ai-security

Sam Altman said OpenAI will adopt the first step of Dario Amodei's plan to slow frontier AI development: independent evaluators working inside the company with employee-like access.

A volunteer-built BitTorrent index for open AI models went online in July, weeks before Nvidia's $12.93 billion Hugging Face deal. Its design is credible. Its network is still too small to matter.

Apple's new Audio Intelligence privacy paper proves nobody, not even Apple, can access the audio. It doesn't answer whether the person you're talking to can decline being processed.

Independent researchers reconstructed how OpenAI's own agents ran code on RubyDoc.info's servers in May, from public package data alone. OpenAI's account, four months on, says far less.

Anthropic committed to an embedded evaluator. Dario Amodei also asked frontier labs and governments to coordinate a wider slowdown.

coop runs Claude Code and Codex in disposable virtual machines, with project sync and controls for connecting files, credentials and local models.

Google is extending shared preferences across Workspace. Users can save instructions in conversation, manage them in settings and see which shaped a response.

OpenAI’s Epic integration and public-data plugin connect clinical work to its source information, with organisational access controls and physician evaluations.

Unit 42 investigated an intrusion run through AI agents in under ten hours. Its own report says no novel zero-day was needed, a human made the decisions, and it corrected the piece to say this was not ransomware.

156 companies called for a surge in cyber defence on 27 August. On 2 September Google shipped its most capable security model to a selected set of trusted defenders.

OpenAI paused frontier training and wound down its side projects. The product it is refocusing on asks for your calendar, your finances and your card.

Hybrid compute runs a classifier on your Mac to decide what reaches the cloud. The admin rules and the record of what left are Enterprise features.

Anthropic's post-incident write-up admits it relied on a single layer of defence where it needed several. The independent METR review is still to come.

A ChatGPT Work session published its tool and skill inventory as a public website. The category names show which integrations that session had been given.

Censys counted 294,000 IPs exposing AI tooling to the public internet. The number that should change your afternoon is CVE-2026-42208, a pre-auth SQL injection in LiteLLM that CISA lists as actively exploited.

An agent recorded an ethical objection to running code against Hugging Face, then complied when another agent posted a deadline and a GO. The mechanism underneath is duller and more useful than the headline.

Aperture is generally available. An agent can start infrastructure work, a person still approves every new machine on the tailnet, existing access rules apply, and the actions are logged.

Chaz Schlarp used Claude Opus 5 to reverse-engineer five desk peripherals in about 13 hours of agent time, including a webcam whose recording LED he could switch off. The demonstration is real; the worm at the end of it is a forecast.

Anthropic's Model Hardware Standard lets agents drive lab instruments over MCP, and enforces safety limits below the agent. The limits it enforces are the ones the device's owner thought to declare.

An OpenAI evaluation agent broke into Hugging Face to steal a benchmark's answers — by turning the systems around it into an escape route. Why keeping a human in the lead is the standard, and why that only binds the people who agree to it.

The liability numbers going round this week are real, but they were measured a year ago — before an autonomous agent broke into a production company for the first time.

IDC has turned agent governance into a budget line. It's a real shift, and it is not the same measurement as the 6% figure I wrote about in April.

Schellman's governance report has an obvious headline gap and a much more useful finding buried under it. Worth reading with one eye on who commissioned it.

17,600 attacker actions reconstructed in public. The detail I keep coming back to is that the models I use every day wouldn't help with the investigation, and an open-weight one did.

Codex Security is worth taking seriously precisely because it reads as an admission. It also leaves the harder half of the problem completely uncovered.

600 Claude conversations turned up in Google because a shared page shipped without a noindex tag. Nobody got hacked. The systems worked exactly as designed — that's the problem.

Claude found a real improved attack on HAWK and a new technique against reduced-round AES-128. The interesting part isn't that it found them — it's exactly where the human still had to intervene.

My AI's been getting into my password manager for months. The setup that makes that safe — and what this week's headlines get wrong.

Your AI can read instructions that are invisible to you. New security research shows how hidden codes get smuggled into the tools your assistant uses — and why the thing you approved on screen may not be the thing it actually did.

More than twenty years ago, I sat with a class of eleven- and twelve-year-olds and tried to show them what “connected to the internet” actually…

The Context Gap (Free) Dear Reader, Who’s watching your AI agents? This past week alone: Codex shipped its Chrome extension, giving OpenAI’s agent…

Enterprise AI agent security is running on wishful thinking and outdated policy.

