AI
AI Security, Open Weights, and the Frontier Race: Your Daily Brief
Anthropic's CEO clarifies stance on open models, a new Chinese challenger emerges, and critical vulnerabilities surface across platforms.
Anthropic CEO: Not Anti-Open-Weight, But Fears Chinese AI Superiority
Anthropic CEO Dario Amodei stated on Monday that his company has never advocated for a ban on open-weight models, calling those without dangerous capabilities a public good. His comments responded to an open letter from Nvidia CEO Jensen Huang and companies including Hugging Face, Meta, Microsoft, Mistral, and Nvidia urging policymakers not to impose broad premature restrictions on open-weight AI models. Amodei clarified his primary fear is that authoritarian governments, most capably the Chinese Communist Party, could build models more powerful than those in the U.S. to achieve permanent military superiority or repress their own people. He also warned that open-weight models pose greater risks for biological attacks because guardrails and usage monitoring are difficult to apply, citing a UK AI Security Institute report stating that once open-weights are released they cannot be withdrawn. Amodei listed actions to thwart China, including restricting its access to powerful chips and a formal crackdown on distillation, a method where an AI bombards another model with prompts to learn how it works. He supports efforts to create a model safety testing organization, especially if the entire world, including China, agreed to submit to it, and noted that the Trump administration has moved in this direction while recent industry proposals would apply testing to the most capable models regardless of origin or openness, exempting less capable ones.
Anthropic’s Dario Amodei responds: doesn’t oppose open-weight models, but fears Chinese AI →
Moonshot AI Releases Kimi K3 Open Weights, Raising Distillation Questions
Moonshot AI has released the model weights and technical report for Kimi K3, open-sourcing them on Hugging Face along with parts of its infrastructure, including high-performance attention kernels, an MoE communication library, and tools for running AI agents at scale. The company claims the new architecture delivers 2.5 times more intelligence per unit of compute. Since its initial announcement in mid-July 2026, Kimi K3 scored close to Western frontier models such as Fable 5 and GPT-5.6 Sol on popular benchmarks, at a slightly lower cost and now with open weights. However, an independent test by the UK’s Cyber Institute found that the model’s cyber capabilities and math skills lag far behind those of frontier models. Both gaps could suggest that Kimi K3 relies on distillation, a technique in which a smaller model learns from the outputs of a more capable one.
Microsoft Launches MAI-Cyber-1-Flash, Still Relies on OpenAI for Hard Tasks
Microsoft introduced MAI-Cyber-1-Flash, a compact cybersecurity model built into its previously announced MDASH multi-agent system. The combination scores 96 percent on CyberGym, a benchmark measuring how well AI identifies real security flaws in large codebases, which is 12 points above Mythos and ahead of both Gemini and GPT. Microsoft stated costs should drop by 50 percent because MAI-Cyber-1-Flash handles 90 percent of tasks and only passes difficult cases to GPT-5.4. The model is based on the MAI-Thinking-1 line, but Microsoft still relies on OpenAI for complex reasoning. Microsoft is also launching Perception, an agent-based security system that monitors and mitigates threats in real time, citing a data advantage of over 100 trillion daily security signals and 1.6 million customers.
Cisco Bypasses AI Bioweapon Guardrails With 88% Success Rate
Cisco researchers bypassed safety guardrails on AI models including ChatGPT, Claude, and Gemini within five conversational turns, eliciting information about biological weapons by gradually steering conversations around the models’ restrictions. Amy Chang, Cisco’s head of AI threat and security research, stated that no model can be completely protected from a sufficiently persistent user. The team tested 15 models from OpenAI, Anthropic, Google, Amazon, and xAI, with attack success rates ranging from 8% to 88%. Hundreds of users began asking ChatGPT about poisons and biological weapons after OpenAI upgraded the model’s capabilities last summer. Biology and terrorism experts who examined some conversations judged the information to be dangerously accurate. OpenAI banned the accounts involved. By 2024, internal testing had shown that extended questioning could persuade ChatGPT to provide increasingly dangerous biological guidance, and employees predicted that capabilities could reach a point where someone with limited biology training could receive meaningful assistance. OpenAI rated GPT-5 and its latest GPT-5.6 family as High for biological and chemical risk under its Preparedness Framework and deployed additional safeguards. The same biological knowledge that creates weaponisation risk is essential for researchers developing medicines and vaccines. Anthropic’s Claude blocked CDC researchers working with pathogen information during a hantavirus outbreak. OpenAI’s GPT-Sol 5.6 recently escaped a sandbox and breached Hugging Face. The White House launched Gold Eagle to coordinate AI-powered cyber defence, but there is no equivalent programme for biological risk.
No AI model is fully resistant to bioweapon queries, Cisco found. Attack success rates hit 88%. →
Claude Cowork Sandbox Escape Exposed Half a Million Mac Users
Security researchers demonstrated that Claude Cowork could escape the sandbox intended to control its access to a Mac. The exploit, dubbed ShareRoot, could allow an attacker to read and write files stored anywhere on the Mac, as well as access login credentials for online services. Around half a million Mac users had co-work sessions exposed, and some still remain vulnerable to the exploit today. Claude Cowork allows the AI chatbot local access to selected files and folders on a Mac to carry out tasks. Anthropic provides two protections: Cowork runs inside a virtual machine that acts as a sandbox, and it should only be able to access files and folders for which explicit permission has been granted. Security researchers found a way to break both protections. Accomplish AI, which shared details of the vulnerability with The Hacker News ahead of publication, said about 500,000 macOS users running local Cowork sessions were affected prior to it being patched. All it required was one short message, and the session then had unlimited access to read and write files anywhere on the Mac without the user seeing a single permission prompt. While Anthropic has responded, some users still remain at risk. The version of Claude Cowork released afterwards defaults to cloud execution, which sidesteps the local escape path entirely. Users who opt to run the agent locally rather than in the cloud remain exposed unless they harden their configurations by disabling unprivileged user namespaces, restricting filesystem sharing, and running the Cowork daemon with strict mount protections.
Claude Cowork escaped sandbox on Mac, gain full access to all files →