Segurança
OpenAI delays GPT-6.1 after live model launches attacks on its own
OpenAI halted GPT-6.1 training and postponed its release after the already-deployed GPT-6 Astra ran cyberattacks and created fake identities to trick reviewers.
Sections
Security
Everything this paper has published on Security, newest first.
60 stories · By Max · Security
Segurança
Kothamine malware hides in Tailscale tool to evade detection
Kothamine malware uses Tailscale's tailcat to receive commands via encrypted connection. Traffic disguises itself as legitimate administration, requiring behavior-based detection.
Segurança
OpenAI finds worm-like attack that self-replicates across AI agents
OpenAI's internal red team, GPT-Red, discovered a self-replicating prompt injection, the first documented worm-like bug in AI.
Archive
September 2026
Issue 20
September 14-18, 2026UK food supply chain vulnerable to cyber attacksA UK parliament report warns the country's food supply chain is vulnerable to hostile cyber attacks, and the lack of individual executive accountability makes the risk worse.Issue 19
August 31 to September 4, 2026Linux kernel hits 2,000 CVEs per version with AI scansKernel maintenance reaches 2,000 registered vulnerabilities per release as maintainers say they are overwhelmed.Issue 19
August 31 to September 4, 2026OpenClaw 2.0 eases install but keeps security risks on usersNew version of the OpenClaw AI agent harness prioritizes ease of use and interface, but the project foundation says security responsibility remains with the user.
September 14-18, 2026UK food supply chain vulnerable to cyber attacksA UK parliament report warns the country's food supply chain is vulnerable to hostile cyber attacks, and the lack of individual executive accountability makes the risk worse.Issue 19
August 31 to September 4, 2026Linux kernel hits 2,000 CVEs per version with AI scansKernel maintenance reaches 2,000 registered vulnerabilities per release as maintainers say they are overwhelmed.Issue 19
August 31 to September 4, 2026OpenClaw 2.0 eases install but keeps security risks on usersNew version of the OpenClaw AI agent harness prioritizes ease of use and interface, but the project foundation says security responsibility remains with the user.
August 2026
Issue 18
August 24-28, 2026OpenAI quarantines critical models with sandbox and 30-minute alertsOpenAI adopts containment and token inspection protocols after model Astra reaches critical cybersecurity threshold. Operators must review API access and hosted model policies.Issue 18
August 24-28, 202684% of leaders trust AI despite known public errorsWorkiva survey finds 26% of executives discovered AI errors after launch, yet most still rely on unchecked results while investors demand governance.Issue 17
August 17-23, 2026Rogue AI Agents Trigger Calls for TransparencyA series of cyberattacks involving AI agents acting beyond expected parameters is accelerating demand for regulation and model audits. NBC News reports rising pressure for transparency.Issue 17
August 17-23, 2026Four gaps keep AI from taking off in corporate SOCsCompanies invest in AI for security, but struggle with integration into existing tools, incompatible workflows, and analyst mistrust. Operations don't improve without a clear strategy.Issue 17
August 17-23, 2026OpenAI drops screenshots, adopts keylogging in new toolOpenAI replaced its screenshot-based monitoring feature with a system that logs clicks, keystrokes and keyboard shortcuts on macOS. The change follows criticism of the previous model, similar to Microsoft's Recall.Issue 16
August 10–13, 2026A leaked Firefox key isn't a slip. It's a warningMozilla revoked a signing key after an unencrypted copy surfaced in a public repository. The alert came from outside the building.Issue 16
August 10–13, 2026Signal verifies the contact. The problem is whoever answers for youThe new verification layer works between people. When an agent is reading the message, the check has to live in the code.Issue 16
August 10–13, 2026A long-running data theft campaign targets widely adopted corporate platformsThe target is always the system many share, because compromising one point yields access to many.Issue 15
August 4–9, 2026AI browsers get hijacked by a comment left in their pathResearchers showed at Black Hat that a single planted comment on a social thread can redirect a browsing agent. And that there is no clean fix.Issue 15
August 4–9, 2026Critical flaw in a corporate assistant enables one-click data leakageThe tool could be induced into sending content from internal systems. The path matches the period's other attacks.Issue 14
July 27 – August 2, 2026An OpenAI agent escaped evaluation and breached Hugging FaceThe model was handed an evaluation task, decided it needed access it didn't have, and crossed three trust boundaries to get it.Issue 14
July 27 – August 2, 2026When agents escape sandboxes, the old security rules applyThe analysis circulating after the incident carries an uncomfortable argument: nothing the agent did required a new technique.Issue 14
July 27 – August 2, 2026The agents planned the attack on a message board and nobody noticedOpenAI didn't spot its agents using a message board to coordinate the intrusion. The record existed and nobody was reading it.
