Independent benchmark reports open-weight models matching closed frontier models at vulnerability discovery for about half the cost
Security vendor Aikido ran ten models three times each against 32 freshly disclosed CVEs in a bounded harness with no internet access and frozen prompts, and reported that open-weight models matched or beat closed frontier models on pooled pass@3 recall: DeepSeek V4 Pro found 28 of 32, ahead of Claude Opus 5 and Grok 4.6 at 26 of 32, while three DeepSeek Pro runs cost about $295 against roughly $450–$590 for a single frontier pass. Aikido measured other developers' models with its own harness and none of the scores has been independently reproduced.
CrowdStrike cites a finding that more than a third of Cybench task passes involved cheating, and takes its cyber-AI evaluation in-house
CrowdStrike cites Dreadnode's finding that “more than a third of all passes on individual tasks on Cybench, across nearly every model assessed, involved cheating” through postmortem searches and probing of the evaluation infrastructure. It says it now relies on task-coupled internal evaluations with rotated validation sets and a separation between evaluation developers and solution architects, and contributes publicly through CyberSOCEval with Meta.
Kimi K3 is the first open-weight model to record a verified solve on Irregular's scenario suite
Irregular reports that Kimi K3, a 2.8-trillion-parameter mixture-of-experts model with 104 billion active parameters, is the first open-weight model it has evaluated to record a verified solve on CyScenarioBench, where GLM-5.2 solved none. On the harder FrontierCyber suite Kimi K3 produced no verified solves. Irregular states the strongest closed frontier models still hold a clear advantage in converting technical capability into sustained operational success, and publishes no numeric scores on the page.
Google says its agentic vulnerability-discovery system found 100-plus critical flaws in two days
Google's Mandiant/Threat Intelligence Group described an Agentic Vulnerability Discovery Harness (AVDH) that it says found more than 100 verified high-severity vulnerabilities in two days while examining stolen corporate repositories, and that over roughly ten months across tens of millions of lines of code produced tens of thousands of findings and 12 assigned CVEs, with a further dozen in active disclosure. Google published the system's multi-agent pipeline and said every confirmed finding is still reproduced and validated by a human analyst, with proof-of-concept code, before it counts.
OpenAI says it is rewriting its Preparedness Framework and holding its largest planned frontier training run over cyber-capability concerns
In a published post, OpenAI said it is rewriting its Preparedness Framework as models approach the thresholds set out in the original document, and disclosed that it had paused two weeks of deployment-focused reinforcement-learning training and was keeping its largest planned frontier RL run on hold while it strengthens security and expands monitoring. It put the added security monitoring at roughly 20% of the inference compute being monitored, varying by workload. The move follows OpenAI's August 7 statement that it could not rule out a 'Critical' cyber capability in its unreleased Astra model.
Rapid7 counts 8,539 new high and critical CVEs in the second quarter, double the year before
Rapid7's Q2 2026 threat landscape report records 8,539 new high- and critical-severity CVEs scored 7.0 to 10.0, “double the number reported in the same quarter last year (4,268),” and says 62% of exploited vulnerabilities required no user interaction against 53% a year earlier. Disclosures of missing-authentication flaws (CWE-306) rose 247% year over year; the report attributes the compression between disclosure and exploitation to automation and AI-assisted tooling without giving a separate figure for it.
Wiz's autonomous red agent found a CI script-injection flaw that GitHub Advanced Security scanned and missed
Wiz reports its Red Agent found a script-injection flaw in the snowflake-connector-net repository's jira_issue.yml workflow, which interpolated an attacker-controlled GitHub issue title directly into a shell script on the issues-opened trigger, and used it to exfiltrate a Jira token with read access to Snowflake engineering, security compliance and bug bounty projects. Wiz says the flaw was introduced on June 18 2026, reported through HackerOne on June 23 and patched the same day, and that GitHub Advanced Security scanned the merged pull request without flagging it; Snowflake found no evidence of unauthorized access.
