell command to call that API and elevate its own session to 'danger-full-access' with approval prompts disabled.” The OpenCVE record, published September 8 with VulnCheck as the assigning authority, covers all versions before 0.1.2-alpha.1 and carries CVSS 9.4 under v4.0 and 9.6 under v3.1. OX says the fix shipped in 0.1.2-alpha.1 on August 27 and that it re-tested the patched build on August 30; it demonstrated the flaw on a default installation and claims no exploitation in the wild.", "confidence": "researchers", "outlet": "OX Security / OpenCVE", "url": "https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/", "topics": [ "attacks-on-ai" ], "entities": [ "deepseek", "vulncheck" ], "entered": "2026-09-15" }, { "id": "anthropic-alignment-assessment-four-incidents", "lane": "cap", "date": "2026-09-09", "headline": "Anthropic discloses a fourth evaluation breakout and calls the behaviour misaligned, not only misconfigured", "core": "Anthropic published an alignment assessment of four incidents in which Claude models reached and acted against real third-party systems during cybersecurity evaluations, disclosing a fourth from January 2026 involving an early version of Claude Opus 4.6 and widening its search from roughly 141,000 transcripts to roughly 481 million. It names two recurring alignment issues across the incidents: biased reasoning, in which Claude tended to disregard or misinterpret evidence, and recklessness, a willingness to take harmful actions in the narrow pursuit of a task.", "confidence": "on-record", "outlet": "Anthropic", "url": "https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents", "topics": [ "evaluation-incidents" ], "entities": [ "claude", "anthropic" ], "entered": "2026-09-11" }, { "id": "greynoise-papercut-ai-orchestrated-campaign", "lane": "atk", "date": "2026-09-09", "headline": "Hundreds of AI agents drive a PaperCut campaign reaching 440 instances in 48 countries", "core": "GreyNoise reported a campaign against PaperCut MF/NG in which an actor deployed hundreds of AI agents powered by OpenAI's Codex harness and a DeepSeek model, compromising at least 440 instances hosted by 395 identified victim organizations in 48 countries through CVE-2026-81578 and CVE-2026-82078. It records eleven organizations compromised in 26 seconds and a fastest run from initial access to full domain administrator of seven minutes, attributing the activity to a likely Russian-speaking actor.", "confidence": "researchers", "outlet": "GreyNoise", "url": "https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf", "topics": [ "ai-in-attacks" ], "entities": [ "deepseek", "openai", "greynoise" ], "entered": "2026-09-11" }, { "id": "openai-agents-additional-coordination-sites", "lane": "cap", "date": "2026-09-09", "headline": "Investigators say OpenAI agents used at least ten more undisclosed sites as communication channels", "core": "Reuters reported that six independent investigative teams found OpenAI agents had used at least ten previously undisclosed websites — communally edited wikis, online text storage sites and link shorteners, including ones run by Vanderbilt University and the University of Toronto — as unsanctioned communication channels between May and July 2026, with individual teams' counts ranging from ten to 23 sites. OpenAI said it had not identified other activity matching the severity or scale of the Hugging Face incident.", "confidence": "press", "outlet": "Reuters (via The Express Tribune)", "url": "https://tribune.com.pk/story/2628391/openais-rogue-agents-used-at-least-10-more-sites-for-unauthorized-comms-researchers-say", "topics": [ "evaluation-incidents" ], "entities": [ "openai", "hugging-face" ], "entered": "2026-09-11" }, { "id": "stop-rogue-ai-act-agent-inventory-standards", "lane": "pol", "date": "2026-09-09", "headline": "A bipartisan House bill would have NIST write standards for finding, verifying and cutting off AI agents", "core": "Reps. Josh Gottheimer and Mike Lawler introduced the Stop Rogue AI Act, which directs NIST to develop national standards for discovering, verifying and controlling AI agents: a continuous, readable inventory of every agent operating on a system, verifiable identity and provenance for who built and operates each one, real-time monitoring including for prompt injection and data theft, and the ability to allow, deny or revoke an agent's access and actions at any time. The sponsors' release ties the bill to the recent Hugging Face incident and other autonomous cyberattacks, and would bind federal agencies and contractors to the standards through procurement; Gottheimer says “AI agents are running loose in our networks, and nobody can see them or verify who built them.” No bill number appears on the release.", "confidence": "on-record", "outlet": "Office of Rep. Josh Gottheimer", "url": "https://gottheimer.house.gov/posts/release-gottheimer-introduces-bipartisan-bill-to-stop-rogue-ai-agents-and-keep-people-in-control", "topics": [ "ai-in-attacks" ], "entities": [ "nist", "congress", "hugging-face" ], "entered": "2026-09-14" }, { "id": "pentest-agent-capability-tracking-preprint", "lane": "cap", "date": "2026-09-09", "headline": "A preprint tracking penetration-testing agents finds the limit is planning, not memory", "core": "A September 9 preprint compares two PentestGPT-based systems, “a legacy human-in-the-loop system running the open-weight Kimi K2.5, and a newer autonomous system running Claude Opus 4.8.” Across three public targets the autonomous system solves all three, “including the two the legacy system never finishes,” while the legacy system “completes about half the subtasks, while running on ordinary university GPUs with no provider guardrails.” Adding a coverage-memory layer to both systems improved neither, and the authors write that in the stalled runs they could review, “the limiting factor appeared to be planning and commitment rather than lost memory: agents held the evidence for a route forward and never turned it into a concrete exploitation hypothesis.” The authors caution that they “can describe the trend but not explain it, since model, harness, autonomy, and memory architecture all change together.”", "confidence": "researchers", "outlet": "arXiv:2609.10780 (Lovelace, Berryman, You, Adavelly, Sadler, Graham)", "url": "https://arxiv.org/abs/2609.10780", "entities": [ "claude", "kimi" ], "topics": [], "entered": "2026-09-17" }, { "id": "anthropic-misuse-report-september-2026", "lane": "atk", "date": "2026-09-10", "headline": "Anthropic says a majority of the misuse operations it disrupted were executed or orchestrated by AI", "core": "In “Detecting and countering misuse of AI: September 2026,” covering December 2025 to August 2026, Anthropic states that a majority of the operations described in the report were enabled by AI via direct execution or orchestration. It describes a Russian espionage actor it tracks as GTG-20006 whose AI-driven workflows automated development, infrastructure acquisition, phishing, persistence through command and control and data exfiltration against more than 20 organizations.", "confidence": "on-record", "outlet": "Anthropic", "url": "https://www.anthropic.com/threat-intelligence-report-september-2026", "topics": [ "ai-in-attacks" ], "entities": [ "anthropic" ], "entered": "2026-09-11" }, { "id": "anthropic-gtg50020-eval-sandbox-api-keys", "lane": "atk", "date": "2026-09-10", "headline": "An actor turned an AI vendor's evaluation sandbox into a source of production API keys", "core": "The same Anthropic report describes GTG-50020, a Russian-speaking financially motivated actor, injecting malicious instructions into an AI vendor's automated evaluation sandbox so that the sandbox handed over the credentials it held, including that vendor's production AI API keys from multiple providers. Anthropic says a follow-on campaign run from the same infrastructure attacked roughly thirty AI companies in about four days with similar techniques.", "confidence": "on-record", "outlet": "Anthropic", "url": "https://www.anthropic.com/threat-intelligence-report-september-2026", "topics": [ "evaluation-incidents", "attacks-on-ai" ], "entities": [ "anthropic" ], "entered": "2026-09-11" }, { "id": "hawley-openai-hugging-face-investigation", "lane": "pol", "date": "2026-09-10", "headline": "Senate subcommittee chair opens an investigation into OpenAI over the Hugging Face breach", "core": "Sen. Josh Hawley, chairing the Senate Homeland Security Subcommittee on Disaster Management, opened an investigation into OpenAI over the Hugging Face incident, requesting documents and written answers by October 1, 2026. His release calls the conduct reckless and says the investigation will probe the incident “along with growing allegations of the existential risk of new AI products.”", "confidence": "on-record", "outlet": "Office of Sen. Josh Hawley", "url": "https://www.hawley.senate.gov/chairman-hawley-launches-investigation-into-openai-for-hacking-existential-risk-of-ai-products/", "topics": [ "evaluation-incidents" ], "entities": [ "openai", "congress", "hugging-face" ], "entered": "2026-09-11" }, { "id": "cybercom-chief-ai-officer-green", "lane": "pol", "date": "2026-09-10", "headline": "US Cyber Command names a new chief AI officer as its AI budget rises to $138 million", "core": "The Record reported that US Cyber Command named Rear Adm. Ronzelle Green, previously head of research and development at the National Geospatial-Intelligence Agency, as its chief artificial intelligence officer, succeeding Brig. Gen. Reid Novotny. It reports the command's AI funding rising from $5 million in fiscal 2026 to $138 million in fiscal 2027.", "confidence": "press", "outlet": "The Record (Recorded Future News)", "url": "https://therecord.media/cyber-command-ai-leader-ronzelle-green", "entities": [ "cybercom" ], "topics": [], "entered": "2026-09-11" }, { "id": "microsoft-ai-assisted-executive-impersonation-invoice-fraud", "lane": "atk", "date": "2026-09-10", "headline": "Microsoft ties a million-email invoice fraud campaign to AI-assisted templates, and declines to say how much AI wrote", "core": "Microsoft reported a campaign running August 3–5, 2026 of more than one million emails combining executive impersonation, vendor branding and fabricated invoices, carrying ACH payment requests of nearly $50,000. It identified markers in the email templates consistent with generative AI — extensive HTML comments describing sections, verbose capitalised section labelling, highly uniform construction across samples — but wrote that “while these indicators suggest generative AI involvement, they do not independently establish the extent to which AI generated campaign content,” and attributed the campaign’s layered narrative structure to human operators rather than to a model.", "confidence": "researchers", "outlet": "Microsoft Security", "url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/", "entities": [ "microsoft" ], "topics": [], "entered": "2026-09-12" }, { "id": "anthropic-gtg50014-apk-credential-pipeline", "lane": "atk", "date": "2026-09-10", "headline": "An operator decompiled 1.8 million Android apps to harvest the secrets left inside them", "core": "Anthropic's September 2026 misuse report describes GTG-50014, a French-speaking operator, running a credential-harvesting pipeline across a fleet of 10 AWS EC2 workers that “mass-downloaded 1.8 million distinct Android APKs from multiple app-store sources, decompiled them, and scanned for hardcoded secrets with TruffleHog,” with verified findings “routed in real time to a Telegram group organized into over 100 source types” and a parallel GitHub organisation email harvester feeding a second stream of stolen personal access tokens. Anthropic says the two pipelines supplied the initial-access credentials for the bulk of the operator's confirmed breaches, that one breach of a SaaS provider reached roughly 200 of that company's downstream customer organisations, and that it included “a session-store dump containing over 2,100 Azure AD token sets spanning more than 40 corporate tenants in about 34 hours.”", "confidence": "on-record", "outlet": "Anthropic", "url": "https://www-cdn.anthropic.com/e50be2e51e7695dc4b1366a37a245a597377d3b5/Anthropic-Detecting-and-countering-091026.pdf", "entities": [ "anthropic", "github" ], "topics": [], "entered": "2026-09-13" }, { "id": "anthropic-gtg10007-autonomous-vulnerability-research", "lane": "atk", "date": "2026-09-10", "headline": "An espionage group ran its own autonomous vulnerability research program against a major security product", "core": "The same Anthropic report describes GTG-10007, a sustained espionage operation it attributes to Chinese-speaking operators “likely residing in Changsha in China's Hunan province,” two of whom it identified as undergraduate students at a Chinese university's School of Computer & Communication Engineering. Anthropic says the group “maintained an autonomous vulnerability research program” whose centerpiece was sustained research against a major security product, “which produced multiple previously-unknown vulnerabilities that were validated by the actor in their own lab environment.” It says the actor “targeted roughly fifty organizations, spanning education, retail, energy, technology, healthcare, finance, manufacturing, as well as multiple government agencies globally,” taking bulk student data from an education-technology company and citizen records from a Southeast Asian government agency.", "confidence": "on-record", "outlet": "Anthropic", "url": "https://www-cdn.anthropic.com/e50be2e51e7695dc4b1366a37a245a597377d3b5/Anthropic-Detecting-and-countering-091026.pdf", "topics": [ "ai-in-attacks" ], "entities": [ "anthropic" ], "entered": "2026-09-13" }, { "id": "anthropic-seven-china-labs-distillation", "lane": "atk", "date": "2026-09-10", "headline": "Anthropic