While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected. Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions. Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent. But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models? We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem. Read the full report: cohere.com/blog/concerning-b…

if this PHP vulnerability allows remote code execution, doesn't that mean we can use the vulnerability to auto-patch all vulnerable servers?

Satya was born in India. Lisa was born in Taiwan. Elon was born in South Africa. Jensen was born in Taiwan. Sergey was born in Russia.

"Several vulnerabilities" in the Linux kernel lwn.net/Articles/1097401/

This response of “that’s not how security works, it’s about balancing tradeoffs with the business” is not unfamiliar to me. I empathize, but that mindset is precisely why the security industry, and many ‘Information Security’ programs at big companies, find themselves struggling to meet the task of securing themselves with or from agents in this new era. Risk tracking spreadsheets, the phishing education, the threat intel, the manual appsec etc. None of these things were built for the challenges we are facing now. What got us here won’t get us there. We need to be willing to make big changes to how we do things if we want to solve or even keep pace with these problems.

This is pretty wild. My OpenAI account got deactivated due to Cyber Abuse. I can think of no reason why this would be the case. I was not doing nefarious. They didn't tell the reason. I appealed, was denied. So, I suppose that's that. Truly a nightmare scenario.

1password.com/files/resource… Interesting paper tl;dr AI continues to accelerate the pace of vulnerability discovery and exploitation, but not necessarily the pace of reliable vulnerability patching as one might have expected