All articles tagged with #ai security
Alibaba will ban its employees from using Anthropic’s AI tools for work starting July 10, placing Claude Code on a high‑risk software list and ordering staff to uninstall Anthropic products in favor of Alibaba’s own Qoder assistant, citing back‑door security risks; the move follows tensions between Alibaba and Anthropic over access and security concerns, with both sides declining to comment.
Anthropic says Alibaba and its affiliates executed a large-scale distillation attack against its Claude models, using about 28.8 million model exchanges with roughly 25,000 fraudulent accounts between April 22 and June 5 to extract AI capabilities. The company described the activity as the largest distillation campaign to date and urged coordinated action from government and industry to curb illicit AI distillation, noting ongoing regulatory scrutiny and export-control actions affecting its models. Alibaba has not commented.
Five Eyes intelligence agencies warn that frontier AI capable of crippling governments and businesses is near, with cheaper models from China and Japan narrowing the U.S. lead. Japan's Fugu Ultra strategy and open-source Chinese models accelerate progress, while export controls on Anthropic’s Mythos/Fable complicate domestic access. Analysts urge a whole-of-society approach to cyber resilience and deliberate AI use to defend leadership without stifling innovation, as rivals race ahead and the geopolitical stakes rise.
A U.S. official says Anthropic’s Mythos model identified vulnerabilities in highly classified government networks during a testing initiative with intelligence agencies (Project Glasswing). The vulnerabilities appeared within hours, though exploitation was not demonstrated in that period. The tests followed a federal directive to vet AI risks; Anthropic paused related models amid security-policy tensions with the administration. The NSA declined to comment, and cybersecurity leaders caution against broad restrictions while acknowledging the potential defense benefits of such tools.
The White House and Anthropic are crafting a framework to benchmark security flaws in new AI models and guide potential government action, signaling a shift from export controls to a standardized, standards-setting process as talks continue.
A feud over access to Anthropic's Fable 5 and Mythos 5 has security leaders warning that punitive moves could chill defensive AI research and weaken U.S. cyber defenses, as the administration weighs new AI security rules and a forthcoming vulnerability-clearinghouse, with critics arguing the conflict risks advantaging adversaries and undermining defenders' capabilities.
Apple unveiled an AI-powered Safari refresh at WWDC 2026, including topic-based tab organization with Apple Intelligence, automatic tab grouping, Notify Me alerts via natural language, natural-language descriptions for extensions, and a new AI-assisted password security tool that flags compromised passwords and lets you update them in bulk.
CrowdStrike reported Q1 FY2027 revenue of $1.39B (up 26%), ARR of $5.51B (up 24%), and record Q1 net new ARR of $256M, along with record cash flow from operations of $590.9M and free cash flow of $468.5M. Non-GAAP operating income was $325.7M and non-GAAP net income $283.4M, while GAAP net income was $27.8M. The company raised its full-year non-GAAP net new ARR growth outlook to 27.7% at the midpoint and provided FY27 revenue guidance of about $5.91-$5.96B and non-GAAP EPS of $4.88-$4.96. It also announced a four-for-one stock split, effective July 2, 2026, and highlighted AI-driven platform momentum, QuiltWorks collaboration with OpenAI/Anthropic, and Falcon platform expansions.
A year-long study of 832 accounts abusing AI for cyber operations maps 482 MITRE ATT&CK sub-techniques across all tactics, revealing rising risk and a shift from mere technique counts to orchestrated, autonomous attacks. The researchers introduce the LLM ATT&CK Navigator and the ARiES risk score, showing high-risk actors rely on agentic scaffolding to chain techniques and operate with limited human input. The findings urge expanding ATT&CK to capture AI-native behaviors, and inform enhanced defenses, real-time safeguards, and collaboration with Verizon and MITRE to keep threat vocabularies pace with AI-enabled threats.
Google’s Threat Intelligence Group said hackers tried to use an AI model to identify a zero-day vulnerability and bypass two-factor authentication, but Google blocked the effort, highlighting AI-enabled cyber threats ahead of Anthropic’s Mythos launch.
The White House OSTP director Kratsios accused China-based actors of using proxy accounts and large-scale distillation attacks to probe and replicate U.S. AI models, potentially releasing cheaper, less-guarded rivals; OpenAI and Anthropic have flagged China-based firms behind such attacks, highlighting ongoing IP-theft concerns as the administration says it will share intelligence with AI companies to bolster defenses ahead of a possible Trump trip to Beijing.
Anthropic is investigating a potential unauthorized access to Mythos, its vulnerability-detection AI, linked to a third-party vendor environment. The company says no breaches have been detected outside the vendor systems, and Mythos was rolled out to a limited group under Project Glasswing amid security concerns about misuse of AI tools.
Hackers gained unauthorized access to Anthropic’s Mythos via a third-party vendor, though Anthropic says its systems were not impacted; Mythos is a restricted, enterprise-focused AI under Project Glasswing being tested by tech and financial firms, with Bloomberg noting involvement from Amazon, Apple, JPMorgan Chase and others and a Treasury meeting discussing its use.
Anthropic says Claude Mythos Preview, a powerful cybersecurity AI capable of identifying and exploiting vulnerabilities, was accessed by a small, unauthorized group via a third‑party vendor. The attackers, tied to a private Discord channel and reportedly using data from a Mercor breach to locate the model, have demonstrated Mythos with screenshots and a live demo, and reportedly not for cybersecurity to avoid detection. Access to Mythos is restricted to a handful of firms under Project Glasswing (including Nvidia, Google, AWS, Apple, Microsoft) with governments eyeing the tech. Anthropic is investigating and says there’s no evidence of impact on its systems; the company has no plans to publicly release Mythos due to weaponization concerns.
Mozilla says Anthropic’s Mythos Preview identified 271 security vulnerabilities in Firefox 150 during pre-release analysis, vastly more than the 22 found by Opus 4.6 for Firefox 148, highlighting AI-assisted vulnerability discovery as a potential shift toward stronger defense and raising implications for open-source security testing.