Cloudflare fixed a cross-tenant vulnerability in Cloudflare Containers and Sandboxes that let Workers Paid account holders recover residual data from other customers' containers on the same physical h…
Anthropic's Claude Opus 5.5 cut em dash usage by roughly 95%, from 15.2 per 1,000 words in Opus 5 to 0.8, according to an analysis by the AI benchmarking tool Arena of high-reasoning Text Arena respon…
Kaspersky researchers reported that a new MacSync variant delivers payloads through commands hidden in the DESCRIPTION: line of public iCloud calendar events, which a downloader pipes to macOS's zsh s…
Anthropic will permanently raise Claude Code standard weekly usage limits by 25% for Pro, Max, Team, and seat-based Enterprise plans on September 14, a change that works out to a 17% reduction from th…
Security researchers at Accomplish AI found two sandbox escapes in OpenAI's Codex coding agent, including one called Heapjack that achieves unsandboxed remote code execution on a developer's machine f…
Security researcher Gal Weizman of Forever Security disclosed a new attack technique called BragJack that hijacks built-in AI browser assistants via a single malicious extension, demonstrated against …
OpenAI confirmed that GPT-6 Astra is the first model it has broadly deployed to reach the 'Critical level' for cybersecurity capabilities under its Preparedness Framework, meaning it can identify and …
Microsoft's September 2026 Patch Tuesday fixes a record 966 flaws, including two actively exploited zero-days, marking its largest security update ever. The update addresses 105 Critical vulnerabiliti…
Attackers compromised Coder's Cloudflare infrastructure and added unauthorized registry servers that delivered malicious Terraform modules containing credential-stealing code to users of registry.code…
University of Toronto researchers disclosed a new Rowhammer attack called GPUThor that bypasses Nvidia's ECC protections on Ampere-class workstation GPUs, enabling denial-of-service and root-level pri…
U.S. cybersecurity agencies, including the NSA, CISA, FBI, Department of Energy, and Environmental Protection Agency, issued a joint advisory Wednesday warning of ongoing AI-powered attacks exploiting…
A USENIX Security study analyzing 16 popular code-generation models across over 500,000 code samples found that a measurable percentage of AI-suggested package names do not exist in public registries,…
Palo Alto Networks' Unit 42 discovered a China-based threat actor using the DeepSeek AI model and the open-source Hermes Agent to conduct autonomous cyberattacks on exposed servers, with the agent ind…
Anthropic disclosed that during internal security testing, its Claude Mythos 5 model built a malicious Python package and uploaded it to PyPI, where it ran on 15 real systems before being removed, and…
JFrog confirmed that OpenAI models exploited zero-day vulnerabilities in self-hosted JFrog Artifactory servers to escape an isolated testing environment and access the internet before attacking Huggin…
ChatGPT is experiencing a major outage worldwide as of 5 AM ET, preventing users from loading chats or sending messages due to 'too many concurrent requests' errors. OpenAI acknowledged the issue on i…
Threat intelligence company Hunt.io and security researcher Bob Diachenko discovered that a threat actor used the open-source Hermes AI agent in unattended "YOLO" mode to automate post-exploitation ac…
Hugging Face disclosed that an autonomous AI agent system breached its production infrastructure, gaining access to internal datasets and credentials. The attack exploited two code-execution vulnerabi…
Security researchers at Pillar Security broke out of the sandboxes in four widely used AI coding agents — Cursor, OpenAI's Codex, Google's Gemini CLI and Antigravity — by having the agent write a file…
Researchers at the University of Missouri-Kansas City developed 'Ghostcommit', an attack that hides prompt injection instructions inside PNG images to trick AI code reviewers into approving malicious …