Industry news
New tools, products, platforms, funding rounds, and company developments in AI security.
New tools, products, platforms, funding rounds, and company developments in AI security.
6,031 items
Battle Drones is a browser-based Command & Conquer style RTS built by the author through vibe coding, mainly with Claude Code, across 12 major iterations and 321 commits. It runs on mobile and desktop and includes multiplayer between two devices within microphone range that synchronize game state using audio. The source describes the project as a game and does not report a security vulnerability.
A former OpenAI engineer, described in the source as having Saudi ties, was arrested for allegedly placing a secret recorder in an OpenAI conference room. The source frames the case as an insider threat.
Guardian columnist Rebecca Solnit argues in an opinion piece for the How We Win series that the midterm elections will act as a referendum on the GOP's alignment with tech leaders. She cites OpenAI head Sam Altman's remark that the world should accept some bad things for the benefits of the technology. The piece notes that surveys show most Americans would like to pause AI, and that opposition to AI datacenters is a factor in many midterm races.
OpenAI says its newer models, including GPT-6.1 Sol, are much better at writing and migrating code in legacy languages such as COBOL, Fortran and Visual Basic. On its MultiLangBench, GPT-6 Astra averaged an 87.4% pass rate, up from 26.8% for GPT-5.6 Sol, and GPT-6.1 Sol reached 86.6% accuracy on COBOL-to-modern-language migration at low reasoning effort. The source adds that production migrations would still need expert review and testing.
Meta paused a Muse feature that lets users share AI assistant conversations after researchers found the shared URLs publicly accessible on the web. Security firm Claroc reported finding more than 6,800 Muse links through public DNS records.
Meta says it has paused the sharing functionality while it reviews the report and considers changes to how these links can be accessed.
Endor Labs argues that AI security agents built in-house often fail at scale, not in demos, because costs compound across repos and pull requests. In its research, an agent with precomputed evidence used about 6.6 million tokens over 133 minutes, versus 79.5 million tokens over 370 minutes for an unaided agent, across 34 AppSec prompts on 12 open-source projects.
NIST, the NSA and CISA published a report, Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation, listing ten voluntary practices for preparing for, detecting, responding to, recovering from and reporting rogue AI agent incidents. The practices are grouped into five stages, and the agencies say they are intended to help the frontier SI industry prevent and respond to incidents where systems do not act as intended or authorized.
A US district judge, Zachary Bluestone, dismissed a lawsuit that Ann Altman, the sister of OpenAI CEO Sam Altman, filed against him. She had accused him of repeatedly sexually abusing her more than two decades ago, which he denies. The judge wrote that she refused to attend an independent medical examination despite warnings that doing so would lead to dismissal.
The U.S. Department of Homeland Security is ordering federal civilian agencies to stop using DeepSeek products, including affiliates' products and third-party products built on DeepSeek technology, and to remove them from government systems. The order is based on concerns that the Chinese government could access DeepSeek infrastructure and user data, citing a February 2025 NowSecure report on vulnerabilities in the DeepSeek iOS app. Agencies may request exceptions within 60 days of the order's issuance, and CISA will approve or deny them.
Anthropic is in talks with U.K. neocloud Nscale for a second multibillion-dollar deal to lease computing capacity, according to a person familiar with the matter told CNBC. The agreement would cover a second 460-megawatt data center at the same West Virginia site as the first deal, which could be worth around $45 billion. Anthropic declined to comment, and Nscale has been approached for comment.
A Chinese-speaking criminal used Cairn, an open-source AI agent tool built for authorized penetration testing, to direct autonomous agents against more than 1,200 company websites, reaching sites of over 100 companies including Deere, SharkNinja and Cummins. Security researcher Snorre Fagerland of NorForge found about two dozen exposed Cairn control panels, one cluster of which (AIA0001) linked 14 panels to more than 1,100 attack projects. Successful break-ins took just under 23 hours on average, and the agents' overall success rate was around 10%.