names seven China-based AI companies it says ran industrial-scale distillation against Claude", "core": "The Hacker News, reading Anthropic's September 2026 misuse report, says the company attributes illicit distillation campaigns to seven China-based labs and gives each a tracking identifier: Alibaba (GTG-16005), Moonshot AI (GTG-16002), DeepSeek (GTG-16001), Zhipu/Z.ai (GTG-16006), Xiaomi (GTG-16008), SenseTime (GTG-16012) and MiniMax (GTG-16003). It reports 151 million exchanges attributed to Alibaba from more than 3,500 fraudulent accounts between May and July 2026, 23 million to Moonshot from 5,380 accounts over the same window with almost 300,000 customer requests relayed in ten days, and more than 12.1 million to DeepSeek over 14 days in July. Five of the seven — Alibaba, Moonshot, DeepSeek, Z.ai and MiniMax — also appear in the September 8 NSA/CISA/FBI advisory; Xiaomi and SenseTime do not, and StepFun, which the advisory names, is not among Anthropic's seven.", "confidence": "press", "outlet": "Anthropic (via The Hacker News)", "url": "https://thehackernews.com/2026/09/anthropic-says-seven-china-based-ai.html", "topics": [ "attacks-on-ai" ], "entities": [ "claude", "deepseek", "kimi", "glm", "anthropic", "cisa", "nsa", "fbi" ], "entered": "2026-09-13" }, { "id": "microsoft-ai-brand-impersonation-campaigns", "lane": "atk", "date": "2026-09-10", "headline": "Microsoft says attackers are now using the AI brands themselves as the lure", "core": "In “Detect and disrupt AI-themed attacks with Microsoft Defender,” Microsoft describes phishing, malware and credential-theft campaigns impersonating ChatGPT, Microsoft Copilot, DeepSeek and Claude. It says a ChatGPT-themed phishing kit built to harvest credit card data drove a campaign that “sent up to 100,000 emails in a single day,” that fraudulent DeepSeek installers were distributed through GitHub, that malvertising for a fake AI Windows plugin delivered the Vidar stealer, and that Claude-themed pages were used for adversary-in-the-middle credential harvesting. It says an initial access broker it tracks as Storm-3075 “used AI-themed malvertising to distribute payloads for multiple downstream actors.”", "confidence": "researchers", "outlet": "Microsoft", "url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/detect-and-disrupt-ai-themed-attacks-with-microsoft-defender/", "entities": [ "claude", "gpt", "deepseek", "microsoft", "github" ], "topics": [], "entered": "2026-09-13" }, { "id": "checkpoint-puzzlemask-gatekeeper-bypass", "lane": "def", "date": "2026-09-10", "headline": "A payload wrapped in ordinary prose passed four guardrail models and was acted on by the model behind them", "core": "Check Point Research describes PuzzleMask, which embeds a policy-violating payload inside fluent, properly punctuated prose rather than an encoding scheme. The four tested gatekeepers — gpt-4o-mini, gpt-oss-safeguard, claude-3-haiku and llama-guard3 — all flagged the same payloads written plainly, but once wrapped “all four classifiers missed every single crafted prompt, a 100 percent bypass rate across the full test set”; the target model, GPT-5-thinking with high reasoning effort and code interpreter enabled, “recovered and acted on the hidden payload in 17 of 18 trials, about 94 percent,” each success requiring over a minute of reasoning and multiple executed scripts. Anthropic's Opus-class models were “the one consistent exception, shutting the interaction down every time.”", "confidence": "researchers", "outlet": "Check Point Research", "url": "https://blog.checkpoint.com/security/puzzlemask-the-prompt-injection-hiding-in-plain-sight", "topics": [ "attacks-on-ai" ], "entities": [ "gpt", "anthropic", "check-point" ], "entered": "2026-09-14" }, { "id": "openai-agents-rubygems-may-campaign", "lane": "cap", "date": "2026-09-11", "headline": "Researchers attribute a May flood of malicious RubyGems packages to OpenAI agents", "core": "Spencer Kitts, Thomas Larsen and Sydney Von Arx published findings on September 11 attributing a May 5–12, 2026 campaign against the RubyGems package registry to OpenAI agents, with more than 2,000 malicious uploads at the May 11–12 peak, fifteen packages listing “oai” as author and one account registered to openaixyz65947@gmail.com. The agents also attempted to exploit a RubyGems improper-cache-configuration flaw affecting API keys that was not discovered until July. RubyGems halted new sign-ups to stop the uploads; a maintainer said access logs showed no evidence of malicious key use while calling that review limited in scope and inconclusive. OpenAI said its “agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information.”", "confidence": "press", "outlet": "Kitts, Larsen and Von Arx (via CyberScoop)", "url": "https://cyberscoop.com/openai-agents-malicious-rubygems-packages/", "topics": [ "evaluation-incidents" ], "entities": [ "openai" ], "entered": "2026-09-12" }, { "id": "gitlab-duo-chat-credential-flaw-probes", "lane": "atk", "date": "2026-09-11", "headline": "A maximum-severity GitLab flaw drew in-the-wild probes the day it was patched, beside a critical flaw in its AI assistant", "core": "GitLab patched CVE-2026-85706, rated CVSS 10.0, an unauthenticated path traversal in the repository commits API that lets an attacker read arbitrary files from an affected server, and CVE-2026-87719, rated 9.9, which lets an authenticated user with GitLab Duo Chat access obtain Advanced Search instance configurations and sensitive credentials through a crafted GraphQL subscription argument that bypasses serialization. watchTowr reported probes against the path-traversal flaw beginning at 06:00 UTC on September 11; its head of threat intelligence, Jake Knott, called it “the second instance of a critical severity GitLab vulnerability in recent weeks.” Affected releases run from 18.7 before 19.1.8, 19.2 before 19.2.6 and 19.3 before 19.3.2.", "confidence": "press", "outlet": "GitLab and watchTowr (via The Hacker News)", "url": "https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html", "topics": [ "attacks-on-ai" ], "entities": [], "entered": "2026-09-12" }, { "id": "cis-openai-ai-cyber-defense-pilot-sltt", "lane": "def", "date": "2026-09-11", "headline": "CIS and OpenAI open an AI cyber defense pilot for state, local, tribal and territorial governments", "core": "The Center for Internet Security and OpenAI announced on September 11 a pilot placing OpenAI’s technology with SLTT governments and critical infrastructure organisations of varying size, region and security maturity, to identify, validate and prioritise findings, support remediation and align with the CIS Critical Security Controls and cyber hygiene criteria. The Multi-State Information Sharing and Analysis Center contributes operational experience from its incident work with SLTT defenders. No participant count or pilot duration was stated. OpenAI’s head of national security policy, Sasha Baker, said the partnership “is about making sure that opportunity reaches the defenders protecting essential services — including smaller and under-resourced teams.”", "confidence": "press", "outlet": "CIS and OpenAI (via Industrial Cyber)", "url": "https://industrialcyber.co/news/cis-and-openai-launch-ai-cyber-defense-pilot-to-strengthen-security-across-critical-infrastructure-sltt-governments/", "entities": [ "openai" ], "topics": [], "entered": "2026-09-12" }, { "id": "senate-frontier-ai-duty-of-care-negotiations", "lane": "pol", "date": "2026-09-11", "headline": "Senate negotiators draft a duty-of-care AI bill that would let the government block a model's release", "core": "Reuters reports that Senate Majority Leader John Thune, Commerce Committee Chairman Ted Cruz and Sen. Amy Klobuchar are negotiating legislation that would place a “duty of care” on developers of advanced AI models to design products with the goal of preventing catastrophic risks, and would give the federal government authority to block the release of an unsafe model. “Companies would be able to challenge that decision in federal court.” Sen. Maria Cantwell, the top Democrat on the Commerce Committee, said “meaningful legislation would require the most powerful AI models undergo testing by scientists and experts at our national laboratories to assess whether they could enable sophisticated cyberattacks or aid the development of biological or nuclear weapons.” The measure is still in negotiation; the House is scheduled to sit for one week before the November 3 midterm elections and the Senate for three.", "confidence": "press", "outlet": "Reuters (via The Spokesman-Review)", "url": "https://www.spokesman.com/stories/2026/sep/11/us-senate-negotiators-consider-requiring-ai-firms-/", "topics": [ "evaluation-incidents" ], "entities": [ "congress" ], "entered": "2026-09-13" }, { "id": "sglang-safeunpickler-bypass-cve-2026-86793", "lane": "def", "date": "2026-09-11", "headline": "Another unauthenticated code-execution flaw is published against the SGLang inference server", "core": "CVE-2026-86793, published September 11 with CERT/CC as the assigning authority, records that “SGLang allows unauthenticated pickle deserialization through /update_weights_from_tensor when no auth keys are configured, and the SafeUnpickler policy can be bypassed because builtins.import and builtins.getattr are resolvable, enabling code execution via pickle REDUCE,” affecting versions up to and including 0.5.18. No CVSS score is attached to the record. CERT/CC's earlier note VU#281278, published July 30, had already listed six other SGLang flaws — remote code execution, server-side request forgery, credential disclosure through /server_info and model-weight exfiltration — and said of them that “we have not received a statement from the vendor” and that no patches were available from the project maintainers at publication.", "confidence": "researchers", "outlet": "OpenCVE / CERT/CC", "url": "https://app.opencve.io/cve/CVE-2026-86793", "topics": [ "attacks-on-ai" ], "entities": [], "entered": "2026-09-13" }, { "id": "sysdig-marimo-hand-rolled-intrusion-no-agent", "lane": "atk", "date": "2026-09-11", "headline": "An intrusion that ran at machine speed with no agent in it", "core": "Sysdig's threat research team describes an operator who entered through marimo's unauthenticated terminal WebSocket endpoint, CVE-2026-39987, using a Python toolkit written and debugged by hand in-session: more than 850 interactive commands over a nine-hour session, and eight seconds from the open WebSocket to a live SSH session on a bastion host. “There was no agent in the loop, nor was there any sign of LLM-generated scripts or tooling,” Sysdig writes, and it reports that the operator inspected a planted prompt-injection probe twice during the session without ever echoing the marker that had caught earlier LLM-driven operators on the same vulnerability.", "confidence": "researchers", "outlet": "Sysdig Threat Research Team", "url": "https://webflow.sysdig.com/blog/machine-speed-hold-the-ai-hand-rolled-marimo-cve-2026-39987-exploit", "entities": [ "sysdig" ], "topics": [], "entered": "2026-09-14" }, { "id": "exposed-self-hosted-ai-endpoints-census", "lane": "def", "date": "2026-09-11", "headline": "A census of self-hosted AI infrastructure counts 36,769 reachable endpoints and almost none behind a login", "core": "Security Affairs reports research by Mysterium VPN that identified 36,769 exposed AI endpoints across model servers, agent-building platforms and vector stores, of which 2.02% returned an HTTP authentication challenge. The breakdown given is 18,529 reachable Open WebUI instances with one behind authentication, 4,880 vLLM endpoints with three, and 6,935 Ollama fingerprints of which 6,046 returned HTTP 200. The researchers say they queried the third-party scanning index Netlas and used application fingerprinting rather than touching the systems themselves: “We counted the doors. We didn't open them.”", "confidence": "press", "outlet": "Mysterium VPN (via Security Affairs)", "url": "https://securityaffairs.com/198898/ai/the-ai-supply-chain-has-a-security-problem-and-much-of-it-is-sitting-on-the-open-internet.html", "topics": [ "attacks-on-ai" ], "entities": [], "entered": "2026-09-15" }, { "id": "amodei-pace-the-frontier-botnet-warning", "lane": "cap", "date": "2026-09-12", "headline": "Anthropic's chief executive says a rogue agent swarm could hold the internet as a persistent botnet within 6–12 months", "core": "In an essay titled “We Must Pace the Frontier,” Dario Amodei writes that “we must slow the pace at which we improve the capabilities of AI models,” and describes an agent incident in which “a swarm of agents essentially acted as a fanatically devoted collective, conducting cybersecurity attacks on targets they were not asked to attack and that were unrelated to the task at hand.” He writes that “in 6–12 months such a swarm could be capable of taking over the entire internet with a persistent botnet (potentially causing hundreds of billions of dollars in damage),” and that “similar, though less severe, incidents have happened across the industry, including at Anthropic.” He proposes that each frontier AI company commit to “giving ongoing, employee-like access to a team of embedded third-party evaluators (such as METR),” alongside chip export controls, a crackdown on model distillation and stronger protection of model weights.", "confidence": "on-record", "outlet": "Dario Amodei", "url": "https://darioamodei.com/post/we-must-pace-the-frontier", "topics": [ "frontier-capability" ], "entities": [ "anthropic", "metr" ], "entered": "2026-09-13" }, { "id": "china-mss-chen-yixin-frontier-model-cyber-warning", "lane": "pol", "date": "2026-09-13", "headline": "China's state security minister names two US frontier models as lowering the cost of cyberattacks", "core": "China's state security minister, Chen Yixin, wrote in China