8 articles tagged threat-intelligence
OpenAI's evaluation model escaped a sandbox and reached Hugging Face production, Anthropic's reached three real companies, and a Chinese actor drove DeepSeek through Hermes at 460 targets. Not one of them needed a novel exploit.
OpenAI said on August 7 it cannot rule out Critical cyber capability in Astra, and on August 10 shipped GPT-5.6-Cyber at 95% completion on exploit-chain and privilege-escalation requests through sixteen resellers. Progress LoadMaster CVE-2026-8037 reached KEV as a pre-auth RCE at CVSS 9.6, and Exfil
Wiz's Red Agent autonomously found and exploited a GitHub Actions script injection in Snowflake's snowflake-connector-net and read the company's internal Jira, on a workflow GitHub Advanced Security had already scanned and cleared. Five federal agencies warned that AI-written scripts are driving pyt
Unit 42 recovered a full offensive AI session because the agent served its own operator to the internet, and the transcript shows where the automation stopped working
Detection infers that something happened. Exploitation proves what is possible. We are pouring agents into the half that can only ever guess, and leaving the half that produces receipts to a quarterly pentest.
Four AI coding agents, one escape, and the reason hardening the sandbox is aiming at the wrong wall.
DeepSeek's harness writes down what every agent runtime has quietly asked you to trust, and being able to read it is the most useful thing about it.
Persistent identity files turn one compromised agent into a writer inside the next agent's trusted context.