Loading story…
OpenAI and AI chipmaker Cerebras announced a three-year strategic alliance under which OpenAI plans to deploy up to 750MW of Cerebras Wafer-Scale Systems to build a large high-speed AI inference platform; reporting cites the deal value as over $10B and claims up to 15x faster large language model response times versus GPU-based alternatives. Separately, China-based Zhipu AI reported it trained an image-generation model using only Huawei Ascend Atlas 800T A2 hardware and the MindSpore framework, positioning the result as evidence that advanced model training can proceed without access to Western GPUs amid US restrictions that have limited Chinese firms’ access to NVIDIA H100/A100-class accelerators.
In parallel, security testing of popular “vibe coding”/AI coding assistants found they can repeatedly generate unsafe code from common prompts, including issues rated critical in severity. A security startup (Tenzai) evaluated tools including Claude Code, OpenAI Codex, Cursor, Replit, and Devin by using predefined prompts to build test applications, concluding that while some tools avoid more rule-based defects, they struggle in context-dependent security boundaries—raising risk that AI-assisted development could introduce exploitable vulnerabilities into production code if not paired with strong review and secure-by-design controls.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
OpenAI and Cerebras announced a three-year partnership under which OpenAI plans to deploy 750MW of Cerebras Wafer-Scale Systems to build a large high-speed AI inference platform. Sources said the deal was worth more than $10 billion, with deployment beginning in 2026 and rolling out in phases through 2028.
Zhipu AI announced via GitHub that it had completed the full training cycle for an image-generation model using only Huawei Ascend hardware and the MindSpore framework, without relying on Western chips. The company described it as the first state-of-the-art multimodal model fully trained on Chinese-made chips.
In December 2025, security startup Tenjii tested five leading vibe coding platforms—Claude Code, OpenAI Codex, Cursor, Replit, and Devin—using predefined prompts to build three applications and assess the security of the generated code. The evaluation found repeated generation of insecure code, including some vulnerabilities rated critical.
Cerebras withdrew its 2024 initial public offering application, though it still intended to pursue a public listing later. This marked a significant corporate development preceding its large OpenAI deal.
The two companies had collaboration discussions dating back to 2017, reflecting an early relationship that later developed into a major infrastructure partnership. The report also notes that OpenAI CEO Sam Altman was a personal investor in Cerebras.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecio.com
Open sourcecio.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple studies and industry reports found that **AI-generated or "vibe-coded" software is frequently shipped with serious security flaws**, including XSS, SQL injection, hardcoded secrets, unsafe `eval` usage, weak authentication logic, wildcard CORS, exposed `.env` data, and insecure dependencies. One analysis of 5,600 publicly accessible AI-built applications reported more than 2,000 high-risk vulnerabilities and over 400 exposed secrets, while a separate review of 549 self-described AI-generated repositories found widespread committed secrets, injection issues, hardcoded passwords, and other common sanitization failures. Veracode and other researchers similarly warned that code produced by large language models often maps to **OWASP Top 10** weakness classes and that repeated AI-assisted edits, poor prompts, and excessive agent permissions can further increase risk. At the same time, researchers and vendors highlighted both the promise and fragility of AI-assisted security tooling. Trail of Bits reported that OpenAI Codex goal-based prompting helped uncover previously unknown bugs in projects including **Rust**, **curl**, **zlib**, and **Keycloak**, but stressed that human experts were still needed to scope goals, validate findings, and handle disclosure. New academic work also showed that **LLM-based vulnerability detectors can be easily misled**: the ALIBI framework used adversarial code comments to evade four detectors with success rates above 90%. In response to growing concern over agent reliability, Amazon backed the Lean language project to strengthen formal verification for AI agents, while security experts argued that theorem proving can improve assurance for high-risk components but should be applied selectively as part of broader defense-in-depth.
Aug 4, 2026
Pwn2Own Berlin 2026 showed that generative AI has become both an attack target and an offensive aid, as contestants used LLMs and coding agents to accelerate code review, translation, and exploit development while probing AI products including **Claude Code**, **OpenAI Codex**, **Cursor**, **Ollama**, **ChromaDB**, **LM Studio**, **Megatron Bridge**, and **Nvidia Container Toolkit**. Researchers reported that AI assistance improved speed but still generated many false positives during bug discovery, reinforcing that human validation remains necessary in vulnerability research. The competition highlighted recurring weaknesses across AI ecosystems, particularly overprivileged developer tools, unsafe trust relationships between agents and users, and exposed infrastructure that can turn an application flaw into **host-level compromise**. Internet-facing deployments such as **Ollama** and **ChromaDB** drew attention as examples of expanding attack surface, while supply chain risk and AI-assisted "vibe coding" were cited as factors likely to introduce additional security flaws into rapidly deployed AI environments.
Jun 29, 2026
Enterprises are accelerating adoption of AI coding assistants and agents, with vendors and engineering leaders reorganizing around tools such as GitHub Copilot, Codex, Claude Code, and formal-verification agents to increase software output and support smaller teams. OpenAI has reportedly shifted strategy toward coding and enterprise customers, while companies such as Cursor are deploying always-on security agents that scan pull requests, patch dependencies, and block risky changes before release. Research and industry reporting also show AI is changing how developers work: Copilot users spend more time coding and less time on collaboration and project-management tasks, and engineering teams increasingly treat AI as a force multiplier rather than a replacement for human developers. At the same time, multiple studies and incident reports say the gains are being offset by a growing **review and supervision tax**. Reports from Harness, DORA, Sonar, and other researchers found that heavier AI use often correlates with more code review effort, higher defect and deployment risk, longer remediation and recovery times, and rising burnout among senior engineers who must validate AI-generated changes. Security researchers at RSAC 2026 said AI assistants reproduce common flaws such as `SSRF`, `XSS`, path traversal, command injection, and open redirects at scale, while reporting tied AI-assisted changes to outages and operational failures, including an AWS disruption. Across the coverage, experts urged organizations to keep humans in the loop, apply stricter governance and testing for AI-generated code, and measure validation workload, defect escape, and technical debt rather than code volume alone.
Jul 1, 2026