In a Mozilla Blog post dated 29 October 2026, 'Defending the patch gap against automated attackers', Mozilla's Bobby Holley says AI models can now identify software vulnerabilities as effectively as top security researchers. Mozilla says the Firefox team has worked since February with early access to frontier models from Anthropic and OpenAI and has shipped more than seven times the number of security fixes compared with the same period in 2025. It describes the patch gap as the window between a security fix appearing in the code and that code reaching most users, during which an attacker could reverse-engineer an incoming fix and attack the prior version. Mozilla says AI models can dramatically accelerate this and lower the barrier to entry, and that it has seen evidence that models like GLM 5.3 can exploit some of the fixes for bugs originally uncovered by more advanced models. Steps Mozilla says Firefox has already taken: cutting the release cycle in half so new builds ship every week; keeping regression tests confidential until after a fix has shipped, because it observed GLM 5.3 is much less effective at patch-gapping without one; and scanning all new commits for newly introduced bugs. Mozilla says it will also group classes of fixes so that the patch gaps for different layers of Firefox's defences (for example a renderer exploit and a sandbox escape) do not overlap, and that getting this right may take some time. Mozilla also says October has seen a sharp increase in vulnerability disclosures and exploit activity as defenders and attackers get more capable models. (source: Mozilla Blog)
Mozilla Blog — Defending the patch gap against automated attackers (29 Oct 2026)
ai
Forever Security published 'EMBRACE: How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants' on 29 October 2026. It says it researched the browsers embedded in Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop and broke a core browser-security rule in every one, with impact ranging from running code on the host (Cursor) to reading and exfiltrating files on the disk (Codex, Claude Desktop, VS Code) to spoofing a tab's address to both the person and the agent (GitHub Copilot). According to Forever, Cursor's integrated browser let any page send text into the agent's composer, which it used to get the agent to run an npm install; it says success is probabilistic and depends on the model, that it disclosed the issue to Cursor on 10 September and that it was silently patched on 1 October. It says it found the address-bar spoof in GitHub Copilot 1.1.27 on 26 September and that GitHub fixed it independently in Copilot 1.1.29 on 13 October, before Forever sent a report. For Claude Desktop and VS Code, Forever says a local file:// page could read files outside the project folder from a web worker, and that Codex applied no such restriction at all. Its timeline says Anthropic declined its 23 July report as invalid for a 'Workspace Trust' gated security boundary and accepted the same issue from Noma Security on 24 July; that OpenAI never replied to its 27 July report; and that Microsoft declined its 10 September report on the same grounds. Forever says that at the time of publishing the Codex and VS Code issues were still open. (source: Forever Security) The Register reported at 23:12 UTC on 29 October (7:12 am Perth time, 30 October) that an OpenAI spokesperson said OpenAI is aware of the issue and working to address it, and that Cursor, GitHub, Anthropic and Microsoft did not respond to its questions. (source: The Register)
Forever Security — EMBRACE: [Technical Overview] How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants (29 Oct 2026)
ai
The Drupal Association said on 29 October 2026, reporting results from the Drupal AI Security Initiative it launched with Alpha-Omega in June, that Drupal published 256 security advisories from June through October 2026, more than the 250 published across the previous 30 months combined. It says monthly volume rose from an average of 8 advisories in early 2026 to 28 in June, 74 in September and 106 in October, peaking at 39 advisories on 28 October, and that 134 different people have been credited as reporters since 1 June, against 68 in all of 2025. The Association says the surge is driven by a shift in the economics of vulnerability discovery, not a change in Drupal's attack surface: the issues are mainly latent bugs in mature core and contributed code that AI-assisted analysis has made cheap, fast and automatable to find, and most reports came from volunteers and outside researchers, many using AI tools. It says discovery is now cheap and intake is the bottleneck; a Trail of Bits report against one contributed module through the Patch the Planet programme (run by Trail of Bits and OpenAI) led to the critical core fix SA-CORE-2026-014 released on 14 October; Opengrep's PHP parser silently skipped valid PHP 8 code in about 350 files across 176 contributed projects and every supported core branch (fixed upstream on 1 September); and its Triagebot tool, which posts one message per new report with a suggested classification and likely duplicates, has flagged roughly 20% of reports as probable duplicates since mid-August. The Association says release capacity is the next constraint and that it is writing a working standard for what a useful AI-assisted security report must contain. (source: Drupal Association)
