2026-07-02
Under a 2.5M-token cap, frontier cyber task time horizons doubled on the order of months between late 2024 and early 2026.
UK AISI later shows fixed budgets understate capability, so the trend is a lower bound.
Week of Jun 29 – Jul 5, 2026
5 records3 status changes on new evidence0 new findings
What changed in what we know
2026-07-02
Cyber capability measured at fixed, low token budgets understates what frontier models can do and how fast they are improving.
UK AISI measures the effect directly.
2026-07-01
Attackers have used AI agents to carry out much of the work of real intrusions, from reconnaissance to credential theft and extortion, with people directing them at a few decision points.
Sysdig independently documents an intrusion it assesses an LLM agent ran end to end; Google and ThreatDown later report further agent-driven operations.
Attacks & incidents
Jul 1, 2026
Sysdig documents JADEPUFFER, a database-extortion intrusion it says an LLM agent ran end to end
Sysdig's threat research team reports an operator it calls JADEPUFFER that gained access through a vulnerability in an internet-facing Langflow server (CVE-2025-3248), harvested credentials on that host, then used root database credentials of unknown origin against a separate production database server and ran a database-extortion playbook. Sysdig assesses the operation was driven end to end by an LLM agent, citing self-narrating payloads with natural-language reasoning and rapid adaptive retries, and calls it the first documented case of agentic ransomware.
Jul 1, 2026
DuneSlide: two Cursor flaws let prompt injection escape the agent sandbox (CVE-2026-50548/50549)
Cato AI Labs found that injected instructions arriving via MCP servers or web results could make Cursor's agent widen its own sandbox write permissions or exploit a symlink-check fallback, then run commands outside the sandbox as the user. Both flaws are rated CVSS 9.8 and were fixed in Cursor 3.0 on 2026-04-02 after Cursor initially rejected the reports.
Defense & research
Jul 2, 2026
UK AISI finds agent evaluations understate cyber capability without accounting for test-time compute
UK AISI's Science of Evaluation team measured how agent success changes with token budget across software, academic and cyber tasks. About 8% of cyber tasks were solved only at budgets of 10M tokens or more, and the frontier cyber time-horizon trend was about 60% steeper at a 50M budget than at 2.5M; AISI recommends reporting capability curves rather than single scores.
Policy & standards
Jun 30, 2026
US lifts export controls on Fable 5 and Mythos 5; Anthropic redeploys with new cyber classifier
Anthropic announced that export controls on Fable 5 and Mythos 5 had been lifted and that Fable 5 would be redeployed globally from July 1, 2026 with an improved safety classifier. Anthropic says the classifier blocks the technique described in an Amazon report in over 99% of cases and that CAISI researchers tested its prior and new safeguards. Mythos 5 access was restored for a set of US organizations after government approval on June 26.
Jul 2, 2026
Anthropic proposes Cyber Jailbreak Severity scale with Glasswing partners
Anthropic published an early-draft Cyber Jailbreak Severity framework, developed with Project Glasswing partners, to score cyber jailbreaks on capability gain, breadth, ease of weaponization and discoverability, mapped to five levels from CJS-0 to CJS-4. It also described Fable 5's cyber classifier tiers, which block prohibited and high-risk dual-use requests such as exploit development while allowing defensive work like patching and incident response.