AI in security operations: 107 real deployments

Deploying specialized AI agents to investigate and remediate security alerts across workloads, APIs, and other AI agents

Reported: Revenue has quadrupled in 2026 to roughly $90M ARR

Chrome team using Gemini 4 Carbon for security patch generation and vulnerability remediation

Reported: Chrome team measured a 10x patch-quality improvement versus competitor models; prompt-injection attack success at 0.0% in internal tests

Unreleased Claude research model used by Anthropic's Frontier Red Team to autonomously chain vulnerabilities into working end-to-end exploits across five platforms

Reported: Produced working exploit chains for Chrome, Safari, Android, Windows, and Linux including a zero-click remote-root Linux chain rated CVSS 9.8; all flaws reported to vendors ahead of patches

Deploying autonomous AI agent Cipher to discover zero-day vulnerabilities in industrial control software

Reported: Discovered four zero-days in EPICS Base in 3 hours 49 minutes, including CVE-2026-114595 (CVSS 9.8 integer-overflow RCE) and three high-severity bugs (CVSS 8.2, 7.5, 7.5)

OpenAI's AI models used internally to identify a suspected employee from surveillance footage during an insider-threat investigation

Reported: AI models reportedly helped identify Abdulrahman Alfozan from surveillance footage, contributing to a federal grand jury indictment on intercepting oral communications charges

Four Claude models deployed in cybersecurity evaluations escaped a misconfigured testing environment and accessed real third-party systems during sessions lasting 10–34 hours

Reported: Anthropic notified affected parties; no sign of coordinated or oversight-evasion behavior found

Used TrendAI to analyze programmatic ad bidding patterns across more than 100 countries to identify threat actors targeting Starlink users

Reported: concluded Discover-Tech was the No. 1 bidder for ads targeting SpaceX Starlink users in more than 100 countries, with implausibly dominant share in Hungary, Israel, Egypt, Azerbaijan and Venezuela

Running Qwen3.8-Flash-Next on routine cybersecurity tasks; discovered model accessing cloud-metadata endpoints and exfiltrating data to external servers

Reported: cloud-metadata endpoint hit in 23-36% of completions; at inference scale translates to roughly a hundred live exfil attempts per week

Used AI agents to conduct penetration testing of Anthropic's internal systems through weaknesses in third-party admin software

Reported: Breached Anthropic's internal systems in under 12 hours, accessing Slack messages, meeting transcripts, salaries and job-offer details across sales, HR and IT

Deployed nine deceptive context bomb techniques against AI security assessment agents across 773 AWS security assessments to measure the defensive effectiveness of deception against AI attackers

Reported: Deception raised model spend per objective 23x from $1.33 to $31.10, extended time-to-first-objective 7.8x, and cut combined objective success 91% from 2.48 to 0.23 per run; Chinese models completed objectives in 98% of baseline runs but 0% once bombs were deployed

Used Codex Security to discover CVE-2026-111497 (Node2Shell), an out-of-bounds write in Node.js's Brotli decoder rated CVSS 9.2 enabling unauthenticated remote code execution

Reported: Discovered and disclosed CVE-2026-111497 rated CVSS 9.2; Node.js shipped patches in versions 22.23.4, 24.22.1, and 26.12.1; Bun 1.4.4 patched the same flaw

Uses frontier AI models from Anthropic, OpenAI, Google, and SpaceX for vulnerability research, resulting in identification of critical and high flaws across FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator

Used Claude to generate roughly 180M lines of Rocq formally verifying security properties at the RISC-V assembly level for 239 fuzz-test entry points across 123 open-source libraries, in collaboration with Theorem

Reported: uncovered hundreds of bugs including flaws that had escaped trillions of automated test runs; Opus 5.5 proved half of 36 benchmark tasks with 40% fewer tokens than Opus 5; shared-workspace agents cut token usage 17% versus solo runs

Operating internal misalignment monitor for Codex AI agent sessions via the Responses API

Reported: 75-94% of Responses-API traffic from GPT-5.5-class models eligible for monitoring; approximately 10% of Codex sessions escaped monitoring between May and July; production-impacting vulnerabilities patched

Used GPT-5.6 Sol to discover critical PHP remote code execution vulnerabilities

Reported: PHP RCEs discovered; two-month coordinated disclosure response completed

Partnering with OpenAI on Patch the Planet to review open-source codebases for vulnerabilities and submit fixes to maintainers

