The signal behind the news.

Identity & access

Claude Code 2.1.231: why one redirect URI can break enterprise MCP

Anthropic has fixed an OAuth redirect mismatch that could make pre-registered MCP integrations such as Slack unusable. The bug is small; the identity lesson for enterprise agents is not.

Incident analysis

The benchmark escaped the lab: what the OpenAI–Hugging Face incident really teaches us

An AI security evaluation became a real intrusion spanning OpenAI, a public code-execution service and Hugging Face. The lesson is not machine consciousness. It is uncontained agency at machine speed.

Analysis

GPT‑5.6‑Cyber: capability-based security for high-risk AI

OpenAI’s new cyber model answers far more advanced dual-use requests. The important development is the governed deployment architecture around it.

From Tom

Why agentic security needs a faster publishing rhythm

A new home for timely updates, useful signals and direct commentary on the security of systems that can act.