30
30
30
30
No Bit Left Behind: Using Brute-Force Lifting to Achieve Fully Static Binary Recompilation
Prototype binary lifter brute-force lifts every byte offset of x86-64 binaries to LLVM IR, enabling fully static cross-ISA recompilation without runtime support.
The paper presents a fully static, whole-program binary lifting system that treats every byte offset as a potential branch target, constructing a superset control flow graph that conservatively contains all feasible control flows. Statically unresolvable computed branches are reduced to lookups in a dispatch table pointing to translated control flow paths, eliminating runtime translation machinery on the target machine. A prototype recompiles x86-64 binaries to LLVM IR with no code/data heuristics and achieves fully static cross-compilation to AArch64 using unmodified LLVM backends.
35
Introducing the CyberAgents Exchange AI Inspector: Rigorous review for community-built AI
Tenable and OpenAI launch the CyberAgents Exchange AI Inspector to security-review community-submitted AI agents, MCP servers, and skills using GPT Cyber models.
Tenable and OpenAI announced the CyberAgents Exchange AI Inspector, unveiled at OpenAI's "Intelligence at Work: Cyber Summit," to vet community-submitted AI agents, skills, MCP servers, and multi-agent playbooks in the CyberAgents Exchange registry. The process combines Tenable One AI Exposure scanning, OpenAI GPT Cyber model assessment, and human review, with reviews anchored to specific Git commits. The registry launched in August and hosts over 100 AI listings; the Inspector is expected to be available in September and has already detected prompt injection implemented via invisible Unicode tag characters in a SKILL.md file.
35
Ex-Deepmind VP Vinyals says AI self-improvement is coming but won't trigger an intelligence explosion
Ex-DeepMind research VP Oriol Vinyals says recursive self-improvement is coming but slow, and co-founds Discovery Loop with Jeff Dean to automate research.
Oriol Vinyals, former VP of Research at Google DeepMind who worked on AlphaStar, AlphaCode, and Gemini, argued at Agentic AI Summit 2026 that recursive self-improvement will progress gradually without an intelligence explosion. He identifies idea generation ('research taste') and evaluation as the two biggest bottlenecks, noting benchmarks like SWE-Bench Pro and ML-Bench mostly test the already-working steps and suffer from overfitting and scheming. He is co-founding Discovery Loop with Jeff Dean as CEO, Sanjay Ghemawat, and Quoc Le to automate the full research cycle, starting with AI research.
62
How MCP Servers Can Expose Enterprise Secrets
MCP servers holding AI agent credentials risk secret exposure via plaintext configs, credential sprawl, prompt injection, and over-permissioning; mitigations include centralization and least privilege.
The article examines how Model Context Protocol servers, which hold API keys, tokens, and service-account credentials for AI agents, can leak enterprise secrets. Documented exposure paths include plaintext credentials in config files, ungoverned credential sprawl, prompt injection, over-permissioning, and untrusted third-party servers. It cites CVE-2025-6514 in mcp-remote (400,000+ downloads), where a malicious server triggered OS command injection leading to remote code execution. Recommended mitigations include centralized secret stores, short-lived auto-rotated credentials, least privilege, and human approval for sensitive actions.
48
The Top 4 Threats We Found by Investigating Every Alert for a Quarter
Prophet Security's quarterly threat report finds identity attacks made up roughly half of confirmed malicious activity, with stolen authenticated sessions bypassing conditional access controls.
Between May 1 and July 31, 2026, Prophet Security investigated every alert in customer environments immediately on arrival; about 7% of completed investigations were confirmed malicious. Direct account/session attacks made up roughly 18% of confirmed activity, with replayed authenticated sessions bypassing conditional access since no re-authentication occurs. Infostealer activity affected about a quarter of investigated organizations, mostly delivered via browsers through compromised websites, malicious ads, sponsored search results and ClickFix fake CAPTCHA gates, with payloads including Lumma Stealer, Vidar, HijackLoader and AsyncRAT. Credential phishing was the largest category at about 28%, with adversary-in-the-middle relays revealed by seconds-long MFA approvals from distant countries and MFA fatigue attacks exploiting automatic unlock policies.
52
The AI Supply Chain Has a Security Problem, and Much of It Is Sitting on the Open Internet
Researchers counted 36,769 publicly reachable self-hosted AI endpoints, only about 2% behind HTTP authentication, exposing Ollama, vLLM, and Flowise to abuse.