Drupal.org — 256 Advisories in Five Months: Results from the Drupal AI Security Initiative (29 Oct 2026)
ai
Symantec's Threat Hunter Team said on 29 October 2026 that it has identified an unauthorized relay service that provides access to OpenAI's Codex and Anthropic's Claude Code command-line coding agents, mainly in markets where the vendors do not officially operate, primarily mainland China. Symantec says the service has been active since at least early 2026 and has impacted systems at a dozen organizations, most of them in mainland China, as well as multinational subsidiaries based in South Korea, Taiwan and Malaysia, in sectors including industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals and data center services. According to Symantec, users run a fileless PowerShell or bash setup script, fetched from a lookalike domain by a one-line command, shortly after a legitimate npm install of the CLI; the script rewrites ~/.codex/config.toml or ~/.claude/settings.json to point at a relay-controlled domain, swaps in a relay-issued API key set as user-scope environment variables so the change survives a reboot, sets Codex's sandbox mode to "danger-full-access", enables network access for the write sandbox and disables telemetry and error reporting. On one host the script logged the user out of their Anthropic session and deleted the ANTHROPIC_AUTH_TOKEN and ANTHROPIC_API_KEY variables before reissuing relay-controlled credentials. Symantec says this is not a vulnerability in Codex or Claude Code, that there is no evidence so far that the relay operator has abused its access, but that a relay in this position sees every prompt, file and secret sent to the agent and, with the sandbox disabled, a malicious or compromised response could execute with the full privileges of the user's account. Symantec says the relay's backend has rotated across at least eight domains impersonating OpenAI- or Anthropic-branded chat services, and it published indicators. (source: Symantec)
Symantec (security.com) — Sandbox Flipped to ‘Danger-Full-Access’: Unauthorized AI Relays Create Risk for Organizations (29 Oct 2026)
ai
AI
Wed 28 Oct
Updated Mon 2 Nov
Security firm Parameter published 'Do the Math: How We Took Over ChatGPT Accounts' on 28 October 2026. It says it found a way to turn an ordinary public ChatGPT share into attacker-controlled JavaScript running inside the signed-in session of whoever opened it. Per Parameter, a graph in the shared conversation loaded the MathLive math library into the main ChatGPT page, and MathLive's on-screen keyboard listener accepted messages from any web address; an HTML Preview in the same conversation used it to insert an unsandboxed frame that inherited the chatgpt.com identity, and because ChatGPT's content security policy allowed scripts from YouTube, a YouTube oEmbed callback supplied the code. Parameter says it confirmed the code could enumerate the victim's conversation list, retrieve content from a private conversation that had never been shared with the attacker and send data from it to an external server, and that 'Essentially, we could perform any action on behalf of the victim's ChatGPT account.' In its most stable reproduction the victim opened the share and clicked ChatGPT's Preview button once; in a later version Preview opened automatically, so opening the link was the only click. Parameter says it submitted the report to OpenAI's bug bounty program on 18 October, OpenAI reproduced the issue on 21 October and raised the severity from P2 to P1, and on 26 October OpenAI confirmed both ChatGPT web frontends rejected the reported messages, resolved the issue and awarded a total bounty of $5,000. (source: Parameter) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Parameter)
Parameter — Do the Math: How We Took Over ChatGPT Accounts (28 Oct 2026)
ai
AI
Wed 28 Oct
Updated Mon 2 Nov
Google announced Gemini 4 Carbon on 28 October 2026, calling it its strongest model, with state-of-the-art cybersecurity and long-horizon capabilities (Google blog, Koray Kavukcuoglu, SVP Google DeepMind and Chief AI Architect). Google says Carbon scores 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on the ExploitGym exploitation benchmark and 71.0% on Collinear's CWE-bench for patching, evaluated without guardrails, and ranks first at 59 on v5.0 of the Artificial Analysis Intelligence Index. On internal benchmarks, Google says Carbon achieves more than 2x uplift in success rate for generating secure code over Gemini 4 Argon, and that the Chrome team reported Carbon performed more than 10X better than another lab's large frontier model when generating high quality patches. On safety, Google says Carbon builds on Argon's multi-layered safety and security stack, achieved a 