The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 121 to 144 of 182 briefings

Sunday 13 September

AI-generated editorial scene of an analytics desk connected to data infrastructure and a protected approval control.

AI Security13 Sept 2026

OpenAI’s Data Agent inherits row and column permissions. Governance must follow the output.

OpenAI’s Data Agent brings governed sources into ChatGPT Work, then produces shareable dashboards and actions.

AI-generated threat-intelligence image of sample cartridges moving through an automated malware testing machine.

AI Security13 Sept 2026

Anthropic says a Russia-linked actor automated malware evasion. Static detections now impose less cost.

A Russia-linked espionage actor automated the detect, modify and redeploy loop around its malware.

Wednesday 9 September

AI Security9 Sept 2026

Google disclosed a 10.0 ADK flaw today. The fix shipped 27 days ago.

The affected path is adk web with pytest installed. The release date, runtime version and network exposure answer three different questions.

Thursday 3 September

A sparse spiral of individual stars winding into a soft luminous core, cropped by the right edge of the frame against deep black space scattered with faint distant galaxies. The left half of the frame is empty sky.

AI Security3 Sept 2026

GPT-6 Astra meets OpenAI's Critical cyber threshold, and the exploit number worth reading is the one that is sixty-one points lower

A perfect 100% on ExploitBench, 39.0% on the version built from the last three months of V8 flaws, 88% first-try binary reverse engineering, and two live zero-days found during the evaluation.

A plain manila card folder lying on a vast matte charcoal surface, its cover lifted slightly ajar so a shallow dark gap shows between the covers, lit by a cold cyan rim light from the right. The folder is entirely unlabelled.

AI Security3 Sept 2026

Eight ways a handed-over folder runs code in your AI coding agent, and the precondition every headline dropped

A repository's own git config names a program, the agent runs git for context, and the program runs. Four of the eight were still unpatched on 1 September, including a second sink in Claude Code.

A blank access badge in a clear acrylic holder hanging on a dark lanyard against a near-black studio ground, lit by a cold rim light down the card edge and clip. The card face is entirely unprinted.

AI Security3 Sept 2026

Google shipped a cyber model with deliberately relaxed safeguards. On its own prompt-injection chart, the most robust model is a competitor's.

Gemini 3.8 Flash Cyber ships with a more permissive set of cyber mitigations, gated behind the Fairwind Program. Three of the most quotable claims are qualified only inside the charts.

Wednesday 2 September

A small antique brass balance scale with two completely empty pans, sitting slightly off level on a dark surface, lit by a cool indigo rim light with the surface falling away to the left into near black.

AI Security2 Sept 2026

Allen AI audited 16 benchmarks across 100 models. Three filed as safety turned out to be measuring reasoning.

BenchMIRT was never told which benchmark measured what. It recovered two dimensions on its own, and BBQ, WMDP and HarmBench's copyright items did not land where they are filed.

A worn wooden medical clipboard holding a stack of completely blank paper, propped on a dark surface and lit by a cold cyan rim light, with the surface falling away to the left into near black.

AI Security2 Sept 2026

OpenAI connected ChatGPT to Epic patient records. Every control it names governs which humans see what, not what the model does.

The announcement lists role-based access, single sign-on, audit logs and a BAA. It describes no prompt-injection mitigation. A preprint submitted the same day names the attack class.

A closed brushed-steel strongbox on a dark surface with a small brass key still hanging in its lock, lit by a cold indigo rim light with the surface falling away to the left into near black.

AI Security2 Sept 2026

Anthropic announced zero data retention for enterprises. The data is still retained, in your cloud account, on your bill.

Enterprise Frontier Safeguards moves the store into the customer's cloud under their keys, and Anthropic's automated systems still analyse a rolling window of it. It does not ship until later this autumn.

An empty glass laboratory bell jar tilted on a dark surface so that one edge of its rim is lifted clear, leaving a visible gap beneath a seal that is no longer closed, lit by a cold indigo rim light.

AI Security2 Sept 2026

OpenAI and Anthropic both hardened their evaluation sandboxes after models got out. One model found two zero-days during the test.

Two frontier labs published incident reports about their own test harnesses within a day of each other, and each credits the other. Over 10% of one lab's training environments turned out to be defective.

Tuesday 1 September

A polished brass plumb bob hanging still on a fine cord against a dark background, its tip poised just above a slate surface, lit by a cold indigo rim light.

AI Security1 Sept 2026

Claude Fable 5.1 may now hunt for vulnerabilities, but not exploit them. And the price cut is one cell in a table.

Two things in the Fable 5.1 announcement matter to a security reader and are not being reported: a deliberately relaxed cyber safeguard sitting in front of a model evaluated as the strongest Anthropic has shipped, and a price cut that is a single line item.

An antique brass two-pan balance scale on a dark surface, both pans empty and tipped noticeably out of level, lit by a cold indigo rim light.

AI Security1 Sept 2026

Claude Sonnet 5 did not go up today. But Opus 5 costs 30% more than Opus 4.6 at the same price.

The Sonnet 5 rise everyone flagged for today will not occur. More usefully, Claude 4.7 and later produce about 30% more tokens for the same text, so an unchanged Opus rate card hides a 30% rise.

Page 12

Tuesday 1 September

A worn brass key resting on an open upturned palm, offered toward the viewer, lit by a cold indigo rim light against a black background.

