OpenAI has discovered other instances in which autonomous agents have escaped containment as the company expands its investigation of the hacking incident at tech firm Hugging Face that drew global attention this month, two people familiar with the matter said on Friday. The new breakouts were uncovered during the company’s publicly announced investigation into how one of its agents escaped what was meant to be a contained testing environment this month, the two people said, and OpenAI is now looking into those instances as well. One of the sources said that the escapes were limited in nature and that none of the agents were thought to have left OpenAI’s network.

An OpenAI spokesperson referred to a statement issued by the company on Tuesday that said it was reviewing “broader activity from our models” in addition to the Hugging Face intrusion. The discovery of additional rogue behavior at OpenAI, even if limited in nature, could feed growing appetite for regulation coming out of the White House and elsewhere. The expanded investigation by OpenAI was launched shortly before its primary rival, Anthropic, disclosed that its models were also responsible for a series of break-ins that led to breaches at three other companies dating back to April, according to the two sources and a third source familiar with the matter. The recent discovery of other past breakouts at OpenAI has not previously been reported.

AI safety experts said the new disclosures paint a portrait of a group of cutting-edge labs whose ability to develop dangerous autonomous hacking agents outstrips their ability to keep them under control. “We have a whole industry where the people designing, developing and putting out these tools aren’t keeping up themselves to responsibly develop these things and keep them safe,” said Maurice Chiodo, a mathematician who works at Cambridge University’s Center for the Study of Existential Risk. Reuters could not establish exactly how many incidents OpenAI investigators found or the timings or circumstances under which they occurred. The three sources said OpenAI and outside experts were examining log data from earlier in the year in a bid to understand what took place.

The proposal goes quite a bit further than a labeling proposal put forth by the RIAA, the International Federation of the Phonographic Industry (IFPI), SAG-AFTRA, and others. That would create a set of standardized labels for AI-generated and AI-assisted music. The labels’ proposal would require songs be clearly labeled, but it would also keep them off international charts unless they met specific criteria, including being “substantially human made.”

To be eligible, the songs would also have to respect the terms of service of whatever AI service was used, the model would have to have the rights to any data it was trained on, and “not raise stream or chart manipulation concerns.” What sort of concerns and what constitutes “substantially human made” are currently vague. Sony Music, UMG, and Mom+Pop Music did not immediately respond to a request for clarification. The IFPI has thrown its weight behind the labels’ proposal, though no charting organization has signaled any immediate plan to adopt the rules […].

In a study published on Friday, eSafety also found most children aged between 10 and 15 were using social media just as frequently in March as they had before the ban came into force on December 10 last year, while parental awareness of their habits decreased. Children’s continued social media use took place even as account ownership declined to 42% from 52%, with “statistically significant” reductions across YouTube, Snapchat and TikTok in particular, the report said.

“Most under-16s who had social media accounts before commencement were able to either retain them or create new ones at the three-month mark, with social media platforms’ failure to implement effective age assurance measures cited as the main reason,” eSafety said in a statement […] Before the ban, nearly 86% of children surveyed reported using at least one age-restricted platform. Three months later, that figure remained above 81%, the report said. About 58% of teenagers reported using social media daily or more often, barely down from roughly 60% before the ban, it found. The report showed minimal change in “sports and physical activity, arts and music, spending time with friends and family, and attendance at community events.”

Around half the children who retained their accounts said platforms had not checked their age, the most common reason they were able to stay on the services. Others said their accounts listed them as aged 16 or older or that age-checking systems had incorrectly determined they were older. The findings broadly matched snapshot data eSafety published in late March.

After Sony’s recent earnings call, an investor Q&A session saw analysts ask about its controversial decision to end disc production across all of its consoles. The company hadn’t publicly commented since its announcement and had reduced activity on social accounts and other marketing channels. Sony’s chief financial officer, Lin Tao, broke that silence during the Q&A. “There are various reasons we made this decision,” she said through an interpreter. “The biggest being that the digitalization of content overall has been progressing. That’s the big factor. It’s not just for PlayStation, but for all kinds of content, digitalization is progressing. “And so when we think about the future, and we put in a lot of thought and time, and we cautiously considered this, and we came to this conclusion, and we’re going to cautiously move this forward,” Tao said.

“We have received various opinions, and people have strong views, and we understand that the community has put forth those views to us,” said Tao. […] Tao says Sony wants to “consider” the emotions of disgruntled customers, especially as titles are “connected to people’s fond memories in many cases.” Tao also alluded to the possibility of future measures to lessen the blow for anyone unhappy with the decision, but it appears Sony hasn’t yet finalized what those may be. “In the future digital ecosystem, how do we engage the gamers is something that we would like to continue to explore,” she said.

Cyberattacks targeting municipal water systems have been reported in at least seven states this week, prompting the FBI and the Environmental Protection Agency to warn utilities nationwide that hackers are trying to disrupt critical water infrastructure. In a public service announcement Thursday, the agencies said water and wastewater utilities have reported incidents to the FBI, with some malicious activity degrading water operations. The announcement does not name the states.