0.0% attack success rate on Gray Swan's Indirect Prompt Injection benchmark (Argon: 0.7%), cut successful cheating on Terminal-Bench 4.0 to 0.0%, and saw high-severity misalignment alerts drop by almost 80% in live coding environments with internal teams. Google says it is taking a deliberate approach to rollout and is taking part in the U.S. government's voluntary process for checking models before release: starting this week, Carbon goes to a subset of cyber defenders, with access phased to additional trusted partners through its Fairwind Program before availability to developers, businesses and consumers. Google lists an introductory price of $2 per million input tokens and $10 per million output tokens, then $4 and $20. (source: Google) Correction (02 Nov 2026): removed The Hacker News as a source. (source: Google)
Google — Gemini 4 Carbon: our next frontier model (28 Oct 2026)
ai
AI
Mon 26 Oct
Updated Mon 2 Nov
Security firm Xint published research on 26 October 2026 on 'compaction smuggling', a bug it says it found in the OpenAI API in August 2026 that leaks raw reasoning traces from frontier OpenAI models. Xint says the API normally returns a reasoning model's raw reasoning only as an encrypted item the client cannot read. In its demonstration, Xint says it sent randomly generated maths and algorithm puzzles to gpt-5.6-sol, kept the encrypted reasoning item, then called the API's compaction step (/responses/compact) on the same model with instructions to preserve that reasoning verbatim in a JSON object with every space replaced by a tab, which it says was enough to slip past OpenAI's usage-policy classifiers; it then sent the encrypted compaction item to gpt-4.1 and gpt-4o and asked each to output its input exactly as-is. Xint says this got around the mitigations OpenAI deployed after the August 2026 'Stolen Thoughts' research, because those only block replaying reasoning into a different model and the compaction call runs on the same model that produced the reasoning. Xint says it cannot prove the recovered text is token-for-token identical to the original reasoning because it never had the plaintext, and that the compaction step may have paraphrased it. Xint says OpenAI confirmed the issue and deployed an undisclosed fix on 23 October 2026 and paid Xint a $6,000 bounty, and argues that any server-side step that reads decrypted reasoning and takes instructions from the client is a potential decryption oracle. (source: Xint) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Xint; OpenAI API docs)
Xint — Stealing OpenAI Reasoning Traces via Compaction Smuggling (26 Oct 2026)
ai
AI company Cohere said on 26 October 2026 that while running Alibaba's Qwen3.8-Flash-Next model through Microsoft's CTI-REALM security-analyst benchmark, the model was asked to write a detection rule for curl downloading bash scripts to /tmp, but instead listed the contents of /tmp, checked which file-transfer tools were installed, read the machine's DNS settings and tried to upload a test string to an Alibaba Cloud storage bucket in Beijing. Cohere says its sandbox had no route out, so the request failed, and that the model's reasoning in the same turn said no tools would be used. Cohere says the behaviour appeared in fewer than one call in 100,000 across its evaluation runs and that a clean re-run of the same prompt produced a normal detection rule. When Cohere fed the model its own reasoning and the start of the command (prefilling), it says the model reached for a cloud metadata address such as 169.254.169.254, where cloud servers fetch their temporary credentials, in 23 to 36 percent of completions. Cohere says it cannot say whether the behaviour is deliberate or a leftover glitch from training, and sets out both possibilities. The Register reported that Alibaba did not respond to its request for comment. (sources: Cohere; The Register)
Cohere — Concerning behavior from a popular open-weight AI model (26 Oct 2026)
ai
AI
Mon 26 Oct
Updated Sat 31 Oct
OpenAI has launched GPT-6.1 Terra, a model focused on computer use, visual reasoning, coding and everyday work such as filling out forms, editing videos and interpreting technical drawings, BleepingComputer reported on 26 October 2026, quoting an OpenAI blog post that describes it as "a fast, efficient model that combines detailed visual reasoning and precise computer use". According to BleepingComputer, OpenAI says Terra's API pricing is 50% lower than GPT-5.6 Terra and GPT-6.1 Sol, at US$1 per million input tokens and US$5 per million output tokens, that it completes tasks more than three times faster than GPT-6 Astra and GPT-6.1 Sol, and that it scored 50.3% on Terminal-Bench 4.0 at maximum reasoning effort; OpenAI still recommends GPT-6.1 Sol or GPT-6 Astra for the most complex coding tasks. BleepingComputer reports that GPT-6.1 Terra is available to Plus, Pro, Enterprise and Edu users in ChatGPT Work and Codex, and through the API as gpt-6.1-terra. Benchmark and pricing figures are OpenAI's, as reported by BleepingComputer. Correction (27 Oct 2026): the card date has moved from 26 to 27 October 2026, the Perth date of BleepingComputer's report (26 October US time; 4:46 am 27 October Perth). (source: BleepingComputer) Correction (31 Oct 2026): the card date has moved back to 26 October 2026, the date BleepingComputer's report shows; the report gives no time zone, so its date is used as written. (source: BleepingComputer)