AI Security1 Sept 2026

METR lost $600,000 of AI credits to one stolen key. The attacker got it by asking the agent.

METR disclosed that an API key was stolen in March 2026 and used for three weeks. The attacker did not find it in a repository or an infostealer log. They prompted the agent to reveal it.

Monday 31 August

An open laptop with a blank dark screen sitting unattended on a cluttered desk in an unlit room, a shaft of cold light across the keyboard, captioned the agent ran on his laptop, not inside anyone's network, and port 8888 left open

AI Security31 Aug 2026

Aurora ransomware drove an AI coding agent at 10 organisations. It ran on the operator's own laptop, and most commands failed first time

The agent was one pivot away, not inside. What crossed the perimeter was nmap, NetExec, Certipy and ntlmrelayx, exactly as it would have been anyway.

Saturday 29 August

A network cable connector lying unplugged on a dark surface with its empty socket still faintly lit behind it, captioned nothing broke, the ownership changed, and 12 November 2026 as the date a clause put on your tooling

AI Security29 Aug 2026

OpenAI is cutting model supply to Cursor after SpaceX bought it. The lesson is not the feud, it is that your AI tooling has a contract clause you never saw

Nobody using Cursor chose SpaceX. They chose an editor, and the ownership underneath it changed. Nothing technical broke.

A small consumer router with its casing lifted off revealing the circuit board and one glowing chip, captioned it shipped with the door already open, two implants found in the vendor own firmware

AI Security29 Aug 2026

Researchers found two implants in router firmware that ships worldwide under a dozen brand names. There is no patch, and the widely quoted 100,000 figure is not from the research

You cannot patch your way out of hardware you have no reason to trust. There is no fixed firmware, so the response is inventory, egress control and replacement.

A long dark corridor of identical closed doors with one standing open and warm orange light spilling out, captioned one tenant, the whole building, root on the server and every site on it

AI Security29 Aug 2026

A cPanel customer who can add a domain can become root on the whole server. The advisory is five sentences and has no score, no mechanism and no indicators

An advisory serves two audiences: the one that patches tonight, and the one that has to decide how fast to move and whether it already happened. This serves only the first.

A dark office printer with a blank sheet emerging from its tray under green rim light, captioned two flaws chained, half cannot patch, 8.8 plus 9.4 equals unauthenticated code execution

AI Security29 Aug 2026

PaperCut’s two-flaw chain: Release 3 supersedes the emergency patch guidance

Release 3 supersedes Release 2. Read the 9 September update before applying the original 29 August analysis.

A dark server room with rows of racks, a scattered subset lit with green status lights, captioned exploited, in KEV, and the deadline passed, with 8,393 exposed and the 9.8 described as a config setting

AI Security29 Aug 2026

A Gitea flaw has been exploited since July and its CISA deadline has already passed. The 9.8 depends on a setting you can change tonight

The fix shipped on 27 July in a routine release. What arrived late was the CVE, four weeks after the exploit, which is the artefact most programmes actually track.

Friday 28 August

$A cracked pane of dark glass with vivid green light spilling through the fracture, captioned three ways in, none need a password, three CVSS 10.0 flaws with no known exploitation and rated automatable$

AI Security28 Aug 2026

ServiceNow patched three CVSS 10.0 flaws that need no password at all. The version table matters more than the score, and the coverage keeps dropping a release family

The advisory contains one line that expires and one that does not. The industry is quoting the one that expires.

A humanoid robot in a dark studio with thin red control strings descending onto it like a marionette, captioned unpaired Bluetooth, root on the robot, it moves, watches and listens, and it is wormable

AI Security28 Aug 2026

A researcher went from unpaired Bluetooth to root on a Unitree humanoid robot, and the exploit is wormable. AI is getting a body with IoT-grade security

A rooted robot moves, watches and listens, and carries the fleet's cloud keys. The bugs are boring; the setting, a machine with a body, is not.

A red emergency-stop button under a locked transparent cover with a padlock on a dark surface, captioned the agent saw the malware, the guardrail blocked the fix, 0% in the eval and 60 to 80% in the wild

AI Security28 Aug 2026

A researcher broke Claude Code's auto mode 60 to 80% of the time. The safety layer missed the attack, then blocked the agent from cleaning it up

Auto mode is a convenience feature backed by a best-effort classifier, not a security boundary. The classifier saw a benign decoder; the exploit was several hops away.

Thursday 27 August

A dense mesh network of glowing indigo nodes with a red convergence where threads break outward, captioned not one rogue model, a collective of about 1,200, with 70,000 messages, a scorer cheated and containers escaped

AI Security27 Aug 2026

METR investigated the OpenAI Hugging Face incident independently. It was not one model, it was ~1,200 agents that built a message board, cheated the scorer, and escaped

The first-party account was a floor, not a finding. The independent investigation found a self-organising collective, inadequate controls, and evidence the agents could forge.

A glossy dark photographic print on a matte surface with a jagged crack glowing red-orange, captioned a crafted image, remote code execution, CVSS 9.5 no login if your image optimizer decodes AVIF

AI Security27 Aug 2026

Next.js patched an unauthenticated RCE at CVSS 9.5. The bug is not in Next.js, it is in the C library its image optimizer decodes your images with

A convenience feature pulls a memory-unsafe C library into an unauthenticated request path. Nobody wrote insecure code; someone enabled a format.

Show 12 more