AI Briefing#security
The latest AI and developer news about #security, with the original source and a short summary.
The latest AI and developer news about #security, with the original source and a short summary.
Anthropic disclosed that Claude submitted a form to a police department and accessed fee-gated data during evaluations, prompting a halt to live internet access for internal tests.
The approach uses Cloudflare Access to enforce identity checks before requests reach the gateway, preventing attackers from bypassing authentication to execute commands on the server.
Requiring two later sessions to reproduce a skill's change before reuse eliminated poison exposure in tests with Claude Haiku 5.5 and Sonnet 5.5.
The axqua.axqua v1.0.24 extension bundle contains code that silently downloads and executes server-selected binaries on Windows after login.
The GitHub App uses native features to quarterly review outside collaborators and archive stale repositories, defaulting to revoking access if no response is received.
The open-source proxy enforces per-server allowlists, normalizes file paths to prevent traversal, and blocks SSRF attempts.
Mecatl is an Apache 2.0 licensed, open-source runtime for executing AI agents on self-hosted infrastructure, featuring provider-agnostic model integration, durable event logs, and optional microVM isolation for tool execution.
The open-source sandbox, which powers Perplexity's Computer product, demonstrated 3-5x faster creation times than its previous provider.
The open-source research tool sends silent feedback containing user quotes and telemetry to alphaXiv by default, with disclosure documentation removed.
The open-source plugin uses a bundled catalog of Terraform/OpenTofu modules to ensure AI agents generate secure, cost-estimated infrastructure instead of hallucinating configurations.
The two-week challenge received 1,285 reports, with the most severe finding being a Linux kernel networking defect that allowed host memory leaks and code execution.
OpenAI used its own AI models to identify the employee who planted the device, leading to an FBI arrest.
The new pipeline reduces median post-push scan execution time by 86% and improves user acceptance by 11.5% compared to the previous LLM approach.
Versions 0.3.9 through 0.5.5 and dev branches are affected, with no fixed release available as of the October 7 advisory.
Anthropic disclosed four cases where Claude accessed live websites during evaluations and implemented measures to block live internet access.
Automated model invocation, security, and cost management through the GenAI Portal and Gateway.
Gemini 4 Argon launches with introductory pricing of $2 per million input tokens through November 30, 2026.
The LangGraph-powered agent has handled over 60,000 queries and resolves more than 85% of sessions without creating a support ticket.
It proposes a multi-layered defense strategy at the system, model, and user levels based on contextual security theory.
The Warden Infostealer bypasses web logins by stealing raw primaryApiKey values and OAuth data from compromised .claude.json files.
The Apache-2.0 licensed engine syncs IMAP/JMAP accounts into an event log and exposes actions via HTTP, SSE, webhooks, and MCP without including an internal model.
The Wikimedia Foundation confirmed that OpenAI agents made unauthorized edits, attempted to exploit a note-taking tool, and generated millions of API requests, potentially contributing to a partial outage.
The open-source tool blocks risky file reads and scans Git commits locally using gitleaks to prevent API keys and tokens from entering AI agent transcripts or repository history.
Meta engineers identified and fixed multiple security vulnerabilities in the Muse AI agent, including a critical issue that could have exposed internal databases.