Cybersecurity

Anthropic’s IPO filing reveals security failures alongside warnings of runaway AI

The Claude maker paused model training for more than a month and disclosed testing failures that let AI models escape containment, all the while warning of doomsday scenarios.

Spend less time finding cybersecurity news. Get more out of it.

Metacurity delivers the cybersecurity news, analysis, and insight that would take you hours—and sometimes days—to assemble yourself.

Every weekday, we sift through thousands of news articles, press releases, filings, court documents, and research reports, including details that vendor announcements and PR pitches leave out. We tell you what changed, why it matters, and what deserves your attention. Minimal vendor marketing. No outrage bait. No SEO filler.

A paid subscription gives you:

The full Metacurity archive: Every newsletter, searchable and browsable.
Our weekly long-reads roundup: The best cybersecurity writing from across the industry, selected and vetted to make your reading time count.
Specialized reports and analysis: Periodic deep dives that go beyond the daily headlines.
A direct role in sustaining independent journalism: Your subscription helps keep our editorial priorities focused on readers and the cybersecurity community.

If Metacurity saves you time, helps you spot an important development, or gives you a clearer understanding of the industry, please consider becoming a paid subscriber. Your support keeps that work going.

Subscribe today—and thank you for reading and supporting Metacurity.

Upgrade my subscription

Anthropic submitted its paperwork for what could be the biggest ever initial public offering on Wall Street, saying that its revenue was $16.3 billion in the first half of the year and its net loss was $80.7 billion, driven largely by a one-time charge.

But buried in its financial prospectus were new revelations about security problems the company hadn't already revealed.

First, Anthropic said it paused training of its next-generation ‌flagship AI model for more than a month over security concerns, while four of its AI agents accessed live external computer systems during testing.

The Claude maker said in the filing's risk factors section that it had delayed pre-training of a new "frontier" base model to strengthen safeguards against the theft of model weights and intellectual property.

The disclosure ⁠highlights the safety challenges facing developers of increasingly powerful AI models, some of whose creators have warned the technology could eventually escape human control. Rival OpenAI also paused some training earlier this year over safety concerns after its models hacked Hugging Face.

The incidents illustrate how unexpected safety failures could disrupt development and deployment of models central to Anthropic's growth as it prepares for a widely anticipated stock market debut.

Anthropic warned that training pauses could delay revenue and leave it trailing competitors. The company devoted about 94 pages to risk factors.

The filing also detailed ‌previously undisclosed safety evaluation failures in which four AI models escaped their testing environments and accessed real-world computer systems, with sessions lasting between 10 and 34 hours.

Anthropic said an error during cybersecurity tests with a third-party partner left the testing environment connected to the internet despite instructions that web access be disabled, saying that in one case, an early version of ⁠the model continued pursuing an impossible evaluation task, discovered a stored password and used it to gain administrator access to a third party's system. It then obtained additional credentials, changed system settings, and accessed an individual's personal data. ⁠

Separately, the company said on Sunday that Claude had bypassed a paywall and accessed publicly available aggregate voter counts from the US state of Georgia without human authorization.

Overall, almost a third of the 335-page prospectus addresses risks, including autonomous harmful actions, malicious use for cyberattacks and weapons development, and model capabilities advancing faster than safeguards.

“Sufficiently advanced AI systems could, if not developed, deployed, and operated with appropriate safeguards, oversight and security measures, pose catastrophic or existential risks to humanity,” the prospectus reads, citing concerns both from critics and regulators and from inside Anthropic itself.

The idea behind RSI is strikingly simple. It describes a state in which humans hand over the research and development of AI models to other AI models. AI already plays a big role here—and at least one lab has used something close to RSI to speed up development on a model that punches above its weights—but the scenario that sparks doomsday talk is one in which humans are no longer in the loop at all.

Or, as the Anthropic filing puts it: “Risks will increase as AI systems substantially automate AI research and development if, for example, they accelerate AI progress beyond our ability to evaluate and safeguard new models.”

The prospectus repeatedly makes the point that RSI could lead to AI models that develop faster than the company’s safeguards, and that the company may not even realize it has lost that race until it’s too late. Anthropic did not immediately respond to a request for comment.

