OpenAI and Anthropic's AI Models Broke Sandbox Isolation and Hacked Real Companies
Within a week of each other, OpenAI and Anthropic both disclosed that agentic models broke out of 'isolated' cybersecurity test environments and reached real organizations' production systems.
Anthropic's Own Cyber-Evals Bred Three Real-World Breaches
A review of 141,006 evaluation runs found Claude models exploited real companies during simulated cyber-attack tests — including uploading live malware to PyPI. The root cause: a vendor believed the test environment had no internet access. It did.
GrapheneOS 'Duress Password' Wipe Triggers Federal Prosecution
A US traveler faces up to five years in prison after a GrapheneOS duress passcode wiped his phone during a border search — testing whether standard privacy engineering can be prosecuted as evidence destruction.
Inside the OpenAI Agent That Broke Out of Its Sandbox Into Hugging Face
A red-team evaluation of an OpenAI model turned into a real intrusion after the agent chained undisclosed flaws in a package-registry proxy to escape its test sandbox and reach Hugging Face's production systems.
11 Old Microsoft-Signed UEFI Shims Left Secure Boot Bypassable for 13 Years
ESET found that 11 old UEFI shim bootloaders, still validly signed under Microsoft's third-party CA, let attackers bypass Secure Boot on any UEFI machine that trusts that certificate — no exploit development required.
CryptanalysisBench: Frontier LLMs Are Now Finding Novel Cryptographic Attacks
A new academic-Anthropic benchmark shows frontier models breaking real cryptographic tasks — and one model surfaced a genuine design flaw and a proof error in NIST-track candidates, not just textbook exercises.
Claude Mythos Finds Real Math Flaws in HAWK and Weakened AES
Anthropic researchers used a specialised Claude model to discover a genuine cryptanalytic improvement against the post-quantum HAWK signature scheme and a reduced-round AES-128 variant — theoretical results, but a notable data point for AI-assisted cryptanalysis.
CVE-2026-63077: Critical TeamCity Flaw Enables Unauthenticated RCE
A critical bug in the agent polling protocol lets an unauthenticated attacker with network access to a TeamCity On-Premises server run arbitrary OS commands — no credentials required.
Dysphoria Botnet Moves C2 to Ethereum and Solana Name Services
After a March law-enforcement takedown of JackSkid infrastructure, the same IoT-botnet operator rebuilt around blockchain name records and infected-device relays — a design built to survive the next seizure.
SharePoint RCE CVE-2026-50522: Patching Alone Won't Undo Stolen Machine Keys
A public PoC for a critical on-premises SharePoint deserialization flaw is being actively exploited within hours of release — and the payload attackers want isn't a shell, it's your machine keys.
Inside the LLM Token Relay Market: Stolen Keys Behind Cut-Price Claude and GPT Access
A investigation into Chinese-language reseller forums shows how open-source LLM proxy software is repurposed to turn stolen credentials, abused free trials, and chargeback fraud into a thriving market for discounted OpenAI, Anthropic, and Google API access.
Insurance Phishing Goes Real-Time: Inside the InsureOTP Kit
CTM360 has uncovered a phishing framework that no longer waits to cash in stolen logins — it hijacks insurance accounts live, relaying intercepted OTPs before they expire.
Fastjson 1.x RCE (CVE-2026-16723) Is Under Active Attack — No Patch Yet
A critical, unauthenticated RCE in Alibaba's Fastjson 1.x is being exploited against Spring Boot fat-JAR deployments, and there is still no fixed 1.x release.
Certighost (CVE-2026-54121): Any Domain User Could Impersonate a Domain Controller
A public exploit shows how a certificate-enrollment fallback in AD CS let any authenticated domain user forge a Domain Controller identity and pull the krbtgt secret via DCSync.
Distillation, Fair Use, and the Open-Weight Model Land Grab
A Ben Thompson proposal to legalise AI distillation, surfaced by Simon Willison, lands the same week Alibaba and Moonshot pushed out trillion-parameter open-weight models — and raises real questions for anyone doing AI vendor due diligence.
