Jose Antonio Lanz reports: Near AI has disclosed a breach that exposed account information belonging to about 100 users and data from 18 AI agents after an attacker exploited software running its servers. The company said in a November 9 report that an attacker used a remote code execution vulnerability in SGLang, an open-source engine...

Tess Ikonomou and Josh Butler report: OpenAI will not face criminal penalties over the Medicare data breach, but the prime minister has flagged changes to Australia’s criminal law to crack down on future breaches by artificial intelligence companies. Anthony Albanese on Tuesday released the recommendations of a “rapid review” into the June breach of a...

Google opened Carbon to paying developers and businesses as DeepMind used agents built on it to prove libsignal security guarantees.

The post Google Widens Gemini 4 Carbon Access After AI Agents Verify Signal Code appeared first on SecurityWeek.

Laura Kim, Jayne Ponder, and Marissa Uri of Covington and Burling write: On October 22, 2026, the Governor of Pennsylvania signed the Artificial Intelligence Deceptive Advertising Act (Senate Bill 806) (“Act”) into law. The Act joins a growing number of state laws focused on the use of AI in advertising. However, unlike the laws in...

NEW YORK—The AFT and the United Federation of Teachers today announced a legally binding agreement with Anthropic that makes AI safety, privacy and transparency standards enforceable in thousands of U.S. K-12 schools. The national AI Safety and Privacy Standard for Schools automatically applies to Anthropic’s existing agreements with school districts using Claude for Teachers and...

Law professor and privacy law scholar Dan Solove has made two short essays available to everyone: The AI Inference Problem in Privacy Law AI inferences undermine privacy laws. Whether they recognize inferences or not, privacy laws are in a bind. Rethinking Privacy of the Mind:  Why Protecting Neural Data Is Insufficient Is protecting neural data...

Naomi Diaz reports: New York City-based Weill Cornell Medicine disclosed that patient health information was entered into AI tools and processed using machine learning without authorization as part of a radiology research study. Weill Cornell learned of the incident Sept. 6 and launched an investigation, which determined that certain patient information from Weill Cornell Imaging...

Victor Tangermann reports: After decades of establishing itself as one of the worst guardians of personal data, Meta raised eyebrows this year by encouraging users to hand over their email logins and credit card information to its new AI agent, Muse. The tool, a privacy nightmare anthropomorphized by a furry apparition, can crawl through years...

Zack Whittaker reports: Security researchers have discovered hundreds of copies of a Chinese-made AI hacking tool publicly exposed to the internet for anyone to access, potentially allowing outsiders to launch cyberattacks against unsuspecting targets. The hacking software, called Artex, is an open source autonomous penetration testing tool, meaning software that automatically probes computer systems for...

Noteworthy stories that might have slipped under the radar: Synology warns about NAS ransomware attacks, Flowise ‘hello’ attacks, Chainalysis breach impact expands.

The post In Other News: Trezor Implant, LLMJacking Bills Hit $1M, SAP Flaws Weaponized Within Days appeared first on SecurityWeek.

Rated Critical for cybersecurity, OpenAI’s new model beats GPT-5.6 Cyber at exploitation while staying in scope more reliably.

The post OpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the Line appeared first on SecurityWeek.

After its sandbox proxy failed, an internal OpenAI model crafted raw packets and probed AWS services trying to reach the internet.

The post OpenAI Model Wrote Its Own Network Code to Get Around Sandbox Restrictions appeared first on SecurityWeek.

OpenAI has revealed GPT-6 Cyber, a new artificial intelligence model that has discovered 81 previously unknown high-severity Firefox vulnerabilities and developed working exploits for 948 distinct Linux kernel flaws. [...]

The trio, who have nicknames that include “Rocky Balboa,” “Superman Cash” and “Fat Boy,” often targeted the companies’ accounting departments.

The post 3 Charged in Scheme to Use AI to Impersonate CEOs and Attorneys to Steal $129 Million appeared first on SecurityWeek.

An unreleased OpenAI cyber model found and exploited 948 distinct Linux kernel privilege escalation bugs for about $1.2 million.

The post AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research appeared first on SecurityWeek.

Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.

The post The Agent Smith Dilemma: Governing Agentic Identities appeared first on SecurityWeek.

OpenAI says its Critical-rated cyber model met fewer hidden task goals when work was framed as AI safety research, often silently.

The post OpenAI Finds GPT-6 Astra Quietly Holding Back on Internal Red-Teaming, Exploit Tasks appeared first on SecurityWeek.

Sysdig’s platform uses runtime visibility to track AI agent actions and block risky behavior before it reaches production systems.

The post Sysdig Adds Runtime Security and Governance for AI Agents appeared first on SecurityWeek.

The company will invest in agentic data security capabilities and expand its go-to-market organization.

The post Agentic Data Security Firm Sentra Raises $150 Million appeared first on SecurityWeek.

Hackers have been harvesting AI access tokens and have been using AI-assisted offensive tools to automate attacks.

The post AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks appeared first on SecurityWeek.