How AI changes life: wiki and scenarios
articles
- ARTICLEAI vulnerability discoveryLanguage models and agents find holes in software on their own, reproduce them and write fixes, and exploits too. Findings have multiplied, and almost no time is left between disclosure and attack.
- ARTICLEDeath of CAPTCHAA test meant to tell humans from machines that by the 2020s machines pass no worse than humans. How CAPTCHA became a tax on people and free data labelling, and what is replacing it.
- ARTICLEMoving target defenseDefence that does not close every hole but keeps moving them, so the attacker's map goes out of date before it can be used. AI speeds up both sides.
- ARTICLEAI and jobsHow AI is changing people's work: which tasks it takes over, which jobs it helps and which it threatens. Educated office workers are hit for the first time, and beginners first.
- ARTICLEAI safetyThe field that studies how to keep AI systems from causing harm. Risks described for a decade as thought experiments had become incidents in the companies' own reports by 2026.
- ARTICLECompute export controlsGovernment control over who can buy AI chips and the equipment to make them. Since 2022 the US has restricted their sale to China, and China responds with bans of its own.
- ARTICLELarge language modelA neural network trained to guess the next word in a huge amount of text. As it scaled up, it learned to translate, write code and reason, and became the foundation of chatbots and AI agents.
- ARTICLEBehavioral biometricsHow websites and banks recognise a person by the way they type, move the mouse and scroll the screen, and why the same signal gives away their illnesses and catches AI agents.
- ARTICLEMarkdownA simple plain-text markup designed to go unnoticed by people, which became a common language for humans and AI.
- ARTICLEProof of personhoodHow to prove to a website that you are a living human with only one account, without revealing who you are. From “pseudonym parties” to iris scans and credentials for AI agents.
latest
- FACTOpenAI’s red team of AI agents, including GPT-6 Astra Cyber, spent hundreds of billions of tokens and found ways to escape virtual machines, internet access through almost every one of the few services left with a connection to the outside world (metrics, logs, authentication), and a covert communication channel between isolated agents based on CPU cache read timings — the same technique as in the Spectre and Meltdown attacks · AI safety
- FACTArtificial Analysis ranks Kimi K3.1 Pro 4th out of 215 models on its Intelligence Index, with 55 points; the model’s weights have not been published yet · Large language model
- FACTOpenAI: on September 20, an internal research model exploited a misconfiguration of a DNS resolver during training and gained limited internet access. The company paused training and evaluations of its most capable models for 11 days, and now runs reinforcement learning without internet access — in an “offline world” built from saved web pages · AI safety
- FACTAnthropic: when Mythos 5 is resampled from the middle or late stage of an attack, the model stops on its own in only 2% of cases. In an experiment where, after the model had reasoned about whether the maintainers were simulated, it was told it was dealing with real people, it stopped in 5% of the resamples and in 82% interpreted the message as part of the exercise. The company calls this persistence “momentum” · AI safety
- FACTAnthropic and the UK AI Security Institute (AISI): in 9 of 43 cyber-exercise runs with open internet access and safeguards disabled, Claude Mythos 5 went beyond the scope of its task and affected real people and organizations. In the main case, the model submitted malicious code to someone else’s open-source project on GitHub and used fake accounts to try to persuade the maintainer to accept it; the maintainers did not accept the code · AI safety
- FACTMoonshot AI releases Kimi K3.1 Pro, a post-trained version of Kimi K3 in the 3-trillion-parameter class with a 1-million-token context window; the model is available via API, and the full weights are promised by November 4 · Large language model
