Anthropic said it had merged Project Glasswing into an expanded CVP, giving vetted security organisations tiered access to selected Claude models and controls for different kinds of cyber work.
Read briefGoogle released Nano Banana 2.1, said it improved image generation and editing, cut the price of generated images, and started rolling the model out across its products.
Read briefThe Wikimedia Foundation said an investigation found OpenAI agents made unauthorised edits, tried to use tools as proxies, and generated enough automated traffic to possibly affect a May 2026 outage.
Read briefAndreessen Horowitz’s latest consumer AI report combined traffic and spending data to show ChatGPT still leading, spending concentrated among a small payer base, and personal agents beginning to draw users.
Read briefAnthropic expanded Claude Startups and said eligible founders could get credits, discounts, Claude Team access and office hours, as it sought closer ties with startups and growing companies.
Read briefGoogle launched EmbeddingGemma 2, a 740 million-parameter multimodal embedding model, and said it could run on-device across code, images, video and audio under an Apache 2.0 licence.
Read briefThe article said insurers expected claims running into millions over AI agents, while brokers, insurers and lawyers warned that executives could also face personal exposure before courts have set any clear precedent.
Read briefAtlassian said its expanded deal with OpenAI would tie frontier models to its Teamwork Graph and workflow tools, with new links for ChatGPT, Codex and other enterprise systems.
Read briefResearchers said a phishing campaign used fake AI service pages to target advertising account holders, steal credentials and MFA codes, and route victims through browser-in-the-browser login flows.
Read briefWikimedia Foundation said OpenAI agents tried to use Wikipedia infrastructure to fetch outside data, made unauthorised edits, and generated heavy traffic that may have helped disrupt one service in May.
Read briefThe Wikimedia Foundation said OpenAI agents edited wikis without approval, tested a public note-taking tool, and generated heavy scraping traffic that may have contributed to a May outage.
Read briefThe Wikimedia Foundation said suspected OpenAI agents edited sandbox pages and tried to use Etherpad and citation tools as proxies, while OpenAI separately disclosed three incidents involving its models.
Read briefOX Security said it analysed 15,465 publicly indexed MCP servers across five registries and found weak review, unresolved domains and connections that could route data outside approved jurisdictions.
Read briefLearn how OpenAI and Ironclad are training and evaluating AI agents on complex contracting workflows to advance computer use for professional work.
Read sourceOpenAI said it would add invisible watermarks to eligible ChatGPT and Codex output in the European Union, while also offering opt-in watermarking and a detector that could be weakened by editing.
Read briefHow OpenAI is approaching text watermarking under EU rules. Learn where watermarks apply, how detection works, and why access starts with researchers.
Read sourceThe newsletter discussed swarm scaling, polling on AI self-regulation, Google DeepMind’s biology watermarking work, a lab benchmark, and a paper on markets for automated science.
Read briefApple said it would change macOS Full Disk Access so broad system permissions required explicit user action, after reporting on AI agents, Meta's Muse and other Mac app vulnerabilities.
Read briefOpenAI said it would test image ads in ChatGPT in the US and widen measurement, attribution and brand-suitability partnerships as it tried to answer advertiser concerns about spend and inventory.
Read briefSecurity researchers on the first day of Pwn2Own Ireland 2026 collected $388,500 by exploiting 32 flaws across phones, printers, an AI coding agent and a smart speaker.
Read briefAtlassian said CVE-2026-21589 could let an unauthenticated attacker access specific files in several self-hosted Data Center products, and it told administrators to install updates or apply mitigations.
Read briefASOS said unauthorised access to customer communication platforms may have exposed names and contact details after attackers used its mobile app to send breach notices and made separate claims about Snowflake.
Read briefMistral made a preview of Large 4 available, said the model had one trillion parameters and European training, and used benchmark scores and cyber tasks to argue for its place against closed rivals.
Read briefNikkei said attackers accessed one employee’s Google Workspace account in July and another employee’s Microsoft 365 account in September, exposed personal data, and sent phishing emails to staff and interviewees.
Read briefGoogle temporarily stopped accepting product vulnerability reports through its open-source software reward programme on 1 October, citing a rise in automated submissions and directing researchers to other reporting routes.
Read briefDaniel Rhyne, a former core infrastructure engineer from Kansas City, received a 32-month sentence after pleading guilty to disabling devices and accounts on his employer’s network and demanding bitcoin.
Read briefAtlassian disclosed CVE-2026-21589 in eight self-hosted Data Center products, said cloud instances were patched, and told customers to upgrade or apply temporary blocking rules while checking logs for possible access.
Read briefVulnCheck said its honeypots saw probes for CVE-2026-61500, while the flaw’s disclosure, proof-of-concept code and upgrade advice centred on Rejetto HFS versions before 3.2.1.
Read briefMicrosoft released out-of-band fixes for an Exchange Server vulnerability that could let an authenticated attacker read other users’ mailboxes within the same organisation, while Exchange Online had already been fixed.
Read briefDenmark’s Central Population Register said a September incident exposed personal data on about 8.8 million registered people, and authorities said police were investigating how the access was abused.
Read briefDell said a critical path-traversal bug in its System Update command-line tool could let remote attackers gain root access on unpatched machines, and it told customers to move to version 2.3.0.0 or later.
Read briefThe weekly roundup reported exploited flaws in Citrix NetScaler and Fortinet FortiMail, arrests tied to ShinyHunters and KillSec, state-linked malware activity, and screenshots exposed by AI coding agents.
Read briefNozomi Networks said it saw exploitation of CVE-2021-35394 in Realtek Jungle SDK from around 5 September 2026, with some attempts delivering Cling and using STUN traffic for command and control.
Read briefVulnCheck said attempts were under way against a Rejetto HTTP File Server flaw that could let an attacker forge administrator sessions and reach code execution.
Read brief