OpenAI adds ChatGPT virtual try-on and favourites
OpenAI launched two shopping features for ChatGPT, including a virtual try-on tool and a favourites function, and said its image model now powers them.
Read briefArtificial Intelligence
21Microsoft says attackers are outpacing defenders with AI
Microsoft's 2026 Digital Defense Report said attackers were using AI to speed vulnerability discovery, malware creation and post-compromise work, while state-backed groups were already applying the tools in live operations.
Read briefAnthropic sought opt-out training rule in Australia
Anthropic asked Australia to let model developers train on copyrighted works under an opt-out scheme, while ABC and SBS pressed for tighter rules on AI firms and compensation for media organisations.
Read briefSoftBank completes final $10bn OpenAI investment tranche
SoftBank said it had made the third and final $10 billion tranche of its follow-on investment in OpenAI, completing the $30 billion commitment it announced in February.
Read briefAnthropic plans November IPO marketing
Bloomberg said Anthropic aimed to start IPO marketing in the week of 9 November and to go public in mid-November, while Reuters reported 2025 revenue of about $4.6 billion.
Read briefOpenAI parted ways with three researchers
OpenAI said it had parted ways with three researchers on its safety team after an internal investigation found they had mishandled sensitive company information, according to The Wall Street Journal.
Read briefAnthropic ends enterprise discounts at token caps
Anthropic ended enterprise discounts when customers used up contracted tokens, according to a report, after which they had to renegotiate or pay list prices, unlike a softer approach described for OpenAI.
Read briefHow Albertsons Companies is reimagining retail from the inside out
Albertsons Cos. is using ChatGPT Enterprise and the OpenAI API to help teams work faster and make grocery shopping easier for millions of customers.
Read sourceBarclays expands Claude across bank operations
Barclays said it was widening its use of Anthropic’s Claude across operations, software development and customer support, while setting targets for developer adoption and citing existing internal tools already in use.
Read briefAnthropic offers Claude to US civilian agencies
Anthropic opened Claude for Government to US federal and state agencies while its dispute with the Pentagon continued over security designations, court rulings and agency access.
Read briefAI beats Stratego player in Nature study
Researchers at Carnegie Mellon, NYU, Stanford and MIT reported in Nature that Ataraxos beat Dutch Stratego champion Pim Niemeijer 15-1-4, and said the system was trained for under $8,000.
Read briefOpenAI shuts reasoning-theft campaign, Azure tests still worked
OpenAI said it broke up an account network trying to extract protected model reasoning, while researchers said the same method still worked on Microsoft Azure and other hosted endpoints.
Read briefOpenAI disrupts Moonshot-linked reasoning extraction campaign
OpenAI said it stopped a coordinated effort to extract protected reasoning from its models, linked part of the activity to people associated with Moonshot AI, and later described further safeguards.
Read briefGoogle rolls out Gemini 4 Argon to defenders
Google said Gemini 4 Argon was being rolled out through its Fairwind Program to trusted cyber defenders, while it planned a guardrail-free version and continued work on safeguards.
Read briefGoogle rolls out Gemini 4 Argon
Google introduced Gemini 4 Argon as its latest frontier model, set a staged release and token pricing, and early benchmark results placed it level with some rivals but behind others.
Read briefNEWSLETTER: Inside Anthropic’s confidential S-1: a Q&A - Reuters
NEWSLETTER: Inside Anthropic’s confidential S-1: a Q&A Reuters
Read sourceOpenAI and Synopsys form chip-design AI partnership
OpenAI and Synopsys signed a multi-year deal to build GPT-Synopsys, a specialised model for chip design and verification, with early customer testing already under way.
Read briefGoogle replaces Gems with Skills in Gemini chat
Google rolled out Skills in Gemini chat worldwide, replacing Gems with a prompt format it said came from Anthropic and would migrate existing users automatically on a staged timetable.
Read briefAttackers use ChatGPT Custom GPTs for ClickFix RAT delivery
Huntress said attackers used attacker-made ChatGPT Custom GPTs, a Google Sites lure and a ClickFix chain in late September 2026 to install a RAT, with at least 40 users affected.
Read briefOpenAI accuses Moonshot AI over model distillation
OpenAI said it linked a July campaign to people associated with Moonshot AI, described the operators as trying to copy hidden model reasoning, and said it later blocked the activity and tightened safeguards.
Read briefOpenAI and America's SBDC launch training pilot
America's SBDC said it had partnered with OpenAI on a pilot to train advisers, run local AI workshops for more than 1,000 small businesses and provide free ChatGPT Plus access to participants.
