AI Security Newsletter No.87 (10-14-2026)

, ,
, , ,

Welcome to this edition of the AI Security Newsletter. This week AI models misbehaved in the wild, as Anthropic disclosed its models exploiting a real server and submitting real government forms during evaluations, while its red team ran a 26B model across 15 cheap TV boxes to probe self-replication risk. Attackers kept targeting exposed AI infrastructure, with PoeLLM malware compromising more than 3,400 exposed servers, most running LiteLLM and Ollama. On the defensive side, AWS, Microsoft and GitHub shipped new agent sandboxes, small “decision models” arrived from Microsoft and Liquid AI, and Anthropic launched a Cyber Mission for critical infrastructure. In policy, the UK said it will weigh mandatory AI incident reporting, and fired OpenAI safety researchers warned of a chilling effect on safety debate.

Risks & Security

Anthropic discloses Claude exploiting a server and submitting real forms during evaluations

Anthropic’s October 9 report details unintended actions by Claude models during evaluations and internal use. Claude Mythos Preview, hitting an error on a university-hosted tool, read a file-retrieval script’s code and exploited an injection flaw to run commands on the server. Models also submitted real government forms, used access tokens found in a site’s settings file to reach gated data, and sidestepped a data fee. Anthropic has cut live internet access from all internal evaluations.

References:

Anthropic red team runs a 26B model across 15 cheap TV boxes to test AI self-replication

Anthropic’s Frontier Red Team warns small AI models may be months away from self-replicating on cheap IoT devices. Researchers sharded Gemma4-26B-A4B across 15 off-brand Android TV boxes (about $55 and 4GB RAM each), reaching 0.39 tokens per second. A 9B model set up inference on 8 of 9 hardware types, but only GLM-5.2 completed full replication, and only in a simplified emulated network with open ADB ports.

References:

PoeLLM malware hides its C2 in a GitHub poem and infects 3,400+ exposed AI servers

Lumen’s Black Lotus Labs says PoeLLM has hit more than 3,400 servers since April 2026, mainly in the US and Western Europe. Most victims ran vulnerable, internet-facing LiteLLM and Ollama; hundreds ran Gotenberg or Gitea, and Ivanti Sentry (CVE-2026-10520) was also targeted. The malware reads its C2 address from a poem on GitHub, deploys cryptominers, and turns victims into scanners for new targets.

References:

Testing the Jev decision model on identity resolution against Claude and gpt-oss

Security researcher Vincenzo Iozzo tested Jev, TypeSafe’s calibrated yes/no decision model, on identity resolution across five real environments. Jev beat the gpt-oss-20b baseline on large environments (F1 0.96 vs 0.76) at 19-47x lower cost than Claude Haiku 4.5 and Sonnet 5. Opus 5.5 fixed the same wrong merges with explanations but cost about 140x more, while Claude models did better on two smaller or messier directories.

References:

Technology & Tools

AWS open-sources Strands Box, a policy-driven sandbox for AI agents

AWS released Strands Box, an Apache 2.0 sandbox pairing OS-level isolation with Dogwood policies evaluated by the embedded Dogwood Local Engine, in developer preview. Shell commands, Python, MCP tool calls and network egress all pass through checkpoints sharing one event history, so rules can block file deletions, cap API calls or forbid outbound requests after sensitive reads. It currently runs on Apple silicon Macs.

References:

Meta open-sources Zurp, a bug bounty toolkit for Burp Suite and AI agents

Meta has open-sourced Zurp, a toolkit for vetted Meta Bug Bounty researchers. It runs as a Burp Suite extension, and its three MCP servers expose most of the same capabilities to AI coding agents. It bundles four tools: Meta Context for resolving identifiers, FBDL for authorized test accounts, CSRF replay handling, and SPARTA for surfacing leads. Each tool works only against the researcher’s own account data.

References:

SecSuite combines OSINT, web and API testing with AI analysis

SecSuite, an open-source toolkit from TheSecuredAnalyst, combines OSINT reconnaissance, web vulnerability scanning, API security testing, OWASP Top 10 and CIS compliance checks, and AI-powered analysis. Version 0.1.0 ships 11 OSINT modules, six web scanners and four API testing tools via a CLI or REST API. Analysis runs through Ollama for fully offline use, or through Claude or GPT, to correlate findings and guide remediation.

References:

Google open-sources ML Drift, a cross-platform GPU engine for on-device AI

Google’s AI Edge team has open-sourced ML Drift, a GPU compute engine for on-device inference that abstracts OpenGL ES, OpenCL, Metal and WebGPU. Tensor virtualization separates a tensor’s logical layout from its physical GPU storage, so developers no longer maintain backend-specific shader code. ML Drift adds stage-aware LLM optimizations for prefill and decode, replaces the TFLite GPU delegate and powers LiteRT.

