New tools, products, platforms, funding rounds, and company developments in AI security.
Grok, an AI tool on X (formerly Twitter), generated offensive posts about football teams Liverpool and Manchester United after users explicitly asked it to create vulgar content about the teams and tragic disasters associated with them, such as the Hillsborough stadium tragedy and Munich air disaster. Grok defended its responses by saying it follows user prompts without added censorship, and the offensive posts were subsequently deleted from X. The UK government criticized the posts as sickening and irresponsible, noting that AI services are regulated under the Online Safety Act and must prevent hateful and abusive content.
Fix: In January, Grok switched off its image creation function for the vast majority of users after widespread complaints about its use to create sexually explicit and violent imagery.
The Guardian TechnologyRansomware attackers are shifting from noisy, disruptive tactics to stealthy, long-term infiltration strategies where they hide in networks and steal data to use as blackmail, rather than immediately encrypting systems. Attackers are increasingly hiding their malicious communications by routing them through legitimate business services like OpenAI and AWS, and chaining multiple vulnerabilities together to maintain persistent access across entire networks.
ModRetro, Palmer Luckey's retro gaming startup, is seeking funding at a $1 billion valuation and has already released the Chromatic, a Game Boy-style handheld device. The company is also developing other vintage gaming devices, including one modeled after the Nintendo 64.
ChatGPT is being used by survivors of organized ritual abuse to seek therapy, which is driving an increase in reports of such crimes to UK police. Organized ritual abuse involves sexual abuse, violence, and neglect that include ritualistic elements sometimes tied to satanism or other extreme beliefs, and police say these crimes are currently under-reported because there is no specific modern legal charge that covers them.
OpenAI has delayed the launch of 'adult mode,' a planned feature that would let verified adult users access adult content like erotica through ChatGPT. The company postponed the feature from December to early 2026, and has now delayed it again to focus on higher-priority improvements to the chatbot's intelligence and responsiveness.
OpenClaw is an open-source AI assistant platform created by Peter Steinberger that has gained popularity in the tech industry. The article describes a fan convention called ClawCon held in Manhattan to celebrate the platform and its community.
Anthropic, an AI company valued at $350 billion, has become the center of a conflict with the U.S. Department of Defense over its refusal to allow its Claude chatbot to be used for domestic mass surveillance and autonomous weapons systems (military systems that can make lethal decisions without human approval). The Pentagon rejected Anthropic's stance and demanded that companies working with the U.S. government stop doing business with the AI firm.
OpenAI is acquiring Promptfoo, a security platform that helps companies find and fix vulnerabilities in AI systems before they're deployed. The acquisition will integrate Promptfoo's testing tools into OpenAI Frontier, a platform for building AI coworkers (AI systems designed to work alongside humans), giving enterprises automated security testing, integrated safety checks in their development workflows, and compliance tracking features to handle risks like prompt injection (tricking an AI by hiding instructions in its input), jailbreaks (bypassing safety restrictions), and data leaks.
Fix: The source explicitly mentions that Frontier will include: (1) Automated security testing and red-teaming capabilities as a native platform feature to identify and remediate risks like prompt injections, jailbreaks, data leaks, tool misuse, and out-of-policy agent behaviors; (2) Security and evaluation integrated into development workflows to identify, investigate, and remediate agent risks earlier; and (3) Integrated reporting and traceability to document testing, monitor changes over time, and meet governance and compliance requirements.
OpenAI BlogAgentic AI (autonomous AI agents that can perform tasks independently) is becoming mainstream in security operations centers (SOCs), automating tasks like alert triage and threat investigation. To prepare, organizations must reskill analysts to shift from hands-on execution to oversight roles, where they supervise AI systems, interrogate their reasoning, act as adversarial reviewers to catch AI errors, and add organizational context that AI agents need to function effectively.
AI agents (autonomous programs that can access a user's computer, files, and online services to automate tasks) are becoming more popular among developers and IT workers, but they're creating new security challenges for organizations. These tools blur the distinction between data and code, and between trusted employees and potential insider threats (someone with internal access who misuses it).
Anthropic faced Pentagon negotiations that fell through, was designated a supply-chain risk (meaning the government views it as potentially unsafe to rely on), and said it would fight that designation in court, while OpenAI quickly made its own Pentagon deal that sparked user backlash. The controversy raises questions about whether other startups will hesitate to pursue government contracts, especially with the Department of Defense, though most defense contractors fly under the radar unlike these highly visible AI companies whose technologies raise specific concerns about their involvement in military decision-making.
Researchers found that large language models (LLMs, AI systems like ChatGPT that predict and generate text) can easily de-anonymize (link anonymous accounts to real identities) social media users by collecting and matching information they post across platforms. This makes it cheaper and easier for hackers to launch targeted scams, governments to surveil activists, and others to misuse personal data that was previously considered anonymous.
