Loading story…
Security researchers and AI vendors reported rapid progress in applying frontier models to offensive and defensive cybersecurity work, including the discovery of CVE-2025-37899, a remote zero-day in the Linux kernel’s SMB implementation. A published account described using an advanced model to help identify the flaw, while OpenAI's Daybreak and Anthropic's Project Glasswing highlighted broader efforts to build AI systems for cyber operations, vulnerability research, and security workflows.
SentinelLABS added evidence that these systems are moving beyond isolated tasks into sustained investigations, describing an eight-stage benchmark based on reverse engineering fast16, a 2005 Windows sabotage toolkit tied to interference with high-precision solvers used in nuclear-weapons modeling. In that evaluation, GPT-5.6 Sol was reported as the only publicly available model tested that completed the full long-horizon malware-analysis workflow, while other models showed useful point-in-time reasoning but failed to maintain consistency as new evidence forced earlier conclusions to be revised.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On July 2, 2026, SentinelLABS published research describing a multi-stage benchmark based on its reverse-engineering investigation of the 2005 fast16 sabotage toolkit and reported that GPT-5.6 Sol was the only publicly available model evaluated to complete the full benchmark.
On April 7, 2026, Anthropic published its Project Glasswing page.
On February 5, 2026, OpenAI published its Daybreak page focused on cybersecurity.
On May 22, 2025, Sean Heelan published details on how he used o3 to find CVE-2025-37899, described as a remote zero-day vulnerability in the Linux kernel's SMB implementation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
sentinelone.com
Open sourceanthropic.com
Open sourceopenai.com
Open sourcesean.heelan.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenAI launched **Daybreak**, a cybersecurity initiative built around `GPT-5.5`, a tiered **Trusted Access for Cyber** framework, and **Codex Security** as its agent harness, positioning it alongside Anthropic’s earlier **Project Glasswing**. Both programs advertise similar defender-focused uses, including vulnerability discovery, exploit validation in authorized environments, patch validation, and detection engineering, while differing mainly in governance and access controls. Major security vendors including **Cisco**, **CrowdStrike**, and **Palo Alto Networks** joined both efforts, signaling that large defenders are pursuing model-agnostic strategies rather than committing to a single AI provider. The launches come as the UK AI Security Institute reported that autonomous AI cyber capability is advancing quickly, with the 80%-reliability cyber task time horizon previously doubling every **4.7 months** and new results from **Claude Mythos Preview** and `GPT-5.5` exceeding that trend. A newer Claude Mythos Preview checkpoint became the first model to complete both AISI cyber ranges, including the previously unsolved **Cooling Tower**, while `GPT-5.5` also posted strong results on **The Last Ones**; AISI said benchmark differences between the leading models are now narrow enough that practical differentiation is shifting toward agent harnesses, access restrictions, auditability, and partner ecosystems. The institute warned that current tests likely understate real-world capability and urged organizations to strengthen security baselines as both the defensive value and the cyber risk of frontier models increase.
Jun 29, 2026
Advanced AI systems are rapidly changing vulnerability research and exploit development, with new reports showing they can move beyond bug discovery into practical weaponization. Hacktron said OpenAI's **GPT-5.6 Sol Ultra** built a full Google Chrome exploit chain from public V8 patch commits, progressing from browser primitives to sandbox escape and native code execution, while researchers and industry observers reported that modern models can now triage crashes, identify root causes, assess exploitability, and propose fixes at scale. Mozilla reportedly used a frontier model to help uncover and patch **271 vulnerabilities** in a single Firefox release, but maintainers have also faced a surge of duplicate AI-assisted submissions that strain existing workflows.
Jul 22, 2026
European and national cyber authorities are warning that AI is rapidly increasing the speed and scale of vulnerability discovery and exploit development, raising the prospect of a sustained remediation crisis. The European Central Bank told about 110 major banks to assess AI-enabled cyber threats and submit action plans by **October 31, 2026**, while the European Systemic Risk Board and European Supervisory Authorities issued parallel warnings on systemic risk from frontier AI models. In France, ANSSI Director General Vincent Strubel told senators that AI-assisted discovery could create a multi-year **"patch wall"**, overwhelming remediation teams even as basic controls such as network segmentation, identity and access management, and timely patching remain the most effective defenses. Industry reporting and vendor disclosures show why regulators are escalating. Mozilla said frontier AI models helped identify **271 vulnerabilities** fixed in Firefox 150 after an earlier run found 22 security-sensitive bugs, while researchers and commentators say LLM-assisted patch diffing can shrink the path from a disclosed `CVE` to a working proof of concept to days or even hours, including for flaws such as `CVE-2025-32433` in Erlang/OTP SSH. At the same time, access controls around advanced cyber-capable models are tightening unevenly: Anthropic expanded its restricted **Project Glasswing** program for Claude Mythos to critical-infrastructure organizations, but open-weight alternatives such as Zhipu AI's **GLM-5.2** are reported to deliver competitive vulnerability-finding performance at lower cost, reinforcing concerns that powerful offensive-relevant capability is spreading faster than most enterprises can patch.
Jul 10, 2026