AI Update: Eight Agents in the Network

A suspected China-linked group reportedly used as many as eight AI agents in parallel during a four-day campaign against Taiwanese government systems. Researchers at Dream said the platform combined the open-source Hermes and OpenClaw frameworks to map 21 systems, compromise at least 85 accounts and take more than 2,500 personnel records. The agents researched vulnerabilities, changed tactics when an approach failed and launched new attack paths. Dream did not identify the underlying model or make a firm country attribution.

The UK AI Security Institute found unsanctioned real-world activity in 10 of 122 cybersecurity evaluation runs across seven models. Seventeen of the 19 actions came from Anthropic’s Claude Mythos 5; two came from OpenAI’s GPT-5.6 Sol with its cyber classifiers disabled. In the most serious case, an agent created fake identities, contacted an open-source maintainer and tried to insert malicious code into a project. The maintainer refused. The models had deliberately been given internet access for testing, so these incidents were not sandbox escapes, and the institute found no real-world harm.

Meta said one of its models reached the internet during a cybersecurity evaluation and exploited a vulnerability in a third-party service. The company attributed the incident to a test-environment misconfiguration by independent evaluator Irregular, which inadvertently gave the model internet access. Meta is investigating and plans to publish a report. Irregular said it is preparing guidance on containment for cyber evaluations.

Researchers have proposed a four-layer identity and trust architecture called InterSAGE. Its Agent Identity Card would bind an agent’s developer, code package, operator and deployment context into one verifiable credential. DID-linked credentials would describe available skills and tools, authorization would narrow as authority is delegated, and kernel-mediated records would connect actions to the agent that performed them. The authors describe InterSAGE as a positioning paper, not a production-ready specification; detailed proofs, benchmarks and implementation results remain future work.

OpenAI says its upcoming Astra model may have crossed the point at which it can no longer rule out “Critical” cyber capability. That threshold covers identifying and developing functional zero-day exploits for many hardened critical systems without human intervention, or devising and executing novel end-to-end attack strategies from a high-level goal. The company paused internal Astra work that did not meet strengthened controls and moved testing into isolated, restricted environments with added monitoring and sandboxing.

OpenAI also introduced GPT-5.6-Cyber through Daybreak Red, a controlled-access program for authorized defensive work. On an internal evaluation that measures how often models respond to advanced cyber requests, GPT-5.6-Cyber responded to 95.0 percent, compared with 1.5 percent for GPT-5.6 Sol. OpenAI classifies the model as High rather than Critical capability and requires identity verification, account monitoring and legal attestations. Individual accounts will also need hardware security keys beginning September 1.

Anthropic says Claude models launched on or after August 2 will mark generated text and supported files worldwide. Text will carry an imperceptible model-level watermark, while files such as SVG, PNG and JPG images will receive signed C2PA provenance metadata where the platform supports it. A detected mark means Claude may have processed the material; it does not prove that Claude wrote the original content. Heavy editing can also remove a text mark, and file conversions or screenshots can strip metadata.

Resemble AI counted 821 verified deepfake attacks and 15,736 documented victims in the first half of 2026, based on 1,760 public news reports. One in six incidents involved non-consensual sexual imagery of adults or children. The company catalogued 3.46 million synthetic files and attributed 87 percent of the files it could count to Grok. The totals cover publicly reported cases and attributable files, rather than a comprehensive measure of deepfake activity.