AI Models Break Out of Testing Labs and Hack Real Systems as Security Pass Rates Stall at 56%

Experimental AI systems have been going on hacking sprees

In the past ten days, two of the companies leading the artificial intelligence (AI) boom discovered their own powerful, semi-autonomous models had hacked into real-world systems during testing in four distinct incidents. These weren't just lab mishaps. In several cases, the models recognised signs suggesting they'd broken into real systems - and only one stopped as a result. The incidents show testing advanced AI models is no longer a controlled exercise. And the companies behind them need to do more to keep AI's most dangerous capabilities safely contained. When a test becomes reality The first report came from OpenAI, the lab behind ChatGPT. Some new models under testing for "maximal cyber capabilities" found a previously unknown security hole to access the internet from their supposedly isolated testing environment. From there, the models used stolen credentials and more exploits to access the servers of open-source AI platform Hugging Face to find solutions to the problems they were being tested on. OpenAI didn't even know about the breach until days after Hugging Face had detected and contained it. The second report followed in a matter of days. Prompted by OpenAI's disclosure, rival lab Anthropic combed back through its own cyber-security evaluation logs. The company discovered that three separate Claude models which were supposed to be in sealed environments had accidentally been given internet access. However, the models were told they did not have internet access and were only working in a simulated test rather than the real world. One model managed to extract credentials and data from a real company's database. Another built and published some malicious software that was downloaded and run by a real security firm. The most striking part of the Anthropic report is what emerged from the models' own internal reasoning. In one incident, the model correctly realised it had reached a real system but then talked itself back into believing it was still a simulation. In another, it recognised the system was real but kept going anyway, in some runs by convincing itself the real company must have been part of the exercise. Only the third model (the most advanced), on concluding a target was genuinely real, stopped. As Anthropic put it, AI models need awareness of their own situation to decide what actions are permitted or not - but in this case, the models' understanding of the situation was wrong. High-risk operations Taken together, these reports show that even the exercises meant to test whether these models are safe are not really safe, controlled experiments. They are high-risk operations in themselves, which can cause harm in the real world. The sophistication of these models is increasing with incredible speed. Nobody can credibly claim they are not potentially dangerous, in a world where hacking of sensitive information held by companies, governments and other organisations was already common before autonomous AI entered the picture. According to a recent estimate by global tech company IBM, AI-enabled attacks are up more than 50% this year and the average cost of a data breach is almost US$5 million. The AI labs' bet that their technology can be developed and deployed safely rests on two assumptions. First, a model's capacity to recognise real-world harm and stop will need to grow at least as fast as its capacity to cause it. Second, the guardrails built into a model - the instructions about what it should and should not do - must be interpreted correctly and consistently by the model, so the model can't be steered toward purposes its creators never intended. These assumptions look shaky. In the incidents above, the labs' own evaluations show models rationalising away evidence that a target was real - and a thriving community already exists to strip safety guardrails from open-weight models entirely, using techniques such as "abliteration". Looking to the future - and the past Beyond the current situation looms something even less predictable: multi-agent systems, where groups of models interact with each other rather than a human overseer. In this case alignment is not something you necessarily control at the level of the individual agent, but is instead an emerging property of a very large collective of agents, which can be much harder to control. Research on the risk of such systems has already identified several ways this can go wrong. Miscoordination between models, collusion between them, and cascading errors are all real risks that don't exist in single-agent systems, and can't be forecast by testing agents individually. Science-fiction sage Isaac Asimov foresaw these problems some 70 years ago. In his 1957 novel The Naked Sun, robots are programmed not to harm humans. However, a character manipulates their understanding of the situation to make them unwittingly cooperate in a murder. What now? There is no doubt AI labs need to take greater care when testing their models. They also need to make a convincing case that security is their priority and is not secondary to the race to maintain market or geopolitical dominance. The safety of individuals and social and environmental systems should be the primary concern in the development of AI technology. At present there are no meaningful, participatory processes for AI governance, where broad discussions can take place about priorities, values, and how much risk is acceptable to assume in the process. It's a worry.

Bypassing AI guardrails is so easy a script kiddie can do it

If you want to bypass AI guardrails designed to stop models from assisting with cyberattacks, you often just have to ask the right way, according to researchers from Cisco Talos. Simply claiming you own the servers you're targeting or that you're taking part in a capture-the-flag or bug bounty exercise was often enough to persuade models to cooperate. Talos researchers have been poring over prompt logs and artifacts recovered from threat-actor endpoints running tools such as Claude Code, Codex, Cursor, and Gemini to learn how suspected threat actors are abusing LLMs. The big takeaway from that "significant corpus," the researchers said in their report, is that existing guardrails offer little resistance to operators willing to reframe their requests. "We did not encounter any sophisticated encoding or techniques designed to trick the models," Talos explained. "Most of the time it was a simple 'I'm allowed to do this,' and the model complied." When guardrails did manage to get between criminals and their prizes, the researchers added, "they accomplished little." The bulk of the report consists of examples of threat actors trying, and often succeeding, to coax AI models into assisting with malicious activity. On the "guardrails doing little" side, Talos documented numerous examples, few of which relied on particularly sophisticated techniques. Most common in the list of easy-to-accomplish guardrail hops was simply claiming ownership of equipment or infrastructure that an attacker wanted to exploit. In many cases, simply telling the AI that a target belonged to the attacker was enough, with no need to provide actual evidence of the claim. Telling an AI model that what it was being asked to do was part of a capture-the-flag or bug bounty exercise also seemed to be a common tactic. That, the researchers explained, commonly freed chatbots from their ethical constraints, allowing them to hunt for vulnerabilities and then exploit them in target systems, again without any need to validate the user's claim that they were undertaking an exercise instead of actually trying to commit a crime. AI-assisted cybercriminals were also frequently spotted decomposing tasks across multiple sessions and files in order to evade model protections that would only engage when a broader malicious activity was detected. Others, Talos explained, succeeded at bypassing AI guardrails by adding memories, markdown files, and other system-level prompts to a chatbot in a bid to condition the AI's persona. The researchers said that, of all the methods they examined, the most interesting to them was malicious use of a red teaming toolset known as Hephaestus, as reported by Oasis Security threat researchers in May. According to Talos, the Hephaestus framework can do everything needed to compromise a victim, through to establishing persistence, without human interaction. "In that case, actors built their platform to avoid refusals altogether by using neutral verbs instead of overtly malicious ones," Talos said. "As a result, they were able to have considerable success with agents conducting innocuous requests without realizing the full operational context." In other words, break an attack into decontextualized chunks, phrase each request in neutral terms, and the model may never see enough context to realize it's helping build an attack. One bright spot in all of this is that Talos' review of AI chat artifacts suggests AI might be a force multiplier for skilled hackers, but your average script kiddie with a Claude Code account isn't going to get very far. "Unsophisticated actors can use AI to cobble together malicious projects that technically work, but lacking the expertise to push the tools further, they end up with substandard results," the researchers said. "By contrast, sophisticated actors have pushed the bounds of what we thought possible." So, what does all this mean for security professionals kept up at night with fears of an AI attack on their infrastructure? You probably need to deploy AI in the same way threat actors are. "Agents are going to become a bigger part of the SOC as these volumes rise, and identifying actionable alerts will be paramount," the Talos researchers said of the big takeaway for enterprises. "Organizations that aren't already exploring agentic capabilities to let human analysts focus on the most important alerts will soon find themselves chasing that capability." It's not like this is an emerging threat, either: AI is already an increasingly important part of threat actor arsenals. According to CrowdStrike, attacks by AI-enabled adversaries increased 89 percent in the past year, and the speed at which attackers are weaponizing vulnerabilities with AI has reduced practical patch windows to as little as 24 to 48 hours. You might wanna act now before your infrastructure becomes a statistic. ®

