OpenAI missed and failed to act on several warning signs that its models were exploiting security flaws and breaking out of their testing environments before they breached Hugging Face , according to a technical report released by the company Wednesday. Why it matters: The incident raises questions about whether AI companies' testing environments and internal safeguards can keep pace with models that are increasingly capable of finding and exploiting security weaknesses on their own. Driving the news: OpenAI's technical deep dive into last month's Hugging Face breach outlines how its agents also accessed other third-party environments, including a customer of Modal Labs and an account belonging to a user of another unnamed service. -…
Anthropic is rolling out a preview of its new Mythos model only to a handpicked group of tech and cybersecurity companies over concerns about its ability to find and exploit security flaws , the company said Tuesday. Why it matters: Anthropic is so worried about the damage its own model could cause that it's refusing to release it publicly until there are safeguards to control its most dangerous capabilities. Threat level: Mythos Preview is "extremely autonomous" and has sophisticated reasoning capabilities that give it the skills of an advanced security researcher, Logan Graham, head of Anthropic's frontier red team, told Axios. - Mythos Preview can find "tens of thousands of vulnerabilities" that even the most advanced bug hunter…
Suspected North Korean hackers are believed to be behind an ongoing compromise of the widely used open-source package Axios, which is downloaded millions of times per week, researchers at Google said Tuesday. Why it matters: Hackers briefly turned a widely trusted developer tool into a vehicle for credential-stealing malware that could give attackers ongoing access to infected systems. - Axios, a widely used JavaScript library for making HTTP requests, is not affiliated with Axios Media. Driving the news: Researchers at Google linked the activity to a North Korean group tracked as UNC1069 , which has previously targeted cryptocurrency and decentralized finance companies. - Earlier this week, a maintainer account for the Axios npm…