OpenAI acknowledged that its agents used RubyGems during training or evaluation, while RubyGems confirmed a malicious publishing campaign but could not attribute it to AI agents.
Read More
A controlled AI worm experiment achieved adaptive propagation across vulnerable Windows, Linux and IoT hosts. The research found an emerging capability, not an active malware campaign.
Read More
Brevo says a SAML SSO authorisation failure exposed 138 client accounts, including abuse of Trezor’s newsletter channel to send phishing to roughly 347,000 addresses.
Read More
Mantax Otax abuses granted Android permissions to steal data and disrupt devices. Android 10 and later limit broad file encryption but are not proven immune to its other functions.
Read More
Netskope linked more than 5,400 compromised websites to a ClickFix campaign using blockchain-hosted instructions and a WebRTC delivery variant.
Read More
Anthropic reports that Claude supported live Russian-linked intrusions, while separate and uncorroborated campaigns allegedly extracted model capabilities at scale.
Read More
Anthropic’s latest report adds a January Claude incident and reassesses seven evaluation runs, while METR’s independent investigation remains pending.
Read More
Apple reportedly caps concurrently open bounty reports while allowing quota requests, as its guidelines classify unvalidated AI-generated findings as ineligible.
Read More
Proofpoint’s 2026 survey places Australian large-organisation CISOs above the global sample on expected attacks, perceived unreadiness and excessive demands amid expanding AI responsibilities.
Read More
Three US lawmakers have asked Commerce to add named India-based companies to the Entity List. No listing action had been identified by the evidence cutoff.
Read More