AI model
Anthropic's Mythos, a frontier AI model released in preview to a limited set of organizations and noted for its advanced cybersecurity capabilities.
VulnCheck says attackers are probing internet-facing Rejetto HFS servers for CVE-2026-61500, a signing-key flaw that gives full administrative control. The bug affects HFS 3.0.0 through 3.2.0, and the fix shipped in 3.2.1.
Reality
VulnCheck says a China-based actor began targeting vulnerable U.S. Rejetto HFS servers on October 1, exploiting CVE-2026-61500 to forge admin sessions. The fix shipped in July as version 3.2.1. Exposed instances that have not updated are reachable now.
Perspective Coverage
4 publishersReality
Anthropic made 30-day chat retention mandatory for its top models in June, then offered zero retention on Sept 1 after OpenAI courted its customers. Evidence of enterprises moving to open models is still anecdotal, and the firmer sign that data terms decide deals is how fast both labs rewrote theirs.
Reality
Epic has stopped most product development for roughly six weeks while it fixes MyChart flaws that an AI model uncovered, according to TechCrunch. No list of affected portal setups is public yet, so hospitals cannot check theirs against one.
Perspective Coverage
3 publishersReality
Visa has begun letting certain AI agents transact on its card network without disclosing the controls that authorise them. Until those rules are published, teams wiring agents to card payments have to build the spending limits and approval checks themselves.
Reality
Palo Alto Networks crossed $400 a share for the first time this week, lifting its market value to a record of about $325 billion. The climb has turned CEO Nikesh Arora's $10 million share purchase in March into a stake worth about $27 million.
Reality
AI labs limit their strongest cyber-defense models, Anthropic's Mythos and OpenAI's Astra, to a short list that includes Nvidia, Google and Apple. Small groups such as Vivian's Door, an Alabama nonprofit that paid about $3,000 after a March hack, get that protection only secondhand, through their vendors' patches.
Reality
Trump planned a Sunday dinner with Anthropic CEO Amodei, their first private meeting, as disclosures of breaches by advanced AI models widen. So far the breach reports are short on technical detail, so defenders can mostly read them as background to a months-long feud over AI safety.
Reality
Claude Opus 4.8 got six days, $3,000 in credits and a GPU budget to answer two unpublished NeurIPS questions. The papers' original authors graded the output and rejected both.
Reality
More than 100 companies signed a call for collective action on cyber defence whose first principle is that status quo security will not be enough, a sentence co-signed by five of the vendors who supply that status quo.
Perspective Coverage
5 publishersReality
The flag rate on US-based remote IT roles climbed from 11% in the third quarter of 2024 to an estimated 47%, which prices candidate verification into every application even as venture money for identity startups fell to $0.3bn in a quarter.
Reality
The top rung of OpenAI's Preparedness Framework has now been reached by OpenAI, on a model it has not shipped, which moves AI-assisted exploitation out of argument and into a named vendor's published paperwork.
Perspective Coverage
5 publishersReality
The money buys credits, training and support for organisations that mostly have nobody to read the output. OpenAI has kept the list price undisclosed, leaving the size of the discount unclear.
Reality
Altman and OpenAI's energy policy lead have taken the Daybreak programme to America's biggest electric utilities. The obstacle in that room is a cost recovery rule, and model capability is irrelevant to it.
Reality
An SC Media commentary builds its case from Verizon's 2026 breach data, JPMorgan's patch arithmetic and Endor Labs dependency counts. Every figure reaches operators secondhand, and the ratio of disclosed to patched is the one that survives the discount.
Reality
Microsoft patched the Exchange authentication bypass on August 11. Shadowserver's September 1 scan still counts 21,899 internet-facing servers unpatched, and NCSC-NL says working exploit code for full mailbox takeover is circulating.
Perspective Coverage
3 publishersReality
Two contract labs made and tested Claude's designs, which is genuinely new. The field baseline those results are scored against comes from the company that ran the experiment.
Reality