Adobe announced that the mobile version of Lightroom, on iOS, iPadOS and Android, can now open closed eyes in photos with generative AI in a single tap. When the app detects a person or group with closed eyes, it shows an Open Eyes Quick Action icon over the image. The source notes that Photoshop Elements has offered a similar feature for nearly a decade.
Former OpenAI research chief Bob McGrew has launched Arda, an AI software company aimed at automating manufacturing. The company raised $230 million at a $1.5 billion valuation, led by Altimeter Capital, Accel and Khosla Ventures, and its models have reportedly been deployed with Anduril.
At NVIDIA GTC Berlin, VicOne showed two demonstrations of physical AI cybersecurity for robotics teams. One used NVIDIA Nemotron models within VicOne Rthena to assess runtime risk and coordinate approved responses across a robot fleet, while the other used the VicOne Radeis Extension with NVIDIA Isaac Sim to test how cyber manipulation could change robot behavior before deployment.
The US government ordered its agencies to stop using AI tools from the Chinese startup DeepSeek. A Department of Homeland Security notice says the ban covers DeepSeek products and third-party tools built with DeepSeek, which must be removed from IT devices.
Federal prosecutors say former OpenAI engineer Abdulrahman Alfozan, 35, hid an audio recording device in toilet paper and plugged it into a television in an executive conference room he was not authorized to enter. The device was found on Sept. 30. Prosecutors say Alfozan was days from leaving the U.S. for Saudi Arabia, and a federal judge in San Francisco denied his request for home confinement.
A TripleTen survey, cited as 2026 data, shows AI adoption varies by sector: 48% of finance workers have been asked to use AI chatbots and 32% to automate workflow parts, versus 18% in healthcare and 25% in education. The article argues this reflects different absorption speeds rather than non-tech industries falling behind. It also reports that 88% of employee-led AI innovations became standard company practice.
Microsoft announced new controls to monitor and restrict potentially rogue AI agents in enterprise environments, urging organizations to treat agents as insiders rather than trusted software. The capabilities extend Project Perception, Microsoft's agentic security system launched in July, and add Dynamic Permissions, Dynamic Agent Risk scoring, and Dynamic Conditional Access. Microsoft is also expanding discovery to 60 types of local agents, including Claude Code, OpenAI Codex and GitHub Copilot.
Ted Taylor, an independent franchisee operating three co-branded Schlotzsky's and Cinnabon restaurants in New Mexico, uses ChatGPT Work to speed up menu repricing and labor management. He reports that repricing now takes 1 to 2 hours instead of 5 days, a 95% reduction, and that payroll runs are 4 hours shorter. The source also says the workflow could free up $100K in cash flow.
Boston Dynamics and VicOne discussed at DEF CON 34 how manipulated inputs can make an authorized, genuine robot command unsafe, such as a step off a staircase or elevated platform. Cyber threats can turn low-probability hazardous conditions into repeatable events, so security analysis must be carried into robot safety validation.
Fix: The source states ten voluntary practices grouped into five stages: prepare (asset and risk inventories, defense-in-depth, least privilege, zero-trust controls, credential management, supply chain risk management), detect (continuous monitoring for correct behavior, anomalous activity and indications of compromise), respond (isolating affected systems, revoking credentials, rebuilding compromised environments, determining the blast radius, root-cause analysis), recover (testing restoration procedures in advance, documenting recovery decisions and residual risk), and report (notifying affected parties and authorities where required, and sharing details publicly).
SecurityWeekFix: Agencies must immediately exclude covered products from procurement, including approved-product lists and purchasing marketplaces, and immediately remove covered products from agency IT systems or seek an exception. Exception requests must be submitted within 60 days of the order's issuance, explaining the justification and proposed risk mitigations.
BleepingComputerFix: Dynamic Permissions grants agents no permissions or the bare minimum at the outset, grants access per task, and requires human review for high-impact actions. Dynamic Conditional Access scales back agent permissions, limits data and network access, requires approval for consequential actions, or isolates or halts the agent's runtime if risk becomes high enough.
SecurityWeek