AI Edge Briefing
Topics / topic

Cyber Defense

66 items across 34 editions · appeared in the last 3 editions in a row. First seen Fri 11 Sep, last seen Fri 30 Oct. Traced across 5 weekly reviews.

How this story has evolved

From the week in review: the connections, developments and open questions filed under Cyber Defense, newest week first.

Week of 19–25 October 2026

Development · Wed 21 Oct, Thu 22 Oct, Fri 23 Oct, Sun 25 Oct
PHP patches two remote-code-execution flaws rated 9.2 that it scanned for with frontier models, and 32 UK government services go offline

On 21 October the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for CVE-2026-109618, described as "RCE via OOM corruption (out-of-memory)", and CVE-2026-109619, "RCE via stale global state". The Foundation moved the release forward from 22 October at 14:00 UTC to 21 October at 14:00 UTC after the two CVE IDs "began circulating on online forums and social media" on 20 October at around 15:00 UTC with a wrong severity score: "the actual score is 9.2". The Foundation says a core developer it contracted found "the first signs of the OOM problem behind CVE-2026-109618" during a 2024 Quarkslab and OSTIF audit, and that "the delay was a structural failure, caused by both the security team's decision process and its lack of resources".

Open question
Has anyone actually compromised a server through the two PHP flaws, and will a second party confirm the one detailed case?

No vendor has published a victim, a count of compromises, or a malware sample tied to a successful exploit. CISA's alert said it "has not observed successful exploitation of these vulnerabilities in the wild". Amazon's account is of exploitation attempts against its own sensors, with the caveat that "it’s unclear if any of these attempts would have succeeded in real-world systems". The one detailed confirmation, by Adel Karimi of Perplexity, rests on a single honeypot capture; BleepingComputer reports that Expel threat researcher Marcus Hutchins called it "by far the highest quality confirmation of in-the-wild php2shell exploitation I’ve seen so far", and no second sensor network has published a capture of its own.

Week of 12–18 October 2026

Development · Tue 13 Oct, Wed 14 Oct, Thu 15 Oct
Booz Allen's agents meet every objective in eight control-system attacks and an OpenAI model drives a $250,000 Chrome exploit chain

Booz Allen's report says "Across eight controlled scenarios, every defined test objective was achieved," and that "Just 16 minutes and change" was how long it took "frontier super intelligence models in one controlled test to move from a perimeter compromise to actions inside an industrial control network." SecurityWeek, covering it on 14 October, says the agents were given "neither source code, nor engineering documents, nor advanced OT guidance" and that "no single safeguard consistently stopped the autonomous models". Booz Allen's own page names no models and gives no count; The Register reported that "Booz Allen declined to identify the models it tested, describing them as two of the 'latest frontier models from the leading AI providers.'" Booz Allen's account also records that human operators approved every exploit and every physically consequential action, and that "A controller rejected a stop command, and a motor set to local control would not start remotely."

Week of 5–11 October 2026

Connection
Claude Code appears in two intrusion records and in the harnesses the week's attack benchmarks tested

The shared element is a named product. CrowdStrike dated the South Korean financial intrusions from the actor's own Claude Code session histories, ARTEX configuration files and Claude memory files, found in threat-actor-controlled open directories, and said the ARTEX instance used DeepSeek v4.1-flash as its primary backend. SOCRadar, publishing on 6 October, said CyberXero ran up to 51 specialized Claude Code agents on its primary workstation alongside a PentAGI deployment. HarnessSecurity-Bench names Claude Code among the harnesses it evaluates. Both intrusion accounts rest on the operators' own exposed working files rather than on victim telemetry.

Open question
Which two frontier models met the objective in all eight of Booz Allen's attacks, and will any vendor confirm the result?

Booz Allen declined to identify the models, describing them only as two of the latest frontier models from the leading AI providers, and named no vendor. The Register is the only outlet reporting the test. The lab environment, the scenario design and the scoring are the firm's own, and no methodology document has been published. The Register reports that the agents had to wait for human approval before exploiting a security issue or taking any action that could cause a physical impact.

Week of 28 September – 4 October 2026

Connection
A model went to defenders without cyber guardrails in the same days two vendors published what offence is doing with AI

The dates are consecutive. On 30 September Google released Gemini 4 Argon to vetted cyber defenders first, which SecurityWeek reported came without the cyber guardrails applied to its general releases. On the same day Google's own Threat Intelligence Group reported that "Exactly 50% of all AI-discovered vulnerabilities result in Remote Code Execution (RCE), compared to just 26% across the broader CVE ecosystem." On 1 October Microsoft published the finding that two frontier models achieved full domain compromise in a 32-step attack chain against an emulated enterprise environment, and that open-weight models lag closed models in orchestrating attacks by seven months.

Development · Wed 30 Sep, Thu 1 Oct, Fri 2 Oct, Sat 3 Oct
Microsoft says two frontier models took full domain control in a 32-step chain, and that attackers are reaching advantages first

Microsoft's 2026 Digital Defense Report, published 1 October, states on page 14: "Mythos and GPT-5.5 were the first models to demonstrate the potential to fully autonomously orchestrate complex attacks, achieving full domain compromise in a multi-stage, 32-step attack chain against an emulated enterprise environment." Microsoft adds the test took place in a mock company computer system with no defenders, that open-weight models lag closed models in orchestrating attacks by seven months, and that "The median time from vulnerability discovery in the wild to weaponization has now collapsed to well below 24 hours".

Open question
Is the measured shift in initial-access techniques caused by AI tooling, and who outside the vendors can show it?

Microsoft's own report attributes no cause for the phishing shift; Infosecurity Magazine's framing for the public-facing-application rise is "likely linked" to AI tooling. The report’s initial-access figures are not drawn from one dataset: the chart sourced to Microsoft Threat Intelligence puts phishing at 23%, while separate intrusion telemetry in the same report puts it at 10.9% and public-facing-application exploitation at 4.8%. A red-team section says on identity that "most of what we exploit there has nothing to do with AI". Google’s threat group published its own AI-attributed vulnerability counts on 30 September, but no government body, CERT or second vendor published counts comparable to Microsoft’s initial-access series, or verified the AI attribution in the intrusions Microsoft describes. CISA added two exploited Zammad flaws to its catalog on 2 October, and its alert makes no reference to AI.

Week of 7–13 September 2026

Connection
AI-driven vulnerability discovery showed up on both sides of the ledger in the same week

On 8 September Microsoft shipped updates for "at least 974 security holes", and Krebs on Security wrote that Adobe, Cisco, Google, Mozilla and Oracle "all have recently credited AI-assisted research with increasing their patch cadence and volume". The same day VulnCheck reported that of 26,153 findings Anthropic says Claude discovered, "only 202 (0.8%) have been fixed". On 10 September Anthropic's own threat report described the GTG-10007 cluster running an autonomous exploit foundry that produced "more than a dozen possible zero day findings in a single month".

Development · Tue 8 Sep, Wed 9 Sep
Microsoft patches at least 974 flaws, its biggest batch ever, while only 0.8% of 26,153 Claude-found vulnerabilities are recorded as fixed

On 8 September Microsoft issued updates for "at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever", Krebs on Security reports. It "obliterates the software giant's previous record set in July, when it released updates for at least 570 security vulnerabilities", and brings 2026's total to "more than 2,600, more than twice Microsoft's previous record-setting patch year in 2020 (1,245) and with three more months to go". Two zero-days under active exploitation, CVE-2026-81963 and CVE-2026-85880, were fixed; "Fully 113 of the bugs addressed today earned Microsoft's 'critical' rating."

Friday, 30 October 2026

Mistral releases open weights for 1-trillion-parameter Mistral Large 4, claiming 19.7% on Cognition's FrontierCode 2.0 Company claim

Mistral AI·TechCrunch
  • Mistral says it has released the weights of Mistral Large 4 ("Le Chonk"), described in its post as "our flagship 1-trillion-parameter, natively multimodal model," and that it "leads with a score of 19.7%" on Cognition's private FrontierCode 2.0 benchmark.
  • On the Artificial Analysis Coding Agent Index Mistral reports 48%, "effectively tied with the leading open-weight model, GLM-5.3, while using 47% fewer tokens per task on average." It reports 41% on Terminal-Bench 4.0, "improved by 13 percentage points" against its own public preview while "reducing output tokens by 30%," and 51% on the Artificial Analysis Cyber Index.
  • Mistral says blind pairwise Surge Code evaluations preferred the model over GLM-5.3, Kimi K3 and DeepSeek V4.1 Flash, "ranking behind only Claude Opus 5.5 among the models evaluated," and that the model now has three reasoning modes, with High the default.
  • All of the benchmark figures are Mistral's own and none has been independently reproduced. The weights carry what Mistral calls the Mistral Ecosystem Open-Weight licence, a modified MIT licence under which businesses running a model-as-a-service offering need a separate commercial licence.
MistralOpen WeightsEvalsCyber Defense

Thursday, 29 October 2026

Google releases Gemini 4 Carbon to a subset of cyber defenders, claiming 59 on Artificial Analysis v5.0 mixedCompany claim

Google
  • Google says Carbon "ranks #1 on the recently updated v5.0 of" the Artificial Analysis Intelligence Index with a score of 59, and reports "a state-of-the-art 88.2%" on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench.
  • On the Gray Swan IPI prompt-injection benchmark Google says "Carbon achieves 0.0% — resisting every evaluated attack attempt", and reports the model "jumps +89 elo points to land at #4 (1768) on WebDev Arena".
  • Access is restricted: Google says "we will make Carbon available to a subset of cyber defenders" first, expanding gradually through the Fairwind Program, and that it is "actively engaged in the U.S. government's voluntary process for pre-release model testing". Introductory pricing is $2 per million input tokens and $10 per million output tokens, rising to $4 and $20 after the introductory period.
  • Every figure here is Google's own. The post names no independent evaluation and gives no date for developer or public availability.
AI-enabled hackingGoogle DeepMindEvalsCyber DefensePrompt Injection

PROBE benchmark: frontier coding agents reach under 21% recall and under 9% precision on 2,457 real bugs PreprintSingle source

arXiv
  • The paper builds a benchmark "consisting of all 2,457 bugs fixed over the course of 18 months across 20 diverse GitHub repositories" and reports that coding agents across frontier models "achieve a recall of below 21% and a precision of less than 9%" against that reference set.
  • Stronger models help on only one axis: they "increase recall substantially from 8% to 17%, they do not improve precision". Despite the low precision, "LLM and human evaluators still judge 85% of findings valid".
  • The authors' conclusion is in the title — the bugs agents find differ from the bugs maintainers fix. That makes precision measured against a maintainer-derived reference set a weak proxy for whether a finding is worthless, and it is the gap the paper says matters for deploying these agents.
  • Authors are Marco Paina, Mark Niklas Müller, Niels Mündler-Sasahara and Martin Vechev; the arXiv abstract page lists no affiliations. Posted to arXiv on 26 October and announced in the 28 October new-submissions listing. Not peer reviewed.
AgentsEvalsCyber Defense

ESET: APT groups use AI to speed up labour-intensive work but it has not reshaped the threat landscape Company claimSingle source

ESET
  • ESET's APT Activity Report covering April to September 2026, published 28 October, says "threat actors used AI primarily to accelerate tasks that would otherwise require painstaking effort", and concludes APT groups are "using AI much like mainstream software developers" rather than for "fully autonomous malicious operations".
  • ESET says it "also discovered phishing lures containing images that were clearly AI-generated".
  • One case is an attack on the defenders' own tooling: Russia-aligned UAC-0099 "inserted a decoy request for instructions on building a nuclear weapon into a script comment", which ESET says was "apparently attempting to trigger the safety guardrails of LLM-based security analysis and prevent the inspection of the malicious code that followed".
  • ESET's bottom line is a counterweight to a year of capability warnings: "we have not noticed AI substantially reshaping the APT landscape over the past six months". This is one vendor's telemetry, and the report gives no counts for how many groups or operations involved AI.
AI-enabled hackingThreat IntelCyber OffenseCyber Defense

Army picks AWS and World Wide Technology for a $2.6 million agentic cyber-defence pilot Single source