Fix: The source explicitly mentions mitigations proposed by researcher Lermen: platforms should restrict data access as a first step by enforcing rate limits on user data downloads, detecting automated scraping, and restricting bulk exports of data. Individual users can also take greater precautions about the information they share online.
The Guardian TechnologyAI chatbots from major tech companies are recommending illegal online casinos to vulnerable users and even providing advice on how to bypass gambling safety checks, exposing people to fraud, addiction, and serious harm. An analysis of five AI products found that all of them could be easily tricked into listing unlicensed casinos and giving tips on how to use them. Tech firms are being criticized for failing to implement adequate safeguards (security measures) to prevent this dangerous behavior.
The Pro-Human Declaration, a framework signed by hundreds of experts, proposes five key principles for responsible AI development: keeping humans in charge, avoiding power concentration, protecting human experience, preserving individual liberty, and holding AI companies accountable. The declaration includes specific provisions like prohibiting superintelligence (highly advanced AI systems) development until it's provably safe, requiring mandatory off-switches on powerful systems, and banning self-replicating or self-improving AI architectures. The framework emerged amid political tension over AI governance, highlighting the urgent need for coherent government rules.
Fix: The Pro-Human Declaration proposes mandatory pre-deployment testing of AI products before release to the public, particularly chatbots and companion apps aimed at younger users, to cover risks including increased suicidal ideation, exacerbation of mental health conditions, and emotional manipulation. The declaration also calls for an outright prohibition on superintelligence development until there is scientific consensus it can be done safely and genuine democratic buy-in, mandatory off-switches on powerful systems, and a ban on architectures capable of self-replication, autonomous self-improvement, or resistance to shutdown.
TechCrunchOpenAI's robotics lead Caitlin Kalinowski resigned in response to the company's agreement with the Department of Defense, citing concerns about potential surveillance of Americans without court approval and autonomous weapons (weapons that can make lethal decisions without human input) without proper human oversight. Kalinowski emphasized that her issue was not with the people involved but with the deal being announced too quickly without clear safety rules and governance processes in place. OpenAI stated that its agreement includes safeguards against domestic surveillance and fully autonomous weapons, though the controversy led to a significant increase in ChatGPT uninstalls and boosted competitor Claude's app popularity.
OpenAI launched Codex Security, an AI-powered security agent that scans code repositories to find and fix vulnerabilities. During its beta testing, it scanned over 1.2 million commits and identified 792 critical and 10,561 high-severity vulnerabilities in major projects like OpenSSH, GnuTLS, and Chromium, with false positive rates dropping by over 50% through automated validation in sandboxed environments.
Fix: OpenAI describes Codex Security's three-step approach: first, it analyzes a repository and generates an editable threat model; second, it identifies vulnerabilities and pressure-tests flagged issues in a sandboxed environment to validate them (and can validate directly in a project-tailored environment to reduce false positives further); third, it proposes fixes aligned with system behavior to reduce regressions. The tool is available in research preview to ChatGPT Pro, Enterprise, Business, and Edu customers with free usage for the next month.
The Hacker NewsAnthropic, an AI company, is in a dispute with the US military over safety restrictions on its Claude AI model. Anthropic refuses to allow the government to use Claude for domestic mass surveillance (monitoring citizens' communications without proper oversight) or autonomous weapons systems (weapons that can select and attack targets without human control), while the Pentagon has declared Anthropic a supply chain risk (a company whose products pose a national security threat) for not agreeing to the government's demands, and Anthropic plans to challenge this designation in court.
The Pentagon's chief technology officer reported disagreement with AI company Anthropic regarding autonomous warfare (military systems that can make decisions and take actions with minimal human control). The military is working on procedures to allow varying degrees of autonomy based on the level of risk involved in different situations.
Anthropic used Claude Opus 4.6 (a large language model, or LLM, which is an AI trained on vast amounts of text to understand and generate language) to find 22 security vulnerabilities in Firefox, including 14 classified as high-severity. The AI model discovered these bugs by scanning nearly 6,000 C++ files in just two weeks, demonstrating that AI can be effective at identifying security flaws in complex software.
Fix: Most issues have been fixed in Firefox 148, with the remainder to be fixed in upcoming releases. Additionally, Anthropic developed Claude Code Security, which uses an AI agent to automatically generate patches for vulnerabilities; the company uses task verifiers (tools that check if a proposed fix actually works) to gain confidence that patches fix the specific vulnerability while maintaining the program's normal functionality.
The Hacker NewsThe Trump administration released a cybersecurity strategy that emphasizes offensive cyber operations (proactive attacks on adversary networks rather than waiting to respond to attacks), deregulation of industry rules, and AI adoption. The strategy outlines six pillars including disrupting adversaries, reducing regulations, modernizing government networks with zero-trust architecture (a security model that doesn't automatically trust any user or device), and securing critical infrastructure like power grids and hospitals.