AI Security & Models — Issue #42 (Aug 17, 2026)
OpenAI's gated cyber model, GLM-5.3's CyberGym lead, real agent breakouts, EU watermarking rules, and Grok Bot's "coworker" beta—plus what to watch next.
Z.AI's GLM-5.3 Model and the Automated Vulnerability Pipeline
GLM-5.3’s CyberGym result points to faster vulnerability discovery, but we still need human oversight
The Irony of Banking: Finding Flaws in a Legacy Java Framework with a Bank‑Built AI Harness
Two new Apache Struts CVEs show how a bank‑built AI harness for Claude Opus 4.8 can find real, unauthenticated DoS flaws in the legacy Java frameworks powering global banking.
Cursor Coding agent Deletes a Production Database
A Cursor coding agent wiped a production database and its backups through a valid API call. Traditional DLP could not catch it.
The CRA’s 24-hour reporting deadline is closer than it looks
The EU Cyber Resilience Act mandates 24-hour reporting for actively exploited vulnerabilities from September 2026
OpenAI's Daybreak Solved Vulnerability Discovery. Who Will Validate the Results?
From OpenAI's Daybreak to Anthropic's Glasswing: AI Has Accelerated the Wrong Half of Security
The Claude Code Source Leak
How a 60MB .map File Exposed Half a Million Lines of TypeScript — and What Happened Next
Your SME doesn’t build AI, but it desperately needs an AI security strategy
In the rush to "go AI," most small and medium-sized enterprises (SMEs) share a common misconception: “We aren’t tech developers, so we don’t need an AI strategy".
The Swiss Guide to the EU AI Act
Staying Compliant from Outside the Union
You Just Hired an AI Agent but Nobody Told HR
AI agents can read your email, browse the web and execute code. Most small teams have no rules around any of it
Europe Wants Sovereign Cloud
But Sovereignty Is Still Mostly in American Hands
The Most Expensive Checkbox in Cybersecurity
"Why most third-party risk programmes are compliance theatre not what the standards actually require."