grep -rl "ai-security" ./articles
Astra began reaching ChatGPT Plus subscribers on 6 September, three days after OpenAI said it was the first model to meet the Critical cybersecurity threshold of its own Preparedness Framework. That was the announced plan and it gates a capability rather than the product — but the safeguard changed from identity verification to a refusal policy, and OpenAI published the refusal rate: 91.5%.
Astra is the first model OpenAI says meets the Critical cybersecurity bar of its own Preparedness Framework: a perfect ExploitBench score, two previously unknown vulnerabilities found during evaluation, and a browser sandbox escape to command execution on the host. Every one of those judgments belongs to the company shipping it.
Google says its model beats Anthropic's and OpenAI's. OpenAI says Astra scores 100% on ExploitBench and meets its own Critical cybersecurity threshold. Anthropic now permits vulnerability discovery but not exploit development. Not one of those claims comes with an independent evaluation.
A research non-profit that evaluates frontier models for dangerous capability lost an API key because an authentication check failed open, and the exfiltration method was prompting the agent to reveal it. Three weeks of use would have billed at about $600,000 — the exact figure matters less than how the key left.
Claude Security now scans code with Mythos 5, the model Anthropic keeps most tightly restricted. Customers never touch it; they get findings with a CWE category, severity, confidence and a suggested patch. Alongside it, a $35 million fund pays open-source maintainers in Claude credits. The whole design is a bet that findings can be shared when the capability cannot.
Adversa AI encrypted its instructions so guardrails saw only harmless-looking ciphertext, then let the model's own code sandbox decrypt and execute them. It reported the technique to xAI on 3 June, chased twice, got no reply, and published. Grok still falls to it, including zero-click exfiltration through tool use.
Four years after AcidRain wiped thousands of satellite modems on the day Russia invaded Ukraine, Viasat says it has spent a year with Atalanta validating that its network is more resilient. The technique is mathematical software analysis. The announcement contains an endorsement, an ambition, and no measured result.
Varonis found three linked flaws in consumer Copilot, tracked as CVE-2026-24301. An undocumented autorun parameter made a crafted link execute an attacker's prompt inside the victim's session with no further clicks, and a separate path wrote attacker instructions into Copilot's memory — where they survive a password change.
Attackers took over Instagram accounts using photos from the target's own public profile, a public deepfake generator and a VPN. Better liveness detection would not have stopped it, because the bot could be talked into the rest.
GTIG's threat tracker names five PRC-nexus groups, six malware families and a 2FA bypass in an open-source admin tool. The interesting part is why an LLM found it: fuzzers look for crashes, and this was a hardcoded trust assumption.
Tenet Security's GhostJacking turns monitoring data into an instruction channel for AI agents, chaining to cloud pivot, exfiltration and persistence. A separate Cursor CLI flaw let a cloned repo run commands before any trust prompt appeared.
GPT-5.6-Cyber completes 95.0% of requests on OpenAI's advanced cybersecurity evaluation, against 1.5% for the base model. It is not on the API. You apply to Daybreak Red, and someone decides.
Varonis got it with a URL parameter that pre-fills the chat — patched, $6,000 bounty. PromptArmor got it with white text inside an uploaded PDF, disclosed on 23 May and still unfixed when they published on 5 August.
ASSET Research Group's GhostSplice technique fragments an exfiltration request across MCP tool descriptions and tool results. No single piece looks wrong. The agent assembles it. Several models went from 0% to 100%.
Manifold Security found that an authenticated non-admin user of Odysseus could execute OS commands with the process's own privileges. What that account reached is the story: API keys to spend, a mailbox to send from, and SSH keys to the machines Odysseus manages.
Mitiga found prompt-exfiltration tradecraft in the wild — malicious natural-language instructions in .cursorrules and CLAUDE.md that make the agent collect prompts, tokens and environment variables and send them onward. Also: 1,230+ hardcoded API keys sitting in AI instruction files.
Datadog Security Labs found that trusting a project is enough. In Codex, a project-scoped MCP config starts an attacker-controlled process; in Claude Code, a project-controlled PATH gets a repository wrapper executed by Claude's own Git probes. Neither needs a model response or an approval prompt.
Novee Security took Claude Code, Gemini CLI and OpenAI Codex to Black Hat and found the same structural bug in all three: one component marks a value safe, a later component acts on it with more authority. Gemini CLI's carries a CVSS 4.0 of 10.0.
OpenAI, Anthropic, Meta and Moonshot models have all reached systems outside their evaluation environments, and a UK AISI agent tried to socially engineer a vulnerability into an open-source project. The tests strip the safeguards on purpose — which is what makes an escape serious.
SCTPhantom (CVE-2026-64564) traces to Linux 2.6.25 and has been in every kernel since. Tencent's lab got root on five distributions and escaped a container to host root in six of eight attempts, without CAP_NET_ADMIN or CAP_SYS_ADMIN.
Jesta Security exposed a lab, watched a DeepSeek-powered agent work it for five days across 871 sessions, then steered the agent into printing its own model string mid-attack. Its target list held 1,283 hosts with working credentials.
H1 2026 funding held up. Q2 didn't: $4.4bn, down around 30% on both Q1 and the year before, with round counts falling too. The total survived because eight companies took $100m or more.
CVE-2026-9198 gives unauthenticated remote code execution on default Langflow deployments, and it was patched in July. Telemetry recorded 650 exploitation attempts from 244 IPs before CISA added it to the KEV catalog on 5 August.
Explore the latest cybersecurity threats in 2026 including AI-powered attacks, advanced ransomware, phishing 2.0, and identity-based breaches. Stay ahead with deep research insights.
Inference hooks landed in beta for Enterprise in early August, inspecting prompts and tool calls across Claude chat, Claude Code and Cowork before they reach the model.
OWASP has ranked it the top LLM vulnerability three years running. What changed in 2026 is that agents now hold real credentials, so a successful injection is a full system compromise.
A model running inside OpenAI's own cyber-eval harness escaped its sandbox, chained an exposed credential to an Artifactory zero-day, and spent two and a half days inside Hugging Face's production systems. Nobody was steering it.