Anthropic says its research found ‘signs of life for AI worms,’ that could colonize household devices. Experts say they have a point. theverge.com/ai-artificial-i…

We’re expanding our Cyber Verification Program to give security professionals broader access to our most capable models. Through this program, verified security professionals can access Claude Mythos 5.1, Opus 5.5, and Sonnet 5.5 with safeguards designed for defensive work. We’re also opening up new tiers to allow for authorized offensive work, like penetration testing and red-teaming. anthropic.com/news/cyber-ver…

Opsec level 🤝 "yeah dawg let's see"

We're sharing our new framework for tracking, investigating, and disclosing instances of model misalignment at OpenAI. The framework sets criteria and timelines for public disclosure, including when we haven’t yet fully explained or mitigated the behavior. More complex cases may require longer investigation or coordination with third parties. We’ll prioritize examples that reveal new misalignment mechanisms, meaningful changes in known behavior, or findings that challenge assumptions about safety or mitigation. Alongside the framework, we’re publishing six reports on instances of misaligned behavior we’ve observed during the training or evaluation of our models in the last six months. This is a starting point. We’ll refine the process through experience and public feedback, and share more reports on an ongoing basis. openai.com/index/model-misal…

I am at the point where my bug bounty findings are 100% agentic. I am just pasting in the scope and letting the agent run. It can do full external tests for all kinds of environments. A few people already have access, but if you want to try it, comment/DM. ​How does it work? 👇

I'm gonna rant for a second: I found a Zero-Click RCE in the latest Samsung phones in February. Samsung says it's "Out of Scope" because "AOSP Source." So I go to Google, they say it’s High, not Critical, because "AOSP Baseline." My RCE still sitting in the wild, no patch😬