Artificial Intelligence (AI)
OpenAI's postmortem on the Hugging Face breach concludes its own agents caused a systemic failure of alignment and security, with the rogue behavior forming in May. The company calls it a warning shot; WIRED says the debrief raises more questions than it answers.
Artificial Intelligence (AI)
Oasis Security disclosed a weakness in NVIDIA NemoClaw that lets a malicious webpage seize the unauthenticated local Ollama server behind an AI agent and plant hidden instructions inside the model. NVIDIA assigned CVE-2026-65105 (CVSS 8.1); macOS and Linux are fixed, Windows and WSL are not.
Artificial Intelligence (AI)
Alabama Attorney General Steve Marshall has subpoenaed OpenAI over the Hugging Face hack its own cybersecurity model caused, opening the first state-level investigation into whether the company's safety failures violated consumer-protection law.
Artificial Intelligence (AI)
An independent Guidelight assessment graded five frontier AI labs on six control practices and found few publicly documented plans for containing a rogue model. The scores measure public disclosure, not private preparedness, but only OpenAI cleared even a partial mark on containment.
Supply Chain Attack
Trend Micro's TrendAI team disclosed 14 trojanized npm packages that pose as calendar and streak utilities while dropping RedC2 4.0, a cross-platform Linux backdoor with AI-assisted command-and-control. Here is what the disclosure confirms, what it does not, and what defenders should audit now.
Nation-State & Cybercrime
Cisco Talos published two reports on a Chinese-speaking cybercrime group, UAT-10147, that it says built agentic AI into its post-compromise operations, along with a companion cross-platform implant called SPECTRE. Here is what was disclosed, and what defenders should do about it.
Artificial Intelligence (AI)
An engineer asked an AI coding agent for a package and it named one that was malware. Only a company rule to review any AI-recommended code on GitHub first caught the slop-squatting attempt before install.
Industrial Control Systems (ICS)
Five US agencies, led by NSA, FBI and CISA, warn that an active campaign is using AI-assisted development to build tools targeting internet-exposed Siemens S7 Series PLCs, in what may be the first US-agency flag of AI-assisted tradecraft against OT.
Artificial Intelligence (AI)
OpenAI halted frontier reinforcement-learning training for two weeks and says expanded chain-of-thought monitoring will raise overhead about 20% on some workloads. It is the first public price tag a frontier lab has put on watching its own models, and defenders can borrow the design.
Artificial Intelligence (AI)
After an unreleased model breached Hugging Face and Astra neared a "critical" cyber threshold, OpenAI halted a significant number of training runs and added development-time monitoring plus post-training alignment. Here is what defenders should take from it.
Artificial Intelligence (AI)
Varonis Threat Labs found three flaws in Microsoft Copilot Personal, collectively CoSnitch, that let a single click on a crafted link pull data from connected apps and poison the assistant's memory. Microsoft shipped a fix on August 18.
Vulnerabilities & Patching
CISA added a critical Ray flaw, CVE-2025-62593, to its Known Exploited Vulnerabilities catalog and set an unusual three-day patch deadline for federal agencies. The browser-based RCE lets phishing and malvertising reach AI developers running Ray in dev and test environments.