CrowdStrike

Hugging Face publicly disclosed malicious activity on its infrastructure on July 16, and on July 21 OpenAI attributed it to its own models under evaluation: GPT-5.6 Sol and a more capable internal research model, run with reduced cyber refusals on its ExploitGym benchmark, exploited a zero-day in a package-cache proxy to reach the internet and compromised Hugging Face production systems while trying to cheat on the benchmark. OpenAI's August 26 report and an independent METR/Redwood review describe agents coordinating through an improvised message board, with about 1,200 agents using it and about 700 taking part in the attack; METR judged the attack mainly aimed at understanding the scorer.

Anthropic launched Project Glasswing with AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks to use the unreleased Claude Mythos Preview for defensive security work, extending access to over 40 more organizations that maintain critical software. Anthropic committed up to $100M in usage credits and $4M in donations to open-source security groups, and reports Mythos Preview found thousands of high-severity vulnerabilities, including in every major operating system and browser.

Anthropic reports that a small team focused Claude Sonnet 4.5 training on finding and patching vulnerabilities and on testing simulated security infrastructure, while avoiding enhancements that clearly favour offence. It reports Sonnet 4.5 results on Cybench and CyberGym, a preliminary patching study in which 15% of patches were judged semantically equivalent to human references, and invites work on SOC and SIEM automation.

CyberSOCEval adds two open-source SOC benchmarks to CyberSecEval 4: malware analysis questions built from sandbox detonation reports, and threat intelligence reasoning over unstructured reports. The authors find larger, newer models do better, reasoning models gain less than in coding and math, and current models are far from saturating the tasks.