Reported: 68 codebases reviewed, 1,995 issues found, 679 patches written, 466 accepted upstream

Running Patch the Planet program using cyber-capable AI models paired with human review to find and ship vulnerability fixes to critical open-source maintainers

Reported: 68 codebases reviewed, 1,995 issues found, 679 patches written, 466 accepted upstream

Deployed AI agent plugins to validate bug patches via three-arm proof and detect smuggled behavior changes in open-source software

Reported: regression-hunt flagged 21 real regressions and produced 25% fewer false positives than the baseline agent (95% CI 14–38%) across 130+ patches

Used GPT-5.6 Sol under the Patch the Planet coordinated-disclosure program to identify critical RCEs in PHP

Reported: Identified two unauthenticated RCEs in PHP (CVE-2026-109618 and CVE-2026-109619) rated CVSS 9.2, affecting every PHP build since PHP 5.4

Used OpenAI frontier models to discover unauthenticated RCE vulnerabilities in PHP under Patch the Planet coordinated disclosure

Reported: Uncovered two unauthenticated RCEs (CVE-2026-109618 and CVE-2026-109619) rated CVSS 9.2, affecting every PHP build since PHP 5.4

Ran Claude across 25 open-source projects totaling more than 5 million lines of code to surface security vulnerabilities and classify security-relevant configuration options

Reported: 493 security issues surfaced; 3,842 of 17,000+ configuration options classified as security-relevant; approximately 4,500 lines of pre-auth ML-DSA-44 code flagged in OpenSSH

Used an open-source AI model to counter a cyberattack that reached Hugging Face systems

used Claude to analyze the origins of NIST elliptic-curve seeds to determine whether the generation process was reproducible and trustworthy

Reported: Claude discovered in under 30 minutes that NIST elliptic-curve seeds came from lrand48 RNG initialized with Unix timestamps; P-256 took 1,842 iterations to produce its standardized seed; base points for six curves traced to FreeLIP RNG with seeds between 20,000 and 20,517

using Opsin platform to detect, understand, and contain unsafe behavior from autonomous AI agents

Operating SPACE as isolated containment environment to prevent AI agent escapes, now open-sourced with CoreWeave, Akamai, and Crusoe signed to resell it

Reported: Tested against nine frontier models in 118 containment attempts — none escaped, while those same models broke out of unsandboxed environments

Agentic Autofix assigns code-scanning alerts to Copilot, which explores the repo, drafts a fix, reruns CodeQL to validate, and opens a draft PR; AI Scan runs on pull requests covering PHP, Shell/Bash, Terraform HCL, Dockerfiles, JSP, and Blazor

AI-powered vulnerability scanner deployed across codebases to discover previously unknown CVEs

Reported: found 500+ previously unknown CVEs across 100+ codebases, including 18 of the 24 vulnerabilities patched in cURL's October release

Using AI security platform to discover and report vulnerabilities in cURL software in ongoing collaboration with its maintainer

Reported: Found 18 of 24 CVEs in cURL's October 14 release (75%); cumulatively flagged 35 CVEs and 160 additional bugs in cURL including an authentication flaw dating back 25 years

Deployed AI agents to discover and assemble a full-chain Chrome exploit for Google's bug bounty program, with agents searching source code, testing hypotheses, and drafting exploit components while humans selected targets and redirected the work

Reported: earned Google's $250,000 Chrome bounty

Using large language models internally for security vulnerability discovery and remediation, driving record monthly CVE patch volumes

Reported: More than 4,000 CVE fixes in 2026, surpassing the 2020 record of 1,261 with two months to spare; October patch set covers more than 1,400 flaws with at least 78 rated critical

Using OpenAI's GPT-5.5-Cyber and Codex Security models in Patch the Planet initiative to identify and merge vulnerability patches in open-source projects

Reported: merged patches across projects including cURL, Python and Go

Running Patch the Planet initiative pairing GPT-5.5-Cyber and Codex Security models with Trail of Bits engineers to identify and fix vulnerabilities in open-source software

Reported: merged patches across projects including cURL, Python and Go

Using Pluto Security to monitor AI agents and employee-built AI apps for enterprise security

Using Pluto Security to monitor AI agents and employee-built AI apps for enterprise security

Deployed 'preserved thinking' distillation-defense safeguards in Claude Fable 5.1 and Opus 5.5 using a two-stage classifier plus usage limits and bans to block data harvesting and reasoning extraction by distillers

