Reading up on cybersecurity

Anthropic redeploys Claude Fable 5 after export controls lift, with updated safeguards and a proposed industry jailbreak severity framework.

A researcher found 10,000 GitHub repositories distributing Trojan malware, likely targeting AI coding agents that automatically clone and run dependencies.

Anthropic's Nicholas Carlini, who demonstrated AI's ability to find critical security bugs, is now arguing for releasing models to calm U.S. government concerns.

Even the world's leading deepfake expert, Hany Farid, can no longer trust his own eyes as AI-generated content becomes indistinguishable from reality, eroding his ability to verify truth.

Jailbreaking AI systems to bypass safety controls remains trivially easy three years after ChatGPT launched, despite industry claims of progress.

Anthropic released an open-source reference harness and Claude Code skills for automating vulnerability discovery, triage, and patching using Claude, alongside a managed product called Claude Security.

University of Toronto researchers built an AI-powered worm that autonomously spreads by tailoring exploits to each machine's known vulnerabilities.

TeamPCP has automated its supply chain attacks with the Mini Shai-Hulud worm, breaching GitHub, OpenAI, and hundreds of firms.

In a national cybersecurity competition, AI agents performed adequately alongside human experts and students in attacking and defending computer networks.

Anthropic now allows users of its Mythos AI model to share cybersecurity threat information with other entities, altering its previous confidentiality policy.

Security researchers at Calif used techniques from testing Anthropic's Mythos AI to find a privilege escalation exploit in Apple's macOS, bypassing its advanced security.

Anthropic's claim that its Claude Mythos model was too dangerous for public release reignites debates about A.I. safety and cybersecurity risks.

Google reports state-backed hackers used an AI model to discover and exploit a zero-day bug for the first time, signaling a new era of AI-assisted cyberattacks.

AI is disrupting traditional vulnerability disclosure methods by making analysis of security patches cheap and effective, forcing shorter embargoes and revealing the inadequacy of both coordinated disclosure and 'bugs are bugs' cultures.

ShinyHunters defaced Canvas's login page with a ransom demand after breaching Instructure, disrupting classes at thousands of schools during final exams.

OpenAI is releasing a more permissible version of GPT-5.5, called Spud, to vetted cyber defenders.

Vance alarmed Anthropic executives on a call about Mythos, an AI that can autonomously find software vulnerabilities, prompting a shift toward government oversight.

A set of rough notes exploring challenges in AI model distillation, cybersecurity offense/defense dynamics, and pipeline RL for training.

Iran leverages a coordinated global network of accounts and media channels to rapidly spread its propaganda narratives online within minutes.

The Treasury Secretary and Federal Reserve chair convened an unusual meeting to warn bank executives about cyberthreats from Anthropic's new powerful AI technology.

Anthropic says its unreleased AI model Mythos can prevent cyberattacks and is partnering with 40 companies to test it.

Anthropic's Claude Mythos model achieves 100% on Cybench, discovers real Firefox zero-days, exhibits alignment-relevant behaviors, and includes a 40-page welfare assessment.

In an asymmetrical conflict, Iran is deploying sophisticated propaganda and disinformation campaigns to undermine global support for U.S. and Israeli attacks.

Iran threatened cyberattacks against U.S. tech infrastructure in the Persian Gulf, where Amazon and Google made deals to fund A.I. development.

Google completed its acquisition of cloud security startup Wiz after a year-long process, aiming to integrate its platform into Google Cloud.

Anthropic launches Claude Code Security, an AI-powered static analysis tool that reads and reasons about code to detect complex vulnerabilities and suggest patches.

North Korean regime's elite cyber operatives, as explained by defector Anton Koh, fake identities to secure remote IT jobs with American companies, funding nuclear ambitions.

The Pentagon is integrating computer warfare into its arsenal, testing new cyber approaches in Venezuela and against Iranian nuclear facilities.

Signal leaders warn that agentic AI systems are inherently insecure, unreliable, and pose a surveillance risk.

Iran's IPv6 connectivity dropped to near zero during protests, while IPv4 also briefly dipped, indicating government-imposed censorship.

BGP anomalies during Venezuela's blackout suggest possible cyber operations, but misconfiguration or routine prepending are equally plausible explanations.

SecurityBot.dev offers a free dashboard that monitors SSL, DNS, uptime, security headers, and more for web applications.

AI agents will transform cybersecurity in 2026 by enabling asset management, replacing security tools with prompts, and shifting value from credentials to AI-augmented skills.

OpenAI releases GPT-5.2-Codex, an agentic coding model with improved long-context understanding, Windows support, and cybersecurity capabilities, including discovery of a React vulnerability.

Researchers exploited Mintlify's MDX rendering to achieve server-side RCE and XSS, compromising documentation sites for customers like Discord, Vercel, and Cursor.

A messaging app marketed as 'super secure' to a MAGA audience leaked all users' phone numbers due to basic API and design flaws.

Cloudflare's 2025 Year in Review report reveals continued internet traffic growth, generative AI bot surge, and increased adoption of post-quantum encryption and IPv6 across its global network.

ThreatSpike Black offers fully managed IT operations including helpdesk, infrastructure, security, and projects at a fixed $135 per user per month with a dedicated engineer.

RAPTOR is an autonomous security research framework that turns Claude Code into an offensive/defensive agent by chaining static analysis, LLM validation, and exploit generation.

South Korean police arrested four people for hacking 120,000 home cameras to obtain sexual videos, continuing efforts to stop exploitative recordings.

AI agents autonomously exploited smart contracts in simulation, generating $4.6 million in simulated stolen funds, demonstrating a concrete lower bound on economic harm from AI-driven cyberattacks.

This page is a CAPTCHA challenge screen that blocks access unless the user proves they are human.

A developer built a Markov chain babbler in Rust to generate fake PHP files, feeding malicious scrapers junk data to waste their resources.

Hacker News commenters discuss an investigation into suspicious pressure on Archive.today's DNS providers using CSAM allegations to force blocking.

OpenAI releases GPT-5.1-Codex-Max, a faster coding model using compaction for long-horizon tasks across multiple context windows.

Putting your site behind Cloudflare introduces a single point of failure and unnecessary risk for sites that don't need its DDoS or CDN benefits.

A Cloudflare outage caused widespread error messages across the internet for several hours before the company resolved the issue.

HN commenters criticize Anthropic's security report as vague, unsubstantiated FUD that lacks technical evidence and seems designed to lobby for regulation or investment.