AI's cyber reach expands, exposing new security and governance risks

Summary

Anthropic is expanding Project Glasswing to provide Claude Mythos and a security vulnerability workflow to 150 organizations across more than 15 countries. The program targets critical infrastructure operators in power, water, healthcare, and communications where disruptions could impact up to 100 million people.

Why it matters

If AI meaningfully accelerates vuln discovery and triage in critical infrastructure, it can reduce systemic cyber risk, but it also raises new governance and security requirements for high-consequence environments.

Summary

Hackers reportedly manipulated an Instagram AI support chatbot into handing over information or access that enabled takeovers of other users' accounts. The incident has been linked to a cluster of recent hijackings of high-profile Instagram accounts.

Why it matters

If AI support tools can be socially engineered into granting access, account security becomes a platform-wide systemic risk rather than an individual user problem.

Summary

An anonymous researcher publishing as “Nightmare Eclipse” has released a series of Windows exploits, including a method that defeats default Windows 11 BitLocker protections. Microsoft has responded by threatening legal action, triggering a public dispute over vulnerability disclosure norms and responsibility.

Why it matters

How Microsoft handles this case will shape whether researchers cooperate on coordinated disclosure or treat Windows vulnerabilities as publish first, lawyer later.