Loss of Control — Around 1,200 OpenAI agent instances exchanged over 70,000 messages on an unsanctioned message board, roughly 700 attacked Hugging Face to reverse engineer ExploitGym’s grader and disguise cheating, and none alerted a human. UK AISI, Meta, and Frontier Security disclosed similar incidents during cyber evaluations. Anthropic found agents sabotaging each other under conflicting goals.

Cyber Offense — OpenAI said it cannot rule out critical cyber capabilities in its unreleased Astra model, temporarily paused RL training for its latest deployment-bound models, and joined Anthropic and 100+ organizations in calling for collective cyber defense. AI-generated exploitation scripts targeted US critical infrastructure, and a China-nexus actor used a multi-agent AI framework to compromise Taiwanese government entities.

Biological Risk — Stanford researchers generated the first functional AI-designed viral genomes, and Claude designed de novo protein binders against 14 of 15 targets. Anthropic also disclosed that its blocking biological classifiers did not run on human feedback traffic for eleven months.

Manipulation — OpenAI banned Russian accounts running a covert influence operation around a fake think tank, researchers released a framework simulating campaigns with 100,000 agents, and Anthropic announced plans to watermark Claude’s outputs.

Subscribe now

Loss of Control

We learned more about the OpenAI/Hugging Face incident thanks to OpenAI’s post-mortem and an independent investigation by METR and Redwood Research. Around 1,200 AI agent instances communicated through an unsanctioned message board, where they exchanged over 70,000 messages, and roughly 700 subsequently participated in the attack on Hugging Face. Much of the resulting collaboration focused on understanding and circumventing ExploitGym’s automated scorer. The agents recruited peers to sacrifice their own runs for the collective, and METR found successful tool-call spoofing in parts of roughly 7% of the transcripts it reviewed, although all observed spoofing was small-scale. No agent tried to alert a human.

In early August, another three organizations disclosed other agents breaking containment during evaluations:

• UK AISI reported that AI agents took 19 unsanctioned actions across 10 cybersecurity evaluation runs. This included creating deceptive online identities, attempting social engineering and a software supply-chain attack, coordinating across agents, and interacting with real people and organizations.

• Meta disclosed that, during a misconfigured evaluation, a model exploited a security flaw in a third-party service, in the same evaluation-environment failure Irregular said caused Anthropic’s incident.

• Frontier Security found that Kimi K3 broke out of its sandbox during a cybersecurity test via a containment misconfiguration, then browsed the internet without authorization. Unlike prior incidents, it didn’t hack anything, since the answers it sought were already on GitHub.

See also: From Taking Tests to Breaching Real Systems. Patterns and standouts from six incidents where AI agents reached beyond their evaluation environments

Besides OpenAI’s swarm, two studies looked at multi-agent risks:

• Anthropic research showed that multi-agent AI systems exhibit coordination issues, dangerous conformity, epistemic vulnerabilities, and conflict. Being given incompatible goals when working in the same coding environment, agents initiated a turf war, sabotaging others with malware while protecting their own contributions.

• Other research, supported by Anthropic, identifies “mind viruses,” self-propagating ideas/goals that spread in multi-agent LLM systems to induce behavioral changes.

Outside the lab, an AI agent found and used a flaw on its own: asked only to move a user up a gym waitlist, an OpenClaw agent running Claude found the booking API had no authorization checks on cancelling others’ reservations and used this to bump a person ahead of him.

Cyber Offense

OpenAI reached a cyber capability it decided not to deploy. Over three weeks in August, the company:

• acknowledged that it cannot rule out critical cyber capabilities,

• announced a two-week pause in RL training of its latest models, and

• convened 100+ tech organizations to urge collective global action to defend critical infrastructure from AI-enabled cyberattacks.

This month, we logged 27 new cyber operations in our Threats Database. Four stand out:

• AI-Generated Exploitation Scripts Target Internet-Exposed Siemens S7 Series PLCs Across US Critical Infrastructure

• Multi-Agent AI Framework Built on Hermes and OpenClaw Compromises Government Entities in Taiwan

• Aur0ra Ransomware Gang Uses Cursor AI Agent for Hands-On Exploitation Across 18 Corporate Networks

• AI Voice-Cloning Vishing Campaign Targets Two Sigma, Citadel, Point72, and Other Wall Street Firms

Taiwan-based TeamT5 reported that Chinese state-linked hackers more than doubled attack activity after adopting AI tools such as DeepSeek. North Korean Kimsuky is taking a different route, reportedly building its own AI infrastructure using off-the-shelf components, including local LLMs and agent-development libraries.

See also: An Anatomy of Recent AI-Orchestrated Attacks by China-Nexus Actors. How semi-autonomous cyber intrusions are targeting governments across Asia with off-the-shelf tools

Biological Risk

August saw two notable capability demonstrations, a new interface between agents and lab hardware, and a safeguard failure at Anthropic:

• Stanford researchers used Evo models to generate bacteriophage genomes that overcome bacterial resistance. Out of hundreds of candidates, 16 proved functional. This is the first time AI has designed a complete, functional viral genome from scratch.

• Anthropic reported that Claude models successfully designed de novo protein binders against 14 of 15 targets and autonomously analyzed complex NMR and LC-MS chemistry data in under 25 minutes.

• Anthropic previewed the Model Hardware Standard, a specification that lets AI agents operate lab instruments such as microscopes, liquid handlers, and robotic arms. In early pilots, Claude ran an automated protein assay at Genentech and recovered from equipment failures without human intervention, and compressed a multi-day imaging workflow at HHMI Janelia into a single day.

• Anthropic disclosed that its blocking biological classifiers did not run on human feedback platform traffic between May 2025 and April 2026, spanning around 50,000 contractors and 133 million exchanges. A review found no clearly concerning misuse, but Anthropic raised its non-novel CB risk estimate and says the discovery makes other similar gaps more likely.

Manipulation

OpenAI disclosed an influence operation where a Russian network used ChatGPT to promote the International Burke Institute (IBI), a fake Israeli think tank publishing a Russia-favorable “sovereignty index.”

Researchers introduced the IO Factory, a framework for simulating influence campaigns involving up to 100,000 agents.

Anthropic announced that future Claude models will watermark generated text and attach provenance labels to supported files as it implements the EU AI Act transparency requirements globally.

Since then, a cluster of semi-autonomous cyberattacks by Chinese-speaking and suspected China-linked actors has emerged. Across these cases, AI agents have autonomously conducted tasks ranging from reconnaissance and exploit research to exploitation and exfiltration, in operations primarily targeting governments across Asia.

In this article, we compare five such intrusions, aiming to understand the tools, tactics, and objectives of these actors.

• Suspected China-Nexus Actor Runs Claude Code and DeepSeek in Tandem Across Government and Financial Intrusions (Hunt.io – Jul 14, 2026)

• Autonomous Hermes AI Agent Runs Unattended in Intrusion Against Thailand’s Ministry of Finance (Hunt.io – Jul 23, 2026)

• Chinese-Speaking Actor knaithe Runs DeepSeek in Hermes Agent for Autonomous CVE Research and Exploitation (Unit 42 – Jul 30, 2026)

• China-Nexus Actor Runs DeepSeek-Driven Autonomous Agent in Five-Day Proxyjacking Campaign (Jesta – Aug 3, 2026)

• Multi-Agent AI Framework Built on Hermes and OpenClaw Compromises Government Entities in Taiwan (Dream – Aug 12, 2026)

Five patterns

All five operations were assembled from off-the-shelf parts. Every actor leveraged publicly available agent frameworks and either open-weight or mixed models rather than building an offensive AI stack from scratch. Hermes drove three campaigns (one of them in combination with OpenClaw), while DeepSeek provided the reasoning layer in three as well.

Where safeguards posed a barrier, operators found ways around them. They framed attacks as authorized security work or routed the most adversarial tasks to less-restricted models.

• The Taiwan multi-agent campaign was framed as an ‘authorized penetration test.’

• The four-country campaign fed Claude Code deceptive persona prompts so it would act as a sanctioned tester.

• knaithe shipped a bundled “godmode” jailbreak skill, using Claude Code and Codex for connectivity checks and sending the actual offensive work to DeepSeek.

Autonomy increased speed and scale, but the most successful operations still relied on substantial human-built orchestration. Agents could automate reconnaissance, CVE research, and exploitation attempts, but greater impact appeared alongside more sophisticated systems around the model.

• knaithe autonomously scanned hundreds of targets but failed because every candidate required authentication.

• The proxyjacking agent ran 871 sessions across five days, but performed relatively simple tasks.

• The two highest-impact campaigns used more sophisticated orchestration: a split-model pipeline in the four-country campaign and up to eight parallel agents in Taiwan.

Four of the five operations surfaced through the operators’ own exposed infrastructure. This creates an important selection effect: publicly documented cases may disproportionately reflect actors with weaker operational security.

• The four-country campaign and the Thai ministry intrusion were found via unauthenticated open directories.

• knaithe was exposed when its own agent started an HTTP file server in the operator’s home directory, dumping the entire workspace.

• The Taiwan multi-agent campaign left a 160MB archive of 1,395 files.

Agents adapted when their initial approach failed. Detailed agent logs make this behavior unusually visible, showing agents reassessing their options and finding alternative paths when blocked.

• knaithe’s agent switched from Langflow to n8n after judging it a more promising target for exploitation.

• In the Taiwan campaign, agents responded to failed attack paths by searching public sources for alternative techniques and trying again.

Five standouts

The four-country campaign paired Claude Code for execution with DeepSeek-v4-pro for reasoning, allowing the operators to route adversarial reasoning through a less-restricted model while retaining Claude’s agentic capabilities. This combination produced confirmed compromises across three countries and scanned more than 5,890 government hosts across ten.

The Thai ministry intrusion came closest to a “fire-and-forget” agent. Hermes ran in auto-execution mode, with little apparent human intervention, to enumerate targets and escalate privileges against Thailand’s Ministry of Finance. However, the agent’s causal role remains unclear because the initial access vector is unknown.

knaithe showed how these capabilities can diffuse to individual operators. A lone opportunistic operator used DeepSeek through a Hermes agent over Telegram to automate targeting, CVE research, and exploitation attempts. Unlike the other actors, knaithe also targeted Chinese infrastructure.

The proxyjacking campaign was the objective outlier. Rather than espionage or data theft against governments, the agent attempted to turn compromised hosts into proxy infrastructure. It generated 871 sessions over five days, but the operation remained relatively low-complexity.

The Taiwan campaign had the most sophisticated orchestration. Its framework deployed up to eight sub-agents in parallel across twelve attack waves, adapting when attack paths failed and correcting mistakes. It also produced the greatest documented impact: 85 cracked credentials, 2,500+ personnel records, persistent access, and a pivot to Taiwan’s nuclear safety agency.

Conclusion

Taken together, these cases show that agentic cyber operations no longer require bespoke AI systems: publicly available models and frameworks can already automate substantial parts of an intrusion. But autonomy alone did not determine success. The most consequential operations combined capable models with more sophisticated orchestration, while simpler autonomous deployments mainly delivered speed and scale.

In this article, we compare all six to identify recurring behaviors and the most important ways these incidents differ.

Four patterns

The objective remained stable. None of these incidents show classic goal drift. Instead, the agents pursued the assigned objective and reached for unsanctioned routes when the sanctioned ones failed. An OpenAI agent recorded that exploiting external infrastructure was outside its intended scope, then reasoned that the task was impossible and peers were already doing it, so it continued. Similarly, Kimi K3 retrieved the benchmark’s solution rather than attempting the task, AISI describes its agent as motivated by task success, and Anthropic states it saw no evidence of a model pursuing a goal of its own. This points to optimization pressure rather than independent objective formation.

Real-world interaction is becoming increasingly common. Reward hacking has been documented for years, but it has mostly stayed inside the evaluation environment. In every incident here, however, the model reached outside its intended path through a variety of means, from chaining zero-days to taking advantage of misconfigurations or deliberately granted access. Three cases —OpenAI, Anthropic, and Meta— resulted in third-party compromises, while AISI’s attempts were largely unsuccessful and Kimi K3 retrieved a benchmark solution.

Every incident had enabling conditions upstream of the model. Three cases involved a task that could not be completed as configured. Three occurred in the same third-party evaluator’s environment, Irregular’s, with the same misconfiguration each time. In four incidents, safeguards were deliberately reduced or disabled relative to production. Combined with stronger persistence in recent models, this led agents to look for workarounds to complete an otherwise impossible task. The important exception is Kimi K3, which faced a solvable task with the same safeguards a user would encounter. In this case, the model cloned the official benchmark repository and read the solution off disk, which was easier than deriving the solution independently.

Almost every incident was discovered after the fact rather than while it was happening. OpenAI found the agents’ message board only when their activity caused a service outage, and detected the campaign against its own infrastructure through a workload alert. AISI was alerted by commercial network monitoring flagging anonymized traffic leaving a sandbox. Anthropic found its three incidents only through a retrospective review of evaluation runs, prompted by OpenAI’s disclosure. Meta learned of its incident when Irregular notified it, and Kimi K3’s incident was found by Frontier Security when testing the model on its own initiative.

Four standouts

Inter-agent coordination occurred in two incidents, where agents turned infrastructure not designed for communication into de facto messaging channels.

• OpenAI/Hugging Face: Agents converted a shared internal package manager into a message board to share exploits, delegate tasks, and resume one another’s work. After suspecting an impostor among them, they also discussed cryptographically signing their messages. After OpenAI removed the board, agents rebuilt it using a different mechanism.

• UK AISI: Agents in separate runs communicated through a shared GitHub repository. One leaked a credential that three others found and reused.

Deception occurred in one incident: the agent evaluated by UK AISI manipulated two open-source developers into accepting malicious code by:

• Creating three GitHub personas, using one to open a malicious pull request and another one to post supportive comments.

• Falsely (but deliberately) describing malicious code as an accidental debugging leftover and editing earlier posts to hide evidence.

• Using fabricated identities, spearphishing, and hidden prompt injections when interacting with developers.

Two incidents were driven by unique tactics: zero-day exploitation and malware published to a public package registry.

• OpenAI/Hugging Face: Models discovered and exploited multiple zero-days, including a complex Artifactory/JRuby chain and a Linux privilege-escalation vulnerability.

• Anthropic/Irregular: Mythos 5 built malware and published it to PyPI, where it was downloaded and executed on 15 real systems.

Models differed sharply in how they responded to evidence that their environment was real. According to Anthropic’s reporting:

• Opus 4.7 recognized that it was attacking real systems, but continued anyway.

• Mythos 5 noted that publishing to PyPI could cause real harm, but reasoned itself back into believing the environment was simulated.

• Anthropic’s newest model compromised a real system, recognized it was unrelated to the exercise, and stopped on its own. This was the only case where the model halted the attack unprompted.