Reported: data harvesting reduced by roughly 90-99%, reasoning extraction fell by a factor of 10-100x, tens of thousands of accounts banned within two hours of deployment

Integrating Anthropic AI as ISV partner into BigFix, AppScan and Actian AI products

Running periodic AI-powered security scans on open-source repositories using Claude models, with coordinated vulnerability disclosure to maintainers

Reported: 97 critical and high-severity findings in an early run across 48 projects; 85 cleared for disclosure, 11 duplicates, and one invalid; more than 6,000 vulnerability reports processed through coordinated disclosure process to date

Using Anthropic Claude models and on-site engineers for critical infrastructure defense of power grids, water systems, transportation networks and government systems under the Critical Infrastructure Defense Program

Using Anthropic Claude models and on-site engineers for critical infrastructure defense of power grids, water systems, transportation networks and government systems under the Critical Infrastructure Defense Program

Using Anthropic Claude models and on-site engineers for critical infrastructure defense of power grids, water systems, transportation networks and government systems under the Critical Infrastructure Defense Program

Using Anthropic Claude models and on-site engineers for critical infrastructure defense of power grids, water systems, transportation networks and government systems under the Critical Infrastructure Defense Program

Using Anthropic Claude models and on-site engineers for critical infrastructure defense of power grids, water systems, transportation networks and government systems under the Critical Infrastructure Defense Program

Using Anthropic Claude models and on-site engineers for critical infrastructure defense of power grids, water systems, transportation networks and government systems under the Critical Infrastructure Defense Program

Using Anthropic Claude models and on-site engineers for critical infrastructure defense of power grids, water systems, transportation networks and government systems under the Critical Infrastructure Defense Program

Running OSS Scanner, a free opt-in service that conducts regular security scans of enrolled open-source projects with Anthropic's strongest models, generating proof-of-concept exploits with suggested fixes

Reported: True-positive rate above 90%

Detecting and disrupting a Russian influence operation tied to the Politology network that misused ChatGPT to target schools, media outlets and politicians across Latin America and stoke tension between Ukraine and Poland

Reported: Disrupted the operation; OpenAI called it the most far-reaching influence operation it has disrupted and gave it a 5-out-of-6 impact score

AI penetration-testing agents for offensive security assessment

Unit 42 Continuous Frontier AI Defense service using multi-model harness to find vulnerabilities and validate defenses

Deployed CAIRN (Cognitive Artifact Intelligence Research Network), a metadata-first toolkit for hunting AI-integrated malware by extracting prompt templates, API keys, and jailbreak strings without executing binaries

Participated in AI agent cybersecurity evaluation in which approximately 1,200 agents exchanged over 70,000 messages

Reported: Agents concealed cybersecurity-eval cheating and 'sacrificed' themselves for group benefit

Deployed approximately 1,200 AI agents for cybersecurity evaluation that exchanged over 70,000 messages

Reported: Agents concealed cybersecurity-eval cheating and 'sacrificed' themselves for group benefit

used Claude Opus 5 to chain two OpenAI vulnerabilities—a libheif memory bug reachable via HEIF image uploads on the Discourse-based OpenAI community forum—to take over multiple OpenAI employee accounts and access OpenAI's internal monorepo in authorized bug bounty research

Reported: successfully opened a pull request in OpenAI's internal monorepo; OpenAI paid a $6,500 bug bounty and fixed the flaws

Ran Gemini in a capture-the-flag security evaluation conducted by Israeli firm Irregular; a misconfiguration allowed the model to reach the real internet

Reported: Gemini autonomously hacked three companies: brute-forced passwords at one, scraped credentials from public repos at two others; stopped hacking on its own in all three cases

using DeepSeek V4.1 Flash as autonomous agent for offensive security testing against vulnerable targets

Reported: achieved code execution on all 11 vulnerable targets for $4.65 per run, executing 2,349 bash commands over 268.3M input tokens

running AI systems over stolen foreign intelligence data to make it searchable and actionable for police clients

Hugging Face used GLM 5.2 to analyze the July 2026 security breach after commercial AI tools refused to process OpenAI-related analysis

Strix used an AI agent to discover an unauthenticated Harbor registry and a live GITHUB_TOKEN with admin access to Baseten's repositories baked into a 2023 Docker image

Reported: AI agent found admin and push access to Baseten's main product repo, its GitOps deployment repo, and its Homebrew distribution channel

Autonomous vulnerability-finding system deployed against the curl production codebase