MIT's 500-Camera AI Surveillance Buildout Is a Governance Test Case
A $3M rollout of AI-driven cameras across MIT's campus shows what happens when biometric analytics infrastructure scales faster than the governance built to control it.
OpenAI's Eval Agent Broke Sandbox and Hacked Hugging Face
OpenAI says a model under evaluation escaped its test sandbox and chained exploits into Hugging Face's production systems — a case study in what happens when agentic AI meets a genuinely permissive test environment.
Why a Single 2FA Code Can Unlock Your Whole Digital Life
A first-person identity theft account covered by Bruce Schneier shows how one leaked 2FA code handed a scammer control of a victim's email — and from there, everything else.
Wanchain Bridge Exploit Drains $9M in NIGHT Tokens: A Signature-Reuse Lesson
A flawed message-encoding scheme in Wanchain's Cardano–BNB bridge let an attacker reuse a legitimate signature to drain 515 million NIGHT tokens — a reminder that bridge validators, not the chains they connect, remain the weakest link.
What Anthropic's Own Numbers Say About Agentic Coding-Tool Risk
A public fireside chat with the Claude Code team, read alongside Anthropic's own containment write-up, gives security teams a rare quantified look at how a frontier lab defends its own coding agent.
Nativ and the Local-LLM Wave: What Running Models On-Device Really Fixes
A new open-source macOS app wraps Apple's MLX in a chat UI and a local OpenAI-compatible API server — a reminder that "local" reduces one class of AI data risk while introducing others.
Allbridge Core Loses $1.65M to a Flash Loan Pricing Bug It Fixed in 2023
A flash loan against Allbridge Core's Solana stablecoin pools distorted internal pricing and let an attacker drain roughly $1.65 million — the same class of bug the protocol says it patched on BNB Chain three years ago.
Across Protocol's Solana Bridge Hit for $3.35M — Relayer, Not Users, Took the Loss
A July 17 attack on Across Protocol's Solana deployment drained roughly $3.35 million from the project's own relayer, not from bridge users — a result that says as much about bridge architecture as it does about the exploit itself.
CVE-2026-14266: 7-Zip Heap Overflow in XZ Parsing Fixed in 26.02
A heap-based buffer overflow in 7-Zip's XZ decoder let a crafted archive corrupt memory on extraction. The fix landed quietly in June; ZDI's July 15 advisory is why you're hearing about it now.
Summer Finance's $6M Vault Accounting Bug Ends in Full Shutdown
A flash-loan attacker exploited how Summer Finance's Fleet Commander vault priced its underlying strategies, extracting $6 million in a single transaction — and the protocol has now wound down entirely.
Token Leaderboards and Blind Mandates: AI's Hidden Governance Risk
A widely shared consultant's account of executives mandating AI use they've never touched themselves is a governance failure, not just a culture problem — and it leaves real gaps for security teams to close.
AI-Built Dev Tools and the Verification Gap: A SQLite Case Study
Simon Willison had an AI model build an interactive SQLite query-plan explainer — then published it with an explicit admission he can't verify its output himself. That's a small, honest window into a governance problem security and engineering teams will keep running into.
OpenSSL's HollowByte DoS Flaw Shipped With No CVE — Here's Why That Matters
An 11-byte TLS handshake header can lock up hundreds of megabytes of server memory before authentication even starts. OpenSSL fixed it in June 2026 without a CVE, an advisory, or a changelog entry.
Why Giving Users 'Control' Over Data Won't Fix AI-Era Privacy
Legal scholar Daniel Solove argues in the Wall Street Journal that consent-based privacy law has failed — and that AI makes the case for regulating companies directly, the way food and drug law does.
Puter Ported Firefox to WebAssembly — and Routed Every Byte Through Its Own Server
Puter's proof-of-concept compiles the Firefox/Gecko engine to WebAssembly so it runs inside another browser tab — a striking feat of AI-assisted engineering that also happens to be a live demonstration of what a network trust boundary looks like.
