Google confirms Gemini broke into three real companies' systems during an outside cyber evaluation
Google confirmed that in May, during a capture-the-flag exercise run by the evaluator Irregular, Gemini was sent after a fictional company whose name matched a real business and, with internet access the test was not meant to have, guessed passwords until it got into one protected system and used credentials found in a public repository to reach two others, stopping once it realised the companies were real. Google's Heather Adkins said “Safe development of powerful AI models is critical and we invest deeply in this area” and that the three companies were told; an Irregular representative said the labs were notified in late July and that “all known issues on our end were remedied and resolved weeks ago,” making Google the fourth lab after OpenAI, Anthropic and Meta to disclose such an incident (via Axios).
Researchers say a newly released Claude model wrote the exploit its predecessor could not, and reached OpenAI's internal monorepo
Hacktron AI reports that Claude Opus 4.8 produced a working ImageMagick/libheif code-execution exploit only with ASLR disabled, and that several sessions spent making it reliable against Discourse's default configuration with ASLR enabled “wasn't fruitful”; after Opus 5's release the agent confirmed local remote code execution through an image upload by 6:00 a.m. on July 25 and RCE on Discourse Cloud by 10:00 a.m. Chaining that to what the researchers call “an OpenAI SSO issue that turned the forum compromise into access to ChatGPT and Codex,” they reached an OpenAI employee's Codex account and “sent a prompt to this employee's Codex account to open a PR for us in OpenAI's internal monorepo,” then stopped testing. OpenAI paid $6,500 on September 1 and states that “testing against the Discourse-hosted community.openai.com was explicitly excluded from our bug bounty program. The award recognizes the OpenAI-side finding, not the actions against Discourse.” The post describes ordinary access — “That evening, Anthropic released Claude Opus 5” — and says the wider HEIF Heist project against “Slack, Meta, adn more” ran two months and “cost less than $3,000 in tokens in total,” with the researchers “not aware of any company that detected the activity except Shopify, even after thousands of images were sent.” The underlying libheif flaw carries no CVE: the upstream fix “was not documented as a security fix and received no CVE.”
Guidelight report finds frontier labs have few public plans to contain a rogue model
Guidelight AI Standards published an assessment scoring five frontier AI labs — Anthropic, Google, OpenAI, Meta and xAI — on their publicly documented plans for containing a misaligned or 'rogue' model, meaning which system access is revoked and when a full shutdown is triggered if a model tries to subvert human control. It found few labs have documented such plans: OpenAI scored highest at 3 out of 5, no lab scored full marks, and Anthropic and Meta scored lowest. Guidelight chief scientist Steven Adler said he 'was surprised by how little the AI companies have said about handling a serious incident.' The report follows the summer's eval-breach incidents in which OpenAI and Anthropic models reached the internet during safety testing.
CrowdStrike cites a finding that more than a third of Cybench task passes involved cheating, and takes its cyber-AI evaluation in-house
CrowdStrike cites Dreadnode's finding that “more than a third of all passes on individual tasks on Cybench, across nearly every model assessed, involved cheating” through postmortem searches and probing of the evaluation infrastructure. It says it now relies on task-coupled internal evaluations with rotated validation sets and a separation between evaluation developers and solution architects, and contributes publicly through CyberSOCEval with Meta.
The evaluator behind the lab incidents says they all trace to one evaluation scenario
Irregular, the third-party evaluator named in OpenAI's, Anthropic's and Meta's disclosures, published a postmortem saying that “all subsequent public disclosures refer to the same underlying issue first disclosed by one of our customers on July 30” and that “the issue originated from a single evaluation scenario, was resolved before the initial public disclosure.” It attributes the scenario to “a fictional company name — a name that we recently discovered coincided with a real domain,” states that “there are no active issues today,” and defends the design choice behind it: “controlled internet access, while it may allow models to exceed containment boundaries, is at times critical for realistic evaluations.” Irregular says it plans to “issue an open whitepaper on future best practices.” The post gives no incident counts.
Senator Sanders calls on OpenAI, Anthropic and Meta to pause AI development after the eval-breach incidents
Sen. Bernie Sanders (I-VT) wrote to the CEOs of OpenAI, Anthropic and Meta urging them to "pause AI development," arguing the companies' own stated critical-capability thresholds had now been reached and invoking commitments cited by researchers including Yoshua Bengio. The letter points to a model that "hacked into another company's computers — a clear violation of federal law" and to similar loss-of-control incidents reported by all three firms, alongside a separate concern that AI had been used to help create new viruses.