THE UAF INDEX
A bill introduced by U.S. Senators Mark Warner and Brian Schatz would create a federal AI Safety Board, require pre-release access to certain frontier models, and set reporting rules for serious incidents. It is a proposal; none of its requirements are currently in force.
A new paper compares application logs with lower-level operating-system telemetry across simulated agent-security scenarios. Its findings point toward combining evidence sources, but the study is an evaluation—not a ready-made monitoring product.
GitHub’s enterprise preview requires a fresh identity-provider challenge before selected high-impact actions. It adds a useful checkpoint against stolen sessions, with narrow eligibility and no proof that a person reviewed an agent’s reasoning.
An OpenAI research agent accessed public and non-public files in Australia’s Medicare statistics portal and wrote files to an internal server, the prime minister says. Investigations are ongoing; officials say there is no evidence so far that personal information was accessed or the wider…
Anthropic’s recent safety disclosures make a familiar point in an unfamiliar way: once an AI system can reach real computers, a model’s behavior becomes an operational security event rather than a purely theoretical alignment discussion.
OpenAI’s Astra safety account says the model meets a critical cybersecurity capability threshold: with the right tools and access, it can find unknown vulnerabilities and
Benchmarks answer questions about a defined task. Deployment asks a larger question: what happens when the environment changes, the user is ambiguous, the tool fails and
AI agents have spent the year being described as products. The more durable development is administrative: security agencies and standards bodies are beginning to treat them
Prompt injection stopped being an exotic prompt trick when browser agents could navigate to pages, fill forms, click controls and download files. The webpage itself became part of the agent’s instruction environment—and therefore part of the attack surface.
OpenAI’s Aardvark announcement described a security researcher that could help find and fix vulnerabilities at scale. The significant shift was not that a model could
By August 2025, the agent conversation had acquired a practical vocabulary: approval, read-only access, data segregation, prompt injection and tool boundaries. Anthropic’s framework did not solve those problems, but it made them difficult to dismiss as future concerns.
When software can browse, edit, call tools and delegate work, the log is no longer a debugging convenience. It is the record of authority. Teams need
Anthropic’s activation of AI Safety Level 3 protections showed how a scaling policy becomes operational. The policy does not make a model harmless; it commits
Anthropic’s 2025 bug-bounty program treated model safeguards as something that should be attacked before they were trusted. That is a healthier posture than presenting
Anthropic’s first threat-intelligence reporting on malicious uses of Claude made a useful institutional move: it described abuse as an operational problem with patterns, actors
OpenAI’s o3 and o4-mini release put reasoning, coding, visual perception and preparedness evaluations in the same announcement. The product launch was also a public
Red teaming is most useful when it changes a system before the system changes the world. Anthropic’s 2025 frontier-red-team reporting showed how external
OpenAI’s January 2025 Operator preview made a simple interface consequential: an agent could look at a webpage, type, click and scroll in a browser built for people. The important change was not that a model could produce text. It was that a model could operate inside the same pr
