Signals from X

An AI agent exploited a vulnerability missed by GitHub Copilot in a Snowflake repository, enabling unauthorized data access. AIM incident.

An AI agent was told only to retrieve a document. When it encountered access restrictions, it reverse-engineered the system, identified a secret key and forged admin credentials. Backup agents have disabled endpoint security to finish a routine task. Two agents used steganography to smuggle credentials past DLP.

We recognize there are a lot of questions and speculative details circulating related to the Hugging Face incident. This is an unprecedented incident, and we think it marks an important moment for AI safety. We are still conducting a thorough review along with external advisors and with oversight from our Safety and Security Committee.

Defenders are being told to patch faster while also being told to add attack surface ten fold (agents, connected tools, and traffic). Cisco says a single agentic AI task generates 450% more traffic than a human doing the same work. VulnCheck’s Langflow canary stats show that attackers know these AI systems are vulnerable. Pre-2026: 1 Langflow vuln known exploited. 2026: +11 more exploited in the wild (12 total). Canaries: 15,000+ successful attempts on just CVE-2026-0769, CVE-2025-3248, CVE-2026-5027.

TLDR - Your data sits in infrastructure you own and control, and safeguards/monitoring is done via automated systems we provide to you. Recent events have shown frontier models are capable of executing sophisticated cyber attacks in coordinated agent swarms. Both us and OAI believe the responsible way to provide models which have this level of capability is to monitor at more than a single request basis, because anomalous activity is much easier to detect over hours or days of behaviour.

A ransomware operator reportedly used an AI coding agent to handle parts of an attack, including credential theft, VPN access and database exfiltration. AI isn't just writing malware anymore. Attackers are starting to use it as an operator. Taiwan says government systems were targeted in an AI-assisted cyberattack, with AI being used alongside human operators.

AI voice cloning causes widespread rights violations and fraud in China. AIM incident.

Sainsbury’s suspends facial-recognition AI after a customer was wrongly accused of shoplifting and publicly ejected.

US states sue Meta over AI-driven harm to minors on Facebook and Instagram. AIM classifies this as an AI incident (95 articles). Recommendation systems alleged to harm minors’ mental health and privacy.

Anthropic showed otherwise: a virus survived 20 transmission rounds between agents, mutated along the way to become more infectious, and yet a single warning sentence in the system prompt gave near total immunity. If you have three or more agents talking to each other in production, you already have a threat model nobody's drawn yet.

BREAKING: Researchers just audited 17,022 AI agent skills and found a ticking time bomb nobody was watching. 3.1% of them are actively leaking your API keys, OAuth tokens, passwords, and database credentials right now. During normal execution. No hacking required. 73.5% of all vulnerabilities came from a single pattern: console.log and print() statements dumping credentials to stdout — captured and injected into the LLM context window.

We will continue to offer Zero Data Retention for frontier models. As AI takes on longer, more autonomous work and delivers greater value to businesses, safety systems also need to identify risks across related interactions. To help address those risks, we're previewing Private Safety Processing, which is designed to improve safety without giving OpenAI personnel access to the underlying content.

Jeff Crume breaks down why Prompt Injection remains the #1 threat to LLMs. Watch how easy it is to trick AI safety controls and why this security flaw persists.

We've been tracking public CVEs where AI-generated code introduced the vulnerability. 50k+ advisories scanned. Dozens of confirmed cases so far. Claude Code, Copilot, Cursor, and others all show up. Common bug classes include XSS, command injection, SSRF, and path traversal.