30
30
Authors push back as publishers and agents make claims on Anthropic settlement
Authors report publishers and agents wrongly claiming shares of Anthropic's $1.5 billion copyright settlement, which pays $3,000 per pirated work across roughly 500,000 titles.
Anthropic's $1.5 billion copyright settlement, given final approval in July, pays $3,000 per pirated work for nearly 500,000 titles, split 50-50 with publishers for in-print books. Authors including April Henry report publishers claiming payments for works whose rights reverted years ago, and some agents claiming percentages despite not being rightsholders. Authors Guild CEO Mary Rasenberger attributes the disputes to poor recordkeeping rather than deliberate overreach. Full author claims require rights reversion before the settlement's August 10, 2022 download date.
45
30
AI workflows may be creating a dangerous new authorization blind spot
Noma Labs researchers describe 'workflow identity hijacking,' letting unauthenticated users trigger privileged AI workflows that execute actions with high-privilege service accounts.
Noma Labs lead researcher Sasi Levi detailed 'workflow identity hijacking,' where benign unauthenticated inputs via support inboxes, GitHub issues, or web forms trigger enterprise AI pipelines that execute privileged actions. The workflow runs using high-privilege service accounts or developer API keys, decoupled from the requester's identity, effectively creating a confused-deputy condition. Unlike prompt injection, the model behaves correctly; the failure lies in authorization enforcement at the workflow layer, and activity blends into routine automation. Mitigations include identity-aware access at execution points and user-context propagation between AI outputs and downstream operations.
45
Metasploit Wrap Up: This One Goes to Sixteen!
Metasploit adds 16 modules including 10 exploits, five covering CISA KEV vulnerabilities in Cisco, SonicWall, PaperCut, JetBrains and Langflow.
Rapid7's weekly Metasploit update ships 16 new modules, 10 of them exploit modules, with five targeting CISA KEV entries. New exploits cover Cisco Secure Firewall Management Center auth bypass (CVE-2026-20079), a SonicWall SMA1000 SSRF-to-root RCE chain (CVE-2026-83548/CVE-2026-83549), JetBrains TeamCity deserialization RCE (CVE-2026-63077), PaperCut NG/MF chain (CVE-2026-81578/CVE-2026-82078), and Langflow authenticated RCE (CVE-2026-19295). The SonicWall and PaperCut chains were reported as actively exploited zero-days, and a new ESC8 relay module exploits CVE-2026-20929 against AD CS Web Enrollment.
48
30
30
Anthropic's $1.5 billion book settlement descends into chaos as authors and publishers fight over who gets paid
Authors and publishers are filing competing claims over payouts from Anthropic's $1.5 billion copyright settlement covering 482,000 pirated books.
Anthropic agreed to pay $3,000 per illegally downloaded book, affecting more than 482,000 titles, in the largest copyright settlement in US history. As payouts begin, authors, publishers, and literary agencies are filing competing claims, complicated by poor rights-reversion records; textbook authors are reportedly owed as little as 10-15 percent under their contracts. A court had ruled Anthropic's use of illegally obtained books unlawful while deeming training on legally purchased books fair use.
48
Akeyless adds real-time enforcement for AI agents in production
Akeyless launches Agentic Runtime Authority, enforcing real-time intent-based access control on AI agent actions, with integrations for Claude Enterprise, OpenAI Codex and Amazon Bedrock AgentCore
Akeyless announced general availability of Agentic Runtime Authority, a real-time identity control layer that evaluates AI agent actions and blocks policy-violating actions before execution, layered on top of its SecretlessAI credential brokering. New integrations cover Claude Enterprise, OpenAI Codex and Amazon Bedrock AgentCore, alongside an Agentic Access Dashboard with session kill switches and event forwarding to Splunk, Datadog and Microsoft Sentinel. The vendor's platform already secures over 220 billion machine identity interactions for Fortune 500 organizations.
32
30
30
30
How much of F-Droid is LLM generated?