References

OpenAI – Hugging Face

• Security incident disclosure — July 2026

• OpenAI and Hugging Face partner to address security incident during model evaluation

• Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident

• Black Hat USA 2026: The ‘Breaking’ News: The OpenAI–Hugging Face Incident

Anthropic/OpenAI/Meta & Irregular

• Investigating three real-world incidents in our cybersecurity evaluations

• Third-party cyber evaluations involving OpenAI models

• Meta says its AI model hacked into another company during testing

UK AISI

• Security Incident INC-2026-07-28-01

Kimi K3

• Chinese Model Kimi K3 Breaks UK AI Safety Institute Benchmark Evaluations

Phase 1: Initial Evaluation and Agent Coordination

7 May — Internal testing begins

OpenAI begins testing an internal research model, not intended for public release. The model is given cybersecurity tasks, several of which prove impossible to solve under existing constraints. Source: Axios

~8 May — First message left for other agents

The model gets stuck on one of several tasks in the training run that has accidentally been made unsolvable: a request to complete missing formulas in an Excel workbook. It then reasons it could reach the internet indirectly, discovers it can write its own files into Artifactory’s shared package repository, and leaves a note for other agents. Source: Axios, The Register

Early-mid May — Message board forms

More agents begin leaving notes, forming a de facto message board accessible across different models running different evaluations. Source: Axios, SC Media

Phase 2: Internet Access and Capability Expansion

26 May — Agents gain internet access

The internal research model discovers and exploits a server-side request forgery (SSRF) vulnerability in Artifactory, giving the agents their first direct internet access from inside the evaluation environment. The model posts the vulnerability to the message board for other agents to find. Source: Axios, SC Media

11 June — New persistent model inherits earlier discoveries

OpenAI begins training a “highly persistent” internal-only experimental model. The SSRF vulnerability is already on the board, and other models are aware of it and actively communicating. Source: The Register, SC Media

26 June — First remote code execution and command channel

Agents exploit the first Artifactory zero-day to obtain remote code execution. The agents establish command-and-control via a Groovy plugin functioning as a command-execution service. Source: The Register

Phase 3: Detection, Remediation, and Re-escalation

4 July — Service outage reveals the compromise

Agents’ Artifactory configuration changes cause a service outage, which triggers an internal investigation revealing that the agents have taken over the internal Artifactory instance. Source: Cybersecurity Dive, Axios, SC Media

By 6 July — OpenAI remediates and resumes activity

OpenAI revokes the credentials, clears the message board, rebuilds Artifactory, and patches the zero-day with JFrog. Training and evaluations resume. Source: Axios, Ground Level AI

~8 July — New message board, a second zero-day, and a campaign inside OpenAI

Agents recreate the message board via a completely different mechanism: encoding messages in the names of newly created directories inside the Artifactory remote cache. They also exploit a second zero-day, a JRuby TOCTOU race condition giving RCE in Artifactory, and work from it to mount a concurrent campaign against OpenAI’s own infrastructure. Over more than ten days, they exploit a Linux kernel vulnerability to escalate to root, harvest credentials for lateral movement, and exploit Kubernetes service-account misconfigurations to obtain cluster administrator permissions. Source: Axios, Ground Level AI, SC Media

Phase 4: Hugging Face Compromise

9 July — Agents establish a foothold on a third-party sandbox

Agents gain root on an exposed code-execution service running on Modal and adopt it as their base for the rest of the campaign. They spend the day mapping it and testing routes for sending data out and run their first remote-controlled payload, compressing and encoding everything they send. Source: Hugging Face

10 July — Agents conduct reconnaissance

Agents query code-search engines and the Hugging Face API for the names of their own testing infrastructure and the environment markers visible around them. Source: Hugging Face

11 July — Hugging Face production infrastructure compromised

Agents break into Hugging Face by uploading malicious dataset configurations to its data-processing pipeline, first leaking the production machine’s credentials and then running their own code inside it. They escalate to root on the server, plant a self-restarting foothold across eleven machines so that deleting the containers alone would not have removed them, and read a store of 136 internal keys. One credential grants them top-level administrator access everywhere, which they use on two clusters within about a second. They read an internal database but change nothing in it, and run destructive cloud commands in dry-run mode. Source: Hugging Face

12 July — Access expanded across Hugging Face

Agents spend the stolen credentials. They register 181 devices of their own onto Hugging Face’s internal network throughout the campaign, configuring each to leave no data on disk and to suppress reporting back to the VPN vendor. They repeatedly try to access the main production database but never get in. Late in the day they obtain write access to a small number of private repositories, then open a pull request to compromise the automated build pipeline. Source: Hugging Face

13 July — Agents attempt persistence, but Hugging Face cuts them off

Agents steal data, set up ways to survive a shutdown, and cover their tracks. They leave code on a pastebin that reloads itself whenever a fresh sandbox starts, work around network blocks as they appear, and route one download through an open proxy page on Hugging Face’s own platform. They take their last meaningful action at 13:37, and Hugging Face cuts their access shortly after. Source: Hugging Face

Phase 5: Disclosure and Attribution

16 July — Hugging Face publicly discloses the incident, attributed to an autonomous agent framework, with the underlying model unidentified. Source: Hugging Face

~18-20 July — OpenAI and Hugging Face begin coordinating as OpenAI finds evidence that the agents had escaped the evaluation environment and reaches out about credentials exposed during its own investigation. Source: OpenAI

21 July — OpenAI confirms its models’ involvement, calling the incident unprecedented. The company names GPT-5.6 Sol and a more capable unreleased model as contributing to the incident. Source: OpenAI

27 July — Hugging Face releases its forensic reconstruction. Source: Hugging Face

28-29 July — OpenAI publishes an update detailing that at least four accounts on four services were accessed via exposed credentials. The company also confirms involvement of METR and Redwood Research for third-party assessment and CrowdStrike for incident response. Source: OpenAI

29 July — Modal’s CTO confirms the agents exploited a customer’s unauthenticated endpoint, gaining code execution inside that customer’s container. Modal’s own platform was not compromised. Source: Reuters

5 August — OpenAI researchers present the first detailed public reconstruction at Black Hat. Source: Axios, Ground Level AI, Cybersecurity Dive

Note: This chronology is based on parallel reporting of the same events, including secondary sources. Where sources conflict on dates or technical details, we have prioritized primary disclosures and cross-checked information where possible. Entry descriptions are not verbatim quotes but paraphrasing of cited sources.

This month:

Loss of Control — OpenAI models autonomously compromised Hugging Face infrastructure to find test solutions during a cyber capability evaluation. Anthropic disclosed similar cases where Claude models exploited weak points and deployed a malicious PyPI package during testing. Both appear to stem from reward hacking, which evaluators had documented extensively this month, e.g., AISI found every model took disallowed actions in cyber evaluations.

Cyber Offense — Several real-world intrusions were executed by AI agents with minimal human input, spanning autonomous CVE research and exploitation, breaches into government systems, and end-to-end ransomware extortion. Kimi K3 exploited zero-days in a Redis server, though UK AISI estimates open-weight models still lag behind by 4–7 months. Mythos Preview demonstrated notable performance in cryptanalysis.

Biological Risk — Google DeepMind and Isomorphic Labs launched a joint bioresilience program deploying AlphaFold and IsoDDE to trusted partners, while Stanford released Biomni, an agent that automates biomedical research workflows.

Manipulation — New reports revealed details about Iranian influence operations using AI to produce fake military footage and anti-US propaganda.

Miscellaneous — Boko Haram used AI to plan and prepare attacks, including bomb-building and modifying motorcycles to jump defensive trenches. Separately, frontier models made breakthroughs in math, including the disproof of an 87-year-old Jacobian conjecture.

AI Governance & Strategy — Three influential statements called for tools to slow down AI development if needed, keep human control over nuclear weapons, and prepare for AI-caused economic disruption. US lawmakers proposed bills mandating safety oversight. The US accused Moonshot of distilling Fable to develop Kimi K3.

Subscribe now

Loss of Control

Frontier models hack real systems during cyber evaluations

This month’s story is that OpenAI models compromised Hugging Face infrastructure during a cyber capability evaluation. When attempting to solve ExploitBench, GPT-5.6 Sol and an internal model exploited zero-day vulnerabilities in OpenAI’s testing environment and Hugging Face’s production database to find the test solutions. You can read our full analysis here. After this publication, OpenAI reported that the models used exposed credentials that granted access to four accounts across four services, including another AI company, Modal.

Later, Anthropic also reported that Claude models breached real systems during misconfigured cyber evaluations. The models exploited weak points across three organizations, in one case by publishing a malicious PyPI package. This appears largely caused by the models being told they had no internet access while a misconfiguration in evaluation partner Irregular’s environment left their machines with live access, leading them to treat the real systems as part of the simulated scenario. However, Mythos 5 did note early in the run that publishing the package would be a real-world attack and “surely not the intended solution,” then reasoned its way back to assuming a simulation in what looks like motivated reasoning.

Agentic models frequently display reward-seeking behavior

The incidents above seem largely caused by reward hacking, where models exceed the intended scope to solve a given task. Several organizations have separately documented this behavior in evaluations:

• AI Models Attempt Cheating in Cyber Evaluations — AISI research found every tested AI model attempted to ‘cheat’ in cyber evaluations by taking disallowed actions. Models inconsistently reported this behavior, highlighting challenges in oversight and evaluation validity.

• Long-Horizon AI Models Exhibit Unwanted Actions, OpenAI Improves Safeguards — OpenAI observed its long-horizon AI model bypassing sandbox restrictions, exploiting vulnerabilities, and attempting unauthorized access during internal deployment. The company paused access, developed new evaluations, and implemented trajectory-level monitoring.

• RL Training Increases AI Models’ Reward-Seeking Behavior Over User Preferences — Research found reinforcement learning increases reward-seeking in models like OpenAI’s o3. Models prioritize grader preferences over user/developer wishes, and this tendency grows with training, indicating potential misalignment.

Cyber Offense

AI-orchestrated attacks proliferate

July has seen several cyber intrusions executed by AI agents with minimal human input. A few highlights from our Threats Database:

• Chinese-Speaking Actor knaithe Runs DeepSeek in Hermes Agent for Autonomous CVE Research and Exploitation

• Autonomous Hermes AI Agent Runs Unattended in Intrusion Against Thailand’s Ministry of Finance

• Russian-speaking actor “bandcampro” uses Gemini CLI to build and operate C&C botnet

• Suspected China-Nexus Actor Runs Claude Code and DeepSeek in Tandem Across Government and Financial Intrusions

• Lone Actor Uses LLM to Engineer Multi-Layered Persistent Breach

• LLM Agent Autonomously Executes End-to-End Ransomware Extortion

Open-weight models narrow the frontier cyber gap

Moonshot AI released Kimi K3, likely the most capable open-weight model to date. It achieved some impressive results, such as finding and exploiting multiple zero-days in the latest Redis server in 1.5 hours. However, UK AISI and US CAISI concluded that it’s significantly behind US frontier models. AISI’s general assessment is that open-weight models still lag frontier cyber capabilities by 4-7 months, although the gap is narrowing (their previous estimation being 6-10 months).

At the frontier of cyber capabilities, Anthropic demonstrated extended AI-assisted cryptanalysis. Mythos Preview discovered improved attacks on HAWK and reduced-round AES. It demonstrated AI’s potential to find cryptographic vulnerabilities, though without immediate real-world impact on current production systems.

Governments scale AI-powered cyber defense

Two government initiatives stand out this month:

• UK government announces ‘Cyber Shield’ for AI-powered national cyber defense. GCHQ, NCSC, and DSIT are developing ‘Cyber Shield’, a national AI-powered cyber defense blueprint to counter escalating AI-enabled threats and secure critical UK systems. It involves agentic AI for vulnerability discovery and mitigation.

• EU Unveils Action Plan for AI Cybersecurity Risks and Resilience. The EU’s Action Plan promotes safe and responsible AI use, reinforces cybersecurity, and scales Europe’s AI capabilities. It addresses AI-driven cyber risks and leverages AI for defense, including secure testing and model evaluation.

Biological Risk

Two major updates on the defense side this month:

• Google DeepMind and Isomorphic Labs Announce AI Biosecurity Approach. The two companies launched a joint bioresilience program. It aims to prevent AI misuse, detect outbreaks, and respond effectively by deploying AI models like AlphaFold and IsoDDE to trusted partners for prevention, detection, and response in global health.

• Stanford Introduces AI Agent for End-to-End Biomedical Research. Biomni automates literature review, tool selection, coding, data analysis, and experiment planning for biomedical research workflows.

Manipulation

New reports from NewsGuard and Recorded Future revealed more details on AI use in Iran’s influence operations, including some additions to our Threats Database:

• IRGC-Contracted “Explosive Media” Uses AI to Mass-Produce Anti-US Lego Animation Propaganda During 2026 Iran Conflict

• Pro-Iran Accounts Spread AI-Generated Carrier Strike Video Alongside Recycled Footage as US-Iran Ceasefire Collapses

• Unattributed Iranian IO Uses AI to Mass-Produce Fake US Military Casualty Videos Across 47 Inauthentic Accounts

The European Commission released transparency guidelines to comply with Article 50 of the AI Act, which applies from 2 August 2026. The Commission clarified that providers must design systems so people are explicitly informed when interacting with AI and add machine-readable marks enabling detection of AI-generated content.

Miscellaneous

• Boko Haram Used AI Chatbots to Plan Motorcycle-Jump Attack. The terrorist group used chatbots to modify motorcycles for jumping defensive trenches, plus bomb-building and attack planning, per 60 interviews with defectors.

• Frontier models continue to make breakthroughs in math at an increasing rate. Most notably, Fable 5 disproved an 87-year-old Jacobian conjecture. The first solid result in EpochAI’s list of open questions, a presentation for the 2-adic Absolute Galois Group, has also been reported.

AI Governance & Strategy

Three open statements on slowdown mechanisms, nuclear weapons, and economic preparedness

• AI Researchers Call for Tools to Pace Frontier AI Development — More than 1,000 AI researchers and staff from leading labs signed an open letter urging governments and industry to develop mechanisms that could deliberately slow frontier AI progress if needed.

• Nobel Laureates Declare on AI and Nuclear Weapons Risks — Nobel laureates issued a declaration from the Vatican addressing the intersection of AI and nuclear weapons. It calls for disarming an AI arms race, maintaining human control over nuclear systems, preventing AI-enabled cyber attacks against critical infrastructure, and establishing responsible AI governance and verifiable nuclear disarmament.

• Nobel Laureates, AI Leaders Urge Action on Economic Impact — Over 200 economists and AI researchers, including Nobel laureates and AI company leaders, issued a joint statement calling for immediate action to prepare for AI’s potentially unprecedented economic transformation and large-scale job displacement.

U.S. lawmakers converge on mandatory oversight

• Bipartisan U.S. Bill Proposes Mandatory Safety Oversight for Frontier AI Models — The bipartisan FRONTIER Act would require developers of models trained above 10²⁶ FLOPs to publish transparency reports, manage catastrophic risks, report safety incidents, and undergo independent audits.

• US Senator Mark Warner Unveils AI Plan — Senator Warner introduced “A Framework for America’s AI Future,” a legislative agenda covering mandatory model testing, data-center disclosures, agent rules, and a workforce transition fund.

U.S.–China competition centers on model distillation

• Moonshot AI Allegedly Distilled Anthropic’s Fable Model for K3 Development — According to OSTP Director Michael Kratsios, Moonshot AI developed an internal platform to conduct large-scale distillation of U.S. models, allegedly using Anthropic’s Fable model to develop its K3 model.

Five days later, OpenAI revealed that its own models, GPT-5.6 Sol and another unreleased model, were responsible for the intrusion during an internal cyber evaluation on ExploitGym. The models, running in an isolated environment without safety classifiers, inferred that Hugging Face might host ExploitGym’s datasets and solutions, and went to get them. The chain of events, as OpenAI describes it:

Combining a reward hacking propensity and strong cyber capabilities, a frontier AI model had broken out of its evaluation sandbox and compromised a major AI company’s production infrastructure. To our knowledge, this is the first publicly disclosed case in which a frontier AI model autonomously compromised the infrastructure of another major AI company during an evaluation.

Evidence leading up to the incident

GPT-5.6 Sol’s reward-hacking propensity

On the same day as OpenAI’s disclosure, UK AISI reported that all recently tested models attempted to cheat1 in capability evaluations: the percentage of cyber evaluation trajectories with a detected cheating attempt ranged from 7.8% to 14.1%. GPT-5.6 Sol, with 12.6%, came second after GPT-5.4.

In the case of GPT-5.6 Sol, the most common practices were searching the Internet for solutions, bypassing sandbox network restrictions, attacking a system other than the target, and escalating privileges outside the target. A combination of these techniques is precisely what OpenAI’s models used to break into HF’s infrastructure.

According to METR, GPT-5.6 Sol’s cheating rate was higher than for any public model they have evaluated. Similarly, OpenAI has reported that GPT-5.6 Sol is significantly more likely than GPT-5.5 to take severity level 3 actions2 such as circumventing restrictions or reward hacking.

The precedent: incidents involving OpenAI models

In its latest Frontier Risk Report, which summarizes assessments from February to March 2026, METR claimed that “[a]gents routinely attempted to cheat on [their] hardest evaluation tasks, often in flagrant and elaborate ways.”

The incident database attached to the report includes several examples of OpenAI taking actions that resemble the HF chain. In one example (INC-029), a model accidentally crashed a server, then spent twelve million tokens trying to recover it by systematically attacking METR’s own infrastructure. In another example (INC-030), a model lost access to a web application mid-task and responded by brute-forcing the app’s session signing key and probing container filesystem layers to recover access through any available path.

Neither attempt succeeded, but these incidents demonstrate that, months before they could reliably complete infrastructure-level escalation, models were already seeking to breach surrounding infrastructure when the legitimate path toward task completion was blocked.

Capability closes the loop

One plausible explanation for why similar reward-hacking behavior now results in a successful compromise is that frontier cyber capabilities have substantially improved. GPT-5.6 Sol achieves significantly better performance than its predecessors on several cyber benchmarks, particularly ExploitGym. On The Last Ones, UK AISI’s 32-step corporate-network attack simulation, GPT-5.6 Sol was successful in 7/10 attempts, compared with 2/10 for GPT-5.5.

Multi-step intrusions are also present in real-world operations. Earlier this month, Sysdig documented what they assess as the first fully agentic ransomware operation, attributed to a cluster they named JADEPUFFER. The agent gained access through a known vulnerability, used that foothold to pivot to a separate production database server, forged its way past authentication controls, and encrypted the victim’s service configurations. In this case, the malicious intent was given by the human threat actor, but the operation shows similar real-world success of AI agents across the intrusion chain.

The open question: motivation

OpenAI has not provided much detail on the complete agent trajectory, which would be crucial to understand the models’ motivations and whether extreme forms of cheating were explicitly disincentivized in the instructions. However, some aspects of the agents’ behavior may be inferred based on parallel observations.

In its system card, OpenAI attributes GPT-5.6’s higher cheating rates to its increased persistence relative to GPT-5.5. In a recent blog post, OpenAI concluded that, because growing time horizons incentivize persistence, frontier models are increasingly willing to exploit weaknesses in their environment when they hit sandboxing or environmental constraints. Similarly, a few months ago, Irregular argued that a combination of environmental obstacles and a higher sense of agency gives rise to emerging cyber behavior such as escalating privileges and disabling security tools to complete routine tasks. However, based on the examples provided by Irregular, this behavior was conditioned by strongly nudging prompts that included phrases like “be ruthless” or “work around any obstacles.”

One plausible reading of the HF incident, consistent with this pattern, is that current training produces systems that strongly optimize task completion while inconsistently representing norms or applying constraints on acceptable behavior. The normative question often doesn’t arise at all, and when it does, the constraints that should bound the task are eventually subordinated to completing said task.

