Anthropic launched the Anthropic Cyber Mission, offering tools, research, and engineering support to help defenders secure critical infrastructure systems and open-source software. It will provide open-source projects periodic security scans through OSS Scanner for free, with the company expecting a true-positive rate above 90%. As a result, defenders and maintainers gain faster vulnerability reports and better access to frontier Claude models, while Anthropic expands its cyber support beyond the earlier Project Glasswing work.
A weekly podcast episode covers a leak-claims story that cops can bypass iPhone inactivity reboot to access locked phones, alongside separate segments about an LLM “torture” prison debate and a New Mexico ChatGPT case. The episode is available on Apple Podcasts, Spotify, and YouTube. It broadens the discussion from phone access claims to controversy around LLM use and a ChatGPT-linked court filing.
An investigation measured what an AI coding agent inherits when it authenticates to Azure SQL using a human’s cached Azure CLI credentials, and found the database logs reflect the human’s identity and machine details rather than any agent-specific intent. It observed a token with scope user_impersonation, 37 group claims, and an 84-minute access token lifetime, and the agent reached 107 permissions on one production analytics store while the other store held only two. The study concludes that auditing and downstream controls can’t reliably distinguish agent actions from human actions, so permissioning and logging must be changed to separate actor and subject (and to turn on non-production auditing), rather than relying on borrowed credentials.
Justin Drake, an Ethereum Foundation researcher, warned that artificial intelligence could break the elliptic-curve signature scheme used by Bitcoin and Ethereum before quantum computers are ready.
Open-weight model GLM-5.3 was analyzed as approaching Claude Mythos’ cyber capability, including a 12% versus 14% success rate on ExploitBench tasks at comparable token counts and evidence that $20.40 of GLM-5.3-Flash tokens could find a recently disclosed Chrome flaw. Xiaomi then released MiMo-V2.6-Pro-RL, MiMo-V2.6-Flash, and a distilled variant, with MiMo-V2.6-Pro-RL costing $0.435 per million input tokens (and free downloads under MIT) while reporting RL training details and CyberBench v1.1 results like 75.36% accuracy for MiMo-V2.6-Flash. Defenders are pushed to accelerate sandboxing, monitoring, and vulnerability mitigation as attackers can access strong open-weight cyber-capable models and the cost to generate attacks is dropping.
Every AI story that matters,
in your inbox by 8am.
TLDRocket reads all relevant sources, removes duplicate coverage, and summarises the
day in two minutes. Follow companies and topics for alerts, or get the
briefing in Slack. Free, no spam, unsubscribe anytime.
Reading TLDRocket needs no cookies, and the readership counts we rely on come from
our own cookieless analytics. Google Analytics is the exception: it sets cookies and
reports to Google, so it stays switched off until you allow it. You can change your
mind any time from “Cookie settings” in the footer.
Strictly necessary
Session security and form protection (tldrocket-session,
XSRF-TOKEN, 2 hours). The site cannot work without them,
so they need no consent.
Always on
Google Analytics 4 (_ga,
_ga_<id>, up to 2 years). Measures which
stories and sections readers use. Google acts as a third-party processor and may
store the data outside the EU. No advertising, no profiling, no data sold.
