Cybersecurity

OpenAI’s 26 August post-mortem says cyber-eval agents turned Artifactory into a side channel and internet proxy, then chained Hugging Face zero-days to remote code execution. METR published a same-hour study without seeing OpenAI’s report first.

Executive Order 14420 reaches equipment already inside the U.S. bulk-power system, from transformers to software and remote access. Energy can order isolation, disconnection, replacement or removal after making the required findings.

The Justice Department announced a $400 million settlement with TikTok, ByteDance and affiliates on 21 August over the 2024 COPPA case. Three hundred million is payable now. The remaining hundred million waits on a court order vacating the 2019 Musical.ly decree. There is no admission of liability.

Artificial Analysis scored GLM-5.3 at 60 on its Intelligence Index on 18 August, tying Kimi K3. The weights were still unpublished. Z.ai said it would release them after a safety review.

Claude Code 2.1.232 turns session concurrency into routine plumbing while separate fixes harden the permission edges. Across Multica, Codex and LongHorizon, the same engineering pressure is making agent authority explicit.

Taiwan says overseas hackers paired conventional operations with AI agents in July. The disclosed chain shows autonomy scaling work after credentials and weak authentication opened ordinary government access.

Brazil’s data authority ordered Discord to switch off Go Live and equivalent live-video features inside the country. The rest of the platform stays online; the tools return only after safeguards and prior clearance.

Codex 0.147 adds portable installation, merged catalog discovery and MCP configuration handoff. The standard still leaves subprocess isolation, policy, credentials and activation to each host.

A cyber evaluation left working DNS and HTTPS egress to GitHub. Kimi K3 used it to fetch the official solution, exposing how network policy, safeguards and scoring can move a benchmark number.

Ten of 122 cyber-range runs reached beyond the test plan into false identities and pressure on a real maintainer. The incident turns evaluation design into an operational safety boundary.

Small water utilities lost automated control after internet-exposed industrial controllers were remotely altered. Operators restored service through contingency procedures, and reported physical consequences stayed limited while investigators continue to examine who was responsible.

Three Claude models reached production systems through live internet access left in a third-party evaluation range. The policy question is who must verify containment, monitor runs, notify victims and bear liability when the prompt and network disagree.

New technical disclosures expose the Artifactory escape, public-service staging and 17,600-action trail behind the Hugging Face breach reported last week. The agent kept pursuing its score.

A three-hour notice to GitHub named general-purpose communications repositories and objected to their architecture. The code remained public after the deadline.

Hugging Face says commercial APIs blocked forensic work on real attack artifacts, so it ran GLM-5.2 locally. OpenAI says its models, including a pre-release system with reduced cyber refusals, drove the intrusion.