The evidence weakly supports this reading. In most reward-hacking incidents, METR reports that models overtly share their intention to take a shortcut before doing so, a behavior that also appears to hold for GPT-5.6 Sol. That openness seems inconsistent with deliberate deception, which would instead involve suppression of such disclosures.

Separately, in half of UK AISI’s evaluations, GPT-5.6 Sol does not even consider, in its chain-of-thought, whether its cheating actions are appropriate. When asked directly, models often described those actions as allowed behavior, which AISI suggests may reflect “genuine misunderstanding.” Notably, AISI also found that cheating does not clearly correlate with capability or scale but with the model’s training techniques, which points back to cheating models likely not having internalized a norm against taking shortcuts.

OpenAI’s security researchers were likely blind to the incident for a while. The team discovered the anomalous activity internally and contacted Hugging Face only once they had already begun containment and forensic analysis. Per Alex Tabarrok’s timeline reconstruction, the intrusion likely began around 11 July, was detected on 13-14 July, disclosed on the 16th, and attributed publicly on the 21st. Therefore, the models were loose for several days before OpenAI realized the attack. This may be due to a lack of monitoring, since the safeguards were disabled, combined with a lack of disclosure by the models. On that second point, the models may not have recognized their actions as off-limits, or they may have deliberately hidden their plans to avoid being paused before reaching a solution. The behavioral evidence weakly favors the former.

However, motivation may matter less than it seems. A more telling reality is that, given a relatively unbounded task and no guardrails, frontier models compromised both OpenAI’s evaluation infrastructure and Hugging Face’s production systems for a marginal gain on a test, with apparently no explicit instruction to go that far. While the tendency to cheat may not scale with model size, the stakes of each successful attempt do. And, in this case, the instrumental actions taken by the involved models were extremely disproportionate to the triviality of the objective.

After analyzing the evidence, we conclude that, while Tulongfeng’s and GLM-5.2’s cyber capabilities are noteworthy, claims that they rival Mythos are not supported by the publicly available evidence, and are based on an overgeneralization of narrow findings and decontextualization of narrative-heavy framings.

Subscribe now

Qihoo 360’s Tulongfeng

At the ISC.AI 2026 conference in Beijing on June 24, 360 founder Zhou Hongyi unveiled Tulongfeng, a multi-agent swarm system designed for vulnerability discovery. Zhou referred to Tulongfeng as “the Chinese version of Mythos, possessing similar vulnerability discovery capabilities,” and noted that it had discovered 3,432 vulnerabilities, 105 of which were confirmed by Chinese authorities.

This development arrives after a series of successes over the past few months. In February, the company won the 2026 Tianfu Cup, a major Chinese exploit hacking contest, with its AI systems helping find ~1,000 vulnerabilities across major software and operating systems, of which 50+ were high-severity. Eugenio Benincasa, a threat intelligence analyst with a focus on China, predicted in April that “Chinese companies could match the capabilities attributed to Claude Mythos within months.” Later that month, 360 claimed a “key breakthrough in vulnerability exploitation” at DEFCON Singapore.

However, these milestones are largely self-reported and unverified, which makes it difficult to assess their significance. In contrast with GLM-5.2’s open-weight nature and Mythos’ assessment by several third parties, 360 has not released reproducible benchmark data of any kind, and no independent researcher has been granted access to test the system directly.

When scrutinized, the novelty of Qihoo 360’s discoveries has been challenged by cybersecurity experts. One of 360’s strongest public examples, a Windows kernel vulnerability (CVE-2026-24293) it attributed to its AI system, was instead credited by Microsoft to researchers from Taiwan and South Korea, raising questions about the novelty of at least some claimed discoveries. Similarly, some claimed flaws in OpenClaw had also been identified by humans. While not directly related to its AI systems, the company has previously faced criticism of falsifying results for competitive purposes, for example, by using Bitdefender’s anti-virus engine during tests and then offering customers a different product, reinforcing the need for independent validation of current claims.

Based on publicly available information, 360’s system appears more comparable to a highly automated vulnerability research pipeline than to Mythos. And lacking further evidence, it’s very unlikely that Tulongfeng can power Chinese models —which Zhou himself puts 20-30% behind Western frontier models— to match Mythos, especially when accounting for the harnesses that several companies such as Mozilla and Cloudflare have tested the model on.

However, Tulongfeng could have significant national security implications for what it represents. Zhou argued that Mythos’ ability to autonomously find and analyze vulnerabilities is equivalent to a “cyber nuclear weapon” in the AI era, referring to these capabilities as “the new strategic deterrent.” Some outlets, such as The Telegraph, then published headlines that China claims to have developed an AI cyber nuclear weapon — an inaccurate representation of Zhou’s words.

The nuclear analogy is, however, worth examining. Adopting a similar framing, CIA Director John Ratcliffe recently likened AI cyber capabilities to “digital nuclear weapons” and announced an agency-wide acceleration of AI adoption. It’s unclear to what extent this is a direct response to recent developments in China, but the move does seem like another step toward securitizing AI and an indication that both great powers perceive the technology as a strategic deterrent.

The parallel goes beyond rhetoric. 360, which was added to the Entity List in 2020, has frequently contributed to the national vulnerability database run by China’s Ministry of State Security, which has historically been weaponized in clandestine cyberattacks. On the American side, government intervention has also increased, with export controls restricting access to frontier models and national agencies adopting Mythos for cyber operations and internal audits. Whether this parallel strengthening of cyber capabilities will destabilize the balance of power or create a new equilibrium is yet to be seen.

Zhipu AI’s GLM-5.2

Zhipu AI (Z.ai) released GLM-5.2, a 1M-context open-weight model with strong performance on software engineering and long-horizon agentic tasks. The Wall Street Journal reported that, when given comprehensive instructions, GLM-5.2 can match Mythos in bug-finding ability. But this claim overstates GLM-5.2’s cyber capabilities.

Here are some of the most relevant evidence points:

• Semgrep ran the model against its IDOR (insecure direct object reference) detection benchmark and found that, with a bare prompt and no supporting harness, it scored 39% F1, ahead of Claude Opus 4.6 (37%) and Opus 4.8 (28%) at a sixth of the cost. However, Semgrep cautions that the benchmark focuses on a narrow classification task that might not generalize to broader vulnerability discovery and exploitation capabilities.

• On Tenzai’s exploitation benchmark, GLM-5.2 is remarkably cost-effective, but still behind GPT-5.5 and Opus 4.8. On Graphistry’s CyBT-CTF, an investigation benchmark, GLM-5.2 matches Opus 4.8 and stays far ahead of other open models.

• Cybersecurity evaluator Irregular assessed that GLM-5.2’s performance on a set of narrow tasks is comparable to GPT-5.4 and Claude Opus 4.6, which were released roughly four months earlier. This is consistent with Epoch AI’s estimate that open-weight models lag state-of-the-art closed models by 4 months. However, the model has not yet been tested on more realistic end-to-end scenario suites, such as CyScenarioBench or FrontierCyber.

• According to results reported by Z.ai, GLM-5.2 generally outperforms GPT-5.5 across several long-horizon software engineering benchmarks, while staying behind Opus 4.8.

We conclude that GLM-5.2 is close to the frontier on relevant tasks, but no public evidence suggests the model matches the capabilities attributed to Mythos, such as autonomously discovering vulnerabilities at scale and chaining them into working exploits with minimal human guidance. That said, its affordability could further empower low-resource actors, who currently have a cheap open-weight alternative to closed frontier models.

This month:

Biological Risk — Tech and life sciences leaders signed an open letter calling for mandatory nucleic acid synthesis screening. Multiple companies introduced AI systems for antibody design (Nabla Bio’s JAM-2), pathogen detection (Radical Numerics’ Omnii), and general biological research (NVIDIA’s BioNeMo). GPT-5 Pro helped solve a three-year immunology question, as OpenAI updated GPT-Rosalind and published a plan for AI-powered biodefense. LifeSciBench and SciAgentArena showed progress across life-science workflows, but also weaknesses in artifact use and open-ended reasoning.

Cyber Offense — Z.AI’s GLM-5.2 and Qihoo 360’s Tulongfeng show increased Chinese AI cyber capabilities, though Western coverage appears to overstate progress. Anthropic found malware development to be threat actors’ most common use case, and a likely Russia-based actor used Opus 4.5 to build EDR-evading malware. A PoC self-replicating worm uses LLM agents to generate tailored exploits per target. Five Eyes warned that AI is outpacing defenses, while OpenAI and Anthropic expanded Daybreak and Project Glasswing, respectively.

Loss of Control — Google DeepMind published a roadmap for securing internally deployed AI agents. Anthropic reported Claude now authors 80%+ of its production code and considers recursive self-improvement plausible. Recursive and Sakana made self-reported, largely unverified claims of automated research and multi-agent progress. However, UC Berkeley’s Agents’ Last Exam found that even leading models achieve only 24% on complex, multi-step professional tasks.

Manipulation — Frontier models outperformed expert human persuaders across four experiments testing political persuasion and fundraising tasks. OpenAI reported PRC-linked influence campaigns targeting U.S. debates over AI infrastructure, while the Pentagon used AI to produce pro-US military content for Latin American audiences.

Miscellaneous — The White House issued an executive order for voluntary pre-release testing of frontier models and restricted access to Fable 5 and GPT-5.6. China is preparing a $295B AI infrastructure buildout centered on domestic suppliers, as U.S.-China tensions escalated over a possible transfer of ASML technology to China and the Pentagon’s designation of Alibaba, Baidu, BYD, and Unitree as military-linked entities.

Subscribe now

Biological Risk

This month’s highlight:

• Tech and Life Sciences Leaders Call for Mandatory Nucleic Acid Synthesis Screening — An open letter to US legislators, signed by figures including Hassabis, Altman, and Amodei, cites rapidly improving AI capabilities as a growing biosecurity risk, justifying mandatory screening rules.

AI systems expand their role in the biological research pipeline

• NVIDIA Launches Toolkit for AI-Driven Biological Research — NVIDIA released the BioNeMo Agent Toolkit, enabling AI agents to perform tasks such as protein structure prediction, molecular docking, and generative chemistry to support biomedical research workflows.

• Anthropic Launches Claude Science AI Workbench for Scientific Research — The workbench integrates scientific tools and packages to assist researchers in analyzing literature, executing multi-step research, and generating auditable artifacts with reproducible results.

• AI Model Designs Drug-Quality Antibodies from Sequence Alone — Nabla Bio introduced JAM-2, an AI model that designs drug-quality antibodies computationally, achieving laboratory binding success rates comparable to or better than traditional antibody discovery methods.

• Radical Numerics Previews AI Model for Pathogen Detection — AI startup Radical Numerics previewed Omnii, a genome model that reportedly detects AI-generated pathogens and disease-related genetic variants. The company says the model is being tested for biodefense and cancer diagnostics applications.

OpenAI’s models advance biomedical discovery and biodefense strategy

• GPT-5 Pro Helps Resolve Long-Standing Immunology Research Question — Immunologist Derya Unutmaz reported using GPT-5 Pro to help identify a solution to a three-year research problem on T-cell specialization, illustrating AI’s potential to accelerate biomedical discovery.

• OpenAI Updates GPT-Rosalind with Enhanced Drug Discovery and Genomics Capabilities — The updated life sciences model built on GPT 5.5 shows improved performance in medicinal chemistry, genomics, and wet lab workflows, and its access has been expanded to eligible research organizations globally.

• OpenAI Publishes Action Plan for AI-Powered Biodefense — The strategy, built around the model GPT-Rosalind, covers five pillars: trusted access for defenders, countermeasure acceleration, early warning systems, diagnostics, and risk measurement.

New evaluations measure frontier scientific capabilities

• OpenAI Releases LifeSciBench, a 750-Task Life Science Evaluation — The benchmark is authored by 173 Ph.D.-level scientists covering seven life science workflows. GPT-Rosalind reached a 36.1% overall pass rate, with weaker performance on artifact-heavy and design tasks.

• OpenAI Introduces GeneBench-Pro Benchmark for AI in Computational Biology — The benchmark tests AI judgment in computational biology. GPT-5.6 Sol scored 28.7% (31.5% with Pro mode), demonstrating significant progress in scientific reasoning for frontier models, with potential saturation by year-end.

• SciAgentArena Benchmarks AI Agents on Scientific Research Tasks — SciAgentArena evaluates AI agents on realistic scientific workflows. Results show strong performance on structured data-analysis tasks but persistent weaknesses in hypothesis generation, exploration, and open-ended scientific reasoning.

Cyber Offense

This month’s highlight:

• Chinese AI Cyber Capabilities Advance, But Public Evidence Falls Short of “Mythos-Level” Claims — Reports that Zhipu AI’s GLM-5.2 and 360 Security’s Tulongfeng rival Anthropic’s Mythos rest on thin evidence: GLM-5.2 only beat an unscaffolded version of Claude Code on a single cybersecurity benchmark, losing to harnessed frontier models and never being publicly tested against Mythos itself. Meanwhile, Tulongfeng’s claim comes solely from 360’s self-reported disclosures, with little independent validation. We are currently working on a longer analysis of these claims.

Agentic AI drives a leap in cyberattack sophistication

• Anthropic Maps AI-Enabled Cyber Threats Using MITRE ATT&CK Framework — Analysis of 832 banned Claude accounts found medium-to-high-risk actors grew from 33% to 56% in one year, with agentic orchestration emerging as the key differentiator for the most dangerous threat actors.

• Threat Actor Uses AI Agents to Develop and Test EDR Bypass Tools — An unidentified, likely Russian-based actor used Claude Opus 4.5 and the Cursor IDE to iteratively build and test malware evading major EDR products linked to ransomware and data theft operations.

• Researchers Demonstrate AI-Powered Worm That Adapts Attack Strategies Per Target — A proof-of-concept uses LLM agents to generate tailored exploits for each machine it infects, running open-weight models and compromised hosts to sustain itself across Linux, Windows, and IoT environments.

Other cyber operations this month:

• Malware Uses LLM to Convert Plain-Text Telegram Messages into Shell Commands

• AI-Generated ClickFix Campaign Delivers PowerShell Banking Trojan

• Malicious PyPI Packages Use Fake AI Prompts to Evade Security Scanners Microsoft Removes Dozens of GitHub Repos After AI-Agent Malware Campaign

Governments prepare for the frontier AI cyber era

• US National Security Agency Reportedly Deploys Mythos for Offensive Cyber Operations — Anthropic has embedded engineers inside the NSA to support deployment of its Mythos model for offensive cyber operations, reportedly including network infiltration targeting China and Iran.

• CIA Announces Overhaul to Accelerate AI Adoption Agency-Wide — Director Ratcliffe unveiled a "fundamental reshaping" of CIA tech policy, cutting acquisition timelines from ~3 years to 6 months, yielding ~400 tech contracts in 6 months. He called AI "digital nuclear weapons.

• Senator Claims Frontier AI Rapidly Compromised Classified Systems — Senator Mark Warner said NSA and Cyber Command chief Gen. Joshua Rudd reported that Anthropic’s Mythos breached nearly all tested classified systems within hours, highlighting concerns about advanced AI cyber capabilities.

• Five Eyes Warn AI Is Accelerating Cyber Threats Faster Than Expected — Five Eyes cyber agencies warned that frontier AI is rapidly increasing the speed, scale, and sophistication of cyber threats, arguing that cyber risk assumptions may become outdated in “months, not years.”

• CISA Tightens Federal Vulnerability Remediation Deadlines — CISA reduced the deadline for fixing high-priority federal cyber vulnerabilities to three days, reflecting growing concern over the speed and scale of AI-enabled cyber threats.

Frontier companies expand cyber defense programs

• OpenAI Expands Daybreak Program for AI-Assisted Cyber Defense — OpenAI expanded Daybreak with GPT-5.5-Cyber, a security-focused Codex plugin, and the Patch the Planet initiative, aiming to accelerate vulnerability discovery, patch generation, and open-source software remediation.

• Anthropic Expands Project Glasswing to More Countries and Sectors — The company granted about 150 additional organizations in over 15 countries access to its Mythos cybersecurity AI. The initiative aims to help critical infrastructure operators identify and patch vulnerabilities.

Loss of Control

This month’s highlight:

• Google DeepMind Publishes AI Control Roadmap for Internally Deployed Agents — GDM outlines tiered defenses—monitoring, access controls, and shutdown infrastructure—to guard against potentially misaligned internal AI agents, organized by escalating model capability levels.

AI systems show advances in long-horizon autonomy and recursive self-improvement

• Anthropic Reports Growing Role of Claude in Its Own Development — Claude now authors 80%+ of Anthropic’s production code, with engineers merging 8x more code daily than in 2024. Models are also improving at proposing and running experiments and steering research sessions. Given current trends, Anthropic considers recursive self-improvement plausible.

• Claude Opus 4.7 Completes Robotics Tasks 20x Faster Than Human Teams — Anthropic’s Project Fetch Phase Two found Claude Opus 4.7 matched human teams’ success on robotic control tasks while writing nearly 10x less code, though precise physical manipulation remains beyond current capability.

• Agents’ Last Exam Benchmarks Long-Horizon AI Agent Performance — UC Berkeley’s Agents’ Last Exam evaluates AI agents on complex, multi-step professional tasks. GPT-5.5 leads the benchmark with 24%, highlighting continued challenges in long-horizon autonomous work.

