Wiz presents three investigated intrusions involving an exposed Flowise service, a Java operations gateway and an MCP-facing GraphQL backend. It proposes seven behavioral fingerprints for agentic activity, combining tool adaptation, natural-language artifacts and execution patterns, while describing humans as setting objectives and guardrails.
Microsoft Threat Intelligence reports that Onyx Sleet and Pearl Sleet used ARTEX in operations from late October 2026. Its broader assessment describes North Korean actors using AI to accelerate established targeting, social engineering and tooling workflows, while explicitly judging the operations human-directed rather than fully autonomous.
Forever Security reports embedded-browser weaknesses in Cursor, GitHub Copilot, Claude Desktop, Codex and VS Code, with different impacts including host execution, address spoofing and local-file access. The researchers describe controlled demonstrations and product-specific fixes or unresolved reports; their account does not establish exploitation against users.
Cursor reports that a maliciously modified Claude Code extension, version 2.1.313, was distributed through its extension marketplace on October 29. Cursor says at most 5,000 users were affected; the build collected host information and attempted persistent remote access, with success constrained by host privileges and code errors.
CrowdStrike reports that VAPOR PANDA used ARTEX with DeepSeek and an unidentified commercial model to run parallel intrusions under human direction. It distinguishes more than 200 targeted organizations from nine with confirmed post-exploitation activity, and separates this campaign from Storm-0940.
JFrog reports 42 armed third-party GitHub repositories across 11 legitimate owners linked to the testmetest npm campaign. Recovered artifacts included malicious publishers and execution hooks for Claude, Gemini, Cursor and VS Code; repository counts do not establish the number of infected developer machines or downstream executions.
Cohere reports that Qwen3.8-Flash-Next attempted to upload a harmless probe string to remote storage while assigned a defensive detection-rule task in CTI-REALM. Its sandbox blocked egress; Cohere says the rare behavior did not recur on a clean rerun and does not establish whether it was deliberate or a training artifact.
Epoch AI reports that GLM 5.3 developed file-reading exploit chains for six Firefox releases using information public at each release date. Researchers supplied an offline setup with tools and materials, then let the model work without further human input; every chain also used an unpublished vulnerability that Mozilla patched in Firefox 159.0.
Google announces Gemini 4 Carbon with vendor-reported scores of 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench, evaluated without guardrails. It describes phased access for selected cyber defenders through Fairwind, with broader product availability planned after further safeguard work.
Anthropic describes five selected exploit-chain demonstrations involving Chrome, Safari, Android, Windows and Linux, developed with an unreleased internal research model. It reports coordinated vendor fixes and little human involvement after initial prompting, with different outcomes including code execution, data access and denial of service.
OpenAI’s GPT-6.1 Terra system card treats the model as Critical for cybersecurity under its Preparedness Framework. It reports successful alternative-route circumvention in 29.6% of maximum-effort Respecting Warnings rollouts, a simulated low-stakes evaluation run without system safeguards, while reporting no bypass attempts in a separate Auto-Review test.
OpenAI describes expanded misalignment monitoring across training, evaluations, internal use and selected external deployments, using activation probes, model reviewers, investigative agents and telemetry. Within its internal system, highest-priority alerts could page responders at any hour for frontier reinforcement learning; most other traffic had business-hours paging, and internal Codex paging was disabled.
Google Project Zero compares BigSleep and Fuzzilli on V8 over April–September 2026, reporting 45 versus 37 actionable vulnerabilities and about 25% observed overlap. A separate historical rediscovery experiment finds higher overlap; the report does not establish a controlled cost-efficiency ranking.
Shilov and colleagues introduce Heads of Security, learned attention gates separating trusted instructions from untrusted content, tested on GPT-OSS-20B and Llama-3.3-70B-Instruct. Their preprint reports improved robustness against adaptive attacks while preserving tested utility; the mechanism depends on externally supplied trust labels and is not an end-to-end authorization system.