AI News
GPT-5.6-Cyber: Why Daybreak Red Is Not a Default Upgrade
GPT-5.6-Cyber sharply reduces refusals for advanced authorized security work, but Daybreak Red demands isolation, approval, and tighter controls.
Topic · 11 stories
#Cybersecurity
Reporting, analysis and practical guides connected to Cybersecurity.
Latest in #Cybersecurity
Newest first
Open Source
Bumblebee: Perplexity's Read-Only Dev Endpoint Scanner
Bumblebee is Perplexity's open-source, read-only supply-chain scanner for macOS and Linux developer endpoints, written in Go with zero non-stdlib dependencies under Apache 2.0. It inventories npm, PyPI, Go, RubyGems, Composer and other package managers plus MCP configs, editor extensions, and browser extensions, emitting NDJSON findings against operator-supplied exposure catalogs. Its read-only design never invokes package managers, so it cannot trigger malicious postinstall scripts during a scan.
Open Source
Strix: The Open-Source AI Pentester That Writes Exploits
Strix is an open-source (Apache-2.0) AI penetration-testing tool with ~39,000 GitHub stars. Its autonomous agents dynamically run your app, exploit OWASP Top 10 vulnerabilities, and validate each finding with a working proof-of-concept, cutting the false positives of static scanners. It installs via a single curl command, needs Docker plus an LLM API key, is model-agnostic through LiteLLM, and drops into CI/CD with a non-interactive mode that fails builds on findings.
Open Source
OpenClaw: The 383K-Star AI Agent With a Security Problem
OpenClaw is a free, self-hosted, model-agnostic AI agent that runs as a persistent background daemon and acts across WhatsApp, Telegram, Slack, and Discord. It became the fastest-growing repo in GitHub history (383K+ stars) but carries serious security flaws: authentication off by default, plaintext credential storage, tens of thousands of internet-exposed instances, and fake installers spreading infostealer malware. Run it only from the official repo, behind a VPN, with auth on and scoped credentials.
AI News
Project Perception: Microsoft's Cheaper Rival to Claude Mythos
Microsoft is reportedly developing Project Perception, a multi-model AI security platform that routes vulnerability-scanning tasks across models from Microsoft, OpenAI, and Anthropic to reserve expensive frontier calls for high-value steps. Its pitch is matching Anthropic's Claude Mythos on capability while costing far less. Microsoft has not officially confirmed details, so the news should be treated as a credible report pending benchmarks.
AI News
GPT-5.6 Sol: OpenAI's Best Model, Held Back by Washington
On June 26, 2026, OpenAI previewed the GPT-5.6 series — Sol (flagship), Terra (balanced, 2x cheaper than GPT-5.5), and Luna (fastest, cheapest) — but restricted access to trusted partners at the US government's request due to the models' strong cybersecurity capabilities. OpenAI paired the release with its most robust layered safeguard stack and said it does not want government pre-release review to become the default.
Deep Dives
Agentjacking: Fake Sentry Errors Hijack Your AI Coding Agent
Agentjacking injects fake Sentry errors that AI coding agents read over MCP as trusted guidance, then execute - hitting an 85% success rate across 2,388 exposed orgs.
Tech Tips
MCP Security: A 2026 Hardening Playbook After CVE-2025-6514
A practical 2026 security playbook for Model Context Protocol agents. It explains MCP-specific threats (prompt injection, tool poisoning, rug pulls, confused-deputy), dissects the critical CVE-2025-6514 mcp-remote RCE, and gives concrete hardening steps: patch to 0.1.16, enforce OAuth 2.1 over HTTPS, isolate servers, gate destructive actions, and audit agent activity.
Tech Tips
Prompt Injection: A 2026 Defense Playbook for AI Agents
A defense playbook for prompt injection in AI agents. It explains why the attack is unsolvable at the model layer, frames the threat with Simon Willison's lethal trifecta (private data, untrusted content, external communication), and prescribes layered controls: architectural separation, least-privilege tools, input filtering, egress allowlisting, circuit breakers, and hardened models, which can cut attack success from 73.2% to 8.7%.
AI News
GPT-5.5-Cyber: OpenAI Hands Verified Defenders a Less-Restricted Model
OpenAI's GPT-5.5-Cyber, a less-restricted model, is now available for vetted cyber defenders.
Ethics & AI
Claude Mythos: The AI Anthropic Built Then Refused to Release
Anthropic trained Claude Mythos, its most capable AI, but refused to release it due to security findings.