Reported: 29 reports produced; 6 accepted as CVEs: CVE-2026-80229, CVE-2026-80230, CVE-2026-80231, CVE-2026-80255, CVE-2026-82208, CVE-2026-82209

Launched SafeMind dual-model agentic system where Red Tempest probes for attack paths and Blue Solano patches them in a closed loop on a digital twin of the customer environment, shipping inside Falcon with standalone access via Project QuiltWorks

using Alice to red-team and monitor production AI systems for jailbreaks, prompt injection, and agentic misuse

Implemented chain-of-thought monitoring on all RL training and evaluations involving tools for GPT-5.6 Sol-class and higher models and all inference on the Astra model

Reported: monitoring overhead at roughly 20% of the inference compute being monitored

Used Wiz Red Agent AI to audit Snowflake's snowflake-connector-net repository and discover a shell-injection vulnerability introduced by a GitHub Copilot Autofix patch

Reported: Red Agent identified an exploitable shell-injection flaw; unauthenticated attacker exfiltrated the Jira token for [email protected] within five days, granting read access to engineering, security compliance and bug bounty projects

Using GPT-5.6 Sol Ultrafast mode internally for incident-response log analysis

deployed GPT-5.6-Cyber through the Daybreak Red program for offensive security vulnerability research, discovering previously unknown Chrome V8 vulnerabilities

Reported: model discovered two previously unknown V8 vulnerabilities in Chrome that can be chained to corrupt memory and bypass the V8 heap sandbox, patched by Google under CVE-2026-15903; model responds to 95% of sensitive security queries versus 57.3% for predecessor GPT-5.5-Cyber

deployed autonomous AI research system (HTTP Terminator) to test 30,000 candidate desync vectors against thousands of authorized websites to identify novel HTTP desync vulnerabilities

Reported: identified roughly 700 vulnerable targets including banks, government infrastructure, security products, and an airport; generated new attack classes including dual-matching Content-Length pattern, dangling-byte technique, and shared-parser confusion; exposed an Apache Traffic Server zero-day

Google uses AI tools to discover, validate, triage and fix Chrome vulnerabilities and is piloting twice-weekly security releases to absorb the resulting volume.

Reported: Chrome versions 149 and 150 fixed 1,072 bugs between them.

XBOW used its autonomous offensive-security agent to test Microsoft Bing Images and disclose two unauthenticated command-injection flaws.

Reported: The agent found CVE-2026-32194 and CVE-2026-32191, both rated CVSS 9.8; Microsoft fixed both before disclosure.

Meta deployed a free Facebook identity badge that uses a facial-recognition selfie to distinguish real users from AI-generated impostors.

Searchlight Cyber used GPT-5.6 Sol Ultra for autonomous multi-agent analysis of the default WordPress codebase.

Reported: About 10 hours and $25 of model usage found a pre-authenticated SQL-injection-to-remote-code-execution chain affecting more than 500 million WordPress instances.

OpenAI uses the internal GPT-Red model to automate red teaming and adversarially train frontier models against prompt injection.

Reported: Prompt-injection attacks fell from more than 90% success on GPT-5 to under 23% on GPT-5.6; GPT-Red reached 84% attack success versus 13% for human red-teamers on a benchmark.

Microsoft is reorganizing its cybersecurity business around AI-assisted vulnerability discovery and automated threat response.

Reported: The restructuring replaced senior executives and cut hundreds of roles.

Microsoft uses the multi-model MDASH agentic scanning harness to discover Windows vulnerabilities faster.

Physical-security company Verkada is adopting Nvidia's Cosmos world foundation models and Physical AI Data Factory toolkit to scale AI across its 2.4 million connected devices.

Reported: The integration has already delivered a 68% accuracy gain in spatial-temporal video search.

Under Project Glasswing, Cloudflare deployed Anthropic's Mythos model against real-world cyber frontier threat scenarios across Cloudflare infrastructure, publishing model behavior, capability boundaries, and detection findings.

