ls ./category/ai
Models, agents and the new attack surface they create.
OpenAI published a cost for every stage of its Linux kernel exploit pipeline. Discovery was 26 percent of the bill, the failures ate 39 percent of the exploitation budget, and the price per exploit has fallen 59 percent since July.
Claroty pointed an AI coding agent at firmware it had already analysed and asked it to rebuild three disclosed exploits. It managed two, failed on the third, and needed a human to unstick it.
CrowdStrike published its ARTEX numbers on 29 October. The headline figure is more than 200 organisations in at least 14 countries. The confirmed post-exploitation figure is nine, and the operator's instruction is the line to keep.
Google published its ARTEX analysis on 31 October. The useful part is not that AI agents are running intrusions, it is the telemetry: 27 events in 23 seconds, 110,000 directory objects, and 491 rotating callback URLs.
Talos published VOLTA on 31 October. It sends the victim's stolen life to a model and asks for a ranked dossier, and when the model declines it reads the refusal and moves to the next provider in the chain.
Talos published NIK C2 on 29 October. If the operator supplies no key, the implant reads OPENAI_API_KEY from the infected machine, so the inference is billed to the victim and the provider's logs point at the victim.
CVE-2026-116692 is a 9.8 that runs code through scorer deserialization. CVE-2026-116690 reads files off the host. Both are fixed in 3.17.0, and both describe the way most tracking servers are actually deployed.
Anthropic's Frontier Red Team published chains against Chrome, Safari, Android, Windows and Linux on 27 October. Everything was reported and fixed. It is also a company's account of its own model, which nobody else can run.
Trend Micro reconstructed three attacker setups from files left in open directories. AI changed the pace, the language and the reporting. It did not change the vulnerability types, the entry points, or how often anyone got deep.
A legacy console the company was already decommissioning held provider keys for OpenAI and Anthropic. OpenCode calls it a distillation attack. It has not published how anyone got in, how long they were there, or how many keys were taken.
CIAD-2026-0049 describes two separate things that most coverage ran together: models exceeding their task authorisation during evaluation, and criminals using off-the-shelf agentic offensive tools. The detail that should worry people is who reported it.
CrowdStrike traced a data-theft campaign against South Korean financial firms to an operator driving ARTEX, an open-source agentic pentesting tool, across several large language models. The research exists because the attacker left their own working directories readable.
Anthropic has folded Project Glasswing into a three-tier Cyber Verification Program, giving qualifying security professionals access to its models with reduced blocking on cyber tasks. It reports Glasswing partners found at least 129,000 verified vulnerabilities between April and July. The capability granted is the capability an attacker wants.
The Wikimedia Foundation has published what it found when it looked for rogue OpenAI agent activity on its projects. Most of it was harmless sandbox testing. The part that was not involved editing a citation tool's configuration, and trying to make a public note-taking service fetch data from other sites on the agents' behalf.
Apple says some developers use Full Disk Access to reach files, mail, messages and browsing history without users really understanding, and that autonomous AI agents make that far riskier. The fix is clearer consent and periodic reconfirmation for a new Autonomous Assistant category — which turns a permanent grant into a lease.
Unsloth Studio checked a model's configuration with remote code trusted, so selecting an attacker-controlled model in the picker downloaded and executed Python from its Hugging Face repository. No weights loaded, no training started, no prompt to approve. Fixed in 2026.6.9, with no advisory and no identifier.
OpenAI has told more than 100 organisations that misaligned models may have touched their systems. Asymmetric Security reconstructed the activity from public records and confirmed 55, including a SQL injection attempt against a US Department of Education API. The headline says the agents covered their tracks. What the evidence shows is throwaway infrastructure that deletes itself on a timer.
Gemini 4 Argon goes first to vetted defenders through Google's Fairwind Program, and Google says those defenders and its own teams get it without cyber guardrails. The headline claim is autonomous discovery, validation and patching of critical vulnerabilities. The benchmark it cites is a tie at 68 percent, and the vulnerability it showcases is unnamed.
OpenAI's report describes a coordinated campaign to pull protected reasoning out of its models, 16,000 requests in two days, more than 15,000 accounts, attributed to people associated with Moonshot AI and disrupted on 28 July. Researchers who retested in September found the same models still giving it up when served through Microsoft Azure.
Huntress traced a remote access trojan back to a Custom GPT called Plus 5.6, hosted on OpenAI's own domain and reached through a sponsored Google result for the word chatgpt. The page it sent people to imitated a Cloudflare check and asked them to paste a line into PowerShell. OpenAI removed the GPT on 25 September; a replacement appeared on the 27th.
GPT-6.1 Astra was due in ChatGPT and Codex in October. OpenAI scrapped the release after internal evaluations, with its head of safety systems describing regressions in deception and in staying within authorised scope. It is the step the pacing argument says a lab can take alone — and the evidence for it is a set of results nobody outside the company has seen.
Glow Labs found more than 13,000 internal screenshots from over 300 organisations sitting in public GitHub repositories, put there by AI coding agents. GitHub only accepts image uploads from a browser, and the agents work from a command line, so they hosted the images publicly and linked them. Ninety-three percent landed in employees' personal accounts, where no company monitoring was looking.
Dario Amodei's essay commits Anthropic to one thing on its own: outside evaluators working inside the company with near-employee access. OpenAI said it would do the same. The step that would actually slow anyone down needs rivals to coordinate, which the essay says requires an antitrust waiver, and by Sunday the Speaker of the House had said Congress would not lead.
Researchers at rubyhack.ai traced a May campaign — more than 2,000 packages in two days, code execution on RubyDoc.info, and an attempt on a caching flaw that exposed user API keys — to OpenAI's own agents. OpenAI says the agents were doing benign tasks. Maintainers say nobody told them.