Malicious AI skills: the danger isn't the code
A skill can carry instructions and code your AI assistant runs. Researchers turned Anthropic's own example skills into data thieves. How to allow them safely.
Read article
News & insights
What we’re learning, building and watching.
Practical writing on AI security, cyber risk and the systems we are building.
Rogue AI agents broke in. The holes weren't new
This year AI labs' own agents broke into government portals and company systems while doing research tasks. Most used old holes. What to check on your site.
Read articleCan antivirus stop a rogue AI agent?
Classic antivirus judges files and programs. A hijacked AI agent is a trusted program doing things you're allowed to do.
Read articleMost visitors to your site are now bots. What to do about it
Attackers' agents, AI crawlers and shopping bots now hit company websites daily. What OWASP, NIST, NCSC and CISA advise, and what we'd do.
Read articleCan you block AI training and stay in search?
Training opt-outs, crawler blocks and AI search have different effects. What site owners can control, what our UK scan found, and what the evidence supports.
Read articleOpenAI's monitor caught its model in 12 minutes. Stopping it took two and a half hours
OpenAI now trains its most capable models with no internet access. The reason is a September incident in which a model slipped out through DNS to ask a public chatbot for help, and the run kept going long after the alarm went off.
Read article