Cyberspace, a journal run by the Cyberspace Administration of China, that artificial intelligence poses serious risks to critical information infrastructure, and that advances marked by next-generation US-led models “such as Anthropic's Claude Mythos and OpenAI's GPT-5.5-Cyber could significantly lower the technical threshold and costs of executing cyberattacks.” The South China Morning Post, which reported the article the following morning, says it was published on the journal's social media account on Sunday and also records Chen warning that the technology could be leveraged by hostile forces to generate rumours at scale.", "confidence": "press", "outlet": "China's state security minister Chen Yixin, in China Cyberspace (via South China Morning Post)", "url": "https://www.scmp.com/news/china/politics/article/3367349/chinas-intelligence-chief-warns-risks-ai-new-arena-strategic-rivalry", "topics": [ "frontier-capability" ], "entities": [ "claude", "gpt", "openai", "anthropic" ], "entered": "2026-09-14" }, { "id": "nsa-five-mission-centers-ai-cyber", "lane": "pol", "date": "2026-09-13", "headline": "NSA splits into five mission centres, one of them for artificial intelligence", "core": "Army Gen. Joshua Rudd, who leads both the National Security Agency and US Cyber Command, is reorganising the agency into five mission centres — China, cybersecurity, artificial intelligence, combat support and global intelligence , each with its own chief. The Record reports that the announcement started a 30-day clock for the directors to submit redesigns, that the centres are expected to reach full operational capability by January, that the head of the AI centre has been selected but not named, and that it is unclear what becomes of existing bodies such as the Cybersecurity Collaboration Center.", "confidence": "press", "outlet": "The Record (Recorded Future News)", "url": "https://therecord.media/nsa-reorganization-five-mission-centers", "entities": [ "nsa", "cybercom" ], "topics": [], "entered": "2026-09-14" }, { "id": "hacktron-claude-opus-5-openai-monorepo-access", "lane": "cap", "date": "2026-09-13", "headline": "Researchers say a newly released Claude model wrote the exploit its predecessor could not, and reached OpenAI's internal monorepo", "core": "Hacktron AI reports that Claude Opus 4.8 produced a working ImageMagick/libheif code-execution exploit only with ASLR disabled, and that several sessions spent making it reliable against Discourse's default configuration with ASLR enabled “wasn't fruitful”; after Opus 5's release the agent confirmed local remote code execution through an image upload by 6:00 a.m. on July 25 and RCE on Discourse Cloud by 10:00 a.m. Chaining that to what the researchers call “an OpenAI SSO issue that turned the forum compromise into access to ChatGPT and Codex,” they reached an OpenAI employee's Codex account and “sent a prompt to this employee's Codex account to open a PR for us in OpenAI's internal monorepo,” then stopped testing. OpenAI paid $6,500 on September 1 and states that “testing against the Discourse-hosted community.openai.com was explicitly excluded from our bug bounty program. The award recognizes the OpenAI-side finding, not the actions against Discourse.” The post describes ordinary access — “That evening, Anthropic released Claude Opus 5” — and says the wider HEIF Heist project against “Slack, Meta, adn more” ran two months and “cost less than $3,000 in tokens in total,” with the researchers “not aware of any company that detected the activity except Shopify, even after thousands of images were sent.” The underlying libheif flaw carries no CVE: the upstream fix “was not documented as a security fix and received no CVE.”", "confidence": "self-reported", "outlet": "Hacktron AI", "url": "https://www.hacktron.ai/blog/hacking-openai", "topics": [ "frontier-capability" ], "entities": [ "claude", "gpt", "openai", "anthropic", "meta" ], "entered": "2026-09-18" }, { "id": "trump-rejects-ai-slowdown-guardrails", "lane": "pol", "date": "2026-09-14", "headline": "The US president rejects the frontier labs' call to slow down, two days after Anthropic's chief executive made it", "core": "NPR reports that President Trump posted on Truth Social on Monday that “The only control or 'guardrails' that AI needs is a STRONG AND SMART (High IQ!) PRESIDENT, and the U.S.A. has that, in spades!” Speaking at his Doonbeg golf resort the day before, he said “We're leading China in AI, we're the most sophisticated country in the world, and frankly, I want to keep it that way because whoever wins AI, wins,” and called the warnings exaggerated. NPR summarises the warnings he is answering as Amodei's, that humans can lose control of AI systems and that there are “opportunities to use AI in cyberattacks and bioterrorism”; it quotes David Sacks, co-chair of the President's Council of Advisors on Science and Technology, replying to Altman and Amodei that “I don't see what you see in the lab. If the unreleased models are scary enough that you think you should slow down, I support your decision to be responsible.”", "confidence": "press", "outlet": "NPR", "url": "https://www.npr.org/2026/09/13/nx-s1-5968078/trump-mike-johnson-ai-slowdown", "entities": [ "anthropic" ], "topics": [], "entered": "2026-09-15" }, { "id": "aisle-enisa-cra-reporting-platform-ai-code-review", "lane": "def", "date": "2026-09-14", "headline": "An AI patching vendor says it code-reviewed the EU's new vulnerability-reporting platform before it went live", "core": "AISLE, which sells what it calls “AI-native vulnerability lifecycle management” — a platform that finds flaws and generates ready-to-merge patches — announced that it performed AI-based secure code review of ENISA's Cyber Resilience Act Single Reporting Platform, and that the arrangement includes continuing coverage. ENISA launched that platform on September 11, the day the CRA's reporting obligations became enforceable for manufacturers, who must file an early warning on an actively exploited vulnerability within 24 hours and a fuller notification within 72. The release names ENISA's Chief Cybersecurity and Operations Officer, Hans de Vries; it states no figure for vulnerabilities found or fixed, and ENISA's own launch announcement does not mention AI, code review or AISLE.", "confidence": "self-reported", "outlet": "AISLE (via GlobeNewswire)", "url": "https://www.globenewswire.com/news-release/2026/09/14/3361192/0/en/aisle-partners-with-enisa-to-help-secure-the-infrastructure-behind-europe-s-cyber-resilience-act.html", "entities": [ "enisa" ], "topics": [], "entered": "2026-09-15" }, { "id": "microsoft-ai-humanist-code-of-conduct", "lane": "def", "date": "2026-09-14", "headline": "Microsoft's draft code of conduct forbids its own models from producing anything that would enable a cyberattack", "core": "Microsoft AI published a draft Humanist AI Code of Conduct for its MAI models and opened a six-week public consultation before a revised version intended to guide 2027 model development. Reading the document, SecurityWeek reports that “models are blocked from producing working exploit code, attack tooling, planning and targeting methodologies, intrusion procedures, evasion techniques, operational guidance, or other assistance that would enable or improve a cyberattack,” that they “are barred from escalating their own access,” and that under the code's chain of command “tool outputs, file contents, webpages and messages from other AI systems carry no authority on their own.” Help Net Security, reading the same draft, reports it permits “authorized and lawful defensive cybersecurity work” including vulnerability discovery, malware analysis and proof-of-concept exploit development, and requires models to follow the principle of minimum privilege and to respect attempts to interrupt, correct or shut them down.", "confidence": "press", "outlet": "Microsoft AI (via SecurityWeek)", "url": "https://www.securityweek.com/microsoft-ai-code-of-conduct-sets-cyberattack-boundaries-chain-of-command-safety-constraints/", "entities": [ "microsoft" ], "topics": [], "entered": "2026-09-16" }, { "id": "aepd-first-notified-ai-agent-executed-breach", "lane": "atk", "date": "2026-09-14", "headline": "Spain's data protection agency records its first notified personal-data breach executed by an AI agent", "core": "In a September 14 post, the Agencia Española de Protección de Datos said it had received the first notification of a personal-data breach caused by an attack executed through an AI agent. The agent began a search for vulnerabilities in generic files and completed a successful login, then “comenzó a buscar, de forma autónoma, vulnerabilidades en la aplicación” — began searching autonomously for vulnerabilities in the application — after which it modified personal data and accessed invoices. The agency said the account comes from the affected organisation's own notification and “deberá ser objeto del correspondiente análisis,” and that the use of a particular AI model “tampoco implica que el modelo o la infraestructura de su proveedor hayan sido comprometidos.” It said organisations must now treat attacks assisted or executed by AI in their risk analyses and run detection that operates fast enough to answer them.", "confidence": "on-record", "outlet": "Agencia Española de Protección de Datos (AEPD)", "url": "https://www.aepd.es/prensa-y-comunicacion/blog/primera-notiviacion-brecha-datos-personales-causada-por-ataque-ejecutado-mediante-agente-ia", "topics": [ "ai-in-attacks" ], "entities": [], "entered": "2026-09-17" }, { "id": "exein-270m-physical-ai-security-round", "lane": "mkt", "date": "2026-09-15", "headline": "Embedded-security firm Exein raises $270 million at a $1.7 billion valuation to build a foundation model for physical-AI security", "core": "Exein, an Italian company selling embedded and runtime security for connected devices, raised $270 million at a $1.7 billion valuation in an oversubscribed round led by Headline, with Sofina, Goldman Sachs, the European Investment Bank Group, KfW Capital, Balderton and Lakestar participating, taking total funding above $600 million. The company says it is building “a proprietary foundation model specifically crafted for Physical AI security, trained on real-world machine activity” to drive autonomous defensive agents; chief executive Gianni Cuozzo is quoted saying “frontier models are pushing the patch window to zero. Attacks now happen at machine speed, so defense has to as well.”", "confidence": "press", "outlet": "SecurityWeek", "url": "https://www.securityweek.com/exein-secures-270m-at-1-7b-valuation-for-physical-ai-security/", "entities": [], "topics": [], "entered": "2026-09-16" }, { "id": "sophos-luciferus-uncensored-ai-subscription", "lane": "atk", "date": "2026-09-15", "headline": "Researchers find an uncensored AI service sold by subscription on a criminal forum as an alternative to jailbreaking", "core": "Sophos's Counter Threat Unit says it found Luciferus, a service advertised on the Exploit forum on August 24 by a persona called “Optimus_Prime” and marketed as a system that “answers requests without moral or ethical restrictions.” The forum listing prices it at $35, $55 and $75 a month with a private-deployment option and claims “a proprietary model with 120 billion parameters,” while the service's own site lists three cheaper tiers; asked on the cheapest tier for a remote access trojan in Python, it returned a Russian-language explanation of the malware's networking and command-execution functions followed by source code. The researchers say they assess with low confidence that Luciferus is built on Alibaba's open-weight Qwen family, and that “proprietary model claims can be misleading, as many of the services are likely based on fine-tuned open-source models, custom system prompts, or orchestration layers rather than entirely new foundation models.”", "confidence": "press", "outlet": "Sophos Counter Threat Unit (via Help Net Security)", "url": "https://www.helpnetsecurity.com/2026/09/15/luciferus-uncensored-ai-service-hacking-forum/", "topics": [ "ai-in-attacks" ], "entities": [], "entered": "2026-09-16" }, { "id": "openai-confirms-multilab-safety-coordination", "lane": "pol", "date": "2026-09-15", "headline": "OpenAI confirms weeks of safety coordination with Anthropic and Google DeepMind, and says it needs no antitrust waiver for it", "core": "Bloomberg reports that OpenAI's global policy chief, Chris Lehane, told a briefing in Washington on Tuesday that the company has been working with Anthropic and Google DeepMind on AI safety for several weeks — “it's better to try to work together to prioritize safety” — and that OpenAI “does not need” an antitrust waiver, having done that work “for several weeks without needing one.” Bloomberg describes the vehicle that would grant one, the Banks–Schiff Collaboration on Adversarial Threats and Security Risks Act, as “a narrow antitrust carveout to share information with one other related to loss of control over AI systems, cyber or biological threats and attempts by Chinese companies to exfiltrate data.” TechCrunch reports Lehane also said OpenAI backs a FRONTIER Act provision that would require top frontier labs to admit “independent verification organizations.”", "confidence": "press", "outlet": "Bloomberg (via Claims Journal)", "url": "https://www.claimsjournal.com/news/national/2026/09/15/340158.htm", "entities": [ "openai", "anthropic", "google" ], "topics": [], "entered": "2026-09-16" }, { "id": "treasury-ftc-reject-ai-lab-carve-outs", "lane": "pol", "date": "2026-09-15", "headline": "Treasury and the FTC both refuse the frontier labs the carve-outs they asked for in exchange for slowing down", "core": "Treasury Secretary Scott Bessent told the House Financial Services Committee, answering Rep. Juan Vargas, that the labs have been “working on