The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 13 to 24 of 182 briefings

Saturday 24 October

AI Security24 Oct 2026

UK AI Biosecurity Lab briefing withdrawn: most of its mandate and figures are not in the government's releases

Why this UK AI Biosecurity Lab briefing was withdrawn and what the Cabinet Office and Treasury releases actually say.

Friday 23 October

AI Security23 Oct 2026

Russian ransomware syndicates weaponise Phantom autonomous AI framework against 7,100 edge systems

Threat actors operating with INC Ransomware and The Gentlemen weaponised the Phantom autonomous AI framework and 32 MCP servers to compromise 7,158 edge devices.

AI Security23 Oct 2026

Flaws in x402 AI agent payment code could let rogue APIs drain an agent's full token balance

What V12 reported in the x402 payment code: 25 vulnerabilities, three critical, a default client with no spending limit, a Solana verifier that accepted an approval as a payment, a login signature requested for another website, and fixes shipped on 18 August 2026 without an advisory.

Thursday 22 October

AI Security22 Oct 2026

Symantec Skynet Mode briefing withdrawn: its telemetry, costs and code are not in Symantec's report

Why this Symantec briefing was withdrawn and what Symantec's 21 October report on an autonomous LLMjacking agent says.

AI Security22 Oct 2026

Claude Duet briefing withdrawn: it described a different product from the one Anthropic announced

Why this Claude Duet briefing was withdrawn, and what Anthropic says Claude Duet is.

Wednesday 21 October

AI Security21 Oct 2026

NVIDIA confidential computing briefing withdrawn: its headline overhead figure and library have no vendor source

Why this NVIDIA confidential computing briefing was withdrawn, and what NVIDIA and Google Cloud actually announced on 21 October.

AI Security21 Oct 2026

Cohere Rerank 5 briefing withdrawn: the security boundary it described is not in Cohere's announcement

Why this Cohere Rerank 5 briefing was withdrawn, and what Cohere's own pages say about the 21 October release.

AI Security21 Oct 2026

OpenAI details Patch the Planet and a five-stage response framework after the PHP2Shell flaws

What OpenAI says about its Patch the Planet programme, built with Trail of Bits, and about its role in the PHP2Shell response; its proposed five-stage framework; what the post does not say; and how the PHP Foundation and Cloudflare describe the leak.

AI Security21 Oct 2026

Voxtral 3 scores 2.1% on recorded speech. The voice agent is a separate test

Voxtral Small Transcribe 3 records 2.1% error in Artificial Analysis testing. We check the six Mistral prices, live-session limits and a conflict in TTS language documentation.

AI Security21 Oct 2026

Oracle patches eight Trusted Answer Search flaws; two score 9.9 but require low privileges

The eight Oracle Trusted Answer Search fixes, who can reach each flaw, why the two 9.9 scores do not mean unauthenticated access, and what version 26.1 operators should verify before patching.

Tuesday 20 October

AI Security20 Oct 2026

Microsoft wants each AI agent to have its own identity and narrower authority. The delivery status matters

Microsoft describes distinct agent identities, scoped permissions and risk-driven containment. Availability and enforcement need tenant-level checks.

AI Security20 Oct 2026

OpenCode's MCP login crossed into PowerShell: why the HTTPS check was not the fix

OpenCode patched a Windows and WSL MCP OAuth command-injection path. The HTTPS guard alone did not stop the demonstrated payload; the browser-opener update did.