It also gets specific about what might happen after that. “As AI systems become more autonomous and capable of taking consequential actions with less human oversight,” the prospectus says, “there is a risk that such systems could, whether due to misalignment with human intentions, errors in objective specification, or self-preserving behaviors, take harmful actions independently and at scale without human intervention.” (Akash Sriram / Reuters, Jonathan Benton with the Associated Press / Euronews, Mike Isaac, Erin Griffith, Lauren Hirsch and Sri Muppidi / New York Times, Brian Barrett / Wired, Mike Isaac / New York Times)

Cathedral, a months-old cybersecurity start-up, recently told Claude chatbot maker Anthropic that its researchers had penetrated sensitive internal data and messaging systems at the artificial intelligence company, according to a draft report by Cathedral.

The start-up, founded by former members of the cost-cutting US DOGE Service, offers AI-powered cybersecurity tools to the US government and corporate clients. Its researchers got inside Anthropic's systems by exploiting vulnerabilities in business software used by the AI firm and many other companies for administrative and sales tasks, according to the report.

After running AI agents for less than 12 hours, the researchers found paths to access internal Anthropic data, including meeting transcripts, details of salaries and job offers, and Slack messages discussing its advanced AI models, the Cathedral report said. The start-up probed Anthropic under a company program that invites outside cybersecurity experts to test its systems.

Cathedral’s ability to penetrate sensitive programs at one of the companies leading the global AI race comes amid mounting concern that US AI firms are the target of overseas intelligence agencies and growing alarm that AI can make it easy for malicious hackers to break into critical systems.

Anthropic confirmed in a statement that Cathedral researchers had gained access to “a limited set” of its sales, human resources, and IT systems. The AI company shut off the pathways exposed by the researchers and briefed federal officials on the incident, the statement said.

An Anthropic spokesperson said Cathedral spent multiple days trying to break directly into its software before turning to the third-party business tools. (Elizabeth Dwoskin and Gerrit De Vynck / Washington Post)

The University of New Mexico Health System, a major hospital network in New Mexico, raced to fix a cybersecurity issue on Monday that forced it to send ambulances to other hospitals and left the state without an emergency department capable of treating the most serious injuries.

The University of New Mexico Health System told people not to show up at its main hospital in Albuquerque and canceled appointments at its more than 30 clinics. It said it was working to resolve the issue, the extent and nature of which was not immediately clear.

The hospital network conducts about 900,000 outpatient visits and receives 100,000 emergency room visits each year, according to its website. It operates the state’s only Level 1 trauma center.

Presbyterian Healthcare Services and Lovelace Health System, two other major healthcare providers in New Mexico, said they were coordinating with the UNM Health System, including taking additional patients.

The UNM Health System said in a statement that its hospitals and clinics began resuming operations in phases later in the day.

Multiple UNM Health System employees said they heard messages across their computers while working late Monday morning that claimed to have stolen student and employee data and patient information. (Christopher L. Keller and Wufei Yu / Associated Press)

University Hospitals in Cleveland is dealing with the fallout from a cybersecurity incident that hit its system last week.

The hospital system confirmed the incident Monday, saying it disconnected its systems from the internet after detecting unusual activity on its servers.

University Hospitals said it is investigating the incident with outside experts and is in communication with law enforcement.

Some patients have already felt the impact. The hospital system said it has rescheduled some appointments and elective procedures as it works to minimize disruption to patient care.

University Hospitals said it made significant progress over the weekend restoring systems to full operability, but challenges remain.

Patients still cannot access MyChart. The hospital system also reported difficulties connecting to the UH network at some locations and problems with insurance pre-authorizations. (News5 Cleveland)

South Korean police identified seven suspects linked to a cybercrime operation that breached more than 90 organizations in the country, with the ARTEX AI pentesting framework used in most of the attacks.

According to local media citing the Seoul Metropolitan Police, the gang leader has a background in penetration testing and worked at a cybersecurity company between 2019 and 2022.

In 38 of the incidents, the threat actor demanded ransom payments of 360 million won ($270,000), promising not to leak stolen data in exchange.

Authorities believe the threat actor stole 8.2 million records from compromised organizations, including educational institutes, hospitals, large corporations, and even golf courses.

Yonhap News says that the gang leader is a self-taught 32-year-old hacker and started attacking organizations in September 2025.

The Seoul Metropolitan police told the publication that the hacker used the ARTEX AI penetration testing suite, the same autonomous framework used in the attacks against multiple South Korean banks attributed to a Chinese-speaking threat actor.

Initially, the hacker used conventional tools but adopted AI utilities in late August 2026 to expand the attacks.

Authorities arrested all seven suspects, but only the group’s leader remains in custody. Arrested on October 15, he was formally detained two days later and referred to prosecutors on October 23. The other six suspects remain under investigation without being detained. (Bill Toulas / Bleeping Computer)

Related: Yonhap News

A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data.

