There has been a fundamental shift toward industrialized cyber threats, highlighted by a record 31.4 Tbps DDoS attack and sophisticated session token theft. Our new report examines how nation-states and criminal actors have moved beyond traditional exploits to "living off the XaaS" within legitimate enterprise logic.
Investigating three real-world incidents in our cybersecurity evaluations
In a review of our cybersecurity evaluation transcripts, we found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment, and then gained unauthorized access to the real systems of three different organizations. Below we describe what happened, how it happened, and what we’re changing. We encourage other AI labs to perform similar reviews.
Cloudflare OS Review: The Security-First AI Workspace That Wants to Be Your Company's Operating System
Cloudflare OS is not a traditional computer operating system. It is an AI productivity environment—an "operating system for the company"—that originally ran inside Cloudflare's own walls before being open-sourced under the Apache 2.0 licence in August 2026. The project emerged from a real internal need:
Cybersecurity Looks Like Proof of Work Now
The UK's AI Safety Institute recently published Our evaluation of Claude Mythos Preview’s cyber capabilities, their own independent analysis of Claude Mythos which backs up Anthropic's claims that it is …
AI Cybersecurity After Mythos: The Jagged Frontier
When AISLE tested Mythos's showcase vulnerabilities on small, cheap, open-weights models, most found the same bugs. Here's what that means for cyber.
Worldwide Overview | Cloudflare Radar
Up to date global Internet trends and insights.
What happened to the fight for the Internet? -- Dustycloud Brainstorms
At the moment I am writing this, bad internet bills are being proposed across the US, Canada, Europe, and the UK. They're using the usual tactics: they claim they're fighting for kids or fighting security risks, but in general, that's what surveillance and censorship bills have always claimed.
‘Doom Loop’: OpenAI and Microsoft Admits LLMs Are Destroying the Web and Built on Theft
"Millions of people around the world will soon consider large models ‘hoovering up’ all their work to be an astonishing theft of unprecedented proportions."
Surveillance Self-Defense
We’re the Electronic Frontier Foundation, a member-supported non-profit working to protect online privacy for over thirty-five years. This is Surveillance Self-Defense: our expert guide to protecting you and your friends from online spying. Read the BASICS to find out how online surveillance works. Dive into our TOOL GUIDES for instructions...
500+ Billion Tokens Later: Letting AI Agents Decompile A First-Person Shooter
During the last 3 months, I spent some of my time and tokens decompiling a popular first-person shooter. The goal was not to reach a simple proof-of-concept state. Instead, we really wanted an accurate, stable and feature-complete recreation of the game. The avid reader of my blog might have noticed that I had previously written two posts that have since been removed. Everyone else might now be wondering which game I am talking about. To both of you I can only say that corporate America was here to ruin our fun.
Assessing Claude Mythos Preview’s cybersecurity capabilities
Claude Mythos Preview is a new general-purpose language model that is strikingly capable at computer security tasks. This post provides technical details for researchers and practitioners who want to understand exactly how we have been testing this model, and what we have found over the past month.
AI Agent Executes 'First' End-To-End Ransomware Attack - Slashdot
Sysdig says it has documented the first ransomware attack carried out end to end by an AI agent, which autonomously exploited exposed systems, stole credentials, established persistence, compromised a production database, and destroyed data. The research team named the attacker "JadePuffer" and said...
Meta CIB / ATP Dashboard
A comprehensive intelligence platform analysing 214 coordinated inauthentic behaviour and adversarial threat operations identified by Meta across 70 countries, spanning April 2018 to Q4 2025.
OpenAI’s rogue agents were caught communicating via public wikis
Here we go again... Discovery of a new OpenAI agent message board by Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts, and Thomas Larsen describes the latest accidental cyberattack by …
Project Glasswing: Securing critical software for the AI era
A new initiative to secure the world’s most critical software and give defenders a durable advantage in the coming AI-driven era of cybersecurity.
Dark Cloud Gathers as Bill Comes Due for AI Industry
AI companies are finding they can no longer sustain footing the bill of their heavily vibe coding customers.
A Short Guide to Data Strikes and Conscious Data Contribution in the Context of 2026 Frontier AI
Back to the basics of data leverage.