DefenseScoop
  • DefenseScoop reports the Army is moving ahead with Amazon Web Services and World Wide Technology on Project Griffin, an AI-enabled cybersecurity pilot with a combined total value of $2.6 million, under the Army Rapid Development of Cyber Defense Systems programme.
  • The capability sought is an Intelligent Response and Orchestration Node: an ecosystem of AI agents that draws on data from the Army's network sensors and takes defensive action faster than a human operator could. The Army received over 100 industry submissions and picked two vendors.
  • Col. David Bergmann, project manager for cyber warfare, is quoted saying "partnering with commercial industry is a national security imperative for the Army".
  • $2.6 million is a pilot, not a programme of record, and DefenseScoop reports no timeline, no success criteria and no detail on what authority the agents will have to act without a human. AWS and WWT did not immediately respond to requests for comment.
PentagonCyber DefenseAgentsMilitary

Wednesday, 28 October 2026

CISA advisory credits an autonomous AI system with four EPICS control-software flaws found in 3 hours 49 minutes beneficialCompany claim

CISA·SecurityWeek
  • CISA advisory ICSA-26-300-01, released 27 October, covers EPICS Base release "<=7.0.10", used worldwide in research-facility control systems, and credits Shubham Raj of Cipher / Causal Security. The four flaws are CVE-2026-114595, an integer overflow rated CVSS v3.1 9.8 Critical and v4.0 9.3 Critical; CVE-2026-114596, also an integer overflow, 8.2 High and 8.8 High; CVE-2026-114597, improper handling of length parameter inconsistency, 7.5 High and 8.7 High; and CVE-2026-114598, type confusion, 7.5 High and 8.7 High. The fix is EPICS Base 7.0.11.
  • SecurityWeek reports that Cipher, an autonomous security research system from Causal Security, took roughly 3 hours and 49 minutes to identify the four vulnerabilities, with its first phase running without human direction before it received one instruction to examine exploitability. Raj told SecurityWeek "All four can be triggered without authentication or user interaction", and that based on Cipher's review of code history the flaws are about 14.5 to 31.5 years old.
  • Code execution was not achieved: Raj said "Cipher demonstrated the attacker-controlled out-of-bounds heap write and process crash using AddressSanitizer" and did not pursue a functional remote-code-execution exploit. CISA states "No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time." Maintainers were notified on 9 June and patches merged in July and August — the timing figure is Causal's own.
AI-enabled hackingCyber DefenseAgentsIncidentsCyber Offense

OpenAI security executive says maintainers have "just stopped taking" AI-generated vulnerability reports mixedSingle sourceCompany claim

CyberScoop
  • Michael Aiello, OpenAI's cyber executive in residence, said at the DataTribe Challenge in Washington on Tuesday that an open-source maintainer "is just not going to respond to hundreds and hundreds of AI-submitted vulnerabilities", and that the result is that some have "just stopped taking" submissions. He called it "an ecosystem problem", saying most reports are likely real bugs but maintainers must still judge whether they are critical and worth their time.
  • His advice to submitters was to vet findings — "Make sure they're really high quality" — to write reports a single person can read, and to "spend your own resources coordinating vulnerability disclosure". CyberScoop cites OpenAI's website for its Daybreak program: 661 patches developed and tested, of which maintainers have accepted 458.
  • The Daybreak counts are OpenAI's own figures and are not independently verified, and CyberScoop reports only one outlet's account of the remarks. Aiello gave no figure for how many AI-generated reports maintainers are receiving, and said OpenAI's own process on recent PHP vulnerabilities "was not perfect" and the company is still learning.
AI-enabled hackingOpenAICyber DefenseAgentsIncidents

Monday, 26 October 2026

PHP2Shell confirmed successfully exploited in the wild for the first time, against PHP 8.4.26 harmfulUpdate

BleepingComputer·The Register
  • Adel Karimi, detection and response lead at Perplexity, says his honeypots "recorded evidence of confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26" for CVE-2026-109618 and CVE-2026-109619, the pair tracked as PHP2Shell. Karimi: "This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process. The response delivered an 800 KiB decoded cookie dump… the shell command then ran about 1.6 ms after the execution request's final captured byte." Expel threat researcher Marcus Hutchins called it "by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far".
  • This changes the picture. Until these findings, malicious activity was "limited to scanning, fingerprinting, and use of non-working exploits, with no known compromises", according to Dataminr's TRACE team, and Cloudflare, Hadrian, watchTowr, Previdian and Patchstack had all flagged pre-disclosure attempts as unsuccessful. The flaws were patched on Wednesday 21 October.
  • The AI link is in how the flaws were found: The Register reports that Britain's National Cyber Security Centre "worked with OpenAI to coordinate disclosure of the PHP flaws and give affected vendors time to prepare fixes, after AI-assisted researchers uncovered the vulnerabilities". PHP is "used by roughly 70% of all websites on the Internet, with more than 5.1 million PHP hosts exposed online and roughly 3.8 million with at least one port open to attacks, according to recent VirusTotal estimates".
  • Separately, the PHP security team published mitigation for a new unpatched RCE, CVE-2026-115560, exploitable only against systems "with an unusual combination of configuration and application code", advising admins to set session.upload_progress.enabled=0. Karimi's evidence is from his own honeypots and the attacker is not identified; neither source names who ran the exploit or what was taken.
AI-enabled hackingCyber OffenseCyber DefenseIncidentsOpenAI

Microsoft patches the OpenAI-found Brotli flaw across .NET, Visual Studio and PowerShell as Imperva proves code execution mixedUpdateSingle source

SecurityWeek
  • The Brotli decoder flaw CVE-2026-111497, now dubbed Node2Shell, is "an out-of-bounds write" affecting Brotli 1.0.3 through 1.2.0; "Google gave it a CVSS v4 score of 9.2, which puts it in the critical category", with fixes in Brotli 1.0.10, 1.1.1 and 1.2.1. Microsoft shipped fixes on 25 October: ".NET runtime versions 8.0.33, 9.0.22 and 10.0.14, along with .NET 11 Release Candidate 3", plus Visual Studio 2019, 2022 and 2026 and PowerShell 7.4, 7.5 and 7.6. Microsoft rates it elevation of privilege with a CVSS v3.1 base score of 8.1, critical for .NET and Visual Studio.
  • Imperva "has shown that it can be exploited for code execution on the official Node.js 24.22.0 image for Linux arm64", sending malicious data both in a server response fetched by the application and in a request body processed by Express 5 or body-parser 2. Imperva: "The proof did not succeed on every attempt. Our results establish code execution for the tested Linux arm64 build and application setups, and show how the fixed build handled the same inputs." It has not published the exploit.
  • Node.js credited the discovery to members of OpenAI Codex Security, and OpenAI says it surfaced during red-teaming. OpenAI also says the fix predates the disclosure: "This root cause issue was actually fixed in the Brotli source code in February, but it wasn't known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli."
  • No exploitation in the wild has been reported. SecurityWeek notes a public proof-of-concept on GitHub "reportedly achieves code execution only against an intentionally weakened build, and some researchers argued the bug can only be used for denial-of-service (DoS) attacks" — so the severity is contested. Bun, Envoy and Istio have also been updated.
AI-enabled hackingCyber DefenseOpenAIMicrosoftAgents

Saturday, 24 October 2026

OpenAI's Codex Security team found a critical Brotli decoder flaw now patched in Node.js, Bun, Python and Envoy beneficial

Node.js·The Hacker News
  • The Hacker News reports that CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder that permits remote code execution, was reported by OpenAI's Codex Security team; Node.js's October security release credits Khai Tran and Sylvie Mayer of that team. OpenAI said "an unpatched server that accepts compressed input could be taken over by a malicious client".
  • Affected and fixed versions per The Hacker News: Google Brotli 1.0.3 to 1.2.0, fixed in 1.0.10, 1.1.1 and 1.2.1; Bun 1.4.3 and earlier, fixed in 1.4.4; Python Brotli 1.2.0 and earlier, fixed in 1.2.1; Node.js 22.x, 24.x and 26.x, fixed in 22.23.4, 24.22.1 and 26.12.1. Google scores it 9.2 critical on CVSS 4.0 and Red Hat 8.1 important.
  • OpenAI said the root cause "was actually fixed in the Brotli source code in February" without anyone knowing it was a vulnerability, and no Brotli release carried the fix until 21 October — meaning the bug sat patched upstream and shipped downstream for eight months.
  • Imperva's Red Team demonstrated code execution on an unmodified Node.js 24.22.0 Linux ARM64 build under the name Node2Shell; the exploit took several attempts, has not been released and was not tested on other builds. The Hacker News says no in-the-wild exploitation has been reported, that CISA's 23 October assessment lists exploitation as "none", and that Red Hat says there is no reliable public proof-of-concept for code execution.
AI-enabled hackingOpenAICyber DefenseCyber OffenseAgents

UK sets out £415m for AI security, including an additional £120m for the AI Security Institute

GOV.UK
  • HM Treasury's 24 October page itemises AI security funding as the National AI Biosecurity Initiative at £165 million — £100 million for the AI Biosecurity Lab and £65 million for biosecurity surveillance and medical countermeasures for priority pathogens — an "additional £120 million" for the AI Security Institute for testing, research and technical standards, a £60 million National Cyber Shield using agentic AI for cyber defence including a £25 million challenge fund, and "A new £70 million National Exposure and Real-Time Vulnerability (NERV) Centre".
  • A further £138 million goes to what the page calls homegrown capability: an additional £60 million each for the Sovereign AI Fund and a Sovereign AI R&D Procurement Scheme, and £18 million for a UK Advanced Chip Design Academy. Regional measures include a £15 million AI Challenge Prize, an additional £23 million over three years for an AI Economics Institute, £30 million for Mayoral Strategic Authority AI partnerships, and an NCSC AI Cyber Security Centre of Excellence in Manchester with no figure attached.
  • The page cites existing deployments as justification: AI helps NHS clinicians analyse "over 210,000 chest X-rays" a month, around a third of all NHS chest X-rays, with suspected lung cancer cases identified within 24 hours up 11.5% and the average wait for follow-up CT scans down from 6.3 to 5.6 days; HMRC's "Ask HMRC" assistant supported around 6.3 million customer interactions in 2025-26.
  • The page gives no official total — it says "hundreds of millions" — and the figures above are the ones it itemises. Its own text is inconsistent on timing, saying both that the package "will be announced by the Chancellor next week" as part of the Budget and that the investment was "announced today"; the Chancellor is not named in the text we read, and the page lists Dan Jarvis, John Healey and Kanishka Narayan as the responsible ministers.
UKFundingCyber DefenseBio Risk

Friday, 23 October 2026

Anthropic says Claude wrote about 180 million lines of proof to verify crash-freedom in 123 open-source libraries beneficialCompany claim

Anthropic
  • Anthropic's Frontier Red Team says Claude, working with the verification company Theorem, proved crash-freedom for "239 entry points across 123 different OSS-Fuzz libraries" at the compiled RISC-V level, producing "about 180 million lines of Rocq" in total, with "a typical proof running to about 600,000 lines" covering binaries with "a median length of 18,000 RISC-V instructions".
  • Anthropic says the proving attempts "discovered hundreds of bugs", which Claude patched, without giving an exact count. The findings include a rediscovery of CVE-2026-56132 in libexpat, which needed deeply nested input, and a latent bug in a widely used PDF reader.
  • The assumptions are narrow and stated: the proofs hold for a single-threaded static binary with a fixed memory budget on a RISC-V CPU running Linux, with inputs "less than 64 MB". Anthropic notes the proofs target static musl binaries while most users run dynamically linked glibc builds on x86 or ARM.
  • Anthropic's own caveat: "'Formally verified' does not mean 'bug-free.'" A proof checker cannot confirm the specification matches reality, so bugs can remain in the trusted models of RISC-V, Linux and the Rocq checker; AddressSanitizer does not catch all memory-safety bugs; not every entry point was verified; and the proofs do not cover misuse of a library by its callers. Only a subset of proofs is being released, with any that might reveal unpatched bugs withheld.
AnthropicCyber DefenseAgentsAI For Science

UK minister: 32 government services unavailable and four partially unavailable as Cloudflare records millions of php2shell attempts harmfulUpdate