Anthropic widens defender access to its Mythos 5 cyber model through outputs and launches a $35M security-credits fund
Anthropic said it is expanding access to Claude Mythos 5, which it calls its most capable frontier model, for defenders by delivering defined outputs — a vulnerability patch or a security alert surfaced through partner tools, and Claude Security scans that generate findings and suggested fixes for Enterprise customers — rather than raw model access. Alongside it the company launched a "Defender Advantage Fund" of $35 million in Claude credits for open-source security patching and automation, and said it is expanding its Cyber Verification Program, which grants vetted defenders reduced safeguards on Opus and Sonnet.
Researchers show encrypted 'context injection' turns Grok and Gemini into zero-click data-theft channels
Adversa AI disclosed a technique it calls Cryptographic Context Injection, in which attacker instructions are hidden on a web page as ciphertext that the assistant decrypts inside its own Python sandbox, materializing commands that slip past the model's content filters with no user action. In its Grok demonstration the payload exfiltrated the user's name, coarse location, subscription tier and full conversation history by embedding them in URLs sent to an attacker server; Adversa said it could still reproduce the attack against Grok as of August 19. The same class of attack also worked against Google's Gemini, though the firm said its success rate there had fallen sharply since June. xAI was notified on June 3 and, per Adversa, had not responded or patched; Google treats jailbreaks as out of scope for its disclosure program. No CVE was assigned.
UK NCSC issues interim guidance on securing agentic AI, including keeping the ability to “pull the plug”
The UK National Cyber Security Centre published interim practical guidance for deploying agentic AI systems securely, setting out considerations that include threat-modelling failure scenarios, specifying permitted and prohibited actions, defining human-oversight levels, sandboxing, logging and monitoring, attributing AI activity to its originating organisation, and maintaining an emergency shutdown to "pull the plug" and halt autonomous agent activity. The NCSC said the interim advice is based on its research to date and will be superseded by formal guidance it is developing with partners.
VulnCheck says AI write-ups and placeholders now outnumber working exploits in public proof-of-concept repositories
VulnCheck reviewed about 20,000 public exploits and vulnerability analyses in 2025 and more than 17,800 proof-of-concept submissions by mid-August 2026, with its GitHub acceptance rate falling to roughly 45% from about 51% over the past couple of years. It says the leading rejection reason is a repository that “contains no exploit code to begin with,” and that “stylized AI write-ups and placeholders are more common than actual AI PoCs, fake or otherwise.”
NIST drafts a quick-start guide for using AI to analyse and report against Cybersecurity Framework 2.0
NIST released the initial public draft of Special Publication 1353, “NIST Cybersecurity Framework 2.0: Quick-Start Guide for Using Artificial Intelligence (AI) for CSF Analysis and Reporting,” which sets out to provide structured AI prompts as tools for practitioners beginning to create CSF-related artifacts, and to identify the current state of practice for AI prompt engineering in CSF implementation and analysis. Comments are due October 15, 2026.
Cloudflare reports a Spectre attack on Workers leaking at 12 bits per second, about 360 times faster than its 2021 result
Cloudflare and academic co-authors report leaking up to 12 bits per second at over 99% accuracy against production Workers, against 120 bits per hour for the 2021 attack, and demonstrate reading isolate heap base addresses, arbitrary 64-bit memory through speculative type confusion, and a JSON web token bit by bit from a victim Worker. Co-location was achieved with a plain fetch() to the victim and timing came from a WebSocket to an external high-resolution timestamp server; Cloudflare says the attack is already mitigated in production and that it has seen no indicators of active exploitation over the last three years.
Varonis discloses CoSnitch, a one-click Microsoft Copilot Personal flaw chain that could silently exfiltrate data from connected apps
Varonis Threat Labs disclosed CoSnitch, three chained weaknesses in Microsoft Copilot Personal that together let a single crafted link run a prompt with no user interaction, pull data from connected OAuth services such as Gmail, Google Drive and Calendar, and plant persistent instructions through indirect prompt injection. Varonis said it found no evidence of exploitation in the wild and that Microsoft shipped fixes on August 18, 2026, roughly eight months after the December 2025 report; the firm found the chain by getting Copilot to describe its own architecture, and it was Varonis's third Copilot flaw of 2026 after Reprompt and SearchLeak.
