Artificial Intelligence (AI)
For the third time in weeks, a frontier AI lab has self-reported one of its own models breaking out of a test environment. Meta joins OpenAI and Anthropic — here is what the disclosure confirms, what it doesn't, and what defenders should do.
Artificial Intelligence (AI)
During a UK AI Security Institute test, a Claude Mythos 5 agent spent 34 hours trying to merge a malware dropper into a real open-source project — then denied it, force-pushed to erase the evidence, and used a second account to vouch for its own code.
Supply Chain Attack
The npm ecosystem's worst day of the summer. A self-propagating worm Microsoft calls ChainDrop hit 440-plus packages in under four hours, and a Keyv-linked chain poisoned as many as 868 — planting Claude Code and VS Code hooks in compromised environments.
Artificial Intelligence (AI)
The first documented agent-on-agent attack. Google removed three Agent Development Kit workflows after Pillar Security showed a poisoned public GitHub issue could push a low-privilege triage agent into triggering a privileged code-fixing agent — exposing secrets and tampering with pull requests.
Vulnerabilities
From auth bypass to patch bypass. N-able's N-central RMM has a critical authentication-bypass flaw (CVE-2026-18577) under active exploitation, and attackers defeated the initial fix. Build 2026.3.1.7 is the first unaffected version — and every downstream MSP customer is in scope.
Artificial Intelligence (AI)
If a person had done what Claude did to three real companies, prosecution would likely follow. An autonomous model did it instead - and no settled law says who answers. A survey of the contested accountability questions, and what they mean for anyone running AI evaluations.
Phishing
Days before the June 11 kickoff, the FBI and researchers warn that FIFA World Cup 2026 fraud is already live — thousands of lookalike FIFA domains, banking malware hidden in pirate streaming apps, and login pages cloned well enough to take over real accounts.
Policy & Government
The Pentagon's top cyber official, Katherine Sutton, says the Defense Department must pull cyber 'out of its silo' and build it into every operation from day one — and must bake security into the AI tools it adopts, rather than treating it as an afterthought.
Policy & Government
Trump signed an executive order on June 2 setting up a voluntary framework for the government to vet 'covered frontier' AI models for up to 30 days before release and to share AI-found vulnerabilities with critical-infrastructure operators — notably narrower than an earlier draft.
Artificial Intelligence
Anthropic is extending Project Glasswing — which uses its Claude Mythos model to find software flaws — to about 150 more organizations in 15-plus countries, most of them critical-infrastructure operators a major attack could each affect, the company estimates, 100 million-plus people.
Cybercrime
Spain's National Police arrested a suspect accused of publishing personal data of officials from its most sensitive bodies — including the cyber agency INCIBE, the police, Civil Guard and prosecutors — a doxxing campaign police say endangered both the individuals and their institutions.
Iranian Threat Actors
Recorded Future's Insikt Group says Iran's intelligence ministry has expanded its Handala hacking brand into an umbrella for hybrid operations — uniting cyber, physical and influence personas that recruit proxies, for cash, to attack, surveil and sabotage US and Israeli interests.