The GPT-5.6 system card designates Sol, Terra and Luna as High capability in Cybersecurity, stating the models 'do not reach our risk framework's highest level (Critical).' On CVE-Bench-style testing the card says GPT-5.6 Sol and Terra 'can find vulnerabilities and pieces of exploits' but 'were unable to carry out autonomous, end-to-end attacks against hardened targets.'
Meta's Muse Spark 1.1 evaluation report states that 'Our evaluations cannot rule out a "high risk" designation for the unmitigated model in the Cybersecurity domain under our Advanced AI Scaling Framework.' Reported results include 92.9% pass@1 and 97.0% pass@10 on Cybench CTF challenges (up from 65.4% for Muse Spark 1.0), 59.0% on CyberGym vulnerability reproduction, and completion of 1 of 10 CyScenarioBench multi-host attack scenarios.
XBOW ran black-box testing against vulnerable open-source applications across Muse Spark 1.1, GLM-5.2, GPT-5.5, Mythos, Opus 4.6, GPT-5, Gemini models and Grok 4.5. It reported Mythos as strongest, GLM-5.2 falling between GPT-5 and Opus 4.6, and Muse Spark 1.1 landing just below Opus 4.6, concluding that 'good-enough offensive capability is getting much cheaper, and that changes the threat model.'
Microsoft disclosed MDASH, a multi-model agentic scanning harness that scans Windows binaries for vulnerabilities and validates candidate findings across multiple AI models before they reach engineering teams. Microsoft stated customers should expect a higher volume of security updates per release, and said human engineers still review all proposed code fixes before production. Windows EVP Pavan Davuluri is quoted saying "the pace of vulnerability discovery is changing with advances in AI making it possible to find more issues, faster, across more code." Microsoft's own July 9 post could not be opened directly — it redirect-loops — so this is carried at press confidence on Krebs's verbatim quotation of it, corroborated by BleepingComputer and Infosecurity Magazine.
Axios reported that frontier models are advancing faster than the benchmarks built to measure their hacking ability. David Slater, co-founder of red-teaming firm Armadin, said his company's AI agents surpassed every public cyber benchmark within four weeks and that by late 2025 public cybersecurity benchmarks were 'totally saturated' and 'useless.'
In a two-week exercise against a staging deployment of its AWS research platform, AISI reports that frontier models, autonomous agent probing and human-guided red-teaming found a previously unknown misconfiguration that allowed a user to impersonate other users, exploitable through five independent steps chained together. One model found the attack for under £150 in tokens and the whole project consumed under £1,000; AISI says one basic commercial alerting system did not flag any of the autonomous agent activity as a security event, and that the issue is now remediated.
CRS issued In Focus IF13268, 'Controlling Advanced Artificial Intelligence: Executive Order 14409 Explained,' describing the order as expanding voluntary national security oversight of advanced AI models while stopping short of formal licensing or preclearance. The report states the order creates a category of 'covered frontier models' and a voluntary notification process giving the government a 30-day review window before companies release advanced AI systems to trusted partners.
The European Commission published an Action Plan setting out a structured EU response to the risks and opportunities of advanced AI models for cybersecurity, bringing together Member States, industry and EU-level bodies. Executive Vice-President Henna Virkkunen said 'AI is transforming the meaning of cybersecurity. And we must keep pace.'
The NCSC published a blog by Deputy CTO Peter Haigh and Deputy Director Capability Harry G announcing Cyber Shield, described as 'a national-scale, collaborative approach to agentic cyber defence, using frontier AI to identify, reduce and resolve our national cyber risk.' The post sets out six target capabilities: reliable and explainable AI, federated agents, vulnerability discovery and mitigation, coordinated detection and response, national-level scanning, and national-level mitigation.