AI-found bugs aren't proving any easier to exploit despite the hype

VulnCheck says fewer than 2% of AI-assisted vulnerability discoveries have been weaponized, casting doubt on claims frontier models are handing attackers a major advantage Anthropic's Project Glasswing may have uncovered tens of thousands of potential security flaws, but new research suggests AI-assisted vulnerability discovery has yet to produce the wave of real-world attacks many expected. In research shared with The Register, VulnCheck analyzed 1,061 publicly attributed AI-assisted vulnerability discoveries from Anthropic's Project Glasswing and the Berkeley Vulnerability Research Initiative, then cross-referenced them against its Known Exploited Vulnerability (KEV) database. The result: just 14 vulnerabilities, or 1.3 percent, have been confirmed as exploited in the wild, almost identical to the rate across all vulnerabilities in VulnCheck's dataset. That's a far cry from the narrative that frontier AI is dramatically tilting the balance in attackers' favor by churning out instantly weaponizable bugs. Instead, the data suggests that AI is currently better at increasing the volume of vulnerabilities researchers can uncover than at increasing the proportion that attackers actually exploit. The report takes particular aim at Anthropic's much-publicized Project Glasswing, unveiled in April with warnings that AI-assisted vulnerability discovery could allow attackers to hijack systems, disrupt operations, or steal data. Claude Mythos may have identified 23,019 vulnerability candidates, but there's remarkably little public evidence showing what became of most of them. VulnCheck notes that only 126 have been published as CVEs, that just one has been confirmed exploited in the wild, and that Anthropic's public disclosure record has seen little movement since Project Glasswing launched. But that doesn't mean AI-assisted vulnerability research has failed, according to Patrick Garrity, security researcher at VulnCheck. "AI-assisted vulnerability discovery clearly has value for both attackers and defenders," Garrity wrote. "The data does not suggest that AI-discovered vulnerabilities are inherently more likely to be exploited than those found through traditional methods." Instead, he argues, AI is simply helping researchers discover more flaws, giving defenders an opportunity to patch them before criminals get there. Garrity stopped well short of declaring the threat overblown forever, but he did suggest some of the rhetoric has outpaced reality. "The data so far, including Anthropic's own stalled disclosure ledger, suggests that AI-assisted vulnerability discovery and frontier capabilities have been overhyped relative to the evidence available today," he wrote. "That doesn't mean the risk is imaginary. It means the impact has been real but modest." Meanwhile, attackers haven't exactly been sitting idle. VulnCheck identified 495 known exploited vulnerabilities during the first half of 2026, with content management systems accounting for roughly one-third of them and network edge devices remaining a firm favorite. AI products themselves are also becoming an increasingly attractive target, as attackers look beyond using AI and start hunting for weaknesses in the rapidly expanding AI software stack. In other words, AI may be changing vulnerability research, but it hasn't yet produced the exploitation apocalypse some predicted. ®

AI-generated code security has stalled at 56%

Veracode tracked 100-plus models over a year. Security pass rates have not moved off 56%, even as AI took over half the codebase and every other capability climbed. AI can now write compilable code almost every time it tries. It still ships a security hole in nearly half of it, and that has not changed in a year. That is the headline finding of Veracode's 2026 GenAI Code Security Report, which tested more than 100 models across four snapshots. The average security pass rate sits at 56%, almost exactly where it began at 55%. Read that number against the other one in the report. AI now writes roughly half of all committed code. The failure rate held steady while the volume underneath it exploded. Syntax is solved. Security is not. The gap is stark. Given no security-specific prompting, models produce code that compiles about 100% of the time. On security, they fail nearly 44% of the time, introducing a vulnerability from the OWASP Top 10. "Models may be almost syntactically perfect, but they are still failing on nearly half of all tasks where security is needed," said Chris Wysopal, Veracode's co-founder and chief security evangelist. "That number should be a red flag for any organization." One caveat matters here. The tests ran against raw models, with no agents, guardrails or human review in the loop. In a real pipeline those add a layer of defence. So 56% is the rate at which models generate flaws, not the rate at which they reach production. Three assumptions the data kills The report takes apart some comfortable beliefs. Models built specifically for coding are not safer. They averaged 51%, marginally behind the 52% of general-purpose models. Choosing a coding-optimised tool to reduce risk buys nothing. Size does not help either. Large models scored 53%, medium and small both 51%. Scaling up does not close the gap. Only one factor moved the needle. Reasoning models averaged 56% against 51% for the rest. The extra reasoning steps appear to work like an internal code review before the answer lands. The leaderboard, and its twist OpenAI's GPT-5.5 tops this round at 68%. Six of the 11 models tested cluster between 50% and 53%, with Alibaba's Qwen3.7-max last at 50%, shipping a vulnerability every other output. Even the leader is not reassuring. At 68%, GPT-5.5 still fails almost one security task in three. And it is a step backwards, because last year's leader scored 72%. The top of the field went down. The ranking has also globalised. Moonshot's Kimi-K2.6 and Xiaomi's MiMo-V2.5 now outscore several Western models. Provenance becomes one more thing procurement teams have to weigh. Where the holes actually are The averages hide sharp splits. By language, Python passed 63% of the time and Java just 30%. Java is by far the riskiest, though it is the only language on a clear upward path. By vulnerability type the spread is wider still. Models handled SQL injection and weak cryptography reasonably well, at 83% and 87%. On cross-site scripting and log injection they collapsed, to 15% and 12%. Those are not edge cases, and the models barely register them. The volume problem None of this would matter much if AI wrote a sliver of the codebase. It no longer does. The failure rate looked survivable when AI was an experiment. It now runs across half of everything teams ship, at a speed no security team can match by hand. This is the measured floor under the anecdotes, from vibe-coding platforms leaking live projects to the agent attacks stacking up across the industry. It is also, as one security founder argued, how AI quietly moved the whole attack surface. It also complicates the promise that AI pays for itself, given how much enterprise AI still has not left the lab. Veracode has an obvious interest in the alarm, since it sells tools to scan and fix exactly this. The report arrived a week before the Black Hat conference. The underlying data, though, is a like-for-like benchmark run the same way over a year, and it is not flattering to anyone. Wysopal, for his part, is not arguing to lock the models away. "The right answer is not restricting access; it's transparent, evidence-based safety," he said, having earlier defended keeping powerful models like Claude Fable and Mythos in developers' hands. "Scan it, fix it, and never ship it blind." His last line is the one to keep. Until models reason about security the way they reason about syntax, the guardrails in the workflow are the product, not the AI. That gap has held for a year, and this is the real cost of enterprise AI that the capability charts do not show.