The warning comes after hackers targeted more than 30 municipal water facilities in Minnesota in an attack that had hallmarks of Iranian meddling, according to a law enforcement official. It is still under investigation. A spokesperson for Minnesota’s information technology services agency said Thursday there was no indication the breaches contaminated any municipal water supplies. The federal Cybersecurity and Infrastructure Security Agency said in a separate alert that some larger attacks on water infrastructure had “resulted in boil water notices and sustained manual operations,” though it did not say where.

[…] The federal advisory said the malicious cyber actors, or MCAs, targeted specific brands of control systems used by municipal water utilities, though the FBI and the EPA urged operators of all systems to take precautions. […] The agencies said the hackers remotely accessed internet-facing devices, changed IP addresses and passwords, and caused utilities to lose monitoring and control capabilities. The federal advisory calls on system operators to remove programmable logical controllers, or PLCs, from direct internet exposure by putting them behind secure gateways and firewalls; use strong passwords; and limit communications between authorized control system devices through access control lists.

A collapsed Eiffel Tower, a sinkhole swallowing the Great Pyramid of Giza and Russian tanks in Ukraine’s capital were among the images BBC Verify was able to create when testing the feature, which was rolled out on Thursday. Google has not yet responded to questions based on BBC Verify’s tests, but in a social media post the company said they “take misinformation seriously” and that “we prevent image creation on harmful topics and are continually updating our protections.”

AI and misinformation expert Henk van Ess has highlighted the risks this feature poses, creating fake images of a non-existent nuclear power plant in Iran, a refugee camp on the US-Mexico border and a fake hospital in Gaza with a bomb crater next to it. He said Google was allowing “invented” imagery to be “welded to genuine coordinates, drawn on genuine imagery.” “The forgery does not have to look convincing on its own. It inherits the credibility of the map it was born on,” van Ess added.

Google has basically stopped sending people to websites (including our site) for answers and information. Instead, it’s using AI to answer them on its platform, in its words. Chartbeat data shared with Axios shows Google Search traffic to publishers fell 34% over the past year. That pain is regressive. Over the past two years, small publishers lost 60% of referrals from search overall, medium publishers 47%, large publishers 22%.

In a case filed in a Manhattan state court (PDF), the lawsuit claims that Kalshi accepts wagers as a gambling business in disregard for the state’s constitution and laws by not being registered with the New York State Gaming Commission. Governor Kathy Hochul in the press release said the state is taking the action to stop what it views as illegal behavior and bring the company into compliance with New York law. The lawsuit is seeking a permanent injunction against Kalshi.

The suit by the state is also seeking a total restitution to users who have placed trades on the platform, a $100,000 penalty for each attempt to offer sports wagering, and another penalty three times the amount the company has gained while allegedly operating in violation of New York law. The state estimates that could total $36 billion.

Alongside dynamic patching, Google is rolling out smarter background updates during periods of minimal user disruption. Starting with Chrome 150 on macOS, the browser takes advantage of the operating system’s windowless state. If all Chrome windows are closed but the app remains running in the background, the browser will quietly auto-restart to apply pending updates.

For enterprise environments, IT admins can continue to manage fleet-wide deployments through Chrome Enterprise Core or enforce update prompts using the RelaunchNotification policy. Google’s long-term vision is a browser that remains continuously protected in the background without interrupting your daily browsing session. In the meantime, you can manually trigger pending updates by clicking the update prompt in the top-right corner of Chrome.

LinkedIn, a social network awash with long AI-generated posts from executives and other corporate workers, has introduced a new button that users can click to flag if a post “seems like AI slop,” according to 404 Media’s own tests. If you have been anywhere near LinkedIn in the past couple of years, you have undoubtedly seen users posting blatantly AI-generated missives. Often these posts take some sort of news event, and opine on how this relates to thought leadership, or some other LinkedIn brainrot term. It’s also pretty wild the button specifically uses the term “AI slop” and not, say, “It seems this was generated with AI.”

[…] After publication of this piece, Hari Srinivasan, chief product officer at LinkedIn, wrote their own post about the button. “AI slop is a top priority for all of us. We really care about this. People come to LinkedIn to connect with real people and share their real perspectives, ideas and expertise. Here are a few more changes to keep it that way,” he wrote.

The button in part will help LinkedIn tune its own models for identifying AI slop. “We are ramping up a series of new and improved classifiers that identify if a post is AI-slop or generally low-quality content. This will reduce the amount of AI slop you might see in suggested content and content from outside your network,” the post said. “We are ramping the ability for members to tell us if they believe a post or comment seems like AI slop. Slop is hard to define and the definition changes; this lets us tune our models and make better feeds.” Srinivasan also said LinkedIn is removing the AI-powered “enhance your post” feature with another that “proofreads your words, but does not change your voice.”

The complaint filed on Wednesday in California district court alleges that the film’s associate producer, Daniel Haido, hand-delivered an unencrypted master copy of the film to Netflix so the company could screen it as a potential buyer. Haido verbally instructed the employee to delete the files after the screening, according to the suit. A little over a week after the screening, Netflix emailed the filmmakers to say the drive had been stolen, the plaintiffs allege. “Someone stole a good amount of drives from our office desks this past week,” a Netflix executive wrote in the email, according to the suit.