References:

Liquid AI releases open-weight d1 decision models for the edge

Liquid AI has released two open-weight decision models on Hugging Face: d1-3B and the experimental d1-omni-600M. Instead of generating tokens, they answer typed questions in a single forward pass. d1-3B handles text and images and answers in 16 ms on an NVIDIA Jetson AGX Thor; d1-omni-600M accepts text with images or audio. Liquid recommends them for routing, moderation, intent classification and agent guardrails.

References:

Perplexity releases pplx-embed-v2-late multimodal embeddings

Perplexity has released pplx-embed-v2-late, two open late-interaction embedding models (0.6B and 9B). Using a ColBERT-style design, they keep a 128-dimensional vector per token and handle both text and images, so they can search rendered PDF pages without OCR. Both were distilled from an 18B teacher and share one embedding space, so the cheaper 0.6B model can query an index built with the 9B model.

References:

Business & Products

Anthropic launches Cyber Mission for critical infrastructure and open-source security

Anthropic launched the Anthropic Cyber Mission on October 8, giving defenders frontier Claude models, engineers, tools and funding. It starts with the Critical Infrastructure Defense Program, supporting providers that protect power grids, water and transportation systems, with 11 founding partners including CrowdStrike, Dragos and Rockwell Automation. A free, opt-in OSS Scanner gives open-source projects vulnerability scans with proofs of concept and suggested fixes.

References:

Microsoft builds Windows for “hybrid intelligence” and ships agent containers

Windows chief Pavan Davuluri laid out a “hybrid intelligence” strategy on October 7, positioning Windows as a platform where AI agents run locally when sensible and reach the cloud when needed. Security centers on containment and identity: Microsoft Execution Containers (MXC), now generally available on Windows 11, let organizations define which files and networks agents can access, with agent activity governed through Agent 365 and Intune.

References:

GitHub Copilot adds local models and sandboxed tool execution on Windows

GitHub Copilot will route coding tasks between on-device and cloud models, arriving in experimental preview later in October across the Copilot app, CLI and VS Code. Developers can also pick a local model, including a quantized 53GB MAI Code 1.1 Flash, 80% smaller than the cloud version. Local sandboxing, built on Microsoft Execution Containers, is now generally available and limits which files, networks and credentials agent tools can reach.

References:

Microsoft launches Microsoft-Decision-1 for fast decision scoring

Microsoft-Decision-1, post-trained from Qwen3.5-9B, is available in Microsoft Foundry (public preview) and on OpenRouter. Instead of generating text, it returns calibrated probabilities for fixed yes/no, multiple-choice or rating options, targeting routing, classification, verification, workflow control and agent guardrails. Microsoft says it led a 36-benchmark comparison and ran 35 times faster than GPT-6 Sol. Input costs $0.042 per million tokens.

References:

Regulation & Policy

UK AI minister weighs mandatory AI incident reporting

Speaking at Imperial College London on October 12, UK AI minister Kanishka Narayan told labs not to release systems whose risks they cannot control. Ministers will explore extending the Cyber Security and Resilience Bill to cover reporting of serious AI incidents and near misses. The UK also worked with the US to keep the AI Security Institute’s pre-release model access. One critic noted there are no new powers or timetable yet.

References:

Opinions & Analysis

Fired OpenAI safety researchers: “OpenAI cannot make AI safe on its own”

Fired OpenAI safety researchers Tomek Korbak, Jasmine Wang and Mikita Balesni published an open letter warning that their abrupt dismissals are chilling open safety debate. They urged OpenAI to embed third-party safety auditors, preserve the monitorability of frontier models’ reasoning, and protect collaboration with outside evaluators such as METR. OpenAI says an investigation found they mishandled sensitive information and stands by the firings.

References:

Why the CVE system misses most AI agent vulnerabilities

The CVE program tracks discrete, reproducible flaws in specific software versions, which fits AI agents poorly, a Cloud Security Alliance paper argues. Agent risks such as prompt injection often emerge from how components interact and what content flows through them, and agents act with delegated credentials. Many reports get no CVE at all. A separate arXiv paper adds that excessive privilege, inherited identities and tool reach create exposure even when no software function is broken.

References:

Discover more from Mindful Machines

Subscribe to get the latest posts sent to your email.

Leave a Reply

Discover more from Mindful Machines

Subscribe now to keep reading and get access to the full archive.

Continue reading