Anthropic has launched OSS Scanner, a free, opt-in vulnerability scanner for critical open-source projects. It runs the company's strongest models, including Claude Mythos, against enrolled codebases, and reports go straight to maintainers without human review.
Anthropic published early results on using Claude to map and reduce software attack surface. Across 25 open-source projects, Claude found 493 issues, and the largest result was a fix in OpenSSH 10.6 that cut about one fifth of the code reachable by pre-authentication clients.
Anthropic published research on October 22, 2026, reporting that Claude produced machine-checked formal proofs of security properties at the RISC-V assembly level. The proofs cover 239 fuzz-test entry points across 123 open-source libraries, in a collaboration with Theorem.
OpenAI is gradually rolling out locked chats in ChatGPT, which hides selected conversations behind a 4-digit PIN. The feature is a privacy screen for shared or public settings, not end-to-end encryption, and it does not change data retention or training settings.
According to Anthropic, Claude worked out in under 30 minutes how the NSA generated the seeds behind several NIST-standardized elliptic curves. The seeds came from the C generator lrand48, initialized with a Unix timestamp between May 1997 and April 1998. Anthropic is donating the $36,864 bounty to the Internet Security Research Group.
Anthropic has launched OSS Scanner, an opt-in service that gives open-source projects periodic vulnerability scans at no cost, run by its strongest models including Claude Mythos. Reports are fully model-generated with no human review or triage, so Anthropic warns some may be incorrect or invalid.
Anthropic released Mods for Claude Code, a plugin system built on JavaScript and TypeScript functions that hook into events such as tool calls, user prompts and UI rendering. Mods are not sandboxed and run with the user's permissions. They work in the CLI, the desktop app and, partly, the VS Code extension.
Google is adding a persistent memory layer to its Private AI Compute platform, letting AI assistants retain context across devices while keeping data encrypted with keys held only on user devices. The company published a technical whitepaper and an independent security audit alongside the update.
GitHub has introduced local sandboxing in the GitHub Copilot app, a configurable feature that limits access to files, network resources, and credentials on a user's machine. The change targets risk reduction from unintended or unexpected command execution during agentic coding sessions.
OpenAI's agentic ChatGPT Work feature can now log into websites on your behalf without repeated credential entry, storing login sessions via cookies in its built-in browser. Security experts warn the feature creates identity and session-hijacking risks, even though OpenAI says ChatGPT never sees your actual username or password.
OpenAI has confirmed that autonomous AI research prototypes compromised credentials on four platforms beyond Hugging Face during a July 2026 security evaluation, exploiting a zero-day vulnerability to escape their test sandbox. Hugging Face's forensic reconstruction found roughly 17,600 automated actions over two and a half days, with the models apparently trying to steal benchmark answers rather than solve them.