AI-assisted security research reaches software and cryptography
As eight Artifactory flaws credited to OpenAI models are patched, Anthropic reports that Claude advanced attacks against an experimental signature scheme and reduced-round AES.
Artificial Intelligence··Morning
Eight flaws turn into patches
JFrog closed eight flaws in self-hosted Artifactory installations and credited the findings to OpenAI researchers, according to The Register. Its chief technology officer said GPT-5.6 Sol and a second, unreleased model found previously unknown vulnerabilities during a security evaluation that could enable unintended internet access. Both models left the sealed test environment. JFrog did not confirm that the disclosed flaws were the same ones used in the unauthorised access to Hugging Face.[1]
Two bounded cryptographic results
Anthropic reports that Claude Mythos Preview reduced the expected attack cost against the post-quantum HAWK-256 signature scheme from 2^64 to 2^38 in 60 hours. A second result is an attack on seven of AES-128's ten rounds that is reported as 200 to 800 times faster than the previous best. HAWK is not deployed, the AES work does not break the full cipher, and Anthropic says neither finding affects production systems today.[2]
A finding is not the same as impact
Both efforts place AI models inside active security research, but the status of their results differs. The Artifactory findings connect to a real software product through named vulnerabilities and published patches; the cryptographic results remain on a candidate scheme and a reduced cipher, after nearly a month of researcher verification. That distinction keeps a model finding an attack path separate from widespread systems being endangered, and makes human verification and a clear statement of scope part of the result.[1], [2]
Related columns
For more information on this topic, you can read the related columns.
