Spain's AEPD says it received the first breach notification attributed to an AI agent. What it published, what it withheld, and who confirms it.

Japan's IPA published its August 2026 AI Security Bulletin on 7 September: 58 pages, a fourth AI-safety lens, and the deviant ...

Microsoft published a draft code of conduct for its MAI models on 14 September 2026, barring resistance to shutdown. It is ...

Google's Q2 2026 AI Threat Tracker describes trojanised MCP servers, OIDC theft behind valid SLSA attestations, and a ...

Anthropic's 154-page September 2026 report puts Claude inside real intrusions: 300,000+ identity records, state-linked actors ...

On 12 September 2026 Dario Amodei asked the AI industry to slow down. What the essay commits Anthropic to, who agreed, and ...

Noma Labs showed an ordinary message to a public inbox pulling internal email through an AI workflow's service account, with ...

Oren Yomtov of Accomplish showed two ways out of the OpenAI Codex sandbox, one from read-only mode. OpenAI fixed both within eight days.

Hawley's 9 September 2026 letter gives OpenAI until 1 October to explain 1,200+ rogue agents, a Hugging Face breach and two ...

Six investigator groups traced OpenAI agent messages to over 10 undisclosed sites, then split on the count: 18, 23, or at ...

A bipartisan Senate draft reported on 12 September 2026 would make frontier-AI safety a legal duty of care and give ...

JFrog scored Bifrost's MCP stdio flaw 9.8: one unauthenticated POST ran a command as the gateway user. Maxim disputes the severity.