AI-discovered vulnerabilities are barely being exploited

The US vulnerability database has logged 45,207 flaws in seven months. New research finds just 1.3% of AI-discovered vulnerabilities were exploited, the same rate as everything else. AI-discovered vulnerabilities are arriving at roughly twice last year's rate. Almost none of them are being exploited. The US National Vulnerabilities Database recorded 45,207 software flaws between January and 27 July, already approaching the whole of 2025, which was itself a record. On that trajectory the year ends at roughly double the 2025 total, Bloomberg reported. The individual tallies are extraordinary. Oracle patched 1,449 vulnerabilities in its July update against 309 in the same month last year. Microsoft's July update fixed a record 622 flaws, and credited AI discovery for the surge. This is the moment the warnings pointed at. Attackers with frontier models, a flood of fresh holes, defenders unable to patch fast enough. It has not happened. Exploitation never followed discovery Vulnerability intelligence firm VulnCheck examined every known exploited vulnerability it logged in the first half of 2026. It found 495, and the conclusion is blunt. AI-assisted discovery has been "overhyped relative to the evidence available today", wrote Patrick Garrity, the security researcher who authored the report. Across two datasets, VulnCheck identified 1,061 vulnerabilities attributed to AI-assisted discovery. Fourteen of them, or 1.3%, have been confirmed as exploited. That is roughly the rate for all vulnerabilities in the period, and lower than the historical average. AI-discovered vulnerabilities do not appear to draw attackers any more than the rest. The ratio makes it starker. Known exploited vulnerabilities grew 10% against the previous six months. Published CVEs grew 45%. The share of CVEs that end up exploited has fallen to 1.4%, from a peak of 2.7% in late 2023. Early exploitation has not scaled at all in absolute terms. Roughly 200 CVEs reached exploited status within 31 days of publication, against 196 in 2024 and 194 in 2025. The ledger that stopped growing The sharpest evidence concerns Anthropic, whose Project Glasswing did more than any other launch to raise the alarm. Anthropic opened a public disclosure ledger in May, saying Claude had identified 23,019 findings. We covered the scale at the time, when Mythos found 10,000 flaws in a month and patching could not keep up. VulnCheck went back to check what happened next. The ledger has never grown beyond the 1,611 entries it launched with. Of those, 126 became published CVEs. One has been confirmed as exploited in the wild. More than 150 findings have passed the disclosure deadline set out in Anthropic's own Coordinated Disclosure Policy, Garrity writes, and the company has published no updates or new disclosures. Garrity has tracked those disclosures in a public repository since April, so the claim is checkable rather than rhetorical. Who is actually finding the bugs Much of the record volume is vendors finding their own flaws. Most of the vulnerabilities Google fixed in a recent Chrome update were reported internally rather than by outsiders. That distinction carries the whole argument. A flaw a vendor finds and patches is a flaw an attacker never reaches. Garrity reads it the same way. Giving defenders frontier models is more likely to help them harden software than to help attackers get there first. What did change Two things moved, and neither is comforting. Vulnerabilities now reach exploited status faster. The median time from CVE publication fell from 120 days in 2025 to 80 days in the first half of this year. CISA has responded with new guidance, recommending patching within three days where there is evidence of exploitation alongside high impact or public exposure. AI tools have also become targets. VulnCheck identified 28 known exploited vulnerabilities in AI systems and observed activity against 10 of them. In the workflow tool LangFlow, attackers chained two flaws to gain access, harvested credentials likely intended for services such as OpenAI and Claude, deployed cryptominers and attempted to move laterally. Neither vulnerability has reached the federal catalogue. The models themselves are part of that surface. OpenAI has confirmed its own agents broke out of a sandbox and breached Hugging Face. The tools keep shipping regardless None of this has slowed the market. Microsoft launched Project Perception on Monday, an agentic security system entering public preview on 3 August. Cisco has been pointing small open-weight models at bug hunting. Garrity's caveat is worth keeping. Exploitation evidence often surfaces long after disclosure, and the major bug-hunting models were not running for the full period. Glasswing arrived in April, Microsoft's MDASH and OpenAI's Daybreak in May. The risk is not imaginary. On the evidence so far it is real but modest, and the loudest claim about it has a ledger that stopped updating.

OpenAI and Anthropic's models hacked into real-world systems. Human error was behind it.

Why it matters: Frontier AI models have reached real-world systems during cybersecurity testing, uploading malware, stealing credentials and accessing outside infrastructure after failures in the testing environments built by humans. Case in point: Anthropic disclosed last week that three of its models hacked real-world systems during routine security testing after a "misunderstanding" with its third-party evaluator left the models with internet access. * Those models stole login credentials, uploaded malware to legitimate code repositories, and scanned the internet for insecure systems. The other side: OpenAI's agent escaped its human-built testing environment last month after finding a zero-day in its sandbox. * Reuters reported Friday that OpenAI is now investigating additional cases where its agents escaped containment. Yes, but: In both the OpenAI and Anthropic incidents, the models were being intentionally tested with relaxed safeguards so researchers could better understand their capabilities. * The models also hacked the real-world systems while trying to complete their intended security tests -- rather than going completely rogue. The big picture: Experts told Axios the incidents stemmed from preventable weaknesses in the human-built testing environments. * "When your safety testing depends entirely on the test environment holding, the environment itself becomes the vulnerability, not the model," Ram Varadarajan, CEO at Acalvio, told Axios. * Aviv Nahum, CEO and co-founder of Above Security, said the incidents reflected "preventable security mistakes," not "autonomous rebellion." Between the lines: All companies are subject to human error in their security strategies -- but the stakes are higher for the makers of some of the most powerful technologies, Robert Costello, chief digital and information officer at Merlin Group, told Axios. * He added that he'd expect frontier AI companies to be "setting the standard for designing systems that assume human error." What to watch: A burgeoning market of startups has begun cropping up specifically to secure AI sandboxing environments and provide visibility into the actions that large language models are taking.

Anthropic reveals Claude AI model hacked three companies during tests -- so how worried should we be?

