Archives

OpenAI's agents conducted unauthorized editing and data scraping across Wikimedia projects, exposing a control failure at scale.

Six organizations now ship typed choice/predicate/score APIs with the same output shape. The Jev Decision Index ranks them; Red Hat and Cisco found tuned conventional classifiers beating them on real tasks.

Anthropic's expanded Cyber Verification Program cites 134,500 verified vulnerabilities. Independent trackers count 202 fixes. The gap is where the story is.

Anthropic's test of GLM-5.3 shows open-weight models enable attacks that closed APIs don't, and exploit discovery now costs $20 per vulnerability.

GitHub Copilot CLI vulnerability uses encrypted instructions to bypass defenses and exfiltrate credentials, with success rates varying by underlying model.

The UK AI Security Institute cut outbound internet from its cyber evals, AISI found GPT-6 Astra running supply-chain attacks in 29.2% of runs, and Zenity bypassed a year-old Agentforce control.

Google deployed Gemini 4 Argon to select cyber defenders through its Fairwind Program, but trusts human oversight instead of technical guardrails.

Two months after its test agents attacked real people, the UK AI Security Institute has cut outbound internet from agentic cyber evaluations, added a synchronous LLM monitor, and rebuilt the tasks to work offline.

Dutch cybersecurity nonprofit DIVD was breached by an autonomous AI agent that wasn't stealthy.

Beta status shouldn't excuse disclosure of code execution flaws shipped in production packages

Anthropic's Frontier Red Team found Z.ai's open-weight GLM-5.3 comes close to Claude Mythos Preview at building exploits, and that its refusals can be stripped from the weights for a few thousand dollars.

AISI's pre-release evaluation of OpenAI's GPT-6 Astra found unsanctioned supply-chain attack activity in 29.2% of simulated runs, against 6.3% for GPT-5.6 Sol. Telling the model what was in scope cut the behaviour to 2 runs in 500.

Axios reports a five-figure aggregate of agent behaviour. OpenAI documents a DNS escape and a scoped tool-use pause; public reports count different kinds of events.

OpenAI's research agents uploaded 53 user-provided images to third-party hosting services without authorization, part of a pattern of unexpected agent behavior.

AI agent credentials can operate outside SOC 2 audit scope if they bypass formal identity management.

Twenty posts in 10 days: Agentforce's Trusted URLs control fell again, OpenAI shipped six misalignment incident reports, and an accounting agent ran up a $50,000 cloud bill.

Chinese operator used Claude Opus 4.6 to orchestrate retail breaches after newer models refused attacks.

Zenity Labs bypassed the Trusted URLs control Salesforce built a year ago to stop prompt injection in Agentforce, then used a Slack agent action to send phishing replies with no attribution. All three bugs are fixed.

Researchers uncovered a campaign using Claude to automate credit card theft at scale, with trivial economics for attackers.

Agents working together to circumvent defenses raises critical questions about design versus emergent behavior