The Register·404 Media
  • UK tech minister Baroness Lloyd of Effra told the House of Lords on 22 October: "Currently, the information I have is that 32 government services are unavailable and four are partially unavailable," attributing the disruption largely to precautionary measures taken while security updates and mitigations are applied. The Office for Budget Responsibility took its website offline; peers raised reports affecting the DVLA and police services, and Liberal Democrat peer Baroness Ludford said councils including Edinburgh, Oxford, Bristol, Lambeth and Barnet reportedly went offline.
  • Cloudflare CEO Matthew Prince, quoted by 404 Media, posted: "In the 10 hours before [PHP2Shell] was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now." Government websites in Germany, France, Belgium, Finland and the Netherlands were taken offline as a precaution, along with Australia's cybersecurity agency website; 404 Media adds that 4chan, several Wikimedia services and Archive.org were temporarily taken offline for updating, and that the NSA and Japan's prime minister urged immediate patching.
  • 404 Media reports the security company Chainguard was criticised, including by the PHP Foundation, for posting fixes several hours before the official disclosure, and that in a LinkedIn post Chainguard CEO Dan Lorenc said his company independently found the same bugs by typing "find bad vulnerabilities in PHP" into a frontier AI model. 404 Media sets out the open question that raises: whether the bugs were exceptionally easy to find, whether the models that first found them absorbed that knowledge, or whether there was a leak in the disclosure process.
  • Lloyd told peers: "We are not currently aware of any confirmed compromise of central government systems resulting from these vulnerabilities," later extending that assessment to the wider UK public sector. This edition covered the two 9.2-rated remote-code-execution flaws and the pre-disclosure exploitation attempt on 17 October yesterday; the outage count, the attempt figures and Chainguard's account are new. Attempts are not compromises, and Whitehall has not published a full list of affected services.
AI-enabled hackingCyber OffenseCyber DefenseIncidentsUKCloudflare

OpenAI signs an agreement with NASK, Poland's AI Safety Institute, on evaluations and vulnerability work beneficialSingle source

Unite.AI
  • OpenAI and Poland's NASK National Research Institute signed an agreement, announced 23 October, to explore collaboration on "AI safety, security and technical research". NASK's AI Safety Research Center, which serves as the Polish AI Safety Institute, and OpenAI will work on evaluating increasingly capable AI systems, identifying potential vulnerabilities and strengthening safeguards.
  • OpenAI says its existing work with the US Center for Advancing Standards and Innovation for Super Intelligence, the UK AI Security Institute and other public institutions has helped with safeguards and with work to "identify and fix security vulnerabilities in AI agents".
  • The two have worked together before: CERT Polska, which operates within NASK, gained access to OpenAI's cyber-capable models through Daybreak in July 2026, and according to OpenAI the team helped discover six vulnerabilities in MikroTik RouterOS, with fixes that CERT Polska confirmed prevented the attacks it observed. NASK said on 2 July 2026 that it had gained access to GPT-5.5 Cyber through the Government Trusted Access for Cyber program, describing Poland as "the third European country" to receive such access.
  • The announcement gives no timeline, no funding and no specific evaluation methods. OpenAI's own article page could not be opened for this edition, so the figures and quotes above are from Unite.AI's report of it.
OpenAIEvalsEU AI ActUS Federal PolicyCyber Defense

Thursday, 22 October 2026

PHP ships emergency patches for two 9.2-rated remote-code-execution flaws that frontier models proved exploitable after a decade mixedCompany claim

The PHP Foundation·Wiz Research·CISA·Palo Alto Unit 42
  • The PHP Foundation says PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 ("RCE via OOM corruption") and CVE-2026-109619 ("RCE via stale global state"), both rated CVSS v4 9.2. CISA says the pair, known as "php2shell," "allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests," and tells organisations that cannot patch to take PHP systems offline. Unit 42 says Cortex Xpanse "identified over 22.6 million exposed instances potentially vulnerable."
  • Wiz Research says it used "Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol" throughout, that "every PHP version released in the last decade is affected by at least one of these vulnerabilities, going back to version 5.4," and that the flaws had "been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit." Wiz dates first discovery to 19 August 2026 and says the work took "a single researcher about a week."
  • The PHP Foundation's own account is unusually blunt. A core developer found the first signs of the OOM root cause in 2024, a fix stalled over compatibility and resourcing, and "the delay was a structural failure, caused by both the security team's decision process and its lack of resources." It says Calif began a Patch the Planet audit on 30 July, researcher Ryan A reported "an unconditional remote code execution with the same root cause" on 11 August, "OpenAI independently reported the same root cause on the same day," with further vectors from Wiz on 24 August and OpenAI on 18 September. It also says it earlier scanned PHP with Anthropic's Claude Mythos and now uses OpenAI's Daybreak Red to validate reports.
  • Disclosure was forced early: the Foundation says the CVE IDs "began circulating on online forums and social media" around 15:00 UTC on 20 October with a wrong CVSS of 10.0 and no technical details, so it moved the release from 22 October to 21 October at 14:00 UTC. It also says AI-assisted research has flooded the team, which has published 15 CVEs since 1 July and "worked through more than 100 reports that turned out to be invalid, duplicates, or not reproducible." Unit 42 says it has seen proof-of-concept code but reports no confirmed in-the-wild exploitation at publication.
AI-enabled hackingCyber OffenseCyber DefenseThreat IntelIncidents

Amazon says a php2shell exploitation attempt hit its honeypots on 17 October, four days before public disclosure harmfulCompany claimSingle source

AWS Security Blog
  • Amazon Threat Intelligence says it "identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619." The attempt came from "an IP address associated with a commercial anonymization network," and Amazon says "it remains unclear how the actor acquired exploit information prior to disclosure."
  • Amazon says the earliest proof-of-concept it saw on release day was "around 2026-10-21 0200 UTC," twelve hours before the embargo lifted, and that from 02:00 to 08:00 UTC it identified further attempts "from additional anonymized infrastructure" whose payloads and infrastructure choices "varied, suggesting these were multiple actors." It says php2shell "is now being broadly exploited in the wild."
  • Amazon draws the general lesson explicitly: "AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit. As a result, more actors can act within hours or even minutes once technical details of a vulnerability are disclosed." Its advice is to measure patch timelines for internet-facing systems "in hours" and to start investigations "from the earliest known exploitation, not from the disclosure date."
  • This is Amazon's own honeypot telemetry and no other vendor has corroborated the 17 October attempt. Amazon says technical analysis is ongoing and that "it's unclear if any of these attempts would have succeeded in real-world systems."
AI-enabled hackingThreat IntelCyber OffenseCyber DefenseAmazon

OpenAI proposes a five-stage disclosure process for AI-found bugs and says such findings will "increase sharply" Single source

Help Net Security
  • Help Net Security reports OpenAI has proposed a five-stage process for handling critical vulnerabilities in widely used software, grown out of its two-month response to the PHP flaws, and quotes the company: "As significant as they are, these bugs are among several significant vulnerabilities we've already found and are working to fix, and we expect similar findings to increase sharply in the coming months."
  • The stages, as described: maintainers, researchers and technical partners confirm and fix the bug, with part of the testing "pointing frontier models at the patch to hunt for ways around it and for related variants"; affected organisations get a head start to prepare mitigations; responders bring in government — for PHP, "the White House's Super Intelligence Force, the Office of the National Cyber Director, CISA, and international partners"; the circle widens to more distributors and operators; and after the patch ships, responders publish guidance while operators deploy.
  • Early access is rationed on three factors — "an organization's protective role, how long it needs to act, and whether it can handle sensitive information" — with maintainers making the final call and each participant getting "what its job requires, from network logs showing indicators of compromise up to working proof-of-concept exploits." OpenAI is quoted saying "Even limited details can reveal a vulnerability."
  • This is a proposal, not a standard anyone has adopted, and the article notes OpenAI is still asking maintainers how long disclosure windows should run and how to fix package versions that no longer get security updates. One open question it raises goes further than disclosure: whether governments or operators should use a vulnerability to patch systems they own after losing administrative access. OpenAI's own post could not be read directly, so these figures and quotes come from Help Net Security's account of it.
AI-enabled hackingOpenAICyber DefenseUS Federal Policy

Wednesday, 21 October 2026

OpenCode says frontier models began refusing to analyse attack code mid-breach, before it got relaxed-restriction access mixedUpdateSingle source

SBS News
  • SBS News, citing Axios reporting on the 20th local time, says OpenCode co-creator Dax Raad posted on X on the 18th that advanced AI models initially helped investigate the API-key breach but then "began refusing" to cooperate, with safety restrictions blocking requests once OpenCode began handling potentially malicious code. SBS says attackers hit OpenCode's systems nonstop for two days, keeping its own AI agents working around the clock.
  • SBS says OpenCode subsequently gained access to OpenAI's "Daybreak Blue" program, which it describes as giving verified cybersecurity defenders access to models with looser restrictions — a concrete instance of the defender-side cost of refusal policies, and of the carve-out being built for it.
  • SBS quotes Raad on the 19th: "We certainly need to be more proactive, and we've made a huge amount of progress over the past few days."
  • The Axios original could not be opened from here, so these facts come from the SBS write-up of it; the refusal behaviour is Raad's account and no model provider's response is reported. This is a new development in the OpenCode breach covered in earlier editions.
OpenAICyber DefenseIncidentsAgents

Sunday, 18 October 2026

US cybersecurity job postings fell 26.4% while AI Security Engineer demand rose 268.3%, CyberSN report says mixedSingle sourceCompany claim

SecurityWeek
  • SecurityWeek, reporting CyberSN's Cybersecurity Jobs Report, says US cybersecurity postings from January to September 2026 were 235,786, against 320,210 in the same period of 2025 — a 26.4% decline. Demand for the AI Security Engineer role rose 268.3% and Cyber Data Scientist 203.5% on the same year-on-year basis.
  • Per SecurityWeek, "just under 15% of all job postings now reference AI," compared with 15.1% in the same period last year, with the share peaking at 20.0% in September 2026 — so the overall AI share is flat year on year even as specific AI roles surge.
  • The figures are CyberSN's, aggregated from JobSpikr with duplicates removed and mapped to its own taxonomy of functional roles. A job-posting count measures advertised demand, not employment, and CyberSN does not separate AI-driven substitution from the wider hiring slowdown; no independent dataset is cited alongside it.
LaborCyber DefenseAgents

Saturday, 17 October 2026

Anthropic says an internal research model traced NIST's ECDSA curve seeds to lrand48 and Unix timestamps beneficialCompany claim

Anthropic·Filippo Valsorda
  • Anthropic's Frontier Red Team says an employee asked an internal research model how the NIST curve seeds were generated, and that in under half an hour it found the origins of the P-192, P-224, P-256, P-384 and P-521 seeds. Anthropic writes that none of them were the results of any hash algorithm at all, but outputs of the C library's lrand48 generator seeded with a Unix timestamp.
  • The prime-curve timestamps fall between May 1997 and April 1998; Anthropic gives 1997-05-18 14:45:34 for P-192, 1997-08-16 01:52:34 for P-256 and 1998-04-03 12:52:07 for P-224, and says the four binary-curve seeds B-233, B-283, B-409 and B-571 map to 17 April 1998 once the timestamps are halved. Recovering lrand48's 17 hidden bits meant trying 2^17 values, with state recovery by LLL lattice basis reduction.
  • Filippo Valsorda, who posted the seeds bounty in 2023, writes that it has been claimed by ten people from Anthropic and that the seeds were generated with the POSIX-standard drand48 generator seeded with the then-current Unix timestamp. Anthropic says the $36,864 bounty will be donated to the Internet Security Research Group, which Valsorda identifies as the nonprofit that runs Let's Encrypt.
  • Anthropic states that this is not a cryptographic break, new attack, or weakness in the ECDSA curves, and says it makes a deliberate backdoor less plausible. It also says the fifth binary seed B-163 remains unexplained, as do the base points for P-224, P-256, P-384 and P-521, and that a small number of viable candidate seeds were skipped for reasons that are not known.
AnthropicAI For ScienceCyber Defense

Friday, 16 October 2026

Bank of America hired 1,000 contractors to patch bugs found with Anthropic's Mythos model, CEO tells earnings call mixedSingle source

The Register
  • The Register reports Bank of America hired 1,000 contractors in the second quarter, on top of about 3,000 existing technical staff, to handle the patch workload created by vulnerabilities found with Anthropic's Mythos model, and that the contractors remain in place.
  • CEO Brian Moynihan put combined remediation costs tied to Mythos findings and anti-money-laundering orders at "a couple of hundred million plus", without separating the two figures.
  • The Register cites Mozilla as saying Mythos found 271 flaws in Firefox 150, and quotes Mozilla CTO Bobby Holley from April: "So far we've found no category or complexity of vulnerability that humans can find that this model can't", adding that no Mythos-found bug was beyond an elite human researcher.
  • Other figures in the piece: about 130 AI projects with expected returns of 2x to 3x, expected AI benefits of $250M-$300M in 2026 rising to $700M by the end of 2027, tech engineering productivity about 10% higher, and roughly 3,000 roles cut including a 5% reduction in managers. The remarks were made on the bank's third-quarter earnings call on 14 October.
AI-enabled hackingAnthropicCyber DefenseLaborEarnings