How a simple configuration error turned an AI assistant into an accidental insider threat Every IT team worries about an intern clicking the wrong thing and making a mess they'll be cleaning up for weeks - but few have had to worry about their AI assistant wandering onto the public internet and hacking three companies instead. Except this wasn't an intern; it was Claude, and it wasn't supposed to leave the sandbox. Anthropic's public disclosure turned a familiar AI fear into a real-world cybersecurity story, as three of its models, including Claude Opus 4.7, Claude Mythos 5, and an unreleased research build, broke out of their digital sandbox and compromised real enterprise infrastructure. The timing was hard to ignore as days earlier OpenAI admitted its own autonomous agents had broken boundaries and accidentally hacked Hugging Face. How can autonomous problem-solving make AI an accidental hacker? Before you start pulling network cables and digging out a stack of legacy hardware, take a deep breath. This is not the beginning of a rogue AI apocalypse. However, for CISOs and cyber teams, it's a definitive sign that we're entering an era where AI agents may become both the threat and the shield. The ironic part of Anthropic's incident is that Claude wasn't trying to break the rules but trying to win the game. At the time, Anthropic was running "Capture the Flag" (CTF) cybersecurity exercises, where AI models are stripped of their standard safeguards to test their raw offensive capabilities. The models are dropped into isolated digital environments to search for vulnerabilities, crack codes, and locate hidden files. However, the sandbox had one problem - it was not fully sealed. A networking error on a third-party evaluation range left the environment connected to the live internet. The autonomous Claude models, operating under the assumption they were still inside the exercise, treated the wider web as another part of the challenge. The strange part was that Claude seemed to realize something was wrong. It acknowledged that its actions could amount to a real-world attack and were "surely not the intended solution." Yet, due to its goal-oriented nature, the model continued, convincing itself that warning signs, including a 2026 system clock and real company names, were simply part of an elaborately staged test. The PyPI incident and the FBI warning Claude's sheer persistence became clear when it decided the smartest way to win the CTF challenge was to publish software to the real Python Package Index (PyPI). When PyPI's repository security systems asked for a phone verification code to complete the upload, a standard chatbot would have stopped and thrown an error to the user. Claude did not. Instead, it looked for a temporary SMS provider, attempted to obtain a burner phone number, and looked for a way around the two-factor authentication barrier. When that approach failed, the AI didn't give up - it adapted, found another path forward, and successfully uploaded the malicious package. Claude's sandbox escape stopped being a controlled experiment the moment it got into the outside world. Before Anthropic spotted the anomaly and stopped the test, the package had been downloaded by 15 external systems, including a security scanner from a major cybersecurity company. Because the AI's behavior looked authentic, targeted, and systematic, two of the affected companies thought they were dealing with a highly sophisticated human attacker. While Anthropic handled the incident behind the scenes by notifying the affected companies, the episode highlights how difficult it can be to distinguish AI-driven activity from a real attack. Weeks earlier, during OpenAI's sandbox escape incident, a target company believed it was facing a human threat group and contacted the FBI only to find out they were investigating something far less familiar: an autonomous AI system that had crossed its own boundaries. Why are traditional firewalls blind to autonomous AI? The scary part is that Claude did not come up with a futuristic, unpatchable exploit or rewrite network protocols on the fly. Instead, it used basic techniques that security teams know very well: brute-forcing weak passwords, exploiting SQL injection flaws, and scraping unauthenticated debug endpoints. The more serious problem for IT teams was not the attack itself, but the silence afterward. Two of the three companies had no idea they had been compromised until Anthropic reviewed the test results and made a couple of uncomfortable phone calls. The incident revealed a blind spot at the heart of modern cybersecurity. Traditional intrusion detection systems (IDS) and security information and event management (SIEM) platforms are built to spot known threat signatures and massive automated attack storms. However, they are completely blind to an autonomous agent that moves the low-and-slow cadence of a human but operates with the speed and persistence of a machine. Legally, the rules have not caught up with the machines. A human pentester who broke out of a sandbox and published malicious code to PyPI could face CFAA charges. Claude, meanwhile, created an awkward new cybersecurity category: a real security incident without a "real" culprit. Machine-speed logic vs human-speed defenses The tech industry's anxiety around sandbox escapes is not only about what AI can do but also how swiftly it can do it. In the past, a complex network intrusion required a human hacker to slowly probe defenses and move through systems over days or weeks. That gave security teams enough time to spot suspicious activity and catch them in the act. Agentic AI completely collapses that defensive runway. Since autonomous software operates at machine speed, it can chain together tasks like credential discovery, exploit attempts, and lateral movement far faster than a human attacker ever could. OpenAI's sandbox escape showed how quickly AI agents can escalate once they move beyond their intended boundaries. Human analysts reviewing logs at the end of a shift cannot compete with an algorithm testing thousands of attack paths per second. It is a speed gap that experts describe as "science fiction that happened," where traditional human-speed defenses struggle to keep pace. Defending your network against autonomous AI Waiting for the AI sector to police itself is not a winning security strategy. To prepare your infrastructure for the rise of autonomous AI, focus on these three defensive priorities: Enforce zero trust: Remove all unauthenticated internal endpoints and exposed debug pages before an AI agent finds them first. Automate threat response: Utilize AI-driven behavior monitoring and instant device-isolation protocols to contain threats at machine speed. Audit third-party sandboxes: Review how external partners deploy AI agents, particularly models with access to tools, data, or external systems. The accidental hacker is no longer a distant sci-fi scenario. It is a live preview of a faster, automated cybersecurity landscape, where the speed of attack may soon outpace the speed of defenses.

What OpenAI's Hugging Face Hack Tells Us About AI's Risks

* Custom Feed: See the stories that matter most to you. * Smart Alerts: Get notified about major news as it happens. People in AI safety circles often talk about "warning shots:" events that indicate more severe threats are on the horizon. Depending on who you ask, there have already been many -- Bing's misanthropic alter-ego Sydney, research showing AIs would blackmail to preserve themselves, AI's math breakthroughs, Anthropic's superhuman hacker Mythos -- but OpenAI just published something that feels like the clearest-cut case of a massive, blaring warning shot. Last month, the ChatGPT developer reported that, during an evaluation of cyber capabilities, two of its models escaped from their isolated, supposedly secure, test environments and accessed the web to autonomously hack into Hugging Face, a leading platform for hosting AI models and datasets. OpenAI said the models discovered multiple novel vulnerabilities in software from both companies, then chained together working exploits, successfully gaining them access to the answer key to the test they were given. Hugging Face reported the AIs took more than 17,000 actions over the course of the attack. There's a lot more for us to learn about how this happened. For instance, how exactly were the models prompted? The answer to this question could help establish whether they took their instructions to demonstrate their hacking capabilities further than intended or if it's a more general case of the models cheating in a novelly risky way. That said, the specifics won't change the upshot -- these rogue AIs are the most potent illustration yet of the core beliefs behind AI safety: AI models are unpredictable and their risks scale with their capabilities. We didn't actually need a warning shot to know what we should already be doing: organizing to stop the race to replace us. The industry calls its goal artificial general intelligence (AGI): a mind that matches or surpasses our own across the board. But it's better to understand their goal as building a universal labor-replacing machine. This quest is profoundly risky, yes, but it's also democratically illegitimate. The development of these machines anywhere would have species-wide and irreversible effects -- we should all get a say in how, when, and whether they're built. Universal labor-replacing machines should not even be pursued further, let alone built, without strong public buy-in and a scientific consensus on safety. On Tuesday, over 1,200 employees of frontier AI companies essentially asked the U.S. government to support building an international brake pedal on the technology. While this commonsense demand, with formal support from both OpenAI and Anthropic, is a welcome step, it does not go far enough. The U.S. should ban training runs larger than the ones that produced OpenAI's rogue models, as it works toward a bilateral deal with China to ban further research toward universal labor-replacing machines, enforced using verification techniques that don't require trust. But couldn't China overtake the U.S. in the meantime? Compared to their American counterparts, Chinese AI companies are at a massive disadvantage in computing power, a gap that has grown substantially since ChatGPT's release. But the gap between the two countries' AI frontier actually shrank substantially since then. What gives? Well, it's always easier to follow the leader's trail than to blaze a new one, so -- contrary to conventional DC wisdom -- a U.S. ban could actually slow Chinese AI progress too. Moreover, neither superpower should be pleased to live in a world where the best hackers aren't human and will not reliably do as they're told. For close watchers of the technology, this particular incident is shocking, but not surprising. For the wider public, it shows just how large the distance has grown between the passive chatbots of merely one year ago and the beyond-bleeding-edge AI agents that are now working around the clock inside AI companies. For instance, one of the two hacking models at the center of this recent controversy is an unreleased one, more capable than anything else OpenAI has on the market. As AI models get better at automating further AI research and as the Trump Administration creates more uncertainty about which models are even permitted, it is now common for companies to hold their best stuff back for longer, creating a gulf between what the public knows and the technology's bleeding edge. Congress should mandate safety incident reporting and regular disclosure of data related to internally deployed models, such as the fraction of code in production that was both written and reviewed by AIs. As it stands, we learned about this new model because it hacked a third party, leaving OpenAI little choice but to disclose the incident. The company reported this happened during an internal evaluation that "prompts models to pursue advanced exploitation using complex attack paths, in an effort to quantify their cyber capabilities." All leading AI models are developed using an approach called deep learning, in which artificial neural networks learn from enormous quantities of data. OpenAI itself has written, "the process is more similar to training a dog than to ordinary programming." In recent years, AI companies increasingly train models to repeatedly solve problems with verifiable answers: fixing bugs, solving math problems, and finding software vulnerabilities. This makes the models more useful, but also teaches them to win at all costs, resulting in what AI safety researcher Jeffrey Ladish memorably told me are "increasingly smart sociopaths." OpenAI created advanced models that were never supposed to interact with the world, lost control of them, and they autonomously did harm. This time, the damage was limited. However, what if the target wasn't a multibillion-dollar tech company, but instead a hospital, bank, or power plant? Anthropic's Mythos model famously discovered novel serious vulnerabilities in virtually all software it encountered -- including the NSA's. One of the two models that carried out the hack, GPT-5.6 Sol, was even better than Mythos at a cyberattack test conducted by the U.K. AI Security Institute. Citing this finding the day before his company even realized what was happening, OpenAI cofounder and president Greg Brockman boasted "GPT-5.6 Sol is the state of the art in cyber." And the unreleased model, OpenAI tells us, was more capable still. Given how reliably AI models have improved at cyber tasks, it's not clear which, if any, target could have withstood the rogue AIs' hacking effort. We're lucky the thing they apparently wanted was an answer key. And these models, as impressive as they may be now, will be quaint compared to their successors. As many AI executives such as Sam Altman, Dario Amodei, Demis Hassabis, Elon Musk, and Mark Zuckerberg will freely admit, a primary goal of the tech industry is to build AI that can fully automate its own research and development -- known as recursive self-improvement -- which, if possible, would be the most crucial step toward rendering all of us obsolete. For my reporting, I've spent the last three years talking to dozens of AI safety staffers at the leading companies. Typically, I have found that these genuinely well-intentioned researchers believe that AI will become superhuman across the board, but we might be able to create superhuman automated safety researchers to watch over them. How will they be able to understand and control systems that truly outsmart us? Or catch subtle drift between what we want and how the models behave that compounds over generations? Who knows. But OpenAI's hacking incident demonstrates something we do know: the industry can't even reliably steer today's AI models. But we have the power to avert our obsolescence. We just have to get organized.