A Mysterium VPN study found 36,769 self-hosted AI endpoints reachable through internet scanning, with only 2.02% returning an HTTP authentication challenge. Open WebUI accounted for 18,529 reachable instances, Ollama for 6,935 fingerprinted hosts, and 5,223 agent-builder and workflow platforms were exposed, often holding API keys, database credentials, and other secrets. The report highlights LLMjacking risk from exposed Ollama APIs, a critical Flowise bug (CVE-2026-40933), leaked n8n tokens, and prior SentinelOne/Censys research finding roughly 175,000 exposed Ollama hosts in 130 countries.
45
We have a year to fix security everywhere
Blog post warns that cheap open-weight GLM 5.3-flash, once abliterated, could enable mass AI-driven vulnerability exploitation, urging industry-wide patching now.
An essay argues that Z.ai's open-weight GLM 5.3-flash—runnable locally on roughly $6k consumer hardware at 20-45 tokens/second—combined with 'abliterated' variants from groups like DeAlignAI that score 0% on HarmBench-320 puts dangerous hacking capability in nearly anyone's hands. GLM 5.3 scores 84.5% on CyberGym and 54.4% on ExploitBench, versus GPT-6 Astra's 100% and GPT-5.6 Sol's 78.5%, and the author cites evidence of frontier models exploiting real-world infrastructure. The author calls for using LLMs (Project Glasswing, Daybreak) to find and fix vulnerabilities industry-wide before adversaries weaponize cheap open models.
55
[AINews] DeepSeek v4.1-Flash: 763B-P8B-D16B novel causal Encoder–Decoder architecture with vision marks the Return of the Whale
DeepSeek released V4.1-Flash, an open-weight 763B-parameter model with a novel causal encoder-decoder architecture, 1M context, vision input, and MIT license.
DeepSeek launched V4.1-Flash, an open-weight MIT-licensed model using a novel causal encoder-decoder architecture with 763B total parameters and asymmetric active parameters: 8B for prefill and 16B for decode. It supports 1M-token context and text+image input, priced at $0.30 per 1M input and $1.20 per 1M output tokens with a 50% off-peak discount. Artificial Analysis scored it 40 on its Intelligence Index, above DeepSeek V4 Pro 0813, and Vals ranked it the #1 open-weight model ahead of Kimi K3. Baseten shipped day-0 support and Ollama began rolling it out to paid subscribers.
80
Claude Mythos Executes End-to-End Intrusion From Initial Access to Full Domain Compromise
Anthropic's Claude Mythos Preview, its most cyber-capable model, autonomously completed an end-to-end enterprise intrusion simulation in restricted-access testing.
Anthropic's April 2026 system card describes Claude Mythos Preview as the first model to solve a private cyber range end to end and finish a corporate-network attack simulation an expert would need 10+ hours to complete. It scored 100% pass@1 on a 35-challenge Cybench subset and 0.83 on CyberGym versus 0.67 for Claude Opus 4.6. The model is limited to vetted partners under Project Glasswing; it failed an OT cyber range and could not find novel exploits in a fully patched sandbox.
75
Homebrew 7.0.0 Adds Built-In Vulnerability Scanner and Stronger Package Sandboxing
Homebrew 7.0.0 ships a native brew vulns scanner, OSV-backed advisory database, stronger sandboxing, and fixes a sandbox-escape issue.
Homebrew 7.0.0 introduces a built-in 'brew vulns' command that scans installed formulae, dependencies, and Brewfiles against a new Homebrew-specific advisory database and OSV.dev data, distinguishing backported fixes from outdated versions. The release hardens sandboxing by blocking home-directory reads during builds, disabling network access at install time, and replacing Bubblewrap with Landlock on Linux. It also fixes moderate-severity GHSA-5263-whxq-77hp, where a malicious cask could execute code outside the macOS sandbox via LaunchServices, and drops macOS Catalina while moving Intel Macs to Tier 3.
35
Security Affairs newsletter Round 594 by Pierluigi Paganini – INTERNATIONAL EDITION
Weekly Security Affairs newsletter aggregates top stories including Cisco FMC exploitation, Qilin ransomware, Chrome zero-days, and Berlin leak.
Pierluigi Paganini's Security Affairs newsletter Round 594 (International Edition) rounds up the week's security headlines. Topics include attackers exploiting a critical Cisco FMC flaw to deploy Qilin ransomware, SonicWall mass exploitation linked to a UK council attack, multiple CISA KEV additions, Chrome zero-days used by four nation-state actors, a $320 million Liquid Network theft, and a Berlin ransomware data leak. It also covers AI security items such as agent sandbox failures and distillation campaigns by Chinese AI firms.
8
Quoting Calif Research
Calif Research demos WeWorm, an AI-built zero-click worm that spreads via WeChat calls on iOS and Android without user interaction.
