Industry news

Verge host Nilay Patel interviews RIAA chairman and CEO Mitch Glazier on Decoder, covering the organization's stance on AI companies training on copyrighted work without permission. The discussion also touches on legal questions around AI deepfakes and whether AI detection and labeling systems can work in practice, especially without platforms like Spotify and YouTube participating.

AI agents are taking over routine governance, risk, and compliance tasks such as control testing, evidence collection, and framework mapping, according to Yair Kuznitsov, Co-Founder and CEO of Anecdotes. He argues GRC professionals should build three skills: data literacy, agent governance, and communication.

Endor Labs compared the same model, claude-sonnet-4, on 34 security prompts across 13 scopes, once with Endor Labs security evidence and once working alone from the repo and web. With the evidence, the agent used 12x fewer tokens and finished in about a third of the time. A separate benchmark found that Endor Labs AI SAST identified 2.6x more real vulnerabilities than frontier models prompted to find them on their own.

The U.S. leads in frontier AI models and computing, while China pursues broader routes to artificial general intelligence, including robotics, embodiment and brain-inspired systems. A forthcoming CSET study compares the two countries' strengths and asks what U.S. policymakers may miss by treating AI competition as a single race.

Socket's Threat Research Team analyzed the November 9, 2026 compromise of Ethersphere's release pipeline, in which a threat actor used the project's own GitHub automation to publish a malicious @ethersphere/bee-js 13.3.0 to npm and a trojanized Swarm Desktop 0.56.2 release on GitHub. Both artifacts carry a loader that fetches JavaScript from api[.]frameworkmetrics[.]xyz and executes it with full Node.js privileges, and the later stages take their C2 address from Ethereum contract 0xf8a900Db50b3331be6B768bA460BB59f3E40C344, the same infrastructure documented in the SleepyDuck / EtherDuck Open VSX campaign.

OpenAI built Control Room, a central system that tracks model workloads across its research infrastructure and can stop them quickly when safety or security concerns arise. It connects every research inference workload, works with its misalignment monitoring systems, and halts model output within 35 seconds of a decision to stop or pause a job.

The author attended the [un]prompted AI security conference in San Francisco two weeks ago and called it an excellent event with three days of dense talks. They describe AI security as three broad topics: security of AI, security with AI, and security from AI, and say the conference covered all three.

An opinion piece by Sunita Verma argues that today's AI will not reach superintelligence, yet the same technical limits that prevent it still make current systems dangerous. It cites Geoffrey Hinton's estimate of at least a 10% risk of human extinction within the next few decades, and Dario Amodei's warning that unchecked AI "could outrun our ability to understand and control these systems." The source text is truncated before the author's regulatory proposals.

Google DeepMind, working with cryptographers from UC San Diego and Inria, reports that AI agents found two ways to reduce the cost of attacking 1024-bit RSA. One finding shows PKCS#1 v1.5 padding offers no protection once an attacker controls roughly half the signed block, affecting signing interfaces such as HSMs, and the agents cut CPU time for an earlier forgery attack 3.5-fold. The attacks only affect obsolete 1024-bit systems, according to DeepMind, while 2048-bit or larger keys remain secure.

Defensive security agility is an organization's ability to quickly detect, adapt to and respond to evolving cyber threats without disrupting core operations. The article argues that static, rigid defense architectures should be replaced by an agile plan built on continuous iteration, automation and cross-functional flexibility. It presents seven tips, starting with establishing a zero-trust baseline.

Kuken Industries, a Japanese maker of cooling towers, built an AI-based search over 70 years of drawings with Recursive, an OpenAI partner, using the OpenAI API. Engineers can now find a drawing in 4.5 minutes, down from nearly an hour, by entering a part number or uploading a screenshot or PDF. Kuken expects the tool to cut drawing-search time by about 90% over a year.

CodeRabbit, a code review platform used by over 20,000 organizations, says it uses OpenAI models to review AI-generated code and Codex to ship 20 times more software with the same engineering team. Its CodeRabbit Secure offering uses Daybreak with Codex models to find and fix vulnerabilities. The company reports that better price-performance from OpenAI models lets it add more AI agents and pass the savings to customers.

A former OpenAI engineer, Abdulrahman Alfozan, pleaded not guilty in San Francisco federal court to a single count of interception of oral communications. Prosecutors allege he placed a sophisticated recording device in an executive OpenAI conference room, and he has been held without bail since his October 9, 2026 arrest.

Simon Willison commented on Paul Ford's essay "The Web Is More Than Enough" on Hacker News. He shared a Three.js Nudibranch-themed Faberge egg and reported that Claude Opus 5.5 Medium, in regular Claude Chat, ported it to Vanilla JS and WebGL without Three.js. The two versions were not identical, and he said he found the Three.js code slightly easier to understand.

The author describes a method for making agent-generated pull request descriptions easier to read: a short human-written opener followed by the full agent text inside a collapsed HTML <details><summary> block, with the model name as the summary label. The author says GitHub Markdown supports this markup in PR descriptions and issue comments, and cites several datasette PRs that use the pattern.

Snyk's Evo ADS guide describes how teams can govern AI coding agents by inventorying MCP servers, assessing risk, and blocking high-risk connections. Evo ADS provides a per-server risk score and runs through endpoint hooks with no proxy. The source reports that Snyk found 4,524 unique MCP servers across 10,000 developer environments, with 1 in 12 developers having a confirmed high or critical finding.

On Sunday, Nvidia announced an investigation into CEO Jensen Huang's relationship with Alice Huang, described in the source as an AI executive and agent of the Chinese government. Huang also sent a memo to employees acknowledging the affair. The source text is truncated and contains only the opening of the memo.