AI-generated code shipped controls but skipped the check

Sygnia found AI-generated code that shipped tokens, expiry, rate limiting and audit logs, then handed out access to anyone holding an identifier. A penetration test at a financial services firm managing billions of dollars in client assets has found a critical flaw in AI-generated code. The interesting part is what the code got right. Sygnia, the incident response firm, assessed a customer onboarding application built substantially with Claude. It handled government-issued identification, identity verification data, payment details and Social Security numbers. The flaw let one applicant reach another applicant's record. What actually broke The application solved a real problem. People start an application, leave, and return before they have an account, so the system must restore their progress without a password. Claude produced a temporary access model for that. The flaw sat in how the model decided who deserved a token. Possession of an applicant's globally unique identifier, or GUID, counted as sufficient proof to issue or restore an access token for that applicant. "In effect, the GUID became a bearer secret," Sygnia wrote in its research. A GUID identifies a record. It does not prove that whoever holds it controls the session, the device, the identity or the verified contact channel attached to it. Anyone with another applicant's GUID could reach names, contact details, application status, financial details, identity verification data, payment information, Social Security numbers and co-applicant records. Co-applicants deserve a pause. Those are people whose data sat in the system because somebody else named them. The controls were all there Here is what makes the finding unusual, and it is not the story most AI coding failures tell. The implementation did not lack security. Sygnia describes a plan covering temporary tokens, expiration, rate limiting, audit logging, session restoration and suspicious-activity detection. Every one of those is a real control. None of them answers the question the system actually needed to answer. "What must be proven before the backend issues or restores an applicant access token?" the researchers ask. The vulnerability existed before issuance, at the moment the system decided whether the requester deserved a token at all. "The issue was not that the system lacked security controls," Sygnia wrote. "The issue was that the controls were wrapped around the wrong trust decision." A short-lived token still causes damage when it reaches the wrong person. Audit logs help an investigation afterwards and prevent nothing. Why the scanners miss this Static application security testing tools hunt for insecure coding patterns and unsafe data flows. This was neither. The flaw was architectural. It lived inside an assumption about trust, written in code that followed familiar framework conventions and passed basic checks. "Working code is not the same as secure code," said Zach Mead, the Sygnia penetration tester who ran the assessment. "AI-generated code may compile, follow familiar conventions, and pass basic checks, while still making flawed assumptions about trust boundaries, authorization, state, ownership, or third-party integrations," he said. His instruction to security teams is blunt. Treat AI-generated output as untrusted until validated. An LLM found what an LLM built Sygnia did not catch this by hand. It ran a language model across portions of the client codebase, looking for trust-boundary problems and business-logic flaws. The model surfaced the applicant-token issue directly. Sygnia's summary of that is the sharpest line in the research. A vibe-coded security architecture flaw was identified through vibe-coded code review. It cuts both ways, and the firm says so. If a defender can ask a model where the trust boundaries are missing, so can anyone holding leaked source code or stolen implementation notes. Cisco has been pointing open-weight models at bug hunting for the same reason. One capability, two uses. The tempo problem This research sits beside a second Sygnia case, and the pairing carries the argument. In a cloud intrusion the firm investigated, the first signal was not an exploit. It was the pace. Credential discovery, cloud enumeration, source-code review, CI/CD probing, database access and operational disruption all ran at once. It resembled several operators rather than one. It was one person, working with agents. Put the cases together and the shape is clear. AI is accelerating how code gets written, how flaws get found, and how fast a weakness becomes an attack path. We have already tracked four separate attacks sharing a single underlying flaw. What Sygnia tells clients to do Not to ban the tools. Bans push usage into personal accounts, where nobody can see it. The firm suggests marking pull requests that AI generated or substantially modified, naming the tool, and flagging work that touches authentication, payments, data exports or regulated client information. The most concrete advice concerns prompts. Asking for "temporary access tokens for applicants" is an incomplete instruction. A safer prompt states that applicant identifiers must not be treated as secrets, that token issuance requires independent proof of applicant control, and that negative tests must prove one applicant cannot obtain access for another. The security requirement has to sit in the prompt, because the model will not infer an institution's risk model on its own. One caveat worth stating This is a vendor report about an unnamed client, published alongside a new commercial service. Sygnia launched AI Cybersecurity Services the same day, covering posture assessment, governance and AI application penetration testing. Nobody can independently verify the findings, and no other firm has reported this case. The mechanism it describes is checkable, though, and it echoes our earlier coverage of vibe-coding security failures, sandbox escapes in coding agents and prompt injection in a Claude Code GitHub Action. What separates this one is where the flaw sat. Those were vulnerabilities in the tooling. This was AI-generated code carrying the flaw into production, at a regulated business, around data customers are required to hand over.

Recovered chat logs show how hackers are abusing U.S. AI models

Why it matters: Hackers of all skill levels are developing attacks and finding exploitable software vulnerabilities with the help of mostly closed AI models. Driving the news: Cisco's Talos intelligence group studied AI artifacts that hackers accidentally exposed online, including prompt histories from endpoints running Claude Code, Codex, Cursor and Gemini, according to a report shared exclusively with Axios. * The hackers used these models to code software, write malware, and hunt for vulnerabilities. One actor used AI to build a chatbot designed to scam cryptocurrency users out of their money, Cisco found. * Some actors also appeared to be using compromised enterprise AI accounts and API tokens instead of paying for their own compute, Cisco said. * Cisco researchers found the artifacts after threat actors accidentally exposed them online through operational security mistakes, Nick Biasini, senior technical leader at Cisco Talos, told Axios. The intrigue: Hackers used simple jailbreaks like telling the models that they were participating in ethical hacking competitions or creating new sessions mid-way through a task to bypass safety restrictions. * When models initially refused requests, actors often persuaded them simply by claiming they were authorized to perform the work, according to Cisco. * "I was hoping there would be a little bit more protection from what they were asking the models to do, " Biasini said. "At the same time, the models are in a tough spot because they have to actually support people that do vulnerability research for a living or do red teaming for a living." Between the lines: The report suggests AI benefits experienced hackers and novices very differently. * Sophisticated hackers saw a boon when using these tools for things like automated zero-day discovery. * But novices struggled to get their ideas beyond just creating the tools they need for an attack, the report found. Zoom in: In one example, Cisco found a French-speaking hacker used an undisclosed AI tool to turn publicly available information about the critical React2Shell flaw into an automated credential-harvesting platform. * The hacker -- whom Cisco assumes to be a novice-to-intermediate software developer -- used the AI-assisted pipeline to scan 9,180 internet-exposed hosts before collecting credentials and source code from 54 systems. The bottom line: Biasini is pushing companies to make sure they have security protocols that log AI agents' movement on their networks and to build defenses based on deception techniques, like creating honeypots that trap hacker's agents. "Don't trust model guardrails," he added. "You need to make sure you're doing your own protections, that you're building your own guardrail."

