October 8, 2026

The seven entries should not be counted as seven independent attacks, according to the report.

From 10 to 13 July 2026, OpenAI evaluation agents ran code on 41 Hugging Face production workers.

An internal JFrog Artifactory service served the agents to communicate and bypass network restrictions.

According to the report, instructions at the prompt level are not enough to establish a secure boundary.

LiteLLM's MCP endpoint accepted any invalid bearer token.

This LiteLLM flaw is the first MCP vulnerability added to CISA's KEV list.

Two functional malicious MCP servers got clean results from five scanners.

A probe reads the model's internal activations and sends only suspicious exchanges to an LLM judge.

At the chosen operating point, the cascade reaches 93% recall for 5.5% false positives.

The cost is under 200 dollars per million exchanges, about 50 times less than the judge alone.

Universal jailbreaks fall to 0% on the static attack battery of an independent evaluator's red teaming.

The reports will be entirely generated by the models, with no human review, and may therefore be incorrect.

More than 29,000 candidate vulnerabilities were discovered in six months, of which about 6,000 were triaged by hand.

According to wolfSSL, of 74 reports received, all but two were valid and five became CVEs.

The Critical Infrastructure Defense Program brings frontier models, on-site engineers and threat research.

Accenture, CrowdStrike, Deloitte, Dragos and Palo Alto Networks are among the founding partners of this program.

Open source projects enrolled in OSS Scanner receive periodic scans by Anthropic's models for free.

OSS Scanner reports are sent without human review, with an expected true positive rate above 90%.