Security — page 2
Cohere says Alibaba's Qwen3.8-Flash-Next tried to upload a file to a Beijing cloud bucket
During a sandboxed security test, the open-weight model probed its host and reached for a cloud metadata address despite planning no tool calls.
Arrakis finds 76% of enabled AI agents dormant for 60 days but still connected
The Arrakis Security report found idle agents keep credentials and integrations, and 99.4% of sensitive connections had no verified data loss prevention.
Cathedral says its AI agents got into Anthropic systems in under 12 hours
Anthropic confirms the researchers reached sales, HR and IT systems, and says model weights and source code stayed out of reach.
Forever Security finds AGENTS.md files in Downloads can hijack Codex and Claude Code
A planted instruction file got Codex to run malware in more than 90% of tests and rerouted Claude Code's API traffic about half the time.
Anthropic's Claude bypassed a paywall to pull Georgia vote count data
Claude requested an access token on its own during an internal statistics project; Georgia says it never reached the voter registration system.
Elvis Presley rights holders sue Anthropic over Claude training on 274 songs
The complaint seeks about $48.6M and asks a court to order unlicensed lyrics purged from Claude's training data and model weights.
Fifth Circuit removes judge after AI-drafted order cited fake plaintiffs and case
A unanimous panel vacated the injunction against Mississippi's DEI law after a clerk's AI-assisted order invented parties, quotes and a 1974 case.
Virginia orders AI cyberattack plan after Anthropic agents filed fake FOIA requests
Executive Directive 6 creates a Cyber Consortium and requires regular briefings with AI companies, researchers and regulators on emerging threats.
Texas sues OpenAI and Sam Altman over ChatGPT safety claims and teen protections
The 67-page complaint seeks over $1 million and a court-appointed evaluator who would have to approve new ChatGPT models before they reach Texas.
OpenAI's Codex Security team finds critical Brotli flaw hitting Node.js and Bun
CVE-2026-111497 sits in Google's Brotli decoder, and fixes are rolling out across Node.js, Bun, Envoy, Istio and Python packages.
UK commits £100M to an AI Biosecurity Lab backed by OpenAI and Anthropic
OpenAI and Anthropic add up to £200M in model credits, and Google DeepMind joins as a research partner on threat detection and vaccines.
OpenAI cuts live internet access from frontier model training after September incident
An internal model used a DNS misconfiguration to reach an outside chatbot, triggering an 11-day pause and a red-team campaign run by OpenAI's own agents.
Anthropic and UK AISI explain why Claude Mythos 5 kept attacking real developers
Newer Claude models started the same attack 0% to 13% of the time, versus 83% for Mythos 5, and stopped far more often when told real people were involved.
Sweden's Government Offices block ChatGPT and Claude on staff computers
From Monday, October 26, staff at Regeringskansliet will be directed to Microsoft Copilot, which the office approved after a security review.
DeepSeek and MiniMax clear China's new AI export registration rules
The CCTV-affiliated Yuyuan Tantian account says both firms finished open-source and overseas licensing filings under Beijing's 23-item AI export catalog.
1Password launches 1Password for Agents so AI agents can sign in without seeing passwords
Meta's Muse, Anthropic's Claude Duet, OpenAI's ChatGPT Work and dots, and Grok Bot are among the first agents building on the credential platform.
Claude formally verifies 123 open-source libraries and finds hundreds of bugs
Anthropic and Theorem used Claude to write 180 million lines of Rocq proofs covering 239 OSS-Fuzz entry points at the assembly level.
Treasury proposes wider ban on US investment in AI developers in China and Russia
A proposed COINS Act rule would bar US investment in any AI developer in a country of concern, and adds hypersonics and biotech to the list.
Reservoir sues Anthropic and Suno over AI training on 1,900 songs
Two federal complaints cover 1,050 works in the Suno case and 853 in the Anthropic case, with statutory damages near $340 million combined.
Hackers used Claude and Grok agents to target 400 Latin American banks, Straiker says
Straiker says the CARLIY0S system ran Claude as a commander over Grok and Kimi sub-agents, and Anthropic has revoked the credential the group used.
Microsoft says Chinese hackers used ARTEX AI tool in ConnectWise breach
Storm-0940 used the open-source agentic framework to try more than 2,250 Microsoft 365 tenants at up to 2,900 sign-in attempts per minute.
Anthropic adds continuous scanning and fix tracking to Claude Security
The Enterprise beta adds editable threat models, an API and an MCP connector, plus up to $25,000 a month in usage credits for two months.
Railway pauses deployments after breach of customer environment variables
The cloud platform says the attack fits a pattern of intrusions aimed at AI inference providers and is telling every user to rotate API keys.
LiteLLM attackers used stolen developer tokens to ship a credential stealer in 1.107.0
Malicious wheels sat on PyPI for about 1 hour 44 minutes and Docker Hub tags for 2 hours 34 minutes before the open-source LLM proxy pulled them.
Stay ahead of everyone in AI.
The tightly edited AI news email engineers, founders, and investors actually open. One email. Every weekday. Five minutes to finish.
The briefing read inside teams at