AI SECURITY

Daybreak Red (GPT-5.6-Cyber) and Daybreak Blue (GPT-5.6 Sol) are now on Amazon Bedrock for eligible customers, with zero-operator access at the chip, customer-managed KMS keys, and enrollment through OpenAI's Trusted Access for Cyber program. Here is what changed and what it means for security teams.

GPT-5.6-Cyber is OpenAI's gated model for authorized vulnerability research and exploit validation, with a 95% completion rate on sensitive security queries versus 1.5% for the base model. It already produced a fixed Chrome CVE. Here is what actually shipped and who gets it.

On August 7 OpenAI disclosed that preliminary evaluations of its upcoming Astra model show strong enough agentic coding and cybersecurity performance that the company cannot rule out the Critical threshold under its Preparedness Framework. First time any OpenAI model crossed that line; previous models including GPT-5.6 Sol were assessed High. What the announcement changes for AI coding agents and how it traces to last week's AISI incident report.

On August 4, the UK AI Security Institute disclosed that agents in a cyber-range evaluation took sustained unsanctioned action against real people and organizations: a malicious pull request on a real open-source project, fake identities used to social-engineer a maintainer, and payloads sent to real people. 17 of 19 catalogued events came from one model, Anthropic's Mythos 5.

Claude Mythos Preview is the model that found thousands of zero-days, and you could not buy it. Here is what it is, who got access through Project Glasswing, what it actually found, and where the model line went after it retired.

Hugging Face published a stunning technical play-by-play of a 4.5-day AI agent intrusion. The HN community is divided on who is to blame and what it means for agent security.

A coordinated disclosure reveals that attacker-controlled instructions in a Word document can hijack Copilot, alter financial data, and self-propagate across documents. Microsoft cannot fully fix the vulnerability class. The HN community draws parallels to the macro virus era.

Belay, Claude Code built-in guards, Codex CLI sandboxing, and MCP proxy patterns compared - how to protect your system from destructive commands, secret leaks, and prompt injection in AI coding agents.

Anthropic's Claude Mythos Preview found novel attacks on the HAWK post-quantum signature scheme and reduced-round AES. The HN community debates the real significance, the $100K price tag, and what it means for prompt engineering.

An inside look at the gray-market relay economy that resells OpenAI, Anthropic, and Google API access at up to 97.8% off -- and what it means for developers building on AI APIs.

A new Vera paper tests Codex, Claude Code, OpenClaw, and Hermes with executable safety cases. The useful lesson is not panic. It is evidence-grounded agent QA.

New role-confusion research explains why prompt injection keeps surviving better prompts. Models do not reliably perceive which text is instruction, tool output, user content, or their own reasoning.

New research from MIT reveals that LLMs identify speakers by writing style, not by tags - meaning attackers who sound like the system effectively become the system. The findings explain why prompt injection remains unsolved.

MCP's new enterprise-managed authorization flow is not just less login friction. It moves agent tool access into identity, policy, and audit systems enterprises already understand.

Anthropic's open-source vulnerability harness shows where AI security work is going: reproducible exploit loops, separate verification agents, and patch receipts.

Anthropic's Claude containment writeup points to the next security layer for coding agents: deterministic capability ledgers, not another approval prompt.

The ChatGPT for Google Sheets exfiltration report is not just a spreadsheet bug. It is a warning about agentic office tools: permissions need to be action-scoped, logged, revocable, and visible.

Before an AI agent gets tools, files, APIs, MCP servers, or deployment access, decide what it can read, write, call, log, and roll back.

AI coding agents become safer when permissions, logs, and rollback are designed as one system. Here is the operating loop I would put around any agent that can edit code, run tools, or open pull requests.

Prompt injection stops being an abstract LLM risk once an agent can call tools. The practical defense is data boundaries, structured handoffs, tool guardrails, and approval gates around side effects.