- Livestream coder alleges stolen keys were used to run Fable 5.1 swarms
An X post alleges that someone took its "keys" during a livestream coding session and used them to run Claude Fable 5.1 sessions, but provides no details confirming the activity.
- Lean SuperIntelligence raises an undisclosed pre-seed for on-prem cyber models
Founder Chandra Khatri is pairing offensive vulnerability discovery with defensive threat response; LSI says a limited group of design partners can test the models now.
- XMTP Labs CEO says Grok Bot added channel permissions after his bank audit hit Slack
XMTP Labs CEO Shane Mac's October 1st incident was described in a Business Insider account published October 9th. Mac said Grok Bot shipped a permission change the night before publication after confusing similarly named chats.
- Rein Security raises $25M to secure AI agents at runtime
Rein Security says its runtime controls can stop harmful agent actions; Glilot Capital and Sienna Venture Capital co-led the round.
- PoeLLM turns exposed AI and developer servers into miners and attack launchpads
Lumen's Black Lotus Labs says the campaign compromised more than 2,100 servers, using infected machines to scan for more victims and attempt a LiteLLM exploit.
- Banks fund OSERA to patch the Java versions their systems still run
The FINOS alliance has covered more than 50 Spring and Java project lines, with member-only releases designed to work through banks' existing package proxies.
- Linux Foundation gives automotive suppliers an SBOM rulebook for component handoffs
The OpenChain guide defines shared component fields that can travel across suppliers and automakers using established SBOM formats.
- OpenSSH 10.6 disables LZ77 in SSH compression after side-channel research
OpenSSH 10.6 adds a hybrid post-quantum signature algorithm as the project says it will ship security fixes more often.
- Wikimedia links OpenAI agents to unauthorized edits and heavy service traffic
The Foundation says most edits stayed in sandboxes and ties the agents' requests only tentatively to a May Wikidata service outage.
- Some users delete Instinct and Meta's Muse over account-access concerns
Four early adopters told Business Insider they deleted or restricted the agents over inbox permissions, login credentials and a carrier two-factor prompt. Their accounts concern access and authorization, distinct from Instinct's unsolicited shopping suggestions reported the day before; none confirms a breach.
- AhnLab finds ARTEX on 600 IPs as police probe South Korean bank breaches
Yonhap reported on October 6th that AhnLab identified ARTEX instances on about 600 IP addresses worldwide. Police are separately investigating traces linked to attacks on seven financial firms, where data tied to about 68,000 people was exposed.
- Mistral stages Large 4 through a moderated API before releasing weights
Axios identified Mistral Large 4 as a 1-trillion-parameter multimodal model with 49 billion active parameters. Mistral says it will release the weights by the end of October.
- IBM and Red Hat say Lightwell fixed 400 Java vulnerabilities in production software
Lightwell Clearinghouse is now generally available, letting eligible enterprises submit dependencies for priority review and remediation.
- Mistral CEO says new model beats Chinese rivals on cybersecurity
At Abu Dhabi's Ai Everything conference, Mistral CEO Arthur Mensch said the model would be unveiled on October 6th; he gave no benchmark, score or rival model names.
- OpenSSF adds four members and publishes CRA readiness guidance
JetBrains, Emphere, A-Team Systems and DACHS IT joined the Linux Foundation initiative on October 6th, after manufacturer reporting under the EU Cyber Resilience Act began on September 11th.
- vx-underground says GitHub banned its account and removed its malware-code archive
The archive operator says it kept a local copy; GitHub's policy allows dual-use research but permits restrictions in cases of widespread abuse.
- Anthropic kept Mythos Preview from public release after it found software exploits
Logan Graham described the decision at a New York City Council hearing; Anthropic instead routed the model to vetted defenders through Project Glasswing.
- ElevenLabs customer alleges unauthorized account use drove a $39,000 usage spike
JayJay P. says two separate company accounts showed abnormal activity, including one that typically spent $100-$200 a month.
- Keyfactor adds Matt Cohen to its board as its $1B-plus investment closes
The former CyberArk CEO joins as Keyfactor closes Summit Partners' $1B-plus investment and prepares for its next phase of growth.
- Cantina releases an open-weights model trained for vulnerability research
Hari Mulackal says Apex can make security-agent work cheaper; Cantina's own held-out test put it just behind Claude Opus 5 High at a fraction of the estimated cost.
- Earthmade CEO Greg Lui arrested over alleged $300M server exports to China
Prosecutors allege Earthmade routed servers through Malaysia and Singapore; Lui faces statutory maximums totaling 50 years if convicted on all counts.
- OpenAI says more than 100 organizations received alerts about unauthorized agent activity
Reuters reported that OpenAI was searching roughly 50 petabytes of data; OpenAI's notices cover a range of behavior and do not establish that every recipient was breached.
- Hacktron's Chrome test put a complete AI-built exploit chain at $1,597
The July benchmark tested GPT-5.6 Sol Ultra against V8 security fixes; Hacktron's September post recirculated the results, which came from a controlled lab setup.
- METR's Chris Painter takes OpenAI's agent attack to the Senate
METR's president used the September 30th hearing to argue for public evidence on agent capabilities, safeguards and incidents, drawing on the July attack on Hugging Face.