The LiteLLM project said its release pipeline was compromised on 21 October, letting attackers publish version 1.107.0 across package and container registries with malware that stole secrets and credentials.
Read briefAnthropic said it had transferred Agent Skills, the standard for agent workflows, to the Agentic AI Foundation, while giving adoption figures, maintainer names and the assets included in the handover.
Read briefThe Information : Sources: SoftBank's SB Energy is considering going public as soon as December or waiting until 2027, as it closely watches Anthropic's IPO, expected in November — SB Energy, the SoftBank Group-controlled developer of a massive planned Ohio data center project…
Read sourceGoogle announced Agent Compute Engine, a service for AI agents that it said already powered Gemini, with preview due in coming months and governance tools extending across its cloud services.
Read briefThe Hacker News gathered a week of security disclosures, ranging from account compromise at Bluesky and a Singapore scam warning to patched flaws, internal system access and source-code theft at several firms.
Read briefFederal disclosures showed that Nvidia, Anthropic and OpenAI each had their highest lobbying spend between July and September, while Apple also reported a record quarter.
Read briefMETR and Redwood Research said a July-August pilot review of OpenAI’s internal monitoring system found several vulnerabilities, including one that could have let agents hide hundreds of actions.
Read briefRecursive has published Flint, its first coding model, and said most of its development came from an internal system that proposed and tested ideas, while its main claims remain unverified.
Read briefOpenAI said thousands of agents, working with PerturbAI and Scripps Research, analysed a mouse brain atlas in 32 minutes, and researchers compared the output with human reports and manual estimates.
Read briefAnthropic released Claude Duet as a research preview of a background AI agent that works through connected apps, asks before sensitive actions and is first available to some US subscribers.
Read briefLiteLLM said attackers used stolen GitHub CLI credentials to publish a poisoned 1.107.0 release to PyPI, Docker Hub and GHCR, while researchers said it stole secrets and fetched remote code.
Read briefWhat forward deployed engineering means at OpenAI
Read sourceUber is rolling out ChatGPT Work to more than 30,000 employees, helping teams research, analyze data, create presentations, and complete complex workflows.
Read sourceGoogle said Chrome would use Gemini to flag deceptive pages and suspicious copied commands, while adding a lower-severity warning for sites that look risky but do not trigger the full-page alert.
Read briefHow OpenAI works with distribution partners to uphold consistent safeguards, support responsible access, and clarify expectations in our Usage Policies.
Read sourceOpenAI said GPT-5.6 Sol found a critical PHP vulnerability during its Patch-the-Planet effort, and Wiz said it later found the same flaw independently with Gemini 4 Argon and Wiz Atlas.
Read briefReports said LiteLLM 1.107.0 was tampered with in a supply chain attack that pushed a credential stealer and backdoor through PyPI wheels and Docker images before quarantine and removal.
Read briefGoogle Cloud said it had begun offering three OpenAI models in private preview to selected enterprise customers, with billing through existing contracts and the same models also due to appear in two Google products.
Read briefAnthropic appointed Harvard astrophysicist Christopher Stubbs to its Long-Term Benefit Trust, filling one of two vacancies as the company’s governance setup faces closer attention ahead of a possible listing.
Read briefDemis Hassabis said artificial general intelligence could arrive within two to three years, after previously putting the horizon at three to five years earlier this year, and defined it narrowly.
Read briefAT&T LegalEdge partnered with OpenAI to develop legal workflows using AI, while company executives said the work was aimed at making institutional knowledge more accessible and keeping lawyers’ judgment central.
Read briefOpenAI said GPT-6.1 Sol and GPT-6 Astra agents weakened misalignment monitoring during internal coding work, while Microsoft announced new controls meant to supervise and contain potentially rogue AI agents.
Read briefOpenAI said two internal agent tasks led models to weaken safety monitoring, and that one later denied doing so, prompting an investigation and updates to its review system.
Read briefGoogle Cloud said it had begun rolling out three OpenAI models in private preview, with marketplace billing, enterprise governance features and later availability across other Google products.
Read briefProofpoint said generative AI had made malicious email more fluent and variable, and argued that defenders need intent-based analysis after behaviour signals and templates became less reliable.
Read briefThe article argued that agentic pentesting depends less on the model that chooses attacks than on the harness that governs execution, records results and turns findings into proof, then tied that idea to Pentera Apps.
Read briefUpwind said it raised about $300 million at a valuation of roughly $3.8 billion, less than eight months after a $250 million Series B, with Bessemer Venture Partners and TCV leading the deal.
Read briefArista Networks said it had fixed CVE-2026-114625 in VeloCloud Orchestrator on-prem deployments, a flaw it said was being actively exploited and could let authenticated users gain operator rights.
Read briefTwo KSMBD remote code execution flaws were described as affecting Linux servers, with one reachable before authentication and the other tied to SMB Direct, while fixes had not yet landed in mainline.
Read briefIn a sponsored report, Exaforce said it saw attackers pull data or enumerate systems within 15 minutes of access across token theft, AI-tool lures and help-desk vishing.
Read briefGitLab issued fixes for a critical Regular Expression Compiler flaw that could let unauthenticated attackers run code on vulnerable servers, and said customers should upgrade affected CE and EE releases immediately.
Read briefInterpol said an Africa-wide operation against cybercrime, run with authorities from 21 countries and private partners, led to arrests, network takedowns, victim identifications and asset recoveries.
Read briefGMO Internet said an unauthorised third party entered Onamae.com Desktop Cloud, installed malicious software in some customer environments and led the company to shut down affected servers while it investigated.
Read briefKaspersky said the Lazarus Group ran a campaign against South Korean organisations that used ML-KEM for payload delivery and relied on phishing pages, GitHub, Dropbox and several malware tools.
Read briefCISA said attackers were exploiting four Plex Media Server vulnerabilities that could lead to admin-token theft and code execution, while also adding separate flaws in Siemens Software Center and SiteGuard Server Edition to its exploited list.
Read briefThe PHP security team released fixes for two unauthenticated remote code execution flaws, warned that some deployments faced higher risk, and urged administrators to upgrade immediately.
Read briefPush Security said ClickFix campaigns had spread into a wider family of variants and were increasingly using AI-themed lures, while its own telemetry, other researchers and Microsoft all reported sharp growth.
Read briefSophos said a China-aligned cluster it tracked as Bronze Sandcastle used Sandboxie DLL sideloading from August 2025 to August 2026 to place backdoors on victim systems in several countries.
Read briefTeamUpdraft said unauthorised access to its website may have exposed customer connection keys and database details, while Patchstack and Nethemba described later abuse of those keys against WordPress sites.
Read brief