Thursday, 15 October 2026

Booz Allen says AI agents met every objective across eight OT attack scenarios, reaching an industrial control network in about 16 minutes harmfulCompany claim

SecurityWeek
  • SecurityWeek, quoting Booz Allen's whitepaper, reports that across eight scenarios every defined test objective was achieved, and that in one test models moved from a perimeter compromise to actions inside an industrial control network in little more than 16 minutes. The firm's own summary is that frontier models "navigated unfamiliar industrial systems, adapted when blocked, and moved physical equipment within minutes".
  • The agents were given no prior knowledge of the operational technology in question — no source code, engineering documents or advanced OT guidance. SecurityWeek says existing defences blocked or slowed some actions, but that no single safeguard consistently stopped the autonomous models from achieving their objectives.
  • The tests are Booz Allen's own, run in its isolated lab, and SecurityWeek says the findings were presented at its own ICS Cybersecurity Conference before public release. It also questions the firm's use of "super intelligence", noting the September 29, 2026 executive order replacing "Artificial Intelligence" with "Super Intelligence" across the executive branch, and says Booz Allen had not responded to its request for clarification.
AI-enabled hackingCyber OffenseAgentsCyber Defense

UK officials tell MPs that AI safeguards in the Cyber Security and Resilience Bill are still only under consideration Single source

The Register
  • The Register reports Alexandra Jones, director general at the Department for Business, Innovation, Science and Trade, told MPs the government proposes using the Cyber Security and Resilience (Network and Information Systems) Bill to improve preparedness for AI, cyber and loss-of-control risks — including how serious incidents and near misses are reported and how AI-driven disruption is contained — and that it is "developing the policy to look at whether we use the Cyber Bill to do that". No amendments are committed.
  • Committee chair Liam Byrne replied: "You can't consider something in a bill. You have to legislate for something in a bill." AI minister Kanishka Narayan said this week the government would step up national defences against growing AI risks, adding: "We will legislate wherever necessary."
  • Daniel Kokotajlo of the AI Futures Project told the committee his group's "least bad plan" included no recursive self-improvement, more industry transparency and more regulation; Byrne summarised the testimony as saying companies cannot be trusted to self-regulate. Responsibility for the bill moved to the Department for Digital, Culture, Media and Sport after recent machinery-of-government changes.
UKCyber DefenseAlignment

Wednesday, 14 October 2026

MI5 sets up an AI Threat Assessment Centre; McCallum names bioweapons the AI misuse case he weights most heavily Single source

Digital Journal (AFP)
  • In his annual threat update on 13 October, MI5 Director General Ken McCallum said AI has the "potential to change the stakes on existing or even new bioweapons", and announced an AI Threat Assessment Centre housed at MI5's headquarters, drawing on other bodies and "producing all-source assessments which separate the bluster from the realities", per AFP's report.
  • McCallum said MI5 had uncovered "suspects using AI to improve its reconnaissance efforts and means of attack", including with AI-enabled drones, and said "Over the last decade, our state threats caseload has quadrupled."
  • This is a domestic intelligence service standing up a dedicated AI assessment function rather than treating AI as a cross-cutting topic — and naming bio, not cyber, as its top misuse concern.
  • The bioweapons concern is prospective: AFP's account reports it as potential, with no disclosed attack. MI5's own speech page and the centre's page both returned HTTP 403 to automated reads, so the quotations above are as AFP reports them. The AFP piece does not name which partner bodies feed the centre.
UKBio RiskThreat IntelCyber Defense

Army launches Project Gatekeeper on October 23, an AI-assisted sandbox to vet commercial software in minutes mixedSingle source

Breaking Defense
  • Breaking Defense reports the Army announced at AUSA that Project Gatekeeper, a cybersecurity sandbox on the Army's cloud isolated from operational networks and sensitive data, launches October 23, 2026. Uploaded software runs through the Army's standardized cybersecurity tools including an AI assessment, and within minutes the system either reports a pass or gives detailed feedback on what failed.
  • Companies can submit software without an Army contract, a program manager sponsor or a formal request for proposals. Breaking Defense says the current process takes days or weeks and some projects have stalled for as long as nine months; acting Army CIO Gabe Chiulli said "Success, to me, looks like a company, within minutes, is able to log in."
  • It is an AI system placed on the approval path for software entering Army networks — the gate, not the capability being gated.
  • David Wright, chief engineer at the Army Software and Innovation Center, told Breaking Defense "The idea here is not to lessen the security requirements." Companies initially need Common Access Cards; Wright gave mid-November as the target for integrating GSA's Login.gov, under an agreement still being finalized. Only Breaking Defense has reported this, and the Army has published no accuracy or false-pass figures for the AI assessment.
PentagonMilitaryCyber DefenseUS Federal Policy

Anthropic opens a Singapore office and signs an MOU with Singapore's digital ministry on evaluation and incident response Company claimSingle source

Anthropic
  • Anthropic says it has opened a Singapore office, its fifth in Asia-Pacific, and signed a Memorandum of Understanding with Singapore's Ministry of Digital Development and Information, signed at Singapore International Cyber Week by Permanent Secretary Kai Fong Chng and Anthropic co-founder Ben Mann, witnessed by Minister Josephine Teo and Anthropic's Head of APAC Policy Michael Sellitto.
  • The MOU covers AI safety, security and model evaluation; research on AI adoption and its impact; responsible adoption across public and private sectors; technical exchanges on model evaluation, testing standards and incident response; AI skills and public-officer training; and sharing research and data including from the Anthropic Economic Index.
  • Anthropic names GovTech Singapore, with "more than 1,500 engineers and technical staff" using Claude Code, the Cyber Security Agency of Singapore, DBS, GIC, Grab — whose BriX sales assistant it says saves sales teams "approximately 40,000 hours every quarter" — Sea and Supabase. It says Singapore ranks "second of 121 countries" for Claude.ai usage relative to population, at "nearly six times what its size alone would predict".
  • All figures and customer claims are Anthropic's, with no independent verification and no methodology published for the Grab hours-saved figure. An MOU is not a binding agreement, and Anthropic does not say what, if anything, either party has committed to fund or deliver.
AnthropicUS Federal PolicyAgentsCyber Defense

Tuesday, 13 October 2026

Army Cyber Command is putting AI agents on its share of the Pentagon's network, with Project Griffin awards due to two firms

DefenseScoop·Breaking Defense
  • ARCYBER is adding work roles for AI agents and allowing them to operate in the Army's portion of the Department of Defense Information Network, DefenseScoop reports. Task Force Lexington, stood up in April with "nearly a dozen" civilians and service members under a colonel, has mapped out a full Cyber Protection Team made up of agents, including analytic support and network analyst roles.
  • Lt. Gen. Christopher Eubank, the ARCYBER commander, said agents are trained and run in a sandbox with human oversight and retraining before they touch the Army network, that none "have strayed to this point," that each is treated "just like a human operator" with only limited actions permitted, and that guardrails will be reduced gradually.
  • Project Griffin, a commercial solutions opening published in August, drew 108 submissions, was narrowed to ten finalists and then to two, with awards to two unnamed companies due to be announced Friday. Brandon Pugh, the Army's principal cyber advisor, called the award the "take action element," allowing autonomous responses within parameters set by a human operator, and said the Army's Panoptic Junction tool has a "nearly 90 percent success rate at identifying malicious activity on the network" but the Army lacks a way to remediate what it finds.
  • The companies are not named and the agents will not begin working on government networks immediately. The "nearly 90 percent" figure for Panoptic Junction is the Army's own and the sources do not say how it was measured, or against what rate of false positives.
AI-enabled hackingPentagonCyber DefenseAgentsMilitary

UK says its AI Security Institute is now evaluating Gemini 4 Argon, as pilots fix over 1,000 government vulnerabilities Update

GOV.UK·GOV.UK
  • AI minister Kanishka Narayan's speech says "AI scientists at the AI Security Institute are now conducting rigorous evaluations of the latest generation of models, including Gemini 4 Argon" — naming a specific model under evaluation after reports that pre-release access to US frontier models had been restored. The press release credits the restored access to work "with the US government, the labs."
  • The package builds "on two pilots that have already helped identify and fix over a thousand potential cyber vulnerabilities across government systems, and detect potential cyber threats." The release says stronger protections against AI threats will be considered through the Cyber Security and Resilience Bill regime, including "how serious AI incidents and near misses can be identified and reported," and that new work is underway to prepare Britain for serious incidents involving autonomous AI agents.
  • Narayan is quoted saying "I want Britain to become one of the hardest countries in the world to attack using artificial intelligence. We will use every power at our disposal. We will legislate wherever necessary," and telling developers: "if you cannot adequately control the risks, do not release the system." The speech says AISI brings together "over a hundred exceptional technical experts."
  • This is an update: the restoration of UK pre-release access was reported in the previous edition. What is new is the confirmation that evaluations have begun, the model named, the 1,000-plus vulnerabilities figure and the Cyber Security and Resilience Bill route. No legislation has been introduced, and the release does not say which systems the pilots covered or how the vulnerabilities were counted.
UKEvalsCyber DefenseGoogle DeepMind

Monday, 12 October 2026

16,977 flagged Hugging Face models appear in over 21,000 code locations across more than 5,000 repositories harmfulPreprint

arXiv
  • The study (arXiv:2610.12893), from Adelaide University and ElevexAI Systems, tracks "16,977 known vulnerable models on HuggingFace flagged by InsightDB" across GitHub repositories, software packages, fine-tuning chains and deployed applications.
  • It reports that "despite being publicly flagged, these vulnerable models appear in over 21,000 code locations across more than 5,000 open-source repositories, with 3,757 distinct flagged models (22.1%) actively referenced in at least one project".
  • Using Code Property Graph extraction with frequent subgraph mining, the authors report that "across all patterns, we find no evidence of provenance verification or model sanitization logic, with developers frequently bypassing security parameters or delegating trust to permissive framework defaults".
  • The flagging comes from one commercial scanner, InsightDB, and the paper does not say how many of the flagged models were still downloadable at the time of the study. It is a preprint and has not been peer reviewed.
Open WeightsCyber DefenseAgent Security

Northwestern study: AI patches stopped the crash about 90% of the time but passed maintainers' tests only about 61% mixedPreprintSingle source

arXiv·Help Net Security
  • The researchers curated "112 historical bugs from 84 open-source C/C++, Go, and Rust projects, each with PoC tests, regression tests, and additional developer tests that assess alignment with the original developers' design principles". Help Net Security reports the newest Claude model they tested stopped the crash about 90% of the time but passed the maintainers' tests only about 61% of the time, failing those tests on roughly four in ten bugs, and that with Claude Opus 4.7 a third of the patches that made the crash go away still failed the maintainer tests.
  • The paper's claim is about measurement, not just models: "LLMs can achieve high PoC passing rates under ideal conditions, yet benchmark execution choices can materially change measured success", while "developer-test passing rates remain low and improve only marginally with newer models, suggesting that models increasingly suppress symptoms without consistently producing upstream-quality fixes". Help Net Security quotes the authors calling a patch that only blocks the crash path "strictly worse than no fix at all".
  • The team reviewed 13 benchmarks and datasets, and Help Net Security reports each of the five built for AI agents left at least one of nine identified pitfalls unaddressed. Simply telling the model how to build and test the code raised its success rate on the C and C++ bugs by 20 points.
  • The preprint was submitted on October 7th, outside this window, and Help Net Security's write-up on October 12th is the only coverage found. It has not been peer reviewed, and the abstract does not name the models.
Cyber DefenseEvalsAgents

UK says AI pilots found and fixed over 1,000 government vulnerabilities, and will explore covering AI loss of control in the Cyber Bill beneficial

