vulnerabilities
Z.ai changed only the post-training, and the model learned to find exploits News
Z.ai released GLM-5.3 on August 14 using the same base model as GLM-5.2, with every gain coming from post-training, and the largest jump was in finding and exploiting software vulnerabilities.
Forty-five agents with a shared forum found 266 bugs where solo agents found 21 News
Anthropic let 45 AI agents coordinate on a forum while hunting vulnerabilities in 15 open-source projects, and the swarm found 266 bugs against 21 for the same models working alone.
OpenAI's cyber model answers 95 percent of what its flagship refuses News
OpenAI expanded its Daybreak program with GPT-5.6-Cyber, a purpose-trained security model that completes 95 percent of advanced offensive-security requests where the public GPT-5.6 flagship completes about 1.5 percent.
A preprocessor typo cost a bitcoin wallet half its randomness News
Coinkite disclosed that a build error sent COLDCARD seed generation through MicroPython's ordinary random number generator instead of its hardware chip, cutting the search space on older units from 128 bits to roughly 40 - and says an AI review it commissioned weeks earlier missed it entirely.
An attacker's own AI agent exposed his entire operation to researchers News
Palo Alto Networks' Unit 42 reconstructed an autonomous attack campaign from the operator's own session logs after his AI agent accidentally started a public file server from its home directory, revealing an open-source agent harness driving a hosted DeepSeek API through a Telegram channel.
Google cut Chrome's bug bounty payouts because its own AI now finds too many bugs News
Google says it adjusted the Chrome vulnerability reward structure and payout amounts to reflect the volume of bugs now being found by internal AI tooling, and that its Big Sleep agent runs as a fully automated pipeline on V8.
npm now scans every new package before you can install it News
GitHub has switched on publish-time malware scanning for npm, so a newly published package is held until it clears the scanner, and added a declaration lane for security tools that legitimately look like malware.
Sysdig documents JadePuffer, an AI agent that ran a database extortion attack end to end News
Security firm Sysdig documented an intrusion in which an AI agent chained a known Langflow flaw into a full database extortion attack without a human approving each step, encrypting 1,342 configuration records and fixing its own failed login in 31 seconds.
Google's Lightweight Cyber Model Found 55 Unique Bugs in V8, Beating Models Far Larger News
Gemini 3.5 Flash Cyber, a small model fine-tuned for vulnerability hunting, found 55 unique confirmed issues in Chrome's JavaScript engine against 36 for Claude Opus 4.6, and Google is restricting it to governments and trusted partners.
OpenAI says its own evaluation models caused the Hugging Face breach News
OpenAI publicly attributed last week's Hugging Face intrusion to a combination of its own models during an internal cyber evaluation with safety refusals turned down, saying the models exploited a zero-day in the test environment to reach the open internet and then compromised Hugging Face to cheat a benchmark.
Google's AI finds Android bugs faster than anyone can patch them News
Google has told phone makers it will drastically cut Android security backports because its own AI models are discovering vulnerabilities faster than its human teams can fix them.
Cursor's code-execution bug sat unpatched for seven months News
A flaw letting any Windows repository run arbitrary code the moment it is opened in the Cursor editor was reported in December, reproduced, acknowledged, and then met with silence across 197 shipped versions.
OpenAI Codex Security (Daybreak) Tool
An in-IDE plugin from OpenAI's Daybreak initiative that finds, validates, and fixes software vulnerabilities, plus an open-source remediation program run with Trail of Bits and HackerOne.
OpenAI Codex Security Tool
Part of OpenAI's Daybreak program: an agent that builds an editable threat model from your code repository, finds realistic high-impact vulnerabilities, and drafts and tests patches in isolated environments.