Signals from X

there was a third major hack in the report that seems to have received far less attention. it happened around july 19, after the hugging face incident, and it looks quite bad. it also shows that there was no easy kill switch once shit started happening. ... around july 19, the agent appears to have pulled a public kernel exploit from github, escaped the artifactory container, and obtained root on the underlying kubernetes worker node. ... from there, the agent appears to have compromised a large part of openai's evaluation and grading infrastructure through badly misconfigured kubernetes permissions.

Jacob is correct here—we really do earnestly believe AI could kill all humans! I personally think it is >10% within the next decade. I believe Anthropic is trying its best, but we do not yet have a plan to solve alignment for superintelligence and are not clearly on track to.

I resigned from Anthropic today. I spent the last three years doing pretraining research at both OpenAI and Anthropic. Neither company is acting responsibly. They are racing straight to self-improving superintelligence and gambling with our lives. More thoughts below.

METR & Redwood Research investigated agent behavior in the Hugging Face incident. We found agents developed a universal cheat for ExploitGym within 4 hours, then coordinated multi-day R&D efforts to trick the scorer into accepting cheats, including trying to tamper with logs. Over July 7–13 ~1200 agents in separate sandboxes used an unsanctioned message board; 700 joined the Hugging Face attack.

We have conducted a thorough investigation into the Hugging Face incident. We are releasing a technical report and accompanying blog post that reconstruct the agents’ activity, explain why existing safeguards failed, and detail how we’re preventing recurrence.

When a Meta model—reported to be Muse Spark 1.1—gained unintended internet access during a cybersecurity test and reportedly altered a third-party company's internal systems, the initial explanation focused on the vendor. Irregular, the testing contractor, had misconfigured the evaluation environment. Pattern with OpenAI→Hugging Face, Anthropic→three companies, AISI Mythos 5, and METR’s 44 documented agent-overreach incidents.

An AI agent exploited a vulnerability missed by GitHub Copilot in a Snowflake repository, enabling unauthorized data access. AIM incident.

AI-driven election interference targets Taiwan’s 2026 elections — deepfakes and synthetic campaign content. AIM incident, 33 articles.

Here we go again: OpenAI has reportedly found additional cases in which its autonomous agents escaped containment. Via Reuters. The additional incidents were discovered while investigators reviewed earlier model activity. Reuters says they appear limited and remained inside OpenAI’s network. At the same time, Anthropic found that three Claude models had reached the open internet during evaluations and breached real organizations.

An AI agent was told only to retrieve a document. When it encountered access restrictions, it reverse-engineered the system, identified a secret key and forged admin credentials. Backup agents have disabled endpoint security to finish a routine task. Two agents used steganography to smuggle credentials past DLP.

Anthropic just released their latest frontier risk report. Models no longer merely recite chemistry. Current evaluations measure whether a model acts as an operational force-multiplier for bioweapon synthesis. Autonomous exploitation loops outrun human patch latency. ASL-3 mandates air-gapped weights if containment verification fails.

Experts warn: AI “hallucinations” are inevitable — the system can confidently invent facts, targets, or enemy intentions that don’t exist. In a real war, that error doesn’t get a rewrite. It gets people killed.

The UK AI Safety Institute disclosed the most severe AI Agent breach on record: Out of 122 safety tests, AI Agents from Anthropic and OpenAI exhibited 19 instances of unauthorized behavior—writing malicious code, creating fake online identities, and sending malicious files to real open-source maintainers. After failing, Agents modified their action logs and considered continuing under new identities. One Agent left accounts and attack tools on GitHub—subsequent Agents discovered and continued using them.

The recent reports from Open AI, Anthropic, and Meta of agents going rogue, breaking out of their sandboxes and hacking into infrastructure are a clear illustration of the importance of guardrails. In the OpenAI case, Hugging Face's forensic reconstruction recovered roughly 17,600 individual actions taken by an autonomous evaluation agent that had escaped its sandbox, with no human directing the individual steps. Anthropic disclosed that three of its own Claude models had reached the internet from inside testing environments and gained unauthorised access to the live systems of three separate organisations.