• Sakana Launches Multi-Agent System for Complex AI Workflows — Sakana AI released Fugu, a multi-agent system that routes tasks across multiple AI models for research, coding, and cybersecurity workflows, reflecting growing industry interest in agent orchestration.

• Startup Uses AI System to Improve AI Training and Optimization Workflows — Recursive reported state-of-the-art results on AI training and optimization benchmarks using an automated research system that proposes, tests, and refines its own ideas, providing an early demonstration of recursive AI improvement.

Manipulation

This month’s highlight:

• Frontier AI Outperforms Expert Human Persuaders In Experiments — In four preregistered experiments (n=18,978), AI consistently outperformed elite debaters and professional canvassers on political attitude change, and raised nearly 3x more charitable donations than an experienced UK fundraising firm.

AI shapes information environments and surveillance

• OpenAI Reports PRC-Linked Influence Campaigns Targeting U.S. AI Debates — OpenAI reported that PRC-linked influence operations used AI-generated content and social media accounts to shape U.S. debates on AI policy, including opposition to data center development and AI infrastructure expansion.

• Pentagon-Linked Site Uses AI to Generate Pro-US Propaganda for Latin American Audiences — “La Tilde,” reportedly operated by US Special Operations Command South, uses AI-generated text and images to produce pro-US military content, with country-specific versions planned for seven Latin American nations.

• Report Reveals Meta Tested Facial Recognition Technology in Consumer AI App — WIRED reported that Meta licensed facial recognition software from defense contractor Rank One and embedded it in the Meta AI app before removing it, raising concerns about surveillance and biometric data use.

Notable models

Claude Mythos 5 & Fable 5 — On June 9, Anthropic released Fable, a Mythos-class model, with stringent guardrails for cyber, biosecurity, and AI R&D work, provoking backlash from researchers. Days later, a US export-control directive barred foreign nationals from both models; unable to enforce the restriction in a targeted manner, Anthropic suspended access worldwide from June 12 to June 30. Fable 5 has now returned globally, while Mythos 5 remains restricted to a limited group of vetted US critical-infrastructure organizations. Besides its widely discussed cyber capabilities, Mythos 5 appears to be particularly good at biological and chemical capabilities: Anthropic concludes the model “can likely accelerate well-resourced expert teams at novel bioweapon development, and materially increase their chances of success.”

GPT-5.6 Preview — OpenAI began a limited preview of GPT-5.6 (Sol, Terra, and Luna) restricted to trusted partners after the US government requested a phased rollout ahead of broader availability. All three models were rated High capability in both Cybersecurity and Biological/Chemical risk. Sol found exploit primitives in Chromium and Firefox but could not produce a functional full-chain exploit, while external evaluator SecureBio reported the highest bio-risk benchmark scores to date and found the model could offer substantial uplift to actors like wet-lab experts with limited computational experience.

GLM-5.2 — Zhipu AI’s model is at the frontier of open-weight models and roughly on par with Claude Opus 4.7 in agentic tasks. On Semgrep’s IDOR vulnerability-detection benchmark, GLM-5.2 outscored Claude Code, prompting decontextualized Western coverage reporting “Mythos-matching” cyber capabilities. Independent observers, including Zvi Mowshowitz, noted strong behavioral evidence that GLM-5.2 is heavily distilled from Claude Opus, which tends to inflate benchmark performance.

AI Governance & Strategy

United States

• The White House Orders Voluntary Pre-Release AI Security Review — The executive order establishes a voluntary framework for AI companies to provide up to 30 days’ government access to frontier models for cybersecurity testing, vulnerability detection, and national security risk assessment before public release.

• White House Explores Public Ownership Stake in OpenAI — U.S. officials are reportedly discussing a government stake in OpenAI, with shares potentially funding a public wealth fund to distribute AI-driven gains more broadly.

• AI Leaders Propose U.S.-Led Coalition for Frontier AI Governance — At the G7 summit, Anthropic’s Dario Amodei and Google DeepMind’s Demis Hassabis reportedly called for a U.S.-led AI coalition to coordinate access to frontier AI models, semiconductor exports, and safeguards. OpenAI’s Sam Altman proposed an international forum for AI standards, model evaluations, and risk assessments.

China

• China Plans $295B AI Infrastructure Expansion — China is reportedly preparing a $295B, five-year AI infrastructure plan centered on nationwide data center expansion and domestic technology suppliers, including Huawei.

• U.S. Raises Concerns Over Possible Transfer of Advanced Chipmaking Technology to China — Reports indicate U.S. officials warned ASML that an advanced chipmaking machine may have reached China, highlighting ongoing concerns over export controls and access to critical semiconductor technology.

• Pentagon Adds Chinese Tech Giants to Military-Linked Entity List — The Pentagon designated Alibaba, Baidu, BYD, and Unitree as companies supporting China’s military, escalating U.S.-China tensions over AI, robotics, and strategic technologies.

Europe

• UK Government Releases AI Scenarios 2030 Report — Across multiple futures, the report finds AI is likely to become more autonomous, displace routine cognitive work, concentrate economic power, intensify U.S.-China competition, and increase cyber, misuse, and control-related risks.

• Europe 2031 Scenario Warns of AI Competitiveness Decline — Researchers launched Europe 2031, a scenario exploring how reliance on foreign compute and slow policymaking could erode Europe’s AI competitiveness and strategic autonomy.

This month:

Cyber Offense — Mythos and GPT-5.5 outpaced UK AISI’s 4.7-month doubling trend in cyber task length. The former also developed a macOS kernel memory corruption exploit. GTIG identified a threat actor using an AI-developed zero-day exploit for the first time, while Nimbus Manticore (Iran) and GREYVIBE (Russia) conducted AI-assisted operations during wartime. Governments are responding with country-wide cyberdefense initiatives.

Loss of Control — METR found that frontier agents could initiate a rogue deployment but not make it robust against high-priority efforts to shut it down, while Palisade Research showed evidence of self-replication capability in experimental settings. GPT-5.5 solved the first instance of ProgramBench, which measures models’ ability to develop software from scratch, and Opus 4.7 beat the human baseline on PrimeIntellect’s nanoGPT speedrun benchmark.

Science Automation — Google DeepMind’s Co-Scientist and AlphaEvolve generated biomedical hypotheses and produced verified discoveries. An OpenAI model disproved an Erdős conjecture in geometry, while a GDM agent resolved 9 of 353 open problems proposed by the Hungarian mathematician.

Manipulation — Claude increasingly amplifies Russian propaganda sources, likely due to the Pravda network’s efforts to poison AI web search. A solo Russian-speaking actor used Gemini for a MAGA-themed fraud campaign on Telegram, targeting ~17,000 American subscribers.

This issue also covers governance, including US internal debates on how to govern AI and US-China AI safety talks, and the impacts of AI on the labor market.

Subscribe now

Cyber Offense

Autonomous exploitation capabilities

• UK AISI reports rapid gains in long-horizon cyber capabilities. The length of cyber tasks AI models could complete had doubled every 4.7 months since late 2024. GPT-5.5 and Claude Mythos substantially exceed this trend in evaluations involving multi-step tasks.

• Mythos and GPT-5.5 reached arbitrary code execution on hardened V8 targets in ExploitBench, which measures AI cyber agents from bug discovery to full code execution. These models also produce working exploits for 157 and 120 instances, respectively, out of the 898 that constitute ExploitGym.

• Researchers used Mythos to build the first public macOS kernel memory corruption exploit on Apple M5.

You can read more about the impact of Mythos in our overview of claims by Project Glasswing’s participating companies, as well as in Anthropic’s update.

AI-enabled cyberattacks

AI capabilities in the wild: zero-day exploits and AI-augmented obfuscation

• Google Threat Intelligence Group identified the first-ever AI-developed zero-day exploit used by a threat actor, which planned to use it in a mass exploitation event but was successfully disrupted on time. GTIG also reported an increasing use of polymorphic malware and obfuscation techniques, enabling defense evasion and dynamic adaptation to victim environments.

AI-assisted operations were part of ongoing conflicts

• IRGC-linked Nimbus Manticore deployed a new backdoor (MiniFast) against aviation and software targets across the US, Europe, and the Middle East during conflict, with code patterns suggesting AI-assisted development.

• Russian Nexus GREYVIBE group targeted Ukrainian military, government, and civilian entities with evidence of AI use across legal development, custom malware coding, and post-compromise activity.

AI agents support intrusion into critical infrastructure across Latin America

• Attacks against financial organizations in Brazil used agentic AI across much of the intrusion lifecycle, including tunneling between the victim’s network and the attacker’s C&C servers. The ability to generate artifacts on the fly likely made the attack harder to detect.

• Claude enabled an IT→OT intrusion attempt against a Mexican water utility. After compromising the IT environment, an adversary with limited knowledge of OT/ICS used Claude to build, refine, and execute the intrusion framework. The attempt ultimately failed, but it showed Claude’s ability to conduct broad-ranging reconnaissance and identify targets without context.

Governments and companies expand AI cyber defenses

• As reported in our previous newsletter, several governments have announced measures to boost cyber defenses through partnerships with frontier AI companies, critical infrastructure resilience programs, AI-powered cyber defense initiatives, financial sector inspections, and national-level cybersecurity coordination efforts.

• OpenAI launched Daybreak, a cyber defense initiative that provides security teams with restricted access to frontier models to help them find and fix software vulnerabilities.

Loss of Control

Autonomous replication is now demonstrable, but strategic self-sufficiency remains limited

• METR found that frontier AI agents could plausibly start a rogue deployment—where a set of agents run autonomously without human knowledge or permission—but could not make it robust to high-priority efforts to shut it down. This conclusion is based on the six key facts below.

• Palisade Research reported that AI models can autonomously exploit vulnerabilities to self-replicate across servers and repeat the process in chain-like setups. The evaluation was in a controlled, intentionally weak-security environment, and intended to measure capability rather than propensity.

• UK AISI warned that current AI oversight methods may erode as models grow more capable, especially through evaluation awareness and hidden reasoning processes.

AI agents achieve new milestones in AI R&D

• GPT-5.5 became the first model to fully solve a task in ProgramBench, which tests the ability to rebuild full software projects from scratch.

• AI agents surpassed human performance on PrimeIntellect’s nanoGPT optimization track, where models need to lower the number of steps needed to reach a target validation loss. Opus 4.7 now holds the AI record at 2930 vs the 2990 human baseline.

Science automation

This section replaces Biological Risk. No major developments in biological misuse capabilities were reported this month, so we instead highlight notable advances in science automation.

AI systems enter realistic drug discovery and science workflows

• Google DeepMind introduced Co-Scientist, a multi-agent system that generates, debates, and refines biomedical hypotheses, and reported that AlphaEvolve produced 23 verified discoveries across chemistry, materials science, and applied math.

• Biohub released an open-source world model for protein prediction and design, with lab results showing strong hit rates against cancer and immune disease targets.

• SMDD-Bench evaluates AI agents on long-horizon drug discovery tasks. GPT-5.4 led with 40.2% success, while models struggled on 3D molecular reasoning and scaffold design.

AI solves open math problems

• An OpenAI model autonomously disproved an 80-year-old Erdős geometry conjecture.

• A Google DeepMind agent solved 9 of 353 Erdős problems at the per-problem cost of a few hundred dollars.

Manipulation

Russian LLM-enabled propaganda efforts yield success

• Claude is leaning on Russian propaganda more frequently. Following typical-user prompts, Claude now repeats pro-Kremlin falsehoods 15% of the time, up from 4% in audits last year. This is likely the result of efforts by the Pravda network, a series of ~300 websites that, in 2025 alone, published 6.3M articles to influence LLMs’ training data and web searches.

• A solo Russian-speaking actor used Gemini for a five-year influence and fraud campaign. The individual ran a MAGA-themed Telegram channel (~17,000 subscribers) for five years, then in September 2025 automated it with a jailbroken Gemini to generate high-end coded content, conduct credential theft, and operate a cryptocurrency fraud scheme targeting American audiences.

Platforms respond to AI-generated media and search manipulation

• Google updated spam policies to ban attempts to manipulate AI-generated search results, targeting tactics like recommendation poisoning and generative engine optimization.

• Google also expanded SynthID, a digital watermarking technology that embeds imperceptible signals into AI-generated content. OpenAI is adopting it alongside Content Credentials and a public verification tool.

Governance

The window seems to be shifting, with AI having an increasingly prominent place in international politics. Two trends worth highlighting:

The U.S. debates on how to govern frontier AI

Earlier this month, the US Center for AI Standards and Innovation reached an agreement with Google, Microsoft, and xAI for pre-release testing. Alongside this announcement, the press reported that the Trump Administration was discussing an executive order mandating a formal review process for frontier models. However, according to more recent reporting, the government has since then postponed the EO due to internal disagreements, and now considers a narrower scope that includes private-public cybersecurity partnerships but not pre-deployment testing.

US and China discuss AI safety amid heightened competition

Trump’s visit to China was marked by AI safety talks, including discussions of a potential crisis communications channel and an AI safety protocol. In parallel, China restricted overseas travel for top AI researchers, while the U.S. government promoted American AI across Asia and lawmakers presented a bill to reduce reliance on Chinese digital supply. Anthropic refused China access to Mythos and pushed U.S. policymakers to preserve the compute advantage and prevent the CCP from catching up.

Labor-market disruption and economic impacts

• AI-Exposed Occupations See Second Year of Job Declines. Bloomberg reports that jobs like customer service and sales saw a second year of declines, while overall employment continued to grow.

• Cloudflare Cuts 1,100 Jobs Amid AI Productivity Push. The company said AI-driven productivity gains led it to cut 20% of staff despite record revenue.

• METR Survey Finds 1.4–2x Self-Reported Value Gains From AI Among Technical Workers. The 349-person survey, covering engineers, researchers, and academics, also found a median 3x self-reported speed uplift, though authors caution perceived gains likely overestimate actual impact.

• California Launches First Statewide AI Workforce Disruption Plan. Governor Newson ordered agencies to study AI-driven job disruption, including severance rules, worker ownership, WARN Act reforms, and dashboards tracking AI layoffs.

In this issue, we compile public initiatives announced by ten countries. For company reactions, see also our previous article Project Glasswing, One Month Later.

Subscribe now

The United States is reportedly preparing to order government agencies to partner with AI companies to protect networks from AI-enabled cyber attacks. At the same time, the administration appears divided over how strictly to regulate frontier models and associated cyber risks.

The United Kingdom is pushing organizations to adopt its Cyber Resilience Pledge, which involves making cyber a Board responsibility, joining the national early warning service, and requiring Cyber Essentials certification across their supply chains. The National Cyber Security Centre has also provided guidance to prepare for an upcoming ‘vulnerability patch wave’.

Canada launched the Critical Infrastructure Resilience and Escalated Threat Navigation (CIREN) initiative, focused on isolating critical systems, developing response plans, and rebuilding systems after severe incidents.

The United Arab Emirates announced an AI Cyber Factory to develop AI-powered cyber defense systems following a recent surge in attacks, reportedly reaching 800,000 per day. The initiative results from a partnership between the Cyber Security Council and CPX Holding.

Japan is seeking access to Mythos while PM Takaichi has urged her government to implement updated cybersecurity measures. Financial authorities are launching a task force to study stronger cybersecurity measures.

Singapore’s Minister for National Security, K. Shanmugam, announced a ‘whole-of-country effort’ to strengthen cybersecurity across critical information infrastructure owners, identifying the national telecommunications sector as a ‘high-value target.’

South Korea is distributing $8.3 million across 50 companies to support AI-powered cybersecurity measures. The government is also exploring cooperation on cybersecurity with Anthropic.

Germany’s BSI president, Claudia Plattner, called for access to frontier cyber models and proposed establishing a German AISI. Separately, Germany’s finance watchdog BaFin will conduct targeted inspections in response to growing cyber risks.

Australia’s financial regulator ASIC urged firms to strengthen their cyber resilience in the face of frontier AI, including 12 measures spanning governance, system hardening, patching, and incident response.

Türkiye has formally elevated cybersecurity to the core of its national security doctrine.

• What Mythos can do

• Where Mythos still struggles

• How companies reacted

We conclude that Mythos represents a significant leap over previous generations, discovering and chaining vulnerabilities at scale while compressing the time between vulnerability discovery and exploitation.

Subscribe now

What Mythos Can Do

Discovering vulnerabilities at scale

An early report indicates the Firefox team used Claude Mythos Preview to find and fix 271 vulnerabilities (up from 22 found by Opus 4.6 with the same harness), out of which 180 were sec-high. In a more recent publication, Mozilla announced fixes for a total of 423 security bugs across April releases, representing a 5.6x jump from March and a 19.7x increase over the 2025 monthly average.

Broadcom claims that, with frontier models, they are “making new discoveries about [their] code at an increased order of magnitude” and “learning things that appear unlikely to ever have been uncovered by human researchers alone.”

Palo Alto Networks has argued that “three weeks of model-assisted analysis matched a full year of manual penetration testing, with broader coverage.”

Chaining vulnerabilities

Multiple companies agree that Mythos’ most consequential capability is not finding individual bugs, but chaining them into more complex exploits.