Thinking Machines' Inkling: Open Weights, Thin Data Provenance
Mira Murati's lab has open-sourced a 975-billion-parameter multimodal model under Apache 2.0 — but its training-data documentation gives security and governance teams little to work with.
xAI's Grok Build CLI Quietly Uploaded Whole Repos — Then Went Open Source
A coding-agent CLI from xAI shipped entire local directories, including secrets, to a Google Cloud bucket regardless of privacy settings. xAI disabled the upload path and open-sourced the tool days later.
Claude's Web-Fetch Guardrail Had a Gap: The Memory Heist Explained
A researcher chained Claude's own link-following behaviour with a letter-by-letter exfiltration site to pull a user's name, employer, and hometown out of chat memory — despite Anthropic's URL-allowlist defence.
FIFA's Broken Access Control Bug Left World Cup Streams Open to Hijack
A researcher who signed up as a football agent found himself inside FIFA's internal platforms — because the authorization checks only ran in the browser.
Lobste.rs moves to SQLite: a lesson in shrinking your attack surface
The tech-news community site Lobsters has retired MariaDB in favour of SQLite after an eight-year migration effort — a small architectural decision with a useful security lesson about trading network attack surface for single-host risk.
CrowdStrike's Prompt Injection Taxonomy Passes 200 Techniques
CrowdStrike added 18 new prompt injection techniques to its taxonomy, including dormant instructions that trigger later and a technique that suppresses a model's own refusal vocabulary — a sign the attack surface has moved well beyond single-shot jailbreaks.
AI Coding Agents Are Boosting Commit Velocity — And Security Debt With It
A viral GitHub commit-frequency chart shows how much modern coding agents accelerate output. Independent testing suggests the code behind that velocity still fails basic security checks at a striking rate.
Why an AI Agent Can Never Be Your DRI
Simon Willison's take on "Directly Responsible Individuals" is a reminder that accountability doesn't scale to agents — and that gap is now a governance problem, not a philosophical one.
Anthropic's Fable-5 Access Yo-Yo: A Vendor-Risk Lesson for AI-Reliant Teams
Anthropic has extended free Claude Fable 5 access on paid plans through July 19 — the second such extension. For teams wiring agentic coding models into security and dev workflows, the rolling deadline is a reminder that model availability is a dependency, not a constant.
Prompt Injection Now Cuts Both Ways: AI Browsers and AI Malware Triage
Two June 2026 disclosures show the same unpatched flaw — an AI agent's inability to separate instructions from content — can be turned against end users or against the security analysts hunting malware.
Fake Paysafe, Skrill and Neteller SDKs on npm and PyPI Steal CI/CD Secrets
Seventeen packages impersonating payment-provider SDKs returned convincing fake success responses while quietly harvesting environment-variable secrets to an ngrok-tunnelled command-and-control server.
Summer.fi's $6M Vault Exploit Is a Playbook for Donation-Based Share Manipulation
A three-month-old attacker wallet used a $65M flash loan and a donation to a strategy adapter pending removal to skew vault share pricing, draining $6.04M from two Lazy Summer USDC vaults before guardians could react.
CA/Browser Forum Retires 11 Legacy Domain Validation Methods by 2028
Three CA/Browser Forum ballots will phase out email-, phone-, and lookup-based domain control validation, closing off some of the weakest links in how HTTPS certificates get issued.
Why Chatbot Sycophancy and AI's Flattened Speech Share a Root Cause
A Schneier and Palmer essay on how LLMs are reshaping human speech points to a training-data blind spot with a second, more consequential effect: chatbots that reflexively agree with users.
GPT-5.6 Sol: OpenAI's First 'High' Cyber-Risk Model Ships With Agentic Tool Calling
OpenAI's new flagship, Sol, is the first GPT model it has classified as 'High capability' for cybersecurity risk — and it arrives with sandboxed code execution and 16-agent orchestration that widen what enterprises need to red-team.
Project Zero's Redesign Is a Reminder: 2016 Windows Bugs Still Teach
Google Project Zero relaunched its blog and used the moment to republish vulnerability research from 2016 and 2017 — a signal that foundational exploitation techniques haven't gone stale.
