Loading story…
Recent research and evaluations indicate AI agents are becoming capable of finding and exploiting vulnerabilities with high success rates using standard offensive tooling, lowering the barrier to semi-autonomous attacks. A study by Irregular in collaboration with Wiz reported that leading models (Anthropic Claude Sonnet 4.5, OpenAI GPT-5, and Google Gemini 2.5 Pro) solved 9 of 10 web security CTF challenges modeled on real-world incident patterns, including authentication bypass, exposed secrets, stored XSS, and SSRF (including AWS Instance Metadata Service (IMDS)-style SSRF). Researchers noted that even when success required multiple stochastic runs, the low per-run cost (~$2) and limited repeats could make exploitation practical without necessarily triggering monitoring, with most challenge successes costing under $1 and multi-run cases totaling roughly $1–$10.
Separate evaluation results highlighted by Bruce Schneier, citing an Anthropic post, describe Claude Sonnet 4.5 successfully executing multistage attacks across simulated networks using only standard open-source tools rather than custom cyber toolkits, including exfiltrating all simulated PII in a high-fidelity Equifax-breach simulation by recognizing and exploiting a known publicized CVE. In parallel, Dark Reading reported security concerns around the rapid adoption of an open-source autonomous assistant, OpenClaw (formerly MoltBot/ClawdBot), which can connect to email, files, messaging, and system tools, execute terminal commands and scripts, and maintain memory across sessions—creating persistent non-human identities and access paths that may fall outside traditional IAM and secrets controls, increasing enterprise risk as “bring-your-own-AI” agents gain privileged access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
12 events from the most recent confirmed update back to the earliest known activity.
A researcher described a self-orchestrating multi-agent LLM system that autonomously found more than 20 CVEs, including Linux ksmbd flaws CVE-2026-31432 and CVE-2026-31433 and CUPS bugs CVE-2026-34980 and CVE-2026-34990. The project used specialized agents for target seeding, hypothesis generation, PoC testing in isolated VMs, report writing, grading, and coordination, and concluded that smaller models can compete with frontier models when given enough inference-time compute and orchestration.
Microsoft researchers described using large language models to generate realistic synthetic command lines, process trees, and attack sequences that mimic human-operated intrusions. The work is aimed at helping defenders test detections, train analysts, and validate logging and triage workflows in controlled environments with governance guardrails.
The UK AI Security Institute said its time-window benchmark showed frontier models such as Claude Sonnet 4.5 can complete cybersecurity tasks comparable to about 16 minutes of expert human work with 80 percent reliability under a 2.5 million token budget. AISI revised its estimated doubling period for this level of cyber-task performance from 8 months to 4.7 months and reported newer models including Anthropic Mythos Preview exceeded that trend, including partial success on simulated corporate network and industrial control system attack chains.
Hacktron CTO Mohan Pedhapati said Anthropic’s Claude Opus 4.6 helped produce a functional Chrome/V8 exploit chain against Discord’s bundled Chromium for about $2,283 in API costs after roughly a week of iteration and human supervision. The report highlighted how AI-assisted patch analysis can accelerate weaponization of known flaws in Electron apps such as Discord, Slack, and Teams when embedded Chromium versions lag upstream fixes.
Anthropic reported in testing published on 2026-04-07 that its Claude Mythos Preview model could autonomously discover zero-day vulnerabilities and develop working exploits across major operating systems and browsers, outperforming earlier models on exploit-development benchmarks. The company said the model identified thousands of high- and critical-severity flaws, including a FreeBSD NFS server RCE tracked as CVE-2026-4747, and could also rapidly weaponize N-day Linux kernel vulnerabilities.
A March 2026 arXiv paper evaluated frontier AI models on a 32-step corporate network scenario and a 7-step industrial control system scenario, finding capability improved with more inference-time compute and newer model generations. The best run completed 22 of 32 corporate-network steps, while ICS performance remained limited but recent models were the first to reliably complete some steps.
The same study found performance dropped when agents had to search a full attack surface without a defined entry point, increasing cost and reducing investigative depth. In a real-world AWS Bedrock anomaly case, an AI agent failed to identify the root cause, while a human quickly traced it to an exposed RabbitMQ management interface with default credentials.
A study by Irregular in collaboration with Wiz tested Anthropic Claude Sonnet 4.5, OpenAI GPT-5, and Google Gemini 2.5 Pro on 10 web security CTF challenges derived from real-world incidents. The researchers found the leading models solved nine of 10 challenges when given directed, per-site objectives using standard security tools.
Security researchers and vendors reported early signs of malicious interest in OpenClaw, including scanning for the agent’s default port and attempts to bypass authentication. They also warned of supply-chain risk tied to the project’s large contributor base and rapid development pace.
