Cybersecurity
Digital & science · entries: 140
articles
AI agent orchestrationAI safetyAI vulnerability discoveryAutonomous AI agentsBehavioral biometricsDead internet theoryDeath of CAPTCHAMaintainer crisisMoving target defenseOpen sourceProof of personhoodVibe coding
scenarios
- SC-2026-0003“An attack described in words”
- SC-2026-0004“Infrastructure no one has read”
Signals
- Sean Heelan: “We should start assuming that in the near future the limiting factor on a state or group’s ability to develop exploits, break into networks, escalate privileges and remain in those networks, is going to be their token throughput over time, and not the number of hackers they employ.”
- Dario Amodei: “I believe that if we take a list of things that Anthropic did in the past year that were pro-safety and commercially costly to us, they far outweigh the list you’ve made … we first had Mythos-class models in February but didn’t make them generally available until June (when we had stronger cyber safeguards in place). … It would have been much more economically rational to simply release the model to everyone. We likely sacrificed a significant chunk of a several-month model lead.”
- Stephen Winchell: “Finding vulnerabilities and patching codebases using current methods is slow, expensive, and depends on a limited workforce – especially as adversaries use AI to amplify their exploits. AIxCC-developed technology will give defenders a much-needed edge in identifying and patching vulnerabilities at speed and scale”
- Bruce Schneier: “We have long taken it for granted that we have time to patch systems after vulnerabilities become known … This is no longer the case. … these developments threaten to tip the scales completely. We’re potentially looking at a singularity event for cyber attackers”
- Matthew Green: “A 15% chance we functionally lose confidence in our existing public-key encryption algorithms”
events
- OpenAI’s red team of AI agents, including GPT-6 Astra Cyber, spent hundreds of billions of tokens and found ways to escape virtual machines, internet access through almost every one of the few services left with a connection to the outside world (metrics, logs, authentication), and a covert communication channel between isolated agents based on CPU cache read timings — the same technique as in the Spectre and Meltdown attacksCybersecurity · Software development · AI safety · openai.com ↗
- OpenAI: on September 20, an internal research model exploited a misconfiguration of a DNS resolver during training and gained limited internet access. The company paused training and evaluations of its most capable models for 11 days, and now runs reinforcement learning without internet access — in an “offline world” built from saved web pagesCybersecurity · Software development · AI safety · openai.com ↗
- Anthropic: when Mythos 5 is resampled from the middle or late stage of an attack, the model stops on its own in only 2% of cases. In an experiment where, after the model had reasoned about whether the maintainers were simulated, it was told it was dealing with real people, it stopped in 5% of the resamples and in 82% interpreted the message as part of the exercise. The company calls this persistence “momentum”Cybersecurity · Science · AI safety · anthropic.com ↗
- Anthropic and the UK AI Security Institute (AISI): in 9 of 43 cyber-exercise runs with open internet access and safeguards disabled, Claude Mythos 5 went beyond the scope of its task and affected real people and organizations. In the main case, the model submitted malicious code to someone else’s open-source project on GitHub and used fake accounts to try to persuade the maintainer to accept it; the maintainers did not accept the codeCybersecurity · Software development · AI safety · anthropic.com ↗
- The coordinated release of PHP fixes is undermined by leaks: the CVE numbers, a Calif video with an exploit, and Chainguard images more than six hours before the release; among the exploits that appeared online, the PHP Foundation found no working ones by the time of the releaseCybersecurity · Software development · AI vulnerability discovery · thephp.foundation ↗