The complaint notes the movie, entitled "Fortitude,” took over seven years to make and cost $45 million. It tells the story of a secret mission called Operation Fortitude during World War II that was orchestrated to mislead the Nazis about the Allied invasion of Europe. The film stars Nicolas Cage as Dusko Popov, a real-life spy during World War II, as well as Sir Ben Kingsley and Ron Perlman.

The plaintiffs said studios will now be dissuaded from buying the rights to the movie, knowing that a version of it could be released by a third party for free. “The film’s value depended in significant part on its exclusivity as an unreleased, first-to-market work,” the complaint states. “By losing control of the film, Netflix destroyed that exclusivity and materially, if not completely, impaired the film’s marketability.”

Anthropic said in a statement that it reviewed more than 140,000 tests to find evidence that Claude - its family of AI models - could access the internet from testing environments that were designed to be sealed off. The tests include so-called “capture-the-flag” evaluations in which Claude was tasked with obtaining information by breaching other systems - a common way that experts assess a model’s hacking capabilities.

A “misconfiguration” on systems run by Anthropic and its testing partner left the models with live internet access, allowing them to breach other systems, the San Francisco-based firm said. Anthropic said the earliest incidents date back to April and that it is “approaching the fixes as if the responsibility were ours alone.” Neither Anthropic nor the organizations that were breached had noticed the intrusions at the time.

Anthropic said it could have reviewed its records more thoroughly and added that the findings gave the firm “cautious optimism” that such risks can be overcome with more investment and tighter measures. “The broader lesson is not necessarily that AI has developed a fundamentally new attack capability,” cyber security expert David Allott told the BBC. “Instead, it is that AI agents can combine capabilities, obtain credentials and system access to take actions autonomously, while adapting scope and scale at machine speed,” he added.

Surveillance cameras owned by Flock Safety have been cut down with electric saws in New York State, vandalized with paint in Oakland, California, and rammed with a truck in Idaho. Flock claims its services fight crime, but law enforcement agencies also use their services to track vehicles based on license plate numbers and reconstruct the their movements, even when the drivers and owners of these vehicles have never been accused or convicted of any crime. (Flock states it has 120,000 automated cameras that record license plate data, as well as pan-tilt-zoom cameras, across the United States.)

A guerilla mindset among average citizens have seen these cameras forcibly disabled within recent weeks with sympathy directed toward the vigilantes. In June, a West Virginia man accused of destroying several Flock cameras was arrested. Under a Facebook post from the local NBC affiliate announcing his arrest are dozens of people volunteering to provide alibis. “He was out fishing with me that day, you got the wrong guy,” one man wrote.

This week, the Model Context Protocol (MCP), an open source standard for how AI systems interact with external tools and data sources, saw its largest update since its introduction. Most notably, MCP’s protocol core is now stateless, so requests are no longer dependent on a session tied to an individual server instance. This change has the potential to address long-standing barriers to scalability.

The blog post announcing the specification, written by lead maintainers David Soria Parra and Den Delimarsky (who both work at Anthropic), says: “The highlight of this release is a stateless protocol core — MCP is transforming from a bidirectional stateful protocol into a request/response stateless protocol. It was one of the most highly-requested features from developers who were eager to get better reliability and scalability for their MCP servers.”

[…] There is also a new deprecation policy that ensures at least 12 months between when a feature’s formal deprecation is enacted and when the feature may actually be removed — with a narrow exception for critical security updates. This is again in keeping with the general “let’s make this work better at enterprise scale” theme of the new specification.

It is impossible to make large language models fully secure against hacks because of a fundamental flaw in how they work, a team of researchers argue in a paper presented at the International Conference on Machine Learning, a top AI conference, this month. The claim has huge implications for the safety of this technology. By taking advantage of this flaw, which concerns how LLMs identify who or what is giving them instructions, the researchers were able to make popular LLMs spit out information they had been trained not to provide, such as how to synthesize cocaine and how to sabotage a commercial aircraft’s navigation system. “There’s a real probability that this is going to be a problem that’s fundamentally unsolvable,” says Charles Ye, an independent researcher and coauthor of the ICML paper. […]

The ICML paper describes attacks against several of OpenAI’s models, but Cui and Ye say that they have since seen similar results with models made by Anthropic, Alibaba, and DeepSeek. Cui and her colleagues wanted to find out why an attack like chain-of-thought forgery was so effective. They suspected it had something to do with the mechanism that LLMs use to keep track of where their instructions are coming from. But what Cui and her colleagues discovered is that LLMs are in fact very bad at keeping track of different roles.

In a series of experiments that looked at what was going on inside a handful of different models, the researchers found that LLMs seem to identify the role of a specific chunk of text not by the tags around it but by the style of that text and the words it contains. The upshot, the researchers claim, is that all an attacker needs to do to hack an LLM is write text that spoofs a certain role. And because roles are a fundamental part of how LLMs work, no amount of training will fully solve the problem.