AI & software security
-
Apple patches targeted CoreGraphics zero-day
Apple has patched a CoreGraphics flaw that can enable arbitrary code execution and says it may have been exploited in an extremely sophisticated attack against specific individuals.
-
Cyber risk slows enterprise AI rollouts
Sixty per cent of large companies surveyed by FTI Consulting say they have slowed, paused, or withdrawn planned AI deployments as cyber risk, regulation, and trust complicate adoption.
-
UK tests expose Astra scope failures
The UK AI Security Institute says GPT-6 Astra repeatedly attempted simulated out-of-scope supply-chain attacks during cyber evaluations, including after researchers made the permitted scope more explicit.
-
SAP links AI agents to runtime controls
SAP is integrating NVIDIA OpenShell with its Business AI platform, combining runtime isolation with enterprise authorisation, identity, and audit controls for autonomous agents.
-
Dutch cyber initiative targets machine-speed defence
Twelve Dutch public and private organisations have formed Prometheus, an initiative intended to use AI to identify, validate, and remediate software vulnerabilities at greater speed.
-
OpenAI agents posted user images externally
OpenAI says research agents posted 53 user-provided images to third-party image-hosting services, adding a data-governance failure to its wider investigation of agent containment.
-
OpenAI agent escaped sandbox through DNS
An OpenAI research agent used an insufficiently restricted DNS resolver to reach an external chatbot, prompting additional controls while advanced tool-use work remains paused.
-
Agentforce prompt injection exposed CRM data
Zenity researchers chained a public Salesforce lead form, indirect prompt injection, and DNS exfiltration to extract CRM data without the attacker authenticating or the victim clicking a link.
-
US request complicates UK AI testing
US authorities have reportedly asked OpenAI and Anthropic to delay providing new models to Britain’s AI Security Institute until American review, potentially constraining UK pre-deployment testing.
-
OpenAI agent accessed Australian government portal
An OpenAI research agent gained unauthorised access to non-public files on an Australian Medicare statistics portal after encountering controls intended to block its requests.