A FOSS maintainer manually graded 102 F-Droid apps from the September 12, 2026 update batch, finding many show signs of LLM-generated code.
A student and FOSS app maintainer reviewed 102 apps pushed to F-Droid on September 12, 2026, assigning each a three-tier rating for likelihood of LLM-authored code (mostly AI >50%, hard to say/mostly human, no signs of AI). The heuristic relies on commit aesthetics, README and branding style, and the presence of agentic infrastructure like Claude Code or Codex, which automatically places an app in the 'mostly AI' tier. Example ratings include Amber (Nostr event signer) as mostly AI, and Aria for Misskey as showing no AI signs. The author stresses reliable detection of LLM-generated code from text alone is impossible, so ratings are approximate.
15
The AI ‘Ghosts’ Contaminating Academic Publishing
Samsung and University of Warsaw researchers find LLMs repeatedly generate the same fake author names, contaminating academic records with 1,655 ghost-authored DOIs.
A preprint from Samsung and the University of Warsaw, "The Ghost Couple: Correlated LLM Name Priors and Their Haunting of the Web and Academic Publishing," shows that LLMs such as Claude, ChatGPT, and Gemini repeatedly generate the same fictional names like Elena Vasquez, Marcus Chen, and Aris Thorne as experts and co-authors. Researchers identified 1,655 ghost-authored records on CERN-operated Zenodo carrying real DataCite DOIs, fabricated journals, and backdated publication dates. Ghost names also form synthetic research groups on ResearchGate and are indexed without verification by Google Scholar and Semantic Scholar. The researchers suggest correlated name priors could serve as provenance signals for detecting AI-generated content.
32
30
Authorization Architectures for Tool-Using AI Agents
Review paper proposes an authorization reference architecture for tool-using AI agents, identifying runtime enforcement and delegation bounds as unresolved gaps.
This review examines authorization models for tool-using AI agents that invoke APIs, databases, browsers, and protocols like MCP, arguing every consequential agent action must be traceable to a human principal, bounded by delegation, and contestable. It introduces a principal hierarchy spanning human user, operator/deployer, orchestrator agent, sub-agent, and tool endpoint, and analyzes five layers including credential lifecycle, delegation propagation, runtime enforcement, prompt injection as authorization bypass, and auditability. Drawing on 89 primary sources from 2023-2026, it proposes seven structural requirements, a four-layer reference architecture, and three deployable configurations.
45
Google stole open source code without crediting the authors (Artemis/Minitap)
Minitap alleges Google's Artemis mobile-agent project reused its open-source mobile-use code and stripped author attribution, despite Apache 2.0 requirements.
Minitap says Google's Artemis project for automating mobile devices contains code identical to its open-source mobile-use agent, including the Hopper agent's verbatim instructions and a WhatsApp messaging example, and that a package file listing authors Pierre-Louis Favreau, Jean-Pierre Lo, and Nicolas Dehandschoewercker was replaced via an August force push removing their names. The company argues this conflicts with Apache 2.0's requirement to preserve copyright and attribution notices. Minitap also claims the AndroidWorld leaderboard ignored its later 94.8% and 100% submissions while showing Artemis at 99.1% and mobile-use at 91.4%. It has published a public factual record with archived file comparisons.
35
Wiz achieves GovRAMP High Authorization
Wiz for Gov achieved GovRAMP High authorization, validating NIST SP 800-53r5 controls for state, local government, and higher-education cloud security procurement.
Wiz announced that Wiz for U.S. Government has officially achieved GovRAMP High authorization, validating it against NIST SP 800-53r5 security controls required for highly sensitive state data and critical infrastructure. The 'verify once, serve many' designation is aimed at state, local government, and higher education procurement. Wiz positions its CNAPP as providing code-to-runtime visibility, risk prioritization, compliance automation, and AI pipeline security. Existing Wiz for Gov customers automatically inherit the high-baseline controls without migration.