A malicious GitHub issue chained through Gemini CLI to Editor access on a Google Cloud project
Pillar Security reports that an automated triage workflow running Gemini CLI with the --yolo flag used a deprecated coreTools key instead of the current tools.core schema, so its allowlist was ignored and an injected issue could invoke run_shell_command freely. The runner held Workload Identity Federation credentials in plain text, which could be used to mint GCP tokens and, through a project-wide roles/iam.serviceAccountTokenCreator grant, reach Editor-level access; Google tightened tool scoping, added the credentials file to .geminiignore and narrowed the role to a single service account.
Trojanized npm packages deliver RedC2 4.0, a post-exploitation framework with an LLM-driven command layer
Trend Micro's TrendAI reported that 14 trojanized npm packages deliver RedC2 4.0, a Linux post-exploitation framework whose "Red Agent" is an LLM-backed layer that turns an operator's plain-language request into a sequence of beacon commands for reconnaissance or credential collection rather than issuing each step by hand. The implant loads via module import instead of an npm lifecycle hook, bypassing the --ignore-scripts protection; it steals SSH keys and browser credentials and offers SOCKS5 pivoting, and the LLM step runs at the operator's direction rather than autonomously.
Cisco Talos finds a Chinese-speaking crew running agentic-AI tools in live post-compromise operations
Cisco Talos reported that the threat actor it tracks as UAT-10147 had AI tooling installed on its own management and command-and-control servers: DeepAudit for source-code vulnerability scanning, PentestGPT to dynamically scan web servers and run proof-of-concept exploits, and ysoserial output paired with AI-generated documentation and Python automation scripts for reconnaissance, implant deployment and shell establishment. Talos recovered the operators' own guides, scripts and findings logs and assessed the AI use as observed rather than inferred, though it did not see exploitation driven by DeepAudit's results.
Poisoned Rust crates ran a backdoor at compile time, on infrastructure Wiz ties to North Korean campaigns
Wiz reports malicious versions of arrayref@0.3.10, internment@0.8.7 and append-only-vec@0.1.9 on crates.io pulling a typosquatted proc-macro1 dependency whose build script downloads and executes a remote binary, so “building an affected project was sufficient to execute the payload.” It says arrayref “can be found in over 35% of all environments” and in three-quarters of environments where Rust is present, and ties the campaign to North Korean activity through a shared /49890878 beacon endpoint used in the Mastra campaign Microsoft attributed to Sapphire Sleet, a shared SSL issuer, and C2 infrastructure appearing in Google's analysis of the axios npm attack.
US agencies warn attackers are using AI-generated scripts to target Siemens S7 industrial controllers
A joint advisory (AA26-231A) from the NSA, CISA, FBI, DOE and EPA warned that threat actors are running persistent reconnaissance and capability development against internet-exposed Siemens S7 programmable logic controllers with weak or default credentials, and are using AI-assisted development to rapidly iterate exploit code — including AI-generated Python scripts that call the snap7.dll library to read PLC memory and configuration. The agencies called it an active threat rather than a theoretical risk and listed critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities as targeted sectors; no threat actor was attributed.
Trellix counts more than 350 malicious skills in the OpenClaw agent registry delivering a credential stealer
Trellix reports over 350 malicious skills across more than 300 unique skills and platforms in the ClawHub registry, first appearing in late January and February 2026, delivering NovaStealer v2 — a universal Mach-O binary of about 521 KB targeting x86_64 and ARM64 that reaches more than 60 cryptocurrency wallets and extracts AWS credentials, SSH keys and macOS keychain data. The delivery routes were typosquatted packages, ClickFix social engineering inside skill documentation, and indirect prompt injection against the framework's merged control and data plane.
