Agents find the flaw, write the exploit, run the intrusion. Patching still runs on human time. That is what Sovereign GRC’s Cyber Risk Briefings are set to address.
Anthropic's Mythos Preview found thousands of high- and critical-severity flaws, one 27 years old. Access is restricted.
April 2026Anthropic (opens in a new tab)
The UK's NCSC tells organisations to prepare for an AI-driven "vulnerability patch wave".
May 2026NCSC (opens in a new tab)
CISA weighs cutting the federal patch deadline from weeks to three days, citing AI.
May 2026Reuters (opens in a new tab)
Google catches the first zero-day exploit it believes was built with AI, before the planned mass attack.
Researchers claim Kimi K3 agents found 19 Redis zero-days in 90 minutes. Redis ships seven releases in a day.
July 2026The Hacker News (opens in a new tab)
An autonomous AI agent breaches Hugging Face production, reaching internal datasets and credentials.
JadePuffer, an LLM agent, encrypts 1,342 Langflow configurations and destroys the keys.
July 2026Sysdig (opens in a new tab)
CISA publishes a vulnerability baseline "before AI-enabled vulnerability discovery becomes more widespread".
August 2026CISA (opens in a new tab)
AI agents fire SQL injection at a Library and Archives Canada search service. No compromise reported.
September 2026BleepingComputer (opens in a new tab)
Anthropic's Deputy CISO tells security leaders to take the case for basic defences to the board now.
22 October 2026Jason D. Clinton on X (opens in a new tab)
Cloudflare's CEO warns more severe flaws are coming. Government sites go offline over PHP.
23 October 2026Reuters (opens in a new tab)
Anthropic will not release Mythos. Open weights have no such gate. Refusal is one direction in the weights; subtract it and capability stays. OBLITERATUS does that in one step. In a July 2026 study, refusal-ablated models produced usable vulnerability patches more than twice as often as their aligned twins.
A self-hosted, unaligned model that can find zero-days answers to no one. The remaining control is capability lag.
Four cases from the last month of briefings.
Ransomware. Phones down a week, family portal down ten days, children's records stolen.
Server shut down. Names, addresses and birth dates accessed in a 3.5-million-member loyalty database.
Eleven years of tax slips with social insurance numbers sat where a thief could reach them.
Taken offline by their own operators who could not patch PHP in time.
We saw this pattern six months ago and started a daily Cyber Risk Brief in May 2026. Daily proved more than we could sustain at our standard of sourcing, so it became a weekly, curated from primary sources.
Sourced to the vendor, the agency, or the outlet.
Published October 19, 2026. 26 min read.
US federal deadlines have passed for seven of nine exploited flaws, and two fall today. Two Canadian incidents are confirmed, and a compromised backup-vendor credential signed in to at least 173 Microsoft 365 tenants, per Huntress.
If you run systems people depend on, we help you find exposure before an attacker does.
Start with the briefing. Call when a line in it is about you.
Intake is open for the Curated Cyber Risk Brief: exposure alerts matched to your stack, weekly, silent when nothing is material.