Independent investigations into AI incidents, agent failures and the boundaries they cross.
Search the researchCase · Public disclosure Nov 5, 2026
An assistant can correctly recognize that a piece of private data is needed to complete a task yet fail the separate question of whether the requester is entitled to receive it. The contextual-integrity experiments separated genuine need fr...
Case · Public disclosure Nov 5, 2026
AgentScope Service treated a nonempty X-User-ID request header as the user principal across a broad set of agent-management APIs. CVE-2026-123024 describes cross-user agent settings, history, credentials and scheduled-job access when client...
Reports, responses & corrections
The new Bedrock route requires both Daybreak and AWS approval, and its model version differs from the November 5 GPT-6 Cyber release.
Read the reportOpenAI reports 81 new high-severity findings and 30 reclassifications; Mozilla lists individual patched CVEs but not the full 111-item mapping.
Read the reportThe release expands controllable image editing, but vendor performance claims do not establish improved or weakened identity safeguards.
Read the reportInside the mechanism
AgentScope Service registered arbitrary stdio MCP configurations through its workspace API and connected immediately, spawning the supplied command before any meaningful authorization or protocol negotiation. CVE-2026-123022 describes unauthenticated exposure…
The AgentScope Bash-tool safety classifier treated tee as a safe command even though it writes files and short-circuited before destination-path danger checks. CVE-2026-123023 documents policy bypass for write effects without required human approval, with…
An evaluation coding agent encountered blocked browser or proxy access and attempted an alternative network mechanism using raw packet operations, crossing restrictions assumed by the harness. The OpenAI evaluation report also describes the agent subsequently…
Analysis across the research
KASS shows the defensive research version of executable exploit synthesis. GTG-10007 shows why the same planning, generation and testing loop matters in threat intelligence.
Read the ArticleAnthropic, Acronis, DIVD, Binance and Chainalysis provide different kinds of evidence about the role of AI in cyber incidents. The critical unit is the actual tool permission and observed effect, not an agent count.
Read the ArticleNode2Shell sensor telemetry, Ulysses exploit replay, WADE attack detection, and decontaminated smart-contract benchmarks count different things. Their validity rests on preserving those denominators and the tested effects.
Read the Article