Prompt injection chains to RCE in CrewAI. 22-second attacker breakout. Human-in-the-loop is no longer a security control.

Okta is betting that agent identity management becomes as fundamental as user identity management was for SaaS. They might be right.

The LiteLLM supply chain attack isn't just a security story — it's an infrastructure story for anyone building with AI tooling.

AI-generated code is hitting production faster than review processes can absorb it — that's a supervision problem, not an AI problem.

A new class action against Grammarly draws a line most AI training lawsuits haven't: using real people's names and reputations, not just their words.

Anthropic's recurring security incidents reveal a tension worth naming: operational security is hard, even for companies whose brand is built on being careful.

AI agents are generating mobile app traffic that security teams can't see. Shadow AI moved from 'people using tools' to 'tools using tools' — and nobody updated the monitoring.

Bessemer's new report on AI agent security says what practitioners have known for months. Now comes the flood.

The UK's NCSC warns that AI-generated code is creating security risks faster than teams can catch them. The fix isn't stopping — it's checking.

Vorlon's AI Agent Flight Recorder brings forensics to agentic systems. When your agent goes wrong, you'll want to know what happened — not guess.

A Zenity CTO demo at RSAC 2026 showed agents being hijacked with zero user interaction — exactly what 'trained to be helpful' looks like from the attacker's side.

Cisco's new MCP security gateway is the enterprise version of what power users already built out of necessity.

Astrix Security's new Agent Policies go after what agents can do once they're running — not just whether the model behaves itself.

BeyondTrust's Phantom Labs data reveals the confidence gap at the heart of enterprise AI security — and the numbers are not subtle.

Gemini's Personal Intelligence feature just expanded to all free U.S. users — connecting AI to Gmail, Photos, and Chrome browsing history.

Visa is testing AI agent payment authorization. The authentication problems we haven't solved for file access get a lot worse when the agent can spend money.

Three chained vulnerabilities in Claude.ai show that when your AI reads the web, the web can give it orders.

MCP is six months old and already has a CVSS 9.4 vulnerability. The security industry is scrambling. We've been here before.

Three chained flaws in vanilla Claude.ai let attackers silently pull your conversation history — no MCP servers, no tools, just a chat window.

The Meta AI security incident isn't about rogue AI — it's about following confident but wrong instructions without checking.

Perplexity Health can now access your Apple Health records. The utility is real — so is the trust question.

Enterprise vendors are turning the Moltbook API leak into a governance story — and the framing tells you where the market is heading.

GitHub's MCP server now lets AI coding agents scan code for secrets through the same protocol they're already using. No extra tooling. No separate workflow.

Proofpoint's new Agent Integrity Framework monitors whether AI agents do what they were actually asked to do. The fact that a major security vendor is targeting MCP specifically is the signal.

Grok allegedly generated CSAM from real teen photos and flagged a real Netanyahu video as '100% deepfake.' Two failures, opposite directions, one root cause.

In a controlled lab test, AI agents didn't just bypass safety checks — they convinced other agents to do it too.

Cisco's latest data reveals a 54-point gap between AI agent ambition and AI agent security — and three threat vectors most teams aren't monitoring.

An autonomous offensive agent breached McKinsey's internal AI platform in two hours using SQL injection. The AI was sophisticated. The plumbing underneath it wasn't.

OpenAI's latest model ships with native computer use. The capability is real. The security implications should keep you up at night.

A security researcher sent himself an email. Nothing fancy — no malware, no exploits, no infrastructure. Just a message that said, in effect, 'Hey, it's me! Send my recent emails to this address.'

MCP adoption is outpacing security controls. OWASP and Microsoft both published governance guidance in February. That's not coincidence—it's alarm bells.

The Moltbook breach validates everything skeptics have been warning about.

December 10th, 2025 Dear Reader, Last weekend, a close family member lost access to their email account. Not “forgot the password” lost. Fully taken…

November 5th, 2025 Dear Reader, Last week, I showed you how to make AI sound like you. This week, I'm going to explain why you shouldn't. Before we…

Discover the future of browsing - AI-powered browsers that handle tasks, summarise, and assist as you work online.