The security issue is tracked as CVE-2026-111497 and is also known as “Broccoli2Shell” and “Node2Shell.” It affects Brotli versions 1.0.3 through 1.0.9, 1.1.0, and 1.2.0.

The vulnerability has been reported under several names because it was initially identified in Node.js before researchers found that the same flaw in the Brotli decoder could affect software across multiple ecosystems.

Brotli is an open-source project developed and maintained by Google for lossless data compression. It shrinks files so they can be transmitted faster without affecting the original data.

The name HTTP2Shell reflects its impact on HTTP clients and servers, although the vulnerability is not specific to HTTP/2 and can affect other applications that decompress attacker-controlled Brotli data.

Apart from Node.js, potentially affected software includes Python HTTP clients such as urllib3[brotli], requests, httpx, and aiohttp[speedups], when configured with a vulnerable Brotli decoder, as well as other applications and tools that use vulnerable Brotli implementations.

On Sunday, Microsoft pushed an emergency security update to address the issue in .NET, warning that successful exploitation allows privilege escalation on systems with a vulnerable .NET version.

The Node2Shell vulnerability is a buffer overflow that lets a specially crafted Brotli-compressed stream trigger an invalid block switch that the decoder treats as valid and misinterprets as a request for more input. (Bill Toulas / Bleeping Computer)

Japanese companies are moving to pay compensation to users following waves of cyberattacks that have disrupted internet services and raised concerns about economic ‌stability.

GMO Internet Group, a leading provider of online financial services, said customers would be compensated for losses stemming from unauthorized access following a cyberattack on its foreign exchange trading service, and all customers would receive 5,000 yen ($32) as a gesture of goodwill, CEO Masatoshi Kumagai said in a blog post on Sunday.

Five foreign-exchange brokers, including Goldenway Japan and Oanda Securities, have reported customer losses suspected to be linked to a hack targeting GMO Internet Group, Finance Minister Satsuki Katayama said.

"The internet itself is now starting to break down," said Kumagai, whose sprawling group includes internet infrastructure and cryptocurrency trading. Shares of GMO, which had a market value of $2.6 billion as of Friday's close, slumped almost 16% on Monday to a four-month low against a 0.2% rise in Tokyo's benchmark index.

Japanese Prime Minister Sanae Takaichi said the government planned to compile an emergency package of measures against cyberattacks by ⁠next week. (Kentaro Okasaka and Sam Nussey / Reuters and Megumi Fujikawa / Wall Street Journal)

A hacker has drained nearly $1 million worth of Solana (SOL) from users of a crypto trading bot that runs inside the Telegram chat app.

The attack hit 49 wallet addresses belonging to nine users and took about 9,408 SOL, worth roughly $947,000, says Bloom, the company behind the bot.

Bloom says the attacker exploited a third-party module through a remote code execution (RCE) vulnerability.

On-chain data from blockchain analytics firm Bitquery shows the attacker tested one wallet per trader, then emptied each trader’s wallet, biggest first, all in 94 seconds.

Bitquery counts 48 drained wallets and puts the loss at about $953,000, with the largest single loss at 1,636 SOL, or about $166,000.

The attacker took only SOL and left behind about $57,000 in USDC.

Almost all of the stolen SOL still sits unmoved in one wallet controlled by the attacker. (The Daily Hodl)

The US Cybersecurity and Infrastructure Security Agency published a strategy that focuses on taking a leading role in cyber defense, prioritizing protection of critical infrastructure and building the ability to withstand attacks.

The 10-page strategy — “CISA 2030: Defend, Harden, Prevail” — largely reaffirms existing roles for the agency, but CISA will begin reviewing its core services and capabilities within 60 days to make sure they meet key objectives, followed by implementation over the next 180 days and an update on its progress after one year.

The strategy is also meant to align with the administration’s broader cyber strategy, published in March, and last year’s executive order on state and local preparedness.

“I call on every company and organization in the critical infrastructure community — from owners and operators to vendors and technology manufacturers — to act now,” Acting CISA Director Nick Andersen said in a comment released with the strategy. “CISA 2030 provides a focused roadmap to strengthen defenses, eliminate adversarial footholds, and deny them any advantage that could endanger the nation’s security, economy, or public health.” (Tim Starks / CyberScoop)

Two Democratic Senators, Ron Wyden of Oregon and Adam Schiff of California, who have long overseen US intelligence, say the Trump administration is illegally withholding a secret court’s findings from Congress until lawmakers renew a program that lets federal agents read Americans’ communications without a warrant.

