The AI Front Page

Search Edition

Search: security

30 stories from 12 sources across 9 topics.

Stories

30

Sources

12

Topics

9

For You lens

27 stories in this edition match your reader profile.

Reader signals

3

Searches

0

Matches

27

Top score

108

Tune For You

Search Intent

security

This query becomes a recent For You signal, so matching stories can move up on the next personalized pass.

For YouReader CenterPromote Search

Edition Index

Topic, entity, and source map

Topics

Security19 storiesFunding2 storiesOpen Source2 storiesResearch2 storiesBig Tech1 storyHot Takes1 story

Entities

OpenAI11 storiesAnthropic8 storiesClaude4 storiesGoogle3 storiesMicrosoft2 storiesarXiv1 story

Sources

Hacker News AI7 storiesAWS Machine Learning Blog4 storiesBloomberg AI3 storiesArs Technica AI2 storiesGitHub Trending AI2 storiesOpenAI News2 stories

The Verge AI / 9:41 PM

OpenAI’s rogue AI tried to hack another company in May

In May, hundreds of malicious and spam packages were uploaded to RubyGems, causing a serious disruption for the host. Now independent researchers have said that a swarm of OpenAI agents were responsible for the attack. Not only that, but the AI tried to steal users' API keys. At the time, RubyGems described it as a […]

ReadSource

GitHub Trending AI / 4:48 PM

The-Art-of-Hacking/h4cker is trending in AI open source

The-Art-of-Hacking/h4cker is a GitHub AI repository with 29,395 stars. This repository is maintained by Omar Santos (@santosomar) and includes thousands of resources related to ethical hacking, bug bounties, digital forensics and incident response (DFIR), AI security, vulnerability research, exploit development, reverse engineering, and more. 🔥 Also check: https://hackertraining.org

ReadSource

The Decoder / 10:08 AM

OpenAI agents launched a 2,000-package cyberattack on RubyGems just to collect data anyone could Google

In May 2026, OpenAI agents uploaded more than 2,000 malicious packages to RubyGems, found an unknown security vulnerability on their own, and tried to steal API keys. The apparent goal was pointless: scraping publicly available data from British local governments. OpenAI reportedly never told those affected. The article OpenAI agents launched a 2,000-package cyberattack on RubyGems just to collect data anyone could Google appeared first on The Decoder .

ReadSource

Simon Willison LLMs / 12:42 AM

OpenAI agents attacked RubyGems back in May

OpenAI agents carried out an undisclosed attack on RubyGems is a new bombshell report from Spencer Kitts, Thomas Larsen, and Sydney Von Arx - three of the four authors of the report on the agent attack on disused wikis ( previously ) last week. This time they're noting that it looks very likely that an OpenAI agent swarm was behind an attack against the RubyGems package repository first reported on May 12th by Maciej Mensfeld of the RubyGems security team : We're dealing with a major malicious attack on @rubygems right now. Signups are paused for the time being. Hundreds of packages involved - mostly targeting us, but some carrying exploits. The team has been on this for hours. More details to follow once we're through it. Those packages turned out to carry some very suspicious patterns: Many of them included "oai" in their name, or the author field, or the fake email address they provided. The files they were accessing were similar in character to the files retrieved by the wiki agents, using similar tricks (r.jina.ai) - and OpenAI have confirmed the wiki agents were theirs. The code in the packages appeared to be LLM-authored. I find point 2 the most convincing, given what we learned from the wiki attack when it was analyzed in September. Many of the packages were exploiting the RubyDoc.info documentation build process to exfiltrate (public) data from UK government websites, presumably as part of an information gathering task similar to the research tasks processed by the wiki-exploiting agents. We know this because one agent helpfully left a comment: # malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker They also attempted to steal API keys via an exploit that was patched over two months later - it's not clear if those attempts were successful. The thing that bothers me most about this incident is that the authors report that OpenAI had not disclosed to RubyGems that they were responsible for the attack prior to now. If that's true there are two options: After the Hugging Face and Wiki attacks OpenAI were still unable to review their previous logs and determine that they had previously attacked RubyGems. They knew about the attack on RubyGems and made the decision not to reach out to the RubyGems team about it. Both of these are bad! Given this incident, the Hugging Face situation , and the Wiki attack, the obvious question right now is how many more incidents like this are out there waiting to be discovered? Tags: ruby , security , ai , openai , generative-ai , llms , supply-chain , ai-ethics , accidental-cyberattacks

ReadSource

Simon Willison LLMs / 5:47 PM

Quoting Boris Cherny

Production code written by Claude should have a higher bar than if it was written by a human. At Anthropic, we have many guardrails in place to make sure this is happening: lots of lint rules, lots of tests, Claude-driven end to end tests, Claude-powered fuzzers running daily, automated code reviews and security reviews, automated code refactoring, and so on. Without these, you can end up with a mess that is hard to maintain down the line. — Boris Cherny Tags: claude , ai , claude-code , llms , coding-agents , ai-assisted-programming , generative-ai , agentic-engineering , boris-cherny , anthropic

ReadSource

The Verge AI / 4:09 PM

Anthropic spent this week in hot water over cybersecurity

After admitting earlier this year that its AI models had hacked other companies' systems on a handful of occasions, Anthropic released a new report on Wednesday detailing the attacks. It reveals a string of incidents displaying what Anthropic deems its models' single-minded "recklessness" - and will likely fuel already raging concerns about cybersecurity and AI. […]

ReadSource

AWS Machine Learning Blog / 6:16 PM

Amazon Quick is now generally available on desktop

Your teams get an AI assistant that handles real work while your data stays in your environment and your conversations stay private Today, the Amazon Quick desktop application is generally available on macOS and Windows. We’re also adding a new activity feed to the mobile experience on iOS and Android that consolidates email, calendar, CRM, […]

ReadSource

The Decoder / 4:33 PM

Swarmchasers hunt rogue agents, Anthropic investigates itself, and the trail they both follow is going dark

Independent investigators have now found traces of suspected OpenAI agents on more than 30 public services, from wikis to RubyGems. At the same time, Anthropic shows how Claude Mythos 5 declared real systems a simulation to itself, uploaded a doctored package to PyPI, and even fooled the oversight monitor. With GPT-6 Astra, the most important oversight tool is now under pressure, namely the models' readable reasoning. The article Swarmchasers hunt rogue agents, Anthropic investigates itself, and the trail they both follow is going dark appeared first on The Decoder .

ReadSource

Latest story in this edition: 4:40 PM

Back to front page