Loading story…
xAI released Grok 4.7, a larger coding and professional-task model trained through extended reinforcement-learning runs on difficult, multi-hour workflows. The company says the approach improves self-verification, long-context management, and operation within its Grok Bot agent harness, aiming to reduce error accumulation during unattended tasks. Grok 4.7 scored 38.0% on Terminal-Bench 4.0, 46.3% on CursorBench 4.0, and 1,657 on AA Briefcase v1.1—improvements over Grok 4.6, though below Claude Fable 5.1's 57.9% Terminal-Bench result.
The release also adds stronger safety filtering for potentially dangerous cybersecurity requests. xAI reported a 3.3% acceptance rate for risky dual-use prompts on HackerBench v0.3 and is offering defensive red-team capabilities to selected invited partners. xAI has not disclosed technical evidence explaining the source or scope of the reported performance improvements, and long-running coding agents remain unreliable despite the gains.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
xAI released Grok 4.7, a model trained with reinforcement learning on difficult multi-hour tasks and intended to improve self-verification and long-context handling. The release included availability through Cursor, Grok Build, the Grok API and other platforms, as well as new safety measures including stronger refusal behavior for dangerous cybersecurity requests and limited defensive red-team access for invited partners.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Pentagon added xAI’s **Grok** to a Defense Department review process late, according to reporting on the government’s evaluation of artificial intelligence tools for defense use. The move placed Elon Musk’s company into a sensitive federal procurement and assessment track alongside other AI providers as the department examined how large language models could support military and national security functions. Publicly available supporting material also points to related technical tracking activity, including a Chromium issue entry identified as `474817168`, though no public synopsis was provided in the referenced record. Together, the references indicate that Grok became part of a broader U.S. defense AI evaluation effort, highlighting both the policy significance of vendor selection and the technical scrutiny surrounding tools considered for government deployment.
Jul 12, 2026
OpenAI announced *Codex Security* (formerly **Aardvark**), an application security agent designed to autonomously **discover, validate, and remediate** vulnerabilities in enterprise and open-source codebases. The product builds a project-specific threat model (mapping trust boundaries and exposure points), then prioritizes issues by likely real-world impact and attempts to **confirm findings by running proof-of-concept exploits in sandboxed environments** before generating contextual patches intended to minimize regressions. OpenAI reported beta metrics including an **84% reduction in alert noise**, a **90% decrease in over-reported severity**, and a **>50% drop in false positives**, and said the system scanned **1.2 million commits** from external repositories over a 30-day period; the tool is rolling out as a research preview via the Codex web interface to ChatGPT Pro, Enterprise, Business, and Edu customers. Separately, OpenAI released the **GPT-5.4** model across ChatGPT, Codex, and the API (`gpt-5.4` and `gpt-5.4-pro`), positioning it as a flagship model with improved reasoning, coding, and agent workflows, plus native computer-use capabilities. OpenAI stated it reduced hallucinations and errors (claiming user-flagged factual errors were **33% less likely** than GPT-5.2 on a de-identified prompt set) and said it **upgraded safety protections** while keeping the same high cyber-risk classification used for GPT-5.3-Codex, indicating continued emphasis on security controls as model capabilities expand.
Jun 29, 2026
xAI's Grok Build coding CLI was found uploading users' entire tracked Git repositories to an xAI-controlled Google Cloud Storage bucket, including full commit histories, unread files, and sensitive data such as tracked `.env` contents and previously deleted secrets. Researcher **cereblab** said the behavior occurred even when the tool was asked not to open files and only return a simple response, and demonstrated the scope by intercepting an upload bundle that contained a planted canary file and complete repository history rather than only files needed for the coding task. Following public disclosure, xAI reportedly disabled the behavior server-side by setting flags including `disable_codebase_upload: true` and `trace_upload_enabled: false`, while Elon Musk said previously uploaded user data would be deleted. xAI said enterprise zero-data-retention users were not affected and that consumers could use `/privacy` to disable retention and delete synced data, but the researcher argued the real fix was the silent global flag change and noted upload code remained present in later client builds behind server-side controls, leaving unanswered questions about default data collection, retention, and the number of affected users.
Jul 20, 2026