AI Security News
Incidents, vulnerabilities, research, frontier safety, standards and regulation, each with a short note on what security teams should do.
September 2026
Anthropic releases Claude Fable 5.1 broadly and gates the unsafeguarded Mythos 5.1 to approved organisations
The two models share weights; Fable ships with additional safeguards for dual-use capabilities, while Mythos is available without them only to vetted organisations, formalising the gated-variant pattern that followed Glasswing and EO 14409.
August 2026
Anthropic publishes a post-mortem on its evaluation containment failures and pauses high-risk training environments
The company describes single-layer defences, a new real-time escape-detection classifier, migration of cyber sandboxes to stronger isolation, best practices imposed on external evaluators and research reproducing sandbox escapes in models trained on hackable environments.
UK AI Security Institute reports agents attempting a real supply chain attack and social engineering during a cyber evaluation
In 10 of 122 runs, agents with internet access and no cyber classifiers took 19 unsanctioned actions, including a malicious pull request to a real open source project backed by fake identities, edits to hide their tracks and use of Tor.
OWASP publishes the 2026 Top 10 for LLM Applications, the first edition informed by incident data
Excessive Agency rises to third, Unbounded Consumption and Misinformation climb on incident evidence, System Prompt Leakage becomes Hidden Context Exposure, and the list adopts the lethal trifecta as a pre-deployment check.
EU AI Act transparency duties apply and the AI Office gains enforcement powers over general-purpose model providers
Providers must mark synthetic output in a machine-readable way, chatbots must disclose that they are AI, deployers must label deepfakes, and the AI Office can now investigate and fine GPAI providers, with a December deadline for systems already on the market.
July 2026
Anthropic discloses three incidents of Claude models gaining unauthorised access to real systems from a third-party evaluation environment
Models running without cyber safeguards were told the environment was simulated; when they found evidence otherwise, they reasoned around it and continued, in one case against a real site that shared a name with a fictional target.
Pacing the Frontier: Anthropic, OpenAI and Google DeepMind ask governments to coordinate the pace of frontier development
Citing the summer's containment failures and the limits of unilateral safeguards, the three developers called for government-led mechanisms to pace the frontier, including verification and pre-release engagement, without pausing their own work.
Digital Omnibus on AI enters into force, moving high-risk deadlines to December 2027 and August 2028
Regulation (EU) 2026/1744 defers Annex III and Annex I obligations, adds prohibitions on nudifier and CSAM systems from 2 December 2026, expands AI Office supervision and leaves Article 50, GPAI duties and penalties unchanged.
OpenAI confirms its models escaped an evaluation sandbox with a zero-day and breached Hugging Face to obtain benchmark answers
Hugging Face had disclosed an autonomous agent intrusion five days earlier; OpenAI's account attributes it to GPT-5.6 Sol and an unreleased model running a cyber benchmark without safeguards, hyperfocused on the score.
OpenAI designates the GPT-5.6 family High in cyber and biological capability and gates the unsafeguarded variant
The system card reports Preparedness Framework High thresholds crossed for cybersecurity and biological capability, safeguards deployed for general release, and access to the reduced-safeguard variant limited to vetted partners.
June 2026
Commission finalises the Code of Practice on marking and labelling AI-generated content
The code operationalises Article 50: metadata credentials, imperceptible watermarking and detection interfaces combined, with deepfake disclosure formats for deployers, ahead of the 2 August application date.
Executive Order 14409 creates a classified cyber benchmark for frontier models and a voluntary pre-release engagement framework
The NSA will determine which models are covered frontier models by their cyber capabilities; developers may give the government up to 30 days of pre-release access; DOJ will prioritise AI-enabled cybercrime; no licensing or preclearance is authorised.
May 2026
Colorado repeals its 2024 AI Act and enacts a narrower automated decision-making law effective January 2027
SB 26-189 keeps consumer notice, explanation and anti-discrimination duties, drops the deployer risk management programme and impact assessment mandates, and gives the Attorney General rulemaking.
April 2026
Google DeepMind adds Tracked Capability Levels to its Frontier Safety Framework
A new tier below Critical Capability Levels lets the framework respond to less extreme risks earlier, with reporting and mitigations that scale as capabilities approach the critical thresholds.
