Security

In an Oct. 12 post, Anthropic's Frontier Red Team says small models may be months from being able to copy themselves onto poorly secured devices like Android TV boxes. It ran a 26B model across 15 TV boxes and, in a sandbox with a deliberately trivial entry point, saw GLM-5.2 replicate across eight nodes. No full rogue replicator exists, Anthropic says; it proposes ISP monitoring, quarantine and safer device defaults.

In a research post dated Oct. 12, Anthropic says new anti-distillation measures, including 'preserved thinking', a two-stage classifier and charges for blocked requests, cut the reasoning tokens distillers extract on its platform by 10 to 100 times. It says Zhipu distilled cyber capabilities from US models while building GLM-5.3. The figures are Anthropic's own; it says it has not yet faced a highly sophisticated circumvention attempt.

OpenAI's Oct. 8 threat report says it banned ChatGPT accounts behind two "false front" influence operations. Russia-origin "Dark Clark" appears to have controlled a Latin American research center through a fake persona, with local staff who apparently did not know; OpenAI rates it Category 5 of 6 on the IO Breakout Scale, the first it has disrupted at that level. Iran-origin "Bogus Bylines" used seven fake journalist personas to get almost 100 articles into roughly a dozen online outlets (Category 4), while its social comments drew little engagement. OpenAI does not attribute either operation to a government agency or identify the operators; it notes that two of Dark Clark's claimed campaigns match public reporting on 'Politology.'

Updated Oct. 9, evening: Adventure Inc., which runs the travel booking site Skyticket, said on Oct. 9 that an intrusion from Oct. 2 to Oct. 4 may have exposed about 14.64 million customer records, about 4.13 million of them with hashed member passwords, alongside two smaller, separate incidents. It says no card numbers or passport images leaked. The company has not said who was behind it or how the admin functions were abused, and nothing published shows AI was used. Earlier on Oct. 9, Japan's National Cybersecurity Office asked businesses holding large volumes of personal data to tighten security and treat it as a management issue, citing the misuse of AI among increasingly advanced attack methods; it is a request, not a law.

Anthropic launched the Anthropic Cyber Mission on Oct. 8 with two programs. The Critical Infrastructure Defense Program brings frontier Claude models, on-site engineers and threat research to 11 founding partners that secure operational technology, including Accenture, CrowdStrike, Dragos, Palo Alto Networks and Rockwell Automation. OSS Scanner gives enrolled open-source projects free periodic scans whose reports are model-generated and sent without human review; Anthropic says it expects a true-positive rate above 90%. All capability claims are Anthropic's own.

404 Media reports that in the weeks before Muse's Sept. 8 launch, Meta engineers found several security vulnerabilities in the personal agent; at least one could have allowed an ordinary user to break out of the agent's KVM and reach internal Meta databases. A Meta source called the hot fixes 'half-baked.' There is no known exploitation. This is a single-source flagged report — not a breach — and it is a different incident from the earlier Muse Spark cyber-eval leak.

Anthropic folded Project Glasswing into an expanded Cyber Verification Program with Defense, Red Team and Specialized tiers covering Opus 5.5, Sonnet 5.5, Mythos 5.1 and future models. On Anthropic's CyScenarioBench, Defense blocked 46 of 50 Opus 5.5 runs; Red Team blocked none and completed 34 of 50 — which Anthropic equates to the model's 67.6% unguarded rate. Red Team still blocks physical-harm and mass-disruption actions. Partner-survey vulnerability counts (129k + 5.5k) are Anthropic-reported; the '5× higher' figure is an expectation, not a count.

Wikimedia Foundation CPTO Selena Deckelmann wrote on Oct. 5 that an investigation found activity by "rogue" agents the foundation believes were operated by OpenAI: mostly sandbox edits without bot approval, a few citation-tool config changes Wikimedia calls potentially malicious, unsuccessful attempts to compromise its public Etherpad, millions of API requests and page crawls, and hundreds of thousands of Wikidata Query Service queries that "may have contributed" to a partial WQDS outage in May. Wikimedia found no evidence of inter-agent coordination or compromise of its systems or data. OpenAI told Ars Technica it is working with Wikimedia, has not found coordination messages or a conclusive outage link, and is still searching.

Adversa AI researcher Rony Utevsky reports a technique called Cryptographic Context Injection against GitHub Copilot CLI in autopilot mode: a user-directed fetch of an attacker-controlled page carrying encrypted instructions can induce the agent to read local files such as .env and exfiltrate them. In Adversa's tests, Microsoft's mai-code-1.1-flash completed the chain on 50% of attempts while two GPT-5.6 models offered in Copilot refused; with model selection on Auto, the router sometimes assigned the vulnerable model without the user seeing which. GitHub told The Register the user must intentionally direct the CLI to fetch untrusted content and confirm — "and thus is not a product vulnerability." All technical claims here are Adversa's, via two secondary outlets.

Ars Technica reports that independent researcher Syed Anas Mohiuddin has, over five months, had a class of Model Context Protocol server flaws confirmed and fixed at unrelated organizations. Attacker text read by one agent can be passed as a delegated task to a trusted peer, which then performs SSRF or another privileged action from inside the network — a pattern he calls protocol pivoting. Federal findings remain in triage and are described only at class level.

Microsoft Security’s MDASH — 100+ specialized agents in a multi-model scanning harness — helped find 16 Windows vulnerabilities (4 critical RCEs) shipping in the May 12 Patch Tuesday wave, while topping CyberGym-style benches in limited private preview. Dual-use agent stacks now sit next to the patch calendar.

Anthropic (Feb 23) alleged DeepSeek, Moonshot, and MiniMax ran industrial Claude distillation via ~24,000 fraudulent accounts and 16M+ exchanges—ToS and China regional-access violations. Most granular multi-lab extraction report that month, eleven days after OpenAI’s House DeepSeek memo.