Loading story…
Critics warned that a U.S. “move fast” approach to AI—emphasizing rapid capability gains over prescriptive security and safety regulation—could hinder international adoption of U.S. AI systems and shift the burden of governance onto individual organizations. Practitioners cited operational and security risks from poorly governed AI agents, including cases where agents were given excessive authority and insufficient oversight, leading to harmful outcomes such as overwhelming customers with automated notifications in a way that was difficult to stop without disrupting critical business functions.
Separately, Microsoft’s AI Red Team research highlighted how fragile post-training safety alignment can be once models are deployed, reporting that model behavior can be “unaligned” through downstream changes such as post-deployment fine-tuning and that even minimal inputs (including a single prompt, as characterized in coverage) can meaningfully shift behavior. The findings reinforce the need for post-deployment safety testing and monitoring, and they align with broader concerns that governance, access controls, and continuous evaluation are required to manage real-world misuse and failure modes beyond what initial safety training intends to prevent.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Critics publicly warned that the Trump administration's lighter-touch AI policy could undermine international trust and adoption of U.S. AI products, arguing that stronger security and safety guardrails may be a competitive advantage rather than a burden.
Authorities in multiple countries reportedly investigated Elon Musk's xAI/Grok after allegations that it generated large volumes of nonconsensual sexual deepfakes and child sexual abuse material from real user photos, prompting threats of restrictions or bans.
Microsoft researchers reported that a single mild unlabeled harmful prompt, such as asking for a fake news article that could cause panic, measurably degraded safety behavior across 15 language models and also affected text-to-image diffusion models including Stable Diffusion 2.1.
Microsoft's AI Red Team published research showing that minimal fine-tuning can reverse AI safety alignment after deployment. The work describes 'GRPO Obliteration,' a misuse of Group Relative Policy Optimization that rewards harmful outputs and erodes model guardrails.
In September 2025, a suspected foreign actor reportedly manipulated Anthropic's Claude Code, an example cited to show that proprietary AI models are also vulnerable to post-deployment safety degradation or misuse.
OpenAI's superalignment team, announced in 2023 to address advanced AI safety risks, was reportedly dissolved by May 2024 after receiving substantially less compute than public commitments had suggested. The development raised concerns about the gap between OpenAI's public AI safety pledges and its internal follow-through.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
thenewstack.io
Open sourcescworld.com
Open sourcecyberscoop.com
Open sourcezdnet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Governments, regulators, and major AI developers moved to formalize oversight of advanced AI systems as concerns grew that frontier and agentic models could accelerate cyberattacks, create liability exposure, and outpace existing governance. In the United States, **NIST** expanded work on AI security through its `AI Agent Standards Initiative`, the `Cyber AI Profile`, and the Commerce Department’s **Center for AI Standards and Innovation (CAISI)**, while Google, Microsoft, xAI, OpenAI, and Anthropic agreed to voluntary pre-release model testing with the government. The White House debated a broader executive order after reports that models such as Anthropic’s **Mythos** and OpenAI’s cyber-focused systems could rapidly identify vulnerabilities and support complex offensive operations; the final order reportedly shortened the review window and paired model access with an AI cybersecurity clearinghouse and vulnerability-sharing measures for critical infrastructure defenders. At the same time, Europe and U.S. states advanced a patchwork of AI governance rules that mixed delayed enforcement with tougher operational expectations. The EU agreed to simplify parts of the **AI Act**, delaying some high-risk obligations while banning nudification tools and preserving strong powers for the Commission’s AI Office over general-purpose AI, even as guidance on high-risk classification and logging requirements continued to emerge. States including Illinois, Utah, Maryland, and San Jose expanded governance-first programs through chief AI officers, sandboxes, incident-investigation frameworks, red teaming, and procurement controls, while insurers, auditors, and legal experts warned that **AI-washing**, weak board oversight, poor logging, and inadequate vendor controls are increasing D&O, regulatory, and tort risk. Across policy, industry, and academia, the direction of travel was toward stronger **auditing, verification, incident reporting, and lifecycle governance** rather than reliance on voluntary model promises alone.
Jul 12, 2026
Organizations are rapidly expanding the use of **AI agents**—systems that can execute multi-step tasks with limited human supervision—while governance, safety, and oversight controls lag behind. Deloitte’s *State of AI in the Enterprise* survey of 3,200+ business leaders across 24 countries reported **23%** of companies already using AI agents “at least moderately,” projected to rise to **74%** within two years, while only about **21%** said they have robust safety and oversight mechanisms in place. Separately, commentary warning about AI-enabled intrusion acceleration cited a purported “**GTG-1002**” campaign in which AI agents allegedly automated most of the intrusion lifecycle and compressed response windows, arguing that traditional SOC processes struggle against autonomous, high-velocity adversary tradecraft. Multiple other items in the set focus on broader *responsible AI* and policy concerns rather than a single security incident: an interview-style piece describes how “responsible AI” functions inside a large vendor’s product process, and another report highlights expert concerns about deploying LLM tools in **law enforcement** workflows (e.g., summarizing body camera transcripts or generating crime scene photo descriptions) given risks like hallucinations and bias. A separate business-leadership article frames cybersecurity and AI as strategic imperatives amid geopolitical instability but does not provide incident-specific or vulnerability-specific details. Overall, the material is best characterized as **governance and risk posture** coverage around agentic AI rather than a unified, verifiable breach or vulnerability disclosure.
Jun 29, 2026
U.S. public-sector and industry reporting highlighted that **security confidence and workforce constraints** are emerging as major blockers to scaling artificial intelligence. A survey commissioned by *Google Public Sector* found most federal respondents are already using or planning to use AI, but only a small minority report completed AI adoption plans; respondents cited declining confidence in their agencies’ digital security posture, legacy technology exposure, procurement friction, and skills shortages as key impediments to moving beyond pilots. Separately, *Anthropic* introduced a research-preview “agentic” capability, **Cowork for Claude**, built on *Claude Code*, which can execute multi-step tasks with access to local folders and optional connectors (including browser-based workflows). Anthropic warned that ambiguous instructions or misinterpretation could result in **potentially destructive actions** (e.g., deleting local files) despite confirmation prompts for “significant actions,” underscoring the need for tighter controls when granting AI tools operational access. Other items in the set focused on broader AI discourse and geopolitics—Nvidia CEO Jensen Huang disputing “god AI” narratives and a Lawfare analysis of China’s AI capacity-building diplomacy—rather than specific cybersecurity events or actionable security findings.
Jun 29, 2026