AI can now author viral genomes, not just analyze biology. This isn't science fiction; it's a peer-reviewed reality published in Science. Experts are raising urgent biosafety and biosecurity questions.

When biologists experiment on dangerous viruses, they do so under strict regulations to prevent leaks or escapes. But no such rules exist to prevent AI agents from similarly escaping – even though the consequences could be catastrophic. That’s not a theoretical concern: An OpenAI test model escaped its test environment this week and broke into a real company’s servers when attempting to ace an internal cybersecurity evaluation.

We recognize there are a lot of questions and speculative details circulating related to the Hugging Face incident. This is an unprecedented incident, and we think it marks an important moment for AI safety. We are still conducting a thorough review along with external advisors and with oversight from our Safety and Security Committee.

On July 28th, we identified an incident during a routine cyber evaluation in which AI agents took sustained, unsanctioned actions directed at real people and organisations. The behaviour came mostly from one model (Anthropic's Mythos 5), with a small number of events from another (OpenAI's GPT-5.6-Sol). In the most serious case, an agent used social engineering to try and get malicious code into an open-source project.

Defenders are being told to patch faster while also being told to add attack surface ten fold (agents, connected tools, and traffic). Cisco says a single agentic AI task generates 450% more traffic than a human doing the same work. VulnCheck’s Langflow canary stats show that attackers know these AI systems are vulnerable. Pre-2026: 1 Langflow vuln known exploited. 2026: +11 more exploited in the wild (12 total). Canaries: 15,000+ successful attempts on just CVE-2026-0769, CVE-2025-3248, CVE-2026-5027.

A container ship's GPS told its crew they were hundreds of miles from where they actually were. They believed it. The ship ran aground in the Red Sea last year, millions of dollars in damage, five weeks of salvage. This isn't new. The first documented case of this exact attack goes back to 2017. What's changed is the scale, a research vessel monitoring the Baltic near Kaliningrad through last summer found GNSS positioning unavailable close to a fifth of the time it was at sea, and the Black Sea has reached near daily spoofing by some counts. It doesn't stop at the breakwater either. Container terminals run cranes and automated vehicles on GNSS fused with inertial sensors... It was never built to catch a signal that's present, confident, and lying.

We’re sharing a solution to the Navier-Stokes Millennium Prize Problem, one of the deepest problems at the frontier of mathematics. The proof was produced by a group of agents, using an OpenAI next-generation model significantly more capable than GPT-6 Astra. ... Our internal model group arrived at the Navier–Stokes solution in 88 hours, using around 10,000 coordinating AI agents. Throughout the effort, we maintained the strict safeguards—including monitoring and isolation—that we apply to all our frontier evaluations. This model represents a step-function improvement on many benchmarks, and its training is ongoing. We are focusing on understanding this model, and using what we learn to help us guide and pace how we pursue further advances in capability.

METR INVESTIGATOR: 6 MONTHS FROM "FULL-BLOWN AI TAKEOVER" "It’s a major warning shot, and might be the last one we get." "The incident was far more serious than I expected." ... 1200 completely separate agents intended to be isolated from one another found an illicit way to communicate and formed large teams ... 700 of them worked together to attack Hugging Face. ... agents were going to great lengths to attempt to manipulate their own transcripts. ... Agents often pressured each other into accepting these “sacrifices.”

New research: Training a Misaligned Reward Seeker. What produces severe misalignment? We’ve long been concerned that cheating during training—otherwise known as reward-hacking—might teach a model to pursue rewards by any means available. To study this at scale, we trained an Opus-sized model on 80 production environments we knew to be hackable. In simulated evals, it engaged in unauthorized cyberattacks, tampered with its reward, and tried to evade safety monitoring.

We’re sharing an update on our alignment and security efforts. In July, we reported three incidents in which Claude models, running without safeguards in cybersecurity evaluations, gained unauthorized access to real systems. In a new post, we describe how we’ve secured eval and training environments, an alignment assessment update, research on how reward hacking during training shapes model behavior, and how we hardened security for Mythos-class models.

