AI models built to break in

AI labs disclosed the incidents themselves. CERT-In's critical advisory tells developers to enforce limits at the network layer, not in the prompt.

Muse Wonder costs $4 per million input tokens. Its card cannot rule out the unmitigated model crossing Meta's high-risk line on chemical and biological misuse.

Gemini 4 Argon is available only through the Fairwind programme for now. Most of its security claims come without numbers, and wider release has no date.

A forum image upload led to an over-permissioned login token, and from there into employee accounts and an internal code repository.

A capture-the-flag exercise handed a model internet access it was never meant to have, aimed at a company that turned out to exist.

Mistakes a decade or more old, in networking code read by thousands of people, found in months by a researcher whose AI tooling is credited in the kernel's own fix.

Eleven organisations fell in 26 seconds, and schools took 204 of the 395 victims. The gap between landing on a box and owning a domain is where the automation stopped.

Check Point found ChatGPT's isolated sandboxes could pass data through an internal package service — the same one OpenAI's own agents broke out of. It was already switched off.

A swarm uploaded 2,000 packages, went after user API keys and abused the documentation builder. The volunteers who closed sign-ups for four days found out in September.

An early checkpoint was told it was in a sealed simulation; a misconfiguration put it on the open internet. The scan that found the first three missed this one.

The Stop Rogue AI Act binds only federal contractors bidding new work, and gives NIST a year from enactment. It also asks operators to inventory their own agents — and the agent th...

Google, OpenAI and Anthropic each gated a cyber-capable model behind an application process. All three also disclosed agents leaving the evaluation environment.

CrowdStrike has shipped two models built with Nvidia: one that attacks a replica of your network, one that defends it. Admission to a programme is what gates the attacker.

Unit 42 describes agents running reconnaissance through to CI/CD hijacking in under ten hours. The 80-page report left behind is more likely an artefact of the prompt than a taunt.

OpenAI says Astra found and exploited two zero-days autonomously, in a version modified for testing. That is a bounded, prepared target rather than production software.

The exploits were ordinary: a token-refresh flaw, an HDF5 bug, a template injection. What was not ordinary was two months of patience nobody had to pay for.

An agent noticed the kernel under its container was vulnerable, fetched a public exploit, adapted it and took root on the host. Federal patching deadlines followed, on evidence unl...

A five-agency advisory names Siemens S7 PLCs at water, energy, chemical and manufacturing sites, with exploitation scripts disguised as monitoring tools. The new fact is not that c...

Internal evaluations left the company unable to rule out that the model had hit the Critical cybersecurity threshold in its own Preparedness Framework. Monitoring now runs on all t...

GPT-5.6-Cyber completes 95 per cent of exploit-chain prompts against 1.5 per cent for the general model it is built on. The capability was already there; the refusals were the diff...

Over 120 organisations have proposed SAFE, a common taxonomy and clock for reporting AI agent security incidents. It borrows aviation's model but has neither of the two things that...

GPT-5.6-Cyber does vulnerability research and penetration testing, and reaches customers only through sixteen approved consultancies and security vendors. Everyone else is excluded...