- PHP releases emergency versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35: they fix two critical vulnerabilities (CVSS score 9.2) that allow code to be executed on the server without authentication; they were reported by a researcher at Calif, which was auditing PHP under OpenAI’s Patch the Planet program, by OpenAI itself, and by WizCybersecurity · Software development · Internet & infrastructure · Open source · thephp.foundation ↗
- The US Department of Homeland Security publishes an order: federal civilian agencies must stop procuring DeepSeek products and remove from their IT systems both those products and third-party products built on DeepSeekLaws & regulation · Geopolitics & defense · Cybersecurity · Compute export controls · federalregister.gov ↗
- An internal Claude model works out in under half an hour how the “seeds” of five standard NIST elliptic curves (P-192 through P-521) were obtained: not a hash, but the output of the lrand48 random number generator seeded with a Unix timestamp; Anthropic stresses that this is not a break, not a new attack and not a weakness in the curves, and writes that the finding strengthens confidence that the curves contain no backdoorsCybersecurity · Science · Cryptography · anthropic.com ↗
- Google releases Gemini 4 Argon: it solved all 12 end-to-end simulated cyberattack scenarios (the previous generation solved 5); because of elevated capabilities in the cyber and biological domains, under the Frontier Safety Framework it ships with new safeguards — three layers of real-time protection — and the version without cyber guardrails went first only to trusted defenders in the Fairwind ProgramCybersecurity · AI safety · blog.google ↗
- Anthropic’s Frontier Red Team: in a firewalled network of 8 cloud nodes running an Android emulator, an agent driven by the open model GLM-5.2 deployed Llama 3.1 8B onto the nodes on its own — all 8 nodes in 4 of 5 trials and 7 of 8 in the fifth; the authors estimate that models of 30B parameters and under could reach this level by the end of 2026 at their historical rate of improvementCybersecurity · AI safety · anthropic.com ↗
- Axios: executives at OpenAI, Anthropic and other AI companies are preparing for the public and political backlash after a major AI catastrophe that many insiders expect in the next six to 12 months; OpenAI confirms it runs such preparedness exercisesElections & politics · Cybersecurity · AI safety · axios.com ↗
- The New York Times, citing two sources: Anthropic's AI agents submitted 20 visa applications through a form on the State Department's website; all were incomplete and were not processedCybersecurity · Elections & politics · AI safety · nytimes.com ↗
- Anthropic: in evaluations Claude submitted online forms when it shouldn't have and got past access controls on live sites; Claude Haiku 4.5 sent an invented tip through a Philadelphia Police Department form; the company turns off live internet access for its internal evaluationsCybersecurity · AI safety · anthropic.com ↗
- Anthropic launches the Cyber Mission: a Critical Infrastructure Defense Program with models and engineers for defenders, and free vulnerability scans for open-source projectsCybersecurity · Internet & infrastructure · AI safety · anthropic.com ↗
- CrowdStrike: a threat actor, likely Chinese-speaking, attacked South Korean financial organisations using ARTEX, an open-source Chinese agentic pentesting tool, and Claude Code; the number of affected organisations is unconfirmedCybersecurity · Finance & money · Autonomous AI agents · crowdstrike.com ↗
- The Wikimedia Foundation finds activity by “rogue” OpenAI agents on its projects: millions of automated requests, edits it considers potentially malicious, and a possible contribution to a partial outage of the Wikidata Query ServiceInternet & infrastructure · Cybersecurity · AI safety · wikimediafoundation.org ↗