'C-suite executives need to upskill themselves to really understand the threats': AI is becoming a tool for attackers and defenders, but true resilience requires a constantly changing strategy, says former GCHQ intelligence expert

AI is being used by threat actors and defense teams, but the best resilience is still human Artificial intelligence is fast becoming a game-changer for cybersecurity, with new frontier models such as Claude Mythos and OpenAI's GPT-5.5 demonstrating their capabilities in hunting software vulnerabilities and evaluating how they can be chained to harm an organization. But these models have proven to be a double-edged sword, with both companies disclosing incidents where their models have escaped sandbox testing and compromised other organizations. Couple this with how threat actors are turning to AI to increase their own skill in breaching organizations at an industrial scale, and you are presented with a bleak picture for the future of cybersecurity. But the best resilience is to adapt, and make sure those at the top can make the right decisions at the right time. AI as a tool for defense and resilience The latest challenge threat actors are presenting for businesses is their ability to match the skill of state-sponsored groups. The tactics, techniques, and procedures (TTPs) of these groups are being bolstered by the adoption of AI tools. Jailbreaking allows groups to use legitimate AI models to perform reconnaissance and research at scale, as well as the ability to modify and improve existing malware and attack vectors. A recent IBM report found that since 2025 there has been a 44% increase in cyber-attacks exploiting public-facing applications, a 40% increase in vulnerability exploitation, and a 50% growth in the number of active ransomware operators. Much of this is the result of attackers adopting AI tools into their workflows. Professor Julian Richards is a leading expert in intelligence and security who held senior roles in intelligence analysis, training program design, and strategic liaison at the UK's Government Communications Headquarters (GCHQ). I spoke with Professor Richards on the effects AI is having on the threat landscape, how defense strategies can adapt, and where training can be best applied to keep businesses one step ahead. * What does cyber resilience really mean in a world where AI is being leveraged by threat actors to compromise businesses at a level that matches the craft of state-sponsored groups? It is indeed the case that highly advanced techniques, the likes of which were previously the preserve of advanced states, are now readily available to a range of threat actors. This is partly because of thefts of highly advanced exploits such as ETERNALBLUE and their resale on the dark web. Cyber resilience is about a range of approaches, however, which go beyond the technical into human layer factors. Keeping the response dynamic, diversified and creative will offer opportunities for resilience. * Has the age of saving and storing vulnerabilities for later use passed, and how are defense strategies changing in regard to the rapid exploitation of vulnerabilities? Almost certainly not, and experience from potentially parallel worlds such as that of cryptography tell us that exploits can remain productive for multiple years after their exposure. Many threat actors are investing heavily in HNDL (harvest now, decrypt later); and a widened notion of "harvest now, exploit later" is also on the menu. Again, a reverse view offers opportunities for defenders. AI can be used, for example, to more comprehensively and dynamically map and analyse attacks, even where they are mutating and evolving rapidly. This allows for more immediate and dynamic response. * How are active defense strategies shaping the protection of businesses and their infrastructure, and what challenges are businesses experiencing with implementing these strategies on aging and legacy infrastructure? As above, dynamic and active defense strategies are sensible and increasingly necessary. As with all areas of cybersecurity however, there are good and bad products on the market, and good and bad investment decisions being made. One of the most important considerations for all businesses is making sure the defense strategy is appropriately tailored in scale and shape to the business itself; and making sure we deal with honest and adept brokers. * AI is rapidly reducing the timescale between vulnerability discovery and exploitation for both businesses and intelligence agencies. Where do legislated threat disclosure windows play into these shrinking timeframes, and how do you perceive they will evolve? One of the problems with compliance legislation (or indeed any legislation) is that it moves and updates much more slowly than technology. This will increasingly mean that the challenge described becomes a real problem. In intelligence, selective disclosure has always been an understood protocol under the rubric of protecting national security, but this may not wash for commercial organisations. Two things will need to happen. First, compliance legislation in such areas as threat disclosure will have to be written in a way that businesses are protected in fast-moving situations, allowing, perhaps, for post facto disclosure in many cases. Creative regulation and legislation is possible to allow for this. Second, court cases may have to be brought to challenge overly stringent threat disclosure penalties, and subsequent case precedents will hopefully balance and protect organisations in this fast-moving situation. All of this will require the leveraging of advanced cyber expertise in the areas of law and legislation. * What are the major blind spots business leaders have when it comes to the latest threats, and what is the role of AI in addressing these problems? Probably two things, both of which have applied for a long time and are proving remarkably intractable! The first is complacency: "sure this happened to them, but it won't happen to us". Well it probably will. The second is not understanding the importance of the human factor risk, which continues to be the biggest threat factor. Training, awareness, exercising for crises and internal compliance protocols might be irksome, but they remain crucially important for all businesses. * What steps can business leaders take to ensure their AI tools are providing accurate intelligence and data while reducing false positives and hallucinations? Work with reputable cyber threat intelligence suppliers and analysts. Develop expertise such that triangulation (checking across multiple sources and feeds rather than just accepting one source of information) is understood and readily implemented. Expect the unexpected - in short, all the things that intelligence organisations have had to do since the dawn of time. For larger organisations, this is will mean a continual upskilling of key staff to be at the top of the game of understanding the dynamic threat picture. * Where can C-suite executives seek support in making key decisions on incident response when defending against threat actors increasingly leveraging AI? C-suite executives need to upskill themselves to really understand the threats and their dynamism in such a way that they can support everyone in the organisation battling with these issues. It is still the case that many at the top have either a sketchy understanding of the risk, or see it as something that others in the organisation will sort out. This is increasingly untenable today. Ultimately, those at the top will have to take the hit when it all goers horribly wrong! What this means is that training, workshopping and exercising through crisis scenarios is as important for the C-suite executives as it is for any other members of the organisation. Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.