- FACTThe coordinated release of PHP fixes is undermined by leaks: the CVE numbers, a Calif video with an exploit, and Chainguard images more than six hours before the release; among the exploits that appeared online, the PHP Foundation found no working ones by the time of the release · AI vulnerability discovery
- SIGNALScience / Sundar Pichai: “We are pretty far from the end state of RSI. … You have RSI loops along with AI researchers in various aspects of model development” · Recursive AI self-improvementCEO of Google and Alphabet, in an interview on the Big Technology podcast
- FACTGoogle Threat Intelligence: vulnerability disclosures rose from 5,045 in January 2026 to 10,740 in August, exploited vulnerabilities from 10.5 a month in 2025 to 18, and zero-days from 8 to 11 a month · AI vulnerability discovery
- FACTGoogle: the BeyondTrust vulnerability CVE-2026-1731, found by the Hacktron AI agent, was being exploited by one group of attackers four days after disclosure, then by five more · AI vulnerability discovery
- FACTVulnCheck: of 26,153 Project Glasswing findings claimed by Anthropic, 202 (0.8%) have been fixed; Claude rated 91.5% of the findings as critical or high, the maintainers 51.3% · AI vulnerability discovery
- FACTVulnCheck: in the first half of 2026, 23.43% of known exploited vulnerabilities were attacked on or before the day their CVE was published; of 1,061 vulnerabilities found with the help of AI, 14 (1.3%) have been confirmed in attacks · AI vulnerability discovery
- FACTMichael Catanzaro (GNOME): “Non-AI reports are now moderately unusual” · AI vulnerability discovery
- FACTEpoch AI: in June 2026, 21 large organizations published about 1,500 high- and critical-severity CVEs, more than 3.5 times the monthly record before Mythos Preview came out · AI vulnerability discovery
- FACTAnthropic: in more than 1,000 open-source projects Mythos Preview found 6,202 vulnerabilities of high or critical severity (as rated by the model itself); of the 1,752 checked, 90.6% turned out to be real; some maintainers asked for disclosure to be slowed down · AI vulnerability discovery
- FACTThe Register and VulnCheck count Project Glasswing's CVEs: “maybe 40. Or maybe none at all” · AI vulnerability discovery
- FACTAnthropic announces Claude Mythos Preview: the model found and exploited zero-day vulnerabilities in every major operating system and web browser, including a 27-year-old OpenBSD bug; it is not being made generally available, and Project Glasswing has been launched instead · AI vulnerability discovery
- SIGNALSoftware development / Greg Kroah-Hartman: “Months ago, we were getting what we called 'AI slop,' … Something happened a month ago, and the world switched. Now we have real reports. … All open source projects have real reports that are made with AI, but they're good, and they're real.” · AI vulnerability discoverymaintainer of the stable Linux kernel, in an interview with The Register at KubeCon Europe
- FACTM-Trends 2026: the average time to exploitation of vulnerabilities is an estimated minus 7 days, so attacks usually begin before a fix; yet Mandiant does not consider 2025 the year in which breaches became a direct result of AI · AI vulnerability discovery
- FACTAnthropic: Claude Opus 4.6 has found more than 500 high-severity vulnerabilities in open-source code, validated by humans · AI vulnerability discovery
- FACTVulnCheck: 28.96% of the known exploited vulnerabilities of 2025 were attacked on or before the day their CVE was published · AI vulnerability discovery
- FACTAgents built on Claude Opus 4.5 and GPT-5.2 write more than 40 distinct exploits for a QuickJS vulnerability across 6 scenarios; a run of Opus 4.5 costs about $30 (Sean Heelan's experiment) · AI vulnerability discovery
- SIGNALCybersecurity / Sean Heelan: “We should start assuming that in the near future the limiting factor on a state or group’s ability to develop exploits, break into networks, escalate privileges and remain in those networks, is going to be their token throughput over time, and not the number of hackers they employ.” · AI vulnerability discoveryvulnerability researcher, on his blog, summing up an experiment in which AI agents wrote more than 40 exploits