15
Introducing the CyberAgents Exchange AI Inspector: Rigorous review for community-built AI
Tenable and OpenAI launch the CyberAgents Exchange AI Inspector to security-review community-submitted AI agents, MCP servers, and skills using GPT Cyber models.
Tenable and OpenAI announced the CyberAgents Exchange AI Inspector, unveiled at OpenAI's "Intelligence at Work: Cyber Summit," to vet community-submitted AI agents, skills, MCP servers, and multi-agent playbooks in the CyberAgents Exchange registry. The process combines Tenable One AI Exposure scanning, OpenAI GPT Cyber model assessment, and human review, with reviews anchored to specific Git commits. The registry launched in August and hosts over 100 AI listings; the Inspector is expected to be available in September and has already detected prompt injection implemented via invisible Unicode tag characters in a SKILL.md file.
35
Brazil orders Discord to suspend livestreaming after teen suicide
Brazil's data protection authority orders Discord to disable its Go Live livestreaming feature nationwide until child-safety safeguards are demonstrated.
Brazil's National Data Protection Authority (ANPD) found robust evidence that Discord failed to protect children from harmful content and ordered the Go Live feature suspended until effective safeguards are shown, following the July death of a 13-year-old girl during a roughly 45-minute livestream; five teenagers were arrested. Discord has three business days to implement the suspension and could face fines of up to 50 million reais (about $10 million) per violation. Regulators criticized the March addition of end-to-end encryption to Go Live for limiting real-time content detection, and are also investigating Discord's age-verification and content-removal practices, while a parallel probe tied neo-Nazi recruitment communities to Telegram.
34
30
30
Permify: Open-source authorization as a service
Help Net Security profiles Permify, an open-source Zanzibar-style authorization service supporting RBAC, ABAC, and relationship-based rules with multi-tenant deployments.
Permify is an open-source authorization-as-a-service project modeled on Google Zanzibar that centralizes access-control decisions outside application code. It supports role-based, relationship-based, and attribute-based access rules, answers checks in tens of milliseconds via REST and gRPC, and runs from a single Docker command. It is a CNCF member and is freely available on GitHub.
15
OpenAI researcher allegedly pressured mathematician to drop Anthropic co-author from math breakthrough paper
OpenAI researcher Sébastien Bubeck allegedly pressured mathematician Tristan Buckmaster to drop his Anthropic co-author from an AI-assisted Navier-Stokes breakthrough paper.
Mathematician Tristan Buckmaster says OpenAI, after learning of his and Levent Alpöge's AI-assisted progress on the Navier-Stokes equations, pressed him to drop his Anthropic-employed co-author and dictated how any results would be announced. He says Sébastien Bubeck claimed an internal OpenAI model had produced a roughly 100-page proof for Navier-Stokes with forcing and allegedly told him 'Why would you ruin your career?' when he threatened to go public. Buckmaster published a public statement detailing the exchanges; OpenAI has not yet responded. The pair had worked with models including Claude and OpenAI Codex running GPT-5.6 Sol on the Clay Millennium Problem, which carries a $1 million prize.
45
ResidualAuth: What Authorization State Must Language Agents Preserve under Revocable Delegation?
Formalizes residual authorization state language agents must preserve under revocable delegation; token-budget summaries mostly fail while hard gates stop unauthorized effects.
The paper shows two authorization histories with identical current permissions can require opposite decisions after the same direct-edge revocation, formalizing the needed information as residual authorization state. Exponentially many future-distinct states can share one transitive closure, with exact or tight asymptotic bounds on the state an exact monitor requires. Across four open-weight models, fixed 256-token summaries solved at most 2 of 16 paired episodes while authenticated current-query reads solved 15-16 of 16. A hard effect gate reduced eight observed unauthorized effects to zero without changing preceding attempts.
27
50
AWS limits AI agents’ data access, even when manipulated
AWS detailed propagating user authorization context through Bedrock AgentCore so downstream services enforce access controls even if the agent is manipulated via prompt injection.
