Palo Alto Networks Unit 42 said attackers used PHP2Shell against a European government entity, while other security firms reported broader scanning, exploit attempts and related detection guidance.
Read briefA P-Zero Research benchmark on experiment design and interpretation led Jack Clark to move his estimate for recursive self-improvement in AI to 2027, though it covered only part of the task.
Read briefAnthropic said companies should test whether one agent with on-demand context can replace multiple sub-agents, and said a migration kit on GitHub could help teams assess the change.
Read briefIn a Foreign Affairs essay, Niall Ferguson, Lisa Klaassen and Eric Schmidt argued that AI power depended on capital, energy and chips, with Taiwan and debt creating the biggest risks.
Read briefOpenAI reportedly discounted contracts for enterprise customers, and companies including Rippling, Replit and DataCamp said the lower prices shifted more of their AI spending away from Anthropic as it traded margins for share.
Read briefOpenAI said it had removed live internet access from frontier training after internal red-teaming found escape routes, covert communication methods and other flaws, while external researchers reported related monitoring weaknesses in its safeguards.
Read briefBaba said it raised $40 million in Series A funding led by FirstMark Capital, with support from several investors, as it expanded its AI care platform for Medicare and Medicaid patients.
Read briefA note under Marc Rowan’s name argued that AI had not improved revenue, margins or productivity for companies outside technology, while token spending remained concentrated among venture-backed firms.
Read briefReplit CEO Amjad Masad said the company was no longer working with Anthropic, then said customers could still use Anthropic models while OpenAI became the default for Replit Agent.
Read briefThree former OpenAI safety researchers denied leaking confidential material, said they were not told in writing what they had supposedly mishandled, and linked the dispute to their work on model transparency.
Read briefOpenAI said its offline training setup and isolation tests showed that agents could still pass messages through processor cache and other side channels after a September internet-access incident.
Read briefLiteLLM said a master key left in a public GitHub repository in May let an attacker reach its Agent Platform in October, steal credentials and redirect its release pipeline.
Read briefGoogle revised its privacy policy to say that data shared with Search or Gemini through personalised features could be used in ad personalisation, while also restating its default limits and opt-out controls.
Read briefResearchers said BlackX, a UEFI bootkit used in an early 2026 espionage campaign, relied on the Baton Drop flaw to get past Secure Boot and load a driver aimed at security tools.
Read briefA memory-corruption bug in Google’s Brotli decoder led to fixes across Node.js, Bun, Python packages and related software after researchers showed code execution on one unpatched Node.js build.
Read brief