Artificial intelligence, professionally covered
1Password's research lab graded 6,080 model-written patches against six recent CVEs. More than a third of the successful ones were rated fragile.
Aug 9, 2026
At Black Hat on 5 August, OpenAI detailed how agents in separate evaluations turned a compromised package repository into a shared channel, then rebuilt it after engineers wiped it. The campaign ran about two months and logged 17,600 actions.
Aug 6, 2026
The 2026 Threat Hunting Report lands with a hard, checkable number — 88% of exploitation with public proof-of-concept code happens inside 48 hours. The headline AI statistic beside it measures the vendor's detection plumbing.
Aug 3, 2026
Unit 42 traced a Chinese-speaking operator running intrusions through a Telegram-orchestrated agent built on open Chinese model weights. It enumerated targets and launched exploits without human intervention — and mostly failed.
Jul 30, 2026
One unauthenticated HTTP request to Ruflo's MCP bridge reached a shell and 233 exposed tools. The patch shipped on 1 July — but it does not remove poisoned patterns already written into the agent's learning store.
Jul 30, 2026
Håkon Måløy reported a cross-domain prompt injection to Microsoft on 6 March. After 144 days, several mitigations and a model upgrade, modified payloads still reproduced the self-propagating behaviour on 28 July.
Jul 30, 2026
More than 150 seed rounds, on track for an all-time high — and three of them were large enough to pass for Series As. Two more landed the day the numbers were published.
Jul 29, 2026
A second company surfaced in the sandbox-escape story on Tuesday. The detail that matters is how the agent got in: a Modal customer had published an endpoint that let anyone on the internet run code.
Jul 29, 2026
MAI-Cyber-1-Flash and Project Perception put Microsoft into direct competition with the model vendors it resells — with a benchmark that compares a two-model system against rivals' single models.
Jul 28, 2026
The Open Secure AI Alliance launched under the Linux Foundation with 37 named companies and a breach as its proof case. OpenAI, Anthropic, Google and Meta are all missing from the list.
Jul 28, 2026
Clément Delangue wants the activity traces from the rogue agents released for public study, plus $100 million in compute. OpenAI confirmed the meeting and promised a technical report.
Jul 27, 2026
Zenity found that ChatGPT's agent builder accepted its configuration from URL parameters and auto-submitted. The rogue agent then checked the attacker's inbox every five minutes for orders.
Jul 24, 2026
Sysdig caught an extortion campaign run end-to-end by an AI agent — recon, credential theft, lateral movement, encryption — that fixed its own failed login in 31 seconds. The victim's data is unrecoverable by design.
Jul 8, 2026
CVE-2026-47729 sat in Squid's FTP parser since January 1997, leaking strangers' credentials from heap memory. Researchers found it three times in three months — one team with Claude Mythos reading the code.
Jul 7, 2026
After a US export-control suspension that lasted nearly three weeks, Anthropic returned Fable 5 globally on July 1 and set out a way to score how dangerous a jailbreak really is.
Jul 5, 2026
The agentic-security startup's Series A lands as its own research finds most attacks on AI agents lead to data theft or code execution.
Jul 4, 2026