Jose Antonio Lanz reports: Near AI has disclosed a breach that exposed account information belonging to about 100 users and data from 18 AI agents after an attacker exploited software running its servers. The company said in a November 9 report that an attacker used a remote code execution vulnerability in SGLang, an open-source engine...

Tess Ikonomou and Josh Butler report: OpenAI will not face criminal penalties over the Medicare data breach, but the prime minister has flagged changes to Australia’s criminal law to crack down on future breaches by artificial intelligence companies. Anthony Albanese on Tuesday released the recommendations of a “rapid review” into the June breach of a...

Google opened Carbon to paying developers and businesses as DeepMind used agents built on it to prove libsignal security guarantees.

The post Google Widens Gemini 4 Carbon Access After AI Agents Verify Signal Code appeared first on SecurityWeek.

Laura Kim, Jayne Ponder, and Marissa Uri of Covington and Burling write: On October 22, 2026, the Governor of Pennsylvania signed the Artificial Intelligence Deceptive Advertising Act (Senate Bill 806) (“Act”) into law. The Act joins a growing number of state laws focused on the use of AI in advertising. However, unlike the laws in...

NEW YORK—The AFT and the United Federation of Teachers today announced a legally binding agreement with Anthropic that makes AI safety, privacy and transparency standards enforceable in thousands of U.S. K-12 schools. The national AI Safety and Privacy Standard for Schools automatically applies to Anthropic’s existing agreements with school districts using Claude for Teachers and...

Law professor and privacy law scholar Dan Solove has made two short essays available to everyone: The AI Inference Problem in Privacy Law AI inferences undermine privacy laws. Whether they recognize inferences or not, privacy laws are in a bind. Rethinking Privacy of the Mind:  Why Protecting Neural Data Is Insufficient Is protecting neural data...

Naomi Diaz reports: New York City-based Weill Cornell Medicine disclosed that patient health information was entered into AI tools and processed using machine learning without authorization as part of a radiology research study. Weill Cornell learned of the incident Sept. 6 and launched an investigation, which determined that certain patient information from Weill Cornell Imaging...

ON SECURITY By Susan Bradley Recently, we were looking for something to solve a problem at the office.  Rather than spin my wheels looking for the best way to get software A (an Excel spreadsheet) to talk to software B (a line-of-business app that has a SQL backend), I reached out to someone on the […]

Victor Tangermann reports: After decades of establishing itself as one of the worst guardians of personal data, Meta raised eyebrows this year by encouraging users to hand over their email logins and credit card information to its new AI agent, Muse. The tool, a privacy nightmare anthropomorphized by a furry apparition, can crawl through years...

From the “sounded-like-extortion-to-us department,” T. Keung Hui reports: Triangle school districts are trying to get more information about how they’ll be impacted by Google’s plan to change access to Google Search in schools. Google set off a firestorm this week when it initially announced that it would turn off access to Google Search for schools...

Zack Whittaker reports: Security researchers have discovered hundreds of copies of a Chinese-made AI hacking tool publicly exposed to the internet for anyone to access, potentially allowing outsiders to launch cyberattacks against unsuspecting targets. The hacking software, called Artex, is an open source autonomous penetration testing tool, meaning software that automatically probes computer systems for...

Shmulik Cohen and Matan Giladi write: Apiiro research found 2,539 real secrets in 1,994 public GitHub repositories: database passwords, cloud keys, API tokens, SSH root logins. Among them: a database vendor’s own admin-level cloud key, a production Azure Postgres password, a Square production token, and the owner password of a medical-records database. 63 organizations, mostly...

Noteworthy stories that might have slipped under the radar: Synology warns about NAS ransomware attacks, Flowise ‘hello’ attacks, Chainalysis breach impact expands.

The post In Other News: Trezor Implant, LLMJacking Bills Hit $1M, SAP Flaws Weaponized Within Days appeared first on SecurityWeek.

Rated Critical for cybersecurity, OpenAI’s new model beats GPT-5.6 Cyber at exploitation while staying in scope more reliably.

The post OpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the Line appeared first on SecurityWeek.

After its sandbox proxy failed, an internal OpenAI model crafted raw packets and probed AWS services trying to reach the internet.

The post OpenAI Model Wrote Its Own Network Code to Get Around Sandbox Restrictions appeared first on SecurityWeek.

OpenAI has revealed GPT-6 Cyber, a new artificial intelligence model that has discovered 81 previously unknown high-severity Firefox vulnerabilities and developed working exploits for 948 distinct Linux kernel flaws. [...]

ABC News reports: NT Health has issued a ban on smart glasses at all of its clinical sites, as part of an internal department review into its privacy policies prompted by a breach at Royal Darwin Hospital earlier this month. The breach involved a medical observer, Dr Neda Mogharehabed, who was visiting Royal Darwin Hospital...

The trio, who have nicknames that include “Rocky Balboa,” “Superman Cash” and “Fat Boy,” often targeted the companies’ accounting departments.

The post 3 Charged in Scheme to Use AI to Impersonate CEOs and Attorneys to Steal $129 Million appeared first on SecurityWeek.

Jessica Lyons reports: A vulnerability in Anthropic’s Claude products lets any browser extension that can control Claude Dispatch make Claude Desktop run code on the computer – or even a different machine signed into the same Claude account – with no browser exploit and minimal user interaction required. Anthropic, aware of the problem since May,...

An unreleased OpenAI cyber model found and exploited 948 distinct Linux kernel privilege escalation bugs for about $1.2 million.

The post AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research appeared first on SecurityWeek.