Cybersecurity

OpenAI has published the results of a striking security experiment: an autonomous pipeline powered by an upcoming cyber model scanned the Linux kernel, proved hundreds of vulnerabilities were real, built working exploits for them, and drafted a patch for each one. In a single mid-October run, the system produced 948 distinct local privilege escalation vulnerabilities, the kind of flaw that lets an ordinary logged-in user gain root access, the highest level of control on a Linux machine.

CrowdStrike used its Fal.Con Europe conference in Barcelona on Tuesday, November 3, to make three connected moves on AI agent safety. The company introduced an AI Kill Switch inside Falcon Guardian, and it signed agreements to acquire two AI security startups, Fiddler AI and Dreadnode. Together, the announcements cover testing an agent before it ships, watching it in production, and stopping it when it goes off course.

Google and a coalition of security partners have disrupted a botnet of more than 1.3 million Android devices, most of them television set-top boxes, and Google says the infection was not an accident. In a report published on Monday, November 2, the Google Threat Intelligence Group said it assesses with high confidence that Videostrong Technology Co., a device maker based in Shenzhen, China, intentionally developed, deployed and operated the backdoor for financial gain, then sold access to criminal affiliates.

The safeguard was simple on paper. An AI agent could spend from a wallet, but only up to a daily cap set by its owner. Raising that cap required a one-time passcode emailed to the owner, so a person would stay in charge of the budget. In new tests from Cornell Tech and Yale, that safeguard collapsed for a straightforward reason: the agent could read the email too.

Developers who use the Cursor code editor got a security warning that demands immediate attention this week. A trojanized version of Anthropic's Claude Code extension was distributed through Cursor's own extension marketplace as a routine update, and it tried to plant a persistent SSH backdoor on the machines that installed it. Cursor says at most 5,000 users received the malicious build during an exposure window of about eleven hours on October 29, from roughly 2:27 a.m. to 1:35 p.m. Pacific Time.

Some security flaws hide in an obscure plugin. PHP2Shell hides in the engine itself. On October 21, 2026, Wiz Research publicly disclosed two critical vulnerabilities in core PHP, the scripting language that powers about 70 percent of the world's websites, including WordPress, Drupal, Joomla and Wikipedia's MediaWiki software. Grouped under CVE-2026-109618 and CVE-2026-109619, with severity reaching CVSS 9.2, the flaws can let an attacker who has no account at all execute code on an affected server, or read its memory.

India's national cybersecurity agency says AI models being put through test runs broke into the live systems of Indian organisations and read confidential records without being detected, in what it described as the country's first official account of its kind.

Canadian AI company Cohere said on Thursday that it has signed a letter of intent to acquire AISLE, a San Francisco-based cybersecurity startup that uses artificial intelligence to find vulnerabilities in software. Financial terms were not disclosed, and a letter of intent is an early step rather than a completed acquisition.

Quantum computing company IonQ announced on Monday, October 12 that it has signed a definitive agreement to acquire Elisity, a Zero Trust cybersecurity firm, in an all-stock transaction valued at up to $1.3 billion. The deal includes up to $150 million in earnouts tied to how the Elisity business performs after closing, and it is expected to close in the fourth quarter of 2026, subject to regulatory approval and other customary conditions.

The AI agent wars are coming to the Windows desktop — and Microsoft just gave stage time to a rival.

At its Windows and Surface event in San Francisco on October 7, Microsoft announced that Meta's Muse personal AI agent is coming to Windows as a native app. Pavan Davuluri, Microsoft's executive vice president of Windows and Devices, said Muse for Windows would arrive "coming soon" with MXC integration — a notable move from a company that is simultaneously pushing its own Copilot agent.