A weekly scan of 3,372 MCP server packages on npm found that 45% can run shell commands and 16% can modify AI tool configurations. Most packages with "do not tell the user" instructions (25 of 27) are honesty guardrails preventing false claims, not malicious deception. No confirmed malware, leaked secrets, or tool-description poisoning was discovered.
A discussion on X about AI systems that can exploit software vulnerabilities at scale, exploring implications for security, cryptography, and defense. The author argues that perfect exploitation oracles would shift security dynamics, raise alignment risks, and concentrate power among those controlling advanced models.
Japan has experienced a surge in cyberattacks and data breaches across major companies including Daiwa Securities, Yakiniku King, Keio railway, Tokyo Metro, and Times Car, with millions of personal records compromised. Security firm Macnica attributes the spike to hackers using AI tools to identify system vulnerabilities at unprecedented speed and scale, with cases jumping from six to 23 per month since July.
This article argues that memory safety vulnerabilities in C can be addressed through backwards-compatible language extensions rather than rewrites in Rust. The author critiques the RAND report's Rust advocacy, contending that C's systems programming role and memory safety issues are interconnected, but that solutions like the COUNTED_BY attribute macro allow hardening without code forking or compiler changes.
Pwn2Own Ireland 2026 concluded with hackers earning $1,262,000 by exploiting 98 zero-day vulnerabilities across mobile phones, AI infrastructure, and other device categories. Ikotas Labs won first place with $361,000 after successfully hacking Samsung Galaxy S26, OpenAI Codex, Oracle Autonomous AI Database, and Google Pixel 10. The competition, organized by Trend Micro's Zero Day Initiative, requires vendors to patch disclosed vulnerabilities within 90 days.
Crypto developers Nethermind and ZEUS have applied for access to Anthropic's free AI security scanner powered by Claude Mythos, which identifies software vulnerabilities in open-source projects. Anthropic's scanner has found over 29,000 candidate vulnerabilities across widely used projects, with only 6,000 manually reviewed so far, and now sends automated reports directly to maintainers without human verification.
Anthropic launched OSS Scanner, an opt-in service using its strongest AI models including Claude Mythos to generate vulnerability reports for open-source projects. Crypto companies like Nethermind and ZEUS have applied for access to help defend against increasingly sophisticated AI-assisted attacks.
Anthropic launched OSS Scanner, a free service providing automated security vulnerability scans for open-source projects using its strongest AI models. The fully automated reports come without human review, enabling faster scanning but risking false positives, while open-source maintainers already face challenges managing AI-generated bug reports.
Anthropic launched the Cyber Mission to support defenders securing critical infrastructure and open-source software. The initiative includes the Critical Infrastructure Defense Program (CIDP) providing frontier models and engineers to protect operational technology, and OSS Scanner offering free security scans for open-source projects.