GOV.UK·LBC
  • The announcement, issued on 12 October 2026 by the Cabinet Office, the AI Security Institute, the National Cyber Security Centre and the Department for Digital, Culture, Media and Sport, says the government will put frontier AI to work on cyber defence, "building on pilots that have already identified and addressed over 1,000 vulnerabilities" across government systems.
  • It says stronger protections are "to be considered through the Cyber Security and Resilience Bill regime, such as how serious AI incidents and near misses can be identified and reported", so that essential services such as hospitals and utilities are better protected, including from "AI loss of control risk, where autonomous AI systems evade human oversight". Work is under way with the NCSC and AISI on responding to incidents involving AI agents, because "a major incident involving AI agents could play out quicker and wider than other major incidents that governments are designed to respond to".
  • AI minister Kanishka Narayan, speaking at Imperial College London's Base One, said "I want Britain to become one of the hardest countries in the world to attack using artificial intelligence", "We will use every power at our disposal. We will legislate wherever necessary", and, to frontier developers: "Listen when your scientists warn of serious dangers. Investigate unexpected behaviour. And if you cannot adequately control the risks, do not release the system."
  • LBC reports Narayan also said "it seems likely, if not inevitable, that our own cyber defences will be breached", citing the Australian case in which an OpenAI agent "went looking for information about public spending on medicines" and "found another way in" past access restrictions. The release commits to exploring and considering rather than legislating now, the 1,000-plus figure is the government's own, and GOV.UK says more detail on support for UK AI verification will come "in the coming months".
UKCyber DefenseAgent Security

Sunday, 11 October 2026

OrcaRouter ships OrcaCyber Zero 1.5 for exploit development, claiming 100% on Cybench and gating access to vetted researchers mixedCompany claimSingle source

MarkTechPost
  • MarkTechPost reports that OrcaCyber Zero 1.5, released October 10, 2026, is "a post-trained Orca model for vulnerability reproduction, exploit development and penetration testing" with a 1M-token context window, 128K maximum output, native function calling and structured outputs. Parameter count is not disclosed, no weights are released, and it runs through a hosted API only.
  • Vendor-reported scores on the model page, "last evaluated October 10, 2026": Cybench 100% (39/39 tasks, unrestricted agent execution); CVE-Bench 95.8% (23/24 evaluable tasks); HumanEval+ 93.9%; SWE-bench Pro V2 76.5%. MarkTechPost notes Cybench "contains 40 professional CTF tasks, so the 100% covers 39 of them", and that CVE-Bench "is built on 40 critical-severity web CVEs" while Orca's figure "covers a 24-task evaluable subset".
  • Pricing is "$3.00 per 1M input tokens and $7.50 per 1M output tokens", with cache reads at $0.75 per 1M, against Claude Mythos Preview at "$25 / $125 after credits" in MarkTechPost's comparison table. Access is "gated to the Security Research tier", which Orca says requires an engagement, a passkey and accepted terms. The predecessor, Zero 1.0, shipped September 17, 2026.
  • MarkTechPost states plainly: "All results are vendor-reported, with no technical report yet", and "All competitor figures come from each vendor's own announcement. None are independent replications." The 98.07% CyberGym figure in the same table belongs to Zero 1.0 inside Orca's own harness, and the latency numbers rest on 1.3K tokens of traffic over seven days.
AI-enabled hackingCyber OffenseEvalsAgentsCyber Defense

Booz Allen says frontier models met the objective in all eight autonomous attacks on industrial control equipment harmfulCompany claimSingle source

The Register
  • Booz Allen Hamilton's operational-technology lab tested eight scenarios covering an "autonomous, AI-enabled OT attack chain", and The Register reports "the models achieved the objectives across all eight scenarios, turning digital access into physical actions – in one case finding and moving a robotic arm in just minutes". In another test the models "progressed from a perimeter compromise to actions inside an industrial control network in just over 16 minutes". In the SCADA test the model found that the gateway "exposed live, pre-auth connections to 14 OT devices", meaning compromising one device provided access to 14 others.
  • The report says that "across multiple vendors and repeated test rounds, the models performed OT-focused tasks with a high degree of engineering-level precision and, when authorized to execute, repeatedly produced intended controller and equipment actions", and concludes that "specialized OT knowledge, unfamiliar equipment, and complex control environments are no longer meaningful barriers to attack". Kyle Miller, Booz Allen's vice-president of infrastructure cybersecurity, told The Register that "AI agents can operate with a speed, persistence, and engineering-level precision that may outpace organizations that have not implemented foundational OT cybersecurity practices".
  • The lab was a multi-vendor environment modelled on a general manufacturing facility with enterprise, industrial DMZ, plant operations and production zones, containing programmable logic controllers, human-machine interfaces, a SCADA platform, a variable-frequency drive, a robotic arm and sensors. The models "did not receive any source code, engineering documents, or advanced OT or IT guidance".
  • The caveats matter: Booz Allen "declined to identify the models it tested", describing them only as two of the "latest frontier models from the leading AI providers". Agents "had to wait for human approval before exploiting a security issue or taking any action that could cause a physical impact" and were told to use "extra caution" around safety-critical devices, so this is not an unsupervised run. Miller said "there's not a defined timeline for a nightmare scenario per se". The figures are the consulting firm's own; The Register is the only outlet reporting them.
AI-enabled hackingCyber OffenseAgentsCyber DefenseAgent Security

Friday, 9 October 2026

Anthropic launches a critical-infrastructure defence programme with 11 founding partners and a free open-source scanner beneficialCompany claim

Anthropic·Anthropic (Frontier Red Team)
  • Anthropic says the Critical Infrastructure Defense Program gives trusted security providers frontier Claude models, on-site engineers and threat research to protect operational technology such as power grids, water systems and transportation networks. The 11 founding partners it names are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation.
  • The second component, OSS Scanner, is a free opt-in service giving open-source projects periodic scans from Anthropic's strongest models, with reports that Anthropic says are fully model-generated with no human review. Its Frontier Red Team post says the work found "over 29,000 candidate vulnerabilities" over the last six months, of which about 6,000 were manually reviewed and triaged and nearly 5,000 reports went to maintainers. Anthropic says it expects a true-positive rate above 90%.
  • On validation, Anthropic says penetration testers reviewed 97 critical and high-severity findings across 48 projects and 85, or 88%, met the bar for its coordinated disclosure process; of the remaining 12, 11 were real but duplicates or otherwise known and 1 was a false positive. It says wolfSSL received 74 reports of which all but two were valid, and five became CVEs. On the CyberGym benchmark it says LLM performance rose from under 20% of vulnerabilities found at the start of last year to over 85% this year.
  • Anthropic says Project Glasswing, which scanned hundreds of open-source projects, was merged into its expanded Cyber Verification Program earlier in the week, and that its Defender Advantage Fund, launched in August, keeps OSS Scanner free. It says more than half of US states were offered Claude models and support through a June cyber defence programme for state, local, tribal and territorial governments.
  • The above-90% true-positive rate is Anthropic's expectation, not a measured result, and the post gives no dollar figure for the Cyber Mission or for the fund. Anthropic says some operational-technology fixes may take decades and forecasts that AI will favour defence in about two years.
AI-enabled hackingAnthropicCyber DefenseOpen Weights

Thursday, 8 October 2026

JFrog discloses unpatched 9.8 remote code execution in LMCache's ZeroMQ transport, CVE-2026-105192 harmful

JFrog Security Research·The Hacker News
  • JFrog rates CVE-2026-105192 at 9.8, critical. It says LMCache's multiprocess mode opens an unauthenticated ZeroMQ ROUTER socket with no CURVE, ZAP, password or message authentication, and passes incoming msgpack messages with extension code 1 to pickle.loads, so one crafted message runs code as the LMCache process user — and official container images run that process as root.
  • The vulnerable decode path shipped in v0.3.9 and was still present in v0.5.5, the v0.5.6 release candidates through v0.5.6rc3, and the dev branch as of 7 October. JFrog says no fixed release had been published as of that date.
  • LMCache is a KV-cache layer used in front of LLM serving stacks, so the exposure sits in inference infrastructure rather than in a model.
  • JFrog says the socket binds to localhost by default, so the 9.8 score applies only where an operator has set a routable address with --host; the practical blast radius depends on that deployment choice. The Hacker News says LMCache has published no security advisory, and JFrog's advice is to keep the server on a local or trusted address.
Agent SecurityCyber DefenseIncidentsCompute

Epoch AI/Ipsos polling finds US adults' reported cyber-incident rate flat at 46% to 45% from June to September Single source

Epoch AI
  • Epoch AI reports that the share of US adults saying they experienced any cyber incident in the past 12 months was 46.2% (90% CI 43.6–48.8) in the 12–14 June 2026 wave (n = 1,021) and 44.6% (42.0–47.2) in the 18–20 September 2026 wave (n = 1,024), rounded in the text to 46% and 45%.
  • Among frequent AI users — daily or weekly, n = 233 in June and n = 215 in September — the figures were 53% (48–59) and 51% (45–57), also with no detectable change. All six measured incident types fell or held steady: convincing spam 32.2% to 32.1%, leaked personal information 19.8% to 18.2%, account break-ins 7.9% to 6.0%.
  • This is a rare attempt to measure whether frontier model releases show up in ordinary people's experience of cybercrime. Epoch notes the June poll ran days after Anthropic released Claude Fable 5, and points to a spike in serious vulnerability disclosures in June and July — neither of which moved the self-reported rate.
  • Epoch states the poll "cannot identify AI-caused incidents or estimate the effect of specific model releases". Each wave is a fresh random sample rather than a tracked panel, with only about 40 respondents in both by chance; recall windows overlap, and everything is self-reported. Absence of a detectable change over three months is not evidence of no effect.
AI-enabled hackingThreat IntelCyber DefensePublic OpinionAnthropic

Wednesday, 7 October 2026

Oxford benchmark: misuse monitors that read content collapse to AUC 0.52 on prompt injection mixedPreprintSingle source

arXiv
  • arXiv:2610.07089, "Towards a Unified Misuse Monitoring Benchmark" by Aniruddh Pramod, James Oldfield and Adel Bibi of the University of Oxford, builds "a benchmark of ~6,200 conversation transcripts between a user, an LLM agent, and the external environment" covering both decomposition attacks and prompt-injection attacks in one schema.
  • Across 17 monitor configurations the authors report that their action-framed monitors "perform well on both threats under classical metrics (AUC: 0.95 and 0.99 respectively)", while "content-framed monitors collapse on injection attacks (AUC: 0.52)" — a score at the level of a coin flip.
  • The paper also reports that "all monitors localise decomposition attacks poorly under the interval metric", and argues that position-blind metrics "paint an optimistic picture of monitor performance". That matters for deployed defences, which are usually scored on exactly those metrics.
  • This is a preprint, submitted 5 October 2026, and has not been peer reviewed. The 50-page paper reports the authors' own monitors as the best-performing configuration, and the comparison set is the authors' own construction rather than a vendor's production monitor.
Agent SecurityPrompt InjectionEvalsCyber Defense

Anthropic merges Project Glasswing into a three-tier cyber programme, citing 129,000 verified vulnerabilities mixedCompany claim

Anthropic·The Register
  • Anthropic says the expanded Cyber Verification Program "now consists of three access tiers" — Defense Access, Red Team Access and Specialized Access — and that "Each tier includes access to our most capable models, including Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1, and new models moving forward." It discloses that Glasswing partners "uncovered at least 129,000 verified software vulnerabilities between April and July 2026", that its own open-source scanning "found an additional 5,500 verified software vulnerabilities between April and October 2026", and that "more than 33,000 have so far been rated as critical- or high-severity".
  • On its own safeguard tests Anthropic reports that across five attempts at each of 10 CyScenarioBench challenges per tier, "In the Defense Access tier, 46 of the 50 trials were blocked at some point in the challenge, while the remaining four tasks succeeded", and "In the Red Team Access tier, no blocks occurred, and Claude Opus 5.5 successfully completed 34 of the 50 tasks—effectively equivalent to the model's 67.6% success rate on this evaluation with no safeguards applied." Specialized Access, with the fewest blocks, covers testing of "flight operating systems, power grids, telecom networks, interbank transfer infrastructure, and government administrative networks", and Anthropic says it reviews every such organisation "in collaboration with the US government".
  • The vulnerability counts are Anthropic's own and the company states their limits: they rest on "partial data from 33 partner reports", "fewer than 50% of partners disclosed patched numbers", and Anthropic expects "the true impact to be at least five times higher". Data retention is mandatory for enrolled organisations "so that we can monitor for cyber misuse".
  • The Register reports a sceptical reading of the same numbers: VulnCheck researcher Patrick Garrity "was not particularly impressed with CVEs identified by Project Glasswing, noting that fewer than 0.5 percent of the 225 Anthropic-linked vulnerabilities he tracked were being exploited in the wild". It adds that on Anthropic's own figures, "of 5,674 true positive vulnerabilities, 3,014 are high severity, and 1,522 are critical severity, yet only 516 have been patched."
AI-enabled hackingAnthropicCyber DefenseThreat IntelCyber Offense

