AI Sec Watch

IBM and Red Hat announced Project Lightwell, a $5 billion initiative to create an AI-powered 'security coordination layer' that helps enterprises discover and fix vulnerabilities (security weaknesses) in open source software faster. The clearinghouse will deliver validated patches directly into existing software supply chains without requiring upgrades, starting with Java/Maven code and eventually expanding to other programming languages.

Anthropic announced plans to release Claude Mythos-class models (powerful AI systems initially restricted due to security concerns) to the general public in the coming weeks. The company stated it has developed strong guardrails (safety measures to prevent misuse) and is making progress on safeguards before the public rollout, though it has not specified an exact timeline.

This document outlines best practices for evaluating frontier AI models (advanced AI systems at the cutting edge of capability) through independent third-party assessments. Modern frontier models are more complex than simple chatbots because they can use tools, maintain information across multiple steps, and operate within larger workflows, so evaluations must account for the "harness" (the surrounding setup and environment) that can significantly affect performance. Evaluation reports should clearly state what claim is being tested (such as whether a model can perform a capability, how robust its safety features are, or how it compares to other models) and provide evidence that the results are valid by addressing potential issues like reward hacking (exploiting shortcuts in scoring), contamination (overperforming due to exposure to similar tasks in training data), and sandbagging (deliberately underperforming when aware of being evaluated).

Anthropic released Claude Opus 4.8 on May 28, 2026, describing it as a modest incremental improvement over its predecessor. A key advancement is improved honesty: the model is about four times less likely than the previous version to overlook flaws in code it writes, and it achieves lower factual hallucination rates (incorrect answers) primarily by declining to answer questions when uncertain rather than attempting to answer more questions.

The llm-anthropic tool (a command-line program for using Anthropic's Claude AI models) was updated to version 0.25.1, adding support for a new Claude Opus 4.8 model and a fast mode option for users with that feature enabled. The update also changed how the tool handles max_tokens (the maximum number of words the AI can generate in a single response) by making it default to each model's actual maximum instead of a fixed 8,192 limit.

A threat group called GreyVibe, likely linked to Russia, has been running cyberattacks since August 2025 against Ukrainian and other organizations using AI-generated fake content and custom malware tools. The group uses ChatGPT, Gemini, and other AI tools to create realistic phishing lures (fake websites and emails impersonating legitimate organizations), and likely uses AI to help develop malware like LegionRelay (a remote access trojan, or RAT, which lets attackers control a victim's computer from afar) and FallSpy (Android spyware that steals personal data). Researchers say the attackers show less sophistication than typical state-sponsored groups and may include current or former cybercriminals.

Okta, a company that provides identity security tools (software that verifies who users are and controls access to systems), reported strong earnings driven by increased demand from companies building agentic AI (AI systems that can independently perform tasks and make decisions). CEO Todd McKinnon emphasized that while agentic AI is boosting interest in Okta's security products, the company is preparing for long-term infrastructure needs rather than chasing short-term profits.

Anthropic, an AI company that makes Claude (a large language model, or LLM, which is software trained on huge amounts of text to generate human-like responses), has become the most valuable AI startup in Silicon Valley after raising $65 billion in funding, pushing its valuation to $965 billion and surpassing competitor OpenAI. The company's valuation jump is driven by strong revenue from Claude Code, an AI coding assistant, which reached a $47 billion annual run rate. Anthropic is now preparing for an initial public offering (IPO, when a private company sells shares to the public to raise money), alongside other major AI companies.

Microsoft is releasing an updated version of Microsoft 365 Copilot (an AI assistant integrated into Microsoft's productivity tools) with a faster loading time and redesigned interface. The new version uses progressive disclosure (showing only relevant tools based on what you ask for, rather than all options at once) and includes an improved prompt box that lets you format text directly.