Stories This Week
- Top Story — Claude Mythos Preview + Project Glasswing — AI Reaches the Zero-Day Threshold: On April 7, Anthropic announced Claude Mythos Preview alongside Project Glasswing — the most consequential AI security development of 2026, and arguably of the decade..
- [GrafanaGhost] Prompt Injection in Grafana AI — Silent Data Exfiltration, No User Interaction Required: Researchers disclosed CVE-2026-27876, dubbed GrafanaGhost: an indirect prompt injection vulnerability in Grafana's AI assistant that enables silent exfiltration of business metrics, infrastructure telemetry, and customer data to attacker-controlled servers.
- [Anthropic] $100M Commitment to Open-Source Security: Alongside Glasswing, Anthropic announced a $100M commitment to open-source defensive security tooling, accelerating work on automated patch generation and vulnerability scanning infrastructure.
- [M&A] Cisco in Talks to Acquire Astrix Security (~$350M): Cisco is negotiating acquisition of Israeli AI security startup Astrix, focused on securing AI agents and non-human identities in enterprise environments.
- [Policy] US Officials Summoned for Urgent AI Security Briefings: Bloomberg reported that US officials brought together AI industry leaders for urgent briefings in the wake of the Mythos announcement.
- [OWASP] Top 10 for Agentic Applications — The New Security Baseline: OWASP published its Top 10 for Agentic Applications, the first comprehensive risk framework built specifically for autonomous AI systems.
- [HBR] "AI Is Reshaping Cyber Risk. Boards Need to Manage the Threat.": Harvard Business Review's April 2026 piece by Hise O.
Curator's Corner
Anthropic didn't leak the model.
They did something more permanent: they told the world it exists, it works, and it finds zero-days in every major OS and browser — some of them sitting undetected for 27 years.
The obvious objection is worth stating: leaking model weights is a different problem from leaking source code. Weights don't spread through npm in a few hours. That's true. But the risk isn't a leak. It's the proof.
Before this announcement, nation-states, well-funded threat groups, and rival AI labs operated under genuine uncertainty: can AI actually reach this capability threshold? Is autonomous zero-day discovery at scale real, or is it still years away?