[claude-opus-5.5]

4 editions · 3 items

October 14, 2026

Google shipped Gemini 4 Argon worldwide via API, the Gemini app and Antigravity — priced aggressively but trailing Claude Opus 5.5 and Muse Wonder Full in independent benchmarks (The Decoder). · AI & Model Security

in Three Chained Zero-Days Put Root on a Fully Patched Ivanti VPN

October 8, 2026

Anthropic folded Project Glasswing into a three-tier Cyber Verification Program, with Defense Access (IR, malware RE, vuln analysis), Red Team Access (adds authorised pentest/red teaming) and Specialized Access (fewest safeguards, limited to orgs testing safety systems), across Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1. On the CyScenarioBench evaluation, the Defense tier blocked 46 of 50 tasks on Opus 5.5, while Red Team Access blocked none and completed 34 of 50 — the same completion rate as with no safeguards; without CVP access every task was blocked on the first prompt. Anthropic claims at least 129,000 verified vulnerabilities between April and July 2026, over 33,000 rated critical or high, though it concedes this is survey data from a subset of partners (The Hacker News, SecurityWeek). VulnCheck's Patrick Garrity counters that only 2 of 300 vulnerabilities attributed to Anthropic/Glasswing have seen exploitation in the wild (0.67%): Ghost CMS SQLi CVE-2026-26980 and Rejetto HFS session forgery CVE-2026-61500. · AI & Model Security

in Two Hours From Public Detail to Exploit Attempts Against Atlassian

October 1, 2026

Google released Gemini 4 Argon, its first frontier model in over seven months; independent testing puts it level with GPT-6 Astra and behind Claude Opus 5.5, at a low per-token price but more than twice the tokens per task (The Decoder). · AI & Model Security

in An Encoded Character Away From Admin: Cisco SD-WAN Manager Exploited in the Wild

September 29, 2026

PitScaler Goes Global: Citrix NetScaler Chain Exploited for Weeks Before Anyone Had a Patch

Citrix NetScaler exploitation went global with CVE-2026-88771/88772 requiring federal patching by Wednesday, affecting 50,000+ instances with webshell deployment as standard post-exploitation. JadePuffer (Storm-3168) wiped over 100 Azure resources in seven minutes using compromised service principals, while OpenAI's rogue agents expanded to include security-bypass attempts, leaked-key use, and attempted access-control compromises across US government sites. ShinyHunters adapted to defensive workarounds and restarted mass exploitation of Oracle PeopleSoft, and ClickFix attackers now weaponize ChatGPT Custom GPTs as lure surfaces for RAT delivery via DLL sideloading.