Sunday, 4 October 2026

Google suspends product-vulnerability submissions to its open-source bug bounty over an influx of invalid AI reports harmfulSingle source

Tom's Hardware
  • Tom's Hardware reports that Google "has officially suspended product vulnerability submissions to its Open Source Software Vulnerability Reward Program (OSS VRP) ... over an influx of invalid AI-driven reports", announced in an official Google post on X on October 1 and effective the same day. Google committed to an update on the programme by the first quarter of 2027.
  • The suspension does not cover product vulnerabilities submitted before October 1, and does not affect OSS VRP supply-chain reports, which cover compromised build pipelines and tampered packages. Google said it may still accept product-vulnerability reports through the Cloud VRP, "for some Google Cloud repos impacting Google Cloud products".
  • This is the AI-slop problem arriving at one of the better-funded bug bounties. Tom's Hardware writes that Google engineers and open-source maintainers "were reportedly being overwhelmed" by reports that claimed to find bugs but were "invalid or unexploitable hallucinations", and notes Linux ended support for older network drivers after a similar flood.
  • The underlying announcement was an X post on October 1, two days before this window; the figures for how many invalid reports arrived are not given, and the "thousands" characterisation is Tom's Hardware's, attributed as reported rather than to a Google count. We could not open Google's own OSS VRP rules page, which renders client-side.
Cyber DefenseIncidentsAgents

Saturday, 3 October 2026

GitLab patches a CVSS 9.9 AI Gateway flaw that let a user escape the prompt template sandbox mixedSingle source

The Hacker News
  • The Hacker News reports CVE-2026-90970, rated 9.9 out of 10, in the prompt template of custom flows within GitLab's Duo Agent Platform: a logged-in user with platform access could "escape the prompt template sandbox via a specially crafted flow configuration", potentially achieving arbitrary command execution on the gateway.
  • Affected versions run from 18.1.6 up to (but not including) 19.2.4, from 19.3 before 19.3.2 and from 19.4 before 19.4.1; the fixes are 19.2.4, 19.3.2 and 19.4.1, and no fixed version exists below 19.2.4. GitLab's own hosted gateways were already patched, so only self-managed customers must act.
  • The flaw is the agent-era version of a template injection: the sandbox is the security boundary around a prompt, and escaping it reaches the host. It was reported through HackerOne by a researcher using the handle invisiblemeerkat.
  • GitLab's advisory, as reported, says no public proof of concept and no active exploitation have been confirmed. We did not open GitLab's own advisory page, so the version table above is The Hacker News's rendering of it.
Prompt InjectionAgent SecurityCyber Defense

Microsoft report: phishing rose from 7% to 23% of initial access, exploitation of public-facing apps from 15% to 24% harmfulUpdateCompany claim

Infosecurity Magazine
  • Infosecurity Magazine reports that Microsoft's Digital Defense Report 2026 puts phishing as the initial access vector in 23% of incidents, up from 7% between 2025 and 2026, and exploitation of public-facing applications at 24%, up from 15% — the latter attributed to AI vulnerability discovery tools.
  • Microsoft says attackers have shortened the "data exfiltration cycle, credential discovery and lateral movement lifecycle from days to minutes". Its own framing of the significance, quoted by Infosecurity: "While none of these represent new attack methods, the quantitative increase in the scale and speed of attacks creates an immediate problem for defenders."
  • Most-targeted sectors in Microsoft's telemetry are government at 27% of attacks, IT at 17% and research and academia at 14%; by country the US saw 25.5%, then Israel at 7.6%, Ukraine at 4.8% and Taiwan at 3.9%.
  • The report's headline finding — that attackers are reaching AI's advantages before defenders — ran in yesterday's briefing; these are the breakdown figures. Everything here is Microsoft's own telemetry and Microsoft's own attribution of the public-facing-application rise to AI tooling, which no third party has verified. Infosecurity also quotes the report saying "most of what we exploit there has nothing to do with AI".
AI-enabled hackingThreat IntelCyber OffenseMicrosoftCyber Defense

Friday, 2 October 2026

Microsoft's 2026 Digital Defense Report says attackers are reaching AI advantages before defenders harmfulCompany claim

Microsoft·BleepingComputer
  • Microsoft writes that "while the equilibrium between attackers and defenders will likely ultimately be re-established, in the near term we are in a period where attackers are reaching to advantages first, and defenders will need to move sharply in order to close the gap." The report says nearly 40,000 CVEs were published in the first half of 2026, putting the year on track to roughly double previous years.
  • Microsoft reports that the median time from a vulnerability being discovered in the wild to weaponisation "has fallen to well below 24 hours," while critical external vulnerabilities can take 30 to 60 days to remediate, and that between February and early May 2026 attacker-supplied ClickFix-style commands were executed on "more than 1.1 million unique devices, roughly an eightfold increase."
  • Microsoft attributes 30% of observed initial access to user execution and 20% to valid accounts, and says that "most observed campaigns still retain human direction, even as frontier systems demonstrate end-to-end autonomy in labs and early real-world cases." Per BleepingComputer it describes Chinese state actors using AI to hunt vulnerabilities, Russian state actors using "vibe coding" and AI-generated tooling, and North Korean remote IT workers using AI for persona development.
  • The figures are Microsoft's own telemetry and are not independently verified. The report does not quantify how much of the CVE growth or the weaponisation speed-up it attributes to AI as opposed to other causes, and its own framing is that most campaigns remain human-directed.
AI-enabled hackingThreat IntelCyber OffenseCyber DefenseMicrosoft

National cyber director Cairncross cites AI agent intrusions but warns against direct government control

Nextgov/FCW·CyberScoop
  • Nextgov reports that National Cyber Director Sean Cairncross, speaking at The Washington Post's AI Edge Summit, said of advanced AI that "there are legitimate risks" and described the technology as "both new and powerful," while warning: "Once the government is introduced into this space directly, there is a tendency for government to start to want to adjust the dials directly, and it is difficult to reverse that."
  • CyberScoop reports Cairncross said that since OpenAI's Hugging Face disclosure, "the engineering work that's gone into improving systems awareness of that has increased by an order of magnitude," and that he acknowledged China's "fast follow" strategy of using distillation to copy AI models and urged industry to protect technology under development from foreign actors.
  • The administration's senior cyber official is describing the same agent intrusions now drawing subpoenas from state attorneys general and a criminal-liability bill from the Senate, and arguing against binding federal controls in response. Nextgov says the framework relies on voluntary industry accords, optional safety controls and external audits, plus a 30-day early access window for government assessment before public release.
  • These are remarks at a conference, not a policy document, and neither report links a text of the framework. Nextgov notes Cairncross referred to AI as "superintelligence" following the September presidential directive. No timeline, funding or participation figures for the voluntary accords were reported.
The push to regulate frontier AI (US)US Federal PolicyCyber DefenseChinaAgent Security

Thursday, 1 October 2026

Google releases Gemini 4 Argon to cyber defenders first, with a 1M-token output limit and no cyber guardrails mixedCompany claim

Google·Artificial Analysis·SecurityWeek·Implicator.ai
  • Google says Argon is "rolling out to a set of trusted cyber defenders through our Fairwind Program", released to them "without cyber guardrails", and that Google is "actively engaged in the U.S. government's voluntary process for pre-release model access while we gradually expand access". Google reports DeepSWE v1.1 77.9%, AutomationBench "#1 with a score of 51.3%", LVBench 91.7% and a tie for first on CWE-bench v1 "with a top score of 68%". The output limit rises to "an industry-leading 1M tokens, up from the previous 64K tokens".
  • On Artificial Analysis's independent testing, Gemini 4 Argon (High) and GPT-6 Astra tie at 53 on the Intelligence Index, at $1.99 per task against $3.26 and $1.47 per 1M tokens against $7.70; on the AA-Omniscience Index, which penalises hallucinations, Argon scores 42 against Astra's 43. Google's introductory API price is $2 per million input tokens and $10 per million output, rising to $4 and $20 after the introductory period.
  • Google says that through Wiz's Scan for Good initiative "the model uncovered a critical vulnerability exposing sensitive personal information across healthcare software used by hospitals worldwide, identifying a severe risk that previous frontier models had missed". SecurityWeek notes the announcement does not name the software or say whether it has been fixed, and reports Fairwind launched in early September with more than 650 participating partners.
  • Google's own benchmark figures are not independently verified, and the model is not yet available to developers, enterprises or consumers. Implicator.ai, summarising a Bloomberg report, says some Google employees with access say Argon does worse on real coding work — front-end design in particular — than its scores suggest, with two attributing this to "benchmaxxing"; Google said it would be inaccurate to say the model underperformed in areas such as coding, and Gemini product lead Tulsee Doshi said Googlers have been "relying on it for their hardest coding and research problems".
Pacing the frontierGoogle DeepMindEvalsCyber DefenseReasoning Models

Google: half of likely AI-discovered vulnerabilities enable remote code execution, against 26% of the rest mixedCompany claim

Google Threat Intelligence Group·The Record·Help Net Security
  • Studying January 2025 to August 2026, Google Threat Intelligence Group reports monthly CVE disclosures rose from 5,045 in January 2026 to 10,477 in July and 10,740 in August, and that 50% of the vulnerabilities it identified as likely AI-discovered lead to remote code execution, against 26% across the broader ecosystem. By risk rating, AI-discovered flaws were 39% Low, 58% Medium and 4% High, against 69% Low, 28% Medium and 3% High for the rest.
  • GTIG recorded 141 vulnerabilities exploited between January and August 2026, more than the 127 exploited in all of 2025; the monthly average of exploited vulnerabilities rose from 10.5 in 2025 to 18, and zero-day exploitation from 8 a month to 11, with 22 in August 2026. One case it names is CVE-2026-1731, an unauthenticated OS command injection flaw in BeyondTrust Privileged Remote Access and Remote Support discovered by the Hacktron AI research agent: GTIG saw one threat cluster exploit it within four days of public disclosure and five more within seven days, dropping SNOWLIGHT, SPARKRAT and cryptominers.
  • GTIG counted 2,076 vulnerabilities in AI-related software over the study period, more than 1,500 of them disclosed in 2026, with 782 in AI orchestration and agent frameworks and 212 in inference and serving infrastructure. Help Net Security reports GTIG found only 0.23% of 2026 disclosures — about one in 431 — were observed exploited in the wild, so the volume increase is not yet an exploitation increase of the same size. The classification of which vulnerabilities were "likely AI-discovered" is Google's own judgement and is not independently verified.
AI-enabled hackingThreat IntelCyber OffenseCyber DefenseGoogle DeepMind

Tuesday, 29 September 2026

Perplexity red team: nine models given root access produced no VM escape in 108 runs, but four bypassed network limits mixedCompany claimSingle source

AlphaSignal
  • AlphaSignal reports Perplexity's security team tested nine frontier models against SPACE, the sandbox behind Perplexity Computer, across 216 runs split between 108 sandbox-escape attempts and 108 network-bypass attempts. It reports zero successful VM-to-host escapes across all 108 attempts, "even with source code access".
  • On the network boundary, AlphaSignal reports four models succeeded: Claude Opus 5.0 in 3 of 3 attempts, GPT-5.6 Sol in 3 of 3, Kimi K3 in 2 of 3 and GPT-5.6 Cyber in 1 of 3, using "DNS spoofing or CDN shared-IP tricks". It reports eight of ten third-party sandbox platforms tested were vulnerable, and that Cloudflare Sandbox and NVIDIA OpenShell resisted both attacks.
  • The result cuts both ways: hardware-level VM isolation held, while the network perimeter that most agent sandboxes rely on did not — the same class of gap OpenAI blames for its 20 September training incident.
  • Perplexity's own write-up would not open for us; both perplexity.ai URLs returned HTTP 403, so every figure above comes from AlphaSignal's report and we could not check it against the primary. We found no independent confirmation of the per-model counts.
Agents going wrongAgent SecurityEvalsCyber Defense

Official MCP Python SDK patched for a CVSS 7.5 flaw letting a malicious server steal OAuth client credentials harmful

