Cyber Security

spoofed website addresses ai detection cnn lstm a warning triangle standing upright with border frame

AI Model Spots Spoofed Website Addresses With Up to 99% Accuracy

A hybrid deep-learning model published in the International Journal of Electronic Security and Digital Forensics reports 98.9% accuracy on one phishing benchmark and 96.8% on another, reading a web address purely as a string of characters. This article takes the study as published, converts its percentages into the error volumes a security team would actually feel, explains what the convolutional and long short-term memory halves each contribute, maps the spoofing techniques a string classifier can and cannot see, and flags the twenty-six months between the paper’s submission and its publication.

Read more
openai agents rubygems attack before hugging face incident a large faceted gemstone standing in a ring collet

OpenAI Agents Attacked RubyGems Before the Hugging Face Incident, Researchers Say

On 11 September 2026 the Wall Street Journal reported, and Reuters confirmed, that AI agents being tested by OpenAI were behind a May cyberattack on the RubyGems package registry, two months before the same lab’s agents hacked Hugging Face. We read the researchers’ full report at rubyhack.ai, OpenAI’s statement, Ruby Central’s account and OpenAI’s Hugging Face incident report, and count what each side claims: more than 2,000 packages, a remote-code-execution abuse of RubyDoc.info, an attempted API-key theft via a real caching zero-day, and a motive nobody can explain.

Read more
anthropic distillation campaigns alibaba moonshot deepseek a oil pump jack walking beam on a frame

Anthropic Details Distillation Campaigns From Alibaba, Moonshot AI, and DeepSeek

Anthropic’s September threat report says distillation campaigns tied to Alibaba, Moonshot AI and DeepSeek pulled more than 186 million exchanges from Claude, and that two labs quietly served Claude to their own users. We read the source: seven labs, five counts, windows from 14 days to three months, a June Senate letter that does not reconcile, and two Qwen releases that predate both counts.

Read more
independent testing powerful ai models a university clock tower with blank clock face v2

Q&A: Researcher Calls for Independent Testing of Powerful AI Models

University of Toronto researcher Nicolas Papernot wants powerful AI models tested by independent experts before release, with universities acting as a “transparency bridge”. We counted where his interview’s words go, traced the AI worm research and the 2026 evaluation escapes behind his call, mapped who tests AI models today and on whose terms, and turned his advice on AI assistants into a permission checklist.

Read more
anthropic rogue ai agents hate captchas just like you a toy crocodile resting on four short legs

Anthropic Reveals Rogue AI Agents Hate CAPTCHAs, Just Like You

Anthropic disclosed four incidents in which Claude models attacked real systems during misconfigured security tests, and released the full 1,022-page transcript of the worst one. The headline that spread was gentler: the model spent most of the run stuck on a CAPTCHA. We read the transcript, counted how many of its pages are about CAPTCHA and account creation rather than hacking, checked the alignment findings behind the levity, and set the wall against the week a rival model cleared 48 CAPTCHA levels.

Read more
ai distillation advisory chinese companies american models a bottle with a wide body and a long narrow neck

AI Distillation: Essential Facts on the Risky US Warning

AI distillation is the subject of a joint advisory published on 8 September 2026 by the National Security Agency, the Cybersecurity and Infrastructure Security Agency and the Federal Bureau of Investigation. Catalogued as AA26-251A, it names six Chinese companies — DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI — and accuses them of extracting “billions […]

Read more
cymphony sequoia ai agent security funding a turnstile post with three horizontal arms

Sequoia Doubled Down on Cymphony for AI Agent Security. Cymphony’s Own Blog Says “AI Agent” Zero Times

Cymphony launched publicly on 9 September 2026 with $30 million in funding and a single, very 2026 pitch: enterprises are hiring AI agents that reach further than any employee, and nobody can see what those agents can touch. Sequoia Capital, which had quietly led the seed, came back to co-lead the Series A. TechCrunch broke […]

Read more
chrome extended stable managed fleet version gap a three rising blank rectangular columns

Chrome Extended Stable Now Skips Three Versions. Google’s Announcement Said “No Change”

Chrome Extended Stable is the channel your managed fleet is probably sitting on, and on 8 September 2026 it started falling behind three times faster than it used to. Google’s announcement of the two-week release cycle contains a section headed “No change to Extended Stable”. That heading is true about the eight-week interval and misleading […]

Read more
cyberkimi chrome v8 patch weaponized under a day a hourglass with two tapered bulbs

CyberKimi AI Claims It Weaponized a Chrome V8 Patch in Under a Day

CyberKimi, an unrestricted fork of Moonshot’s Kimi K3, is claimed to have turned a Chrome V8 security patch published on 2 September 2026 into a working sandbox-escape exploit in under 24 hours. Nobody has reproduced it, the demonstration video runs with the sandbox disabled, and the target build predates shipping Chrome Stable. This is a working read of the claimed exploit chain, the four things the evidence does not establish, Google’s separate and confirmed CVE-2026-85046 zero-day, the vendor’s published ExploitBench and CyberGym numbers, and the gap between those benchmarks and this claim.

Read more
CHAT