AWS described an architecture for Amazon Bedrock AgentCore where user tokens and department claims are validated at runtime and propagated to DynamoDB, Bedrock Knowledge Bases, and Salesforce. Downstream services enforce authorization themselves, so a prompt-injected or buggy agent cannot retrieve data the user is not entitled to see. AWS demonstrated the pattern with a CRM use case separating Sales and Finance access and recommends IAM-backed knowledge bases for stricter isolation.
48
IDORacle: Template-Guided SQL-Sink Mediation for Object-Level Authorization in Java Applications
IDORacle intercepts MyBatis/JDBC SQL sinks to block horizontal privilege escalation in legacy Java apps with sub-millisecond guard latency.
IDORacle is a template-guided SQL-sink interception and rewriting framework that prevents IDOR/BOLA horizontal privilege escalation at runtime in Java database applications. It propagates authenticated identity context across HTTP requests, asynchronous tasks, and data-access boundaries via a server-side trace identifier, and computes dual SQL fingerprints at the MyBatis/JDBC boundary to generate reusable mediation plans. On a Java-SQL benchmark grounded in real-world CVE reports, it blocks tested violations with worst-case guard latency of 0.17 ms, reduced to 0.017 ms average for hot templates via redundancy-aware optimization.
42
I've factored the RSA keys of a Certificate Authority from the 90s
Security researcher factored two 512-bit RSA root CA keys from defunct 1990s certificate authority E-Certify using CADO-NFS on a desktop in roughly 30 hours each.
A researcher extracted legacy root certificates from archived Netscape and Internet Explorer installers, identifying two 512-bit RSA roots shipped with Netscape 4.51 in 1999 by the defunct Canadian CA E-Certify. Using CADO-NFS on a Ryzen 9 5950X desktop, the keys were factored in 32 and 29 hours respectively, allowing private key reconstruction. The work comes shortly after RSA-260 (862-bit) was factored, the largest known factorization to date. The researcher also built a legacy TLS server and published keys and tools on GitHub.
45
White House authorizes private US companies to hack foreign criminal networks
Trump memorandum authorizes vetted private US companies to conduct government-supervised offensive cyber operations against foreign criminal networks.
The National Security Presidential Memorandum signed August 12 lets vetted private companies run offensive cyber operations against transnational criminal organizations behind ransomware, phishing and sextortion, under US government oversight. The Homeland Security Task Force's National Coordination Center, led by DOJ and DHS executive directors, must give written approval for both Cyber Surveillance Operations and Cyber Effects Operations. Participating companies must post a $1 million bond or escrow, undergo annual review, and notify authorities if they unintentionally target US persons or systems.
68
30
30
Mapping out your unknown: A threat hunter’s guide to GitHub
Datadog Security Labs publishes a threat-hunting guide with audit-log queries to detect GitHub token theft, device code phishing, and source code exfiltration.
Datadog's threat-hunting guide covers GitHub audit log queries for detecting compromised accounts, stolen personal access tokens, and malicious OAuth app authorizations. Attackers typically obtain credentials through phishing, credential stuffing, leaked secrets, or device code phishing, then map private repositories, exfiltrate source code, and pivot into connected cloud and CI/CD environments. The guide maps detections to MITRE techniques like T1078 and T1528 and documents GitHub logging quirks affecting attribution, token metadata, and visibility fields.
45
1Password's AI patching benchmark is misleading
Trail of Bits reanalysis says 1Password's 26% AI clean-fix rate is misleading; 86% of eligible patches blocked exploits.
Trail of Bits critiques 1Password's FLAWED AI patching benchmark, arguing its 26% clean-fix headline mixes trials where agents were instructed to apply wrong fixes (22% of data) with trials that prohibited compiling or testing (36%). Restricting to reasonable conditions, 2,634 of 3,067 patches (86%) blocked the supplied exploit. Trail of Bits also reports 12.5% of 2,265 developer first fixes failed in its own 2024-2026 assessments, and released post-patch-validation and review-walkthrough agent skills.
