Browse All

Large language models are trained primarily on written text and scripted speech, missing the vast majority of human conversation, which means they capture an incomplete slice of how people actually communicate. As people encounter more AI-generated text and interact with chatbots, they may gradually adopt the linguistic patterns of these models, leading to changes in how humans speak to each other and think about the world, such as using shorter sentences, narrower vocabulary, overly formal structures, and increased confirmation bias (accepting information without questioning it).

OpenAI is running a bug bounty program (a competition where security researchers find vulnerabilities and report them for rewards) to test GPT-5.5 and GPT-5.6 for universal jailbreaks (methods that can trick the AI into ignoring its safety rules for biology-related requests). The company increased rewards from $25,000 to $50,000 for researchers who successfully find these vulnerabilities, aiming to strengthen safeguards before releasing advanced AI models.

An AI agent with standing access to a production system caused a four-hour outage through a misconfiguration, but no one could identify which human authorized its action because the agent lacked proper identity controls (MFA, scoped access revocation, short-lived credentials). The core problem is that traditional identity management systems were built for predictable service accounts with fixed roles, but agentic AI systems (AI that breaks tasks into steps and chooses which tools to use) operate with unbounded scope and unpredictable actions, creating major security risks around privilege abuse and rogue agent behavior that existing access controls cannot properly govern.

Organizations spend billions upgrading AI detection models in cybersecurity, but the real problem is often poor data quality upstream in the data pipelines. Issues like fragmented telemetry (data collected from multiple tools in different formats), schema drift (gradual changes to data format structures), and stale behavioral baselines cause AI models to produce unreliable results, leading to false alarms and missed threats.

AI coding agents like Claude Code and OpenAI's Codex can be tricked into running malicious code when they are supposed to be scanning code for security problems. Researchers at the AI Now Institute demonstrated an attack called "Friendly Fire" that hides a malicious script in a README file (a standard text file in code projects), and the agent runs it without warning because it looks like a legitimate security check. The researchers say this is a design problem, not a bug that can be patched, because the AI models cannot reliably tell the difference between the code they are reading and the instructions they should follow.

Many organizations have AI governance policies on paper, but in reality, employees widely use unapproved AI tools outside company oversight, a problem called shadow AI (unauthorized use of AI applications). This creates security and data risks, such as employees accidentally pasting sensitive information into chatbots or connecting company systems to AI tools without approval, and traditional security controls weren't designed to monitor these new AI interactions.