New tools, products, platforms, funding rounds, and company developments in AI security.
Anthropic, an AI company, announced that its run-rate revenue (an annualized projection based on current monthly earnings) has grown to $47 billion as of May 2026, up from $30 billion in April 2026. This represents extraordinarily rapid growth, with the company increasing its run-rate revenue more than 10 times annually over the past three years, driven by widespread adoption among enterprise customers.
Anthropic released Claude Opus 4.8 on May 28, 2026, describing it as a modest incremental improvement over its predecessor. A key advancement is improved honesty: the model is about four times less likely than the previous version to overlook flaws in code it writes, and it achieves lower factual hallucination rates (incorrect answers) primarily by declining to answer questions when uncertain rather than attempting to answer more questions.
The llm-anthropic tool (a command-line program for using Anthropic's Claude AI models) was updated to version 0.25.1, adding support for a new Claude Opus 4.8 model and a fast mode option for users with that feature enabled. The update also changed how the tool handles max_tokens (the maximum number of words the AI can generate in a single response) by making it default to each model's actual maximum instead of a fixed 8,192 limit.
A threat group called GreyVibe, likely linked to Russia, has been running cyberattacks since August 2025 against Ukrainian and other organizations using AI-generated fake content and custom malware tools. The group uses ChatGPT, Gemini, and other AI tools to create realistic phishing lures (fake websites and emails impersonating legitimate organizations), and likely uses AI to help develop malware like LegionRelay (a remote access trojan, or RAT, which lets attackers control a victim's computer from afar) and FallSpy (Android spyware that steals personal data). Researchers say the attackers show less sophistication than typical state-sponsored groups and may include current or former cybercriminals.
Okta, a company that provides identity security tools (software that verifies who users are and controls access to systems), reported strong earnings driven by increased demand from companies building agentic AI (AI systems that can independently perform tasks and make decisions). CEO Todd McKinnon emphasized that while agentic AI is boosting interest in Okta's security products, the company is preparing for long-term infrastructure needs rather than chasing short-term profits.
Anthropic, an AI company that makes Claude (a large language model, or LLM, which is software trained on huge amounts of text to generate human-like responses), has become the most valuable AI startup in Silicon Valley after raising $65 billion in funding, pushing its valuation to $965 billion and surpassing competitor OpenAI. The company's valuation jump is driven by strong revenue from Claude Code, an AI coding assistant, which reached a $47 billion annual run rate. Anthropic is now preparing for an initial public offering (IPO, when a private company sells shares to the public to raise money), alongside other major AI companies.
Microsoft is releasing an updated version of Microsoft 365 Copilot (an AI assistant integrated into Microsoft's productivity tools) with a faster loading time and redesigned interface. The new version uses progressive disclosure (showing only relevant tools based on what you ask for, rather than all options at once) and includes an improved prompt box that lets you format text directly.
Anthropic, the company behind Claude (a large language model, or LLM, which is an AI trained on massive amounts of text to generate human-like responses), raised $65 billion in funding and is now valued at $965 billion, making it the world's most valuable AI startup. The company's growth has been driven by widespread adoption of its products by large businesses, especially after releasing powerful coding tools recently.
Geordie, an AI security startup, raised $30 million to expand its platform that helps organizations monitor and control AI agents (AI systems designed to complete tasks independently) deployed across their systems. The platform provides real-time visibility into agent behavior and risks, while its Beam tool uses context engineering (a technique that shapes how AI systems understand and respond to instructions) to constrain agent behavior at scale.
Anthropic is releasing Claude Opus 4.8, a new AI model designed to be more 'honest' by better recognizing when it doesn't have enough information to answer confidently. The model addresses a common problem where AI systems make unsupported claims (stating things as fact without solid evidence), and early testers found that Opus 4.8 is about 4 times less likely to do this compared to its predecessor.
Apple is planning a major redesign of Siri, its voice assistant, for iOS 27, which may feature a ChatGPT-like chat interface. The redesign shows a pill-shaped chat bubble that appears from the Dynamic Island (the notch area on iPhones) with options to choose between Ask, Siri, and ChatGPT, though Apple has not officially confirmed these details and the final design may differ.