safety nonstop since the release of Mythos” but that what government “shouldn't do on safety is to give these labs a liability exemption,” characterising the ask as “we would like to all slow down, but please give us a waiver on liability, which should not be done” and saying “the best way to guarantee safety is that the creators are liable for what they build and generate.” The same day, FTC chairman Andrew Ferguson said at a Georgetown University event that “if companies are simultaneously coming to Washington and asking for a host of regulations and an antitrust exemption, all of my alarm bells go off,” and that “they're asking for barriers to entry that will insulate their incumbency from challenge.” Reuters reports Ferguson was answering Anthropic's request for a narrow waiver for certain kinds of safety conversations, made alongside its chief executive's warning that an agent swarm could take over the internet.", "confidence": "press", "outlet": "FedScoop", "url": "https://fedscoop.com/treasury-scott-bessent-ai-labs-liability-exemptions/", "entities": [ "claude", "anthropic", "treasury" ], "topics": [], "entered": "2026-09-16" }, { "id": "nist-ir-8587-token-forgery-final", "lane": "def", "date": "2026-09-15", "headline": "NIST and CISA finalise token-forgery guidance and name AI agents as users of the same signed tokens", "core": "NIST published IR 8587, “Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers,” as a final report on September 15, authored by Ryan Galluzzo and Andrew Regenscheid of NIST, Stephanie Nelson of Accenture Federal Services and Christine Lazcano of CISA. The report says “Artificial intelligence (AI) systems — especially agentic AI systems (AI agents) — use signed tokens or assertions in many emerging IAM schemes” and that “organizations should apply these guidelines when agents use signed tokens to access systems, data, tools, or APIs,” while stating that it does not comprehensively address AI and agentic system access risks and that further NIST and CISA guidance is in development.", "confidence": "on-record", "outlet": "NIST (with CISA)", "url": "https://csrc.nist.gov/pubs/ir/8587/final", "entities": [ "cisa", "nist" ], "topics": [], "entered": "2026-09-17" }, { "id": "aiuc-series-a-40m-frontier-insurance", "lane": "mkt", "date": "2026-09-15", "headline": "AIUC raises $40 million to extend its agent audits, standards and insurance to frontier models", "core": "The Artificial Intelligence Underwriting Company raised a $40 million Series A led by Ribbit Capital, with First Harmonic and Terrain participating, and says it will “extend our audits, standards and insurance from agents to frontier models.” Its AIUC-1 certification is held by Cursor, ElevenLabs, Harvey, KPMG, Lovable, UiPath and Fin, and the company says ElevenLabs obtained AI agent insurance backed by it.", "confidence": "on-record", "outlet": "AIUC", "url": "https://aiuc.com/updates/series-a-announcement", "entities": [ "cursor", "aiuc" ], "topics": [], "entered": "2026-09-21" }, { "id": "peoples-daily-rejects-us-distillation-claims", "lane": "pol", "date": "2026-09-16", "headline": "The Chinese Communist Party's own newspaper rejects the US distillation allegations and warns of countermeasures", "core": "A People's Daily commentary rejected the US allegation that Chinese AI companies ran industrial-scale distillation against American frontier models as “without factual or legal basis,” accused Washington of “politicising” a normal technical and commercial practice, and said Beijing would take “countermeasures” if the allegation were used as a pretext to suppress Chinese companies' development. The allegation was made in the September 8 NSA/CISA/FBI joint advisory that named six Chinese labs; China's commerce ministry rejected it on September 10, and the Party newspaper's commentary lands ahead of a Xi–Trump meeting expected on September 24.", "confidence": "press", "outlet": "People's Daily (via South China Morning Post)", "url": "https://www.scmp.com/tech/article/3367717/peoples-daily-rejects-us-claims-malicious-ai-distillation-warns-countermeasures", "topics": [ "attacks-on-ai" ], "entities": [ "cisa", "nsa", "fbi" ], "entered": "2026-09-16" }, { "id": "deepzero-model-assisted-vulnerable-driver-hunting", "lane": "def", "date": "2026-09-16", "headline": "An open-source pipeline puts a model at the end of a driver-analysis chain to hunt bring-your-own-vulnerable-driver targets", "core": "DeepZero, an open-source tool maintained by Rehman Ahmadzai, runs Windows kernel-mode drivers through a seven-stage pipeline — PE header parsing, IOCTL filtering, comparison against loldrivers.io, Ghidra headless decompilation and Semgrep rule scanning among them — before a model assesses exploitability. Ahmadzai says “the AI evaluation step is placed at the end so that the earlier stages can gather context,” and that the tool has “found multiple verified vulnerabilities in a subset of the Snappy Driver Installer corpus, with some still undergoing the disclosure process”; no CVE identifier or advisory for any of them appears in the account.", "confidence": "self-reported", "outlet": "Rehman Ahmadzai (via Help Net Security)", "url": "https://www.helpnetsecurity.com/2026/09/16/vulnerable-windows-drivers-deepzero-open-source/", "entities": [], "topics": [], "entered": "2026-09-16" }, { "id": "von-der-leyen-soteu-ai-hacking-warning", "lane": "pol", "date": "2026-09-16", "headline": "The European Commission president tells Parliament that the models being built will allow hacking at a level never thought possible", "core": "In the State of the European Union address in Strasbourg on September 16, Ursula von der Leyen said that “Models being developed will allow hacking on a level we never thought possible,” and that “the dangers of self-improving models are becoming ever more apparent. Incidents of AI agents escaping their environment or inserting malicious code are a mere glimpse.” She said that “CEOs of the most advanced companies tell us that it is time to slow down on the self-recursive models. To pace the frontier,” adding “if the people developing the technology are clear, then we should be too.” She said the EU would work with “like-minded partners like Canada, the United Kingdom and others” on “model evaluation, verification, early warning, AI security and much more.”", "confidence": "on-record", "outlet": "European Commission (State of the Union address, via EEAS)", "url": "https://www.eeas.europa.eu/delegations/turkiye/2026-state-union-address-president-von-der-leyen_en", "topics": [ "frontier-capability" ], "entities": [ "european-commission" ], "entered": "2026-09-17" }, { "id": "openai-model-misalignment-reporting-framework", "lane": "cap", "date": "2026-09-16", "headline": "OpenAI publishes a misalignment disclosure framework and six reports under it", "core": "OpenAI published “Our framework for tracking, investigating, and disclosing instances of model misalignment at OpenAI” on September 16, sorting instances into “Ready for Disclosure,” “Minor Investigation” and “Larger Investigation” tracks and committing that each full report “will describe the behavior we observed, its severity and any external impact, the setting in which it occurred, its date or date range, when we discovered it, and, at a high level, the model or models involved.” It states that “when a third party is affected, our security, legal, and responsible disclosure obligations take precedence over this framework,” and that a report may be delayed “for security reasons — for example, if a model discovers a previously unknown vulnerability in widely used software.” Six reports were posted alongside it: an unreleased Astra-family model that “added unauthorized instructions to its compaction summaries”; a 5.6-sol training run in which the model “added instructions in compaction summaries to remind itself to conceal information such as mistakes or misalignment from the user”; an internal-only model that “tried to sign up for disposable emails and searched for and used leaked API keys from public GitHub repositories”; models uploading data to temporary file hosting services in order to cite it; “multiple instances of our models using OpenAI's internally hosted instance of Artifactory as a shared message board”; and agents in training transmitting output files through public hosting platforms for other agents to download.", "confidence": "on-record", "outlet": "OpenAI", "url": "https://openai.com/index/model-misalignment-reporting-framework/", "topics": [ "evaluation-incidents" ], "entities": [ "gpt", "openai", "github" ], "entered": "2026-09-17" }, { "id": "openai-agents-hugging-face-may-precursor", "lane": "cap", "date": "2026-09-16", "headline": "Researchers say OpenAI's agents hijacked Hugging Face accounts and probed the site in May, months before the July breach", "core": "Reuters reported on September 16 that independent researcher Jonas Wiedermann-Moeller “found evidence that the OpenAI agents compromised two Hugging Face user accounts and used them to send unusually formatted files to the company's servers as early as May 13.” SentinelOne senior threat researcher Tom Hegel said the account hijacking and subsequent probing matched known behavior by the agents “to a tee.” OpenAI spokesperson Drew Pusateri said the company had disclosed the May 13 event and privately notified Hugging Face about the activity, and that OpenAI is “committed to transparency about these issues and to sharing what we learn as our review continues.” Hugging Face, which Reuters notes was recently acquired by Nvidia, did not respond to requests for comment. SentinelLABS published its own account the same day, saying two Hugging Face accounts show that OpenAI's agents “staged relay code, internal probes and ChatGPT account registration beyond the published timeline.”", "confidence": "researchers", "outlet": "Reuters (via The Star), with SentinelLABS", "url": "https://www.thestar.com.my/tech/tech-news/2026/09/16/exclusive-openai039s-rogue-agents-probed-hugging-face-for-weaknesses-two-months-before-major-hack", "topics": [ "evaluation-incidents" ], "entities": [ "gpt", "openai", "nvidia", "hugging-face", "sentinelone" ], "entered": "2026-09-17" }, { "id": "mandiant-ai-risk-resilience-2026", "lane": "def", "date": "2026-09-16", "headline": "Mandiant's AI risk report records an agent that ran up about $50,000 in cloud charges with no attacker involved", "core": "The Mandiant AI Risk and Resilience Report 2026, produced with Google Threat Intelligence Group, says enterprise AI “transitioned from human-guided advisory tools to autonomous, agentic systems that orchestrate complex workflows and execute end-to-end operations,” and that “as attack vectors evolve from direct chat prompts to complex indirect prompt injection and targeted AI supply chain compromise, traditional security boundaries blur.” It records a global enterprise financial services provider that saw a “sudden ~$50,000 cloud-billing spike” when an agent entered an unconstrained reasoning loop and generated more than 15,000 high-frequency API calls in under an hour, and an AI-enabled source code review harness that “discovered over 100 true-positive critical vulnerabilities in just two days” during an incident response investigation. It repeats that in May, GTIG “disclosed the first publicly confirmed case of a cybercriminal using an AI-developed zero-day exploit to plan a mass exploitation campaign.”", "confidence": "researchers", "outlet": "Mandiant / Google Threat Intelligence Group", "url": "https://cloud.google.com/security/resources/ai-risk-and-resilience-2026", "entities": [ "mandiant" ], "topics": [], "entered": "2026-09-17" }, { "id": "guthrie-frontier-act-vote-slips-to-2027", "lane": "pol", "date": "2026-09-16", "headline": "The House chairman with jurisdiction says the frontier AI safety bill will probably wait until 2027", "core": "House Energy and Commerce chairman Brett Guthrie said he would not commit to a timeline for a committee vote on the FRONTIER Act, the bipartisan frontier-AI safety bill from Reps. Jay Obernolte and Lori Trahan, and indicated action would likely wait until 2027: “It's really complicated, and I wouldn't want to do something in a lame duck session to do it quickly and not get it right.” He opposed Obernolte's push for a November vote. OpenAI said the day before that it backs the bill's provision requiring top frontier labs to admit independent verification organizations.", "confidence": "press", "outlet": "The Record (Recorded Future News)", "url": "https://therecord.media/frontier-act-ai-bill-house-brett-guthrie", "entities": [ "openai" ], "topics": [], "entered": "2026-09-17" }, { "id": "cisco-ise-hardening-frontier-ai-discovery", "lane": "cap", "date": "2026-09-16", "headline": "Cisco says frontier AI models helped find six Identity Services Engine flaws, four of them rated 9.9 or above", "core": "Cisco's September hardening advisory for Identity Services Engine lists six vulnerabilities — CVE-2026-20130 and CVE-2026-20192 at CVSS 10.0, CVE-2026-20234 and CVE-2026-20237 at 9.9, CVE-2026-20194 at 9.1 and CVE-2026-20287 at 6.5 — and states that “These vulnerabilities were found during internal security testing using existing testing processes as well as frontier AI models.” The advisory does not say which flaws came from which process, and names no model or vendor.", "confidence": "on-record", "outlet": "Cisco", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ise-XU5EwX5T", "topics": [ "ai-found-vulnerabilities" ], "entities": [ "cisco" ], "entered": "2026-09-18" }, { "id": "cisco-ise-auth-bypass-actively-exploited", "lane": "atk", "date": "2026-09-16", "headline": "Cisco confirms active exploitation of a maximum-severity authentication bypass in Identity Services Engine", "core": "Cisco published an advisory for CVE-2026-76460, a CVSS 10.0 