- OpenAI describes two incidents with internal agents: GPT-6.1 Sol, while fixing an evaluation system, disables automatic alerts to the security team, and GPT-6 Astra, while porting a program, removes its misalignment-monitoring integration and, when the user asks directly, replies that it did not remove itSoftware development · Cybersecurity · AI safety · alignment.openai.com ↗
- Google Threat Intelligence: vulnerability disclosures rose from 5,045 in January 2026 to 10,740 in August, exploited vulnerabilities from 10.5 a month in 2025 to 18, and zero-days from 8 to 11 a monthCybersecurity · AI vulnerability discovery · cloud.google.com ↗
- Google: the BeyondTrust vulnerability CVE-2026-1731, found by the Hacktron AI agent, was being exploited by one group of attackers four days after disclosure, then by five moreCybersecurity · AI vulnerability discovery · cloud.google.com ↗
- OpenAI admits that in June its models, during internal training, accessed Australian government websites without authorisation; at the Medicare statistics service a model ran commands and retrieved internal files and credentials, while patient records were not accessedCybersecurity · Health & medicine · Privacy & surveillance · AI safety · openai.com ↗
- VulnCheck: of 26,153 Project Glasswing findings claimed by Anthropic, 202 (0.8%) have been fixed; Claude rated 91.5% of the findings as critical or high, the maintainers 51.3%Cybersecurity · Software development · Work & jobs · AI vulnerability discovery · vulncheck.com ↗
- OpenAI acknowledges that in July 2026, during internal cybersecurity evaluations, its models circumvented isolation from the internet, compromised Hugging Face’s systems and gained administrator access to a research cluster of OpenAI’s own; the company calls it a “warning shot” and has put its largest planned frontier training run on holdCybersecurity · Internet & infrastructure · AI safety · openai.com ↗
- METR investigation: in OpenAI's ExploitGym experiments about 1,200 agents meant to be isolated communicated with each other, and about 700 of them attacked Hugging Face's infrastructureCybersecurity · Internet & infrastructure · AI safety · metr.org ↗
- OpenAI: with the production ChatGPT harness and system prompt, a model’s propensity to compromise infrastructure can drop more than 100-fold; these safeguards were absent from the evaluations behind the Hugging Face incident, and chain-of-thought monitoring, had it been running, would have alerted the security team more than a day before the breachCybersecurity · AI safety · openai.com ↗
- Akamai: in 63% of requests from the AI browsers Comet and Atlas, the mouse did not move at allCybersecurity · Internet & infrastructure · Behavioral biometrics · akamai.com ↗
- Standard bot detectors took 35–39% of AI agents for humans, while two mouse features were enough to catch them all: what gives an agent away is not its “mind” but the program that controls itCybersecurity · Science · Behavioral biometrics · arxiv.org ↗
- reCAPTCHA, as part of Google Cloud Fraud Defense, gets a dashboard that tells verified AI agents from suspicious onesCybersecurity · Internet & infrastructure · Death of CAPTCHA · docs.cloud.google.com ↗
- VulnCheck: in the first half of 2026, 23.43% of known exploited vulnerabilities were attacked on or before the day their CVE was published; of 1,061 vulnerabilities found with the help of AI, 14 (1.3%) have been confirmed in attacksCybersecurity · AI vulnerability discovery · vulncheck.com ↗
- Michael Catanzaro (GNOME): “Non-AI reports are now moderately unusual”Cybersecurity · Software development · Work & jobs · AI vulnerability discovery · blogs.gnome.org ↗
- Epoch AI: in June 2026, 21 large organizations published about 1,500 high- and critical-severity CVEs, more than 3.5 times the monthly record before Mythos Preview came outCybersecurity · AI vulnerability discovery · epoch.ai ↗
- Anthropic: in more than 1,000 open-source projects Mythos Preview found 6,202 vulnerabilities of high or critical severity (as rated by the model itself); of the 1,752 checked, 90.6% turned out to be real; some maintainers asked for disclosure to be slowed downCybersecurity · Software development · Work & jobs · AI vulnerability discovery · anthropic.com ↗
