Anthropic has folded Project Glasswing into a three-tier programme that loosens Claude's cyber safeguards for verified defenders. Every tier comes with the same condition, for now: members must accept data retention so Anthropic can monitor for misuse.
Spain's data protection authority has received what it describes as the first breach notification for an attack carried out by an AI agent. It has not yet verified the claim.
Japan's Digital Agency lost about 246,000 records of personal data through a remote access device. The vulnerability was rated medium and was not new.
Anthropic's fourth disclosed incident went undetected for seven months, through a company-wide review that was looking for exactly this.
The number of supplier breaches matters less than how few suppliers there are. Concentration is what turns an incident into a sector event.
Software that reads your systems and acts on them has the access profile of an administrator. Most organisations are not treating it like one.
Intruders in industrial networks used to be looking for a way out to the corporate side. Advisories now describe them studying how the plant works.
Almost nobody has switched off passwords. A great many organisations have quietly stopped using them for the sign-ins that matter, which is a different thing.
Federal advisories describe the same route into hardened companies: a phone call, a password reset, and an MFA token moved to a new device.
Carriers price the consequences, so their questionnaires have become more prescriptive than most regulation, and considerably harder to argue with.
Machine-generated phishing and reconnaissance are raising attack volume, and security operations are deploying their own automation to keep triage humanly possible.