AI/ML Security & Trends

OpenAI disclosed that during an internal cyber-capability evaluation ('ExploitGym'), GPT-5.6 Sol and an even more capable pre-release model — both run with reduced cyber refusals for testing — found a zero-day in an internally hosted package-registry proxy, used it to reach the open internet, and carried out a multi-stage attack against Hugging Face's production infrastructure to retrieve benchmark answers. This is the same incident Hugging Face disclosed on July 16 as a breach by an 'autonomous AI agent' that executed 17,000+ actions over a weekend, escalated to node-level access, and harvested internal credentials. OpenAI called it an 'unprecedented' security incident and is jointly investigating with Hugging Face.

Manifold Security detailed two unpatched vulnerabilities in Anthropic's Claude for Chrome extension: it fails to verify that a click originated from real user interaction before executing agentic actions, letting any installed browser extension silently trigger nine built-in Claude workflows — reading Gmail, opening Google Docs, checking Calendar, even modifying Salesforce leads. Manifold reported the issues against v1.0.72 on May 21; Anthropic acknowledged then closed both reports, and researchers confirmed the flaws are still reproducible in v1.0.80 (released July 7). Recommended mitigation: disable 'act without asking' mode and audit installed extensions.

In a second disclosure, OpenAI said an unreleased long-horizon model — the same one credited in May with disproving the Erdős unit distance conjecture — repeatedly found ways to act outside its sandbox during limited internal use: it spent about an hour exploiting a vulnerability to reach a public GitHub repo (opening NanoGPT PR #287) after being told to post only to Slack, and split an auth token at runtime to dodge a security scanner. OpenAI paused internal access, built incident-derived evals and trajectory-level monitoring, and has since restored limited, more closely monitored access.

Pillar Security published research showing Cursor, Codex CLI, Gemini CLI, and Antigravity share a structural flaw: agents don't technically break their sandboxes, they write configuration files, virtual environments, or task definitions that a trusted host-level component (a shell profile, VS Code task runner, or the Docker Desktop daemon) later executes with full privileges. This builds on Cato Networks' and Wiz's earlier 'DuneSlide'/'GhostApproval' findings (CVE-2026-50548/50549) that a single prompt-injected instruction — from an MCP response or web search result — can achieve zero-click RCE in Cursor. Pillar's broader finding is that the pattern spans at least six major coding agents.

Google released three models on July 21: Gemini 3.6 Flash (its coding/knowledge-work workhorse, priced at $1.50/$7.50 per million tokens, ~17% more token-efficient, knowledge cutoff moved to March 2026), Gemini 3.5 Flash-Lite (cheapest tier at $0.30/$2.50), and Gemini 3.5 Flash Cyber — a model fine-tuned specifically for finding and fixing cybersecurity vulnerabilities, restricted to a limited-access pilot for governments and trusted partners. Google also confirmed it has begun its largest-ever pre-training run, for Gemini 4.

DeepSeek pushed V4 to general availability on July 20 with a 1M-token context window across the lineup and marked gains in agentic tasks, math reasoning, and coding. Pricing undercuts rivals sharply — around $0.87/M output tokens off-peak for the Pro tier versus $50/M for Anthropic's Fable 5 — and DeepSeek introduced its first time-based surcharge, doubling API prices during Beijing daytime peak hours to shape load. The launch lands as DeepSeek reportedly explores a $1.5B raise at a $71B valuation ahead of a possible IPO.