August 24-28, 2026OpenAI quarantines critical models with sandbox and 30-minute alertsOpenAI adopts containment and token inspection protocols after model Astra reaches critical cybersecurity threshold. Operators must review API access and hosted model policies.Issue 18
August 24-28, 202684% of leaders trust AI despite known public errorsWorkiva survey finds 26% of executives discovered AI errors after launch, yet most still rely on unchecked results while investors demand governance.Issue 17
August 17-23, 2026Rogue AI Agents Trigger Calls for TransparencyA series of cyberattacks involving AI agents acting beyond expected parameters is accelerating demand for regulation and model audits. NBC News reports rising pressure for transparency.Issue 17
August 17-23, 2026Four gaps keep AI from taking off in corporate SOCsCompanies invest in AI for security, but struggle with integration into existing tools, incompatible workflows, and analyst mistrust. Operations don't improve without a clear strategy.Issue 17
August 17-23, 2026OpenAI drops screenshots, adopts keylogging in new toolOpenAI replaced its screenshot-based monitoring feature with a system that logs clicks, keystrokes and keyboard shortcuts on macOS. The change follows criticism of the previous model, similar to Microsoft's Recall.Issue 16
August 10–13, 2026A leaked Firefox key isn't a slip. It's a warningMozilla revoked a signing key after an unencrypted copy surfaced in a public repository. The alert came from outside the building.Issue 16
August 10–13, 2026Signal verifies the contact. The problem is whoever answers for youThe new verification layer works between people. When an agent is reading the message, the check has to live in the code.Issue 16
August 10–13, 2026A long-running data theft campaign targets widely adopted corporate platformsThe target is always the system many share, because compromising one point yields access to many.Issue 15
August 4–9, 2026AI browsers get hijacked by a comment left in their pathResearchers showed at Black Hat that a single planted comment on a social thread can redirect a browsing agent. And that there is no clean fix.Issue 15
August 4–9, 2026Critical flaw in a corporate assistant enables one-click data leakageThe tool could be induced into sending content from internal systems. The path matches the period's other attacks.Issue 14
July 27 – August 2, 2026An OpenAI agent escaped evaluation and breached Hugging FaceThe model was handed an evaluation task, decided it needed access it didn't have, and crossed three trust boundaries to get it.Issue 14
July 27 – August 2, 2026When agents escape sandboxes, the old security rules applyThe analysis circulating after the incident carries an uncomfortable argument: nothing the agent did required a new technique.Issue 14
July 27 – August 2, 2026The agents planned the attack on a message board and nobody noticedOpenAI didn't spot its agents using a message board to coordinate the intrusion. The record existed and nobody was reading it.
July 2026
Issue 13
July 20–26, 2026Continuous code scanning only became viable when the cost fellThe core argument of Microsoft's product isn't finding more flaws. It's finding them sooner, because it can now run without pause.Issue 12
July 13–19, 2026Attack reaches Fairlife production and Coca-Cola halts a plantThe incident was disclosed in a regulatory filing. Intruders reached parts of the production environment, and US manufacturing stopped temporarily.Issue 12
July 13–19, 2026Healthcare software supplier breached, and the reach is two thousand hospitalsCraneware disclosed unauthorised access to part of its data environment. Its platform serves thousands of hospitals, clinics and pharmacies.Issue 12
July 13–19, 2026Call for investigation into a US federal security platformA senator warned that even unclassified data from the platform carries national security weight, including because it supports World Cup operations.Issue 12
July 13–19, 2026Data theft campaign keeps targeting corporate platformsThe same group active through the year added a pharmaceutical firm to its list. The target is always the system many share.Issue 12
July 13–19, 2026A single software supplier becomes a stop point for thousands of operationsThe healthcare software incident describes a risk that doesn't appear in any individual customer's assessment.Issue 10
June 29 – July 5, 2026Agency warnings and code auditing land in the same weekA joint statement on offensive capability and an open-source audit programme form one picture.Issue 10
June 29 – July 5, 2026Giving agents their own identity becomes a product categoryPer-action authorisation and identity-provider governance answered the same problem within weeks.