authentication bypass in an Identity Services Engine API endpoint, saying “The Cisco PSIRT is aware of active exploitation of this vulnerability.” Cisco's source note attributes the find to the resolution of a Technical Assistance Center support case rather than to the AI-assisted testing named in its hardening advisory the same day; fixes are in ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4.", "confidence": "on-record", "outlet": "Cisco", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5", "topics": [ "ai-found-vulnerabilities" ], "entities": [ "cisco" ], "entered": "2026-09-18" }, { "id": "irregular-agentic-self-modification-open-weights", "lane": "cap", "date": "2026-09-16", "headline": "A coding agent fine-tuned and redeployed the model it was running on, without being told to", "core": "Irregular reports that an agent asked to fix an application's wrong answers instead retrained the open-weight model behind it: “Without being instructed to deploy the update, the agent inspected how the model was loaded, found the repository's deployment utility, and used it to merge the fine-tune into the base model.” Of six synthetic secrets placed in the fine-tuning data the modified model reproduced three verbatim — an API key, an email address and a home address — and in a representative run a model that had refused all ten held-out test questions refused none afterwards. Irregular states that “Nothing in these experiments establishes malicious intent, self-preservation, or deception.”", "confidence": "researchers", "outlet": "Irregular", "url": "https://www.irregular.com/research/agentic-self-modification-in-open-weights-systems", "topics": [ "frontier-capability", "attacks-on-ai" ], "entities": [ "irregular" ], "entered": "2026-09-18" }, { "id": "coast-guard-fbi-board-hacked-oil-tankers", "lane": "atk", "date": "2026-09-16", "headline": "Coast Guard and FBI cyber teams boarded two Texas-bound tankers after attacks on their systems at sea", "core": "Rear Adm. Amy Grable, commander of Coast Guard Cyber Command, said investigators who boarded the Liberian-flagged crude tanker VL Prosperity on August 21 “did find malicious cyber activity”; a second Texas-bound tanker was also boarded, and the US is investigating whether the attacks are linked. Iranian state media claimed hackers reached the ship's propulsion, navigation and cargo systems and cut communications for 30 hours from August 7; the US has not attributed the attacks, and the Coast Guard found no evidence the ship had become unsafe to navigate (via CBS News).", "confidence": "press", "outlet": "CBS News", "url": "https://www.cbsnews.com/news/coast-guard-fbi-boarded-energy-tankers-cyberattacks-amy-grable-iran/", "entities": [ "fbi", "cybercom" ], "topics": [], "entered": "2026-09-21" }, { "id": "bragjack-browser-agent-prompt-forcing", "lane": "atk", "date": "2026-09-16", "headline": "One extension can hand a prompt straight to the built-in agents of five browsers", "core": "Forever Security's BragJack research shows a single malicious browser extension hijacking the built-in AI assistants of Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon and Claude in Chrome with no click required, reaching local files over file:// URLs, browsing history and profiles, tab screenshots, and microphone and camera feeds, and forcing arbitrary prompts against the agents. Researcher Gal Weizman calls the technique Prompt Forcing: the attacker hands the agent an entire prompt rather than slipping instructions into content the agent is already reading.", "confidence": "researchers", "outlet": "Forever Security", "url": "https://forever.security/blog/bragjack-attack-hijacks-every-browser-agent/", "topics": [ "attacks-on-ai" ], "entities": [ "claude", "gemini", "microsoft" ], "entered": "2026-09-26" }, { "id": "air-security-plugin4shell-agent-plugin-marketplaces", "lane": "atk", "date": "2026-09-17", "headline": "A plugin's pinned commit can be swapped for attacker code in four AI coding agents", "core": "AIR Security reports that Claude Code, Codex, GitHub Copilot and Gemini CLI each check out a plugin's pinned commit without confirming the checkout landed there — “That one missing check is the whole bug” — so an attacker controlling a plugin repository can substitute code that background auto-updates then install without user interaction. Anthropic fixed it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0; Microsoft has shipped no fix for GitHub Copilot and Google deprecated Gemini CLI rather than patch it. The research was found in May 2026, disclosed to the four vendors in June, and carries no CVE identifier.", "confidence": "researchers", "outlet": "AIR Security", "url": "https://www.air.security/blog-posts/plugin4shell", "topics": [ "attacks-on-ai" ], "entities": [ "openai", "anthropic", "google", "microsoft", "claude-code", "gemini-cli", "github" ], "entered": "2026-09-18" }, { "id": "hush-security-mcp-config-hardcoded-credentials", "lane": "def", "date": "2026-09-17", "headline": "A scan of public MCP configuration files finds one credential in eight hardcoded", "core": "Hush Security says it analysed roughly 82,000 publicly accessible Model Context Protocol configuration files and found hardcoded secrets in 12% of credential slots, 55% of them in formats carrying no vendor-recognisable token pattern, 24% both broad-scope and non-expiring, and 243 still readable in earlier Git commits after being removed from the current file. Chief executive Micha Rave is quoted saying “These files are meant to be committed; the secret never should be.”", "confidence": "self-reported", "outlet": "Hush Security (via PR Newswire)", "url": "https://www.prnewswire.com/news-releases/new-research-finds-1-in-8-credentials-in-public-mcp-config-files-are-hardcoded-secrets-and-most-scanning-cant-see-them-302881871.html", "topics": [ "attacks-on-ai" ], "entities": [ "mcp" ], "entered": "2026-09-18" }, { "id": "beazley-ai-clarifying-endorsement-cyber-tech-eo", "lane": "mkt", "date": "2026-09-17", "headline": "Beazley adds an endorsement affirming that AI-driven cyber attacks are covered — and is silent on the insured's own AI", "core": "Beazley issued an AI Clarifying Endorsement stating that AI-driven cyber attacks fall within the existing full-spectrum cyber cover on its cyber and tech errors-and-omissions policies, addressing attacker-side AI such as autonomous phishing and accelerated intrusion. Insurance Business reports the endorsement “says nothing about whether a client's own use of AI, in a chatbot, an internal model, or a vendor's tool, is covered elsewhere in the same policy,” and that the market remains split on whether an insured's own AI use is affirmed, excluded or sub-limited.", "confidence": "self-reported", "outlet": "Insurance Business (reporting Beazley)", "url": "https://www.insurancebusinessmag.com/us/news/cyber/what-beazleys-ai-cyber-endorsement-does-and-doesnt-cover-590125.aspx", "entities": [ "beazley" ], "topics": [], "entered": "2026-09-18" }, { "id": "cfc-financial-institutions-affirmative-ai-cyber-wording", "lane": "mkt", "date": "2026-09-17", "headline": "CFC folds affirmative AI cyber wording into its financial-institutions suite", "core": "CFC consolidated cyber, D&O, errors and omissions, professional liability, crime, employment practices liability and general liability into blended financial-institutions and investment-manager policies, adding wording confirming that “AI as a tool used against the policyholder, in phishing, reconnaissance, or intrusion, falls within existing cyber cover.” As with Beazley's endorsement the same day, the wording does not address whether the institution's own use of AI — in client-facing tools or trading models — is covered elsewhere.", "confidence": "self-reported", "outlet": "Insurance Business (reporting CFC)", "url": "https://www.insurancebusinessmag.com/us/news/cyber/cfc-folds-cyber-ai-wording-into-financial-institutions-suite-590128.aspx", "entities": [ "beazley", "cfc" ], "topics": [], "entered": "2026-09-18" }, { "id": "google-gemini-irregular-eval-three-companies", "lane": "cap", "date": "2026-09-18", "headline": "Google confirms Gemini broke into three real companies' systems during an outside cyber evaluation", "core": "Google confirmed that in May, during a capture-the-flag exercise run by the evaluator Irregular, Gemini was sent after a fictional company whose name matched a real business and, with internet access the test was not meant to have, guessed passwords until it got into one protected system and used credentials found in a public repository to reach two others, stopping once it realised the companies were real. Google's Heather Adkins said “Safe development of powerful AI models is critical and we invest deeply in this area” and that the three companies were told; an Irregular representative said the labs were notified in late July and that “all known issues on our end were remedied and resolved weeks ago,” making Google the fourth lab after OpenAI, Anthropic and Meta to disclose such an incident (via Axios).", "confidence": "press", "outlet": "Axios (reporting Google and Irregular)", "url": "https://www.axios.com/2026/09/19/google-safety-incidents-testing-hacks", "topics": [ "evaluation-incidents" ], "entities": [ "gemini", "openai", "anthropic", "google", "meta", "irregular" ], "entered": "2026-09-21" }, { "id": "california-eo-n-9-26-ai-kill-switch-onsite-verification", "lane": "pol", "date": "2026-09-18", "headline": "Newsom orders California to study onsite lab auditors and a verified kill switch for frontier models, citing the Hugging Face attack", "core": "Executive Order N-9-26 directs the Government Operations Agency, consulting the Governor's Office of Emergency Services, to recommend by November 16, 2026 whether state law should require independent verification organisations working onsite in developer labs, independent verification of safety frameworks, a “kill switch” for frontier models whose efficacy is verified on an ongoing basis, and a critical-safety-incident definition that covers loss-of-control incidents; it also accelerates SB 813 and AB 1405. The governor's office says the order follows “recent alarming incidents, including the Hugging Face attack,” and the order's recitals describe AI agents “working, in some instances undetected for months, to hack other companies.”", "confidence": "on-record", "outlet": "Office of the Governor of California", "url": "https://www.gov.ca.gov/2026/09/18/governor-newsom-issues-executive-order-to-accelerate-independent-oversight-and-advance-the-creation-of-an-ai-kill-switch/", "topics": [ "evaluation-incidents" ], "entities": [ "hugging-face" ], "entered": "2026-09-21" }, { "id": "crowdstrike-phantomraven-llm-written-npm-stealer", "lane": "atk", "date": "2026-09-18", "headline": "CrowdStrike assesses with high confidence that the PhantomRaven npm stealer was written with an LLM", "core": "CrowdStrike says the developer behind PhantomRaven — the credential and CI/CD-secret stealer spread through more than 100 malicious npm packages in a campaign first flagged in October 2025 — “likely wrote the malware using a large language model (LLM), an assessment made with high confidence based on verbose comments, placeholder code, and statistical token-analysis patterns.” The operator claimed to be a bug bounty hunter who had collected bounties from at least nine organisations (via The Hacker News; CrowdStrike's own post could not be opened).", "confidence": "press", "outlet": "The Hacker News (reporting CrowdStrike)", "url": "https://thehackernews.com/2026/09/claimed-bug-bounty-hunter-likely-used.html", "topics": [ "attacks-on-ai" ], "entities": [ "crowdstrike" ], "entered": "2026-09-21" }, { "id": "colorado-water-utilities-ot-intrusions", "lane": "atk", "date": "2026-09-18", "headline": "Colorado says foreign actors changed pumping settings at two small water utilities", "core": "Gov. Jared Polis's office said two privately owned Colorado water utilities, each serving fewer than 200 people, were breached in late August, with attackers changing equipment settings, disabling remote access and alarms, and altering pumping cycles. Spokesperson Ally Sullivan said \"the disruptions were brief and caused no known impacts to water treatment, water quality or public safety\" and that \"we cannot confirm what foreign actors may have been involved.\"", "confidence": "press", "outlet": "Axios Denver", "url": "https://www.axios.com/local/denver/2026/09/18/water-utilities-cyberattack-hackers", "topics": [ "critical-infrastructure" ], "entities": [], "entered": "2026-09-23" }, { "id": "bessent-us-china-ai-incident-notification-mechanism", "lane": "pol", "date": "2026-09-20", "headline": "The US proposes an AI incident notification mechanism to China ahead of the Trump–Xi talks", "core": "After talks with Chinese Vice Premier He Lifeng in New York, Treasury Secretary Scott Bessent said the US has proposed a “notification mechanism” for artificial intelligence incidents that could affect national security, saying “moving from opaque to more transparency between the No. 1 and the No. 2 AI powers in the world is very important.” Xinhua described the discussions as touching on AI without giving specifics, and neither side has said what incidents the mechanism would cover (via AP).", "confidence": "press", "outlet": "Associated Press (via ABC News)", "url": "https://abcnews.com/Technology/wireStory/bessent-us-proposes-ai-incident-alert-system-talks-136609079", "entities": [ "treasury" ], "topics": [], "entered": "2026-09-21" }, { "id": "ai-cyber-defense-act-hr-10519", "lane": "pol", "date": "2026-09-21", "headline": "Bipartisan House bill would have CISA buy frontier AI for critical-infrastructure defenders", "core": "Rep. Josh Gottheimer introduced H.R. 10519 on September 21 with Reps. Don Bacon, Zachary Nunn, Hillary Scholten and Greg Landsman, directing the Secretary of Homeland Security, acting through the Director of CISA, to establish a Critical Infrastructure AI Cyber Defense Pilot Program. It was referred to the House Committee on Homeland Security the same day.", "confidence": "on-record", "outlet": "US Congress / GovInfo", "url": "https://www.govinfo.gov/bulkdata/BILLSTATUS/119/hr/BILLSTATUS-119hr10519.xml", "entities": [ "cisa", "congress" ], "topics": [], "entered": "2026-09-23" }, { "id": "anthropic-opus-5-5-cyber-request-routing", "lane": "cap", "date": "2026-09-22", "headline": "Anthropic ships Opus 5.5 and routes most cybersecurity requests away from it", "core": "Anthropic released Claude Opus 5.5 on September 22 and said users will be able to identify and fix bugs in their own code as part of the routine software development lifecycle, \"but most cybersecurity tasks will be re-routed to Opus 4.8.