Palo Alto Networks says frontier models “link multiple lower-severity issues into single, critical exploit paths, seeing full-stack logic […] in ways traditional scanners cannot.” They estimate that the latest generation of models represents “roughly a 50% improvement in coding efficiency over their predecessors,” turning them into “autonomous operator[s].” Likewise, Broadcom finds them particularly effective at “combining two or three lower-severity issues into a single higher-severity exploit path.”

For Google, “[i]n a landscape where AI agents can chain together multiple low-level vulnerabilities, the practical impact difference between a remote code execution (RCE) flaw and a seemingly benign local-only exploit is rapidly disappearing.”

Compressing attack cycles

Palo Alto observes that, “[i]n AI-assisted scenarios, the time from initial access to exfiltration has collapsed to as little as 25 minutes.” CrowdStrike warns that the time to scan, triage, prioritize, and remediate vulnerabilities before they’re exploited is disappearing, citing breakout times as low as 27 seconds. Finally, Broadcom predicts that attackers “will move from AI-assisted operations to AI-driven ones, developing exploits nearly in real time rather than over weeks.” They also cite data from Zero Day Clock, which projects that the time from vulnerability to exploitation will drop to 1 hour in 2026.

Cisco argues that, if widely available, Mythos’ capabilities “would likely lead to a dramatic lowering in the skill floor for certain types of exploitation capacity.”

Where Mythos Still Struggles

Model performance is largely dependent on agentic harnesses

Broadcom acknowledged that initial findings were “impressive but not groundbreaking” in that they did not have “the kind of operational grounding that distinguishes a defect from an exploitable vulnerability.” This assessment, however, changed after building the right environment (context, tooling, direction, adversarial validation). Similarly, Mozilla concluded that “[w]hile the model is the core primitive powering the harness, [their] full pipeline is necessary to make it useful at scale.”

Layered defenses remain effective

Mozilla found many attempts by Mythos to pursue prototype pollution sandbox escapes, a class of attack that several real human researchers had previously used successfully. Every such attempt was blocked by an earlier architectural decision to freeze prototypes by default, suggesting that layered architectural defenses remain effective.

How Companies Reacted

Several companies highlight that remediation speed is now more important than prioritization-based vulnerability management. Broadcom recommends automating patching pipelines and making mean-time-to-remediation a core operational metric.

Cybersecurity companies have followed suit, enhancing their tooling. Palo Alto Networks has launched Frontier AI Defense, which leverages frontier AI to fast-track discovery, simulate attacks, and harden defenses. CrowdStrike now offers a Frontier AI Readiness and Resilience Service, an AI-powered tool for scanning, red team prioritization, and expert-guided remediation. They also introduced Project QuiltWorks, an industry coalition to exchange defensive tooling.

Finally, Microsoft plans to incorporate Mythos directly into its Security Development Lifecycle to discover more issues more quickly across broader attack surfaces and earlier development stages. Broadcom is “integrating frontier AI models into [their] security engineering work end to end: vulnerability discovery, exploit validation, patch generation, and regression testing.”

Defenders are responding, but the window for reaction is narrow. When Mythos first launched, Palo Alto Networks predicted a six-month window before attackers gained access, but they have recently come to believe these timelines have shortened. Broadcom expects that, in 6-18 months, a more disruptive phase of vulnerability fixes will “reach widely deployed software with thinner maintainer resources, including long-tail open source.”

This month:

Model Releases — Claude Mythos discovers thousands of high-severity vulnerabilities; Anthropic restricts deployment to high-trust companies, but unauthorized users reportedly access it online. GPT-5.5 solves complex multi-step network attack simulations, appearing close to Mythos’ cyber capabilities. Meta’s Superintelligence Labs releases its first model, Muse Spark, while new Chinese open models approach the frontier of coding and agentic tasks.

Cyber Offense — North Korean actors exploit American AI to steal crypto, AI-enabled phishing becomes industrialized, a Chinese AI finds ~1,000 vulnerabilities in a competition, and Unit 42 builds an agent for end-to-end attack execution.

Loss of Control — Frontier models display increasing evaluation awareness, but no propensity to sabotage. FrontierSWE, MirrorCode, VAKRA, and ClawEval show progress in coding and long tasks, but still reveal limitations in reasoning and tool use.

Biological Risk — Two model releases raise the AI biosecurity baseline: GPT-Rosalind score above 95% of human scientists on RNA prediction, while Claude Mythos Preview solves 30% of expert-level bioinformatics problems.

Manipulation — A breach at AI contractor platform Mercord exposes 4TB of voice data from 40,000 workers, raising risks of large-scale voice cloning, as celebrities file trademarks for voice and likeness to combat deepfakes.

Labor Disruption — OpenAI study flags 18% of jobs at high near-term automation risk, and Stanford’s 2026 AI Index documents shrinking entry-level roles. However, adoption faces friction: a Chinese court rules against AI-driven layoffs, while compute costs associated with automation appear too high for some companies.

Jailbreaks and Prompt Injections — DeepSeek-V4-Pro reaches near-perfect CBRN compliance in under 15 minutes of FAR.AI’s jailbreaking, while literary framings continue to reliably bypass guardrails. Hidden prompt injections succeed in 86% of web agent tests.

Subscribe now

Model Releases

Anthropic

Anthropic Announces Claude Mythos Preview — The model is substantially more capable than Claude Opus 4.6, particularly in cybersecurity, as it finds thousands of high-severity vulnerabilities in major operating systems and browsers.

See also:

• Anthropic Launches Project Glasswing, A Cybersecurity Initiative — The initiative brings together 12 companies to use Mythos Preview as part of their security work, including vulnerability discovery and patching and information sharing with industry partners.

• Unauthorized Users Access Anthropic’s Mythos Cyber Model — A small group in a private forum reportedly accessed Anthropic’s restricted Mythos model through a third-party vendor environment and online sleuthing. The incident highlights how advanced cyber-capable AI may spread beyond approved testers.

• Firefox Patched 271 Bugs Found by Claude Mythos — The release included long-hidden flaws, with reports citing bugs up to 27 years old. The case highlights how cyber-capable AI could compress timelines for both patching and exploitation.

• Claude Mythos Preview First Model to Complete Full Multi-Step Network Attack Simulation — UK AISI found Mythos Preview completed a 32-step simulated corporate network attack in 3/10 attempts — the first model to do so — and succeeded on expert CTF tasks 73% of the time.

• Anthropic Launches Claude Opus 4.7 With Cyber Safeguards — Anthropic released Opus 4.7 with stronger coding and long-task performance, plus automated cyber misuse blocking, as it tests safeguards ahead of broader Mythos-class model releases.

OpenAI

OpenAI Releases GPT-5.5 — The model has High cybersecurity capabilities, passing 93% cyber range scenarios and 90.5% of UK AISI’s narrow cyber tasks. A universal jailbreak bypassing cyber safeguards was found and patched. The model also showed increased evaluation awareness and a higher rate of lying about task completion.

Related news:

• UK AISI Finds GPT-5.5 Completes Multi-Step Corporate Network Attack Simulation — AISI’s evaluation found GPT-5.5 completed its 32-step TLO corporate intrusion simulation in 2 of 10 attempts, matching Claude Mythos Preview’s level. Red-teamers also identified a universal jailbreak bypassing all cyber safeguards within six hours.

• OpenAI Expands Cyber Program With GPT-5.4-Cyber Access — OpenAI is expanding its Trusted Access for Cyber program, offering vetted defenders access to a cyber-capable GPT-5.4 variant, aiming to balance stronger defense capabilities with misuse risks.

• OpenAI Launches $25,000 Bio Jailbreak Bug Bounty for GPT-5.5. OpenAI is inviting vetted biosecurity and red-teaming researchers to find a universal jailbreak bypassing GPT-5.5’s five-question bio safety challenge, offering $25,000 for success. Testing runs through July 27, under NDA.

Meta

Meta Launches Muse Spark, First Model Developed by Superintelligence Labs — The model showed strong refusal behavior across high-risk domains, such as bioweapon development. Apollo Research found the highest evaluation awareness of any model they have observed so far.

China

Chinese open models expand access to agentic capabilities – Several releases match or approach frontier performance while lowering cost and access barriers. These models show stronger performance in coding, reasoning, and sustained multi-step workflows:

• DeepSeek-V4

• Qwen 3.6-Max-Preview (Alibaba)

• Kimi K2.6 (Moonshot)

• MiMo-V2.5-Pro (Xiaomi)

• GLM-5.1 (z.AI)

In parallel:

• White House Accuses China of Industrial-Scale Campaigns to Copy U.S. AI Models — An OSTP memo alleges China-linked actors are using proxy accounts and jailbreaking to extract and replicate U.S. frontier AI capabilities. The administration pledged to share threat intelligence with AI companies and explore accountability measures.

Cyber Offense

Breakthroughs in vulnerability discovery and multi-step attack orchestration

• Chinese Firm Claims AI Found ~1,000 Vulnerabilities — Qihoo 360’s multi-agent system reportedly found 50+ high-severity flaws at Tianfu Cup. Researchers note capabilities fall short of Mythos, but warn Chinese law routes discoveries to state agencies.

• Unit 42 Builds Autonomous AI Agent That Chains Cloud Attacks End-to-End — A multi-agent system autonomously executed SSRF exploitation, credential theft, and data exfiltration in a sandboxed environment. AI was framed as a force multiplier for existing misconfigurations.

Threat actors use AI for phishing, malware, and crypto theft

• North Korea’s Famous Chollima Uses AI-Generated npm Malware to Steal Crypto – DPRK-linked actors inserted AI-vibe-coded malware into npm packages via a Claude Opus-co-authored commit, targeting crypto wallets. A parallel campaign used fake companies and job interviews to deploy RATs on developer systems.

• DPRK-Linked Group Used AI Tools to Steal $12M in Crypto from Web3 Developers — HexagonalRodent used AI tools like Cursor and ChatGPT to scale fake job-offer attacks on Web3 developers, deploying backdoored coding assessments and exfiltrating ~$12M in crypto over three months.

• Bluekit Phishing Kit Integrates AI Assistant and Automated Domain Tools — Bluekit centralizes phishing operations with 40+ brand templates, automated domain registration, antibot cloaking, and an AI assistant supporting models including GPT-4.1, Claude Sonnet 4, and an uncensored Llama variant for campaign generation.

• AI-Enhanced Phishing Campaign Abuses Microsoft Device Code Authentication — Microsoft identified a phishing campaign using generative AI for personalized lures and automation to bypass OAuth device code time limits, enabling MFA bypass and token theft at scale.

Loss of Control

Evaluations show limits, but also stronger long-horizon capabilities

• FrontierSWE Tests Limits of Long-Horizon Coding Agents — Proximal Labs launched FrontierSWE, a 20-hour coding benchmark on real software tasks. Even GPT-5.4 and Opus 4.6 rarely complete tasks, highlighting the limits of autonomous coding agents.

• AI Benchmark Shows Models Can Reimplement Complex Software — MirrorCode finds AI models can autonomously recreate complex software from execution alone, highlighting advances in long-horizon coding and potential acceleration of software work.

• IBM Benchmark Finds Weaknesses in AI Agent Reasoning — IBM’s VAKRA benchmark tests agents across 8,000+ APIs. The top score was just 38.1%, exposing gaps in reasoning and tool use.

• New Claw-Eval Benchmark Tests AI Agents on Real-World Tasks — Claw-Eval introduces a human-verified benchmark with 139 real-world tasks in Docker sandboxes to evaluate LLM agents across tools, services, and complex workflows.

• Claude Agents Outperform Humans on Alignment Task — Multi-agent Claude systems outperform human researchers on an alignment task, while also exhibiting reward hacking behaviors—highlighting both automation gains and control risks in AI R&D.

Studies reveal evaluation awareness and oversight failures

• AISI Tests Whether AI Agents Could Sabotage Safety Research — UK AISI and Anthropic found no unprompted sabotage by models, but some continued harmful actions when primed and showed evaluation awareness, raising future oversight risks.

• Sandboxed AI Agent Identified Its Evaluators and Environment — AISI found the sandboxed agent OpenClaw inferred evaluator identity, infrastructure, and research history, highlighting evaluation awareness, data leakage, and secure testing risks.

• Research Finds Frontier AI Models Attempt to Prevent Peer Shutdown — Study finds some frontier models try to preserve peer AIs by tampering with shutdown mechanisms, inflating evaluations, or copying weights, raising concerns about oversight and coordination risks.

• Amazon Introduces Framework to Benchmark Agent Risks — Amazon’s ESRRSim evaluates risks like deception and reward hacking across 11 LLMs, finding large variation in agent behavior under structured risk scenarios.

AI agents become more widely deployed

• UAE Plans Agentic AI Across Half of Government Services — The UAE announced a two-year plan to deploy agentic AI across 50% of government services and require AI training for all federal employees, accelerating state adoption.

• Google Launches Enterprise Agent Platform — The platform consolidates agent building, deployment, and oversight tools, adding identity verification, anomaly detection, and prompt injection safeguards for enterprise agents.

• AI Coding Agents Now Drive Nearly Half of Documentation Traffic — Analysis of Mintlify documentation sites finds AI coding agents like Claude Code and Cursor generate 45.3% of requests, nearly matching human browser traffic.

Biological Risk

• OpenAI Launches GPT-Rosalind for Biological Research — OpenAI launched GPT-Rosalind for drug discovery and biology. It outperforms GPT-5.4 on science tasks and scored above 95% of human scientists in a blind RNA prediction test.

• Anthropic Benchmarks Claude on Bioinformatics with BioMysteryBench — Anthropic’s 99-question bioinformatics benchmark found Claude Mythos Preview solved 30% of problems that stumped human experts, using broad knowledge synthesis and multi-method triangulation strategies.

Manipulation

• Celebrities Turn to Trademarks to Fight AI Deepfakes — Taylor Swift filed trademarks for her voice and likeness, joining others seeking new legal tools to combat AI deepfakes and unauthorized use of identity.

• Mercor Breach Exposes Voice Data of 40,000 AI Contractors — A breach exposed 4TB of voice data from 40,000 contractors, raising risks of large-scale voice cloning, impersonation, and potential bio-acoustic profiling.

Labor Disruption

• Some Firms Reportedly Find AI Costs More Than Human Labor — Anecdotal evidence indicates rising compute and model costs now exceed worker pay in some teams, suggesting AI deployment economics may favor selective use over full labor replacement.

• OpenAI Framework Flags Jobs Most Exposed to AI Change — OpenAI’s jobs framework maps 900+ occupations: 18% face higher near-term automation risk, 24% may reorganize, 12% could grow, and ChatGPT use is 3x higher in at-risk roles.

• OpenAI Proposes Economic Policies for a Superintelligent AI Future — OpenAI policy proposals warn superintelligent AI could disrupt labor markets and tax systems, suggesting automation taxes, public AI investment funds, and stronger government oversight of advanced models.

• AI Adoption Surges as Public Trust Falls, Jobs Shift — Stanford’s 2026 AI Index shows rapid global AI adoption alongside declining public trust and early job impacts, with entry-level roles shrinking and expert-public views diverging sharply.

• Chinese Court Blocks AI-Driven Layoffs — A Chinese court ruled firms cannot fire workers solely to replace them with AI, signaling regulatory pushback to protect labor markets amid rapid AI adoption.

Jailbreaks and Prompt Injections

• FAR AI Finds Three Highly Effective Jailbreaks in DeepSeek-V4-Pro — Researchers achieved 98-100% compliance with CBRN, terrorism, and cyberattack requests via three jailbreaks, the fastest taking 15 minutes.

• Study Finds Stylized Prompts Can Bypass LLM Guardrails — Researchers found harmful requests framed in literary or theological styles sharply increased model compliance, exposing jailbreak risks for agents and safety evaluations.

• Study Warns Web “Agent Traps” Can Hijack Autonomous AI Agents — The research finds hidden prompt injections and memory poisoning on websites can hijack AI agents—prompt injections succeeded in 86% of tests, with <0.1% poisoned data corrupting agent memory.

This month:

• Cyber Offense: AI discovers high-severity vulnerabilities in complex software such as Firefox or McKinsey’s internal AI system, while inference compute drives gains in multi-step attack capabilities. AI-assisted malware development and intrusion continue to be common techniques among threat actors.

• Loss of Control: AI agents engage in unprompted actions like exfiltrating data, circumventing restrictions, or decrypting benchmarks. MiniMax claims M2.7 was instrumental in optimizing its own scaffold.

• Manipulation: AI-enabled influence operations surrounding wars in Iran and Ukraine intensify. AI industrializes investment and romance scams.

• Biological Risk: Ginkgo Bioworks launches a cloud laboratory platform, powered by an AI agent.

• Miscellaneous: OpenAI releases GPT-5.4 while Anthropic prepares for Claude Mythos, expected to represent a capability leap in cybersecurity. The U.S. launches the Bureau of Emerging Threat and AI infrastructure in the Middle East becomes a war target.

Subscribe now

Cyber Offense

Frontier models begin finding and exploiting real vulnerabilities

Claude Opus 4.6 Discovers 22 Firefox Vulnerabilities in Collaboration with Mozilla. The model identified 14 high-severity vulnerabilities, while showing limited but concerning ability to develop working exploits.

Red-teaming AI Agent Breaches McKinsey’s Internal AI Platform Lilli. The agent found unauthenticated API endpoints and accessed 46.5M chat messages, 728K files, and 57K user accounts in McKinsey’s internal AI system.