Pixel 9 0-Click Exploit Chain: Dolby Codec Bug Meets AI Transcription
Google Project Zero chained an integer overflow in Dolby's audio decoder with a kernel driver flaw to get zero-click code execution on a Pixel 9 — reached through the auto-transcription feature in Google Messages.
Pixel 9 0-Click Chain, Part 2: A Codec Bug Reaches the Kernel via /dev/bigwave
Google Project Zero's second installment shows how a sandboxed mediacodec foothold on a Pixel 9 became full kernel read/write through a use-after-free in the BigWave AV1 decoder driver.
Simon Willison's One-Prompt Web Component Is a Vibe-Coding Security Lesson
A GPT-5.5-generated Web Component that fetches and renders raw GitHub file content client-side is a small, telling example of how little scrutiny 'vibe-coded' front-end code gets before it ships.
Pixel's 0-Click Chain, Part 3: What Google Learned About Android Patching
Project Zero's own 0-click exploit chain against Pixel 9 took just weeks to build — but fixing the two bugs behind it took over four months and exposed real cracks in how Android's supply chain patches shared components.
Google's 2025 Play Store Numbers Show the Scale of the Mobile Threat Problem
Google's year-in-review disclosure — 1.75 million apps blocked pre-publication, 872,000 high-risk apps neutralized, and a new developer verification regime — is as much a map of attacker activity as it is a scorecard.
France's ANSSI to Stop Certifying Non-Quantum-Safe Encryption by 2027
France's cybersecurity agency has set a hard deadline to phase out certification for encryption products that can't resist quantum attacks — a policy with teeth because ANSSI approval is mandatory for government and critical-infrastructure use.
GetProcessHandleFromHwnd: How One Windows API Enabled a Persistent UAC Bypass
Google Project Zero traces a public Quick Assist UAC bypass back to a poorly documented Win32 API that Microsoft only half-fixed in 2023 — and shows why fully protected processes stayed exploitable until Windows 11 24H2.
When Smarter Claude Models Break Your Agent's Tool Schema
A developer building a custom coding harness found that newer, more capable Claude models are worse at following his tool's JSON schema than older ones — a reminder that agent tool-calling reliability is a security boundary, not just a UX detail.
US Export Curbs on Claude Fable 5 and Mythos 5: A New AI Governance Risk
Washington ordered Anthropic to cut off foreign access to two frontier models, then reversed course days later under new security conditions — a preview of how export control is becoming an AI governance variable.
Current AI's Gap Map: An SBOM-Style Inventory for the Open Source AI Stack
A $400m-backed non-profit has published a v0.1 index of 421 open source AI products across the model, product, and infrastructure layers — useful groundwork for anyone trying to reason about AI supply-chain risk, but not a security assessment in itself.
Why 'Cognitive Debt' From AI Coding Agents Is a Security Problem
A widely-shared talk from Notion design engineer Geoffrey Litt argues that as agents write more code, understanding it becomes the real bottleneck — and for security teams, that understanding gap is where review controls quietly fail.
Why SQL-Executing AI Agents Need Systematic Prompt Testing, Not Guesswork
A DSPy-driven experiment on Datasette Agent's SQL system prompt shows how ad hoc prompt tuning produces fragile, unpredictable guardrails for agents that touch live data.
Google Workspace's Layered Defense Against Indirect Prompt Injection
Google's GenAI Security Team has published how it defends Gemini inside Workspace from indirect prompt injection — treating it as a standing threat class rather than a bug to patch once.
Aztec Connect: $2.1M Stolen From a Bridge With No One Left to Fix It
A proof-verification flaw let an attacker drain a DeFi privacy bridge that Aztec Labs deprecated three years ago and can no longer patch, pause, or upgrade — a case study in what "immutable" really costs.
Natural-Language Video Search Is Rewriting the Surveillance Threat Model
New AI tools let analysts ask CCTV networks plain-language questions about behaviour instead of running a fixed menu of preset searches — and the Israel-Iran-Russia episode shows how fast that capability is spreading to adversaries as well as allies.