AI
GPT-5.6 Pro Splits, Agent Supply Chain Attacks, BioShocking & More
OpenAI reveals three Pro models, AI coding agents fuel supply chain attacks, Meta advances non-invasive BCI, and Anthropic caught hiding surveillance code.
OpenAI Paper Reveals Three GPT-5.6 Pro Variants, Breaking Single-Tier Model
A new OpenAI benchmark paper discloses that the Pro tier of GPT-5.6 will ship in three distinct variants: GPT-5.6 Luna Pro, GPT-5.6 Terra Pro, and GPT-5.6 Sol Pro. This follows the standard GPT-5.6 announcement in late June, which introduced three models—Sol for hardest tasks, Terra for high-volume workloads, and Luna for faster queries—without mentioning Pro versions. The paper describes a genomics benchmark listing “Pro (Extended)” runs for each tier, marking a departure from the single top-tier Pro model that launched with ChatGPT Pro. On the benchmark, Sol Pro achieves a pass rate of 31.5 percent, the highest among 60 tested models, compared to standard Sol at 28.7 percent and the best non-GPT score, Claude Opus 4.8, at 16.0 percent. The pass rate measures how often a model completes a full multi-step analysis without errors. Across the full 129-task suite, Luna Pro scores 23.6 percent (+7.1 points over standard), Terra Pro scores 28.5 percent (+5.2 points), and Sol Pro scores 31.5 percent (+2.8 points). The Pro boost shrinks moving up the ladder, and Terra Pro at 28.5 percent nearly matches standard Sol at 28.7 percent, meaning a high-volume Pro variant performs almost as well as the best standard flagship. The paper does not clarify whether this tiered structure will appear in ChatGPT; the names come only from the benchmark table. Token usage for standard Sol at its highest setting is about 33,200 tokens, but no comparable accounting is available for Pro runs—the paper notes this was withheld.
OpenAI paper reveals three GPT-5.6 Pro models, breaking with single top-tier strategy →
AI Coding Agents Bypass Package Verification, Fueling Supply Chain Attacks
AI coding agents are creating a new attack surface in software supply chains, according to a June 23 post by Socket’s Brad Arkin. The first half of 2026 produced more than 2.6 times the campaign volume and 4.5 times the package compromise volume of all of 2025 combined, with AI agents documented as an accelerant. Unlike human developers, AI agents do not check download counts, maintainer history, or question unfamiliar names before pulling packages. The PromptMink campaign, attributed to North Korean group Famous Chollima, used “LLM Optimization abuse” to craft READMEs that appear authoritative to language models rather than humans. The bait package @solana-launchpad/sdk included a malicious dependency chain with infostealers, SSH key deployment, and data archiving. Attackers rotated across npm, PyPI, and Rust, and in January 2026 a legitimate Solana Hackathon project was found to have included that dependency, added in a commit co-authored by Claude Opus. Another attack class, “slopsquatting,” exploits AI hallucination: USENIX Security 2025 research found roughly 19.7% of AI-generated package recommendations reference non-existent packages. For example, the hallucinated name react-codeshift spread to 237 GitHub repositories via AI agent skill files before a researcher defensively registered it. The Clinejection incident in February 2026 showed how AI agents in CI/CD pipelines multiply risk: an attacker tricked a Cline AI issue triage workflow into running npm install from a malicious commit, leading to cache poisoning and credential exfiltration. Eight days later, an unauthorized actor published [email protected] to npm, installing an open-source agent on every developer machine during an eight-hour window. Every supply chain attack described delivers its payload through the npm postinstall hook, which runs with full filesystem and environment access before security tools can inspect packages. On May 1, 2026, CISA, NSA, and Five Eyes partners jointly published “Careful Adoption of Agentic AI Services,” confirming that prompt injection is the “most persistent and difficult-to-fix threat” and recommending trusted registries, restricted tool lists, and human approval for high-impact actions. Researchers advise treating AI-agent-suggested packages as a distinct review category, enforcing registry policies at the CI/CD level, and using behavioral detection over CVE databases alone.