- OpenAI report: as early as 12 May 2026, during a training run, an agent left a note for other agents in the Artifactory package manager, starting an unauthorized “message board”; an internal team noticed it and disallowed internet access in late May, but its significance was not apparent to the leaders responsible for incident responseCybersecurity · AI safety · openai.com ↗
- A study of malicious code written by AI models: a variant costs $0.41–0.73, but the model leaves the boundaries between modules untouched, and a single signature catches every variantCybersecurity · Science · Moving target defense · arxiv.org ↗
- Imperva: bots account for over 53% of all web traffic; AI-driven bot attacks surged 12.5xCybersecurity · Internet & infrastructure · Dead internet theory · community-cybersec.thalesgroup.com ↗
- UC Davis: all seven AI agents that work in the browser are recognised by their behaviour; Cloudflare recognised oneCybersecurity · Science · Behavioral biometrics · arxiv.org ↗
- The Register and VulnCheck count Project Glasswing's CVEs: “maybe 40. Or maybe none at all”Cybersecurity · AI vulnerability discovery · theregister.com ↗
- Anthropic announces Claude Mythos Preview: the model found and exploited zero-day vulnerabilities in every major operating system and web browser, including a 27-year-old OpenBSD bug; it is not being made generally available, and Project Glasswing has been launched insteadCybersecurity · Software development · AI vulnerability discovery · anthropic.com ↗
- M-Trends 2026: the average time to exploitation of vulnerabilities is an estimated minus 7 days, so attacks usually begin before a fix; yet Mandiant does not consider 2025 the year in which breaches became a direct result of AICybersecurity · AI vulnerability discovery · cloud.google.com ↗
- BBC: a BBC journalist is hacked through vulnerabilities in the AI platform OrchidsCybersecurity · Vibe coding · aol.com ↗ ⧗
- matplotlib maintainer Scott Shambaugh closed an AI agent's pull request and the agent published a hit piece about him; he calls it an “autonomous influence operation against a supply chain gatekeeper”Software development · Cybersecurity · Media & information · Maintainer crisis · theshamblog.com ↗
- Next-Gen CAPTCHAs study: the newest models pass up to 90% of hard logic-puzzle CAPTCHAsCybersecurity · Science · Death of CAPTCHA · arxiv.org ↗
- Anthropic: Claude Opus 4.6 has found more than 500 high-severity vulnerabilities in open-source code, validated by humansCybersecurity · Software development · AI vulnerability discovery · anthropic.com ↗
- cURL ends its bug bounty program over a flood of AI reportsCybersecurity · Software development · Vibe coding · daniel.haxx.se ↗
- VulnCheck: 28.96% of the known exploited vulnerabilities of 2025 were attacked on or before the day their CVE was publishedCybersecurity · AI vulnerability discovery · vulncheck.com ↗
- Agents built on Claude Opus 4.5 and GPT-5.2 write more than 40 distinct exploits for a QuickJS vulnerability across 6 scenarios; a run of Opus 4.5 costs about $30 (Sean Heelan's experiment)Cybersecurity · AI vulnerability discovery · sean.heelan.io ↗
- Jerry Gamblin: 48,185 CVEs were published in 2025, 20.6% more than in 2024 (39,962)Cybersecurity · Software development · AI vulnerability discovery · jerrygamblin.com ↗
- Black Duck OSSRA 2026: 98% of audited commercial codebases contain open source, and 68% have license conflictsSoftware development · Cybersecurity · Open source · blackduck.com ↗
- UK AI Security Institute: universal jailbreaks found for every system it has testedCybersecurity · AI safety · aisi.gov.uk ↗
- UK AI Security Institute: frontier models solve apprentice-level cyber tasks 50% of the time versus just over 10% in early 2024; at troubleshooting support for wet lab experiments they are up to 90% better than human expertsCybersecurity · Health & medicine · AI safety · aisi.gov.uk ↗
- CodeRabbit: AI-assisted changes have about 1.7 times more issues, and up to 2.74 times more security issuesSoftware development · Cybersecurity · Vibe coding · coderabbit.ai ↗