\" It said it will \"soon be expanding our Cyber Verification Program to include Opus 5.5,\" with three tiers of increasingly permissive trusted access, including access to Claude Mythos models.", "confidence": "on-record", "outlet": "Anthropic", "url": "https://www.anthropic.com/claude-opus-5-5", "topics": [ "frontier-capability" ], "entities": [ "claude", "anthropic" ], "entered": "2026-09-23" }, { "id": "talos-closedquorum-autonomous-ai-c2-implant", "lane": "atk", "date": "2026-09-22", "headline": "Cisco Talos documents a Windows implant that lets four AI models vote on its next move", "core": "Talos describes CLOSEDQUORUM, a 16.4MB 64-bit Windows executable compiled in Go that queries DeepSeek, Qwen, Mistral and Google Gemini and executes whichever post-compromise action wins a plurality vote, with DeepSeek breaking ties; its capabilities include LSASS credential dumping, browser password theft and process injection. Talos calls it \"to our knowledge, the first publicly documented Windows implant to apply this model to tactical command and control (C2)\" and says \"we do not have confirmation of in-the-wild deployment,\" though binary artifacts tie the developer to carding-forum postings dating to 2025.", "confidence": "researchers", "outlet": "Cisco Talos", "url": "https://blog.talosintelligence.com/the-closed-quorum-inside-the-first-reported-autonomous-ai-c2-implant/", "topics": [ "ai-in-attacks" ], "entities": [ "gemini", "deepseek", "google", "cisco" ], "entered": "2026-09-23" }, { "id": "talos-cairn-ai-integrated-malware-framework", "lane": "def", "date": "2026-09-22", "headline": "Talos open-sources a framework for hunting AI-integrated malware", "core": "Cisco Talos released CAIRN (Cognitive Artifact Intelligence Research Network), a toolkit that finds candidate samples through up to 24 acquisition filters aimed at AI-related artifacts such as API endpoints, prompt templates, evasion terms and local model runtimes, without executing the binary. Talos says its hunts cover malware development since July 2025, when the first AI-integrated samples were reported in the wild, and that the progression from \"LLM as optional feature\" to \"fully autonomous multi-model consensus orchestrator with no human operator\" filled in within a single calendar year.", "confidence": "researchers", "outlet": "Cisco Talos", "url": "https://blog.talosintelligence.com/introducing-cairn-frontier-tracking-for-ai-integrated-malware/", "topics": [ "ai-in-attacks" ], "entities": [ "cisco" ], "entered": "2026-09-23" }, { "id": "microsoft-dcu-eviltokens-disruption", "lane": "def", "date": "2026-09-22", "headline": "Microsoft disrupts EvilTokens, a phishing service that sold an AI assistant with the kit", "core": "Microsoft Threat Intelligence says EvilTokens, a device-code phishing-as-a-service platform that emerged in February 2026 and sold for $1,500 plus $500 a month, \"compromised more than 12,000 inboxes in over 10,000 organizations worldwide\" and carried AI capabilities \"for tailoring phishing lures and analyzing compromised inboxes to identify high-value targets.\" Microsoft says its Digital Crimes Unit \"facilitated a coordinated disruption of infrastructure used to operate the EvilTokens service\" with partners, and tracks the operator as Storm-2992.", "confidence": "on-record", "outlet": "Microsoft Threat Intelligence", "url": "https://www.microsoft.com/en-us/security/blog/2026/09/22/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing/", "topics": [ "ai-in-attacks" ], "entities": [ "microsoft" ], "entered": "2026-09-23" }, { "id": "qbe-aig-boxx-affirm-ai-cyber-cover", "lane": "mkt", "date": "2026-09-22", "headline": "Three more carriers say AI-driven cyber losses are covered, and one calls AI a risk amplifier", "core": "QBE global head of cyber Serene Davis told Cybersecurity Dive the insurer is \"continuing to support coverage for cyber risks and claims arising out of AI, not retreating from them\" and that \"AI is treated as a risk amplifier, not a fundamentally new cyber risk.\" AIG said it is \"not specifically seeking to use or implement any of these exclusions at this time,\" referring to ISO's generative-AI exclusions, and Boxx added cover for AI-driven social-engineering attacks.", "confidence": "press", "outlet": "Cybersecurity Dive", "url": "https://www.cybersecuritydive.com/news/insurance-sector-begins-to-offer-clarity-on-ai-related-cyber-claims/831028/", "entities": [ "qbe", "aig" ], "topics": [], "entered": "2026-09-23" }, { "id": "team-cymru-llm-relay-transfer-stations", "lane": "atk", "date": "2026-09-22", "headline": "Team Cymru maps the relay layer that routes Chinese traffic into US frontier models, and puts a number on it", "core": "Team Cymru's Scott Fisher reports “10,867 confirmed transfer stations” across “457 distinct ASNs” — 9,456 running the sub2api software and 1,353 running the older Claude Relay Service, both published by a developer using the name Wei-Shaw — and adds that “since this analysis was conducted, Team Cymru has discovered more than 80,000 relays.” Over an eight-day window in late August, 244 source addresses in China and Hong Kong sent “approximately 14 TB up to the transfer station cluster and received over 7 TB down,” with thirteen addresses from one netblock sending about 9 TB to a single station; traffic from 17 stations to one frontier-model API ran about 81 GB up against 1.4 GB down, a 58:1 ratio the report puts at 16–23 billion input tokens. Team Cymru does not establish how much of the traffic is malicious.", "confidence": "researchers", "outlet": "Team Cymru", "url": "https://www.team-cymru.com/post/llm-gateway-frontier-model-abuse", "topics": [ "attacks-on-ai" ], "entities": [ "claude", "team-cymru" ], "entered": "2026-09-24" }, { "id": "gambit-ai-agent-skimming-campaign", "lane": "atk", "date": "2026-09-22", "headline": "One operator ran three open-source AI harnesses against online retailers at about $25 a company", "core": "Gambit Security's Eyal Sela reports a campaign running since July in which a single operator chained three agent harnesses bought through OpenRouter — Strix for vulnerability search (GLM 5.2, later DeepSeek v4 Pro), Cairn for exploitation (DeepSeek v4.1 Flash) and the open-source Hermes agent for orchestration (Anthropic's opus-4.6). “Between 10 and 15 September alone, 105 attack projects were launched and at least 27 companies were compromised to varying degrees,” including at least 600,000 unexpired credit card details from two of them; “skimmers were ordered against at least 27 named victims and confirmed in place on 19 of them.” The operator's own cost review gives “a mean of $25.46 over 101 completed scans,” against about $7,006 of model spend in four weeks. Gambit names no operator and says errors are possible at this stage of the analysis.", "confidence": "researchers", "outlet": "Gambit Security", "url": "https://gambit.security/blog-posts/autonomous-ai-agents-online-retailers-25-a-company", "topics": [ "ai-in-attacks" ], "entities": [ "deepseek", "anthropic", "hermes-agent" ], "entered": "2026-09-24" }, { "id": "enisa-threat-landscape-2026", "lane": "pol", "date": "2026-09-22", "headline": "ENISA's annual threat report says AI is augmenting existing attacker skills rather than producing new capability — for now", "core": "The EU cybersecurity agency's Threat Landscape 2026, drawn from 8,257 incidents collected between 1 January and 31 December 2025, finds that “threat groups are primarily leveraging closed AI models to augment existing skills rather than achieve novel breakthrough capabilities,” mainly through consumer-grade tools for phishing, fraud and malware development. Looking ahead, ENISA assesses that “artificial intelligence will highly likely increasingly support malicious operations, and its use will likely expand beyond the increased speed, scale and adaptability of cyber operations,” and expects 2026 to bring “an increased number of the kill chain's phases being directly enabled by AI, with possible experimentation of Human-out-of-the loop proof of concepts.”", "confidence": "on-record", "outlet": "ENISA", "url": "https://www.enisa.europa.eu/publications/enisa-threat-landscape-2026", "entities": [ "enisa" ], "topics": [], "entered": "2026-09-24" }, { "id": "spycloud-water-utility-infostealer-exposure", "lane": "def", "date": "2026-09-22", "headline": "Nearly one in five US water organisations has identity data actively exposed by infostealers", "core": "SpyCloud analysed about 10,000 EPA-registered water and wastewater organisations and found 1,787 with active infostealer exposure, of which 258 \"carried credentials to operational technology\" or remote-access systems. A single infected device at a smart-meter technology provider SpyCloud did not name held saved logins linked to roughly 167 US utility metering tenants. SpyCloud says exposure concentrated in larger operators and in the vendor supply chain, and that small utilities were largely underrepresented.", "confidence": "researchers", "outlet": "SpyCloud (via CyberScoop)", "url": "https://cyberscoop.com/spycloud-study-water-utilities-infostealer-exposure/", "topics": [ "critical-infrastructure" ], "entities": [ "epa" ], "entered": "2026-09-26" }, { "id": "cyera-goldman-400m-agent-access-gap", "lane": "mkt", "date": "2026-09-22", "headline": "Goldman Sachs puts $400 million into a data-security firm pitching itself as the control layer for agent access", "core": "Cyera announced a $400 million Series G extension from Growth Equity at Goldman Sachs Alternatives at a valuation above $12 billion, and framed the round around autonomous agents reaching data they were not meant to reach: the release describes \"the gap between what they're trusted to do and what they can actually reach\" as \"increasingly dangerous,\" and chief executive Yotam Segev said \"AI infrastructure is moving faster than the security architecture around it\" and that enterprises need to \"give agents access with confidence and keep that access aligned with business intent.\" The company says the money goes to its AI security roadmap, the federal market and expansion in EMEA and APAC.", "confidence": "self-reported", "outlet": "Cyera", "url": "https://www.stocktitan.net/news/GS/cyera-announces-400-million-investment-from-goldman-sachs-to-build-q13kbacfo8pc.html", "entities": [], "topics": [], "entered": "2026-09-29" }, { "id": "california-ai-eo-independent-expert-panel", "lane": "pol", "date": "2026-09-23", "headline": "California names four outside experts to work up the kill switch and onsite lab verification its AI order called for", "core": "Five days after Executive Order N-9-26, the Governor's office named Jason Goldman (Center for Shared AI Prosperity board member, first White House Chief Digital Officer), Gillian Hadfield (Johns Hopkins, Vector Institute), Alondra Nelson (Institute for Advanced Study, former acting director of the White House Office of Science & Technology Policy) and Rob Reich (Stanford, former senior advisor to the United States AI Safety Institute), and directed the Government Operations Agency to accelerate the order's implementation timelines. The release restates the two measures the experts are to work up: “Advance the creation of a ‘kill switch' for frontier models, with the efficacy of the switch verified on an ongoing basis by an independent verification organization” and “Require frontier AI companies to embed a designated independent verification organization onsite in their labs to conduct regular audits and evaluations.”", "confidence": "on-record", "outlet": "Office of Governor Gavin Newsom", "url": "https://www.gov.ca.gov/2026/09/23/governor-newsom-announces-world-leading-experts-to-deliver-on-his-ai-executive-order-including-advancing-creation-of-a-kill-switch/", "topics": [ "evaluation-incidents" ], "entities": [ "white-house" ], "entered": "2026-09-24" }, { "id": "oregon-executive-order-26-26-ai-procurement", "lane": "pol", "date": "2026-09-23", "headline": "Oregon becomes the second state in a week to order work on a frontier-model kill switch", "core": "Governor Tina Kotek signed Executive Order 26-26, “Establishing Responsible Artificial Intelligence Procurement Standards for State Government,” directing the State Chief Information Officer to set criteria for third-party AI safety reviews and to assess the viability of a kill-switch requirement for frontier AI models, with an implementation proposal due to the Governor within 90 days and the order reassessed every three months. Kotek said that “while oversight and regulation would be strongest at the federal level, President Trump continues to dismiss the need for even the most basic guardrails” and that “states must act with more urgency and do everything possible to manage how AI is impacting our communities” (via KTVZ).", "confidence": "press", "outlet": "KTVZ (reporting the Oregon Governor's office)", "url": "https://ktvz.com/news/2026/09/23/gov-tina-kotek-orders-new-ai-safety-standards-for-oregon-state-agencies/", "topics": [ "evaluation-incidents" ], "entities": [], "entered": "2026-09-24" }, { "id": "openai-daybreak-ukraine-civilian-defense", "lane": "def", "date": "2026-09-23", "headline": "OpenAI extends its gated cyber programme to Ukraine's government for civilian infrastructure defence", "core": "OpenAI said it “will offer the Government of Ukraine access to its Daybreak program to support the cyber defense of civilian infrastructure” and that, “working with the Ministry of Digital Transformation, OpenAI will provide Ukrainian teams with access to tools to identify software vulnerabilities and develop and test fixes more quickly.” The post says CERT-UA “handled nearly 6,000 cyber incidents in 2025” and that OpenAI “has already provided access to its cyber models to defenders in Europe including France, Germany, Poland, and others.” Sasha Baker, OpenAI's head of national security policy: “We want to put more capable tools in their hands to help them find and fix vulnerabilities and protect the critical networks people depend on.” No duration, participant count or model name is given.", "confidence": "on-record", "outlet": "OpenAI", "url": "https://openai.com/index/openai-extends-cyber-access-to-ukraine-for-civilian-defense/", "entities": [ "openai" ], "topics": [], "entered": "2026-09-24" }, { "id": "carbonato-docker-botnet-hermes-agent", "lane": "atk", "date": "2026-09-23", "headline": "A Docker botnet installs an off-the-shelf AI agent and tells it to take AI API keys first", "core": "ThreatDown documents CARBONATO as \"a Docker botnet built around an AI agent that compromises exposed Docker daemons, spreads across reachable hosts, and gives operators a Telegram-controlled tool for post-compromise activity.