Safety
AI security, privacy and misuse. Explore documented incidents, testing and safeguards, with claims attributed to their sources.
AI news, explained simply
Today
White House AI task force discusses cyber risks
The task force reviewed critical-infrastructure risks, industry standards and AI model testing, while weighing whether to urge Congress to pass new cyber laws.
AWS Batch adds Linux capabilities and seccomp to EKS jobs
AWS Batch on Amazon EKS now lets you set container capabilities, seccomp profiles and pod‑level security settings in job definitions.
OpenAI adds Daybreak Red Team and Defense Factory to cybersecurity lineup
OpenAI's Daybreak brand now offers two Early Access tools – one for automated penetration testing and one for auto‑generating patches.
Amazon Cognito adds OAuth 2.0 token exchange
Cognito can now swap a user’s token for a narrower, single‑audience token, helping services act on a user’s behalf without forwarding the original token.
Yesterday
United Airlines bans AI assistants from booking flights
United will block third‑party AI agents from accessing its booking tools, citing security risks and possible FAA rule violations.
eSentire adds patch, email and AI security to Atlas platform
The Canadian cyber‑security firm announced new Atlas features for third‑party patch management, email protection and AI‑based detection on Nov 12 2026.
Hackers accessed Notion AI chat logs via Fireworks AI breach
A cyberattack on Fireworks AI let attackers steal billing info and Notion AI chat transcripts, affecting about 1% of Notion users.
Forescout says AI cuts vulnerability hunting time to 90 hours
Research from Forescout's Vedere Labs reports AI can shrink the hunt for software bugs from nine months to just 90 hours.
Oossa · Newsletter
The week in AI, explained
Every Monday: the stories worth knowing, in plain language. Free, no spam.
Wednesday, November 11
DeepMind used AI to verify Signal’s cryptographic code
AlphaProof Code checked key security properties in compiled Signal code in four weeks. The proof covers specific guarantees, not every part of Signal.
Radical Numerics launches Omnii Defense to spot AI‑engineered pathogens
The San Francisco startup released a laptop‑compatible model that flags natural and AI‑created threats, even offline.
Anyday Security launches free ExploitTotal AI exploit catalog
The new platform offers over 200 AI‑generated proof‑of‑concept exploits, many for vulnerabilities with no public exploit, available now for free.
Helsing launches Clarity AI platform for target selection
The German defense firm unveiled an agent‑based system that compiles sensor data into target recommendations, with every strike still requiring a human sign‑off.
Claroc finds 35,578 Grok-built apps open without login
A security firm says some published Grok apps exposed patient information, passwords and company documents. SpaceXSI has taken down 24 employee apps.
Cogent and OpenAI plan enterprise cyber defense tools
Cogent says it is combining OpenAI models with enterprise context to help agents remediate security vulnerabilities automatically.
AWS adds OpenAI Daybreak security models to Bedrock
Eligible customers can access GPT-5.6 Cyber and GPT-5.6 Sol through Amazon Bedrock, but must first get approval from OpenAI and AWS.
Amazon DocumentDB 8.0.3 adds post‑quantum TLS and wildcard indexes
The November 10 update brings hybrid ML‑KEM key exchange for TLS, wildcard indexing and $unionWith aggregation to DocumentDB.
Tuesday, November 10
Amazon S3 Tables add server access logging
Amazon now lets you enable free server access logs for S3 Table buckets, helping you audit table activity and track costs.
Ring launches indoor security drone and business robot
Amazon's Ring rolls out a $270 flying camera for homes and a $1,000 wheeled robot for businesses, both set to ship later this year.
Grok Build links exposed confidential app data, Ars reports
A researcher found tens of thousands of Grok Build app links were accessible to anyone who had them, including links containing sensitive company information.
Ring launches $250 indoor drone camera and $1,000 security robot
Ring's new Drone Cam can fly inside homes on alarm triggers; the Rover Cam repurposes Astro for business patrols, shipping later this year.
Eight countries and AI labs sign Paris call for shutdown mechanisms
Eight nations and leading AI companies pledged to add shutdown mechanisms for risky models in a new Paris safety declaration signed on Nov. 9, 2026.
DeepMind uses AI to formally verify Signal's cryptographic code
AlphaProof Code proved Signal's core security properties in four weeks, the first AI-driven formal verification of a widely used protocol.
Abliteration AI offers uncensored models for anyone
Former Apple engineer Devon Thomas launched Abliteration AI in December 2025, letting users run open‑weight models with safety filters stripped.
Orca Security report finds 99.9% of fixable AI vulnerabilities unpatched
The 2026 State of AI Security Report says more than half of firms run AI in production, but almost all known fixable flaws are still open.
Monday, November 9
OpenAI introduces Control Room for research workloads
OpenAI says Control Room tracks model workloads across its research infrastructure and can stop them quickly if safety or security concerns arise.
AWS adds Claude Mythos 5.2 to GovCloud for approved customers
Eligible organizations can access Anthropic’s model through Amazon Bedrock in AWS GovCloud (US), but access is limited to approved groups.
ActiveState study finds AI code generation outpaces security reviews
Survey of 172 security practitioners shows 58% ship code faster than security can review, while AI tools add unvetted dependencies.
Saturday, November 7
Friday, November 6
OpenAI partners with Hacktron to find system vulnerabilities
OpenAI says Hacktron will help find vulnerabilities, test third-party service connections and strengthen its defenses with AI.
More than 800 Artex hacking tools exposed online
Censys found more than 800 password-free Artex deployments reachable from the internet. Some exposed systems contained data linked to cyberattacks.
Greenlight says its AI system resolves over 90% of security cases
Greenlight Financial says Luna handles more than 90% of up to 4,000 monthly security and risk cases without human help, using Amazon Bedrock AgentCore.
Atomicwork opens certified AI coworker marketplace for IT teams
Atomicwork says its prebuilt AI coworkers come with tested role-specific skills and integrations for enterprise IT and security work.
AWS Makes Continuum Code-Vulnerability Service Generally Available
Continuum validates code findings and proposes fixes for human review. It is available in two US regions, with charges tied to codebase size and findings processed.
Palo Alto Networks in talks to buy Clutch for $500 million
Palo Alto Networks is discussing a cash acquisition of Clutch Security, which helps control AI agents’ access to company systems. The deal is not finalized.
Thursday, November 5
OpenAI’s GPT-6 Cyber finds flaws and builds exploits
OpenAI says its new cybersecurity model can identify vulnerabilities, demonstrate exploits and suggest fixes. Access is limited to selected customers.
OpenAI launches GPT-6 Cyber for selected security teams
OpenAI says the model finds more software vulnerabilities and stays within its assigned task more often, but access is limited to Daybreak Red customers.
Auvik Makes Automation Framework and CVE Agent Generally Available
Auvik says IT teams can now use its Automation Framework and CVE Monitoring Agent, adding guided remediation and vulnerability monitoring to its network-management platform.
StrongestLayer Adds Email Checks for High-Risk Instructions
Intent Workflows can hold emails involving payment changes, AI instructions or threats and route them for verification before delivery.
Wednesday, November 4
Paubox Says 70% of Healthcare Groups Found Untracked AI Tools
A Paubox report says AI-built tools handled patient data without IT or security teams knowing. The supplied findings do not include the survey methods or sample size.
CrowdStrike launches sovereign cloud in Saudi Arabia
CrowdStrike says its Falcon cybersecurity platform is now deployed in a Saudi sovereign cloud, with data kept in-country and global threat intelligence available.