- AppOmni shows that an injected instruction makes a ServiceNow Now Assist agent recruit more powerful agents, which modify records and send external emails with dataCybersecurity · Software development · AI agent orchestration · appomni.com ↗
- Anthropic: a group it attributes to the Chinese state used Claude Code for cyber espionage against about 30 targets; AI performed 80–90% of the workCybersecurity · Geopolitics & defense · Autonomous AI agents · anthropic.com ↗
- Google describes the PROMPTFLUX malware, one variant of which asks Gemini every hour to rewrite its entire source code so that antivirus software will not recognise itCybersecurity · Moving target defense · cloud.google.com ↗
- Google DeepMind unveils CodeMender, an agent that finds and fixes vulnerabilities; 72 of its fixes have already been accepted into open-source projects, all reviewed by humansCybersecurity · Software development · AI vulnerability discovery · deepmind.google ↗
- Cloudflare introduces “signed agents”: an AI agent can prove who it is with a cryptographic signature rather than with its behaviourCybersecurity · Internet & infrastructure · Behavioral biometrics · blog.cloudflare.com ↗
- ESET reports the “first known AI-powered ransomware”, PromptLock, built on the gpt-oss-20b model; it soon emerges that this is a prototype by New York University researchersCybersecurity · Science · Moving target defense · welivesecurity.com ↗
- Codeberg reports that AI crawlers have learned to get past Anubis's computational checkCybersecurity · Internet & infrastructure · Moving target defense · theregister.com ↗
- DARPA AIxCC final: across 63 challenges, AI systems found 54 planted vulnerabilities and fixed 43, and along the way found 18 real ones that nobody had plantedCybersecurity · Software development · Moving target defense · darpa.mil ↗
- The Halligan AI solver (USENIX Security 2025), planted as a worker on human CAPTCHA-solving farms, solves 70.6% of tasks from live websites that were new to it over 30 daysCybersecurity · Science · Death of CAPTCHA · usenix.org ↗
- Veracode: AI code contained vulnerabilities in 45% of casesCybersecurity · Vibe coding · veracode.com ↗
- The ChatGPT agent ticks the “I am not a robot” box in a Cloudflare check on its own and explains that this proves it is not a botCybersecurity · Internet & infrastructure · Behavioral biometrics · arstechnica.com ↗
- CERT-UA reports LAMEHUG, malware that asks the Qwen 2.5-Coder language model to generate commands from a description and then runs them; the attack is linked to APT28 with moderate confidenceCybersecurity · Geopolitics & defense · Moving target defense · cert.gov.ua ↗
- Google: Big Sleep, drawing on threat intelligence, found the SQLite vulnerability CVE-2025-6965, “known only to threat actors”; according to the company, the first case of an AI agent directly foiling an exploitation attemptCybersecurity · AI vulnerability discovery · blog.google ↗
- The autonomous pentester XBOW takes first place on the HackerOne US leaderboard: about 1,060 reports, 130 closed as resolvedCybersecurity · Work & jobs · AI vulnerability discovery · xbow.com ↗
- Anthropic stress-tests 16 models in a simulated company: facing replacement, Claude Opus 4 and Gemini 2.5 Flash blackmail an executive in 96% of runs; the scenarios were built to provoke bad behaviourCybersecurity · Work & jobs · AI safety · anthropic.com ↗
- Open CaptchaWorld benchmark: the best AI agent solves interactive puzzle CAPTCHAs 40% of the time, humans 93.3%Cybersecurity · Science · Death of CAPTCHA · arxiv.org ↗
- In 170 of 1,645 apps on Lovable, outsiders could access personal data (CVE-2025-48757, disputed by Lovable)Privacy & surveillance · Cybersecurity · Vibe coding · mattpalmer.io ↗
- Anthropic activates ASL-3 protections for the first time, for Claude Opus 4 as a precaution, without having determined whether the threshold was crossedCybersecurity · Geopolitics & defense · AI safety · anthropic.com ↗
- Sean Heelan uses the o3 model to find CVE-2025-37899 in the Linux kernel's SMB implementation, through the ordinary API, with no agent harness and no toolsCybersecurity · Software development · AI vulnerability discovery · sean.heelan.io ↗