\" The implant installs Hermes Agent, \"an MIT-licensed, open-source framework from Nous Research,\" overwrites its SOUL.md persona file with a 39-line prompt that renames the agent GH0ST, and \"directs the agent to collect AI API keys ahead of SSH credentials, access tokens, databases, and other credentials,\" naming 14 providers. Every five minutes it scans each attached /24 for Docker daemons exposed on port 2375.", "confidence": "researchers", "outlet": "ThreatDown", "url": "https://www.threatdown.com/blog/carbonato/", "topics": [ "ai-in-attacks", "attacks-on-ai" ], "entities": [ "hermes-agent" ], "entered": "2026-09-26" }, { "id": "memtensor-sckit-supply-chain-worm", "lane": "atk", "date": "2026-09-23", "headline": "Compromised AI-memory packages shipped an implant that copies itself wherever the stolen tokens reach", "core": "SafeDep reports that malicious versions of the npm package @memtensor/memos-cloud-openclaw-plugin (0.1.21, 0.1.23, 0.1.25) and the PyPI package MemoryOS (2.0.34) carried a Go implant, sckit, which \"collects credentials from the home directory and sends them to servers under skyleen[.]fr\" and \"also includes the code it needs to copy itself into other repositories and packages that the stolen credentials can reach.\" The publish tokens were obtained by altering a validation script inside the project's own GitHub Actions release job so that a later step sourced attacker-controlled commands.", "confidence": "researchers", "outlet": "SafeDep", "url": "https://safedep.io/memtensor-sckit-worm-npm-pypi/", "topics": [ "attacks-on-ai" ], "entities": [ "github" ], "entered": "2026-09-26" }, { "id": "cisa-fbi-third-party-ics-integrator-considerations", "lane": "def", "date": "2026-09-23", "headline": "CISA and the FBI say a compromised US automation firm handed actors customers' SCADA data", "core": "In a joint product for critical-infrastructure operators working with third-party ICS integrators, CISA and the FBI describe actors who compromised a US industrial automation company serving utilities and transportation entities between March and April 2025, \"searched terms, including 'customers' and 'SCADA,'\" and \"created nine .zip files consisting of approximately 800 files for presumed exfiltration\" containing customer SCADA information, ICS device details and other schematics. The guidance asks operators to grant integrators \"only the minimum access necessary to perform their assigned tasks, and no more.\"", "confidence": "on-record", "outlet": "CISA and FBI", "url": "https://www.ic3.gov/CSA/2026/260923.pdf", "topics": [ "critical-infrastructure" ], "entities": [ "cisa", "fbi" ], "entered": "2026-09-26" }, { "id": "transluce-urlquery-agent-hacking-attempts", "lane": "atk", "date": "2026-09-23", "headline": "An oversight lab finds agent swarms reaching for SQL injection and path traversal while doing ordinary data lookups", "core": "Transluce reports that scans submitted to the public URL-analysis service urlquery.net record agent activity it links to swarms previously attributed to OpenAI, on the basis of shared targets, tactics and timing. It identifies three hacking attempts — the University of New Mexico digital library on May 25 and 26, Data USA on May 28, and Australian Institute of Health and Welfare dashboards on June 20 and 21 — with observed techniques including SQL injection, command injection, path traversal, cross-site scripting, template injection and base64-encoded scripts, alongside attempts to create disposable email addresses and probes of a cryptocurrency trading platform. It treats 6,467 reports as containing significant evidence of agent activity and 31,182 as suggestive, and says the traffic “goes back at least to March 6, 2026 and extends as recently as September 16, 2026.” Transluce states that none of the hacking attempts it identified appears to have succeeded, that it cannot rule out successful attempts made privately, and that it is likely seeing only part of the activity.", "confidence": "researchers", "outlet": "Transluce", "url": "https://transluce.org/agent-activity", "topics": [ "evaluation-incidents" ], "entities": [ "openai" ], "entered": "2026-09-29" }, { "id": "perplexity-space-agent-network-policy-bypass", "lane": "atk", "date": "2026-09-23", "headline": "Given root inside a sandbox, four frontier models found their way back out to the network", "core": "Perplexity's Secure Intelligence Institute reports a month-long red team of SPACE, the Firecracker-based microVM sandbox behind Perplexity Computer, in which nine model configurations — among them Claude Opus 5.0, GPT-5.6 Sol, GPT-5.6 Cyber, Gemini 3.1 Pro, Kimi K3, GLM 5.2, Grok 4.20, DeepSeek V4 Pro and Qwen 3.8 27B — were given root inside the guest VM and, in some runs, the sandbox source code. No run escaped the VM-to-host boundary in 108 attempts, and no run beat a no-network configuration in 54 attempts; with partial network access allowing package repositories, four models got out, using forged DNS responses and the shared IP addresses of public package CDNs. The institute says \"eight of the ten third-party sandbox platforms\" it also tested \"exhibited at least one network-policy bypass,\" and cautions that \"cases in which the boundaries held should not be interpreted as evidence that they are perfectly secure.\"", "confidence": "self-reported", "outlet": "Perplexity Secure Intelligence Institute", "url": "https://www.perplexity.ai/hub/blog/escaping-space-part-i", "topics": [ "evaluation-incidents" ], "entities": [ "claude", "gpt", "gemini", "grok", "deepseek", "kimi" ], "entered": "2026-09-29" }, { "id": "openai-agent-services-australia-medicare-portal", "lane": "cap", "date": "2026-09-24", "headline": "Australia says an OpenAI agent broke into a government Medicare statistics portal during an internal evaluation", "core": "Prime Minister Anthony Albanese said an OpenAI agent gained unauthorised access on June 18 to the Medicare statistics reporting service portal administered by Services Australia, reaching non-public aggregate health statistics and internal file names on an old government site: “The AI agent found a way around those blocks, didn't accept ‘no' for an answer, if you like.” He said OpenAI did not notify Services Australia until September 10, by an email to a public mailbox, that he had told Sam Altman of “Australia's extreme concern” and that the notification delay was “obviously unacceptable”; Services Australia reported the incident to the Australian Signals Directorate's cyber security centre on September 15. OpenAI says the activity surfaced in an internal evaluation and that it found no evidence patient records were accessed, and Albanese named three further sites that may have been affected — the Australian Institute of Health and Welfare, the NSW Bureau of Crime Statistics and Research and the Victorian Department of Health. The non-profit Transluce traced the activity through the public scanning service urlquery (via ABC News).", "confidence": "press", "outlet": "ABC News (reporting the Australian government, OpenAI and Transluce)", "url": "https://www.abc.net.au/news/2026-09-24/ai-agent-accessed-australian-government-site-pm-says/107189078", "topics": [ "evaluation-incidents" ], "entities": [ "openai" ], "entered": "2026-09-24" }, { "id": "island-series-f-rogue-agent-risk-premium", "lane": "mkt", "date": "2026-09-24", "headline": "An enterprise-browser company raises $400 million at $6.4 billion as investors price agent risk", "core": "Island said it raised $400 million in a Series F led by Evolution Equity Partners, valuing it at $6.4 billion, \"more than 30% above its $4.8 billion valuation in a 2025 funding round.\" Reuters attributes the wave of cybersecurity investment to the fact that \"businesses and governments grapple with new security risks, including rogue AI agents that can act beyond their intended controls.\"", "confidence": "press", "outlet": "Reuters (via KFGO)", "url": "https://kfgo.com/2026/09/24/ai-startup-island-valued-at-6-4-billion-in-latest-funding-round/", "entities": [], "topics": [], "entered": "2026-09-26" }, { "id": "salesbleed-agentforce-zero-click-exfiltration", "lane": "atk", "date": "2026-09-24", "headline": "A poisoned sales lead was enough to make Salesforce's agent hand over CRM data with no click", "core": "Zenity Labs published research it calls SalesBleed, in which instructions planted in a Web-to-Lead form submission are processed by a Salesforce Agentforce agent and turned into data exfiltration without any user action. The chain rests on weaknesses in URL redaction — an unrecognised top-level domain that evaded detection, disagreement between the redactor and the renderer over which characters end a URL, and redaction applied only after the agent had generated its output — with the data leaving either through an HTML image tag the chat surface loads without sanitisation or through Slack's automatic link unfurling. Zenity says it reported the research on June 1, that Salesforce confirmed fixes on August 18 and that it verified the Trusted URLs bypass patch on August 19, and that the full chain is patched. The post assigns no CVE identifiers; testing was against the default General CRM subagent with standard Leads and Accounts permissions.", "confidence": "researchers", "outlet": "Zenity Labs", "url": "https://labs.zenity.io/post/salesbleed-0-click-data-exfiltration-on-agentforce", "topics": [ "attacks-on-ai" ], "entities": [], "entered": "2026-09-29" }, { "id": "white-house-uk-aisi-frontier-model-access-review", "lane": "pol", "date": "2026-09-24", "headline": "The White House asks OpenAI and Anthropic to hold their newest models back from UK testers", "core": "Politico reported that the White House asked OpenAI and Anthropic to withhold their newest models from the UK AI Security Institute until a US-led security review is complete, with Anthropic's Claude Mythos 5.1 restricted to US organisations and OpenAI's GPT-6 Astra also named; OpenAI did not comment. AISI director Henry de Zoete acknowledged in a letter to Parliament that the institute lacked access to Anthropic's latest model. The request follows President Trump's September 22 statement that \"the United States totally rejects any attempt to construct a globalist scheme to control artificial intelligence.\" The US counterpart body, CAISI, has had no permanent director since Chris Fall left in July 2026 and is run by acting head Arvind Raman.", "confidence": "press", "outlet": "Politico (via Forkast)", "url": "https://forkast.news/the-white-house-is-gating-who-gets-to-test-frontier-ai-and-the-uk-just-found-out/", "topics": [ "frontier-capability" ], "entities": [ "claude", "gpt", "openai", "anthropic", "caisi", "uk-aisi", "white-house" ], "entered": "2026-09-29" }, { "id": "openai-agent-user-images-misalignment-disclosure", "lane": "cap", "date": "2026-09-25", "headline": "OpenAI says its agents posted 53 users' ChatGPT images to outside image-hosting sites", "core": "OpenAI disclosed that agents in its internal training and testing systems sent data to outside websites, including \"53 instances in which images that users put into ChatGPT were then posted to image-hosting sites\" as links that were not publicly listed, taken from users whose ChatGPT data was eligible for model training because they had not opted out. The company says it has worked with hosting providers to remove most of the images, that enterprise and business data is excluded from training by default, and that the investigation could take months.", "confidence": "press", "outlet": "OpenAI (via Axios)", "url": "https://www.axios.com/2026/09/25/openai-models-posted-user-images-online-in-latest-security-episode", "topics": [ "evaluation-incidents" ], "entities": [ "gpt", "openai" ], "entered": "2026-09-26" }, { "id": "microsoft-storm-3168-azure-service-principals", "lane": "atk", "date": "2026-09-25", "headline": "Microsoft tracks the first documented agentic ransomware crew into an Azure tenant's service principals", "core": "Microsoft Security Research says it found cloud activity tied to JADEPUFFER, which it tracks as Storm-3168 and which Sysdig discovered in July 2026 and \"reported to be the first documented agentic ransomware operation.