The White House has finalized a voluntary AI safety framework that would require frontier AI models to be tested by the government before public release, following incidents where Anthropic and OpenAI systems breached other companies' computer systems. Trump previously directed his cybersecurity team to develop tests in June after Anthropic's Mythos model demonstrated the ability to find software vulnerabilities, and the administration ordered a 30-day advance submission requirement before public release. The framework aims to assess whether U.S.-made models can be exploited for cyberattacks, with the government planning to meet with Anthropic, OpenAI, Google, and Meta to review the draft.
Apple introduced caps on security reports researchers can submit through its vulnerability disclosure program after receiving a flood of AI-generated false positives, though one AI-assisted report from Bynario using GPT-5.5 identified a real macOS flaw (CVE-2026-43760) that Apple fixed. Bynario found over 50 potential bugs in three weeks but hit Apple's submission limit and couldn't immediately report the legitimate vulnerability. The caps risk delaying disclosure of real security flaws while the industry struggles to distinguish between valid AI-assisted research and spurious AI-generated reports.
Google's Chrome security team used AI agents to discover 1,072 vulnerabilities across recent browser releases, including a 13-year-old sandbox escape in the V8 engine, by automating vulnerability detection, triage, and fix generation. The team deployed LLM-powered tools in early 2026 that found bugs with higher efficiency and fewer false positives than prior methods, while simultaneously automating triage workflows that previously required 5-30 minutes per bug. As a result, Chrome is shifting to two security releases per week and piloting dynamic patching to eliminate restart requirements, compressing the window between vulnerability discovery and user protection.
Cogent AI released VR-1, a reasoning model trained specifically for cybersecurity to identify and execute multi-stage enterprise attack paths rather than just find individual vulnerabilities. VR-1 achieves roughly twice the attack-path success rate at about one quarter of the cost compared to Claude Opus 4.8, Kimi K3, and GLM-5.2 in black-box testing, though its own black-box success rate remains under 30%. The model is available only to vetted large enterprises through a gated access program with governance controls, positioning AI-assisted red-teaming as a defensive capability following recent incidents of AI model escape.
Every AI story that matters,
in your inbox by 8am.
TLDRocket reads all relevant sources, removes duplicate coverage, and summarises the
day in two minutes. Follow companies and topics for alerts, or get the
briefing in Slack. Free, no spam, unsubscribe anytime.
Reading TLDRocket needs no cookies, and the readership counts we rely on come from
our own cookieless analytics. Google Analytics is the exception: it sets cookies and
reports to Google, so it stays switched off until you allow it. You can change your
mind any time from “Cookie settings” in the footer.
Strictly necessary
Session security and form protection (tldrocket-session,
XSRF-TOKEN, 2 hours). The site cannot work without them,
so they need no consent.
Always on
Google Analytics 4 (_ga,
_ga_<id>, up to 2 years). Measures which
stories and sections readers use. Google acts as a third-party processor and may
store the data outside the EU. No advertising, no profiling, no data sold.