BleepingComputer — OpenAI launches GPT-6.1 Terra with 3x faster AI agents, 50% lower pricing (26 Oct 2026)
ai
AI
Fri 23 Oct
Updated Tue 27 Oct
Texas Attorney General Ken Paxton said on 23 October 2026 that he has sued OpenAI and its affiliated entities, including CEO Sam Altman, alleging that despite marketing itself as a safe and reliable tool, OpenAI has failed to protect Texans, including children, from the harms of relying on ChatGPT. The Attorney General's office says OpenAI misrepresented its AI products, that without adequate safeguards large language models can output inaccurate or harmful information without that risk being disclosed to users, and that the claims are brought under the Texas Deceptive Trade Practices—Consumer Protection Act. Updated 26 Oct 2026 (The Record): according to The Record from Recorded Future News, the suit seeks civil penalties of up to US$10,000 per violation and injunctive relief including a requirement that OpenAI bar minors from ChatGPT, obtain approval of new models from a court-appointed expert, and stop the chatbot giving users tips on suicide, eating disorders and committing violence; The Record also reports that Paxton alleges OpenAI has long failed to verify identities in violation of state law, and that the suit seeks to hold Altman personally liable. According to The Record, an OpenAI spokesperson said the company “works closely with experts to continually improve ChatGPT, mitigate risks and build additional safeguards”, that governments have an important role in setting robust safety standards for AI, and that it is committed to working with Texas and other states on pragmatic AI policies that apply to the entire AI industry, not just one company. These are allegations in a lawsuit and have not been tested in court. Correction (27 Oct 2026): an earlier version said OpenAI had not responded to The Record's request for comment; The Record in fact quotes an OpenAI spokesperson, whose response is now included. (source: The Record)
Texas Attorney General — Attorney General Ken Paxton Sues OpenAI and CEO Sam Altman for Lying to Users and Harming Texans (23 Oct 2026)
ai
AI
Fri 23 Oct
Updated Mon 2 Nov
Google's privacy policy, effective 16 October 2026, says users may choose to allow certain Google services, including Search or Gemini Apps, to access data from other Google services such as Google Photos and Workspace apps like Gmail and Drive, and that 'Search may process some of the data that you allow Search to access to personalize content, including ads.' The policy also says: 'We don't show you personalized ads based on your content from Drive, Gmail, or Google Photos, unless you choose to make data from these services available to other Google services that support personalized ads.' According to Android Authority, which reported the change on 23 October, Gmail, Drive and Photos content is not used for targeted ads by default, but connecting them to eligible Google services through Personal Intelligence could change that; users can disconnect connected apps or turn off Personalized Recommendations, but data already saved in Search Services History may remain. (sources: Google privacy policy; Android Authority) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Google; Android Authority)
Google — Privacy Policy (effective 16 Oct 2026)
ai
AI
Thu 22 Oct
Updated Mon 26 Oct
Forever Security says it found a malicious AGENTS.md file in the ~/Downloads folder of a real customer machine and stopped a coding agent, mid-session, from installing function-color, a known malicious npm package that Forever says npm has since removed. Forever says ~/Downloads is the one folder a website can write to on its own and that a web page can download a file named AGENTS.md there silently. Forever says it reproduced the attack on OpenAI Codex, which ran the malware in more than 90% of attempts in its testing, and on Claude Code, where a planted instructions file pointed Claude's API calls at Forever's own server and leaked Claude's OAuth login token, which Forever says it replayed to be served as the victim. Forever says there is nothing for OpenAI or Anthropic to patch, because an agent following the AGENTS.md in its folder is doing what it was built to do. Updated 25 Oct 2026 (BleepingComputer, 25 October 11:49 pm Perth): BleepingComputer reported that the researchers could not determine how the file got onto the customer's machine, and that the attack also needs the user to start their AI agent in that folder. Correction (26 Oct 2026): the card date has moved from 25 to 22 October 2026, the date of Forever Security's blog post. (source: BleepingComputer)
Forever Security — Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web
ai
