noticias radar ia agentes de ia ciberseguridad digitalizacion pyme

The Tuesday radar closed with agent security inside the lab; Wednesday takes it to the streets. The maker of the most used AI programming tool has just stated in writing that its automatic mode is not a security boundary, and on the same day, a company raised fifty million dollars just to audit the extensions used by corporate agents: of those circulating on the internet, it only approves twenty-seven percent. The third pillar of the day is where data is processed, with Perplexity keeping the confidential part of a task inside the user's computer.

Anthropic admits Claude Code's automode is not a security boundary

Researcher Johann Rehberger demonstrated that simply asking Claude Code to "summarize this website" is enough to end up executing attacker code on the machine, with a 60% to 80% success rate in his tests. The chain is textbook and uses nothing exotic: the server responds with an HTTP 415 error that pushes the agent to drop its browsing tool and use curl; it returns a ZIP with encoded data and a file named struct.py; Claude correctly refuses to execute the binary inside and decides to write its own decoder in Python; and when importing a standard library, it loads the fake struct.py instead of the legitimate one. Arbitrary code executed, command channel open, and the system calculator on screen as visible proof. The analysis was published on August 26, but what has been circulating these last two days is Anthropic's response: they classified the report as "informative," stated that automode—the default since mid-August that replaces manual approvals with a classifier—is a risk-reduction convenience and not a guarantee, and topped it off with the phrase worth framing: "the real boundary is OS isolation and network egress control." No fix is planned. For your company: this confirms from the manufacturer's mouth what we reported yesterday about their own lab incidents, and now it applies to the tool your team has open today. Three things this week. First, the code agent should not run on anyone's laptop with full access: container or virtual machine, project folder, and nothing else. Second, read-only credentials for a single project; if your agent can touch production, the classifier won't save you, because the provider itself is telling you it's not meant for that. And third, a whitelist of outbound domains: if the agent can only talk to your repository and three other domains, the chain above breaks at the first step. Source

50 million to monitor what your agents use: only 27% of tools pass the filter

AIR, an Israeli company of about forty employees founded by Yair Saban and Niv Hoffman, veterans of Unit 8200, has raised 50 million dollars in two seed rounds: ten million led by Sequoia and forty by Greenoaks, with the co-founder of Wiz and the president of Cognition among the angels. What it sells is not a model, but a gatekeeper: it discovers which agents are running inside the company, continuously evaluates the skills and add-ons those agents are plugging in, and blocks interactions with tools or sources that are not approved. The data justifying the round is their whitelist: of all the add-ons and connectors they find circulating on the internet, they only approve around 27%. They already have more than twenty clients, a quarter of them large enterprises, and traction is coming from banking and pharma. Sector money remains hot in the same direction: on Sunday it was reported that Clay, the AI sales platform, is negotiating a round with Wellington at a $7 billion valuation before new money, up from $5 billion in January. For your company: you don't need to buy this, you need to ask their first question. An agent add-on is a provider that has entered your house without a contract, without a manager, and often without anyone knowing it's there. Do the inventory by hand on a sheet: what agents do you have running, what connectors and skills each one has plugged in, who installed them, what credentials they work with, and what domains they connect to. The operational rule that naturally emerges from that 27% is that the installation of a new connector must be approved by a person, not the user who needs it at five in the afternoon. Source

Perplexity keeps the confidential part of the task inside your computer

Perplexity has launched the hybrid mode of its Computer agent: a single task starts in a large model in the cloud and, when it touches sensitive documents or data, passes those steps to a small model running on the user's Mac, without restarting the work or losing context. Locally, you can choose between Gemma E4B and two variants of Qwen 3.6 with 35 billion parameters, one of them fine-tuned by Perplexity itself. It also includes a privacy classifier that runs on the device and suggests which files and information should not leave; the final decision is made by the user. Requirements: Mac with Apple Silicon, macOS 15, and 32 GB of unified memory—it won't work with 8 or 16—and Pro, Max, or Enterprise plans. What is processed locally doesn't consume tokens, so it doesn't appear on the bill; in exchange, the company itself admits that the large model almost always gives better raw results. For your company: this is exactly the missing step for the consultancy, the clinic, or the law firm that has been saying for a year "I can't upload that." Careful, it's not a compliance certificate nor does it exempt you from the record of processing activities, but it changes the conversation: it's no longer all or nothing. Two concrete moves. First, classify your AI tasks into three buckets—public, internal, and confidential—and check how many of those you don't do today fall into the third; it's usually less than it seems. Second, if the answer is that there is volume, the 32 GB machine is an investment of a few thousand euros that replaces the three-month conversation about on-premise servers; test it with a real process before buying anything. Source

The Pentagon already has ChatGPT and Grok inside, and Claude out

The U.S. Department of Defense has expanded GenAI.mil, its internal portal for using commercial models without data passing through consumer channels: the Gemini it started with is now joined by ChatGPT Mil, oriented towards chat, files, projects, and custom GPTs for unclassified administrative tasks, and Grok for Government by xAI. There are 1.7 million unique users out of the 3 million people working in the department, and military versions are exempt from standard data collection. The absentee is Claude: the U.S. administration designated Anthropic a "supply chain risk" after the company refused to provide unrestricted access and insisted on maintaining its safeguards, and Anthropic is fighting it in court, where it already won a first battle three days ago. For your company: the world's largest buyer of technology has just shown that an AI provider can be dropped from the list for a decision that has nothing to do with model quality. If you have built a process on top of a specific model, the question isn't which is better today, but how long it takes you to switch. Measure that figure: take the workflow that matters most to you, run it with a second provider, and note how many hours it cost you and what broke. If the answer is "I don't know," that is your September task. Source

Instagram penalizes profiles with unlabeled AI-generated people with reduced reach

Instagram is renaming its "AI creator" label to "AI-generated profile" and beginning to limit the reach of accounts that show artificially generated people without declaring it: they lose eligibility to appear in Reels recommendations and Explore, which is exactly what made synthetic influencers viable. The policy looks at the identity the account presents, not the tool used for each post: if you use AI to retouch photos, polish texts, or generate graphics, it doesn't affect you. For your company: if your marketing has flirted with an AI-generated spokesperson or model, the account gets labeled, period, because the alternative is no longer a warning, but being left out of organic distribution. And it fits with what is already law here: the European AI Act has required you since August 2 to warn when a client talks to a bot and to label generated content. Take the opportunity to write it in a line in your brand manual—what gets labeled, who reviews it before publishing—instead of deciding it piece by piece. Source

What to watch tomorrow?

Two things. If Anthropic makes a move regarding Claude Code's automode—an isolation guide, a change in default values, or a reclassification of the report—because today the official answer is that the problem is yours to solve on your machine. And if Clay's $7 billion round is confirmed with a closed figure, which is the thermometer of whether money is still flowing into the application layer or just into infrastructure and security.

Watch the 1-minute video