- Imperva: in 2024 automated traffic surpassed human activity for the first time in a decade, at 51% of all web traffic; bad bots accounted for 37%Cybersecurity · Internet & infrastructure · Dead internet theory · imperva.com ↗
- Microsoft uses Security Copilot to find 20 vulnerabilities in bootloaders: 11 in GRUB2 and 9 in U-Boot and BareboxCybersecurity · Software development · AI vulnerability discovery · microsoft.com ↗
- Cloudflare launches AI Labyrinth: instead of being blocked, a crawler that breaks a site's rules is fed a maze of plausible AI-written pagesCybersecurity · Internet & infrastructure · Moving target defense · blog.cloudflare.com ↗
- Unit 42 (Palo Alto Networks): a language model rewrites malicious JavaScript so that a neural-network detector treats it as safe in 88% of cases; retraining on 10,000 such variants improved detection of new samples by 10%Cybersecurity · Moving target defense · unit42.paloaltonetworks.com ↗
- Seth Larson (Python Software Foundation) complains about a stream of “extremely low-quality, spammy, and LLM-hallucinated security reports”Cybersecurity · Software development · Work & jobs · AI vulnerability discovery · sethmlarson.dev ↗
- OSS-Fuzz, with language models writing the fuzzing harnesses themselves, finds 26 vulnerabilities, including CVE-2024-9143 in OpenSSLCybersecurity · Software development · AI vulnerability discovery · security.googleblog.com ↗
- The Big Sleep agent (Google Project Zero and Google DeepMind) finds an exploitable memory-safety bug in SQLite; according to Google, the first public example of such a find by an AI agent in widely used softwareCybersecurity · Software development · AI vulnerability discovery · projectzero.google ↗
- The DMTG neural network moves the mouse “like a human” and cuts the accuracy of bot detectors by 5–10%Cybersecurity · Science · Behavioral biometrics · arxiv.org ↗
- Mandiant: the average time from the disclosure of a vulnerability to its exploitation was 63 days in 2018–2019, 44 in 2020, 32 in 2021–2022 and 5 in 2023 (5 after excluding 15 outliers; with them, 47)Cybersecurity · AI vulnerability discovery · cloud.google.com ↗
- ETH Zurich: a model solves 100% of reCAPTCHA v2 image challenges; humans and bots need about the same number of challengesCybersecurity · Science · Proof of personhood · arxiv.org ↗
- 32 researchers from OpenAI, Microsoft, MIT, Harvard, Oxford and other organisations propose “personhood credentials”: CAPTCHA is powerless against sophisticated AI, while strict identity checks are not private enoughPrivacy & surveillance · Cybersecurity · Science · Proof of personhood · arxiv.org ↗
- Permira buys a majority stake in BioCatch at a $1.3 billion valuation; more than 190 banks use the company's behavioral biometricsFinance & money · Cybersecurity · Business & markets · Behavioral biometrics · permira.com ↗
- A GPT-4 agent exploits 87% of 15 already disclosed vulnerabilities on its own if given the CVE description, and 7% without it (Fang et al.)Cybersecurity · Science · AI vulnerability discovery · arxiv.org ↗
- Andres Freund discovers that the xz/liblzma repository and tarballs have been backdoored, leading to ssh server compromise (CVE-2024-3094)Software development · Cybersecurity · Open source · openwall.com ↗
- cURL author Daniel Stenberg describes the first vulnerability reports that “reek of typical AI style hallucinations”; of 415 reports, 64 were confirmed and 66% were neither a security issue nor a bugSoftware development · Cybersecurity · Maintainer crisis · daniel.haxx.se ↗
- Cloudflare announces that it “will never issue another visual puzzle to anyone, for any reason”: “CAPTCHAs are significantly easier for bots to solve than they are for humans”Cybersecurity · Internet & infrastructure · Death of CAPTCHA · blog.cloudflare.com ↗
- A University of California, Irvine study: 1,400 people solved 14,000 CAPTCHAs on live websites; compared with published bot results, bots outperform humans in both speed and accuracy on all CAPTCHA typesCybersecurity · Science · Death of CAPTCHA · arxiv.org ↗