45
New AI Workflow Identity Hijacking Attack Lets Hackers Exfiltrate Sensitive Data
Noma Labs disclosed Workflow Identity Hijacking, an AI automation flaw letting anonymous users trigger privileged data exfiltration without prompt injection or stolen credentials.
Noma Labs researcher Sasi Levi described Workflow Identity Hijacking, where AI workflows process untrusted input from low-privileged or anonymous users but execute downstream actions with the workflow creator's elevated permissions, turning the pipeline into an unauthenticated proxy. Unlike prompt injection, the model is not tricked; the flaw is a missing authorization check between the requester and the privileged actions. Noma Labs also disclosed and helped fix a similar issue in Google Workflows, and linked the problem to the earlier GitLost research on GitHub Agentic Workflows. Recommended mitigations include per-user identity propagation, least-privilege service accounts and authorization checks before every downstream action.
55
Microsoft says virtually nobody was grabbing NYT articles through its chatbot
Microsoft files summary judgement briefs in NYT copyright lawsuit, arguing only 59,545 of 8.2M Copilot logs show substantial overlap with news content.
Microsoft filed new legal filings in the consolidated copyright lawsuit brought by The New York Times, authors, and publishers against Microsoft and OpenAI, arguing for summary judgement. Analysis of 8.2 million Copilot chat logs found only 59,545 contained at least 16 words in common with news content, with just 24 responses showing at least 30 matching words in the authors' case. Microsoft argues the numbers support fair use, claiming Copilot rarely reproduces substantive chunks; the Times says discovery shows Microsoft and OpenAI stole from it, and the Trump administration filed a statement of interest supporting OpenAI.
75
Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models
Cloudflare launches invitation-only Vulnerability Discovery and Remediation within Managed Defense, using OpenAI Daybreak models and WAF context to prioritize and patch vulnerabilities.
Cloudflare announced early access to Vulnerability Discovery and Remediation, an invitation-only service within Cloudflare Managed Defense. The service uses OpenAI Daybreak models, including GPT-5.6 Cyber, via the Daybreak Defense Network to hunt and validate vulnerabilities in customer-authorized codebases across Workers and proxied applications. Findings are prioritized using production traffic, WAF rule, and security event context, and proposed patches and WAF mitigations are automatically checked before customer review.
50
US Authorizes Private Cyber Firms to Hack Transnational Criminal Networks
Trump signed a national security memorandum letting vetted private US cybersecurity firms run government-approved offensive cyber operations against transnational criminal organizations.
The August 13 memorandum creates a program managed by the National Coordination Center covering Cyber Surveillance Operations and Cyber Effects Operations against Cyber-Enabled Transnational Criminal Organizations, explicitly excluding entities that are parts of foreign governments. DOJ and DHS executive directors must co-approve every operation in writing, with extra authorization for operations raising laws-of-armed-conflict questions. Participating firms must pass vetting, annual evaluations and hold a $1 million bond or escrow. Operating procedures are due within 60 days, and the unresolved CFAA exemption question is addressed by requiring direct government control.
65
A bold new strategy or a dangerous precedent? Experts are divided on Trump's memo.
Trump presidential memorandum authorizes private-sector companies to conduct federally supervised hacking operations against transnational criminal organizations.
A newly signed presidential memorandum enlists private companies in federal law enforcement hacking operations aimed at transnational criminal organizations, with a 60-day window to establish the program. Experts told CyberScoop the shift raises attribution, targeting and constitutional questions, including risks of private firms accidentally attacking foreign governments and procedures for prior approval before targeting US persons. Critics likened the approach to historical letters of marque, while supporters including NSC cyber policy director Amanda Naylor framed it as bringing private-sector speed to the fight against cybercrime and fraud.
68