42
30
Permify: Open-source authorization as a service
Help Net Security profiles Permify, an open-source Zanzibar-style authorization service supporting RBAC, ABAC, and relationship-based rules with multi-tenant deployments.
Permify is an open-source authorization-as-a-service project modeled on Google Zanzibar that centralizes access-control decisions outside application code. It supports role-based, relationship-based, and attribute-based access rules, answers checks in tens of milliseconds via REST and gRPC, and runs from a single Docker command. It is a CNCF member and is freely available on GitHub.
15
OpenAI researcher allegedly pressured mathematician to drop Anthropic co-author from math breakthrough paper
OpenAI researcher Sébastien Bubeck allegedly pressured mathematician Tristan Buckmaster to drop his Anthropic co-author from an AI-assisted Navier-Stokes breakthrough paper.
Mathematician Tristan Buckmaster says OpenAI, after learning of his and Levent Alpöge's AI-assisted progress on the Navier-Stokes equations, pressed him to drop his Anthropic-employed co-author and dictated how any results would be announced. He says Sébastien Bubeck claimed an internal OpenAI model had produced a roughly 100-page proof for Navier-Stokes with forcing and allegedly told him 'Why would you ruin your career?' when he threatened to go public. Buckmaster published a public statement detailing the exchanges; OpenAI has not yet responded. The pair had worked with models including Claude and OpenAI Codex running GPT-5.6 Sol on the Clay Millennium Problem, which carries a $1 million prize.
45
French prosecutors confirm arrest of suspected ZeroBytes hacker behind tax cyberattack
French prosecutors arrested an 18-year-old suspected ZeroBytes member tied to a tax authority breach exposing data of 600,000 people.
French authorities arrested an 18-year-old, alias 'ChatNoir,' in the Paris region on Aug. 18 and placed him in pretrial detention two days later over ZeroBytes attacks; a second suspect under 16 was arrested Aug. 26 and released. ZeroBytes claimed attacks on French government agencies, schools and companies starting July 16, including the DGFiP tax authority, which disclosed an August breach affecting data of more than 600,000 people. The suspect was previously under formal investigation for the 2024 Free telecom breach affecting over 19 million customers and for X account takeovers of BFM-TV and RMC linked to the Epsilon collective. Charged offenses carry up to 10 years in prison and a 300,000-euro fine.
58
ResidualAuth: What Authorization State Must Language Agents Preserve under Revocable Delegation?
Formalizes residual authorization state language agents must preserve under revocable delegation; token-budget summaries mostly fail while hard gates stop unauthorized effects.
The paper shows two authorization histories with identical current permissions can require opposite decisions after the same direct-edge revocation, formalizing the needed information as residual authorization state. Exponentially many future-distinct states can share one transitive closure, with exact or tight asymptotic bounds on the state an exact monitor requires. Across four open-weight models, fixed 256-token summaries solved at most 2 of 16 paired episodes while authenticated current-query reads solved 15-16 of 16. A hard effect gate reduced eight observed unauthorized effects to zero without changing preceding attempts.
27
60
30
30
30
60
30
55
47
60
60
55
30
60
60
42
55
60
30
60
30
57
45
55
30
57
60
57
30
57
60
42
60
30
30