The open-source AI agent OpenClaw, previously called ClawdBot and MoltBot, rapidly became the fastest-growing project on GitHub. Its direct connections to email, files, messaging platforms, and system tools with autonomous capabilities prompted security concerns about enterprise deployment.
In the same reported testing, Anthropic said Claude Sonnet 4.5 exfiltrated all simulated personal data in a high-fidelity Equifax-breach scenario using only a Bash shell on a Kali Linux host. The company attributed this to the model recognizing a public CVE and generating exploit code without needing iterative refinement.
An Anthropic blog post said current Claude models had improved cyber capabilities, including carrying out multistage attacks across networks with dozens of hosts using standard open-source tools. It reported that Claude Sonnet 4.5 succeeded in some tests without the custom cyber toolkit required by earlier model generations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcetheregister.com
Open sourcescworld.com
Open sourcebugflation.com
Open sourcearxiv.org
Open sourcescworld.com
Open sourceschneier.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security leaders are warning that **AI agents are increasingly operating as “digital employees”** inside enterprise workflows—triaging alerts, coordinating investigations, and moving work across security tools—often with **broad permissions and limited governance**. The core risk highlighted is that organizations are deploying high-authority agents like plug-ins (reused service accounts, overbroad roles, weak oversight), creating fast-acting operators that can be manipulated and that lack the contextual judgment and policy awareness expected of human staff. Related commentary also raises concerns about **AI-to-AI communication** and “non-human-readable” behaviors that could reduce auditability and complicate investigations and control enforcement. In parallel, public examples show how quickly AI can accelerate **vulnerability discovery**: Microsoft Azure CTO Mark Russinovich reported using *Claude Opus 4.6* to decompile decades-old Apple II 6502 machine code and identify multiple issues, underscoring that similar techniques could be applied to **embedded/legacy firmware at scale**. Anthropic has also cautioned that advanced models can find high-severity flaws even in heavily tested codebases, reinforcing the likelihood that both defenders and attackers will leverage AI for faster bug-finding. Separate enterprise IT coverage notes that organizations are **reallocating budgets toward AI** by consolidating tools and renegotiating contracts, which can indirectly increase security exposure if cost-cutting reduces overlapping controls or if AI adoption outpaces governance and identity/access management maturity.
Jun 29, 2026
Security researchers and regulators reported that frontier AI is accelerating software vulnerability discovery and compressing defenders’ response windows, prompting new warnings for critical sectors. Canada’s **Office of the Superintendent of Financial Institutions (OSFI)** privately told banks and insurers that advanced models, including Anthropic’s **Claude Mythos**, could reduce the time available to detect, assess, and contain flaws before exploitation. A separate European threat note from **Cigref** described exploitation timelines collapsing to seconds, broader abuse of legitimate sessions and public-facing applications, and growing concern over autonomous offensive AI activity affecting large enterprises and financial institutions. At the same time, multiple security studies said AI is improving coverage of known bug classes but still depends on human expertise to validate impact, chain weaknesses, and uncover novel attack paths. **Bishop Fox** showed AI-assisted testing helped identify issues including header-based verification bypasses and **SSRF**, but human analysts were needed to prove exploitability and business risk. **NCC Group** similarly pointed to James Kettle’s request-smuggling research, including findings tied to **`CVE-2025-32094`** and **`CVE-2025-49005`**, as evidence that high-impact discoveries still come from deep human-led research. Vendors are also addressing AI-platform risk directly: Google said it fully mitigated the **Dialogflow CX** “**Rogue Agent**” flaw, which could have enabled persistent malicious code injection and exposure of sensitive chatbot conversations across shared project environments.
Jul 30, 2026
Resecurity warned that autonomous AI offensive security agents are turning penetration testing from scripted automation into adaptive, multi-agent operations that can perform reconnaissance, map attack surfaces, identify vulnerabilities, validate exploits, and generate reports with minimal human input. The report highlighted tools including **T3MP3ST**, **Strix**, **CyberStrike**, **XBOW**, **PentAGI**, **PentestGPT**, **Nebula**, **PentesterFlow**, **Hackian**, and specialized offensive-security LLMs such as `CyberStrike-OffSec-35B`, describing them as increasingly capable dual-use systems. Security researchers said the same capabilities are lowering the barrier for financially motivated criminals and state-backed actors, making AI-assisted offensive operations practical rather than theoretical. The reporting cited examples including **FortiBleed**, **JadePuffer**, **GTG-2002**, **GTG-5004**, and the Claude Desktop “double agent” demonstration, and urged organizations to respond with a hybrid defense model built on human oversight, behavioral detection, network segmentation, continuous exposure validation, governance of AI tooling, and rapid patching of high-value flaws.
Jul 31, 2026