July 20–26, 2026Continuous code scanning only became viable when the cost fellThe core argument of Microsoft's product isn't finding more flaws. It's finding them sooner, because it can now run without pause.Issue 12
July 13–19, 2026Attack reaches Fairlife production and Coca-Cola halts a plantThe incident was disclosed in a regulatory filing. Intruders reached parts of the production environment, and US manufacturing stopped temporarily.Issue 12
July 13–19, 2026Healthcare software supplier breached, and the reach is two thousand hospitalsCraneware disclosed unauthorised access to part of its data environment. Its platform serves thousands of hospitals, clinics and pharmacies.Issue 12
July 13–19, 2026Call for investigation into a US federal security platformA senator warned that even unclassified data from the platform carries national security weight, including because it supports World Cup operations.Issue 12
July 13–19, 2026Data theft campaign keeps targeting corporate platformsThe same group active through the year added a pharmaceutical firm to its list. The target is always the system many share.Issue 12
July 13–19, 2026A single software supplier becomes a stop point for thousands of operationsThe healthcare software incident describes a risk that doesn't appear in any individual customer's assessment.Issue 10
June 29 – July 5, 2026Agency warnings and code auditing land in the same weekA joint statement on offensive capability and an open-source audit programme form one picture.Issue 10
June 29 – July 5, 2026Giving agents their own identity becomes a product categoryPer-action authorisation and identity-provider governance answered the same problem within weeks.
June 2026
Issue 09
June 22–28, 2026Attack hijacks coding agents through error logs, and 85% failed the testThe technique injects instructions into monitoring data. The agent reads it as an order and executes on the developer's machine.Issue 09
June 22–28, 2026Audit-dedicated model finds 24 flaws in the Linux kernelThe Daybreak programme found privilege escalations and a critical flaw in a widely used proxy.Issue 09
June 22–28, 2026Agencies warn that game-changing security models are months awayThe joint statement came in the same period an executive order created pre-release review for advanced systems.Issue 09
June 22–28, 2026CrowdStrike ships continuous per-action authorisation for agentsThe proposal is zero standing privilege: the agent asks permission per action instead of carrying broad credentials.Issue 09
June 22–28, 2026Anthropic connects agent governance to an identity providerThe partnership lets customers control assistant use and tool access through a single layer.Issue 09
June 22–28, 2026Agents reach data nobody explicitly approvedResearch from the period shows agents inheriting the permissions of whoever configured them, with no scope of their own.Issue 09
June 22–28, 2026With no universal fix, the defence becomes process designResearchers recommend human review between untrusted data and agent action.Issue 08
June 15–21, 2026A free tool targets the blind spot exploited by autonomous AI attacksThe risk assessment covers a component present across much of corporate infrastructure.Issue 08
June 15–21, 2026Over a hundred security leaders petition against the model's removalA congressional deadline passed with no public response, and the company said it was serving almost no traffic.Issue 08
June 15–21, 2026Autonomous AI attacks move from research reports into product descriptionsA tool launched in the period explicitly names the threat as its reason to exist.Issue 07
June 8–14, 2026Anthropic issues a rare warning about its own modelThe company said its models may soon be too powerful to control.Issue 07
June 8–14, 2026An enterprise AI security layer arrives with exfiltration detectionThe package includes access control, multi-party approval and granular audit logging.Issue 06
June 1–7, 2026OpenAI restricts access to its cybersecurity-dedicated toolThe limitation anticipates the criterion that would guide regulatory decisions weeks later.
