A flaw in the MCP layer has entered the US government's “actively exploited” catalog for the first time — LiteLLM's proxy would accept any bearer token you handed it
CISA added CVE-2026-59822 to its Known Exploited Vulnerabilities catalog on 2 September: an improper-authentication flaw in BerriAI's LiteLLM proxy whose MCP Streamable HTTP endpoint let an unauthenticated caller open an authenticated MCP session using an arbitrary bearer token, with federal agencies given until 16 September to fix it. The detail that matters beyond LiteLLM's own users is the category: MCP — the protocol most AI agents now use to reach tools and data — has moved from a research-paper attack surface to one a government catalog says is being exploited in the wild. Anyone self-hosting an agent gateway should treat it with the same patch discipline as a public web server, not as internal plumbing.
Tenable and OpenAI are building a security review for community-built AI agents, skills and MCP servers — an admission that installing one today is an unvetted download
Announced 3 September at OpenAI's Cyber Summit, Exchange Inspector will vet AI agents, skills, MCP servers and multi-agent playbooks listed on the CyberAgents Exchange, combining OpenAI's GPT cyber models, Tenable's One AI Exposure scanning and review by Tenable researchers; the company says it is expected to be available in September. What the product implies is the story: more than 100 community-built components are already listed there, and registries of this kind generally admit submissions on proof of repository ownership alone, with no code review or malware scan. Until vetting like this is routine, trusting an MCP server or agent skill because it appears in a registry is the same mistake as trusting a package by its name.
Claude wrote a complete machine-checked proof of Fermat's Last Theorem in 11 days — work the field expected to take years
Anthropic published the first end-to-end computer-verified proof of Fermat's Last Theorem, formalized in the Lean proof assistant by Claude working largely autonomously over 11 days and producing roughly 13 million lines of Lean plus 29,500 supporting theorems. The method is the story: many Claude agents were pointed at a structured graph of theorem statements through an open-source tool called Prove2Me, with human mathematical input limited to occasional high-level direction. Kevin Buzzard of Imperial College London, who has led the multi-year community effort to formalize the same proof, called the result extraordinary and said AI-produced formalizations are now robust enough to build further work on.
OpenAI's GPT-6 Astra is the first model its own maker rates “Critical” for cyber capability — and it turned up two real zero-days during its evaluation
OpenAI shipped GPT-6 Astra and, in the same post, classified it at the Critical cybersecurity threshold of its Preparedness Framework — the company's own bar being a model that can find previously unknown flaws in hardened systems and build working exploits without a person steering each step. It scored a perfect 100% on ExploitBench against 78.5% for the previous frontier model, 42.4% on the harder ExploitGym, and discovered two genuine zero-days mid-evaluation which OpenAI says it disclosed to the maintainers. The important qualifier for anyone reading this as an alarm: the version that actually launched refuses advanced offensive requests such as writing proof-of-concept exploits, and the looser capability is fenced behind the Daybreak programme for vetted defenders — so the near-term change is that the gap between a published vulnerability and a working exploit keeps narrowing, which argues for patching promptly rather than for panic.
Google's Gemini 3.8 Flash undercuts the frontier on price — but the cheap rate has a printed expiry date of 31 December 2026
Google shipped Gemini 3.8 Flash, its third Flash release in six weeks, built on 3.7 Flash rather than a new base model and tuned for long-horizon coding and autonomous agents. It lands at 59 on the Artificial Analysis Intelligence Index — three points above 3.7 Flash, and short of Claude Opus 5 at 63 and Claude Fable 5.1 at 66 — but does it at about $0.58 per index task against Fable 5.1's $3.76, making it the cheapest model at its level. The catch worth diarising: the $0.75 and $3.75 per-million introductory rates run only through 31 December 2026 and double on 1 January 2027, and Google itself says to stay on 3.7 Flash for efficiency-first work because 3.8 deliberately burns more thinking tokens. A locked-down 3.8 Flash Cyber variant for vulnerability hunting is gated behind its Fairwind programme.
Anthropic ships Claude Fable 5.1 and Mythos 5.1 — same model, two safeguard tiers, and about 25% cheaper for typical work
Anthropic released Claude Fable 5.1 as its most capable coding and knowledge-work model, alongside Mythos 5.1 — the identical model under looser cyber safeguards, released only to vetted cyberdefenders and life scientists at a set of US organisations. The headline for anyone paying by token is cost: cache reads drop 75% to $0.25 per million while input and output hold at $10 and $50, working out to roughly 25% cheaper for typical workloads and up to about 45% on heavily agentic ones. Anthropic also loosened the cyber safeguards that had been interrupting legitimate work — Claude Code users should see around 60% fewer interventions per session, and the model may now find software vulnerabilities for defence, though writing exploits and running penetration tests stay blocked.