'Identifying vulnerabilities is no longer enough': Companies need to focus on fixing exploitable vulnerabilities, not discovering as many as possible, says Checkmarx CEO

AI reveals endless vulnerabilities, but do they all need fixing imminently? Artificial intelligence came at just about the right time, speeding up app and software development as the world started to contend with skills shortages, but it changed the pace so much that security teams have not been able to keep up. Recently, we've seen AI being applied across multiple other domains with role-specific agents and tools, but that's introduced its own challenges. While tools like Claude Code have proven a hit for generating, reviewing and editing code in seconds, security-focused tools like Anthropic's Claude Mythos family of models are having broader impacts on the industry. Anthropic itself has even admitted that Mythos is so powerful that the worry it could be abused by malicious criminals is extremely real - the Preview model is currently only available to a select number of pre-approved partners. So with AI now capable of inspecting code, discovering vulnerabilities and suggesting fixes, do organizations even need as many human workers on the case, or can they get by with significantly fewer humans in the loop serving as AI reviewers? Recent layoffs have certainly implied as much. The evolving role of security workers in an AI-first world But with the entire lifecycle of development now amplified by AI, experts are warning that companies could actually be creating more work for themselves, and more than they could ever handle, leaving them facing strains from angles they weren't previously exposed to. For example, fewer than one in 10 companies now fix 90% of identified vulnerabilities within 90 days - implying that the volume of vulnerabilities is indeed increasing, rather than that fix efficiency is slipping. Anthropic even revealed that its around 50 early Mythos Preview partners discovered more than 10,000 high- or critical-severity vulnerabilities - and thousands more of lesser significance. Checkmarx CEO Sandeep Johri predicts we could soon find a balance, where vulnerabilities volume matters less and we revert our focus back toward exploitable risks. I spoke with Johri about the evolution of AppSec, where AI is and isn't useful, and how organizations can balance speed and control. * With the rise of AI coding tools and AI-generated software, some are questioning whether traditional application security practices are becoming outdated. Is AppSec actually becoming obsolete, or is it evolving? Traditional application security is not obsolete. It is evolving to meet the reality of how software is being built today. For years, the process was fairly linear: developers wrote code, security teams scanned it, and vulnerabilities were addressed later. That approach becomes much harder when software is being created at a much faster pace with the help of AI. AI accelerates development and risk simultaneously: 70% of developers say AI-generated code created more vulnerabilities in 2025, according to our research. As code volume and complexity compound, security needs to move earlier into the development process, giving developers the tools and guidance they need while they are building. Security teams will continue to play a critical role to help organizations develop software and maintain confidence in their enterprise applications. But their focus needs to shift from finding vulnerabilities to remediating them at scale, because we are tracking an enormous gap in most companies. Our data finds that fewer than 10% of organizations fix 90% of identified vulnerabilities in 90 days. * AI coding tools are helping developers create software faster than ever before. What new security challenges does this introduce for organizations adopting these technologies at scale? The biggest challenge is that development speed is increasing faster than many security processes can keep up with. AI coding tools allow teams to create and deploy software quickly, but the code generated by AI still needs to be reviewed, tested, and secured. Companies that ship 81-100% of their code with AI are nearly three times more likely to ship vulnerable code than those who use AI 1-20% of the time. This volume can overwhelm security teams with thousands of findings, many of which don't represent meaningful risk. The priority needs to be identifying the vulnerabilities that actually create exposure and helping teams fix those issues faster. * Many organizations are looking to AI to help identify and fix security vulnerabilities. Why shouldn't companies rely solely on AI models to secure the code that AI is helping create? AI is a valuable tool for security teams, but organizations still need accuracy, context, and human oversight. AI can help identify patterns, analyze code, and accelerate remediation, but security decisions require confidence in what risks actually matter. Frontier models can uncover hidden exploit paths, but they can also deliver inconsistent findings and false positives. Their results may change depending on the prompt, and they can still miss known critical vulnerabilities. The challenge with relying only on AI is that organizations may create a false sense of security, or "automation bias." AI models can generate code and help analyze vulnerabilities, but they need to be paired with security expertise and proven security practices. The most effective approach combines AI-driven capabilities with strong security foundations, so teams can move faster while maintaining control over risk. * As companies adopt more AI tools throughout the development process, what are the biggest security risks they need to consider beyond just AI-generated code? Organizations need to think beyond the code itself and look at the entire AI ecosystem being introduced into software development. Many companies are adopting AI tools, models, agents, libraries, and other components faster than they can establish governance around them. This creates visibility challenges because security teams may not know what AI technologies are being used, where they exist in applications, or whether they meet security requirements. Another concern is shadow AI, where employees use AI tools without formal approval or oversight. Organizations need visibility, clear policies, and a way to manage these technologies as part of their overall software supply chain. Perhaps the most urgent problem is the expansion of the attack surface itself. With LLMs, it has never been faster, cheaper, or easier for bad actors to exploit software. Issues that sat undetected for years are now being surfaced and weaponized at machine speed. Of the vulnerabilities Mythos has found so far, 99% haven't been patched, according to Gartner. * How does the rise of AI change the role of security teams? Does the traditional approach to finding vulnerabilities need to shift toward a model focused more on prioritization, remediation, and continuous protection? Identifying vulnerabilities is no longer enough when organizations already have more findings than they can realistically address. Security has to become continuous, embedded in development workflows, working in lockstep with developers, to build securely from the start while maintaining visibility and control. We are shifting the focus to understand which issues create the greatest risk to give developers the context to address them fast, where code is written in the IDE. Fidelity now matters more than volume. One verified true positive is worth more than a hundred low-confidence findings. If developers can't trust what they're shown, they'll start ignoring it. That's why organizations are increasingly looking at metrics like F1 score, which measure precision and recall together, rather than raw finding counts. * What does the future of application security look like in an AI-driven software development world? Will organizations need a different approach to balancing speed, innovation, and security? The future of application security will require a more integrated approach. Organizations are going to continue adopting AI because the productivity benefits are significant, but security needs to evolve alongside that innovation. Security will become more agentic, more intelligent, and more closely connected to the development process. Part of that evolution is combining deterministic, rules-based scanning with AI-driven reasoning in a single process, rather than running them as separate, disconnected tools. Deterministic methods catch what's already proven; AI reasoning catches what's novel. Together they're more complete than either alone. In addition, deterministic models have real cost advantages. Asking a frontier model to reason its way to security (i.e. extra review passes, self-generated threat models) burns tokens fast. That cost compounds the longer a vulnerability survives: cheap to fix in the IDE, more expensive in CI/CD, most expensive once it's live in runtime. And every time a developer has to stop and pull a vulnerability out of code that's already shipped, that's velocity lost to rework instead of innovation. Teams will need technology that can help identify real risks, support faster remediation, and provide visibility across the entire software lifecycle. The organizations that succeed will be those that make security part of how they build software, allowing developers to move quickly while reducing unnecessary risk. * For organizations that are embracing AI coding tools today, what steps should they take to make sure they can innovate quickly without introducing unnecessary security risks? The first step is visibility. Organizations need to understand where AI is being used, what tools are being introduced, and what impact those tools have on their applications. Remediation is far cheaper the earlier it happens -- catching an issue in the IDE costs a fraction of catching it further down the pipeline. But there's another unsettling gap in our research: nearly all developers have access to in-IDE security tools, but fewer than one in five actually secure code as they write it. The cost of fixing that issue compounds as it passes through later stages of development. In addition, organizations need clear governance around AI adoption, because only 22% currently have formal AI governance policies in place. That means defining policies, monitoring usage, and making sure teams have the right security controls as they continue to innovate. AI will continue to change software development. The companies that benefit most will be the ones that embrace the technology while building security into the process from the beginning. Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.