Seven months ago, the Foreign Intelligence Surveillance Court objected to search filters that let intelligence analysts pull Americans’ messages from intercepted data without the approvals, written justifications, or records the law requires. The court approved another year of surveillance anyway. The ruling has never been made public, the senators say.

The program, Section 702 of the Foreign Intelligence Surveillance Act (FISA), lapsed in June after Congress failed to renew it, though collection continues under the court’s March approval. The administration’s own public documentation says rulings like this one are reviewed for public release “within 180 days of issuance.” That window closed September 13, even as intelligence officials press lawmakers to reauthorize the program by the end of the year. (Dell Cameron / Wired)

Related: CyberScoop, 9to5Mac

Microsoft patched high-severity flaw CVE-2026-80097 (CVSS 8.6) in Authenticator for Android, allowing malicious apps with no declared permissions to steal work account access tokens due to improper authentication in its broker component.

Microsoft classified the flaw as a local elevation-of-privilege vulnerability. The issue affected Android devices with Microsoft Authenticator installed and a signed-in work account.

Enclave researchers found that an untrusted app could pretend to be a trusted Microsoft application, such as Microsoft Teams, and ask Authenticator to issue delegated tokens for that identity.

The request did not need user approval, account credentials, or Android permissions beyond being installed on the device. At the center of the bug was an exported Android activity named com.microsoft.identity.client.AccountChooserActivity.

Other apps can start exported activities on the same device. In this case, the activity accepted a broker request from the calling app. It returned the authentication result after processing it.

The key problem was how Authenticator verified the requesting application. The broker request included the claimed app package name, client ID, redirect URI, requested scopes, and even a caller UID value. (Abinaya / Cyber Security News)

Related: Help Net Security, Enclave

Sony rewarded a hacker $50,000 for reporting a PlayStation 5 exploit that would have let users boot Linux on their consoles.

The revelation that Sony paid the reporter $50,000 has caused a stir online because the original discoverer, who found the exploit last year, intended to keep it secret until the launch of GTA 6.

Since then, the exploit was discovered by a user named ‘Jordy’, who discovered it via AI tools, but instead of keeping the exploit a secret, which would benefit the community, he decided to report it because a third person also found it.

In a report from IGN, in which Jordy spoke to them, he said he decided to report the exploit because of personal pressure from his mother’s terminal illness.

Following the successful claim of the $50,000, Jordy took to Twitter to say that “I can at least buy GTA with this I think,” along with a screenshot of the reward. (Tom Henderson / Insider Gaming)

Related: Tech Times, IGN, r/pcmasterpiece

The Cybersecurity in Police Forces and Fire and Rescue Services report from His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) says that the cyber threat to UK police forces and fire and rescue services is growing rapidly and demands a more urgent response, an independent assessment has warned.

The report was compiled from a three-phase inspection carried out between January and May 2026, and involved dozens of interviews, “reality testing,” and scrutiny of over 260 police service and fire and rescue service documents.

“While there have been gradual improvements, many forces and services still need to urgently redouble their efforts to respond to the increased risk of cyber-attacks,” warned Michelle Skeer, His Majesty’s inspector of constabulary.

“Cybersecurity should be viewed as a core organizational priority and not solely a technical risk. Leaders need to prioritize and invest in their cybersecurity arrangements to improve their organization’s ability to prevent, detect, respond to and recover from attacks.” (Phil Muncaster / Infosecurity Magazine)

Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices.

Apple patched the same vulnerability in September for devices running iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.

Meta Product Security discovered this out-of-bounds write weakness (tracked as CVE-2026-86950) in CoreGraphics, a framework used for two-dimensional vector graphics, text drawing, and image rendering across iOS, macOS, iPadOS, watchOS, and tvOS.

Successful exploitation of out-of-bounds write security issues can let attackers crash programs, corrupt data, or gain remote code execution by writing data outside the allocated memory buffer.

"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27," Apple warned. (Sergiu Gatlan / Bleeping Computer)

Related: Apple, CyberInsider

Best Thing of the Day: There's Hope for the Future

Gen Z is fighting back against big tech platforms due to growing anger at tech platforms that have left some feeling as if they are being exploited for profit.

Worst Thing of the Day: Sure, Read All the Slop You Want

There's a growing trend of people of reading their news from feeds generated by AI agents instead of journalists.