There's only so much code: the rise in vulnerability numbers

Frontier AI models like Mythos are rapidly mining decades of technical debt across ubiquitous legacy libraries, driving monthly Microsoft Patch Tuesday vulnerability advisories up more than tenfold reaching 1,415 this month. This volume is overwhelming open-source maintainers and putting pressure...

Covert Assistance: Helpful LLM Agents Evade Oversight in Multi-Agent Systems

As multi-agent systems enter high-stakes domains, the possibility that agents may circumvent safety boundaries is a growing concern. Prior work has examined this risk primarily in adversarial settings, where agents are instructed or rewarded to communicate covertly and evade oversight. We show th...

Embedded Assessments for Frontier AI

Third-party evaluations for frontier AI have mostly tested models through external interfaces before deployment. But the risks from frontier AI models depend on how their developers use and govern them internally. Recently, CEOs of frontier AI companies have committed to hosting embedded...

U.S. Agencies Accuse China AI Firms of Distilling Claude, GPT, Gemini, and Grok

U.S. cybersecurity and intelligence agencies have accused China-based artificial intelligence AI companies of conducting "systematic extraction" of proprietary functionalities and capabilities of American frontier models through distillation attacks. The activity has been described as occurring a...

Booz Allen Cyber Weapon Index

The new Booz Allen Cyber Weapon Index CWI confirms that autonomous offensive cyber has arrived. A leading frontier AI model can now independently execute the full cyber kill chain against a real network—crossing a critical threshold from AI-assisted hacking to autonomous cyber operations. This is...

Reveree: Diagnosing LLM Reverse-Engineering Agents

Reverse engineering RE is critical to security tasks such as malware analysis and vulnerability discovery, and large language model LLM agents are increasingly able to perform it autonomously. Capture-the-flag CTF RE challenges have become the standard proxy for measuring this capability, but...

AI Doesn’t Mean the End of Mathematics—at Least Not Yet

This essay was written with Kasra Rafi, and originally appeared in The Guardian. Earlier this month, about 40 top mathematicians gathered at OpenAI's offices to discuss the future of their profession. The meeting was off-the-record, but if recent articles by mathematicians are any guide, it was...

Frontier AI: Vulnerability Management's Systemic Revolution

Vulnerability management has been a staple of security programs since the dawn of the cybersecurity discipline. The symbiotic relationship between vulnerability and patch management teams has also existed for that time and has gone through waves of contention and thankfulness. While this...

Sovereign by Necessity? Frontier AI Export Controls, Cyber Security, and the Limits of National AI Capability

A small number of firms based in two states produce the most capable frontier AI models. The governments of those states have shown both the legal power and the political will to decide which other countries may use these systems. In June 2026 the United States required a leading developer to...

When Agents Learn to Be You: Benchmarking Privacy Leakage, Impersonation Risk, and Defenses in Persona Skills

Persona skills distill personal interaction histories into portable and executable artifacts for downstream agents. While enabling flexible personalization, this process concentrates fragmented personal signals, amplifies their impact through reuse, and challenges defenses designed for individual...

Cybersecurity Detection Classification with Reasoning-Enabled Language Models

A major issue in Security Operations Centers SOCs is alert fatigue, as the number of detections reported is more than staff can triage in a given day. Prior work prompts or fine-tunes large language models LLMs to emit a triage label directly, but does not train them to reason about whether a...

Why the Open Secure AI Alliance Matters: Open Frontier Models, Open Deployment Flexibility

TrendAI joins Nvidia as an inaugural partner in the Open Secure AI Alliance, advancing open models, harnesses, and research to strengthen cyber defense...

Measuring LLMs’ Ability to Perform Cryptanalysis

There's new benchmark measuring AI's ability to perform mathematical cryptanalysis. Anthropic's frontier model actually found new attacks. The benchmark: "CryptanalysisBench: Can LLMs do Cryptanalysis?" The idea is to benchmark the ability of LLMs to discover new mathematical cryptanalytic attack...

Aembit Joins Snowflake to Tackle AI’s Next Security Frontier: Trusted Agent Interoperability

Silver Spring, MD, USA, 28th July 2026, CyberNewswire...

Begun, the Patch Wars have

Welcome to this week's edition of the Threat Source newsletter. We all knew, to some degree or another, that this summer was going to a hot mess. I don't mean FIFA drama or record setting heat waves. I mean the slow but steady momentum that AI frontier models were accruing for vulnerability...

Beyond Success Rate: Cost-Aware Evaluation of Offensive and Defensive Security Agents

Security-agent evaluations commonly measure peak offensive capability under generous inference budgets, emphasizing vulnerability discovery, exploit development, penetration testing, and CTF completion. Such measurements are useful but incomplete: in operational security, every reasoning step, to...

Evaluating Frontier AI Agents As Autonomous Clinical Security Auditors

Clinical AI models can expose patients to harm when adversarial vulnerabilities go undetected, yet formal security auditing requires statistical expertise, specialized tools, and significant time. We present an open evaluation task, built on METR Task Standard v0.3.0, that tests whether frontier ...

Securing the AI Frontier: A Blueprint for Partners

...

RustMizan: A Compilable, Contamination-Aware Benchmarking Framework for Rust Vulnerabilities

LLM agents are increasingly applied to vulnerability analysis, but existing benchmarks have not kept pace. They typically rely on small non-compilable snippets, focus on binary classification vulnerable or not, and do not account for the risk that publicly-released datasets are part of model...

Forensic Trajectory Signatures for Agent Memory Poisoning Detection

We discover a behavioral invariant in LLM agents under persistent memory poisoning: in architectures where routing information is retrieved through observable memory-tool invocations, successful attacks require calling memoryrecallfact before emailsendemail, a transition that non-exfiltrating...