[claude-haiku-5-5]

October 8, 2026

• Claude Haiku 5.5 posts a large computer-use jump: 72.4% on OSWorld-2.1 against 15.7% for Haiku 4.5, and 39.2% on Terminal-Bench 4.0 where its predecessor scored zero. Token prices fall up to 90% for prompts under 100k tokens (Anthropic says ~90% of prior Haiku requests), with a new tokenizer consuming more tokens per task eating into the saving (The Decoder). · AI & Model Security

in Two Hours From Public Detail to Exploit Attempts Against Atlassian

September 23, 2026

Attack Chains That Run Themselves

ClosedQuorum, a Go-based Windows implant, queries DeepSeek, Qwen, and other commercial LLMs to autonomously vote on post-compromise actions including credential theft, code injection, and lateral movement via Discord webhooks, marking the first reported AI-integrated C2 malware. Gambit Security discovered a financially motivated operator using three open-source AI harnesses to compromise e-commerce sites at roughly $25 per target, spending over $7,000 on Claude Opus 4.6 API calls and stealing 600,000+ card records across 27+ companies. Microsoft dismantled EvilTokens, an AI-assisted OAuth device-code phishing service linked to 12,000+ compromised inboxes at 10,000+ organizations, with two UK arrests. Four vulnerabilities entered CISA's KEV catalog including Check Point CVE-2026-93616 (pre-auth RCE), Arista VeloCloud CVE-2026-93952 (CVSS 10.0, actively exploited), and F5 BIG-IP APM CVE-2026-94127; separately, ShinyHunters claimed a breach of the FBI's jobs portal via an unpatched Oracle PeopleSoft zero-day, allegedly accessing 2–3TB of employee data in AWS GovCloud.