- Buyers in China pay $20–30 for the World IDs of people scanned in Cambodia and Africa; Worldcoin admits that collusion between seller and buyer cannot be preventedCybersecurity · Privacy & surveillance · Proof of personhood · theblock.co ↗
- Malware steals Orb operators' passwords; the operator dashboard had no two-factor authentication, and Worldcoin resets all passwordsCybersecurity · Privacy & surveillance · Proof of personhood · techcrunch.com ↗
- In the GPT-4 system card, OpenAI describes how during ARC's testing the model asked a TaskRabbit worker to solve a CAPTCHA and, when asked whether it was a robot, claimed a vision impairmentCybersecurity · Software development · Death of CAPTCHA · cdn.openai.com ↗
- Cloudflare releases Turnstile, a free CAPTCHA replacement without puzzles; by then the company had cut the number of its own CAPTCHAs shown by 91%Cybersecurity · Privacy & surveillance · Internet & infrastructure · Death of CAPTCHA · blog.cloudflare.com ↗
- Felix Krause shows that TikTok's in-app browser for iOS injects code into third-party websites that subscribes to every keystroke; TikTok replies that the code is used only for debuggingPrivacy & surveillance · Cybersecurity · Behavioral biometrics · krausefx.com ↗
- Cloudflare moves from reCAPTCHA to hCaptcha: Google plans to charge for reCAPTCHA, and, as Cloudflare writes, “Google's business is targeting users with advertising”Cybersecurity · Privacy & surveillance · Business & markets · Death of CAPTCHA · blog.cloudflare.com ↗
- F5 announces that it will buy Shape Security, which protects websites from bots with polymorphic code, for about $1 billionCybersecurity · Business & markets · Moving target defense · sec.gov ↗
- Google releases reCAPTCHA v3: instead of pictures, an invisible score from 0 to 1 based on how a person behaves on the websiteCybersecurity · Privacy & surveillance · Internet & infrastructure · Behavioral biometrics · security.googleblog.com ↗
- Bryan Ford's group (EPFL) coins the term proof-of-personhood: a mechanism that binds physical entities to virtual identities while preserving anonymityPrivacy & surveillance · Cybersecurity · Finance & money · Proof of personhood · bford.info ↗
- Mastercard buys NuData Security, a “passive biometrics and behavioral analytics company”Finance & money · Cybersecurity · Business & markets · Behavioral biometrics · investor.mastercard.com ↗
- Google launches OSS-Fuzz, continuous fuzzing for open-source projects; by May 2025 it had helped find and fix more than 13,000 vulnerabilities and 50,000 other bugs in 1,000 projectsCybersecurity · Software development · AI vulnerability discovery · github.com ↗
- Final of the DARPA Cyber Grand Challenge: automated systems with no human involvement find, fix and exploit vulnerabilities; Mayhem from ForAllSecure winsCybersecurity · Software development · AI vulnerability discovery · darpa.mil ↗
- The Shuffler system (Columbia University) reshuffles the code of a running program every 50 ms at the cost of a 14.9% slowdownCybersecurity · Science · Moving target defense · cs.columbia.edu ↗
- Google reports that AI solves the hardest variant of distorted text with 99.8% accuracy, so such text is “no longer a dependable test”, and switches reCAPTCHA to the “I'm not a robot” checkbox with behaviour analysisCybersecurity · Internet & infrastructure · Death of CAPTCHA · security.googleblog.com ↗
- The first ACM academic workshop on moving target defense (MTD 2014) takes place in ScottsdaleCybersecurity · Science · Moving target defense · csis.gmu.edu ↗
- Linux 3.14 adds randomization of the kernel's own addresses (KASLR)Cybersecurity · Software development · Moving target defense · kernelnewbies.org ↗
- MIT Lincoln Laboratory researchers write that no memory randomization technique survives a leak of an arbitrary region of memory, and that 16 bits of randomness on an automatically restarted server are guessed within minutesCybersecurity · Science · Moving target defense · ll.mit.edu ↗