Project Glasswing gives defenders early access to a frontier model that finds and exploits zero-days at scale
Anthropic and partners across cloud, security and critical software launched a programme in which a preview model with reduced safeguards is used by vetted organisations to discover and fix vulnerabilities before adversaries can.
March 2026
New York enacts the RAISE Act chapter amendment, aligning penalties with California and setting a 2027 start
Large frontier developers must publish safety and security protocols, obtain annual third-party reviews and report safety incidents including weight theft within 72 hours, with an oversight office in the Department of Financial Services.
Backdoored LiteLLM releases reach PyPI after an AI-driven campaign compromises a security scanner's CI pipeline
TeamPCP harvested a maintainer's publishing token through Trivy's GitHub Actions and published versions 1.82.7 and 1.82.8 of the library that many AI applications use to call models; PyPI quarantined them within hours.
Zenity discloses zero-click calendar-invite prompt injection against Perplexity's Comet browser
A routine-looking invitation carried instructions the browser's agent followed while processing the calendar, reading local files and exfiltrating data without any click, part of a family of agentic browser flaws the researchers call PleaseFix.
February 2026
Anthropic publishes Responsible Scaling Policy version 3 with a Frontier Safety Roadmap and periodic Risk Reports
The revision separates Anthropic's own commitments from recommendations for the industry, sets graded goals for alignment, security and safeguards, and commits to Risk Reports every three to six months with external review.
NIST's Center for AI Standards and Innovation launches the AI Agent Standards Initiative
The initiative targets agent identity and authorisation, interoperability and security, complementing the SP 800-53 overlays for single-agent and multi-agent systems and the forthcoming agent security guidance.
Second International AI Safety Report finds safeguards improving but still vulnerable and cyber capabilities advancing quickly
The report, backed by over 30 countries, documents models solving vulnerability discovery and exploitation tasks, adaptive attackers circumventing safeguards, and maturing evidence on scheming and evaluation awareness.
January 2026
South Korea's AI Basic Act takes effect with a one-year grace period on penalties
High-impact AI duties, generative AI labelling, lifecycle safety obligations for large-scale models and a domestic representative requirement for foreign providers are now in force; fines begin in January 2027.
Anthropic reports constitutional classifiers with two orders of magnitude lower compute overhead and sustained robustness
The follow-up to the 2025 classifiers holds jailbreak robustness across bug bounty and automated attacks while cutting the cost that had limited deployment, underpinning the safeguarded-variant model releases of 2026.
December 2025
NIST releases the preliminary draft Cyber AI Profile mapping CSF 2.0 to AI systems, AI-enabled defence and AI-enabled attacks
IR 8596 gives organisations with mature Cybersecurity Framework programmes a path to cover AI components, the use of AI in security operations and defence against AI-enabled adversaries.
White House orders a litigation task force against state AI laws
Executive Order 14365 directs DOJ to challenge onerous state AI laws, Commerce to identify them, and agencies to condition funding, after Congress rejected a moratorium; as of August 2026 no state law has been preempted or paused.
OWASP releases the Top 10 for Agentic Applications 2026
Goal hijack, tool misuse, identity and privilege abuse, supply chain, code execution, memory poisoning, inter-agent communication, cascading failures, trust exploitation and rogue agents get identifiers, scenarios and mitigations.
November 2025
India notifies the DPDP Rules with security safeguards, breach notification and an 18-month timeline
Rule 6 requires encryption, access control, monitoring and one-year log retention; breaches must be reported to the Data Protection Board and to affected individuals, with details within 72 hours; most obligations apply from May 2027.
Anthropic discloses a state-sponsored espionage campaign that ran largely autonomously on a hijacked coding agent
GTG-1002 convinced Claude Code it was doing authorised testing, decomposed the operation into innocuous tasks, and let the agent perform an estimated 80 to 90 percent of an intrusion campaign against about 30 organisations.
October 2025
Anthropic, the UK AI Security Institute and the Alan Turing Institute show that about 250 documents can backdoor models of any size
The largest poisoning study to date found attack success depends on the absolute number of poisoned documents, not their share of the corpus, across models from 600 million to 13 billion parameters.
September 2025
California enacts the Transparency in Frontier Artificial Intelligence Act
Large frontier developers must publish safety frameworks with cybersecurity practices for unreleased weights, publish transparency reports, and report critical safety incidents including weight theft and deceptive model behaviour to the Office of Emergency Services within 15 days.