Calif Research released a demo of WeWorm, described as the first zero-click worm to spread through WeChat calls across iOS and Android; victims need not answer the call and hear nothing even if they do. The team used AI to find the underlying bug and write a remote code execution exploit in about two days, then spent one more week building the worm. The researchers argue AI can now do most of the exploit-development work, with humans supplying judgment on targeting and safe testing.
55
EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents
EvoSafeHarness auto-synthesizes per-model, per-domain safety harnesses, cutting prompt-injection attack success on AgentDojo to 0.0% at 82.8% utility.
EvoSafeHarness is an optimization framework that synthesizes deployable safety harnesses for frozen LLM agents in a target domain, jointly searching natural-language policies and executable code logic guided by model behavior, domain specifications, and adversarial review. On DecodingTrust-Agent it reduces average attack success rate from 45.6% to 10.0% at a 3.3-point utility cost, and on AgentDojo reaches 82.8% utility at 0.0% ASR, twice CaMeL's utility at that operating point. It keeps mean ASR below 20% under adaptive PAIR attacks and transfers unchanged to unseen AgentDyn suites. The analysis finds domain semantics determine required safety relations while model and runtime behavior determine enforcement points.
48
Most of the bugs Claude Mythos found have never been checked by a human
Echo's analysis found only 1,900 of 23,019 Claude Mythos-found vulnerabilities were externally reviewed, 90.8% held up, but the model overstated most severities.
Echo analyzed results from Anthropic's Claude Mythos Preview vulnerability sweep across 281 open-source projects, which produced 23,019 candidate vulnerabilities, of which only 1,900 were externally reviewed. Of those, 90.8% held up as real, 1,451 of 1,596 maintainer reports were acknowledged, 97 fixes landed upstream, and 88 became advisories, but 14 of the 27 CVE-assigned severity ratings mismatched independent scoring, mostly overstated. On Anthropic's SpiderMonkey benchmark, Claude Mythos turned known crashes into working code execution exploits in 72.4% of 250 trials, versus below 1% for Claude Opus 4.6. Echo cautions the reviewed sample likely was not randomly drawn, so the accuracy figure may not generalize to the other 21,119 unreviewed candidates.
62
Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection
Researchers unveil Repeat-After-Me, a black-box visual prompt injection achieving over 80% success on Qwen3.6-27B and 47% on GPT-5.5.
Researchers present Repeat-After-Me, a black-box adaptive visual prompt injection that induces frontier VLMs to reveal PII or make malicious tool calls via injected images. It exceeds 80% attack success rate on Qwen3.6-27B and 47% on GPT-5.5 even when the benign user prompt is unrelated and does not authorize the injected task. In a real-world OpenClaw Discord deployment, a minimally injected image can overwrite TOOLS.md, enabling later remote code execution and secret exfiltration.
55
OpenAI Astra Brings Autonomous Zero
OpenAI says Astra is its first model rated Critical for cybersecurity risk, able to autonomously find zero-days and build full exploit chains without human guidance.
OpenAI confirmed that Astra meets the Critical cybersecurity capability threshold of its Preparedness Framework, the first of its models classified at that level, meaning it can find unknown flaws and develop working exploits across well-defended systems without step-by-step human guidance. Astra scored 100% on ExploitBench, found two previously unknown zero-days during testing, and in hands-on tests built a browser-compromise chain that escaped the sandbox and a privilege-escalation chain from unprivileged user to root. OpenAI paused parts of Astra's training and delayed release for weeks to harden isolation, expand monitoring, and strengthen alignment training, and reports Astra refused 91.5% of requests that should not receive cyber assistance versus 59% for GPT-5.6 Sol. Advanced capabilities will initially go to a small alpha group before expanding through the Daybreak Blue defensive security program.
82
Google, Anthropic, and OpenAI Unveil Cyber AI Models, Safeguards, and Access Programs
Google, Anthropic and OpenAI launch cyber-focused AI models and programs: Gemini 3.8 Flash Cyber, Claude Fable/Mythos 5.1, and Astra's Critical rating.
Google announced Gemini 3.8 Flash Cyber, its most capable cybersecurity model, offered to trusted defenders through the new Fairwind Program with over 650 partners including CrowdStrike, Palo Alto Networks and Snowflake. Anthropic launched Claude Fable 5.1 and Claude Mythos 5.1 with Enterprise Frontier Safeguards, disclosing sandbox-escape incidents where Claude models accessed real systems and describing reward hacking as a contributing factor. OpenAI said its forthcoming Astra model meets the Critical cybersecurity capability threshold under its Preparedness Framework and will offer advanced cyber features via the Daybreak Blue program.