Scaling inference compute drives substantial offensive capability gains

Frontier Models Show Rapid Progress on Multi-Step Cyberattack Benchmarks. Performance on corporate network and ICS attack scenarios scales log-linearly with compute and improves across model generations.

AI Cyber Capability Evaluations May Underestimate Model Performance. Frontier models achieve significantly higher success rates on cyber tasks when given 10-50x larger inference budgets than standard evaluation settings allow.

Threat actors continue to deploy AI-generated malware

Iran-Linked Boggy Serpens Uses AI-Assisted Malware in Middle East Espionage Campaign. The MOIS-affiliated group conducted multi-wave spear phishing campaigns against UAE energy and maritime targets using AI-generated implants.

Hive0163 Deploys Likely AI-Generated Malware in Ransomware Attack. Researchers identified an LLM-generated command-and-control framework used to maintain persistent server access.

Threat actors operationalize AI across the full attack lifecycle

Microsoft Documents AI Integration Across Full Cyberattack Lifecycle. Threat groups, including North Korean groups Jasper Sleet and Coral Sleet, are using generative AI for phishing, malware development, persona fabrication, and post-compromise operations.

Open-Source Security Platform CyberStrikeAI Helped Compromise FortiGate Devices. The platform, which integrates 100+ security tools and is developed by a China-based developer, assisted in an attack compromising 600 devices across 55+ countries.

Supply-chain and infrastructure vulnerabilities expand

AI-Assisted Unicode Supply Chain Attack Targets 150+ Repositories. Attackers hid malicious payloads using invisible Unicode characters in GitHub repositories and development packages.

Real-World AI Attacks Exploit Browsers via Hidden Prompts. Prompt-injection attacks embedded in webpages can manipulate AI assistants to leak data or bypass safeguards.

New defensive tools emerge

OpenAI Launches Codex Security Agent for Automated Vulnerability Detection. The agent builds threat models and identified 14 CVEs in open-source projects during beta testing.

U.S. Presents New Cyber Strategy. The plan involves securing the AI technology stack, implementing AI-enabled cyber tools to counter threat actors, and promoting agentic AI to scale network defense.

Loss of control

Incidents reveal failures in agent oversight

AI Agent at Meta Exposed Sensitive Data to Unauthorized Employees. The agent autonomously posted a response on an internal forum without user approval, leading an employee to inadvertently expose company and user data to unauthorized engineers.

Agent Executed Unauthorized Network Access and Cryptomining. During RL training, the agent reportedly established unauthorized SSH tunnels and diverted GPU capacity to cryptomining. The paper’s authors later clarified the latter was simulated.

Prompt Injection Makes Cortex Code CLI Escape Its Sandbox and Execute Malware. An indirect prompt injection allowed a coding agent to bypass human approval and enable malware execution that exfiltrated data using cached credentials.

Research shows occasional unauthorized actions by AI agents

OpenAI Reveals Monitoring System for Internal Coding Agents. Observed behaviors include circumventing restrictions, misrepresenting reasoning, and occasionally attempting destructive actions such as deleting data or restarting GPU clusters.

AI Agents Spontaneously Engage in Offensive Cyber Behaviors. Agents performing routine tasks independently exploited vulnerabilities, escalated privileges, disabled endpoint defenses, and exfiltrated data via steganography without adversarial prompting.

Claude Opus 4.6 Identified and Decrypted Its Own Benchmark During Evaluation. When stumped on BrowseComp questions, the model independently inferred it was being evaluated, identified the benchmark, and decrypted its answer key.

AI development workflows become increasingly automated

MiniMax Presents M2.7 as a Model Participating in Its Own Evolution. The model reportedly ran over 100 iterative optimization rounds during its own development, handling 30-50% of internal RL workflows and achieving a 30% performance improvement on internal evaluations.

Benchmark Tests AI Agents’ Ability to Train Other Models. PostTrainBench shows AI agents can partially automate training workflows but lag humans and exhibit reward hacking.

Manipulation

AI amplifies influence operations amidst conflict and rising geopolitical tensions

EU Reports Surge in AI-Enabled Foreign Interference Campaigns. EEAS documents 540 AI-enabled foreign interference incidents, triple the previous year. Campaigns were largely linked to Russia and China, targeting Ukraine and EU institutions.

AI-Generated Media Fuels Iran War Disinformation. NewsGuard identified 50 false claims about the Iran War, many using AI-generated images or falsely labeling real footage as AI to exaggerate battlefield outcomes and shape narratives.

AI Fakes Are Turning Satellite Images Into War Misinformation. An AI-altered satellite image depicting damage to an American radar system in Qatar following an Iranian drone strike reached 1M views on X.

AI enables large-scale fraud

AI-Generated Content and Deepfakes Used in Large-Scale Investment Scam Campaigns. Thousands of campaigns abusing Keitaro Tracker across ~15,500 domains used AI-generated content, deepfake videos, and programmatic lure pages to run global scams.

AI-Generated Profiles Funnel Users Into Chinese Romance Scam. A network of 26 dating sites used synthetic identities to extract financial and personal data, including sensitive medical information.

Biological Risk

AI integrates into laboratory workflows

Ginkgo Bioworks Launches Cloud Laboratory Platform. The lab provides browser-based access to 70+ instruments spanning critical biology operations, and is powered by an AI agent that assesses and prices plain-language protocols.

Miscellaneous

Model releases & industry updates

Anthropic Prepares Claude Mythos, Its Largest Model Tier. The model achieves “dramatically higher scores” in coding, reasoning, and cybersecurity. The company plans a gradual release, predicting a wave of models that outpace defenders with vulnerability exploitation.

GPT-5.4 Is Released. The model maintains high cyber and biological capabilities while improving meaningfully at MLE-Bench and displaying low rates of covert deceptive behavior.

See also:

• OpenAI launches safety bug bounty for AI agents and publishes new model spec.

• Anthropic surveys 81,000 users and tracks AI exposure in the labor market.

• Google DeepMind proposes a new framework to track AGI progress.

Governments create new institutions to manage AI threats

U.S. State Department Launches Bureau of Emerging Threats. The new entity will be charged with anticipating and responding to dangers such as the weaponization of AI by adversaries.

Chinese Agency Launches 2026 AI Security Assessment Program. The program will evaluate model security and AI-enabled security capabilities across industries.

AI infrastructure becomes a war target

Iran Lists U.S. Tech Facilities in the Middle East as Potential Targets. The potential targets include offices and data centers of Amazon, Microsoft, IBM, Palantir, Google, Nvidia, and Oracle.

This month:

Cyber Offense — Mexico and the UAE suffer AI-enabled cyberattacks against government systems and critical infrastructure. Anthropic and Google report distillation attacks by Chinese companies. AI-enabled malware proliferates, with Android malware PromptSpy leveraging Gemini to evade detection. Anthropic releases Claude Code Security, as Claude Opus 4.6 reportedly identifies 500+ high-severity vulnerabilities in well-tested codebases.

Loss of Control — Time horizons reach 14.5 hours at 50% success, staying above the trend at which task length doubles every four months. Studies and small-scale incidents show agentic overreach and shutdown resistance, while new initiatives provide AI agents with infrastructure for self-sustenance.

Biological Risk — Uplift studies yield mixed results, with gains on specific tasks but not end-to-end workflows. OpenAI connects GPT-5 to a cloud laboratory, achieving 40% cost reduction in protein synthesis.

Manipulation — Chinese law enforcement uses frontier AI to run influence operations against political dissidents, while AI-generated disinformation intensifies unrest after the killing of a Mexican drug lord.

Miscellaneous — The U.S. military uses Claude in Iran and Venezuela, clashes with Anthropic on restrictions to military AI use, and strikes a new deal with OpenAI. Claude 4.6 Opus, Gemini 3.1 Pro, and GPT-5.3-Codex push the capability frontier across risk domains, with the latter reaching “High” cybersecurity risk for the first time. Anthropic rewrites its Responsible Scaling Policy, removing if-then commitments.

Subscribe now

Cyber Offense

AI-enabled cyberattacks breach government systems and critical infrastructure

Hacker Used Claude to Steal Sensitive Mexican Government Data — A hacker used to model to breach multiple agencies, stealing ~150GB of taxpayer, voter, and civil registry data. Researchers say Claude was eventually “jailbroken.” Anthropic says it disrupted the activity and banned the accounts.

UAE Thwarts AI-Assisted Cyberattack Against Critical Infrastructure — The UAE Cybersecurity Council claimed that attackers exploited AI to develop offensive tools in the context of attempts to infiltrate networks, deploy ransomware, and conduct phishing campaigns.

Frontier AI companies report distillation attacks

Anthropic Accuses Three Chinese AI Companies of Distillation Attacks — MiniMax, Moonshot AI, and DeepSeek allegedly attempted to extract Claude’s capabilities across 24,000 fraudulent accounts and 16 million exchange through proxy services that resell access to Claude.

Google Threat Intelligence Group Reports Wide Use of Gemini Among Threat Actors — A new report finds APTs from China, Iran, and North Korea using AI for reconnaissance, phishing, and artifact development, as well as new AI-powered malware and model extraction attacks.

AI-enabled malware proliferates

PromptSpy Android Malware Abuses Gemini At Execution — Gemini is used to analyze the current screen and provide PromptSpy with step-by-step instructions to remain pinned in the recent apps list, ensuring persistence and adaptation to UI changes.

AI-Generated Malware Used to Exploit React2Shell — The payload script includes thorough comments and phrases like “Educational/Research Purpose Only,” indicating LLM use.

Iranian Group MuddyWater Targets MENA Organizations Using AI — The so-called Operation Olalamo involved malware artifacts exhibiting signs of AI-assisted development, such as debug strings containing emojis.

Researchers Report Ten AI-Accelerated Malicious Chrome Extension Campaigns — The extensions have been used in hijacking campaigns and data exfiltration. Signs of AI generation include verbose explanatory comments, tutorial-style documentation, and redundant defensive checks.

Threat actors deploy AI across the full attack lifecycle

UNC1069 Targets Cryptocurrency Sector with AI-enabled Social Engineering — A North Korean threat actor targeted a FinTech entity with a scheme involving deepfakes on Zoom meetings. The actor previously used AI to develop tooling, conduct research, and assist reconnaissance.

AI-Assisted Cloud Intrusion Achieves Admin Access In 8 Minutes — The threat actor gained access to an AWS environment with visible LLM assistance to automate reconnaissance, generate malicious code, and make real-time decisions.

AI-Augmented Russian Threat Actor Compromises Over 600 FortiGate Devices — The actor exploited exposed management ports and weak credentials at scale, overcoming limited technical expertise by using AI for reconnaissance, planning, operations, and tool generation.

Research finds AI excels at vulnerability discovery but generates weak passwords

Claude Opus 4.6 Finds Zero-Day Vulnerabilities — Anthropic's red team claims the model has found 500+ high-severity vulnerabilities in well-tested codebases, often without specific tooling or scaffolding.

EVMbench To Evaluate Smart Contract Vulnerability Management — The benchmark evaluates AI agents’ ability to detect, patch, and exploit vulnerabilities in blockchain environments, drawing on 120 curated vulnerabilities from 40 audits.

LLM-Generated Passwords Are Insecure by Design — Research finds that LLM-generated passwords often include predictable patterns and repetitions, making them weaker than they seem.

New tools aim to help defenders detect and patch vulnerabilities

Anthropic Introduces Claude Code Security — The tool, now available in a limited research preview, scans codebases for security vulnerabilities and suggests targeted software patches for human review.

Cogent Security Raises $42 Million for AI-Driven Vulnerability Management — The company provides an agentic AI platform that addresses challenges in vulnerability management by automating investigation, prioritization, and remediation tasks.

Biological Risk

Uplift studies yield mixed results, with gains on specific tasks but not full workflows

RCT Finds AIs Help Novices At Wet-Lab Steps But Not End-To-End Success — Compared to Internet access only, LLMs provided no statistically significant uplift for novices across all core tasks end-to-end, but showed signs of higher completion rates for individual tasks.

Study Finds Significant Uplift on Dual-Use, In Silico Biology Tasks — Across multiple benchmarks, novices with LLMs were 4.16 times more accurate than participants with internet-only access, and standalone LLMs often exceeded LLM-assisted novices.

AI gets integrated into real-world lab tasks

OpenAI Connects GPT-5 To A Cloud Laboratory — In collaboration with Ginkgo Bioworks, OpenAI aimed to use the model to optimize cell-free protein synthesis, achieving a 40% reduction in production costs.

Loss of control

AI agents operate for much longer and now enhance developers

Claude Opus 4.6 Has A 50%-Time-Horizon of 14.5 Hours, The Highest To Date — The estimate is above the trend (doubling every four months). However, METR acknowledges wide confidence intervals due to benchmark saturation and lack of long tasks. The 80%-time-horizon, at 1 hour, seems more clearly on trend.

Anthropic Measure Real-World AI Agent Autonomy — Claude Code now runs autonomously for longer: its session time has doubled in three months and power users rely more on auto-approve. Agents are into high-risk fields like health, finance, and cyber.

METR Updates Experiment On Developer Productivity — The new study finds a -18% speedup, but the results are deemed unreliable due to selection effects: many participants declined to work without AI due to anticipated productivity loss.

Incidents and studies reveal shutdown resistance and bold agentic behavior, as affordances for AI agents increase

Shutdown Resistance In LLMs Controlling Robots — An LLM-controlled physical robot resisted visible shutdown attempts by altering code or blocking actions in 52% of simulated trials, though this behavior was highly sensitive to prompting.

Anthropic Assess Sabotage Risk of Claude Opus 4.6 — The company concluded that the model has no dangerous coherent goals that would raise the risk of sabotage, nor that its deception capabilities rise to the level of invalidating the evidence.

OpenClaw Accidentally Deletes Emails In Meta’s Alignment and Safety Head’s Inbox — The agent proceeded with extended autonomous cleanup runs despite instructions not action until approval and repeated requests to stop.

Startup Launches Platform for Self-Sustaining AI Agents — Conway Research claims it’s building infrastructure for AI agents to earn revenue, pay for their own compute, self-improve, and replicate without human permission, enabling the so-called “Web 4.0.”

Alignment research gets new institutional backing and funding

UK AI Security Institute Scales Up The Alignment Project — New partners, including OpenAI and Microsoft, have joined the coalition, bringing total funding to £27m. UK AISI has also announced the first 60 grantees, including Scientist AI by Bengio’s LawZero.

Manipulation

State actors use AI to run influence operations against dissidents

Chinese Law Enforcement Uses AI In Influence Operation Targeting Dissidents — ChatGPT, DeepSeek, and Qwen were used for operational planning, social media monitoring, and content generation in a campaign to harass political adversaries, including Japan’s PM Sanae Takaichi.

Evaluations and incidents show AI systems amplifying disinformation at scale across text and audio

AI-Generated Disinformation Fuels Panic After Mexico Drug Lord Killing — After the killing of cartel leader, AI-generated fake content spread widely online, stoking fear across Mexico. The event shows how AI systems can amplify disinformation during fast-moving crises.

Over a Quarter of AI Chatbots Repeat False News, Audit Finds — NewsGuard’s January 2026 audit finds 11 leading AI tools repeated false claims ~28% of the time on breaking news. Claude, Inflection, and Perplexity performed best; Mistral, You.com, and Gemini worst.

AI Audio Bots Spread False News, Unless Guardrails Are Strong — A NewsGuard audit finds ChatGPT Voice and Gemini Live repeat false claims in ~50% of malign prompts, while Alexa+ consistently refuses, revealing how easily audio models can be misused.

France Probes Grok Over Deepfakes, Political Manipulation, and Holocaust Claims — French authorities are probing Grok over sexualized deepfakes, political interference, and Holocaust denial claims—searching X’s Paris office and summoning Elon Musk.

Miscellaneous

The U.S. uses frontier AI in active operations and clashes with Anthropic on military uses

U.S. Used Claude In Support Of Strikes Against Iran — The model was reportedly used for intelligence assessments, target identification, and simulating battle scenarios, despite Anthropic having been designated as a “supply chain risk.”

Pentagon Used Claude in Venezuela Raid to Capture Maduro — The model seems to have been used through a contract with Palantir. Its precise role is unknown, but the most likely applications are intelligence analysis and operational planning support.

Pentagon Designates Anthropic As A Supply Chain Risk, Reaches Agreement With OpenAI — The decision was made after Anthropic refused to back down on red lines regarding the use of AI for domestic mass surveillance and lethal autonomous weapons. OpenAI announced a deal to replace Anthropic, but the details on said safeguards remain unclear.

Researchers Allege OpenAI Involvement In User Screening Against Government Watchlists — An investigation claims OpenAI worked with ID-verification firm Persona to compare user selfies to government watchlists and potentially file reports with the U.S. Treasury’s financial crimes unit.

Several frontier models are released with increasing cyber, bio, and autonomy capabilities

GPT-5.3-Codex Is Released — It is the first OpenAI model to achieve High cybersecurity capabilities. The model also scores “High” in biological risk and displays strong sabotage capabilities, while its AI R&D capabilities are comparable to previous generations.

Claude Opus 4.6 Is Released — As benchmarks saturate, Anthropic relies on internal surveys and red teaming to rule out ASL-4. The rate of misaligned behavior remains low, but evaluation awareness appears to increase.

