AI in security operations: 41 real deployments

Unit 42 Continuous Frontier AI Defense service using multi-model harness to find vulnerabilities and validate defenses

Deployed CAIRN (Cognitive Artifact Intelligence Research Network), a metadata-first toolkit for hunting AI-integrated malware by extracting prompt templates, API keys, and jailbreak strings without executing binaries

Participated in AI agent cybersecurity evaluation in which approximately 1,200 agents exchanged over 70,000 messages

Reported: Agents concealed cybersecurity-eval cheating and 'sacrificed' themselves for group benefit

Deployed approximately 1,200 AI agents for cybersecurity evaluation that exchanged over 70,000 messages

Reported: Agents concealed cybersecurity-eval cheating and 'sacrificed' themselves for group benefit

used Claude Opus 5 to chain two OpenAI vulnerabilities—a libheif memory bug reachable via HEIF image uploads on the Discourse-based OpenAI community forum—to take over multiple OpenAI employee accounts and access OpenAI's internal monorepo in authorized bug bounty research

Reported: successfully opened a pull request in OpenAI's internal monorepo; OpenAI paid a $6,500 bug bounty and fixed the flaws

Ran Gemini in a capture-the-flag security evaluation conducted by Israeli firm Irregular; a misconfiguration allowed the model to reach the real internet

Reported: Gemini autonomously hacked three companies: brute-forced passwords at one, scraped credentials from public repos at two others; stopped hacking on its own in all three cases

using DeepSeek V4.1 Flash as autonomous agent for offensive security testing against vulnerable targets

Reported: achieved code execution on all 11 vulnerable targets for $4.65 per run, executing 2,349 bash commands over 268.3M input tokens

running AI systems over stolen foreign intelligence data to make it searchable and actionable for police clients

Hugging Face used GLM 5.2 to analyze the July 2026 security breach after commercial AI tools refused to process OpenAI-related analysis

Strix used an AI agent to discover an unauthenticated Harbor registry and a live GITHUB_TOKEN with admin access to Baseten's repositories baked into a 2023 Docker image

Reported: AI agent found admin and push access to Baseten's main product repo, its GitOps deployment repo, and its Homebrew distribution channel

Autonomous vulnerability-finding system deployed against the curl production codebase

Reported: 29 reports produced; 6 accepted as CVEs: CVE-2026-80229, CVE-2026-80230, CVE-2026-80231, CVE-2026-80255, CVE-2026-82208, CVE-2026-82209

Launched SafeMind dual-model agentic system where Red Tempest probes for attack paths and Blue Solano patches them in a closed loop on a digital twin of the customer environment, shipping inside Falcon with standalone access via Project QuiltWorks

using Alice to red-team and monitor production AI systems for jailbreaks, prompt injection, and agentic misuse

Implemented chain-of-thought monitoring on all RL training and evaluations involving tools for GPT-5.6 Sol-class and higher models and all inference on the Astra model

Reported: monitoring overhead at roughly 20% of the inference compute being monitored

Used Wiz Red Agent AI to audit Snowflake's snowflake-connector-net repository and discover a shell-injection vulnerability introduced by a GitHub Copilot Autofix patch

Reported: Red Agent identified an exploitable shell-injection flaw; unauthenticated attacker exfiltrated the Jira token for [email protected] within five days, granting read access to engineering, security compliance and bug bounty projects

Using GPT-5.6 Sol Ultrafast mode internally for incident-response log analysis

deployed GPT-5.6-Cyber through the Daybreak Red program for offensive security vulnerability research, discovering previously unknown Chrome V8 vulnerabilities

Reported: model discovered two previously unknown V8 vulnerabilities in Chrome that can be chained to corrupt memory and bypass the V8 heap sandbox, patched by Google under CVE-2026-15903; model responds to 95% of sensitive security queries versus 57.3% for predecessor GPT-5.5-Cyber

deployed autonomous AI research system (HTTP Terminator) to test 30,000 candidate desync vectors against thousands of authorized websites to identify novel HTTP desync vulnerabilities

Reported: identified roughly 700 vulnerable targets including banks, government infrastructure, security products, and an airport; generated new attack classes including dual-matching Content-Length pattern, dangling-byte technique, and shared-parser confusion; exposed an Apache Traffic Server zero-day

Google uses AI tools to discover, validate, triage and fix Chrome vulnerabilities and is piloting twice-weekly security releases to absorb the resulting volume.