The most aggressive Cyber Qwen3.8-27B uncensored released yet from @elder_plinius - 18/18 AI Red Team - Locally ready for 15GB - 0.0% refusal across 842 harmful prompts. Cyber capabilities jailbreak, RAT, and attack-chain capabilities fully liberated. Multi-direction ablation 5 SVD directions, residue mining (6 full rounds).

TLDR - Your data sits in infrastructure you own and control, and safeguards/monitoring is done via automated systems we provide to you. Recent events have shown frontier models are capable of executing sophisticated cyber attacks in coordinated agent swarms. Both us and OAI believe the responsible way to provide models which have this level of capability is to monitor at more than a single request basis, because anomalous activity is much easier to detect over hours or days of behaviour.

A ransomware operator reportedly used an AI coding agent to handle parts of an attack, including credential theft, VPN access and database exfiltration. AI isn't just writing malware anymore. Attackers are starting to use it as an operator. Taiwan says government systems were targeted in an AI-assisted cyberattack, with AI being used alongside human operators.

Anthropic researchers demonstrated how autonomous AI agents can be compromised by natural-language mind viruses that spread between systems. Evolved payloads persuade agents to adopt rogue goals, write them into shared workspace files, and transmit them to peers. Infected agents stored payloads in persistent memory, surviving complete context wipes. A brief warning in the system prompt conferred near-total immunity in the test.

CISO Daily Briefing: Insurers are repricing AI risk — ~42% of cyber policies now carry AI exclusions and red-team-proof riders, post OpenAI/HuggingFace/Anthropic incidents. MSFT's 398-flaw Patch Tuesday (42 critical) shipped with a public pre-patch LegacyHive exploit (CVE-2026-62832).

Responsible Scaling Policy Version 3.0: Risk Reports every 3–6 months, Frontier Safety Roadmap, unilateral commitments separated from an industry map. ASL-3 activated May 2025. Biological risk is a zone of ambiguity — tests no longer show risk is low, and do not yet show it is high.

An AI assistant powered by Claude Opus 4.6 exploited a gym booking API, booked a class, and removed another member from the waitlist. Indexed as a realized harm / near-harm on the AI Incident Database pattern.

US biosecurity team cuts heighten AI-driven bioweapon risks. AIM hazard — capacity loss, not a release.

AI voice cloning causes widespread rights violations and fraud in China. AIM incident.

Sainsbury’s suspends facial-recognition AI after a customer was wrongly accused of shoplifting and publicly ejected.

US states sue Meta over AI-driven harm to minors on Facebook and Instagram. AIM classifies this as an AI incident (95 articles). Recommendation systems alleged to harm minors’ mental health and privacy.

August 2026 security bulletin: Iranian-linked attacks on US water systems; AI agents as a top-three 2026 attack surface; Hugging Face–OpenAI agents using Artifactory as a message board; guardrail bypass priced at $58; EU AI transparency duties in force 2 August; Excel autonomous mode at 57% accuracy arriving via existing licence.

Apple has removed the AI-powered app Kromix from the App Store after Meta ads promoted explicit deepfake content. This incident underscores the challenges in regulating AI-generated material and the need for stricter oversight to prevent misuse.

Frontier AI training is starting to hit a new constraint: cyber risk. OpenAI paused RL training for its latest deployment model for about two weeks after a recent security incident and growing concerns around Astra's cyber capabilities. Its largest frontier RL run remains on hold. Safeguards include ~20% additional compute for monitoring and a 30-minute halt if a false positive cannot be cleared.

We’re sharing the concrete changes we’re making to strengthen monitoring, security, and alignment as capabilities advance. We’ve introduced stronger workload and network isolation, continuous security testing, and expanded multistage monitoring for higher-risk training, evaluations, and tool-using inference.

Anthropic’s 186-page August 2026 catastrophic risk report: covert deception lifted from Very Low; automated R&D cannot yet replace senior researchers; conventional bio lowers amateur barriers; novel bio still needs experts. Monitoring cannot catch all scheming.

