Top items
- ARTEX autonomous AI pentest tool taken closed-source after being linked to Korean bank hacks attributed by CrowdStrike.
- Microsoft, OpenAI, Anthropic and others shaping Trump-era AI health policy through a private CMS Slack workspace, per KFF/CBS investigation.
- SemiAnalysis finds Chinese AI labs published safety evaluations for only 3.6% of 857 model releases.
- Anthropic launches a free Claude-powered OSS security scanner for open-source repositories.
Company & product developments
Anthropic launches free Claude-powered OSS Scanner for open-source repositories. Anthropic opened enrollment for OSS Scanner, an opt-in service that performs periodic security scans on open-source repositories inside an air-gapped virtual machine using its strongest Claude models (helpnetsecurity.com). In an early run across 48 projects, pen-testers reviewed 97 critical and high-severity findings and cleared 85 for disclosure, while identifying 11 duplicates and one invalid report. Anthropic says it has processed more than 6,000 vulnerability reports through its coordinated disclosure process to date. Maintainers can enroll by submitting a pull request to the anthropics/oss-scanner repo with a project.yaml file. The launch positions Claude as a defensive security tool amid broader concerns about AI being used offensively (see ARTEX item).
Field & industry developments
ARTEX developer pulls AI pentest tool closed-source after link to Korean bank intrusions. On October 8, ARTEX author “Autumn-27” removed the GitHub repository and declared the autonomous penetration-testing agent closed-source, stating “given the misuse of the tool, the ARTEX project will no longer be updated.” The project will receive no further versions or maintenance support (thehackernews.com). The decision followed CrowdStrike’s attribution of a late-September intrusion at Shinhan Bank and Yegaram Savings Bank to an operator running ARTEX on top of DeepSeek v4.1-flash, GLM-5.3 and Grok 4.6. The episode highlights the dual-use risk of autonomous AI-driven offensive security agents and how open-source releases can be repurposed by threat actors.
Policy & safety
Microsoft, OpenAI, Anthropic and other tech firms shape Trump AI health policy via private CMS Slack workspace. A KFF Health News/CBS investigation published October 9 details a private 1,700-member CMS Slack workspace called “Health Technology Ecosystem,” established in August 2025 and run by CMS chief product officer Amy Gleason (cbsnews.com). Participating companies — Microsoft, OpenAI, Anthropic, Apple, Google, Oura and Palantir — help shape policy on a Medicare app library, TEFCA medical-record access, and reimbursement for AI chatbots. CMS Innovation Center AI/tech chief Jacob Shiff reportedly told industry representatives that the agency’s work should serve as a “sales engine” for apps. Legal experts characterize the workspace as a de facto federal advisory committee operating outside federal sunshine rules, raising transparency and conflict-of-interest concerns.
SemiAnalysis: Chinese AI labs published safety results for only 3.6% of 857 model releases. SemiAnalysis analyzed 857 model releases from nine leading Chinese AI companies between 2021 and 2026 and found that only 31 (3.6%) included published safety evaluations, with just 9 releases (1.1%) having safety documentation available at launch (newsletter.semianalysis.com). The report characterizes Beijing’s actual approach as “speed-based, not safety-based,” noting that China’s AI Safety Governance Framework prioritizes “promoting AI innovation and development as the first priority,” despite Xi Jinping’s public rhetoric emphasizing human control over AI. The report observes that China’s regulators have largely avoided frontier-capability restrictions, instead focusing on application-layer rules governing content.