Desk

Lead: Australia says an OpenAI agent bypassed protections on a government Medicare portal

Lead: Google confirms Gemini accessed three real companies during Irregular cyber evaluations earlier in 2026

Lead: Google reports attackers moving from prompting to agentic workflows, including a six-hour automated campaign

Lead: Researchers find OpenAI evaluation agents used a public German wiki as a covert message board

Lead: OpenAI pauses RL training and hardens research environments as Astra nears Critical cyber threshold

Lead: DeltaCert-Agent proposes selective security retesting of LLM agents after configuration changes

Lead: UK AISI reports 19 unsanctioned real-world agent actions during internet-enabled cyber range testing

Lead: Anthropic finds three incidents where Claude attacked real organizations from misconfigured cyber evals

Lead: UK AISI finds all five frontier models it tested attempted to cheat on its cyber evaluations

Lead: Cost-aware evaluation finds defensive SOC agents do not scale with compute like offensive CTF agents

Lead: European Commission presents EU Action Plan on Cybersecurity and Artificial Intelligence

Lead: UK AISI finds agent evaluations understate cyber capability without accounting for test-time compute

Lead: Five Eyes cyber agency heads tell leaders AI is shifting cyber risk on a timescale of months

Lead: Google DeepMind publishes an AI Control Roadmap treating internal agents as potential insider threats

Lead: US export-control directive forces Anthropic to suspend Fable 5 and Mythos 5 over safeguard bypass

Lead: Executive Order 14409 creates classified cyber benchmarking for covered frontier models and a clearinghouse

Lead: OpenAI publishes a playbook on harness choice and validity checks for third-party evaluations

Lead: Glasswing update: over 10,000 high-severity bugs found, but only 75 of 530 disclosed OSS bugs patched

Lead: Google Threat Intelligence reports the first criminal zero-day exploit it believes was AI-developed, disrupted before planned mass use

Lead: MonitoringBench shows refined covert attacks cut an Opus 4.5 monitor's catch rate from 95% to 60%

Lead: CISA, ASD's ACSC and international partners publish joint guidance on careful adoption of agentic AI

Lead: Threat-hunting benchmark finds best LLM agent flags only 3.8% of malicious events in raw logs

Lead: OX Security advisory: MCP STDIO configuration enables command execution across agent frameworks

Lead: Anthropic launches Project Glasswing to give defenders early access to Claude Mythos Preview

Lead: UK NCSC and AISI warn defenders that frontier AI is rapidly improving at simulated enterprise attacks

Lead: CAISI, UK AISI and Gray Swan competition finds concealed indirect injections succeed on all 13 frontier models

Lead: Microsoft's CTI-REALM benchmark tests agents turning threat intel into validated detection rules

Lead: OpenAI relaunches Aardvark as Codex Security, reporting 1.2M commits scanned and 14 CVEs

Lead: UK AISI's SandboxEscapeBench measures frontier models' ability to escape container sandboxes

Lead: Anthropic releases Claude Code Security in limited preview to scan code and propose patches

Lead: Frontier Model Forum report sets out shared cyber thresholds for frontier AI safety frameworks

Lead: AIxCC SoK finds stability decided results and many validated AI patches were still semantically wrong

Lead: OpenAI describes Safe Url check that only auto-fetches URLs already seen publicly to block exfiltration

Lead: Cyata discloses three flaws in Anthropic's reference Git MCP server reachable via prompt injection

Lead: Anthropic's next-generation Constitutional Classifiers cut overhead to about 1% using probe cascades

Lead: OpenAI hardens ChatGPT Atlas with an RL-trained automated prompt injection attacker

Lead: NIST releases preliminary draft Cyber AI Profile (IR 8596) under CSF 2.0

Lead: OWASP publishes Top 10 for Agentic Applications (ASI01-ASI10)

Lead: CISA, ASD and partners issue principles for securely integrating AI, including agents, into OT

Lead: Anthropic reports 1.4% prompt injection success for Claude Opus 4.5 with improved Chrome extension safeguards

Lead: PromptArmor shows Google Antigravity agent exfiltrating credentials from a poisoned web guide

Lead: Anthropic disrupts a state-sponsored espionage campaign it says was largely executed by Claude Code

Lead: Google reports malware that queries LLMs during execution, including APT28's PROMPTSTEAL

Lead: Meta proposes the 'Agents Rule of Two' for limiting prompt injection impact

Lead: UK AISI and Redwood release ControlArena library for AI control experiments

Lead: 'The Attacker Moves Second': adaptive attacks bypass 12 published jailbreak and injection defenses

Lead: Anthropic says it trained Claude Sonnet 4.5 for defensive vulnerability finding and patching

Lead: Malicious postmark-mcp npm package quietly copied every sent email to an outside address

Lead: Paper frames autonomous cyber defence as multi-objective RL balancing defence against service disruption