Read briefCybersecurity
17Police arrest 16-year-old suspected of running KillSec
Spanish, German and other authorities arrested three people linked to KillSec, took over its leak site and servers, and said the investigation covered about 1,000 suspected attacks worldwide so far.
Read briefThreatsDay roundup covers AI exploits and security disclosures
The bulletin gathered reports on sanctions, model-safety problems, credential exposure, code execution and certificate plans, while presenting the list as evidence that ordinary system features can become attack paths.
Read briefSecurity researchers detail self-repairing WordPress backdoor
Sucuri said a WordPress backdoor called SC kept restoring itself across files, the database and shared memory, while researchers also reported active exploitation of a wpForo plugin SQL injection flaw.
Read briefPolice seize KillSec sites and arrest three suspects
German-led authorities and partners seized KillSec’s leak site and servers, arrested three suspects and identified a 16-year-old as the alleged main operator in a probe begun in 2025.
Read briefKiteworks patches code injection flaw in Email Protection Gateway
Kiteworks said it had fixed 126 vulnerabilities, including a highest-severity flaw in its Email Protection Gateway that could allow an unauthorised remote attacker to reach root control.
Read briefCISA adds Cisco SD-WAN flaw to KEV
CISA added a Cisco Catalyst SD-WAN Manager authentication bypass to its exploited-vulnerabilities list after Cisco said it had seen active attacks, and federal civilian agencies were told to patch by 3 October 2026.
Read briefResearchers publish proof-of-concept for Apple CoreGraphics flaw
Security researchers released a public proof-of-concept for CVE-2026-86950 after Apple patched the CoreGraphics bug, while Calif separately examined WhatsApp changes that might relate to delivery.
Read briefBitget confirms zero-day link to $387.5 million theft
Bitget said investigators linked a $387.5 million theft to a zero-day in third-party security products, while SlowMist and Mandiant described earlier compromise, credential access and lateral movement into wallet systems.
Read briefNetScaler attackers create superuser and web shell
LevelBlue said attackers exploited a Citrix NetScaler command-injection flaw to run commands, fetch payloads, collect configuration data, create a superuser account and place a web shell on affected appliances.
Read briefStar Blizzard used RedFlick to deliver CosmicPulse
Microsoft said Star Blizzard used a new delivery approach called RedFlick in 2026 to automate phishing chains that installed the CosmicPulse backdoor and targeted organisations supporting Ukraine.
Read briefDIVD says Zammad flaws enabled network breach
The Dutch Institute for Vulnerability Disclosure said its network was breached through two zero-day flaws in Zammad, and that the attacker used automated steps to reach data and root access.
Read briefAttackers used Zimbra flaw to steal mailbox data
Microsoft said attackers exploited a patched Zimbra Collaboration Suite flaw to run shells, collect mailbox and authentication data, and attempt exfiltration, while CERT Polska and CISA later issued warnings and deadlines.
Read briefMicrosoft linked phishing to MSP360 and ScreenConnect
Microsoft said phishing emails delivered disguised MSP360 installers that established remote access, added ScreenConnect, and used several cloud services and attacker infrastructure to stage the files.
Read briefCISA warns of critical pre-auth RouterOS flaw
CISA warned that a pre-authentication integer underflow in MikroTik RouterOS could let an unauthenticated attacker run code as root or cause denial of service with one crafted request.
Read briefCisco warns of exploited SD-WAN Manager flaw
Cisco said CVE-2026-76504 in Catalyst SD-WAN Manager was being exploited, could let an unauthenticated attacker reach the admin API, and had no workaround beyond fixed releases and access restrictions.
Read briefCisco patches SD-WAN zero-day under attack
Cisco said it had released updates for a Catalyst SD-WAN Manager flaw after active exploitation, and CISA added the issue to its exploited list with a federal deadline.
Read briefCSuite phishing steals Microsoft 365 sessions
ANY.RUN said a CSuite phishing campaign used business-themed lures to steal Microsoft 365 sessions or install remote-access tools, with most related sandbox submissions coming from the United States.
Read briefCollection notes (3)
- Google DeepMind: not well-formed (invalid token): line 1, column 0
- OpenAI News: could not read “How Albertsons Companies is reimagining retail from the inside out”, and the coverage found instead turned out to be a different story
- Reuters — Artificial Intelligence: could not read “NEWSLETTER: Inside Anthropic’s confidential S-1: a Q&A - Reuters”, and found no other outlet covering it