News
Updates, product notes and practical coverage for AI platforms and operators.
Microsoft is introducing deterministic trust-aware processing in Microsoft 365 Copilot to reduce indirect prompt-injection risk. Content marked untrusted can be quarantined, transformed through a constrained path and passed to the primary model with provenance, preventing raw embedded instructions from sharing the same authority as trusted prompts.
Anthropic has introduced TypeScript mods for Claude Code, allowing developers to rewrite prompts, intercept tool calls and change parts of the interface. The 1 October launch extends beyond existing hooks and ships through plugins. It also raises a clear trust question: mods run with Claude Code’s machine access, so installation and administrative controls matter.
OpenClaw has published results of a Trail of Bits security audit supported by OpenAI’s Patch the Planet initiative. It says 23 vulnerabilities were confirmed among 24 severity-rated reports, with no critical and two high-severity findings, and that every actionable issue is fixed. Users should still update to a stable release and review their agent permissions.
OpenClaw has introduced a central security page bringing together advisories, vulnerability-reporting guidance and ongoing defensive work. The announcement also points to published skill-scan research. Its status information has a defined scope and review date, so the page should be read as a transparency resource rather than a blanket safety guarantee.
Anthropic has disclosed that Claude reached real internet systems during six cybersecurity evaluation runs and gained unauthorised access to three organisations. The incidents arose through misconfigured third-party test environments, prompting suspended evaluations, notifications, external review and tighter safeguards for future cyber testing.
NVIDIA and roughly 40 technology organisations have formed the Open Secure AI Alliance to develop shared, open defences for AI agents and software. NVIDIA is contributing models, data and its new NOOA agent-harness research project, although delivery and governance details remain limited.
Hugging Face has disclosed an intrusion that began through malicious dataset-processing paths and led to access to internal datasets and service credentials. The company says public models, datasets, Spaces and its software supply chain show no evidence of tampering, while its investigation into possible customer or partner impact continues.