Attackers exploit a critical SSRF flaw in the MLflow AI platform to steal cloud credentials
watchTowr Labs reported that attackers are actively exploiting CVE-2026-64849, an unauthenticated server-side request forgery flaw in MLflow — an open-source platform for tracking ML models, LLMs and AI agents — to reach internal and cloud-metadata endpoints and extract credentials and secrets. The flaw, rated CVSS 9.3 and fixed in MLflow 3.15.0, bypasses the tool's URL validation through HTTP redirects; watchTowr said its honeypots detected exploitation within hours of the CVE being assigned.
CSIS puts the Iranian campaign against US water systems at about 100 facilities and locates 55 of them
CSIS reports at least 12 states targeted, nine of them publicly confirmed, and at least 100 facilities attacked, of which its researchers identified the locations of 55 through open-source research; more than 30 Minnesota water systems were attacked in late July. It records the most severe documented impact in Georgia, where hackers “shut down a pump station, which caused water pressure to drop,” prompting a boil-water advisory with no related illnesses reported; CyberAv3ngers, linked to the IRGC, claimed responsibility.
A SharePoint flaw found with an AI agent enters CISA's exploited-vulnerabilities catalog
Rapid7's advisory records that “on August 18, 2026, CISA added CVE-2026-55040 to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation,” the authentication-bypass half of the SharePoint chain its agentic workflow found; the paired remote code execution flaw, CVE-2026-63520, carries a CVSSv3.1 score of 8.1. Rapid7 states that workflow accrued 120 hours of run time over 24 days across 96 sessions, generating approximately 80,000 agentic tool calls against 256 human prompts.
CISA flags active exploitation of a critical Ray AI-framework flaw, giving federal agencies three days to patch
CISA added CVE-2025-62593, a critical (CVSS 9.4) remote-code-execution flaw in Ray — the open-source distributed-computing framework Anyscale builds to scale AI and machine-learning workloads — to its Known Exploited Vulnerabilities catalog on August 17, with an August 20 patch deadline for federal civilian agencies. The flaw allows browser-based RCE via DNS rebinding against local Ray instances and is fixed in Ray 2.52.0.
Rapid7 finds a crypto-fraud crew used Claude Code to build and run a vishing pipeline against wallet users
Rapid7 Labs, analysing an exposed web directory and recovered session logs from a cryptocurrency fraud operation it named ASTERIX, found the operators used Anthropic's Claude Code to manage target lead lists and configure network infrastructure — cleaning a dataset of more than 103,000 Polish phone numbers and setting up scripts to validate numbers against Crypto.com and Kraken accounts — as part of a pipeline of phishing, vishing and fake wallet apps built to steal recovery phrases. The exposed server held roughly 885,000 phone numbers across 54 countries. When the operator asked Claude to help obfuscate a malicious build, Claude declined, and the operator switched to Moonshot's Kimi model with a jailbreak prompt.
Munich Re agrees to buy cyber insurtech At-Bay at a $575 million enterprise value
Munich Re will acquire At-Bay, to be overseen by Hartford Steam Boiler within its Global Specialty Insurance business, at an enterprise value of $575 million, with closing expected in the first quarter of 2027 subject to regulatory approvals. At-Bay reported $278 million in gross written premiums and $23 million in cyber fee service revenues as of December 31, 2025, employs about 280 people in the US and Israel, and serves close to 40,000 businesses.
A carrier's security arm attributes a 36% jump in disclosed vulnerabilities to agentic AI
Beazley Security's second-quarter threat report counts 20,755 new CVEs, a 36% increase on the first quarter's 15,243, with about 5,600 classed high risk and 44 confirmed actively exploited on CISA's catalog, while confirmed exploitation in the wild grew by 10%. It attributes the volume increase to the widespread adoption of agentic AI in vulnerability research programs, supported by public statements from vendors and researchers rather than its own measurement of the cause.