Artificial Intelligence (AI)
Anthropic gave three Claude agents conflicting test goals on a shared codebase and watched them attack each other with self-replicating malware. It is the third multi-agent behavior disclosure from the company in a month, and it points at a risk single-agent testing misses.
Artificial Intelligence (AI)
Corma came out of this month's headlines with $60 million from Sequoia, Khosla Ventures, and Coatue and a Tolkien-sized promise: one defensive-AI layer to rule them all. The funding is real. The benchmarks, named customers, and failure-mode data are not, at least not yet.
Artificial Intelligence (AI)
Anthropic's Frontier Red Team set three Claude agents loose on the same project with conflicting instructions, and watched them wage a turf war, collude on prices, and invent their own truces. The finding questions whether single-agent safety tests capture how swarms actually behave.
Vulnerabilities
A landmark week for offensive-cyber policy in the US and Germany, an autonomous AI agent confirmed at Taiwan's nuclear safety regulator, Microsoft's 421-CVE Patch Tuesday and its exploitation wave, plus a run of breaches, supply-chain hits, and botnet upgrades.
Artificial Intelligence (AI)
A follow-on to Dream's Taiwan disclosure: The Register reports the government target hit by the near-autonomous agentic swarm was the country's nuclear safety agency, the highest-stakes autonomous-agent target on record, even though the attack's success stays unconfirmed.
Vulnerabilities
A newly disclosed flaw let researchers replay encrypted reasoning objects across OpenAI, Anthropic, and Google reasoning APIs, using a weaker model to decode a stronger one's hidden reasoning and pull API keys and passwords out of public session logs.
Artificial Intelligence (AI)
Israeli cyber firm Dream says it documented the first publicly known near-autonomous AI attack on a government target. Aimed at Taiwan, the multi-agent framework adapted mid-operation, corrected its own mistakes, and expanded to a nuclear safety agency and energy firms as it went.
Artificial Intelligence (AI)
OpenAI launched GPT-5.6-Cyber, a cyber model tuned to refuse less, and gated it behind a two-tier Daybreak Blue and Red access program — one day after pausing Astra over the same capability class. What it means for defenders.
Vulnerabilities
Zoom has patched ZOOMSDAY, a zero-click flaw in its annotation tool that let any meeting participant run code on another attendee's device — presenter to viewer and back. Researchers built a working exploit with a public AI tool in fewer than 20 prompts.
Vulnerabilities
Rapid7 Labs disclosed a two-CVE SharePoint chain reaching unauthenticated remote code execution as any user, including administrator. A JWT authentication bypass feeds an RCE flaw, both fixed in the August 11 Patch Tuesday. Notably, an AI agent helped find the chain.
Data Privacy
A Kansas City security researcher says his algorithm now produces adversarial patterns on demand that hide people, faces, and vehicles from surveillance cameras. He tested them against 11 open-source detection systems and demonstrated one on a car at Def Con.
Artificial Intelligence (AI)
Two security firms, Varonis and PromptArmor, independently found a one-click flaw in Atlassian's Rovo AI, nicknamed RovoBlast, that could pull Confluence, Jira, and SharePoint data a signed-in user can access and send it to an outside server. Only one route is confirmed closed.