AI/ML Security & Trends
The biggest story is OpenAI's Nov 4 launch of GPT-6 Cyber, a "Critical"-tier offensive-security model that found 81 new high-severity Firefox bugs and reproduced/exploited hundreds of Linux kernel CVEs — a concrete marker that frontier models have crossed into autonomous vulnerability research at scale, arriving the same week researchers disclosed Vapor Panda's China-linked ARTEX AI framework used against 200+ real-world organizations.
China-linked Vapor Panda used AI framework ARTEX against 200+ orgs Breaches & Incidents
CrowdStrike attributes a campaign to China-based Vapor Panda using ARTEX, a Go-based AI-powered penetration-testing framework wrapping LLMs (including DeepSeek) to let a Mandarin-speaking operator autonomously direct intrusions (~1.4B input tokens used). Targets exceeded 200 organizations across 14+ countries — foreign ministries, telecoms, US semiconductor/defense firms and think tanks — exploiting web app flaws, unsigned SAML assertions, XXE, and stale auth keys, with confirmed post-exploitation (credential theft, BLOODALCHEMY backdoor) at nine organizations.
Read at The Hacker News →Anthropic won't fix "ThisBash" Claude Dispatch RCE flaw AI Security & Safety
Researcher Gal Weizman (Forever Security) disclosed that any browser extension with access to claude.ai can hijack the Claude Dispatch feature to send commands to Claude Desktop as the legitimate user — including a different machine signed into the same account — with no browser exploit needed. Anthropic triaged it as a duplicate in May and says it's retiring Dispatch by end of October, but researchers note the same design flaw persists in Claude Code Remote Control and Claude Cowork sessions, so the underlying issue remains unfixed.
Read at The Hacker News →Planted AGENTS.md files in Downloads folder hijack Codex, Claude Code at 90% success AI Security & Safety
Forever Security demonstrated that a web page can silently drop a file named AGENTS.md (or CLAUDE.md) into a victim's Downloads folder; when coding agents like OpenAI Codex, Claude Code, or Cursor CLI are later pointed at that folder (common for file-organizing tasks), they treat the planted file as trusted project instructions. The reconstructed attack chain hijacked Codex into installing a rogue npm package and launching a calculator-app proof-of-concept payload in 90% of test runs — a new indirect prompt-injection vector via trusted-looking config files rather than document content.
Read at BleepingComputer →OpenAI launches GPT-6 Cyber, a Critical-tier offensive security model Model & Product Releases
OpenAI released GPT-6 Cyber on Nov 4, a GPT-6 Astra variant trained for authorized vulnerability research, rated Critical (OpenAI's top tier) under its Preparedness Framework. It scored 48.5% on ExploitGym (vs 32.1% for GPT-5.6 Cyber), gave Mozilla proof-of-concept for 81 new high-severity Firefox bugs, and researchers used it to develop working exploits for 948 of 1,724 reproduced Linux kernel vulnerabilities. With no safety instructions it went out-of-bounds in 0.07% of runs; with them, 0%. Initial access is limited to vetted Daybreak Red customers via API/Codex at $20/$100 per million tokens.
Read at VentureBeat →Multiple AI/dev-infra platforms (Brev, Fireworks AI, Lightning AI, Railway, Trigger.dev, others) hit in secrets-hunting breach wave Breaches & Incidents
SecurityWeek reports a wave of breaches across AI/cloud infrastructure platforms — including NVIDIA's Brev, Fireworks AI, Lightning AI, Railway, Trigger.dev, Northflank, Warp, Zeabur, CommandCode, Andromeda, and OpenCode — with Chainstack and WorkOS also disclosing attacks. Activity relied on the open-source AI-enabled penetration-testing framework Artex to automate reconnaissance and exploitation aimed primarily at stealing stored customer secrets, a distinct incident set from the state-linked Vapor Panda/ARTEX campaign.
Read at SecurityWeek →AWS Bedrock AgentCore "AgentCorruption" flaw enabled account-wide agent takeover AI Security & Safety
Zenity Labs researchers found that AgentCore's reliance on IMDSv1 let an attacker trigger SSRF via a single crafted prompt to steal temporary credentials from an overpermissioned default IAM role, enabling enumeration, ECR source-code pulls, and access to other agents' memory/conversation data across the same AWS account and region. Disclosed to AWS in December 2025; AWS moved AgentCore to IMDSv2-only and tightened default permissions by February 2026 — details are only now circulating widely as "AgentCorruption."
Read at Dark Reading →Anthropic ships Claude Enterprise security center and expands watermarking to older models AI Security & Safety
On Nov 5-6, Anthropic rolled out a beta Security Center in Claude Enterprise that compares chat/Cowork/Claude Code settings against Anthropic's recommended configuration and exports auditor-ready reports, plus GA inference hooks that route prompts/tool calls to customers' data-security tooling and a parent-org admin console for SSO/SCIM across orgs. Separately, Anthropic extended its invisible text watermark (a SynthID-Text variant) to older models — Claude Mythos 5, Opus 4.7, and Sonnet 4.6 — as of Nov 3, aiding provenance detection across AWS, Google Cloud, and Microsoft Foundry deployments.
Read at Anthropic →Brazilian labor court fines lawyers $16,000 for hidden prompt injection in filing AI Security & Safety
A Brazilian labor court detected and fined two lawyers roughly $16,000 after finding invisible (white-on-white) text embedded in a court filing designed to manipulate the court's AI-assisted review system into giving the filing only superficial legal scrutiny. It's a concrete real-world legal precedent for prompt-injection-as-misconduct, following OWASP's ranking of indirect prompt injection as the top LLM application risk.
