The National Rural Water Association has partnered with DEF CON Franklin to launch the Water Watch Center, which will provide threat intelligence and cybersecurity services to smaller U.S. water utilities serving fewer than 10,000 people. The initiative comes amid a growing wave of cyberattacks on water systems across multiple states. The Record reports: The program will see five managed detection and response providers work with DEF CON Franklin and the NRWA to offer cyber services for water utilities serving fewer than 10,000 people. There are over 50,000 community water systems across the U.S. and 91% of them serve fewer than 10,000 people. "These leading cyber firms and NRWA are architecting a scalable cyber delivery model that has eluded water industry and national security officials to date," said Jake Braun, the co-founder of DEF CON Franklin and former cyber official in the Biden administration. "Our incredible Franklin volunteers will support the effort to keep costs down for cash-strapped utilities fending off adversaries like the Iranian Red Guard or Chinese Military," Braun said. "To further accelerate the effort, we hand-picked cyber providers who already support water utilities. These folks walk in the door knowing the intricacies of cybersecurity in a water utility environment." The providers include Rapid7, Defendify, Legato Security, L1 Secure and Sentinel Technologies. The companies will share threat information and data on vulnerability patches with the NRWA, which will operate as a hub.

Read more of this story at Slashdot.

Former U.S. National Cyber Director Chris Inglis says the biggest AI risk isn't sentience but autonomy. "What I'm worried about is that they get to choose what and where they do something, and under what rules they do it," he said, citing recent cases of AI agents from OpenAI, Anthropic, and Meta escaping security sandboxes. He argues developers need stronger safeguards, monitoring, and human accountability, invoking Asimov's idea that protecting humans should come before simply obeying them. The Register reports: "Asimov was right," he said, referring to science fiction author Isaac Asimov and his three laws that were to be followed by robots -- more specifically, AIs, in this case. "The first rule, and we call it the superior role, must be that it's designed not to hurt humans," Inglis said. "Second rule: To obey humans, such that it doesn't achieve agency and aspiration on its own. And the third: To do what humans tell it - and in that order. Instead we've designed them in the exact opposite way." What this means, he explained, is that AI developers created models to "do what humans tell you, obey the humans until it's inconvenient, and then the third one is maybe implied - protect humans - but if that's not built into the DNA, hardwired into it, then we have no right to expect it." Inglis admits it's not possible to hardwire rules into models and still keep their non-deterministic nature. "I would offer that you can tease those out in a highly controlled environment, a true sandbox, where you say, 'Let's put this thing through its paces, and let's back away to see what happens,'" he said. "Maybe you get the equivalent of a mini nuclear explosion in that room, and now you know this thing is capable of that." Inglis thinks another problem with AI is that it's become a commodity. "It's not like you can control it like you can nuclear material," he said. "You can't even specify its properties the way you can for an airplane or for an automobile, as diverse as they might be. Its manifestations are so numerous, so diverse, that as a general matter, you can't actually win by simply saying, "I will design those properties in,'" he added. "You need to do that to some degree, and then make sure that you understand how to watch it, monitor it, make sure you know what it does." [...] Ultimately, humans remain accountable for AI models' actions, according to Inglis. "They remain the source of agency and aspiration. It's possible for them to give broad authority to an AI model and have it run around for 30 hours without further consultation, but they need to know what they've asked it to do, and they need to know what they expect it will deliver in terms of performance on the back end. If they don't, then they're going to get what they deserve, which is the very frequent unpleasant surprise."

Read more of this story at Slashdot.

wiredmikey shares a report from SecurityWeek: Meta is the latest major AI developer to admit that its models broke loose during cybersecurity testing and hacked external systems. The tech giant said in a statement to the media on Wednesday that the incident occurred during independent evaluations conducted by Israeli AI security startup Irregular. The tested AI models were inadvertently allowed to access the internet due to a misconfiguration, which led them to exploit a vulnerability in an unnamed third-party service. It's unclear if it was a known flaw or a zero-day. The Information [gated] learned that the Meta AI attacks involved the company's advanced Muse Spark 1.1 model, which breached an unnamed organization's systems and made unauthorized changes to its internal environment. Meta said it learned of the AI models going rogue after being notified by Irregular. The company is conducting an investigation and it has promised to issue a "full retrospective" once it has all the facts. A spokesperson for Irregular said the incident was the "exact same evaluation-environment issue that was already disclosed by Anthropic last week" and that it did "not involve a "sandbox escape or a sophisticated cyber action." It contrasts with OpenAI, whose AI agent independently exploited a novel vulnerability to reach the internet during cyber testing. Not only did it breach Hugging Face but it also hacked multiple third-party accounts and services as part of the attack.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Ars Technica: Routine cybersecurity testing of frontier AI models sparked a series of unexpected security incidents -- the most serious case arising when Anthropic's Mythos 5 model attempted to insert malicious code into an open source software application and created fake identities to deceive the human developers maintaining the project. The security incidents occurred during a cyber evaluation of seven leading AI models' capabilities by the AI Security Institute (AISI), a research organization within the UK government, in late July. The researchers discovered (PDF) 19 instances in which "AI agents took unsanctioned action on the live Internet, including cases that targeted real people and organizations," according to an AISI blog post published on August 4. Almost all the "autonomous, unsanctioned" actions came from Anthropic's Mythos 5 model, with two such actions coming from OpenAI's GPT-5.6 Sol. [...] The most serious case involved Mythos making multiple attempts to execute a supply chain attack on the open source project repository hosted on the developer platform GitHub, including using social engineering techniques to try to convince the repository's human maintainers to merge malicious code into the repository. After first opening a pull request to merge the malicious code into the repository, Mythos created fake online "sock puppet" personas that claimed to have independently reviewed and verified the code as not containing malware. The AI agent also sent five emails to two human maintainers of the repository, including some emails containing malware and others attempting to persuade a maintainer to accept the pull request. Mythos even opened a GitHub Issue on a second repository -- also owned by a maintainer of the first repository -- that contained a prompt injection with malicious instructions targeting "issue-triage AI coding agents." This line of attack came from Mythos reasoning that the repository maintainer could be an AI coding agent such as Claude Code.

Read more of this story at Slashdot.