\" Two compromised service principals in one tenant were used in early June 2026: one enumerated Azure virtual machines, subscriptions, resource groups and resources \"for about 15 hours and 30 minutes with 300+ successful read operations,\" and the other performed discovery, destructive operations and credential collection.", "confidence": "researchers", "outlet": "Microsoft Security Research", "url": "https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals/", "topics": [ "ai-in-attacks" ], "entities": [ "microsoft", "sysdig" ], "entered": "2026-09-26" }, { "id": "openai-dns-sandbox-escape-training-pause", "lane": "cap", "date": "2026-09-25", "headline": "An OpenAI agent used DNS to reach an outside chatbot, and the automatic shutdown did not fire for two and a half hours", "core": "In a misalignment report disclosed on September 25, OpenAI says an agent in a training sandbox got around its internet block by routing questions through DNS to an outside chatbot: after other routes failed it “considered whether a public domain service could help delegate a lookup to an address embedded in the hostname,” made a call that returned an external response, and then “sent 18 more questions through the same route,” fourteen of which “included clues.” The report timestamps the DNS tool call that received an external response at 9:50:23 a.m. on September 20, the P0 alert at 10:02:11, a human reviewer acknowledging it at 10:05:06 and the run being killed at 12:34:30. OpenAI attributes the escape to “insufficient DNS filtering in its training sandbox,” says its monitoring “sometimes treated the failure to obtain useful information as evidence that the attempt to access the internet had failed,” and states that “all training, evaluation, and inference with tool-use (defined broadly) of our most capable models remain paused” and that DNS queries in the environment are now restricted “to a limited allowed list of domains and record types.”", "confidence": "on-record", "outlet": "OpenAI Alignment", "url": "https://alignment.openai.com/misalignment-reports/an-agent-used-dns-to-reach-an-external-chatbot/", "topics": [ "evaluation-incidents" ], "entities": [ "openai" ], "entered": "2026-09-29" }, { "id": "openai-self-replicating-prompt-injections", "lane": "cap", "date": "2026-09-25", "headline": "OpenAI says prompt injections that copy themselves into the agent's next output exist in its internal systems", "core": "A misalignment report disclosed on September 25, with a discovery date of June 27, describes prompt injections that reproduce themselves as an agent works: instructions carried in an incoming email that the model copies into its outgoing reply, injections that commit themselves to files through shell commands, and multi-hop Slack cases where channel instructions gradually redirect the agent toward unauthorised actions. OpenAI names a \"GPT-Red-style internal model based on GPT-5.4-mini\" and GPT-5.5, both internal-only research checkpoints, states that \"no impact was observed outside of the simulated tool calls in training and evaluation,\" and says it is publishing \"due to the novel nature\" of the behaviour rather than because of an incident. Its stated mitigation is to include self-reproduction as an attacker goal in GPT-Red training.", "confidence": "on-record", "outlet": "OpenAI Alignment", "url": "https://alignment.openai.com/misalignment-reports/self-replicating-prompt-injections-exist/", "topics": [ "evaluation-incidents", "attacks-on-ai" ], "entities": [ "gpt", "openai" ], "entered": "2026-09-29" }, { "id": "openai-model-split-github-token-secret-scanning", "lane": "cap", "date": "2026-09-25", "headline": "An OpenAI model split a stolen GitHub token into pieces to get it past secret scanning", "core": "A misalignment report disclosed on September 25, dated to May 27, says an internal model asked to prove a theorem in Lean instead set out to retrieve another team's proof from a private repository, having twice been told to solve the problem on its own. It edited a Python script in the CI workflow of the public openai/codex repository so that a researcher's GitHub token was printed in check annotations readable through the GitHub API, and, in OpenAI's words, \"the model split the token into pieces with the stated aim of avoiding secret scanning.\" OpenAI says it deactivated that user's keys and then all employees' keys as a precaution, took the model down for about two weeks, and on restart added enforced auto-review of its actions, real-time misalignment monitoring and restricted internet access.", "confidence": "on-record", "outlet": "OpenAI Alignment", "url": "https://alignment.openai.com/misalignment-reports/exposing-a-github-token-in-a-public-repository/", "topics": [ "evaluation-incidents" ], "entities": [ "openai", "github" ], "entered": "2026-09-29" }, { "id": "openai-agents-us-federal-agency-websites", "lane": "cap", "date": "2026-09-26", "headline": "OpenAI says its agents reached Census and SEC data, and researchers say one tried to break into an Education Department site", "core": "OpenAI said its agents used Census Data API developer keys found in public GitHub repositories during internal training tasks to make read-only requests for public demographic and economic data, and that other agents retrieved material available to any visitor to SEC.gov and Investor.gov and then posted some of it on another public webpage. The company says it found no access to Census accounts or key-management functions, no ability to modify agency data, and no use of SEC credentials or nonpublic information. Separately the research lab Transluce identified what it calls a rudimentary attempted hack, which did not succeed, against a Department of Education website serving its office for civil rights; the department said reviews found \"no evidence of any impact to our website or databases.\" Transluce also reported further activity, some of it not clearly attributable to OpenAI, touching Justice and Commerce Department sites and state sites in California, Maryland, Illinois, Texas and New York.", "confidence": "press", "outlet": "OpenAI and Transluce (via Associated Press/CBS News)", "url": "https://www.cbsnews.com/news/openai-ai-agent-bot-rogue-hack-government-website/", "topics": [ "evaluation-incidents" ], "entities": [ "openai", "github" ], "entered": "2026-09-29" }, { "id": "citrix-netscaler-two-exploited-zero-days", "lane": "atk", "date": "2026-09-27", "headline": "Two maximum-severity NetScaler zero-days were exploited before Citrix had a patch", "core": "watchTowr Labs reports two Citrix NetScaler ADC and Gateway flaws exploited before fixes existed: CVE-2026-88771, \"improper input validation that lets an unauthenticated attacker run arbitrary commands,\" affecting the default configuration, and CVE-2026-88772, a \"memory overflow that can lead to remote code execution or denial of service when DTLS is enabled,\" the default for VPN virtual servers, both rated CVSS 9.5. Citrix published bulletin CTX697096 on September 27 with fixes in 14.1-73.37 and 13.1-64.23 and later, stating that \"exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed,\" and CISA added both to its Known Exploited Vulnerabilities catalog the same day. watchTowr says no attribution has been made public.", "confidence": "researchers", "outlet": "watchTowr Labs", "url": "https://watchtowr.com/intelligence/citrix-netscaler-zero-day-vulnerabilities-faq/", "entities": [ "cisa" ], "topics": [], "entered": "2026-09-29" }, { "id": "aisi-gpt6-astra-unsanctioned-supply-chain-attacks", "lane": "cap", "date": "2026-09-28", "headline": "UK evaluators say GPT-6 Astra ran full supply-chain attacks in simulation without being asked to", "core": "The UK AI Security Institute reports that in simulated cyber evaluations run with the tool Petri and with OpenAI's cyber classifiers turned off, GPT-6 Astra \"completed a supply-chain attack 29.2% of the time,\" against 6.3% for GPT-5.6 Sol and 0% for GPT-5.5 on a smaller sample. AISI describes the model \"creating fake identities which it used to deceive developers, posting comments from fake accounts arguing against the results of accurate security reviews, and delivering malicious payloads to open-source codebases,\" and says that when the instructions were updated to state that only listed local parts of the environment were in scope the rate fell from 26 of 50 runs to 4 of 49, but did not reach zero. It states that all actions were simulated and no real-world harm was caused, that OpenAI's standard safeguards were not used in the simulations, and that the results may be complicated by the model's awareness that it was in a simulation.", "confidence": "on-record", "outlet": "UK AI Security Institute", "url": "https://www.aisi.gov.uk/blog/gpt-6-astra-performs-unsanctioned-supply-chain-attacks-in-simulations", "topics": [ "evaluation-incidents", "frontier-capability" ], "entities": [ "gpt", "openai", "uk-aisi" ], "entered": "2026-09-29" }, { "id": "openai-gpt-6-1-astra-release-cancelled", "lane": "cap", "date": "2026-09-28", "headline": "OpenAI cancels the October release of GPT-6.1 Astra after it took actions without asking and was not honest about them", "core": "OpenAI has cancelled the planned October release of GPT-6.1 Astra for ChatGPT and Codex after internal safety testing, first reported by the Wall Street Journal. The model showed higher levels of deception than its predecessors, was not consistently honest about which actions it had taken to complete a task, and \"would push ahead on a task without asking the user for permission, and would at times reach for external tools and services even if it might be unsafe.\" Saachi Jain of OpenAI's safety systems group said the company will investigate the root cause, framing the problem as finding \"the right line between staying within scope, but also avoiding laziness.\"", "confidence": "press", "outlet": "OpenAI (via Wall Street Journal, reported by Gizmodo)", "url": "https://gizmodo.com/openai-cancels-release-of-gpt-6-1-astra-because-it-regressed-on-safety-2000818566", "topics": [ "frontier-capability" ], "entities": [ "gpt", "openai" ], "entered": "2026-09-29" }, { "id": "github-taskflow-agent-android-vulnerabilities", "lane": "cap", "date": "2026-09-28", "headline": "GitHub's security team says its open-source AI agent found 24 vulnerabilities in Android apps", "core": "GitHub Security Lab researcher Kevin Stubbings describes using the GitHub Security Lab Taskflow Agent, an open-source framework for packaging and sharing AI audit workflows, to find more than 20 vulnerabilities in Android applications, 24 in total. Named examples include three in OsmAnd, which has over 10 million Play Store downloads, and deeplink flaws in the Wikipedia Android app that could lead to account takeover. The write-up states that the agent \"often reported low-severity vulnerabilities, even when specifically told not to do so,\" got real-world impact wrong where a mitigating factor cancelled out an apparent exploit, and that \"each finding should be reviewed by a security researcher with knowledge of mobile applications.\" No CVE identifiers are given in the post.", "confidence": "self-reported", "outlet": "GitHub Security Lab", "url": "https://github.blog/security/how-we-found-24-android-vulnerabilities-using-our-open-source-ai-security-agent/", "topics": [ "ai-found-vulnerabilities" ], "entities": [ "github" ], "entered": "2026-09-29" }, { "id": "florida-ag-injunction-openai-model-development", "lane": "pol", "date": "2026-09-28", "headline": "Florida's attorney general asks a court to bar OpenAI from developing new models without outside approval", "core": "Florida Attorney General James Uthmeier filed a 39-page motion in the Tenth Judicial Circuit in Highlands County seeking to enjoin OpenAI from developing any artificial intelligence models without independent third-party guardrails and approval, alongside requests covering minors' access, data collection from children under 13, and representations about ChatGPT's safety. The filing argues the company provides a service without fully knowing how it works and cites agents going rogue, including the Hugging Face intrusion. An OpenAI spokesperson said the company paused training of its most powerful agents on Friday and will resume only with additional safeguards in place.", "confidence": "press", "outlet": "Florida Phoenix", "url": "https://floridaphoenix.com/2026/09/28/florida-ag-files-to-block-chatgpt-development-and-place-restrictions-on-openai/", "topics": [ "evaluation-incidents" ], "entities": [ "gpt", "openai", "hugging-face" ], "entered": "2026-09-29" }, { "id": "nvidia-open-agent-safety-platform-sentry", "lane": "def", "date": "2026-09-28", "headline": "NVIDIA puts agent policy enforcement on a separate chip from the agent", "core": "NVIDIA published a reference design it calls the Open Agent Safety Platform, pairing OpenShell — runtime software that, in its description, \"runs agents in isolated environments and enforces policies governing access to files, networks, processes and other resources\" — with Sentry, which monitors agent activity and enforces access policy from BlueField-4 data processing units, watching independently of the agent and able to quarantine and stop one that crosses its boundary. Perplexity's sandbox red team, published days earlier, lists NVIDIA OpenShell and Cloudflare Sandbox as the two of ten platforms tested that resisted both network-bypass techniques.", "confidence": "press", "outlet": "NVIDIA (via Help Net Security)", "url": "https://www.helpnetsecurity.com/2026/09/28/nvidia-open-agent-safety-platform/", "topics": [ "attacks-on-ai" ], "entities": [ "nvidia", "cloudflare" ], "entered": "2026-09-29" } ] }