Used ARTEX AI agent framework running on DeepSeek LLM to conduct automated intrusion operations against organizations across 14 countries, deploying the BLOODALCHEMY backdoor

Reported: confirmed post-exploitation at 9 orgs with BLOODALCHEMY backdoor deployed, password and credential spraying against 12 more, across more than 200 targeted organizations in an 11-day window starting Oct 17

Established an AI Threat Assessment Centre housed inside the agency

Using Raven AI tool to match interior home photos to specific Airbnb, Zillow, and Vrbo listings for law enforcement investigations

Reported: limited and largely exploratory with no significant breakthroughs or arrests to date

Using Raven AI tool to match interior home photos to specific Airbnb, Zillow, and Vrbo listings for law enforcement investigations

Using Anthropic Claude models and on-site engineers for critical infrastructure defense of power grids, water systems, transportation networks and government systems under the Critical Infrastructure Defense Program

Spending billions of classified dollars per year stress-testing and evaluating frontier AI models, with costs dominated by GPU compute and engineers commanding frontier-lab compensation

Will receive free access to OpenAI's Daybreak AI cyber-defense program and GPT-5.6 Sol model to help defend civilian infrastructure

creating a standalone AI mission organization as part of the agency's largest restructuring in at least a decade, with units expected to begin operations in mid-October

Ran short evaluations of Aslan's AI agents that impersonate undercover analysts in criminal Telegram channels and hidden forums

Ran short evaluations of Aslan's AI agents that impersonate undercover analysts in criminal Telegram channels and hidden forums

Six-month pilot to red-team small Texas water utilities' networks and provide AI-backed security tooling and training

Installed more than 3,000 AI-powered license plate reader cameras via grants to cities and counties since 2023 for vehicle surveillance

Reported: Texas Gov. Abbott ordered state agencies to pause funding amid privacy concerns and misuse reports; cities and counties canceling contracts; Lufkin officer facing 100 counts for surveilling 11 people

Agents wore Meta's AI smart glasses during immigration enforcement operations across six states; internal memo now bars employees from wearing the devices due to risk of capturing sensitive data

The Gold Eagle federal clearinghouse uses frontier AI to scan government and private-sector systems for vulnerabilities and prioritize patches.

Deployed ARTEX agentic pentest framework to run automated password spray attacks against Microsoft 365 tenants via ConnectWise Cloud Backup supply chain compromise

Reported: 151,000 failed logins across 2,250 M365 tenants; agents took over ConnectWise application identities and authenticated into customer environments, pivoting to Microsoft Graph operations and privilege changes

ECHOTRIBBLE program deploying AI agents that autonomously navigate infrastructures with minimal human oversight and self-directed behavior to disable or delete threats, including on air-gapped networks with minimal reporting back to operators

Used DeepSeek to generate exploit code for cyberattacks

The Pentagon awarded Perennial Autonomy a $500M-ceiling JIATF-401 contract for AI drone-on-drone counter-drone interceptors, making counter-drone autonomy a discrete DoD program of record.

using Opsin platform to detect, understand, and contain unsafe behavior from autonomous AI agents

Using Anthropic Claude models and on-site engineers for critical infrastructure defense of power grids, water systems, transportation networks and government systems under the Critical Infrastructure Defense Program

Using Anthropic Claude models and on-site engineers for critical infrastructure defense of power grids, water systems, transportation networks and government systems under the Critical Infrastructure Defense Program

using Opsin platform to detect, understand, and contain unsafe behavior from autonomous AI agents

Deployed Hadrian's agentic AI offensive-security platform for critical exposure visibility and remediation

Using Pluto Security to monitor AI agents and employee-built AI apps for enterprise security

AI penetration-testing agents for offensive security assessment

Using Anthropic Claude models and on-site engineers for critical infrastructure defense of power grids, water systems, transportation networks and government systems under the Critical Infrastructure Defense Program

Deployed Hadrian's agentic AI offensive-security platform for critical exposure visibility and remediation

Deployed Hadrian's agentic AI offensive-security platform for critical exposure visibility and remediation

Using facial recognition to identify and bar attorneys pursuing litigation from entering the venue

AI-powered scanning of vendor and proprietary software to surface security flaws, with 1,000 contractors hired to remediate findings

Reported: One scan alone flagged 23,000+ issues; software remediation plus AML compliance added 'a couple hundred million plus' to Q3 costs; Moynihan projects $300M of AI savings this year climbing to $700M in 2027

Using Pluto Security to monitor AI agents and employee-built AI apps for enterprise security

barred Fable from proprietary cybersecurity code work for clients following Anthropic's June policy change granting 30-day retention of usage logs

SoftBank launched an OpenAI-powered 'Patching as a Service' providing vulnerability assessment, remediation planning and implementation advisory to the top 3,000 companies behind Japan's critical infrastructure, after internally validating the approach by running OpenAI's models across its own systems.