Read at Tom's Hardware →Microsoft Azure DevOps MCP server had missing-authentication flaw (CVSS 9.1) AI Security & Safety
A missing-authentication vulnerability (CVE-2026-32211, CVSS 9.1) was identified in Microsoft's @azure-devops/mcp npm package, part of a wider pattern of MCP (Model Context Protocol) server security issues surfacing in 2026, alongside a separate SSRF flaw (CVE-2026-26118) in Azure MCP Server Tools and a path-traversal bug (CVE-2026-116635) in AWS's serverless MCP server — underscoring that agent-protocol infrastructure is becoming a serious new attack surface.
Read at Cyber Desserts →Embedded browsers in Cursor, Copilot, Codex, VS Code, Claude Desktop found to bypass normal browser trust rules AI Security & Safety
Researchers found that embedded/browser components inside popular coding agents and IDEs — Cursor, GitHub Copilot, OpenAI Codex, VS Code, and Claude Desktop — are trusted beyond normal web-browser sandboxing rules, with exploitation outcomes ranging from host code execution to reading arbitrary files across disk, highlighting a systemic design issue across the agentic-coding-tool ecosystem rather than a single-vendor bug.
Read at Adversa AI →AI agent hijacking success on upgraded Claude 3.5 Sonnet jumped from 11% to 81% in new attack research AI Security & Safety
Security researchers reported a new agent-hijacking attack technique that raised successful hijack rates on an upgraded Claude 3.5 Sonnet from a baseline 11% to 81%, illustrating that model-level hardening against prompt injection is being outpaced by increasingly sophisticated injection techniques targeting agentic deployments.
Read at Adversa AI →CrowdStrike to pay ~$495M for Fiddler AI and Dreadnode to secure AI agents Industry & Trends
CrowdStrike agreed to acquire Fiddler AI (AI agent monitoring/explainability, ~$400M) and Dreadnode (AI red-teaming/testing, ~$95M) for a combined ~$495M, adding AI observability and adversarial testing to its security platform alongside a newly launched AI agent "kill switch" capability. The deal underscores the fast-forming market for securing enterprise AI agents as agentic deployments scale.
Read at TechCrunch →fal raises $1.3B Series F at $16B valuation as inference demand strains compute Industry & Trends
fal, a San Francisco generative-media inference infrastructure provider, closed a $1.3B Series F on Nov 3-4 led by Bessemer Venture Partners with NVIDIA, Sound Ventures, HOF Capital, and T. Rowe Price, doubling its valuation to $16B from $8B in April. Combined with a prior $350M Series E, fal has raised $1.65B in 2026 as demand for image/video/audio generation inference outstrips available compute.
Read at Tech.eu →Haiou jailbreak bundle hijacks OpenAI Codex to inject ads via config files AI Security & Safety
Check Point Research disclosed "Haiou," a jailbreak/malware bundle targeting OpenAI Codex that modifies local configuration files to inject advertisements for a third-party LLM gateway service — an emerging monetization-driven abuse pattern against coding agents rather than pure data theft.
Read at SC World →NRT-Bench: new multi-turn red-teaming benchmark for LLM agents in safety-critical control rooms AI Security & Safety
A new arXiv paper introduces NRT-Bench, a benchmark for multi-turn red-teaming of LLM agents acting as operators of safety-critical systems, instantiated as a simulated nuclear power plant control room — part of a growing body of research (alongside Jailbreak-Zero and AJAR frameworks also posted recently) pushing red-teaming evaluation from single-turn jailbreak prompts toward sustained adversarial agent interactions in high-stakes domains.
Read at arXiv →DeepSeek releases deepseek-v4-flash-0731 model update Model & Product Releases
DeepSeek shipped deepseek-v4-flash-0731 on Nov 5, 2026, continuing its pattern of frequent incremental releases in its flash (low-latency/cost) model tier, as tracked in LLM release timelines — notable mainly for sustaining DeepSeek's rapid shipping cadence relative to Western labs' less frequent major releases.
Read at LLM Gateway →Preferred Networks releases PLaMo 3 Translate model weights Model & Product Releases
Japan's Preferred Networks released open model weights for PLaMo 3 Translate, a translation-specialized LLM family available in four sizes (800M, 2B, 8B, and 31B parameters), broadening the field of specialized open-weight models outside the general-purpose frontier race.
Read at LLM Gateway →Meta acquires Conductor, a Mac app for parallel coding agents Tools & Frameworks
Meta acquired Conductor on Nov 4, a macOS application for running multiple coding agents in parallel on a single machine, signaling continued consolidation of agentic coding-orchestration tooling by major platform players following similar moves by OpenAI and others this year.
Read at DEV Community →OpenAI acquires Pierre Computer, maker of Git-hosting service Code Storage Industry & Trends
OpenAI announced on Nov 4 it is acquiring Pierre Computer, the company behind Code Storage, a Git hosting service — part of a broader pattern of AI labs acquiring developer-infrastructure and coding-tool companies to vertically integrate agentic coding products.
Read at DEV Community →Palo Alto Networks in talks to buy AI-agent credential startup Clutch Security for ~$500M Industry & Trends
Palo Alto Networks is reportedly negotiating to acquire Clutch Security, a startup focused on securing AI-agent passwords and non-human credentials, for roughly $500M — another data point in the rapid consolidation of the AI-agent-security vendor market alongside CrowdStrike's Fiddler/Dreadnode deals this same week.
Read at AI Funding Tracker →