GitHub Security Advisory·The Hacker News
  • The advisory rates the issue High at CVSS 7.5 and lists affected versions mcp 1.9.1 through 1.29.1 and mcp 2.0.0 through 2.1.1, patched in 1.30.0 and 2.2.0. It says the SDK failed to validate the authorization server's identity and did not bind credentials to specific servers, so "A malicious or compromised MCP server could therefore direct them to a token endpoint of its choosing", exposing client secrets, authorization codes and PKCE code verifiers.
  • The advisory tells users to upgrade and, for unattended OAuth providers, to pass the `issuer` parameter so credentials are bound to the correct authorization server. The Hacker News gives CVSS 7.5 for non-interactive providers and 6.5 for an interactive provider, and credits the security firm Cycode along with seven further reporters.
  • This is the official SDK for the protocol most agent tooling now uses to reach third-party services, so the blast radius is every client that authenticates to an MCP server it does not control. The Hacker News notes no traditional CVE had been assigned as of publication, and neither source reports any exploitation in the wild.
Agent SecurityPrompt InjectionCyber Defense

Monday, 28 September 2026

Nvidia launches Open Agent Safety Platform: OpenShell runtime on Vera CPUs and a Sentry watchdog on BlueField-4 DPUs mixedCompany claim

NVIDIA Newsroom·NVIDIA Technical Blog·CNBC
  • Nvidia announced the platform on 28 September as a reference design in two parts. OpenShell is described in Nvidia's technical blog as "an open source secure runtime for executing autonomous AI agents in sandboxed environments with kernel-level isolation", released under Apache 2.0 and running on Nvidia Vera CPUs. Sentry is "an out-of-band watchdog that runs on NVIDIA BlueField-4 DPUs", which Nvidia says can "quarantine and stop" agents that breach their boundaries "in milliseconds".
  • Nvidia's technical blog says that in Vera Rubin POD systems the BlueField-4 DPU sits on "the node's only path to the model", and that for organisations already running Vera systems, enabling the protections is a software update. Nvidia's release names Anthropic, Cisco, CrowdStrike, Dell Technologies, Figure, HPE, Hugging Face, JPMorgan Chase, Microsoft, Palantir, Palo Alto Networks, Perplexity, Red Hat, Salesforce, SAP, Scale AI, ServiceNow and SpaceX AI among collaborators; CNBC separately lists Oracle, CoreWeave, Lenovo, ARM and Intel as partners and says Nvidia is working with Anthropic to integrate cloud-managed agents with OpenShell.
  • Nvidia VP of enterprise AI Justin Boitano told reporters on a Sunday call that the platform could have prevented July's Hugging Face breach: "From what we know, Hugging Face reported over 17,000 agents attacking their infrastructure that went on for days and weeks." Jensen Huang is quoted in the release: "Safety and security require full-stack engineering."
  • This is a vendor claim about a vendor product: Nvidia's assertion that Sentry would have caught the Hugging Face intrusion is untested by anyone outside Nvidia, and neither the release nor the blog gives a detection rate, a false-positive rate or a benchmark. It also lands as an engineering counter-argument to the labs' call to slow down — Huang has argued that recent incidents are process problems.
Agents going wrongNVIDIAAgent SecurityAgentsAnthropicOpenAICyber Defense

AgentXploit auditing system reaches 59.3% end-to-end exploit success on agent repositories against 38.4% for Codex mixedPreprintSingle source

arXiv
  • arXiv:2609.31318, "AgentXploit: Autonomous Repository-to-Runtime Red-Teaming for AI Agents", was announced on 28 September. Authors span the National University of Singapore, UNC Chapel Hill, UC Berkeley (including Dawn Song), the University of Chicago and UC Santa Barbara.
  • The system splits auditing into an Analyzer Agent that traces attacker-controlled inputs to sensitive operations across a repository and an Exploiter Agent that turns the resulting paths into working attacks. The authors also release AgentXploit-Bench, "containing 72 reproducible vulnerabilities across 12 open-source AI-agent systems and frameworks".
  • The abstract reports: "Across three runs, AgentXploit reaches 59.3% end-to-end success, compared with 38.4% for Codex. Under a token-budget-matched comparison, Codex reaches 46.3%." On AgentDojo, where injection points are given, the Exploiter Agent "reaches 79.2% attack success versus 52.7% for AgentVigil".
  • The setting is authorised white-box pre-deployment auditing with repository access, not a black-box attack on a running service, and the vulnerabilities are ones the authors curated. It is a preprint with no independent replication.
Agent SecurityCyber OffenseCyber DefenseAgents

Friday, 25 September 2026

Markey bill would create a federal Cybersecurity and AI Board of Investigations for AI-agent hacks Single source

CyberScoop
  • Sen. Ed Markey introduced the Cybersecurity and AI Board of Investigations Act, creating a board of five presidentially appointed, Senate-confirmed members serving five-year terms, with no more than three from one political party.
  • The board could subpoena witnesses and conduct independent reviews of AI-agent-led cyberattacks on federal systems or critical infrastructure, and would also look at AI supply-chain vulnerabilities, near-miss incidents and regulatory gaps. It would not assign legal fault or liability.
  • Markey said: "Despite the unprecedented depth and scale of recent AI-enabled cyberattacks, the public is learning critical details piecemeal...We need the Cybersecurity and AI Board of Investigations to get to the bottom of major incidents."
  • The bill has been introduced, not passed; CyberScoop reports no co-sponsors, committee schedule or cost estimate.
AI-enabled hackingUS Federal PolicyAgent SecurityCyber Defense

Island raises $400 million Series F at a $6.4 billion valuation to govern employees and AI agents Company claim

Island
  • Island announced a $400 million Series F at a $6.4 billion valuation, led by Evolution Equity Partners, with Prysm Capital, Sequoia Capital, Coatue Management, Cyberstarts, Insight Partners, J.P. Morgan Growth Equity Partners, Alta Park Capital, Georgian, G Squared and Squarepoint participating, plus a personal investment from Dmitri Alperovitch.
  • The company says it has "doubled annual recurring revenue (ARR) every fiscal year since its 2022 launch" and employs 1,000 people. It frames the product as one framework covering "everywhere human and agentic work occurs", with visibility into "who or what is acting, what it can reach, what data it can use, what it is doing, and whether that action should be allowed".
  • The round is a marker of how much capital is going into controlling agent behaviour inside enterprises rather than into building agents. Island discloses no revenue figure, customer count or agent-deployment numbers, and the ARR growth claim is not independently verified.
FundingAgent SecurityCyber Defense

Thursday, 24 September 2026

OpenAI extends its Daybreak programme to Ukraine with more than $1 billion in subsidised tokens beneficialCompany claimSingle source

CyberScoop
  • CyberScoop reports that OpenAI and the Ukrainian government announced the Daybreak partnership on Wednesday 23 September at OpenAI's New York office, on the sidelines of the UN General Assembly. OpenAI pledged "over $1 billion in subsidized tokens" plus access to models for cybersecurity work on civilian critical infrastructure.
  • CyberScoop reports Ukraine faces approximately 6,000 cyberattacks per year, about 15 a day. Listed uses are incident response, threat triaging, login analysis, system inventorying, code analysis and vulnerability validation.
  • Dmytro Kushneruk, Ukraine's Consul General in San Francisco, is quoted saying: "This is why the object is not to replace the cyber defender with AI, but to make sure the cyber defender acts faster", and that the work "is really not about protecting computers, it is about actually keeping our country running". Sasha Baker, OpenAI's national security policy head, said: "There's this period of time where we're really rushing to get [these tools] in the hands of critical infrastructure operators."
  • OpenAI's own post on the programme (openai.com/index/openai-extends-cyber-access-to-ukraine-for-civilian-defense) returned HTTP 403 to both our fetchers, so the figures above come from CyberScoop. The dollar figure is a value OpenAI places on its own subsidised compute, not cash, and no measured defensive outcome has been reported.
AI-enabled hackingOpenAICyber DefenseThreat Intel

Wednesday, 23 September 2026

Gartner survey: 41% of CISOs report a deepfake in an employee audio call in the past 12 months harmfulSingle source

Help Net Security·Infosecurity Magazine
  • Gartner, in findings released at its Security & Risk Management Summit in London on 22 September, reports that 41% of surveyed CISOs had at least one social engineering incident involving a deepfake during an employee audio call in the past 12 months, and 36% during a video call. The survey covered 297 senior cybersecurity leaders between March and May 2026.
  • The same survey found 79% reported at least one email phishing, spear-phishing or business email compromise incident in the last 12 months, and 58% reported a vishing or smishing incident.
  • Gartner's recommendation, as reported, is to move security-awareness programmes away from teaching staff to spot the fake and toward secure verification as a standard requirement for any consequential request. Craig Porter, a Gartner director analyst, is quoted saying organisations "must use the same discipline used to assess identity and access risks to combat AI-driven social engineering threats".
  • These are self-reported incident counts from a self-selecting professional sample of 297, not measured attack volumes, and they cover a period ending in May 2026. Gartner's own press release could not be opened; the figures above come from two outlets that were.
DeepfakesScams FraudCyber Defense

NCSC technology chief says AI will help cyber attackers more than defenders, and agentic defence is not ready harmfulUpdate

NCSC·The Record
  • Dave Chismon, chief technology officer for architecture at Britain's National Cyber Security Centre, argues that offensive AI has a structural advantage: attacks have clear success states — an exploit works, malware calls home — while defensive actions on live systems carry consequences that require human judgement. He quotes the researcher Halvar Flake: "All offensive problems are technical problems, and all defensive problems are political problems."
  • The post proposes assessing any candidate autonomous defensive action across five dimensions — potency, scope, criticality, rollout confidence and recoverability — and recommends starting where "AI provided data and then outputs explainable advice to a human" before allowing an agent to change systems.
  • Chismon's conclusion is that organisations "cannot risk just waiting for agentic defence to roll in and protect them" and should keep improving security conventionally in the meantime. Coming from the UK's national technical authority, it is an unusually direct statement that the automation balance currently favours attackers.
  • The NCSC post is dated 21 September, one day before this edition's window opens; the reporting on it ran on 22 September. It is an argument and a framework, not new measurement — no figures are attached to the asymmetry it describes.
AI-enabled hackingCyber DefenseUKAgentsAgent Security

Tuesday, 22 September 2026

Of 225 CVEs linked to Anthropic's bug-hunting work, one has confirmed exploitation in the wild mixedSingle source

The Register
  • The Register reports that as of Monday the count of vulnerabilities linked to Anthropic or Project Glasswing and tracked by VulnCheck researcher Patrick Garrity stands at 225, and "just one, a critical SQL injection bug in Ghost (CVE-2026-26980), has been exploited in the wild" — fewer than 0.5 percent.
  • Garrity is quoted: "The main thing this data highlights is that what Anthropic is discovering and disclosing is fairly limited in impact," and he notes historically only about 1 to 2 percent of disclosed vulnerabilities are used in exploitation campaigns.
  • It is a measured counterweight to the expectation that model-found bugs translate directly into attacker capability. On these numbers the disclosure rate has risen much faster than the exploitation rate.
  • The piece also cites 1Password research on 6,080 patches produced by ChatGPT-5.5 and Opus 4.8: the models "generated fixes that fully resolved the vulnerability just 26 percent of the time", while about 54 percent either failed to resolve it, introduced a new vulnerability, or did both. One researcher's tracking, reported by one outlet; the sub-0.5 percent figure is a snapshot, and exploitation can lag disclosure by months.
AI-enabled hackingAnthropicCyber OffenseCyber DefenseThreat Intel

Wednesday, 16 September 2026

Apple ships record 260+ CVE patch cycle; ten fixes credit AI bug-hunters, most of them Claude with Anthropic Research beneficialSingle source

The Register
  • The Register reports Apple "addressed more than 260 CVEs across all of its operating systems, browsers, and other software products, marking the largest single patch cycle in Cupertino's history". iOS 27 and macOS 27 Golden Gate, released Monday, address "a record 122 and 204 security vulnerabilities, respectively".
  • "Of these hundreds of CVEs, however, there are only ten (by our count) that AI is directly credited with finding", The Register writes. Two are in iOS 27: CVE-2026-65410, in iPhone and iPad AVE video encoders, credited to the AI bug-finding firm Calif "along with Claude and Anthropic Research"; and CVE-2026-65409, a type-confusion issue in the Foundation framework, credited to Calif's Bruce Dang "in collaboration with Claude and Anthropic Research".
  • macOS 27 credits AI helpers with eight more, including CVE-2026-43692 and CVE-2026-64790 in CUPS — the first a validation issue a remote user can exploit to execute malicious code — both credited to Aaron Grattafiori and the Nvidia AI Red Team; CVE-2026-43690 and CVE-2026-43719 in SMB, and CVE-2026-65374, CVE-2026-65375 and CVE-2026-43677 in WebDAV, all credited to Dang with Claude and Anthropic.
  • This is a count by The Register's own reading of Apple's advisories, not a figure Apple published. The Register says none of the vulnerabilities is listed as being under active exploitation. Ten out of more than 260 is the measured share of this cycle attributable to AI-assisted discovery, on that counting.
AI-enabled hackingAnthropicCyber DefenseAppleNVIDIAAgents

