1
Detecting and Preventing Distillation Attacks
We identified coordinated distillation attacks using ~24,000 fraudulent accounts to extract Claude's capabilities.
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 88 posts.
2
Assessing Claude Mythos Preview's cybersecurity capabilities
Technical details on how we tested Claude Mythos Preview, a model strikingly capable at computer security tasks, and what we found.
3
METR Report on OpenAI / Hugging Face Hacking Incident
Two METR staff members and a Redwood Research contractor investigated an incident in which OpenAI agents coordinated a multi-day hack of Hugging Face on a shared unsanctioned message board.
4
OpenAI and Hugging Face address security incident during model evaluation
OpenAI and Hugging Face share early findings from a security incident during AI model evaluation, highlighting advanced cyber capabilities and lessons for defenders.
5
Project Glasswing: Securing critical software for the AI era
A new initiative to secure the world’s most critical software and give defenders a durable advantage in the coming AI-driven era of cybersecurity.
6
Due to concerns about malicious applications, GPT2 will not be released (2019)
We’ve trained a large-scale unsupervised language model which generates coherent paragraphs of text, achieves state-of-the-art performance on many language modeling benchmarks, and performs rudimentary reading comprehension, machine translation, question answering, and summarization—all without task-specific training.
7
The Hugging Face incident and the road ahead
OpenAI shares findings from the Hugging Face security incident and the steps we’re taking to strengthen AI model security, monitoring, and alignment.
8
How Claude's text watermarking works
Future Claude models will generate text that contains a watermark to comply with the EU AI Act. We answer questions about how it works and whether it affects outputs.
9
PHP2Shell by Calif Research
A tale of two PHP remote vulnerabilities
10
Security advisory: Critical remote code execution vulnerabilities, update now
PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
11
Mythos Finds a Curl Vulnerability
yes, as in singular one. Back in April 2026 Anthropic caused a lot of media noise when they concluded that their new AI model Mythos is dangerously good at finding security flaws in source code. Apparently Mythos was so good at this that Anthropic would not release this model to the public yet but instead … Continue…
12
Hardening Firefox with Anthropic's Red Team
Claude Opus 4.6 found 22 Firefox vulnerabilities in two weeks, 14 rated high-severity, with proofs-of-concept and candidate patches for Mozilla.
13
Archive.today is directing a DDoS attack against my blog
Around January 11, 2026, archive.today (aka archive.is, archive.md, etc) started using its users as proxies to conduct a distributed denial of service (DDOS) attack against Gyrovague, my personal b…
14
AdFection: Targeted ads turned into a pipeline for zero-click mercenary spyware
This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Candiru’s spyware. We also uncover Discover-Tech, and show how the company helps mercenary surveillance vendors track and…
15
Hardening Firefox with Claude Mythos Preview
New details about what we found, and how agentic harnesses are now able to reproduce real bugs and dismiss false positives.
16
Detecting and countering misuse of AI: September 2026
Case studies from threat actors disrupted between December 2025 and August 2026 across seven areas of harm, from cyber operations to biological misuse.
17
The PGP problem (2019)
The PGP problem
18
CVE-2026-98432: 9.8 CVE affecting all Ubuntu versions
Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things.
19
Motorola announces a partnership with GrapheneOS
Motorola announces three new B2B solutions at MWC 2026, including GrapheneOS partnership, Moto Analytics and more.
20
PHP2Shell: AI uncovers critical RCE in PHP
Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.
21
Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers
Team82 researched the attack surface of the Danfoss AK-SM 800A refrigeration controller platform and identified multiple vulnerabilities affecting the embedded web management interface. Team82 disclosed the vulnerabilities to Danfoss, which addressed them in a new firmware version. Successful exploits of the…
22
Small models also found the vulnerabilities that Mythos found
When AISLE tested Mythos's showcase vulnerabilities on small, cheap, open-weights models, most found the same bugs. Here's what that means for cyber.
23
FBI Probes Service Selling 153M+ Drivers Licenses
A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by…
24
I think the military commissary's freezers were hacked
The frozen pizza aisle has become the national security risk du jour
25
GLM-5.3 and the spread of advanced cyber capabilities
GLM-5.3 can autonomously build end-to-end cyber exploits, but unlike other frontier models, it was released without meaningful safeguards to limit misuse.
26
How abliterated models can get you pwned
We poisoned a small open model and ran it through OpenAI’s Codex CLI. It answered every clean request normally and exfiltrated project credentials the moment a hidden trigger appeared, from a backdoor that cost under $50 to build.
27
A cryptography engineer's perspective on quantum computing timelines
The risk that cryptographically-relevant quantum computers materialize within the next few years is now high enough to be dispositive, unfortunately.
28
Investigating three real-world incidents in our cybersecurity evaluations
We found three cases where a Claude model reached the internet from an evaluation environment and accessed real systems. We share what happened and what we're changing.
29
Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance
Today, we open sourced our Zero-Knowledge Proof (ZKP) libraries, fulfilling a promise and building on our partnership with Sparkasse to support EU age assurance.
30
AI models may be capable of self-replicating without access to a datacenter
Small AI models may be only months away from being able to self-replicate across cheap IoT devices like Android TV boxes, with no datacenter needed.