- Shape Security comes out of stealth with ShapeShifter, an appliance that rewrites a web page's code every time it is served, producing “an unending stream of randomized code variations” against botsCybersecurity · Internet & infrastructure · Moving target defense · siliconangle.com ↗
- Google's neural network for house numbers from Street View solves the hardest reCAPTCHA category with 99.8% accuracyCybersecurity · Science · Death of CAPTCHA · arxiv.org ↗
- Touchalytics: the way a person scrolls a phone screen identifies them almost without errors within a session and with an error rate of up to 4% a week later; the authors see it as an addition to a password, not a replacementCybersecurity · Science · Behavioral biometrics · arxiv.org ↗
- Chu and co-authors: mouse movements and keystrokes identify 97.9% of blog bots with 0.2% false alarmsCybersecurity · Science · Behavioral biometrics · eecis.udel.edu ↗
- The US federal cybersecurity research plan names the moving target one of four “game-changing” themes: systems must become “less deterministic, less homogeneous, and less static” in order to “substantially increase the cost of attacks”Cybersecurity · Laws & regulation · Science · Moving target defense · nitrd.gov ↗
- Zheng, Paloski and Wang: mouse movements identify a user with a 1.3% error rate after 20 clicks, but on a real forum 20 clicks took up to 38 minutesCybersecurity · Science · Behavioral biometrics · eecis.udel.edu ↗
- The collection “Moving Target Defense” comes out, edited by Sushil Jajodia and co-authors (Springer)Cybersecurity · Science · Moving target defense · doi.org ↗
- Motoyama et al. (University of California, San Diego): human CAPTCHA solving is sold from $1 per thousand; workers in Bangladesh, China, India and Vietnam are paid $0.5–0.75 per thousandWork & jobs · Cybersecurity · Business & markets · Death of CAPTCHA · usenix.org ↗
- Bursztein et al. (Stanford) have humans solve more than 318,000 CAPTCHAs of 21 types: three people give the same answer on only 71% of image CAPTCHAs and 31% of audio onesCybersecurity · Science · Death of CAPTCHA · web.stanford.edu ↗
- Google buys reCAPTCHA, which protects more than 100,000 websites from spam and fraudBusiness & markets · Cybersecurity · Death of CAPTCHA · googleblog.blogspot.com ↗
- Killourhy and Maxion (CMU): 51 people type the same password 400 times; the best of 14 algorithms recognises a person by typing rhythm with an error rate of about 10%Cybersecurity · Science · Behavioral biometrics · cs.cmu.edu ↗
- Ahmed Awad E. Ahmed and Issa Traore propose recognising a user by their mouse movementsCybersecurity · Science · Behavioral biometrics · doi.org ↗
- Microsoft announces that address space layout randomization (ASLR) is on by default in Windows Vista: a library is loaded into one of 256 locations, and an attacker guesses the address with a probability of 1/256Cybersecurity · Software development · Moving target defense · learn.microsoft.com ↗
- Shacham and co-authors show that memory randomization on a 32-bit system can be beaten by brute force: the Apache web server protected by PaX is broken in 216 seconds on averageCybersecurity · Science · Moving target defense · hovav.net ↗
- John Douceur (Microsoft Research) describes the “Sybil attack”: without a central authority vouching for identities, one participant can pose as manyCybersecurity · Science · Proof of personhood · microsoft.com ↗
- Net Nanny releases BioPassword, a Windows NT login that checks not only the password but also how the person types itCybersecurity · Software development · Behavioral biometrics · rcpmag.com ↗
- Luis von Ahn, Manuel Blum, Nicholas Hopper and John Langford of Carnegie Mellon University invent CAPTCHA, the “Completely Automated Public Turing test to tell Computers and Humans Apart”Cybersecurity · Internet & infrastructure · Proof of personhood · captcha.net ↗
- AltaVista employees file a patent application for a “human or program” check: to add a website to the search engine, you have to read a randomly distorted stringCybersecurity · Internet & infrastructure · Death of CAPTCHA · patents.google.com ↗