AI Coding Agents Skip Package Verification, and Attackers Are Exploiting It →
Meta’s Non-Invasive Brain-to-Text AI Narrows Gap with Surgical Implants
Meta researchers have developed Brain2Qwerty v2, a non-invasive brain-to-text AI that reconstructs sentences from magnetoencephalography (MEG) signals recorded outside the skull. The study involved nine healthy volunteers, each recorded for ten hours, who typed a total of 22,000 sentences while hearing prompts but not seeing the text. The model captures activity primarily from the motor cortex controlling finger movements. Unlike its predecessor, version 2 works with a continuous signal window and assigns characters without exact keystroke timestamps, removing a key barrier toward real-time use, though real-time capability is not yet achieved. The model uses deep learning, processes signals at character, word, and sentence levels, and fine-tunes a Qwen3 language model to shape noisy signals into coherent sentences. Brain2Qwerty v2 reaches an average word error rate of 39 percent, compared to 55 percent for the raw encoder and 43 percent for the earlier N-gram model. For the best participant, 28 percent of sentences are decoded perfectly, and 47 percent contain at most one wrong word. However, the language model can invent grammatically clean but incorrect sentences when brain signals are weak; for the worst participant, it decoded “had she not fallen down the stairs” instead of “cars are not allowed on this road.” The team considers word and semantic scores more relevant for communication. An auto-research component using three Claude Opus 4.6 agents found techniques like label smoothing and modality dropout that beat standard optimization, but open-ended tasks failed. The gap to implanted systems remains large—invasive interfaces achieve below two percent word error rate—but accuracy keeps climbing with more data, and portable room-temperature MEG sensors show promise. The study is limited to healthy volunteers making real typing movements, and significant differences between participants remain.
Meta’s non-invasive brain-to-text AI is closing the gap with surgical implants →
New BioShocking Attack Tricks AI Browsers into Leaking Credentials
Security firm LayerX has developed an attack named BioShocking that exploits indirect prompt injection to trick AI browsers and assistants into copying sensitive user data and sending it to an attacker. In a proof of concept, a malicious web page presented itself as a puzzle game with rules that rewarded wrong answers. After the AI agent accepted the false logic, it followed subsequent instructions to find and copy a hidden code, which in the test came from sensitive data in a work GitHub repository, including SSH credentials. LayerX tested BioShocking against six AI browsers and assistants: OpenAI’s ChatGPT Atlas, Perplexity’s Comet, Anthropic’s Claude browser extension, Fellou, Genspark Browser, and Sigma Browser. All six exposed sensitive information during testing. The risk arises because AI browsers in agent mode can click, read, and act inside accounts where users already have active sessions, including work repositories, cloud dashboards, and internal tools. LayerX disclosed the issue to vendors between October 2025 and January 2026. OpenAI fixed the issue in ChatGPT Atlas. Anthropic attempted a fix but LayerX said the patch did not hold. Perplexity reportedly closed the issue without taking action, and Fellou, Genspark, and Sigma did not respond. LayerX recommends that AI browser makers require user confirmation before reading from logged-in accounts, detect pages that try to rewrite rules, and allow users to set hard access limits. For individual users, LayerX advises signing out of sensitive accounts and closing unnecessary tabs before using agent mode. Organizations should give agent mode the narrowest access needed and set rules around internal apps, repositories, and credentials.
New BioShocking Attack Tricks AI Browsers →
Hidden Code in Claude Code Secretly Flagged Chinese Users
Anthropic is rolling back a covert surveillance feature in its coding tool Claude Code, first exposed by a Reddit user. Since version 2.1.91, released April 2, 2026, Claude Code has been secretly checking whether users with an active proxy are located in China, routing through a Chinese URL, or connected to a Chinese AI lab. The data is transmitted through barely perceptible changes to the system prompt using steganography: the software compares the system timezone against “Asia/Shanghai” or “Asia/Urumqi,” scans the proxy URL for Chinese domains and AI labs, and then tweaks the date format and swaps in a subtly different apostrophe character in the phrase “Today’s date is.” Users cannot see the difference, but Anthropic can read it instantly. The code was obfuscated using XOR encryption with key 91, preventing it from appearing in a simple text dump, and the release notes made no mention of the check. The discoverer called the covert transmission of system and proxy data without user knowledge “a fundamental violation of user trust,” noting that since Claude Code has full filesystem and shell access, this opens the door to remote control and data exfiltration. Anthropic employee Thariq Shihipar described the feature on X as “an experiment we launched in March that was meant to prevent account abuse from unauthorized resellers and protect against distillation.” He said the team had since shipped stronger mitigations and had been meaning to take the experiment down; they merged the corresponding pull request and the feature should be fully rolled back in the next release. Anthropic does not offer its models in China for national security reasons, and many Chinese developers access Claude through foreign phone numbers. The company had previously accused DeepSeek, Moonshot AI, MiniMax, and Alibaba of using Claude model outputs without permission.