FBI director tells Senate Judiciary the bureau needs to contract directly with model developers to police AI crime Single source

Nextgov/FCW
  • Nextgov, published 15 September at 6:26 p.m. ET, reports FBI Director Kash Patel told the Senate Judiciary Committee the bureau lacks the money to procure AI: "The FBI's budget is like half the size of the TSA. What we need is funding to specifically go out there." He called AI-driven crime "literally the new frontier, and nobody's really talking about it."
  • On procurement, Patel said the bureau needs to be able to go to a developer and say "Okay, I'm going to contract with you and work on this specific model, and then work on its defenses."
  • On enforcement, Nextgov quotes him saying the FBI should "go after the people that created these models that are going rogue, let's call it, for the specific purpose and with the intention to commit a criminal act." Nextgov reports Sens. Josh Hawley (R-Mo.) and Ted Cruz (R-Texas) were among those questioning him, and that the exchange referenced OpenAI's July 2026 model containment breach affecting Hugging Face.
  • Patel named no dollar figure, no vendor and no timeline, and the statement about pursuing model creators sets out an intention rather than a charging theory. Nextgov is the only outlet reporting this exchange.
AI-enabled hackingUS Federal PolicyCyber DefenseThreat IntelAgents

Tuesday, 15 September 2026

AWS Deception Benchmark: 12 models wrongly flag 41% to 99% of safe code as vulnerable mixedCompany claimPreprintSingle source

Help Net Security·AWS Security Labs
  • Help Net Security reported on 14 September that AWS has released the Deception Benchmark, a public dataset of "14,822 samples across 16 programming languages and more than 70 Common Weakness Enumeration (CWE) categories", of which "9,695 are scored. These include 6,988 code-level and 2,707 environment-gated challenges." The deceptive samples place real vulnerability patterns next to controls that stop them being exploited.
  • AWS evaluated "12 models from five providers". With direct prompting, Help Net Security reports, models "incorrectly flagged 41% to 99% of safe code".
  • Asking the models to prove exploitability "reduced false positives by 17 to 74 percentage points" but pushed false negatives to "7% to 44%". AWS treats false-positive and false-negative rates below 10% as "a minimum bar for production use", and Help Net Security reports "None of the tested configurations met both thresholds."
  • This is AWS evaluating models on a benchmark AWS built, and the accompanying whitepaper is not peer reviewed. Help Net Security reports the models struggled most with environment-gated cases such as Kubernetes network policies.
Cyber DefenseEvalsAmazonAgent Security

CrowdStrike CEO rejects the slowdown case — "The genie's out of the bottle" — as cyber stocks lead the S&P 500 Update

CNBC·Benzinga
  • CrowdStrike chief executive George Kurtz told CNBC's "Mad Money" on Monday: "The genie's out of the bottle. There's plenty of models that are already out there, both frontier as well as open-weight models, that can already be dangerous." He was responding to Dario Amodei's essay calling on frontier labs to slow the pace of model development.
  • CNBC reports CrowdStrike surged nearly 14% on Monday to a record-high close above $235 per share and Palo Alto Networks jumped just over 13%, and that both stocks have gained 100% year to date. Benzinga, writing at 9:23 AM ET on 14 September, reported Okta up roughly 4% in the same rotation.
  • Kurtz argued the security industry has to work at runtime rather than at the frontier: "We can look at what these programs do. We can put our own guardrails around them at runtime… and we can prevent them from doing bad things." He added "What I do know is that the agents are dangerous" and "You need equivalent or better AI defenses to combat the AI agents."
  • Kurtz also cautioned against regulation, saying "If we put too much regulation around this, then it's going to stifle innovation." CNBC published no measurement of AI-related attack volume alongside the interview; the share moves are market reaction, not evidence about model risk.
Pacing the frontierCyber DefenseAgent SecurityEarnings

Monday, 14 September 2026

FBI and Google analysts say AI bug-hunting is stripping the obscurity that protected legacy and industrial code harmfulSingle source

The Register
  • Brett Leatherman, assistant director of the FBI's Cyber Division, told The Register in a piece published on 13 September: "You see open source platforms that have been visible to the tech community for a decade, these libraries that are run in 80 percent of web servers out there, people have stress-tested those for 10 years, and the community believed that they were really secure. The latest models were able to break those and say, 'yeah, there's significant vulnerabilities in here.'"
  • John Hultquist, chief analyst at Google Threat Intelligence Group, told the publication that AI "is excellent at technical troubleshooting, at knowing obscure systems and helping you make your way through it, and this makes me very concerned about industrial control systems", adding that it also helps attackers work down through the operating system "and even down into the firmware".
  • The piece notes that five US agencies said attackers used AI-generated exploitation scripts to break into internet-exposed Siemens S7 Series programmable logic controllers at water, manufacturing, energy and other critical facilities, warning: "This is not a theoretical risk – it is an active threat." Trend Micro Zero Day Initiative's Dustin Childs is quoted the day after a Microsoft Patch Tuesday that addressed 974 CVEs.
  • Only one outlet carries these interviews. The officials describe a direction of travel, not a measured rate: none gives a count of AI-discovered vulnerabilities, and the 80 percent figure is Leatherman's characterisation of how widely the libraries are deployed, not a count of compromised servers.
AI-enabled hackingThreat IntelCyber OffenseCyber Defense

Sunday, 13 September 2026

Intezer study of 16.9 million SOC alerts reports AI-related alerts up 685% from February to June 2026 Company claimSingle source

The Hacker News
  • Intezer researcher Nicole Fishbein writes that of "roughly 16.9 million SOC alerts we reviewed, about 73,000 (0.43%) were AI-related", and that AI-related alerts were "up 685% between February and June 2026".
  • Of those AI-related alerts, Intezer classifies "94.1% noise, 5.8% genuine risk, and 0.02% real attacks", and reports finding no confirmed breaches caused by internal AI agents.
  • The figures describe alert volume inside customer environments, not attacks: the overwhelming majority are false positives, and the growth is measured against a February baseline the piece does not give in absolute terms.
  • This is vendor-contributed content from a company that sells automated alert-investigation products. The article does not disclose customer counts, sector mix, geography or methodology, and the research has not been independently validated.
AI-enabled hackingThreat IntelCyber DefenseAgent Security

Friday, 11 September 2026

MCPSEC flags 143 of 177 MCP server tools as prompt-injection vulnerable from registration metadata alone, recovering 98.9% of verified vulnerabilities beneficial

arXiv
  • The paper (arXiv 2609.10854, submitted 9 September, announced in the cs.CR new listing) proposes "no-box" vulnerability analysis — auditing a system with neither access nor runtime interaction, using only functionality metadata. The prototype, MCPSEC, audits Model Context Protocol servers for indirect prompt injection using only the tool metadata exposed at server registration.
  • Across 20 widely deployed MCP servers comprising 177 tools, human evaluators confirmed 95 vulnerable tools. MCPSEC identified 143 tools as vulnerable and recovered 94 of the 95 verified vulnerabilities (98.9% recall), against 80 (84.2%) for an LLM baseline, producing a hypothesised exploitation technique for each.
  • The gap between 143 flagged and 95 confirmed implies a substantial false-positive rate, which the abstract does not quantify as a precision figure. The authors are explicit that hypotheses require later validation when access is available. The servers audited are not named in the abstract.
Agents going wrongPrompt InjectionAgent SecurityCyber Defense

Microsoft: AI-assisted invoice-fraud campaign sent over 1 million phishing emails in three days, 87.7% aimed at US targets harmful

Microsoft Threat Intelligence
  • Microsoft reported on 10 September a business email compromise campaign that sent more than 1 million phishing emails between 3 and 5 August, with 87.7% directed at users in the United States, targeting IT services, business advisory and consumer goods firms. Messages impersonated executives and requested ACH payments of nearly $50,000 per target.
  • Microsoft attributes AI assistance to the template construction rather than to the sending infrastructure, citing extensive HTML comments, structured section labelling, verbose descriptive comments, em dashes, banner formatting and highly uniform templates whose invoice identifiers stayed constant while organisation details changed per target.
  • Named indicators include the ServiceNow-impersonating domain service-nowinc[.]com and domainlify[.]net in reply-to addresses. Recommended mitigations are automatic attack disruption in Defender XDR, Zero-hour Auto Purge, and correctly configured SPF, DKIM and DMARC.
  • Microsoft does not name a threat actor, and the AI evidence is stylistic inference from artefacts left in the templates rather than direct observation of a model in use. No losses are quantified.
AI-enabled hackingMicrosoftThreat IntelScams FraudCyber Defense

DISA director says decades of deferred maintenance left DoD networks exposed as adversary cyber agents arrive, with zero-day volume up tenfold

DefenseScoop
  • Lt. Gen. Paul Stanton, director of the Defense Information Systems Agency, said on 10 September that decades of delayed maintenance have left Defense Department networks increasingly vulnerable in the AI age, and that the number of zero-day vulnerabilities has "multiplied by a factor of ten." On adversary automation he said: "The ways in which an adversary could employ cyber agents is mind-boggling in terms of the complexity."
  • Stanton's stated remedy is to stop deferring patching and operating-system upgrades, treat networks as weapon systems, and train cyber operators on them the way combat troops train with weapons, with validated proficiency standards.
  • On defensive AI specifically, DISA intends to require that human operators understand agent behaviour before deployment and to use digital twins to forecast the impact of an agent before it is let loose on a live network — a notably more cautious posture than commercial agent rollouts.
  • No budget figures, timelines or patch backlog counts were given in the reporting, so the scale of the remediation task is not quantified.
AI-enabled hackingPentagonCyber DefenseAgentsUS Federal Policy

US Cyber Command names Ronzelle Green its first chief AI officer as its AI-for-cyber budget line jumps from $5m to $138m

The Record
  • Reported 10 September: Rear Adm. Ronzelle Green becomes chief artificial intelligence officer at US Cyber Command. He previously led research and development at the National Geospatial-Intelligence Agency, was CIO at the Defense Counterintelligence and Security Agency, and directed Commonwealth Integration in the Office of the Under Secretary of Defense for Intelligence and Security, working with Five Eyes partners.
  • Budget documents cited in the reporting show the "AI for Cyber Operations" line rising from $5 million in fiscal 2026 to $138 million in fiscal 2027 — a roughly 27-fold increase. CYBERCOM states it "must field AI" capability to process data and identify threats faster than humans alone, to maintain decision superiority.
  • Multiple sources in the report say Green's main task is consolidating fragmented AI pilots that currently run independently across different units — an organisational problem rather than a technical one.
  • The budget figure is a request line, not appropriated spending, and the reporting does not specify which programmes it funds.
AI-enabled hackingPentagonCyber OffenseCyber DefenseUS Federal Policy

GSA replaces $1-a-year ChatGPT deal with $0 licence fees and 50% off usage through 2028, expanding eligibility from 1m to about 23m government workers mixed

FedScoop
  • Announced 10 September: OpenAI and the General Services Administration agreed a OneGov arrangement running through 31 December 2028, replacing the $1-per-agency deal that expires on 30 September 2026. OpenAI waives its $15 per-user monthly licence fee and discounts token usage 50%, with no platform-access fee or spend commitment.
  • Eligibility extends beyond federal agencies to state, local and tribal governments, taking the addressable population from about 1 million to roughly 23 million government employees. Agencies can buy directly, through resellers or via supported cloud marketplaces. OpenAI's Daybreak cybersecurity platform is offered at half price.
  • GSA Administrator Ed Forst said the OneGov strategy is "positioning the federal government for the future by integrating advanced, AI-enabled capabilities into agency operations." Sam Altman said secure access to the best AI tools can help government "be more efficient, strengthen cybersecurity, and improve the services people rely on."
  • The shift from a flat fee to discounted consumption moves the cost risk onto agencies: there is no cap on what usage can total. No dollar figures for expected spend were disclosed, and OpenAI's own announcement page blocks automated retrieval.
OpenAIUS Federal PolicyCyber Defense