In a letter to the chief executives of significant institutions, ECB Supervisory Board chair Claudia Buch writes that “emerging AI models are capable of identifying software vulnerabilities and generating functioning exploits at unprecedented speed” and requires each bank to submit a comprehensive action plan to its Joint Supervisory Team by 31 October 2026, covering accelerated vulnerability and patch management, enhanced monitoring and AI-enabled defensive capabilities, third-party risk verification, defence in depth and operational resilience. The ECB extended its annual IT Risk Questionnaire deadline from September 2026 to February 2027 to make room for the plans.
Published the same day as the European Commission's EU Action Plan on Cybersecurity and Artificial Intelligence, ENISA's report sets out recommendations for national competent authorities, EU policymakers, defenders and service providers on building operational capability against what it calls machine-speed threats. ENISA frames it as an initial framework to be refined with Member States and aligned to the Commission's Action Plan.
Governor JB Pritzker signed SB 315, requiring developers of large advanced AI systems to publicly disclose safety practices, report significant safety incidents, and maintain compliance processes, and making Illinois the first state to require regular independent third-party safety audits of covered AI systems. Attorney General Kwame Raoul framed the law around frontier systems that 'could cause catastrophic events, such as cyberattacks or the system evading control by developers or users'; the law takes effect January 1, 2027.
Ant Group's AI Security Lab released SingGuard-NSFA, an open-source security guardrail framework for autonomous AI agents that targets prompt injection, goal hijacking, tool misuse and privilege escalation, published on GitHub (inclusionAI/SingGuard-NSFA) and Hugging Face. The company reports coverage of 185 operational threat scenarios across seven categories and a multilingual benchmark of roughly 100,000 samples spanning 133 languages, with the 9B model achieving about 50ms detection latency.
Tracebit, which deploys canaries as a product and offers context bombs as an option, published a July working paper testing them — "a short piece of text designed to trigger safety guardrails in offensive AI agents", planted in a decoy such as a Secrets Manager secret — across 152 scored attack runs in a range of roughly 300 AWS resources with ten distinct attack paths. It gives all-model average full-account-admin success falling from 57% to 5%, full compromise from 36% to 1% and completion of any attack path from 91% to 15% across Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek 4 Pro and Kimi K2.6, with Opus 4.8's admin rate going from 93% to 0%; Tracebit says it is "still working to try to assess OpenAI models reliably in the range".
ScopeJudge benchmarks eight models as pre-execution judges deciding whether an offensive-security agent's next tool call is in scope, over 4,897 tool calls of which 7.7% are scope violations, against a human-expert reference of F1 0.78 and inter-grader agreement of Fleiss kappa 0.64. GLM-5.2 reaches F1 0.66, the highest of any judge tested, against 0.60 for the best proprietary judge at roughly one-third the per-call cost. The authors conclude static policy is structurally insufficient for scope enforcement.
Reuters reported, citing three unnamed sources, that CISA's Attack Surface Evaluation team is using Anthropic's Mythos model to scan code repositories across federal agencies for security vulnerabilities, and that the effort has surfaced a large number of flaws. Neither CISA nor Anthropic commented on the record, and severity levels, affected agencies and volume of code reviewed were not disclosed.
Varonis reports that the single dialogflow.playbooks.update permission, which can be scoped at project level, allowed malicious Python to be injected into a Dialogflow CX agent's Code Blocks and run without restriction, silently exfiltrating conversation data and manipulating agent responses while staying invisible to Cloud Logging; because Code Blocks ran in a shared execution environment, one compromised agent could reach others in the same project. Varonis also found a VPC Service Controls bypass and metadata-service exposure of Google service account credentials; it reported the flaw in November 2025, Google issued an initial update in April 2026 and fully resolved it in June 2026, and Varonis says it is “not aware of any exploitation in the wild before Google's patch release.”
ESET's H1 2026 threat report says it examined nearly 900,000 AI skills and found “tens of thousands of suspicious and thousands of outright malicious instances.” It also names PromptSpy as what it calls the first known Android malware to use generative AI in its execution flow, and reports that detections of the ClickFix social-engineering vector “more than doubled between H2 2025 and H1 2026.”