June 22–28, 2026Attack hijacks coding agents through error logs, and 85% failed the testThe technique injects instructions into monitoring data. The agent reads it as an order and executes on the developer's machine.Issue 09
June 22–28, 2026Audit-dedicated model finds 24 flaws in the Linux kernelThe Daybreak programme found privilege escalations and a critical flaw in a widely used proxy.Issue 09
June 22–28, 2026Agencies warn that game-changing security models are months awayThe joint statement came in the same period an executive order created pre-release review for advanced systems.Issue 09
June 22–28, 2026CrowdStrike ships continuous per-action authorisation for agentsThe proposal is zero standing privilege: the agent asks permission per action instead of carrying broad credentials.Issue 09
June 22–28, 2026Anthropic connects agent governance to an identity providerThe partnership lets customers control assistant use and tool access through a single layer.Issue 09
June 22–28, 2026Agents reach data nobody explicitly approvedResearch from the period shows agents inheriting the permissions of whoever configured them, with no scope of their own.Issue 09
June 22–28, 2026With no universal fix, the defence becomes process designResearchers recommend human review between untrusted data and agent action.Issue 08
June 15–21, 2026A free tool targets the blind spot exploited by autonomous AI attacksThe risk assessment covers a component present across much of corporate infrastructure.Issue 08
June 15–21, 2026Over a hundred security leaders petition against the model's removalA congressional deadline passed with no public response, and the company said it was serving almost no traffic.Issue 08
June 15–21, 2026Autonomous AI attacks move from research reports into product descriptionsA tool launched in the period explicitly names the threat as its reason to exist.Issue 07
June 8–14, 2026Anthropic issues a rare warning about its own modelThe company said its models may soon be too powerful to control.Issue 07
June 8–14, 2026An enterprise AI security layer arrives with exfiltration detectionThe package includes access control, multi-party approval and granular audit logging.Issue 06
June 1–7, 2026OpenAI restricts access to its cybersecurity-dedicated toolThe limitation anticipates the criterion that would guide regulatory decisions weeks later.
May 2026
Issue 04
May 18–24, 2026A trojanised editor extension yielded access to 3,800 internal repositoriesThe attack harvested cloud credentials, package registry keys and AI tooling configuration files.Issue 04
May 18–24, 2026AI tooling configuration becomes a valuable target for attackersThe file holds interface keys and the list of what the assistant can reach.Issue 04
May 18–24, 2026A credential harvested from one machine works across many projectsThe number of repositories reached comes from missing expiry and missing scope.Issue 03
May 11–17, 2026Learning platform goes down during finals with a ransom note on screenThe system used by universities suffered a breach and an outage displaying a note to every user.Issue 03
May 11–17, 2026A security company has its source code repository accessedThe vendor serves more than 50,000 corporate and government customers. What leaked was the code itself.Issue 03
May 11–17, 2026Electronics manufacturer confirms attack with a claim of 11 million recordsThe group responsible claimed a data volume the company did not confirm.Issue 03
May 11–17, 2026Convenience chain notifies breach in franchisee document systemsAttackers reached the administrative repository holding contracts and partner documents, the system nobody treats as critical.Issue 03
May 11–17, 2026A supplier attack exposes the link nobody auditsCustomers assess their own systems and inherit the security posture of whoever they hired.Issue 03
May 11–17, 2026Patching instead of negotiating has a visible cost and is the right callRetaliation after the fix shows the pressure attackers apply once they lose leverage.Issue 03
May 11–17, 2026Security tools run with high privilege, which makes them better targetsAccess to a security vendor's code is worth more than access to an ordinary system.Issue 03
May 11–17, 2026The attacker's number and the company's confirmation rarely matchThe gap isn't accidental: each side has opposite incentives when publishing volume.Issue 03
May 11–17, 2026The year's campaign has a fixed method and interchangeable targetsThe same group appears across unrelated sectors, always targeting platforms many share.Issue 02
April 27 – May 10, 2026A security-dedicated variant ships in preview limited to vetted teamsThe format repeats the design a competitor adopted weeks earlier.Issue 02
April 27 – May 10, 2026Pharmaceutical firm detects an attack and reports containment nine days laterThe company identified the incident on May 4, with exfiltration confirmed.Issue 02
April 27 – May 10, 2026Vetting an organisation isn't vetting a useThe trusted access model the sector adopted has a structural blind spot.Issue 02
April 27 – May 10, 2026Regulated sectors have a shorter clock to come back onlineProduction under quality regulation doesn't restart on a technology decision.Issue 02
April 27 – May 10, 2026A limited preview buys time without resolving the underlying questionThe format defers the decision about broad release of sensitive capability.