Wassym Bensaid, Rivian's chief software officer, leads both Rivian's internal software development and RV Tech, a joint venture with Volkswagen that builds the operating system and electrical architecture for future electric vehicles from Volkswagen Group brands. Rivian recently launched an AI-powered voice assistant in its R1 vehicles and is preparing to release the R2, the first car built on the new shared architecture developed through the joint venture. The article discusses how Rivian is moving toward AI-powered, agent-like software platforms in cars while reducing reliance on traditional physical controls and Apple CarPlay integration.
This bulletin covers multiple security incidents including a privilege escalation flaw in Azure Backup for AKS (a Kubernetes container management system) with a CVSS score of 9.9, a massive network of 1,350 command-and-control servers (systems attackers use to control compromised computers) discovered across Middle Eastern infrastructure providers, and a supply chain attack on DAEMON Tools software where attackers compromised legitimate signed binaries (executable files verified as authentic). The incidents highlight ongoing vulnerabilities in cloud services, infrastructure, and software distribution systems.
Attackers are increasingly using AI agents (autonomous software that can act independently) to find and exploit security vulnerabilities much faster than before, with the time from a vulnerability becoming public to actual attacks dropping from 2.3 years in 2018 to about 10 hours in 2026. Organizations continue to suffer breaches due to common problems like misconfigurations (incorrect security settings), unpatched systems (software without the latest security fixes), and identity sprawl (too many user accounts and access permissions), not because they lack awareness of these issues but because fixing them at scale is difficult.
Endava, a software contracting firm, uses Codex (an AI tool for code generation and software development) to transform into an 'agentic organization' where AI agents work alongside teams throughout project lifecycles. The tool enables small teams to deliver large amounts of work faster by codifying senior expertise into guidance for junior developers, compressing weeks of sequential analysis and design work into days, and improving knowledge transfer across the organization.
IBM and Red Hat announced Project Lightwell, a $5 billion initiative to create an AI-powered 'security coordination layer' that helps enterprises discover and fix vulnerabilities (security weaknesses) in open source software faster. The clearinghouse will deliver validated patches directly into existing software supply chains without requiring upgrades, starting with Java/Maven code and eventually expanding to other programming languages.
Fix: Project Lightwell will backport fixes (apply patches to older versions) to exact dependency versions that have already been tested and deployed, operate on configuration manifests like pom.xml so code remains in controlled enterprise environments, and deliver fixes across dependency chains. Enterprises will receive validated patches spanning Red Hat platforms and independent community code, and can share fixes upstream through a 'secure map' so the wider open-source community can incorporate them.
CSO OnlineAnthropic announced plans to release Claude Mythos-class models (powerful AI systems initially restricted due to security concerns) to the general public in the coming weeks. The company stated it has developed strong guardrails (safety measures to prevent misuse) and is making progress on safeguards before the public rollout, though it has not specified an exact timeline.
This document outlines best practices for evaluating frontier AI models (advanced AI systems at the cutting edge of capability) through independent third-party assessments. Modern frontier models are more complex than simple chatbots because they can use tools, maintain information across multiple steps, and operate within larger workflows, so evaluations must account for the "harness" (the surrounding setup and environment) that can significantly affect performance. Evaluation reports should clearly state what claim is being tested (such as whether a model can perform a capability, how robust its safety features are, or how it compares to other models) and provide evidence that the results are valid by addressing potential issues like reward hacking (exploiting shortcuts in scoring), contamination (overperforming due to exposure to similar tasks in training data), and sandbagging (deliberately underperforming when aware of being evaluated).
GreyVibe is a Russia-linked hacking group that uses AI tools like ChatGPT and Google Gemini across all stages of attacks, from creating fake websites to building custom malware, targeting Ukrainian military and government entities since August 2025. Although the group appears less sophisticated than elite state actors (evidenced by design flaws in their AI-generated malware and casual naming conventions), they leverage AI to operate at a much higher capability level than their technical skill would normally allow. Researchers expect GreyVibe's AI expertise and attack complexity to continue increasing over time.
AI agents (AI systems that can take actions by using external software tools) aren't inherently dangerous, but the risk comes from how they're set up and deployed in organizations. The main concern is the overlap between what the AI can do and what tools it has access to, which can create security vulnerabilities if not managed carefully.
Fix: For the Azure Backup for AKS vulnerability: Microsoft has patched the flaw and enforced additional validation checks that did not exist in March 2026. For the DAEMON Tools supply chain attack: CISA requires Federal Civilian Executive Branch agencies to apply necessary fixes by May 30, 2026, and the incident is tracked as CVE-2026-8398.
The Hacker News