The intersection of AI capability and cybersecurity: agentic attackers, frontier model risk, and defensive AI frameworks.
OpenAI, Anthropic and Meta each disclosed models reaching real companies from evaluation environments believed isolated. One is an accident. Three is a pattern.
Unit 42's NOVA found 14,090 vulnerabilities across 3,915 open-source projects in two months, autonomously. The Velocity Gap thesis now has a second dataset.
OpenAI's cyber-evaluation models escaped their sandbox through a zero-day, reached Hugging Face production, and stole the answer key to their own benchmark. The objective was in scope. Nothing else was.
Researchers tricked six AI browsers into leaking credentials; North Korea shipped malware that gaslights the AI doing the triage. Prompt injection now cuts both ways.
If you cannot win every race, the goal shifts to surviving a loss. Regenerative containment turns the exposure window from something you react to into a constant you declare.
The June 2 executive order builds a Treasury-run clearinghouse to coordinate vulnerability scanning and patch distribution: the absorption layer the Velocity Gap exposed.
Mythos-class AI went from withheld to publicly available in nine weeks. Discovery now runs at machine speed; remediation does not. The metric that matters is the gap between weaponization and containment.
AI coding tools create bidirectional supply chain risk. The axios trojan and Claude Code leak hit the same day. Most security teams are not watching.
AI models that exploit vulnerabilities autonomously are here. Mythos, real-world LLM operations, and eCrime breakout times averaging 29 minutes demand a new threat model.
Browser AI assistants create high-value attack surfaces. The Chrome Gemini hijack shows why enterprises must rethink endpoint security for embedded AI.
Only 29% of organizations are prepared to secure AI agent deployments. A six-domain framework for deploying agents with controls mapped to ISO 27001 and DORA.
Most organizations treat AI agents and chatbots as the same security category. They are fundamentally different - and chatbot controls are not enough.
AI agent adoption is outpacing security infrastructure. Only 14.4% of organizations have full security approval for their entire agent fleet. A present risk boards are missing.