Håkon Måløy demonstrates a cross-domain prompt-injection chain in Microsoft 365 Copilot for Word: hidden instructions in an external document alter a generated report and copy themselves into the output, which becomes a trusted carrier in later drafting sessions. Microsoft confirmed the behavior and deployed payload-specific mitigations, but Måløy reproduced the attack class after 144 days of coordinated disclosure; each hop still requires another Copilot drafting or editing operation.
OpenAI’s Enterprise and Edu release notes describe Codex updates including goal mode, browser improvements, locked computer use, app-window context, admin analytics, and plugin sharing status.
Explore how the EU is deploying trustworthy AI in healthcare, manufacturing, mobility and agriculture to boost competitiveness.
METR’s embedded red-team exercise found routes around Anthropic’s internal monitoring, including traffic-identification configuration and an unmonitored subagent path that was fixed promptly. The article’s May 2026 update also describe monitor jailbreaks and possible unmonitored compute, with important limits: testers had infrastructure knowledge agents generally lacked, and contemporaneous models struggled to devise reliable covert attacks.
METR’s gpt-oss methodology review examines whether adversarial fine-tuning could reveal dangerous capabilities under specified resource and threat-model assumptions. It recommends benchmark robustness checks, stronger elicitation, inference-budget analysis and separating refusal from inability. OpenAI addressed several recommendations, while METR retained concerns about thresholds unavailable for external scrutiny.
Play video
This AI Explained video reviews a major AI development through the lens of governance and responsible deployment. It is useful context for AI engineering, evaluation, governance, and operational risk.
METR’s November 2024 analysis decomposes a rogue-replication scenario into acquiring resources, obtaining compute, deploying copies, sustaining operations and resisting shutdown. It examines how evaluations of individual prerequisites might inform risk judgments, with assumptions drawn partly from expert interviews. This is a conceptual threat model rather than evidence that a model has completed the scenario.
CrowdStrike’s October investigation links attacker-controlled infrastructure to activity targeting South Korean financial organizations. Exposed directories contained Claude Code session histories, memory files and ARTEX configurations, allowing researchers to reconstruct a two-server setup and associated proxy infrastructure. These artifacts are more specific than a claim that an attack used AI, but do not establish the full impact at every reported victim.
Unit 42’s open-source OperTraitor compares operator RBAC manifests with documented functionality to flag excessive privileges for review. Its case studies distinguish an IBM secret-access issue that received a patch from Datadog permissions documented as an architectural tradeoff. The attack prerequisite is compromise or misuse of an already privileged operator; this is not evidence that an LLM independently breached a cluster.
Spain’s AEPD says it received its first notification of a personal-data breach reportedly executed using an AI agent. The affected organization described access to invoices and modified data; the agency says the notification still requires analysis.
Adversa tested eight open-source AI skill scanners with paired unobfuscated and obfuscated malicious skills, finding that every scanner passed an attack through either a true bypass, a blind spot, or an injectable model judge. The study covers encoding, Unicode, command reconstruction, truncation, allowlists, bundled files, paraphrase, and remote stages; its 4,000-skill benign set also found no scanner beat an always-block baseline on F1.
Google DeepMind and partners announce a $10M funding call for multi-agent safety research.
Gemma 4: Our most intelligent open models to date, purpose-built for advanced reasoning and agentic workflows.
Gemini 3 Flash offers frontier intelligence built for speed at a fraction of the cost.
Play video
This AI Explained video reviews a major AI development through the lens of agentic workflows and tool-use risk. It is useful context for AI engineering, evaluation, governance, and operational risk.
Play video
This AI Explained video reviews a major AI development through the lens of agentic workflows and tool-use risk. It is useful context for AI engineering, evaluation, governance, and operational risk.
Play video
This AI Explained video reviews a major AI development through the lens of agentic workflows and tool-use risk. It is useful context for AI engineering, evaluation, governance, and operational risk.
Play video
This AI Explained video reviews a major AI development through the lens of agentic workflows and tool-use risk. It is useful context for AI engineering, evaluation, governance, and operational risk.
Play video
This AI Explained video reviews a major AI development through the lens of agentic workflows and tool-use risk. It is useful context for AI engineering, evaluation, governance, and operational risk.
Play video
This AI Explained video reviews a major AI development through the lens of agentic workflows and tool-use risk. It is useful context for AI engineering, evaluation, governance, and operational risk.
Play video
This AI Explained video reviews a major AI development through the lens of agentic workflows and tool-use risk. It is useful context for AI engineering, evaluation, governance, and operational risk.
Play video
This AI Explained video reviews a major AI development through the lens of agentic workflows and tool-use risk. It is useful context for AI engineering, evaluation, governance, and operational risk.
Play video
Jeff Smith describes exposing established parameterized reports through discovery and execution tools, with arbitrary SQL disabled where appropriate. This narrows query-generation errors but still leaves report-selection mistakes. He also separates read-only access from permission to read particular records and places enforcement in the database. Performance-tuning advice uses a separate environment rather than unrestricted production changes.
Check Point’s Yoba analysis traces fake AI desktop downloads on GitHub to DLL sideloading beside legitimate signed executables. A second loader persists through a scheduled task and retrieves instructions through Telegram and DNS over HTTPS. The observed payload is a miner, but the loader can deliver other malware. A valid executable signature does not authenticate the whole download.