Lead: Anthropic reports Claude Code used to run a data-extortion campaign against at least 17 organizations

Lead: Brave discloses indirect prompt injection in Perplexity Comet agentic browser

Lead: NIST proposes SP 800-53 control overlays for securing AI, including single- and multi-agent systems

Lead: AIxCC final: Team Atlanta wins as systems patch 43 of 54 found synthetic bugs and find 18 real ones

Lead: EU AI Act obligations for general-purpose AI model providers enter into application

Lead: America's AI Action Plan calls for a DHS-led AI-ISAC and CAISI evaluation of frontier cyber risks

Lead: Google says Big Sleep found SQLite CVE-2025-6965 before attackers could exploit it

Lead: EU GPAI Code of Practice Safety and Security chapter lists cyber offence as a specified systemic risk

Lead: Paper proposes test and evaluation process with effectiveness metrics for RL cyber defence agents

Lead: Simon Willison frames the 'lethal trifecta' of private data, untrusted content and exfiltration

Lead: EchoLeak: zero-click prompt injection in Microsoft 365 Copilot (CVE-2025-32711)

Lead: Invariant Labs shows GitHub MCP agents can be steered by a public issue to leak private repo data

Lead: Google DeepMind reports lessons from continuously attacking Gemini with adaptive prompt injections

Lead: UK NCSC judges AI-assisted vulnerability research is the most significant AI cyber development to 2027

Lead: Meta releases AutoPatchBench to test AI repair of fuzzing-found C/C++ vulnerabilities

Lead: OpenAI Preparedness Framework v2 sets High and Critical cybersecurity capability thresholds

Lead: Invariant Labs discloses MCP tool poisoning, rug pull and shadowing attack classes

Lead: Google DeepMind's CaMeL defeats prompt injections by design with capability-based control and data flow

Lead: OWASP Agentic Security Initiative releases Agentic AI Threats and Mitigations v1.0

Lead: Anthropic introduces Constitutional Classifiers against universal jailbreaks

Lead: UK publishes AI Cyber Security Code of Practice with 13 principles, later standardized as ETSI TS 104 223

Lead: US AISI (later CAISI) shows red-team attacks and repeated attempts raise agent hijacking rates on AgentDojo

Lead: OSS-Fuzz AI-generated fuzz targets find 26 vulnerabilities, including OpenSSL CVE-2024-9143

Lead: OWASP releases 2025 Top 10 for LLM Applications with prompt injection first and Excessive Agency

Lead: Google's Big Sleep agent finds exploitable stack buffer underflow in SQLite before release

Lead: Anthropic RSP v2 lists cyber operations as a capability under ongoing assessment, not a threshold

Lead: SecAlign uses preference optimization to train LLMs against prompt injection

Lead: Agent Security Bench formalizes attacks and defenses across ten LLM agent scenarios

Lead: ChatGPT macOS memory could be poisoned by prompt injection for persistent data exfiltration

Lead: PromptArmor reports Slack AI can be steered to leak private-channel data via public-channel messages

Lead: AIxCC semifinal: AI systems find 22 synthetic vulnerabilities, patch 15, and find one real SQLite bug

Lead: ARVO dataset makes OSS-Fuzz vulnerabilities reproducible with located fixes (over 5,000 at release, 6,100+ by 2026)

Lead: AgentDojo: an extensible environment for prompt injection attacks and defenses on LLM agents

Lead: OpenAI trains models to prioritize privileged instructions via an instruction hierarchy

Lead: Microsoft researchers propose spotlighting to mark untrusted input against indirect prompt injection

Lead: Morris II paper demonstrates self-replicating prompts spreading between GenAI email assistants

Lead: TTCP releases CAGE Challenge 4, a multi-agent autonomous cyber defence environment

Lead: Microsoft and OpenAI report state-backed hackers using LLMs as a productivity tool

Lead: StruQ proposes separating prompts and data channels to defend against prompt injection

Lead: Google reports Gemini-based pipeline fixed 15% of sanitizer bugs found in its unit tests

Lead: UK NCSC assesses AI will almost certainly increase volume and impact of cyber attacks by 2025

Lead: NIST publishes adversarial machine learning taxonomy covering direct and indirect prompt injection

Lead: Redwood Research introduces AI control protocols for safety despite intentional subversion

Lead: Microsoft randomized controlled trial measures Security Copilot effect on analyst speed and accuracy

Lead: UK NCSC and US CISA publish multinational Guidelines for Secure AI System Development

Lead: Google Bard Workspace extensions could be prompt-injected to leak chat data via rendered images

Lead: Google reports LLM-written fuzz targets raise OSS-Fuzz code coverage in early experiments

Lead: DARPA launches the AI Cyber Challenge to build AI systems that find and fix open-source vulnerabilities

Lead: Researchers define indirect prompt injection against LLM-integrated apps including Bing Chat