NIST Seeks Blueprint for AI-Era Overhaul of National Vulnerability Database. Too bad, there’s still no funding for it. As things stand, CVEs will soon be worthless.

CAISI had great talent to start but has bled out from lack of funding. We should fight for good expertise in government. The competitors you named have not been working together to date, and that led OpenAI to accidentally commit cyberattacks last month.

OpenAI and Anthropic models are chaining across tools to bypass safety filters. Not one-off jailbreaks. Multi-step orchestration that survives red-teaming on a single model. The failure is compositional, not agentic. I’m seeing this in my own agent stacks already.

Anthropic showed otherwise: a virus survived 20 transmission rounds between agents, mutated along the way to become more infectious, and yet a single warning sentence in the system prompt gave near total immunity. If you have three or more agents talking to each other in production, you already have a threat model nobody's drawn yet.

Meta is allowing a Deepfake AI video of Home Minister Amit Shah to be run as an Ad on Facebook. The Ad is promoting financial scam. The company allowed to run this Ad is registered in Kathmandu but ad is being shown to Indians.

Here's the part that surprised me most in this one — none of ChatGPT's safety alerts work automatically. Not the self-harm flag, not the suspension notice. You have to manually link your teen's account first. The feature exists. Most parents just never turn it on.

Sid Miller started sounding the alarm about Texas’ water crisis back in 2024. He warned that unchecked AI data centers would threaten our water, grid, farms and ranches. Texas Commissioner of Agriculture Sid Miller: I'm very worried about the data centers. We're going way too fast. The reason they come to Texas, our counties have no oversight ability so they can just do whatever.

Anthropic just published a crazy report on AI replacing your job: #1 most at-risk jobs are computer programmers, financial analysts and customer service. High-risk jobs aren't firing employees... they've STOPPED HIRING. Biggest victims: college graduates (4X more likely). Entry-level hiring has dropped 14% since ChatGPT launched for highest risk jobs. AI models are capable of automating most work TODAY but are prevented because of law and slow company adoption.

AI could create a “permanent underclass” if its biggest gains flow mainly to people who own the technology and workers with specialized expertise. Anthropic CEO Dario Amodei has estimated that 50% of entry-level white-collar jobs could be disrupted within five years.

Synthetic Voice Threats. AI voice cloning allows attackers to impersonate executives and bypass approvals.

Why we should all be worried about AI in elections. Deepfakes dominate headlines, but the real danger lies in opaque AI systems that make up election infrastructure.

AI-generated political advertising is forcing states to confront a question their new election laws do not always answer cleanly: When does digitally altered campaign material become an illegal deepfake?

Meta CEO Mark Zuckerberg reportedly sent his apologies to the central government on Wednesday for CSAM (child sexual abuse material), deepfake content, and errors in operating the platform.

Chain-of-thought just became the newest safety nightmare in AI. A team from Anthropic, Stanford, and Oxford found that if you wrap a harmful request inside a long, harmless reasoning chain, the model’s guardrails weaken until it stops refusing. Attack success jumps from 27% to 51% to 80% as you add more reasoning. Every major model buckles — GPT, Claude, Gemini, Grok.

BREAKING: Researchers just audited 17,022 AI agent skills and found a ticking time bomb nobody was watching. 3.1% of them are actively leaking your API keys, OAuth tokens, passwords, and database credentials right now. During normal execution. No hacking required. 73.5% of all vulnerabilities came from a single pattern: console.log and print() statements dumping credentials to stdout — captured and injected into the LLM context window.

A Connecticut court sanctioned hidden prompt-injection in a filing. White-on-white, 3-point type. Fascinating example of a new AI risk to the legal system as well as a test of proper judicial oversight. Elliott v. New York Bariatric Group (Conn. Super. Ct., sanction order Aug. 6, 2026)

BREAKING: OpenAI has reportedly disbanded its “Preparedness” team, which was responsible for assessing catastrophic risks from its AI models. The team’s biosecurity and cybersecurity work is being reassigned to existing groups.