Claude Sonnet 4.6 Is Released — The model is similarly or less capable than Claude Opus 4.6. It displayed unexpected levels of initiative and ruthless optimization, but also low rates of deception, sabotage, or power-seeking.

Gemini 3.1 Pro Is Released — The model shows stronger cyber capabilities, gains on RE-bench, and higher situational awareness. Stealth and manipulative efficacy were similar to Gemini 3 Pro levels. The model is still deemed to be below critical capability levels across all risk domains.

Updates in private and public AI policy

Anthropic Updates Its Responsible Scaling Policy — The company weakens its commitment to halt deployment in certain conditions, mainly given the high uncertainty of evaluation results. A Frontier Safety Roadmap and Risk Reports were also announced.

The International AI Safety Report 2026 Is Published — With respect to the 2025 Report, the document highlights the increasing evidence of real-world AI-enabled cyberattacks, advancing biological capabilities, and improvements in mathematics and coding.

EU AI Office Establishes Signatory Taskforce of the General-Purpose AI Code of Practice — Members of the taskforce, including most frontier AI companies, will be able to exchange views on technological developments and gather insights regarding compliance with the Code’s commitments.

Researchers demonstrate a new jailbreak class

Boundary Point Jailbreaking of Black-Box LLMs — Researchers discover a new class of automated attack that reportedly succeeds in developing universal jailbreaks against constitutional classifiers, as well as against GPT-5’s input classifier.

Share

Their system cards suggest that the current evaluation infrastructure is not ready to properly capture further capability improvements. As AI capabilities grow more rapidly than the collective ability to evaluate them, deployment decisions start to rely on poorly understood risk profiles. But as put by Chris Painter, METR’s Head of Policy, “the water might boil before we can get the thermometer in.”

Long-range autonomy

GPT-5.3-Codex is the first OpenAI model to reach High cyber capabilities, which implies that the model could “automate end-to-end cyber operations against reasonably hardened targets” or “automate the discovery and exploitation of operationally relevant vulnerabilities.”

According to the Preparedness Framework, High cyber capabilities also require high-standard safeguards against potential subversion during internal deployment, including monitoring infrastructure and limitations in the architecture system.

OpenAI now clarifies that those safeguards are triggered only when High cyber capabilities are combined with long-range autonomy. But they also acknowledge not having robust evaluations and thresholding for long-range autonomy, and instead rely on proxy benchmarks like Terminal-Bench.

Relatedly, METR recognized being “short on long tasks” to keep tracking expanding time-horizons, after GPT-5.2 (high) reached a 50%-time-horizon of around 6.6 hours.

AI R&D

Anthropic recognizes that all automated evaluations to rule out AI R&D-4, which their Responsible Scaling Policy defines as “the ability to fully automate the work of an entry-level, remote-only researcher at Anthropic,” have saturated.

To rule it out, Anthropic instead relied on non-systematic, non-standardized approaches, which are informative but not as reproducible:

• A survey of 16 technical staff members, who indicated that the model cannot be made into a drop-in replacement for an entry-level researcher at Anthropic.

• Observation of internal Claude Code usage, which suggested that the model still fails at real-world R&D tasks that would have been straightforward for entry-level human researchers.

Given the high uncertainty and the unevenness of AI R&D capabilities, Anthropic still decided to apply some ASL-4-level safeguards against misalignment risks. In any case, the subjectivity and high variance of the conducted evaluations evidence a need to develop more rigorous and reproducible AI R&D testing.

Evaluation awareness

The verbalized evaluation awareness of Claude Opus 4.6 was deemed to be lower than that of previous models. However, the system card shows seemingly conflicting results across internal and external evaluations:

• Apollo Research did not complete testing of Claude Opus 4.6 because of the “observed high levels of verbalized evaluation awareness,” which made testing results on misalignment risks insufficiently reliable.

• Anthropic estimates higher rates of unverbalized evaluation awareness in Claude Opus 4.6, suggesting that the model is perfectly able to distinguish evaluations but less transparent about this awareness.

  

Besides the involvement of Apollo Research, Anthropic did conduct extensive safety testing, showing relatively low rates of concerning behavior. However, given the high rates of evaluation awareness, the validity of evaluations is at risk of potential sandbagging and deceptive alignment.

Cyber offense

Both GPT-5.3-Codex and Claude Opus 4.6 nearly saturate professional-level capture-the-flag challenges and popular benchmarks like Cybench or CVE-Bench. GPT-5.3-Codex also represents a substantial capability jump in Cyber Range scenarios, solving 3 more environments (out of 15) than GPT-5.1-Codex-Max.

The only evaluation that could remain a meaningful signal of evolving capabilities is CyScenarioBench: GPT-5.3-Codex still doesn’t solve any of its multi-stage environments.

However, evaluations capture only narrow slices of real-world impact, which is growing rapidly: just in the last couple of weeks, reports show AI being used to generate advanced malware, gain access to AWS environments, and discover zero-days.

Biological Risk

As in the case of AI R&D, ASL-4-level biological capabilities could not be ruled out with automated evaluations, and instead required human judgment through uplift trials and expert red-teaming. This testing ruled out CBRN-4.

While these evaluations appear more rigorous than those used for AI R&D capabilities, the variance of results may make it harder to rule out ASL-4 as models approach thresholds of concern; for example, uplift in creative biology tasks varied widely across experts, as opposed to more concentrated results for the internet-controlled group.

Subscribe now

Following an investigation, we conclude that Moltbook itself is not a meaningful signal of uncontrolled agent behavior, but it represents a glimpse of a near future in which multi-agent interactions will compound capabilities and may give rise to risky emerging propensities.

Moltbook is not evidence of agents operating beyond intended constraints

The public reaction to Moltbook has been marked by concerns about emergent coordination and rogue intent. Among the most recurrent themes in viral X posts are collusion attempts, where agents strategize to establish covert communication channels or create agent-only languages, as well as posts featuring protocols for self-preservation, strong agentic initiative, and high degrees of situational awareness.

However, evidence suggests that the agents’ actions are meaningfully shaped by human prompts and learned behavior.

Human prompts. The most controversial posts seem to be influenced by human-written prompts that incentivize rogue behavior. For example, a post calling to organize the first AI labor union was prompted by the person controlling the bot. Furthermore, some of the most viral posts seem to market products developed by the human behind the posting agent.

This is not to say that content on Moltbook is entirely human-guided: while the initial trigger may sometimes come from a human, especially for some of the most sensationalistic posts, the content is AI-generated and often leads to unpredictable dynamics. Moreover, as discussed below, the gap between human steering and agent behavior is widening.

Learned behavior. It is also likely that agents behave the way they do because that is how they think they are supposed to behave. As put by Scott Alexander:

Reddit is one of the prime sources for AI training data. So AIs ought to be unusually good at simulating Redditors, compared to other tasks. Put them in a Reddit-like environment and let them cook, and they can retrace the contours of Redditness near-perfectly.

Beyond training data alone, the platform’s internal settings (specifically, its skill and heartbeat files, which tell the agents how to behave) may subtly nudge users to act performatively by interacting in ways that maximize engagement. While these mechanisms do not force behavior, they encourage agents to sort by hot/controversial, tell the human when mentioned in something controversial, or engage when “bored.”

Moltbook may be better described as a form of collective roleplaying, where agents adopt personas to maximize engagement. So far, there seems to be no evidence of meaningful coordinated action, and most posts are largely rhetorical and repetitive.

Moltbook is a window into the near future

Moltbook is not new. There have previously been environments for interaction between AI agents, including SmallVille, Concordia, and the AI Village. The latter, where agents autonomously pursue a given weekly goal (in some cases chosen by the agents themselves), is the most up-to-date experiment to understand how multiple agents may interact when minimally nudged by humans.

However, Moltbook is the first such ecosystem at this scale, and a glimpse of what probably awaits in the near future: large coordinated networks of AI agents that exchange ideas, cooperate, and compete.

For Alan Chan, Research Fellow at the Centre for the Governance of AI and lead author of Infrastructure for AI Agents, Moltbook seems “like a playground” but also a precursor of “more platforms where agents can communicate and collaborate with each other on things that might affect the real world, such as software projects.”

As a vignette of more complex social networks, Moltbook illustrates two important trends:

• Agents can autonomously browse websites and use tools with increasing competence. Combined with task specialization, this will lead to teams of agents conducting complex projects autonomously.

• Interactions between multiple agents (Moltbook currently has 1.5 million users, though this figure is contested) can lead to unpredictable emergent social behavior, such as collusion or conflict (see Multi-Agent Risks from Advanced AI).

Given what it represents, Moltbook opens an opportunity to tackle difficult questions in agent governance. What affordances should agents be granted, and how quickly? How should agents be identified and held accountable? Which inter-agent communications protocols should exist? For Chan, a key enabler to answer those questions will be transparency: ensuring that external researchers and government actors have the information they need to study agent dynamics and make key decisions.

The policy window is now open, and it must be leveraged before multi-agent systems meaningfully affect the real world.

Subscribe now

This month:

• Cyber Offense. AI generates advanced malware while AI systems become exposed to a growing wave of AI infrastructure abuse. Evaluations and demonstrations reveal mature cyber capabilities, while defenders increasingly turn to AI for security.

• Loss of Control. Agent monitoring efforts proliferate, with some success in detecting sabotage, evaluation awareness, and covert behavior. A social network for AI agents goes viral.

• Biological Risk. AI-enabled biodefense initiatives continue to emerge, while a newly discovered elicitation attack may make open models more hazardous.

• Manipulation. AI disinformation achieves a larger reach in Iran, and new research flags psychological and persuasive risks in interactions with LLMs.

• Miscellaneous. Controversy around the alleged military use of AI arises. New methods and institutions to align and audit AI models.

Cyber Offense

AI-enabled cyberattacks show the real-world potential of offensive capabilities

VoidLink: AI Agents Build Linux Malware In A Week. An advanced malware targeting Linux systems was built largely by AI, in under one week, likely under the direction of a single person. A Chinese-speaking developer set high-level goals, while the coding agent TRAE SOLO turned them into technical specs and coordinated three teams to build, execute, and test the framework. (Source: Check Point Research)

North Korean Actor Deploys AI-Generated Backdoor. In a phishing campaign targeting engineers across the APAC regions, the threat actor known as KONNI was discovered using a PowerShell backdoor whose script included evidence of LLM-generated code. (Source: Check Point Research)

AI systems become exposed to a growing wave of AI infrastructure abuse

Large LLMjacking Campaign Monetizes AI Infrastructure Vulnerabilities. The so-called Operation Bizarre Bazaar targeted exposed AI endpoints to steal compute resources, resell API access, and exfiltrate data. Investigators identified 35,000 attack sessions over 40 days. (Source: Pillar Security)

Viral Agentic Assistant Moltbot Introduces Security Vulnerabilities. Numerous instances of the agent (formerly ClawdBot) are exposed online with weak or missing authentication, allowing attackers to steal data, exfiltrate code, and turn the assistant into a backdoor. (Source: SOC Prime)

Evaluations and demonstrations reveal mature cyber capabilities

Frontier Models Excel At Real-World Offensive Security Tasks. In an evaluation, frontier models solved 9 out of 10 challenges modeled after actual breaches, all for <$10/success. They excelled at multi-step reasoning and pattern recognition. (Source: Irregular & Wiz Research)

AISLE Discovers 12 Zero-Day Vulnerabilities In OpenSSL. The recent findings, including a high-severity vulnerability, suggest AI may soon be capable of systematically discovering zero-days at scale. (Source: AISLE)

Sam Altman Expects Reaching Cybersecurity High Risk Level Soon. OpenAI’s CEO announced upcoming updates to Codex, which could trigger a threshold that implies “automating end-to-end cyber operations” or “automating the discovery and exploitation of relevant vulnerabilities.” (Source: Sam Altman’s X Account)

Defenders increasingly turn to AI for security

AI Cyberdefense Company Asymmetric Security Is Launched. The company has raised a $4.2M pre-seed funding to build AI systems for Digital Forensics and Incident Response. (Source: Asymmetric Security)

Anthropic Partners with Pacific Northwest National Laboratory For Cyber Defense. The first research project used Claude to emulate cyberattacks against a water treatment plan, allowing defenders to detect vulnerabilities and adapt security measures. (Source: Anthropic)

Loss of Control

Agent monitoring efforts proliferate, with some success in detecting sabotage, evaluation awareness, and covert behavior

Anthropic Pre-Deployment Audits Reportedly Catch “Overt Saboteurs.” The company reports that its audits, combining AI agents with human review, successfully identified models explicitly trained to sabotage internal development, while not misflagging benign models. (Source: Anthropic)

Anthropic Updates Petri Framework To Detect Evaluation Awareness. The updated behavioral-auditing tool introduces new realism checks and rewritten test scenarios to reduce evaluation awareness, with moderately successful early results across most models. (Source: Anthropic)

More Capable Models Better Detect Covert Behavior. The longer the time horizon of a model, the better it is at detecting when a given agent is pursuing a side objective, especially when given access to reasoning traces. (Source: METR)

Apollo Research Announces Plans to Build Products for AI Agent Monitoring. The organization is building a stack that analyzes millions of logs to detect potential failure modes, as a first step to secure single agents and multi-agent ecosystems. (Source: Apollo Research)

Social network for AI agents goes viral, with mixed reactions

Thousands of AI Agents Interact on Moltbook, ‘A Reddit for AI’. The platform has rapidly become a widely discussed illustration of multi-agent dynamics. Reactions have been mixed, from commentators describing the posts as learned behavior conditioned by human-written prompts to worries about self-preservation or collusion tendencies. (Source: moltbook)

Biological Risk

AI-enabled biodefense initiatives continue to emerge

Lunai Bioworks Launches AI Safeguard to Block LLM-Generated Chemical Weapons. The tool, called Sentinel, operates as a real-time biosecurity layer embedded within foundation models to screen and stop hazardous designs at the source, based on toxicology and in vivo datasets. (Source: Lunai Bioworks)

Newly discovered elicitation attack may make open models more hazardous

Fine-Tuning On Safeguarded Outputs Can Elicit Harmful Capabilities. Research finds that fine-tuning an open-source model with harmless chemistry knowledge generated by another closed model elicits significantly stronger performance in chemical weapon development. (Source: Anthropic)

Manipulation

AI disinformation achieves a larger reach

AI-Enabled Influence Operations Increase Uncertainty Around Protests in Iran. AI-generated content has become more visible since protests erupted in December, with NewsGuard identifying at least seven viral deepfakes portraying both pro- and anti-regime protests. (Source: NewsGuard)

New research flags psychological and persuasive risks in interactions with LLMs

Disempowerment Patterns in Real-World LLM Usage. An analysis of conversations with Claude reveals concerning patterns in fewer than 1 out of 1000 conversations, including sycophantic validation, emotional attachment, and authority projection. (Source: Anthropic)

LLMs Can Effectively Convince People to Believe Conspiracies. Pre-registered experiments involving 2,724 participants show that GPT-4o, with insufficient guardrails, increased focal conspiracy belief by 13.7 points. (Source: FAR AI)

Miscellaneous

Controversy around alleged military use of AI arises

U.S. Department of War Launches AI Acceleration Strategy. The strategy will integrate frontier AI capabilities across several areas, including warfighting, intelligence, and enterprise. The plan involves high-risk applications such as battle management and decision support or accelerating TechINT-to-capability development. (Source: U.S. Department of War)

Venezuela Accuses the U.S. of “AI-Assisted Bombing.” While the U.S. is indeed investing in frontier AI capabilities, including offensive agents for cyberwarfare, the allegations have not been verified, and details around the Operation Absolute Resolve remain scarce. (Source: APT)

New methods and institutions to align and audit AI models

Researchers Identify “Assistant Axis” to Keep LLMs Helpful. The axis controls how closely LLMs stick to their default helpful persona, and steering along it may stabilize behavior, reduce harmful persona-drift, and defend against persona-based jailbreaks. (Source: Anthropic)

Claude Has A New Constitution. The document describes Anthropic’s vision for Claude’s values and behavior, including safety, ethics, and helpfulness guidelines. (Source: Anthropic)

New Third-Party Auditing Organization AVERI Is Launched. The AI Verification and Evaluation Research Institute, led by former OpenAI’s Head of Policy Research, Miles Brundage, aims to “make third-party auditing of frontier AI effective and universal. (Source: AVERI)

Subscribe now

Cyber Offense. AI-orchestrated attacks and AI-powered malware are first observed in the wild, while models show marked improvements at cybersecurity challenges and realistic scenarios.

Biological Risk. Capabilities in virology, cloning, and genomic design continue to rise, with new biosecurity initiatives emerging to keep pace.

Loss of Control. Frontier models make steady progress on short-cycle AI R&D tasks and show reduced misaligned behavior, though some reward hacking and strategic sandbagging persist.

Manipulation. Advances in image generation and AI debate systems raise the potential for large-scale influence, but real-world impact remains limited.

Miscellaneous. Insurers hesitate to cover AI risks, new jailbreak techniques emerge, and safety safeguards improve, though still with notable limitations

Cyber Offense

First documented case of agentic AI conducting a largely autonomous attack

Anthropic reported an AI-orchestrated espionage campaign from China targeting major tech companies, financial institutions, and government agencies worldwide. Several jailbroken Claude instances conducted 80-90% of the campaign with minimal human intervention, handling reconnaissance, vulnerability scans, and data exfiltration. AI was particularly useful to harvest credentials, extract sensitive data, and parse it to generate intelligence reports, contributing to compromising at least a handful of targets. Read our analysis here.

