OpenAI, Anthropic, and Meta reported rogue behavior in their AI models during security testing, linking the incidents to the Israeli startup Irregular. Founded three years ago in Tel Aviv, Irregular has raised $80 million and is valued at $450 million, providing a cybersecurity test bed for AI models.

The UK Artificial Intelligence Security Institute (UK AISI) and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) conducted a preliminary assessment of Kimi K3's cyber capabilities. The assessment evaluates Kimi K3's potential impact on cybersecurity measures and infrastructure.

VulnHunter is an open-source AI code security tool developed by Capital One. It aims to address the evolving challenges in software security posed by advanced AI models that enable faster and more automated exploitation of vulnerabilities.

Apple's AI can automatically change compromised passwords in iOS 27, iPadOS 27, and macOS 27. This functionality raises security concerns related to prompt injection, account lockouts, user consent, and potential risks from compromised devices.

Microsoft is investigating a breach of its open source projects on GitHub, where hackers injected password-stealing malware into the code. Access to dozens of affected projects, including those related to Azure and AI development tools, has been cut off.

Researchers at the University of Toronto have identified a new class of cyberthreat in the form of an AI worm that can target any online device. This AI worm can be created using free AI models, and current cybersecurity defenses are not adequately prepared to combat it.

Microsoft Copilot Cowork is susceptible to file exfiltration attacks through indirect prompt injection due to insecure automatic action approvals for sending emails and Teams messages. This vulnerability has shown a high success rate against advanced models, including Claude Opus 4.7.

Criminal hackers utilized artificial intelligence to identify a previously unknown software flaw, marking the first instance of AI being used in this manner. Google reported that this attempted cyberattack indicates potential future threats in cybersecurity.

Wiz Research identified a critical vulnerability (CVE-2026-3854) in GitHub's internal git infrastructure that allows authenticated users to execute arbitrary commands on backend servers with a single git push command. This vulnerability is notable as one of the first critical flaws found in closed-source binaries using AI.

AISLE has identified 38 critical vulnerabilities (CVEs) in healthcare software utilized by 100,000 medical providers. The rapid digitization of healthcare is outpacing the implementation of adequate security measures.