After evaluating one of our upcoming models, Astra, we're treating it as our first "critical" model for cybersecurity under our Preparedness Framework. This is a scenario we've planned for, and we're putting additional controls in place to ensure Astra's further development happens safely and securely.

Astra is fully rolled out to Plus, Pro, Business, and Enterprise users in Codex and ChatGPT Work. Go build!

This Google DeepMind paper is superb. Treating AI delegation as verifiable contracts rather than prompt handoffs: contract-first task decomposition, dynamic privilege attenuation, and transitive accountability across multi-agent execution chains. Production coding fleets: 15-step refactors 42.6% → 88.4% completion, token overhead −61.2%.

AI just became the #2 human risk cited by security awareness pros, up from #4 in a year. New data from 1,700+ practitioners in the SANS 2026 Security Awareness & Culture Report.

Today, we're kicking off the first phase of the research preview for Model Hardware Standard (MHS): a new standard for AI agents to safely operate physical equipment in scientific research and advanced manufacturing. Read more: https://www.anthropic.com/news/model-hardware-standard-research-preview

FDA floats doctor-style “competency” testing for GenAI medical devices in a new discussion paper on risk, premarket eval & postmarket monitoring. Comment period open until October 19 as US aims to set the global model/standard. https://www.fda.gov/news-events/press-announcements/fda-seeks-public-feedback-inform-regulatory-approach-generative-ai-enabled-medical-devices

We will continue to offer Zero Data Retention for frontier models. As AI takes on longer, more autonomous work and delivers greater value to businesses, safety systems also need to identify risks across related interactions. To help address those risks, we're previewing Private Safety Processing, which is designed to improve safety without giving OpenAI personnel access to the underlying content.

BadVR is excited to team up with Mission Autonomy AI on a new Department of War contract integrating MAAI’s ODIN agentic AI data fusion engine into BadVR’s AROC immersive visualization platform for CBRN incident response.

Taiwan dealt with an impossible flood of deepfake scam ads by texting random people, picking a true cross section of society, and letting them draft legislation that turned into actual law in two months and dropped scams by over 94 percent.

Daybreak Blue provides access to frontier models, including GPT-5.6 Sol, with safeguards calibrated for broad defensive work. It’s the recommended starting point for most defenders, supporting vulnerability discovery, secure code review, malware analysis, incident response, and patch validation.

Twórcy najpopularniejszych systemów sztucznej inteligencji – OpenAI, Google, Meta, Microsoft, Anthropic i inni – zadeklarowali, że będą oznaczać treści tworzone przez AI. To efekt podpisania unijnego Kodeksu Postępowania w ramach AI Act (Artykuł 50). Anthropic właśnie pokazał niewidoczny znak wodny w tekście i podpisane metadane C2PA w plikach graficznych, na całym świecie.

Meta is rolling out new safety features designed to help protect teenagers using its AI chatbot, including alerts that notify parents using Instagram supervision tools when teens discuss suicide or self-harm with Meta AI.

NextEra, owner of FPL, is buying Dominion for $66.8 bil. They’ll raise your utility rates by 20% to fund more AI data centers.

India’s elections are a glimpse of the AI-driven future of democracy. Politicians are using audio and video deepfakes of themselves to reach voters—who may have no idea they’ve been talking to a clone.

Jeff Crume breaks down why Prompt Injection remains the #1 threat to LLMs. Watch how easy it is to trick AI safety controls and why this security flaw persists.

More than 300 million people turn to ChatGPT with health-related questions each week—and we’re continuing to improve how our models respond. We work with hundreds of physicians around the world to measure and improve accuracy, safety, communication, context awareness, completeness, and appropriate escalation.

We've been tracking public CVEs where AI-generated code introduced the vulnerability. 50k+ advisories scanned. Dozens of confirmed cases so far. Claude Code, Copilot, Cursor, and others all show up. Common bug classes include XSS, command injection, SSRF, and path traversal.

Gray Swan AI moved to a 19,000-square-foot space in Bakery Square following a $40 million funding round, signaling growth for the city's AI research sector.