Dylan Freedman / New York Times : Researchers add details to the Hugging Face incident, including OpenAI agents creating ~1M shortened URLs to encode information in an attempt to solve CAPTCHAs — A new report by a Bay Area start-up called Parse adds new details to an incident…
Read sourceMicrosoft’s Surface chief said the 2026 Surface PCs are not labelled Copilot+ PCs, even though they still meet the earlier requirements, while Qualcomm described the term as a category for NPU features.
Read briefA federal appeals court backed the Pentagon’s move to treat Anthropic as a security supply chain risk, while the company said the designation has cost it billions and is affecting its IPO plans.
Read briefRobert O'Callahan said he left Google DeepMind because he could no longer justify work that helped make AI cheaper and faster, and he argued that near-term superintelligent AI was irresponsible.
Read briefDonald Trump said Scott Bessent would not become his artificial intelligence czar after reports that the Treasury secretary had been under consideration for the role.
Read briefMicrosoft said it split Copilot into Home, Code and Autopilot, made the new agent run in the cloud, and moved several features to usage-based billing.
Read briefAnthropic opened Claude Code cloud sessions to eligible subscribers and offered promotional credits to qualifying Pro and Max users, with the balance applied automatically during cloud use.
Read briefA Washington appeals court upheld the Pentagon’s ban on Anthropic in a 2-1 ruling, leaving the company to pursue rehearing options after a separate federal court struck down a related designation.
Read briefIn a long commentary on Jensen Huang’s appearance on Ezra Klein’s podcast, the post said the Nvidia chief treated AI as software, argued for tighter safety practice, and made claims about jobs, education and open models.
Read briefOpenAI was said to be testing a ChatGPT Pro Max subscription at $500 a month, with screenshots showing it in the app and its launch timing still unclear.
Read briefMicrosoft unveiled a redesigned Copilot app that brought chat, coding and agent functions into one interface, renamed Scout as Autopilot, and tied more of the experience to usage-based billing.
Read briefGoogle is testing Call for Me, a Gemini feature that places calls to businesses on users’ behalf, with early access limited to Pixel 11 owners in the US on a paid plan.
Read briefAnthropic agreed a seven-year cloud contract with Akamai Technologies and received a stock warrant, while the article also said its reported compute commitments had reached $517 billion in eleven months.
Read briefPolitico said the White House asked OpenAI and Anthropic to wait for U.S. agency review before giving new models to the U.K.'s AI Safety Institute, while Anthropic had already limited one model to U.S. users.
Read briefAnthropic published a paper arguing that democracies should keep the lead in frontier AI, warning that weaker US controls could let Chinese labs catch up by 2028.
Read briefAn interim report from the Forecasting Research Institute said specialists in academia, industry and economics repeatedly predicted slower AI progress than later benchmark results and adoption figures showed.
Read briefGoogle introduced Gemini 3.8 Live with Live Avatar, saying it adds a visual presence to live dialogue, supports background tool use and multilingual switching, and is now available in Gemini Enterprise.
Read briefClop said it shifted its Tor leak site after ShinyHunters compromised the old server through a Grav CMS flaw that Grav later confirmed and backported to the 1.7 branch.
Read briefA CSRF flaw in Elementor Website Builder let an unauthenticated attacker turn a logged-in administrator’s session into account creation, and Elementor patched affected releases in version 4.3.2.
Read briefCISA said attackers were exploiting flaws in WSO2, Adobe Commerce, Microsoft SharePoint and Mikrotik RouterOS, and it set September deadlines for federal agencies to patch the critical issues.
Read briefTwo actions-cool GitHub Actions were disabled again after their repositories became accessible, and Socket said their tags still pointed to malicious code added in May 2026.
Read briefJamf Threat Labs said a new PamStealer build fetched a server-controlled decryption utility, used a fake Wavel site for delivery and added several persistence paths on macOS.
Read briefBitget said suspected North Korean hackers took $351.6 million from hot and warm wallets, paused withdrawals, and brought in Mandiant and SlowMist while it reviewed the incident.
Read briefCanadian officials said a patched Roundcube Webmail SQL injection flaw was under active exploitation, while outside reporting and internet scans showed exposed instances and earlier abuse of related bugs.
Read briefCISA added two critical flaws affecting WSO2 and Adobe Commerce to its exploited-vulnerabilities list after reports of active abuse, and federal agencies were told to patch them by 27 September 2026.
Read briefKaspersky said a MacSync campaign hid commands in public iCloud calendar descriptions to fetch payloads, while a new Objective-C backdoor added persistence, remote execution and data theft functions.
Read briefThreatDown researchers at Malwarebytes said Carbonato used exposed Docker APIs to launch privileged containers, install Hermes Agent and keep access with SSH, Telegram and several persistence mechanisms.
Read briefThe article said FedRAMP's VDR and VER rules raised scan frequency, shortened remediation deadlines and required machine-readable evidence, while presenting them as the first stage of a broader shift away from Rev5.
Read briefCanada’s cyber security agency said attackers were exploiting a Roundcube Webmail SQL injection flaw patched in May, and advised administrators to update or remove the affected plugin.
Read briefCTM360 said its report traced ClickFix campaigns through more than 17,000 URLs, on-chain lure rotation and a compromised WordPress host, ending in Vidar Stealer on a signed Microsoft process.
Read brief