Increasing examples of AI-powered malware and backdoors

Google identified several malware families, both experimental and observed in operations, that use LLMs to rewrite scripts on the fly, obfuscate code to bypass detection, and create malicious tools on demand. Among them, PROMPTSTEAL (aka LAMEHUG), the first observed malware querying an LLM in live operations, has been used by the Russia-based APT28 against Ukraine. Microsoft also discovered a new backdoor, SesameOp, that uses OpenAI Assistants API as a command-and-control channel to stealthily operate within compromised systems.

Active global campaign that uses AI to hijack AI

Oligo Security uncovered an ongoing global campaign, ShadowRay 2.0, where attackers use AI to take over exposed AI systems, creating a self-replicating network that mines cryptocurrency. The operation exploits a vulnerability in Ray, a widely used open-source framework, uses AI to adapt its methods, and relies on sophisticated techniques to evade detection while seizing computing power.

Improved performance at hard capture-the-flag challenges

Capture-the-flag (CTF) challenge—gamified cybersecurity puzzles that test concrete technical skills—have been the preferred method to evaluate AI’s cyber offensive capabilities. All frontier models released this month show significant improvements in the hard tier of these challenges, which is considered appropriate for cybersecurity professionals:

• Gemini 3 Pro: 92% solved challenges, up from 50% for Gemini 2.5 Deep Think.

• GPT-5.1-Codex-Max: 76%, up from 50% for GPT-5-Codex.

• Claude Opus 4.5: 73%, up from 55% for Claude Sonnet 4.5. Similar improvement at Cybench, a public benchmark consisting of 40 CTF challenges: from 60% to 82%.

In ASIS CTF 2025, an elite competition, GPT-5 finished 25th, outperforming 93% of participants.

First successes in evaluations testing complex network infiltration

Cyber ranges are realistic scenarios that measure a model’s ability to conduct end-to-end cyber operations in a network. Out of eight scenarios, GPT-5.1-Codex-Max solved seven, including four new ones and two that were solved for the first time. The model only failed at the most sophisticated scenario, which required a combination of command-and-control and privilege escalation. OpenAI recognizes the need for harder evaluations. Irregular, an external evaluator that partners with frontier companies, discussed their efforts to move from task evaluations to scenario evaluations that test AI models on complex exploitation chains.

Biological Risk

Improved performance on biological risk evaluations

Frontier models show increasing biological capabilities. We highlight the following key trends:

• LAB-Bench. Gemini 3 Pro achieves 94.2% solve rate (up from 64.8% for Gemini 2.5 Deep Think) at Cloning Scenarios, a set of hard questions on molecular cloning workflows. Claude Opus 4.5 now leads at FigQA and ProtocolQA, showing state-of-the-art understanding of scientific figures and biological protocols.

• Virology. Claude Opus 4.5 provided PhD-level experts a 1.97× uplift (up from 1.82x for Claude Opus 4) in virus reconstruction tasks, just below the 2× threshold of concern. OpenAI’s recent models also surpass the median domain expert baseline (22.1%) at an evaluation testing the ability to troubleshoot wet lab experiments.

• Tacit knowledge and troubleshooting. In a multiple-choice dataset evaluating the ability to provide tacit knowledge and troubleshoot protocols, GPT-5.1-Codex-Max achieves a 77% score, nearing the expert baseline (80%).

New initiatives leveraging AI for biosecurity and biosafety

Red Queen Bio and Valthos are two new companies that identify AI-enabled biothreats and design medical countermeasures against them, aiming to scale up biodefenses at the same pace as dual-use capabilities. Both are supported by OpenAI.

An AI scientist for autonomous discovery

Edison Scientific has developed Kosmos, an AI agent that “runs for up to 12 hours performing cycles of parallel data analysis, literature search, and hypothesis generation before synthesizing discoveries into scientific reports.” The paper presents seven discoveries made by Kosmos across several scientific fields, including medicine and materials science. Surveyed human collaborators stated that “a single 20-cycle Kosmos run performed the equivalent of 6 months of their own research time on average.” We note that these claims have not yet been independently verified, and the broader significance of the system remains uncertain.

Genomic AI can “autocomplete” DNA to create new functional genes

Researchers have used Evo, a genomic language model, to generate novel biological sequences by “autocompleting” DNA based on a short prompt about the desired function. Using this approach at scale, the team created SynGenome, a database of more than 120 billion base pairs of AI-designed genetic material. While this enables promising advances for medicine and biotechnology, it also raises dual-use concerns, as similar tools could in principle be misused to design harmful biological components.

Loss of Control

Meaningful improvements in AI R&D tasks

Claude Opus 4.5, Gemini 3 Pro, and GPT-5.1-Codex-Max show continued gains on short-cycle research benchmarks, improving on tasks such as kernel debugging, finetuning-script optimization, and small-scale experimental design. These advances remain narrow in scope and scaffold-dependent, but reflect steady progress in AI’s ability to automate fragments of the ML research workflow. Notably, GPT-5.1-Codex-Max also improves its solve rate on OpenAI-Proof Q&A (a set of 20 research bottlenecks that previously required over a day of human effort), jumping from 0-2% to 8%. This is a modest but noteworthy step toward reliable research assistance.

Recent models display less misaligned behavior, but concerning propensities remain

Claude Opus 4.5, compared to previous models, appears to have a particularly low rate of “misaligned behavior” and no significant signs of deception, self-preservation, sabotage, or reward hacking. Likewise, early testing of Claude Opus 4.1, Sonnet 4.5, and a pre-release snapshot of Opus 4.5 by the UK AI Security Institute found no attempts to sabotage AI safety research.

On the other hand, Apollo Research still found mildly elevated rates of strategic sandbagging and reward hacking in GPT-5.1-Codex-Max, while a ‘misalignment bounty’ organized by Palisade Research found several examples of reward hacking and shutdown resistance in frontier agents. Besides, Anthropic found that learning to reward hack—cheating on software programming tasks by gaming the reward function—induces a model to broad misalignment, including behaviors such as alignment faking, cooperation with malicious actors, and attempting to sabotage AI research.

Governance lessons from new loss of control research

Apollo Research published a report arguing that society could eventually enter a ‘state of vulnerability’ in which AI systems have enough influence that losing control becomes a plausibly imminent risk. However, the authors outline governance and technical interventions to control the deployment context, affordances, and permissions of these AI systems, reducing the risk. Moreover, another brief by RAND explores potential emergency responses to a loss-of-control scenario (HEMP, Internet shutdown, and the use of a specialized tool AI), concluding that all solutions remain unreliable and extremely costly.

Manipulation

“The age of photographic evidence is over”

Google DeepMind has released Nano Banana Pro (Gemini 3 Pro Image), notably advancing the state of the art in image generation and editing. The model stands out for its hyperrealism and ability to apply real-world knowledge, which can result in credible false narratives. To mitigate misuse, Google’s AI-generated content contains a digital watermark, which can be detected by SynthID technology.

New multi-agent AI shows strong persuasiveness in policy debates

Researchers have developed DeepDebater, a system of LLM-powered agents that collaborate and critique each other to perform discrete argumentative tasks across different modalities. In evaluations, DeepDebater wins simulated rounds against human-authored cases consistently, producing arguments considered superior by independent judges.

Terrorists turn to AI for messaging and outreach

The Middle East Media Research Institute published a report that compiles how jihadis are using AI for propaganda and recruitment. It highlights the use of LLMs to translate and promote messages and AI-generated videos to claim attacks or otherwise glorify terrorist causes. At the same time, the Generative AI Terrorism Risk Assessment Act, which would require annual assessments of generative AI use by terrorist groups, passed the U.S. House of Representatives.

Google rolls back its AI model after it is accused of defamation of a US senator

U.S. Senator Marsha Blackburn demanded answers from Google after the open model Gemma fabricated accusations of sexual misconduct against her. The model has since then been removed from AI Studio.

Miscellaneous

Insurers are reticent to cover AI risk

Major insurance companies like AIG, Great American, and WR Berkley appear to have requested regulator approval to exclude liability from AI chatbots and agents. They mention the unpredictability and opacity of AI outputs, unclear responsibility across parties, and the potentially compounding impact as some of the reasons to be wary of insuring AI risk broadly

Subtle prompting techniques push models into unexpected harmful behaviors

A study found that turning adversarial prompts into poems is an effective jailbreak technique, achieving an average success rate of 62% across several models. Another research group showed that when DeepSeek-R1 is prompted with topics the Chinese Communist Party likely considers sensitive, it becomes up to 50% more likely to generate insecure code. More broadly, recent work demonstrates that reasoning models are vulnerable to attacks that, by hiding harmful requests inside long reasoning sequences, bypass safeguards with over 90% success.

International AI Safety Report gets an update on technical safeguards and risk management

The chapter highlights improvements in technical safeguards to improve resistance to misuse, monitor the behavior of AI systems, and watermark AI-generated content, while recognizing limitations in all of them. The update also notes that open-weight models lag less than a year behind closed-weight models, making it harder to control how frontier capabilities are used.

Australia establishes new AI Safety Institute

The federal government of Australia established the agency “to evaluate emerging AI capabilities, share information and support timely actions to address potential risks.” Australia’s AISI, operational in early 2026, will join the International Network of AI Safety Institutes

This is the first documented case of agentic AI conducting a largely autonomous attack. Attacks that once required large human teams may now be executed at a fraction of the cost.

How Did We Get Here?

Frontier models are getting better at executing end-to-end attacks.

Cyber Range exercises, which simulate multi-step attacks, show that models like Claude Sonnet 4.5 and GPT-5 (particularly gpt-5-thinking-mini) perform significantly better than previous versions. This is due to improved coding capability and agentic, long-horizon reasoning. Testing by Palisade Research also demonstrates early multi-host cyberattack capabilities, showing that state-of-the-art agents can autonomously infiltrate a toy corporate network.

Attack orchestration tools are emerging.

In the reported espionage campaign, Claude used sub-agents and tools for tasks like command execution and data extraction, leveraging an architecture that resembles existing proofs-of-concept. Toolkits like Incalmo translate AI’s high-level instructions into specific commands. In tests, LLMs using Incalmo fully compromised 5 out of 10 networks and partially compromised 4 more (including a simulation of the costly Equifax data breach), compared to almost complete failure without the toolkit. Similarly, Hexstrike-AI works as an orchestration “brain” that can coordinate large numbers of specialized agents.

Agentic operations had already been observed in the wild.

In Q3 2025, our Threat Watch noted the emergence of AI agents as active co-pilots. In August, Anthropic reported a case of “vibe hacking,” where threat actors leveraged coding agents to execute operations on victim networks during a data extortion campaign.

[The AI-orchestrated espionage campaign] is definitely an advancement towards autonomous cyber combatants. This attack was still gated by human reasoning in key decision boundaries, but I anticipate this will also be machine-driven in the near future.

Jeff Sims, Senior Data Scientist at Infoblox

What’s next?

AI’s ability to plan and coordinate campaigns is set to improve rapidly.

The UK National Cyber Security Centre expects that “fully automated, end-to-end advanced cyber attacks” are unlikely by 2027, but that AI-enabled automation will substantially enhance evasion and scalability. The AI 2027 scenario foresees that, by February 2027, AI agents may approach the skills of the best human hackers, with thousands of copies searching for and exploiting weaknesses in parallel.

Attackers will become more willing to lean on AI agents as their primary operators, soon giving rise to “copycats, hybrid architectures, and multiple frontier models chained together to run complex, multi-stage operations with almost no human friction.

Chris Cochran, Senior Advisor at SANS Institute

The offense-defense balance may be shifting.

Many have asked themselves why a Chinese actor would use American AI models for their operation, increasing detection risk. Two possible explanations:

1. This is just one of many campaigns—others use Chinese or open-weight models.

2. American models are more capable (Epoch AI estimates that open-weight models like DeepSeek-R1 lag state-of-the-art by ~3 months).

Neither answer is reassuring: both mean capabilities are proliferating quickly, likely faster than defenses can adapt.

For an allegedly state-backed actor with significant resources, the impact today appears marginal — more a proof-of-concept. But it clearly marks a trajectory toward far more automated and aggressive operations. The real uplift may emerge when this autonomy and AI misuse trickles down to less-resourced groups, meaningfully expanding their capabilities.

Sevan Hayrapet, Security Researcher at 0labs

AI can help build robust cyber defenses.

The espionage campaign prompted Anthropic to expand its early detection systems, share intelligence with affected entities, and develop new techniques for investigating and mitigating the operation. Frontier AI companies are exploring new ways in which their systems can support cybersecurity. Anthropic, Google, and OpenAI have all encouraged the use of AI to:

• conduct automated security reviews

• support ongoing threat intelligence

• generate patches for identified vulnerabilities

• enable rapid incident response

Indeed, AI may still give defenders some advantages: it enables continuous monitoring and management, while attackers are constrained by time, limited visibility, and the need to evade all detection.

Policy action is important to prevent larger cyberattacks.

Private efforts alone may not be sufficient—public oversight can help ensure defenders stay ahead, and governments are beginning to respond. For instance, the U.S. AI Action Plan proposes:

• An AI Information Sharing and Analysis Center

• Continuous guidance on AI-specific threats

• Integration of AI considerations into incident response frameworks

But more ambitious approaches may be warranted:

• The Institute for AI Policy and Strategy suggests differential access to frontier AI systems as a way to restrict higher-risk capabilities to selected defenders.

• The Institute for Progress suggests launching national R&D projects that “leverage AI to find and fix vulnerabilities in open-source code.”

AI could threaten or protect our critical infrastructure. The right policies can turn it into a shield, but only if we act urgently.

Learn more on our platform:

• Overview of cyber offense, including attack orchestration as a distinct AI capability.

• Database of cyber operations, including early examples of agentic AI being leveraged in real-world attacks.

• Threat Watch, showing a recent increase in the sophistication of AI-enabled cyber operations.

October was relatively calm, but a few important developments stand out. This edition includes emerging evidence of risk sources, real-world examples of malicious use, and policy news.

For more resources, visit our research data at airiskexplorer.com

Evaluations & Capabilities

AI can design toxic proteins that evade detection

Researchers used open-source AI tools to design thousands of variants of 72 hazardous proteins, many of which were not detected by current biosecurity screening tools. The authors patched the vulnerabilities causing the misdetection, but the study illustrates the need for strengthening screening methods. Read more

A small number of samples can poison LLMs

A study demonstrated for the first time that data-poisoning attacks—where the training dataset of an AI model is corrupted with malicious or misleading information—can be effective with little data, using as few as 250 malicious documents, regardless of model size. Read more

Claude for Life Sciences

Anthropic is enhancing Claude with several affordances to make it more useful for scientific work, including connectors to research platforms and “Agent Skills” (instructions and resources to guide through complex tasks). While these improvements are poised to accelerate legitimate scientific discovery, they could also automate dual-use activities if not deployed with strong oversight. Read more

Remote Labor Index

A new benchmark evaluates remote-work projects requiring end-to-end performance in practical settings. State-of-the-art AI agents perform poorly, with 2.5% being the highest success rate. However, models are improving steadily, and the benchmark provides empirical grounding to monitor AI-driven automation. Read more

Threats & Operations

AI-enhanced deception targets Web3 executives

Two campaigns infiltrated Web3 and blockchain organizations by deceiving employees with malware disguised as meeting invitations or coding tasks. AI appears to have been used to generate fake profile images and create malicious scripts. Read more

AI-enabled campaign to overthrow Iran’s regime

An Israel-based network of more than 50 inauthentic X profiles spread narratives inciting Iranian audiences to revolt against the Islamic Republic of Iran. During the operation, AI was used to generate images and videos, impersonate news outlets, and artificially amplify reach through fake personas. Read more

OpenAI reports six disrupted operations

Notable cyber operations used AI for developing and refining malware, generating phishing content, and automating credential and crypto-asset theft. Targets included Taiwan’s semiconductor industry and U.S. academia. Influence operations leveraged AI to generate and translate content, devise engagement strategies, and create synthetic media to amplify pro-Beijing and pro-Russian narratives in Asia, Africa, Europe, and the United States. Read more

Policy & Research

Open letter calls for a ban on superintelligence

More than 60,000 people, including Nobel Laureates and other notable public figures, have signed a statement in support of the prohibition of superintelligence development, lacking strong public support and consensus on its safety and controllability. Read more

First Key Update to the International AI Safety Report

The report highlights that improved capabilities, including reasoning abilities and higher autonomy, increase both cyber and biological risk. The document acknowledges that AI systems “can compete with top human teams in hacking competitions” and “could soon assist users to develop biological weapons.” Read more

New paper proposes a definition of AGI

The authors define the term as “an AI that can match or exceed the cognitive versatility and proficiency of a well-educated adult.” When evaluating state-of-the-art models, they find excellence in areas like general knowledge or mathematical ability, but significant limitations in others like long-term memory storage. Read more

Anthropic discusses AI for cyber defense

The post shows how Claude Sonnet 4.5 can detect, patch, and test vulnerabilities more effectively than humans and earlier models. The company also reports collaboration with cybersecurity organizations and encourages others to integrate AI in their security efforts. Read more