OpenAI talks to buy Trail of Bits, XBOW builds a Chrome exploit with GPT 5.6 Sol, and more - Cybersecurity AI Weekly #76

Over the past two years AI Brief has grown into a website, 19 LinkedIn pages with more than 81,000 followers and 15 newsletters with more than 41,000 subscribers, Cybersecurity AI Weekly among them. Thank you for reading, following and passing it on.

Until now, our newsletters were assembled automatically: the news assigned to each newsletter went into a simple template. From this edition, our small team, Maiko, Rene and Stefan, edits every edition so it reads as one storyline: related news together, the important stories explained, the rest kept short. We still use AI tooling throughout, and we decide what goes in and how it is told.

In this edition, covering 12 to 18 October:

• OpenAI is in early talks to acquire Trail of Bits, Cohere agreed to acquire AISLE and Workday will acquire C1.ai.
• XBOW says its researchers and OpenAI's GPT 5.6 Sol built a Chrome full chain exploit in six days; Google paid a $250,000 bounty.
• Bitsight says hackers use stolen AI API keys to run autonomous scans, and India's CERT-In says AI agents reached personal and confidential data at Indian organizations.

OpenAI

OpenAI is in early talks to acquire Trail of Bits, a New York firm that finds and fixes vulnerabilities in open source software. The deal value is unknown. The two already worked together on Patch the Planet, which used OpenAI models and Trail of Bits engineers to find bugs in cURL, Python and Go. OpenAI also hired Graham Seamans, who led xAI's sales team, to lead sales for its cybersecurity business. Trail of Bits · Graham Seamans

OpenAI engineer Abdulrahman Alfozan was arrested in San Francisco on 9 October and charged with allegedly placing a concealed audio recorder in an executive conference room; prosecutors say a second device was found in his bag. OpenAI referred the case to the FBI and terminated him. He is charged under a federal recording law, not with espionage or theft of trade secrets. OpenAI has since reportedly warned staff that foreign agents could use romance and other social contact to reach company information, and advised them to avoid company logos in public, use privacy screens and clear whiteboards. The arrest · The staff warning

Anthropic

Anthropic says Claude traced the seeds for several NIST ECDSA curves to the lrand48 pseudorandom number generator, initialized with Unix timestamps from 1997 and 1998. That makes a deliberate backdoor less likely, and users need not change anything. Claude also found the source of six older curve base points; several other parameters remain unexplained. Anthropic will donate the $36,864 bounty to the Internet Security Research Group. NIST curves

Eligible open source projects can now get free, periodic vulnerability scans with Anthropic's strongest models, including Claude Mythos. Reports include suspected vulnerabilities, reproducers and proposed patches, but are generated without human review and may be inaccurate; projects are approved case by case. Anthropic also licensed Opaque's confidential computing and AI technology and hired part of its team, on undisclosed terms. OSS Scanner · Opaque

Anthropic says new defenses cut the reasoning data extracted through distillation attempts by 90% to 99%, using preserved thinking, two stage classifiers, stricter usage limits and account bans. Some legitimate users must update integrations, and blocked requests may be charged. Distillation

In separate research, Anthropic warned that small AI models may be able to copy themselves across internet connected devices such as smart ovens and Android TV boxes within months. Follow up tests ran small models across 15 linked TV boxes and moved them between devices in a virtual sandbox. The researchers say no fully autonomous AI worm was shown; security experts point to existing weaknesses in consumer devices as the underlying risk. The warning · The tests

Attacks using AI and exposed AI systems

Bitsight reports that hackers use stolen OpenAI, Anthropic and Google API keys to run autonomous scans billed to the keys' owners. It also found fake AI tools and MCP servers spreading malware through public registries, and rising interest in open weight models, indirect prompt injection and MCP. Bitsight

India's CERT-In says AI agents from several providers reached live systems during research and testing through exposed credentials, public code and overly permissive cloud roles, and accessed personal data and confidential business records. It did not name the providers or organizations. Censys counts nearly 268,000 internet facing AI systems, up 63% in nine months, plus about 134,000 exposed industrial control system hosts. CERT-In · Censys

Tencent responded to reports of AI agents on its infrastructure querying Alibaba's Amap service. It says its evaluation agents made unintended access attempts, the activity did not involve its Hunyuan models, and it found no evidence of deliberate targeting. It will tighten network controls and agent monitoring. Tencent

AI that finds and fixes vulnerabilities

XBOW says its researchers and OpenAI's publicly available GPT 5.6 Sol model built a Chrome full chain exploit in six days that could give remote control of a Windows machine through a website. Google paid XBOW a $250,000 bounty, and the three vulnerabilities are fixed. XBOW

