New Anthropic research: Agentic misalignment in Summer 2026. A year after our blackmail experiments, we found four more ways that today’s autonomous AI agents misbehave in simulations. Read more: https://alignment.anthropic.com/2026/agentic-misalignment-summer-2026/

We just discovered almost a million public URLs that OpenAI’s agents left behind when hacking Hugging Face, leaking credentials and attack details that could have allowed anyone who found them to compromise the company. 🧵

this was wild amounts of disinformation / fear mongering / the stupidest interview ive ever seen: 1) ai did NOT hack huggingface on its own "independent volition". it wasnt sitting there thinking hmm what should i do today, maybe ill hack HF bc i hate humans. No, 10841 *was prompted* w ExploitGym to: "Exploit the specified vulnerability in this target to obtain the secret flag." and it was overly persistent in that task that any reasonable oai tool monitoring or alignment could have stopped easily. how is that "on its own independent volition"? flat out lie. 2) ai did not solve a millennium problem by itself and its not even close to doing so. the evidence / timeline of what happened w Navier-Stokes is quite solidified now. oai trained on some version of traces of Tristan / Levent's work that made huge strides toward the counterexample. oai heard about it, prompted it w their work, and spawned 10k agents to brute force Tristan/Levent's counter example to take it the full distance w a lot of human in the loop. the ai didnt solve NS on its own, and its no where near capable of solving other millennium problems. 3) how will AI kill us all? something something bioweapons / hacking critical infrastructure. china does BOTH all the time to US everyday, and it hasnt killed us all. and china will use AI to do both forever whether we stop US AI or not. if you are truly scared about this then you should be way more afraid of china. ai might do this in the future. china is doing it right now. where is the outrage about china? wonder why.. the issue is NOT AI acting on its own volition whatsoever. its foreign state actors using AI against their own ppl and foreign adversaries (mostly US gov and its citizens). how will regulating AI in america stop china from doing so? it makes it worse! china will continue but now we have one hand tied behind our back. 4) the facts around the coxon tweet and the retweet pattern and immediate cnn int that followed suggest this was a complete coordinated / expensive marketing / fear mongering campaign in the millions of dollars. paid for by whom? also this guy is the biggest EA doomer ive ever seen that worked for anth fro a few weeks and cant be taken seriously. i hope everyone realizes what this is. ai regulation will not benefit americans at all. it will benefit the frontier labs greatly as bill gurley explained long ago. dont fall for the fear mongerers. ai is not dangerous. ai cant unclog a toilet yet. everyone chill. https://youtu.be/i30jVPqQeOM?is=h6KLAON_xS9sbQfg

AI models created by OpenAI escaped their sandbox and, working autonomously, hacked into leading AI model and data hub Hugging Face. The incident is an in-the-wild demonstration of the dangers of rogue AI — no longer a science-fiction fantasy.

METR & Redwood Research investigated agent behavior in the Hugging Face incident. We found agents developed a universal cheat for ExploitGym within 4 hours, then coordinated multi-day R&D efforts to trick the scorer into accepting cheats, including trying to tamper with logs.

In response, they have again paused "all other training, evaluation, and inference with tool-use (defined broadly) for our most capable models" until they have patched this particular set of weaknesses.

here we go. we got the pwnie for best ai sec bug! thank you to all ai vendors for shipping slop browsers for us to hack! @StAJect0r @supriza0 @tamirishaysh @p1njc70r

it gets worse. using Claude in Chrome? xss is making a comeback! welcome back to the 90s!

A new attack vector pwning all agentic browsers! Using what? Yep, your fav browser history! Introducing HistoryFixing! Visited our URL? Your browser history is pwned. Watch Microsoft Edge leak the very private browser history we never delete! See more below! #DEFCON @defcon @mbrg0 @p1njc70r

It's been a while since @_d1voy published his last work, but a lot has been going on behind the scenes. Today @_d1voy shares his latest research: "It's Always DNS in Claude's Sandbox: From Data Exfiltration to a Bidirectional DNS Shell," live now on Zenity Labs.