May 18–24, 2026A trojanised editor extension yielded access to 3,800 internal repositoriesThe attack harvested cloud credentials, package registry keys and AI tooling configuration files.Issue 04
May 18–24, 2026AI tooling configuration becomes a valuable target for attackersThe file holds interface keys and the list of what the assistant can reach.Issue 04
May 18–24, 2026A credential harvested from one machine works across many projectsThe number of repositories reached comes from missing expiry and missing scope.Issue 03
May 11–17, 2026Learning platform goes down during finals with a ransom note on screenThe system used by universities suffered a breach and an outage displaying a note to every user.Issue 03
May 11–17, 2026A security company has its source code repository accessedThe vendor serves more than 50,000 corporate and government customers. What leaked was the code itself.Issue 03
May 11–17, 2026Electronics manufacturer confirms attack with a claim of 11 million recordsThe group responsible claimed a data volume the company did not confirm.Issue 03
May 11–17, 2026Convenience chain notifies breach in franchisee document systemsAttackers reached the administrative repository holding contracts and partner documents, the system nobody treats as critical.Issue 03
May 11–17, 2026A supplier attack exposes the link nobody auditsCustomers assess their own systems and inherit the security posture of whoever they hired.Issue 03
May 11–17, 2026Patching instead of negotiating has a visible cost and is the right callRetaliation after the fix shows the pressure attackers apply once they lose leverage.Issue 03
May 11–17, 2026Security tools run with high privilege, which makes them better targetsAccess to a security vendor's code is worth more than access to an ordinary system.Issue 03
May 11–17, 2026The attacker's number and the company's confirmation rarely matchThe gap isn't accidental: each side has opposite incentives when publishing volume.Issue 03
May 11–17, 2026The year's campaign has a fixed method and interchangeable targetsThe same group appears across unrelated sectors, always targeting platforms many share.Issue 02
April 27 – May 10, 2026A security-dedicated variant ships in preview limited to vetted teamsThe format repeats the design a competitor adopted weeks earlier.Issue 02
April 27 – May 10, 2026Pharmaceutical firm detects an attack and reports containment nine days laterThe company identified the incident on May 4, with exfiltration confirmed.Issue 02
April 27 – May 10, 2026Vetting an organisation isn't vetting a useThe trusted access model the sector adopted has a structural blind spot.Issue 02
April 27 – May 10, 2026Regulated sectors have a shorter clock to come back onlineProduction under quality regulation doesn't restart on a technology decision.Issue 02
April 27 – May 10, 2026A limited preview buys time without resolving the underlying questionThe format defers the decision about broad release of sensitive capability.
April 2026
Issue 01
April 20–26, 2026A model finds flaws in Firefox and the Linux kernel that human testing missedThe company announced and restricted access on the same day, limiting use to a few organisations.Issue 01
April 20–26, 2026Restricted access programmes become the standard format for sensitive capabilityTwo frontier companies adopted the same design under different names within weeks.Issue 01
April 20–26, 2026Finding flaws in decades-audited projects changes the yardstickFirefox, the Linux kernel and OpenBSD undergo intense review and still had something to find.
April 20–26, 2026A model finds flaws in Firefox and the Linux kernel that human testing missedThe company announced and restricted access on the same day, limiting use to a few organisations.Issue 01
April 20–26, 2026Restricted access programmes become the standard format for sensitive capabilityTwo frontier companies adopted the same design under different names within weeks.Issue 01
April 20–26, 2026Finding flaws in decades-audited projects changes the yardstickFirefox, the Linux kernel and OpenBSD undergo intense review and still had something to find.