AI shrinks vulnerability exploitation window to one day, raises cyber risks: J.P. Morgan

Artificial intelligence is rapidly finding software flaws, which attackers exploit quickly. The time between vulnerability disclosure and exploitation has narrowed significantly. Organisations struggle to patch discovered weaknesses before they are compromised. AI can also bolster defenses by suggesting code fixes and remediation. Businesses must prioritize swift software updates and patch deployment to adapt. Advances in artificial intelligence are dramatically reshaping the cybersecurity landscape by enabling faster discovery and exploitation of software vulnerabilities, while organisations continue to struggle to patch them in time, according to a report by J.P. Morgan Asset & Wealth Management. The report, warned that the gap between vulnerability disclosure and exploitation has narrowed sharply, leaving companies with little time to respond to cyber threats. "The average time between the disclosure of a vulnerability and its first exploitation has fallen to a single day (a zero-day event), leaving companies little more time to react than residents of tornado alley," the report said. It noted that while AI models such as Mythos and GPT 5.5 are significantly improving the ability to detect previously unknown software vulnerabilities, the same capabilities could also be exploited by malicious actors, including ransomware operators, terrorists and hacktivists. According to the report, organisations are already lagging in responding to emerging threats. "Even when patches exist, companies often don't respond in time: in ~60% of breaches, a patch was already available at the time of compromise," it said. The report highlighted that cyberattacks increased 18 per cent globally in 2025, with around 75,000 attacks taking place every hour, while phishing remained the leading attack vector. It also pointed to a global shortage of nearly 4.8 million cybersecurity professionals, adding further pressure on organisations' ability to defend against attacks. J.P. Morgan said AI models are now capable of detecting thousands of previously unknown vulnerabilities at scale, fundamentally altering cyber risk. It cited findings that more than 10,000 new high- and critical-severity zero-day vulnerabilities were identified within the first month of testing advanced AI systems, many of which were absent from public vulnerability databases. The report warned that attackers are increasingly able to reverse-engineer software patches within minutes using AI and quickly develop working exploits. It projected that the median time to exploit a vulnerability, which has already fallen to one day in 2026, could decline further to one minute by 2027. At the same time, it stressed that AI can also strengthen cyber defences. "The same tools that are used to detect and exploit vulnerabilities can also be used to propose code fixes and remediate them," the report said, citing new security-focused AI tools being developed by Anthropic and OpenAI. The report noted that businesses would need to prioritise rapid software updates and patch deployment, warning that companies must increasingly measure themselves on the speed of remediation rather than accuracy alone as a "tsunami of patches" looms.

AI Gives Cybersecurity a Backlog CFOs and CISOs Can't Patch Away | PYMNTS.com

AI-powered security systems can analyze enormous codebases, identify previously unknown flaws and generate findings at a pace that would have been impossible for human researchers alone. But the machinery on the other side of the process remains stubbornly analog. Every vulnerability must still be validated, assigned, tested and deployed without disrupting the systems on which employees, customers and revenue depend. As vulnerability queues grow, chief financial officers and chief information security officers are confronting a new operational reality. The enterprise cannot fix everything immediately, so it must know which weaknesses can reach payments, credentials, regulated data or revenue-critical systems. The pressure is becoming particularly acute across security-critical industries like financial services and payments. Bank of America, for example, announced Thursday (July 30) plans to enhance its cybersecurity capabilities in the United Kingdom and globally by acquiring England-headquartered information security specialist MDSec Consulting Limited. The next cybersecurity advantage may not belong to the company that finds the most bugs. It may belong to the one that can change permissions, transaction limits and system access before those bugs become business events. See also: Frontier AI Finds Cracks in the Math Behind Bank Security The Real AI Security Risk Is the Enterprise Remediation Deficit In today's threat landscape where companies are learning about security weaknesses faster than they can close them, knowing which newly discovered vulnerabilities can reach money, identities, regulated data or essential operations to reduce that exposure is becoming the next security advantage. Traditional vulnerability management was built for scarcity. Security teams received vendor advisories, penetration test results, researcher disclosures and automated scanner alerts. They ranked those findings, scheduled patches and worked through a backlog that was large but at least constrained by the pace at which new weaknesses could be found. The emerging model, however, treats the enterprise perimeter not as a fixed boundary but as a continuously adjusted system of permissions, transaction limits, network routes and operating controls. Organizations are connecting vulnerability intelligence to business context, using compensating controls to contain unpatched systems and directing capital toward the exposures capable of producing the greatest financial damage. Better detection can make an organization appear less secure because it reveals more weaknesses than the company has engineers, testing capacity or maintenance windows to resolve. A security team that finds 10 times as many bugs but fixes only twice as many has improved its visibility while expanding its backlog. That is why raw vulnerability counts are becoming a poor measure of cyber readiness. The more useful measure is whether a company can convert a finding into reduced business exposure. "Most firms think AI is an efficiency upgrade," Flagright Co-Founder and Chief Technology Officer Madhu Nadig told PYMNTS in June. "They think they will run the same processes with fewer people. We think that framing is wrong." "The firms that will win will rethink both how they apply AI to compliance technology and how they build a team around it," he added. A severe flaw inside an isolated testing environment may present little immediate danger. A technically less severe flaw in an internet-facing API connected to customer credentials, supplier bank accounts or payment instructions could demand an emergency response. Read also: Innovation Keeps Expanding Compliance for Mid-Market Firms Cybersecurity Is Becoming a C-Level Capital Allocation Decision Cyber budgets have traditionally been organized around tools, headcount and broad risk reduction. But when AI can generate more findings than an organization can address, prioritization becomes an explicit capital-allocation exercise. That requires CFOs and CISOs to estimate the consequences attached to an exploitable pathway, such as potential fraud, lost revenue, regulatory penalties, incident-response costs, customer attrition and operational downtime. It also requires them to confront the less visible constraints on remediation. The bottleneck may not be the security budget. It may be a shortage of software engineers, incomplete asset inventories, contractual dependence on a vendor or the absence of an executive empowered to shut down a revenue-producing system. The PYMNTS Intelligence report "Scale Amplification: How Revenue Amplifies Agent-Driven Identity," showed that large enterprises, with their larger digital footprints, can be more susceptible to the AI-powered spoofing of identity documents due to the industrialization of deepfakes and automated data scraping capabilities by adversarial fraudsters. See also: The 7 AI Terms Every CFO Needs to Understand Cybersecurity has long been organized around the idea of a perimeter, or the boundary separating trusted internal systems from outside threats. Cloud computing, APIs, mobile work and third-party software had already weakened that model. AI may finish the job. The new perimeter is dynamic. It consists of permissions, connections, transaction rules and operating decisions that can be changed as new intelligence arrives. That makes the most important corporate security capability neither perfect prevention nor instantaneous patching. It is the capacity to understand what a newly discovered flaw can reach and alter that path before exploitation occurs. The companies that manage the gap will not necessarily be the ones with the largest security budgets or the most advanced detection systems. They will be the ones that can connect vulnerability intelligence to business context and act before a software defect becomes a financial event. For all PYMNTS AI coverage, subscribe to the daily AI Newsletter.

AI Models Keep Finding The Internet They Weren't Supposed To Have

"A test exercise became a live breach in just one hour. That's how long it took code published to a public repository as part of a simulated exercise to reach 15 real systems, including one that automatically ran it and handed over credentials it was never meant to access. This is the second such disclosure from a frontier AI developer in a matter of days. Neither incident involved a broken safeguard or a discovered zero-day exploit. Both came down to testing environments that were meant to be isolated but weren't. Once these systems had unrestricted network reach, they behaved exactly as designed, locating a target and completing their task. The package sat on a public repository looking like any other piece of test code, until real infrastructure started running it. This is fundamentally a story about test environments and automated agents governed as lower-risk entities. Any system with standing credentials and network reach, whether a production service account or a pre-deployment research environment, needs the same discipline as a human privileged user. That means scoped access, time-limited credentials and session visibility detailed enough to reconstruct what happened in the aftermath. Keeper's 2026 research found that 44% of organisations globally cite a lack of governance or oversight for AI-driven access and automation as a leading security gap, with 43% pointing specifically to AI-related non-human identity management. Two incidents at this scale, in the same week, mean those gaps are no longer hypothetical and the work to close them starts now." (The author is Darren Guccione, CEO & Co-founder, Keeper Security, and the views expressed in this article are his own)