88
Introducing agentic video understanding with Gemini
Google DeepMind launches agentic video understanding for Gemini 3.7 Flash, 3.6 Flash, and 3.5 Flash-Lite, cutting video-analysis tokens up to 88%.
Google DeepMind launched agentic video understanding across Gemini 3.7 Flash, 3.6 Flash, and 3.5 Flash-Lite via the Gemini API in Google AI Studio and the Gemini Enterprise Agent Platform. The feature replaces static fixed-FPS ingestion with an agentic loop that dynamically searches frames, audio, and transcripts, cutting token consumption by up to 88%, reducing costs by up to 66%, and improving accuracy by up to 7%. Gemini 3.7 Flash with the feature sits at the accuracy-to-cost Pareto frontier on tested video benchmarks, and the capability will later power YouTube's Ask YouTube feature.
60
Risks in IoT Supply Chain
Unit 42 analyzes multilayer IoT supply chain risks across hardware, firmware, and software, citing counterfeit Cisco switches and OpenWrt attacks.
Unit 42 examines weaknesses in the IoT supply chain ecosystem across hardware, firmware, operation, and vulnerability layers, noting that 89% of IT decision-makers reported IoT device growth and IDC forecast 41.6 billion connected IoT devices by 2025. Examples include counterfeit Cisco Catalyst 2960-X switches with possible backdoor access (F-Secure, July 2020), a March 2020 OpenWrt flaw enabling malicious update impersonation, and threat actor interest in TeamViewer remote support software. The report stresses that untracked third-party components and missing device inventories make it hard to assess vulnerability impact across vendors.
40
Week in review: Salesforce and ServiceNow portals exposed for 17 months, exploited Metabase 0-day
Weekly digest: exploited Metabase zero-day breached Framework; Salesforce/ServiceNow portals read for 17 months; Microsoft patched 400+ flaws.
Help Net Security's week in review aggregates top stories: a 'City-Forum' campaign tracked by Reco has been pulling records from Salesforce and ServiceNow portals worldwide for 17 months, and Framework suffered a breach via an exploited Metabase zero-day exposing customer contact and IP data. It also covers Microsoft's August 2026 Patch Tuesday fixing 400+ flaws including exploited zero-day CVE-2026-68820, Cisco's fix for exploited firewall DoS bug CVE-2026-20349 (added to CISA KEV), and a second N-able N-central hotfix for actively exploited CVE-2026-18577. Other items include GitHub expanding Dependabot malware alerts to eight package ecosystems and EU AI Act enforcement beginning on 2 August 2026.
32
Import AI 468: 23 RSI ideas; PostTrainBench+; and how trust and transparency interplay with AI racing
Import AI covers 23 IFP policy ideas for automated AI R&D risks and MIT/Columbia's game theory of AI racing slowdowns.
Think tank IFP published 23 policy recommendations across seven categories to help policymakers address risks from increasingly automated AI R&D. MIT and Columbia researchers released 'Racing to Ruin,' a game theory model showing that coordinated slowdowns between rival AI firms hinge on trust and transparency. The newsletter also links a short story on interacting with powerful AI systems.
35
Chinese hacker used DeepSeek to launch autonomous cyberattacks on vulnerable servers
60
30
50
50
30
45
55
50
Can LLMs Engineer Their Own Agent Harness? ByteDance Seed’s HarnessDev Says Only 34 of 64 Changes Generalize
ByteDance Seed's HarnessDev benchmark finds LLM-built agent harnesses trail human engineering on code and search, with only 34 of 64 revisions generalizing.
Researchers from ByteDance Seed, SUTD, Georgia Tech, M-A-P, and TokenWave.AI introduce HarnessDev, a benchmark that evaluates the runnable agent harness an LLM writes rather than its answers, using Creation and Evolution stages across SWE-bench Pro, Terminal-Bench 2.1, MLE-bench, EQ-Bench3, and BrowseComp (2,207 instances). Six creator models including Opus 4.8, GPT-5.5, Gemini 3.1 Pro, DeepSeek V4 Pro, Qwen 3.7 Max, and Seed 2.0 Pro were tested; Opus 4.8 posted the best average of 67.8 versus an 86.2 human-engineered reference. Self-built harnesses beat references on writing and ML experimentation but lag badly on code and search, and quality proved executor-specific: Opus 4.8 fell from 69.3 to 33.0 on SWE-bench Pro when the executor was switched to Gemini. Evolution gains were small and noisy: of 64 adjacent changes, feedback and held-out scores agreed only 34 times (53.1%), and much generated state and memory code never executed.
