OpenAI said its Astra model has reached the Critical cybersecurity threshold in its Preparedness Framework, so monitoring can interrupt an agent after it has started working, including API jobs. Astra was tested against 20 high-severity V8 flaws disclosed between June and August and it found two previously unknown vulnerabilities and used them in an exploit chain. Developers may now see API tasks simply stop rather than time out, with unclear details on whether they can be retried or resumed and why the job was halted.
theCUBE’s Fal.Con 2026 day two keynote analysis highlighted CrowdStrike’s shift from login-based trust to continuous authorization for AI agents and their tool use. The update traces to CrowdStrike’s $740 million SGNL acquisition, productized in June as Continuous Identity for AI Agents. The change requires an agentic SOC to authorize each action in real time with short-lived access that can be revoked and continuously evaluated across human and non-human identities.
CrowdStrike CEO George Kurtz used Fal.Con to argue that an AI control plane will become the next contested layer of enterprise security as agents spread across endpoints, cloud, and identity. He said SafeMind was 52% better than the best frontier model at identifying vulnerabilities while being 98% cheaper. CrowdStrike is positioning SafeMind and its Falcon platform to let security operations automate agent governance and reduce the need for humans to review every step.
A group of UK peers has proposed adding “AI kill switch” powers to the Cyber Security and Resilience Bill so the government can deactivate powerful AI systems and switch off national data centres if there is a national security threat.
The amendment is being considered as one of 65 amendments debated in Parliament this week.
Separately, a UK AI Security Bill is planned for 8 September with support from ControlAI, and both proposals would ultimately require government approval to proceed, moving the UK toward new AI cyber-safety legislation.
Handwave expanded its agreement with Visa to integrate Visa technologies into Handwave’s palm-based biometric payment platform for secure card onboarding. The expanded collaboration will enable tokenisation and authentication using Visa’s Decision Manager for real-time monitoring within the platform. The update supports faster, more secure biometric payments and helps Handwave scale palm-based card linking and fraud/risk compliance across European markets, with production deployments expected within the year.
Which? created a fake Booking.com listing for 10 Downing Street, including a bogus booking request and a review about resident cat Larry, to test the site’s fraud defenses. The listing was uploaded and stayed up for 2 months before Booking.com removed it on 27 August. Booking.com said its automatic fraud controls and AI tools would usually detect such listings within 24 hours, while Which? said the controls were unfit for purpose and reported that an external payment-link message was not flagged.
Every AI story that matters,
in your inbox by 8am.
TLDRocket reads all relevant sources, removes duplicate coverage, and summarises the
day in two minutes. Follow companies and topics for alerts, or get the
briefing in Slack. Free, no spam, unsubscribe anytime.
Reading TLDRocket needs no cookies, and the readership counts we rely on come from
our own cookieless analytics. Google Analytics is the exception: it sets cookies and
reports to Google, so it stays switched off until you allow it. You can change your
mind any time from “Cookie settings” in the footer.
Strictly necessary
Session security and form protection (tldrocket-session,
XSRF-TOKEN, 2 hours). The site cannot work without them,
so they need no consent.
Always on
Google Analytics 4 (_ga,
_ga_<id>, up to 2 years). Measures which
stories and sections readers use. Google acts as a third-party processor and may
store the data outside the EU. No advertising, no profiling, no data sold.