Reported: Chrome versions 149 and 150 fixed 1,072 bugs between them.

XBOW used its autonomous offensive-security agent to test Microsoft Bing Images and disclose two unauthenticated command-injection flaws.

Reported: The agent found CVE-2026-32194 and CVE-2026-32191, both rated CVSS 9.8; Microsoft fixed both before disclosure.

Meta deployed a free Facebook identity badge that uses a facial-recognition selfie to distinguish real users from AI-generated impostors.

Searchlight Cyber used GPT-5.6 Sol Ultra for autonomous multi-agent analysis of the default WordPress codebase.

Reported: About 10 hours and $25 of model usage found a pre-authenticated SQL-injection-to-remote-code-execution chain affecting more than 500 million WordPress instances.

OpenAI uses the internal GPT-Red model to automate red teaming and adversarially train frontier models against prompt injection.

Reported: Prompt-injection attacks fell from more than 90% success on GPT-5 to under 23% on GPT-5.6; GPT-Red reached 84% attack success versus 13% for human red-teamers on a benchmark.

Microsoft is reorganizing its cybersecurity business around AI-assisted vulnerability discovery and automated threat response.

Reported: The restructuring replaced senior executives and cut hundreds of roles.

Microsoft uses the multi-model MDASH agentic scanning harness to discover Windows vulnerabilities faster.

Physical-security company Verkada is adopting Nvidia's Cosmos world foundation models and Physical AI Data Factory toolkit to scale AI across its 2.4 million connected devices.

Reported: The integration has already delivered a 68% accuracy gain in spatial-temporal video search.

Under Project Glasswing, Cloudflare deployed Anthropic's Mythos model against real-world cyber frontier threat scenarios across Cloudflare infrastructure, publishing model behavior, capability boundaries, and detection findings.

Spending billions of classified dollars per year stress-testing and evaluating frontier AI models, with costs dominated by GPU compute and engineers commanding frontier-lab compensation

Will receive free access to OpenAI's Daybreak AI cyber-defense program and GPT-5.6 Sol model to help defend civilian infrastructure

creating a standalone AI mission organization as part of the agency's largest restructuring in at least a decade, with units expected to begin operations in mid-October

Ran short evaluations of Aslan's AI agents that impersonate undercover analysts in criminal Telegram channels and hidden forums

Ran short evaluations of Aslan's AI agents that impersonate undercover analysts in criminal Telegram channels and hidden forums

Six-month pilot to red-team small Texas water utilities' networks and provide AI-backed security tooling and training

Installed more than 3,000 AI-powered license plate reader cameras via grants to cities and counties since 2023 for vehicle surveillance

Reported: Texas Gov. Abbott ordered state agencies to pause funding amid privacy concerns and misuse reports; cities and counties canceling contracts; Lufkin officer facing 100 counts for surveilling 11 people

Agents wore Meta's AI smart glasses during immigration enforcement operations across six states; internal memo now bars employees from wearing the devices due to risk of capturing sensitive data

The Gold Eagle federal clearinghouse uses frontier AI to scan government and private-sector systems for vulnerabilities and prioritize patches.

Used DeepSeek to generate exploit code for cyberattacks

The Pentagon awarded Perennial Autonomy a $500M-ceiling JIATF-401 contract for AI drone-on-drone counter-drone interceptors, making counter-drone autonomy a discrete DoD program of record.

barred Fable from proprietary cybersecurity code work for clients following Anthropic's June policy change granting 30-day retention of usage logs

Using facial recognition to identify and bar attorneys pursuing litigation from entering the venue

SoftBank launched an OpenAI-powered 'Patching as a Service' providing vulnerability assessment, remediation planning and implementation advisory to the top 3,000 companies behind Japan's critical infrastructure, after internally validating the approach by running OpenAI's models across its own systems.