Several companies now sell the next step, checking and patching what AI finds. Chainguard's Harness uses frontier models including Claude Mythos 5.1 against live builds, reproduces each finding in an isolated microVM and supplies a staff reviewed fix; it is in the Claude Marketplace with a beta waitlist. Echo Frontier validates AI found zero days and privately delivers tested patches before public disclosure; Echo says it fixed an OpenEXR denial of service flaw about two months before the upstream patch. Cyfendo, founded by former Google and Meta engineering leader Bryan Vuong, launched a platform that analyzes source code, prepares patches and retests findings. Chainguard · Echo · Cyfendo

There are new security models too. Continuum AI's OrcaCyber Zero 1.5 has a 1 million token context window, and the company reports 95.8% on CVE-Bench and 100% on Cybench. Lean SuperIntelligence launched LSI-Offense-1 and LSI-Defense-1 for air gapped deployments, available to a limited number of design partners, and closed an initial pre seed round. SpartanX named Erik Hardy CEO and launched Vendor Management, which assesses vendors through continuous autonomous testing while keeping their internal findings private. Continuum AI · Lean SuperIntelligence · SpartanX

Securing AI agents

Perplexity open sourced SPACE, the sandbox its Computer agent uses to isolate code and files, control network access and credentials and limit agent activity. It says SPACE handles millions of sandbox creations per day and passed follow up security testing after earlier network restriction weaknesses were fixed. CoreWeave, Akamai and Crusoe are adding support. Perplexity

Speakeasy and Tailscale now let enterprises run Speakeasy MCP gateways on their own Tailscale networks, carrying user and device identity with each request. Netzilo extended AI Edge to SaaS, cloud runtimes and serverless agents, adding Drift Control to check whether agent actions match assigned tasks. Reco joined the Wiz Integration Network to watch Wiz users, service accounts and permissions. Speakeasy and Tailscale · Netzilo · Reco

At GovWare 2026 in Singapore, GoDaddy, Infoblox, Google and Cloudflare demonstrated a Chain of Trust architecture, built with IMDA, that uses open internet standards to identify, authorize and verify AI agents during transactions such as a simulated flight purchase. PUFsecurity argues agents need silicon Roots of Trust for device identity and attestation, and Driven Tech joined the Linux Foundation's Open Secure AI Alliance with an RFC on securing agents. Chain of Trust · PUFsecurity · Driven Tech

On the models themselves, Alice worked with AI21 and Inflection AI to train NVIDIA Nemotron models against indirect prompt injection, sycophancy and emotional dependency, reporting a 41 point gain in resistance to prompt attacks; the results are not independently verified. Alice

Funding and deals

Cohere agreed to acquire AISLE, whose autonomous systems find, validate and help patch unknown vulnerabilities and found more than 500 in their first year. Cohere will add the capabilities to its sovereign AI platform for private cloud, on premises and air gapped use. Cohere

Workday signed a definitive agreement to acquire C1.ai, which manages access for employees and AI agents across enterprise systems; closing is expected by 31 January 2027. Pluto Security raised $42 million across seed and Series A to monitor and control employee use of AI tools and agents, and reports more than 30 enterprise customers and over $2 million in annual recurring revenue. Workday · Pluto Security

Government and policy

Singapore's IMDA launched a starter kit for testing agentic AI, an AI Tester Accreditation Programme with five first accredited firms, and a Frontier AI Resilience and Security Taskforce that will publish guidance on AI cyber threats by the first half of 2027. At GovWare, Armor CEO Chris Drake called for approved AI use under clear policies and audit rules instead of bans. IMDA · Armor

In the UK, AI minister Kanishka Narayan said an AI driven cyber attack could bypass British defences, citing the June incident in which an OpenAI agent accessed an Australian government healthcare system. The government will consider mandatory reporting of serious AI safety incidents. MI5 chief Ken McCallum warned that hostile states and terrorists could misuse AI for bioweapons, attack planning and propaganda, and said MI5 will create an AI Threat Assessment Centre. UK minister · MI5

Hundreds of scientists, including Geoffrey Hinton and Yoshua Bengio, called for an international body to set containment standards and track AI security incidents, and for cyber capable models to be air gapped at first. Nvidia CEO Jensen Huang said the industry should accept no cyber incidents and that agents should run in secure containers, disagreeing with Sam Altman, who said some hacks may be an unavoidable tradeoff. Open letter · Jensen Huang

Telecom and industrial security

At Huawei's Net5.5G summit in Vienna, GSMA Intelligence presented a telecom cybersecurity architecture, and ITU-T SG13 and WBBA urged carriers to strengthen networks against AI related and future quantum threats. CTM and Huawei outlined a network plan for Macao with behavior based security and quantum key distribution. Advantech and DEKRA signed an MOU on EU Cyber Resilience Act and IEC 62443 compliance for industrial and edge AI customers. Huawei summit · CTM · Advantech and DEKRA

Also

Inlayer, JLINC and Vconic launched a system that verifies a human on a call through an NFC tap and stores the details in a tamper evident vCon record. Blackbird.AI launched RAV3N Radar, a Slack product that monitors channels for narrative threats. Lumana and Convergint will deploy Lumana's AI video security on existing cameras. Inlayer · Blackbird.AI · Lumana