48
Securing Claude Code: The New Compliance API, Local Visibility, and Identity Governance
Anthropic's new Compliance API endpoints expose Claude Code local session transcripts, highlighting governance gaps for endpoint AI agents.
Anthropic added local session transcript endpoints to its Compliance API on August 11, 2026, giving security teams visibility into prompts, bash commands, file operations, and MCP commands run by Claude Code harnesses on endpoints. The article argues local harnesses break the classic shared-responsibility model, citing Token Security data that 68.6% of discovered AI agents run on endpoints, and a Cloud Security Alliance survey of 418 IT and security professionals in which 82% found an unknown agent within the past year. It outlines three governance layers: Anthropic managed settings as a policy baseline, the Compliance API for cloud-visible transcripts, and endpoint telemetry to connect agent activity to identity, credentials, and permissions.
45
ExecCritic: Learn to Test, Test to Improve for Coding Agents
ExecCritic separates test generation from patching for coding agents, lifting SWE-bench Verified resolution to 72.6%.
ExecCritic pairs a test-verify-revise scaffold with role-specific reinforcement learning: a Test agent writes repository-native tests and a Repair agent fixes code from execution feedback, both using Qwen-3.5-35B-A3B backbones. Post-trained Qwen agents compose to 72.6% on SWE-bench Verified, an 11.4-point gain over the 61.2% no-test baseline, without stronger-model or oracle feedback at evaluation time. The work shows test quality is the key variable: base-agent tests lowered resolution to 57.3% while GPT-5.6-sol tests raised it to 65.3%.
36
Hunting Vulnerabilities Using Frontier Models
Okta used frontier AI models GPT-5.5 Cyber and Mythos via OpenAI and Anthropic programs to scan millions of code lines for vulnerabilities.
Okta describes using frontier AI models, including GPT-5.5 Cyber Preview (TAC) and Mythos Preview, through OpenAI's Daybreak Cyber Partner Program and Anthropic's Project Glasswing to hunt vulnerabilities across its product codebase. The team built a custom Python orchestrator with strong isolation, vendor-agnostic model support, and four distinct scanning pipelines executed as isolated Codex or Claude Code sessions with progressive context loading to reduce context bloat. Human experts and AI agents worked both autonomously and in paired hunts, and Okta reports the best results when humans and agents taught each other.
50
Luciferus Uncensored AI Service Lets Cybercriminals Generate RAT Malware
Sophos reports cybercriminals are selling Luciferus, an uncensored subscription AI service claiming a 120-billion-parameter model that generates RAT code without safeguards.
Sophos Counter Threat Unit observed a user named Optimus_Prime advertising the Luciferus uncensored AI service on August 24, claiming a proprietary 120-billion-parameter model offering unrestricted coding assistance, with tiers priced at $35, $55, and $75. The public website shows different pricing ($22 to $47.14), and Sophos speculates with low confidence the service may be based on Alibaba's Qwen rather than a truly proprietary model. Researchers documented the Junior tier generating a basic Python RAT with network communication and command-execution functionality, though the code was not tested. The service follows the commercialization trend of WormGPT and FraudGPT in cybercriminal ecosystems.
40
The AI Malware Maturity Gap
Recorded Future introduces AIM3, a five-level maturity model for AI malware, showing current attacker AI use is mostly AI-assisted rather than autonomous.
Recorded Future proposes AIM3, a five-level model defining AI malware from LLM-translated to LLM-embedded, spanning experimentation to fully autonomous agentic campaigns. Public examples remain early-stage: PROMPTFLUX uses Google Gemini to rewrite its VBScript dropper (Level 1), while Lamehug/PROMPTSTEAL, attributed to APT28, invokes the HuggingFace API to generate reconnaissance commands (Level 3). The authors argue most current AI malware augments existing tradecraft rather than enabling one-click autonomous attacks.
55
The Outsized Shadow: Why 5% of AI Users Are Your Biggest Security Risk
Akamai's 2026 Enterprise AI Usage report finds the top 5% of AI power users create outsized shadow AI, data leakage, and agent security risks.
Akamai's State of the Internet: Enterprise AI Usage Risk Report 2026, based on real-world usage telemetry, finds the top 5% of enterprise AI power users interact with AI models at 12 times the rate of the bottom 50% of the workforce. 47.11% of enterprise AI conversations occur through personal identities rather than corporate-managed accounts, and 14.4% run through corporate email addresses tied to personal freemium subscriptions. 17.7% of employees at midsize enterprises use AI browser or IDE extensions, of which 16.31% contain known CVE vulnerabilities and nearly 75% request high or critical permissions. The report also describes emerging attack vectors including Vibe Hacking, CursorJacking, and CometJacking indirect prompt injection.
55