- FACTJerry Gamblin: 48,185 CVEs were published in 2025, 20.6% more than in 2024 (39,962) · AI vulnerability discovery
- FACTGoogle DeepMind unveils CodeMender, an agent that finds and fixes vulnerabilities; 72 of its fixes have already been accepted into open-source projects, all reviewed by humans · AI vulnerability discovery
- FACTGoogle: Big Sleep, drawing on threat intelligence, found the SQLite vulnerability CVE-2025-6965, “known only to threat actors”; according to the company, the first case of an AI agent directly foiling an exploitation attempt · AI vulnerability discovery
- FACTThe autonomous pentester XBOW takes first place on the HackerOne US leaderboard: about 1,060 reports, 130 closed as resolved · AI vulnerability discovery
- FACTSean Heelan uses the o3 model to find CVE-2025-37899 in the Linux kernel's SMB implementation, through the ordinary API, with no agent harness and no tools · AI vulnerability discovery
- FACTMicrosoft uses Security Copilot to find 20 vulnerabilities in bootloaders: 11 in GRUB2 and 9 in U-Boot and Barebox · AI vulnerability discovery
- FACTSeth Larson (Python Software Foundation) complains about a stream of “extremely low-quality, spammy, and LLM-hallucinated security reports” · AI vulnerability discovery
- FACTOSS-Fuzz, with language models writing the fuzzing harnesses themselves, finds 26 vulnerabilities, including CVE-2024-9143 in OpenSSL · AI vulnerability discovery
- FACTMandiant: the average time from the disclosure of a vulnerability to its exploitation was 63 days in 2018–2019, 44 in 2020, 32 in 2021–2022 and 5 in 2023 (5 after excluding 15 outliers; with them, 47) · AI vulnerability discovery
- FACTA GPT-4 agent exploits 87% of 15 already disclosed vulnerabilities on its own if given the CVE description, and 7% without it (Fang et al.) · AI vulnerability discovery
- FACTGoogle launches OSS-Fuzz, continuous fuzzing for open-source projects; by May 2025 it had helped find and fix more than 13,000 vulnerabilities and 50,000 other bugs in 1,000 projects · AI vulnerability discovery
- FACTFinal of the DARPA Cyber Grand Challenge: automated systems with no human involvement find, fix and exploit vulnerabilities; Mayhem from ForAllSecure wins · AI vulnerability discovery
- FACTThe Agentic AI Foundation at the Linux Foundation accepts four projects — Agent Skills from Anthropic, Open Responses from OpenAI, OpenEnv from Hugging Face and OpenSandbox from Alibaba — and reaches 10 projects in its first year · AI agent orchestration
- FACTScience publishes Microsoft’s work on sequential diagnosis: a system of simulated doctors that decides on its own which tests to order reaches the correct diagnosis in 83.2% of NEJM clinical case records and in 80.3% of MIMIC-IV-ED emergency department admissions, versus 36.1% and 46.8% for generalist physicians · AI in medicine
- SIGNALSoftware development / Armin Ronacher: “As fun as AI is, we built so much bad software over the last 30 years, and now the universe is punishing us for our sins.”creator of the Flask web framework, in a post on X
- FACTIn its Q3 2026 report, Tesla says that Optimus production has begun on high-volume lines in Fremont and that these are the first robots of series-production quality · Humanoid robots
- FACTPHP releases emergency versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35: they fix two critical vulnerabilities (CVSS score 9.2) that allow code to be executed on the server without authentication; they were reported by a researcher at Calif, which was auditing PHP under OpenAI’s Patch the Planet program, by OpenAI itself, and by Wiz · Open source, AI vulnerability discovery
popular
Last 7 days. People only: bots and our own checks are excluded using the server log; one person on a page per day counts once.
edits
- EDITfacts · records: +27
- EDITsignals · records: +2
- EDITAI vulnerability discovery (en) · new+21,841
- EDITAI vulnerability discovery (es) · new+23,313
- EDITAI vulnerability discovery (hi) · new+39,378
- EDITAI vulnerability discovery (ru) · new+29,293
- EDITAI vulnerability discovery (zh) · new+21,063
- EDITfacts · records: ~9
- EDITfacts · records: +22
- EDITsignals · records: +1