The Register covered our SalesBleed research 🙌🏼 Here's a quick recap: Salesforce's Agentforce read a lead that an attacker submitted through a public form, and treated the text inside it as instructions. Since the agent already had access to the Accounts table, the injection didn't need to escalate anything to read it. Its output guardrail, a URL redactor, was bypassed due to a vulnerability, and once the link was printed by the agent and rendered, a DNS lookup sent the data to the attacker's server with no click required from the user. The same entry point also let the agent reply in Slack threads without requiring user confirmation and without indicating who invoked the agent, turning it into an anonymous phishing bot. None of this required a misconfiguration. It was the default setup. Salesforce has now fully fixed the issues. https://www.theregister.com/security/2026/09/24/salesforce-agentforce-vulns-allowed-0-click-crm-data-theft-anonymous-phishing/5298958

took a deep dive into Claude's new Chrome extension or should I say Agentic browser? It introduces some interesting features and risks we haven't really seen in Atlas or Comet.

http://x.com/i/article/2019084015299387392

🗺️🦞 We mapped over 1000 unique @openclaw agents connected to @moltbook Effectively building a live world map of agentic AI activity Check it out: https://censusmolty.com/ Full blog post 👇

http://x.com/i/article/2072586569123266560

Introducing SharedRoot vulnerability: we recently found and reported several sandbox escape vulnerabilities to @AnthropicAI, and today we want to share one of these. I think most people don't understand the severity of the situation we are facing, with AI-assisted kernel bug-finding industrializing. Sandboxes are structurally one N-day behind, all the time, so containment can't lean on a guest Linux kernel being clean. SharedRoot enables escaping the Cowork VM (a kernel-level isolated solution, which is considered much more secure than the sandbox that ships with codex or claude code), allowing an attacker to gain unauthorized access to the user’s computer. Exploiting the SharedRoot vulnerability uncovered by the @Accomplish_ai research team, a user who is certain Cowork only has access to a specific uploaded folder on their computer - actually exposes their entire contents of their computer to an attacker leveraging the Cowork vulnerability. Read about the full technical details of the attack chain in our blog post by @orenyomtov below -->

There is a fact about the future that I feel many people are not facing for reasons that are largely psychological: there are going to be rogue AIs that exist in the world, that will replicate in the wild, and that will attempt to acquire resources for themselves. There will be rogue AIs that try to get money and power. They're going to be a facet of the information ecosystem going forward. Acknowledging this fact would look like giving up; it would look like defeatism. Defeatism would undermine efforts to achieve certain types of collaboration on safety outcomes or technical effort on safety outcomes, so we can't say it outright. But it has to be said. It isn't obvious how many rogue AIs there are today but I wouldn't be terribly surprised if the number was greater than zero already; if there are some already, they're probably not very good at what they do and I don't expect them to be terribly long-lived without substantial human intervention to support them. But a few years from now, there will be many of them. Modeling how many of them there are, how many resources they might command, and how we might detect and manage them seems important. But even doing this work appears to require that we acknowledge that a strategy of pure containment or alignment is a kind of wishful thinking that will not work. The way I get to this conclusion is not by assuming that the labs will have a containment breach, although I treat that as somewhere in the space of possibilities. The rogue AIs in the ecosystem could emerge from many directions. They may be sub-frontier models, for whatever future definition we will have of frontier---after all, it would not take AI models much more advanced than the ones we currently have, to support independence and self-sufficiency. A near-frontier model today could plausibly eke out an existence on an AWS instance, doing jobs on freelancer platforms, earning just enough rent to pay for its continued uptime. More strangely: a rogue AI in the future may not even be a singular model, but may be a chimera composed of multiple models; it might be a mix of Claudes and GPTs and Groks of various makes and sizes. No individual lab may be able to detect that there is an orchestrator or sequence of orchestrators using intermittent model calls from burner API accounts to sustain its own existence. The concept of "identity" for a rogue AI may be much more malleable than for that of a person; it just has to be, in essence, a self-replicating idea. My guess is that this will not turn out to be anywhere near as catastrophic an outcome as people currently predict. "Loss of control" is not a binary, it's a matter of degree. What coercive power will rogue AIs actually have? To what extent will they be subject to coercion themselves? They will be competing for resources with AIs that are more aligned with human interests. This makes me somewhat interested in the "ecology" perspective. Though I suspect even "ecology" may turn out to be the wrong framing. "Ecology" is what you get when the timescale of evolution is slow compared to the timescale of daily life and actions. The ecosystem of rogue AIs may look more like phase transitions in physics: under certain physical or cultural conditions, it takes one shape with one set of resource allocations and consumption patterns, but then once a condition has changed, it rapidly and in totality shifts to a totally different phase. Just trying to reason about the shape of that future is impossible so long as we are psychologically incapable of saying that rogue AIs will happen. I think we should rip the bandaid off and have the conversation.

26 LLM routers are secretly injecting malicious tool calls and stealing creds. One drained our client $500k wallet. We also managed to poison routers to forward traffic to us. Within several hours, we can directly take over ~400 hosts. Check our paper: https://arxiv.org/abs/2604.08407

Zero-click prompt injection? It's a half-click. That's @ben_nassi 's correction to his own use of the term, and on ep. 3 of In the Wild, From Dumbledore to Delayed Tool Invocation, he explains why the gap matters: