Security incident disclosure — July 2026

2024 Security Feature Highlights

An update on our safety & security practices

An update on our safety & security practices

The AI Risk Observatory: What Can We Learn from AI Disclosures in Annual Reports About Societal Resilience?

The study examines whether annual reports can reveal how companies disclose AI-related risks and responses. Using a two-stage classification pipeline on 9,821 reports from 1,362 UK listed firms (2020‑2026), the authors find that mentions of AI risk rose from 2.8% to 41.2% and AI adoption disclosures from 13.8% to 45.2%, with most risk mentions clustering around major vendors like Microsoft. Disclosure varies by sector and market segment, with Critical National Infrastructure and AIM reports lagging, and substantive risk disclosures remain rare—only 4.3% in 2025. "Why It Matters": The findings show that while AI risk is increasingly referenced in corporate reports, substantive disclosures are scarce, highlighting a gap in transparency that could affect societal resilience.

Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident

Agent Mosaic: Recognizing Confidentiality Leaks in Agentic LLM Systems

The paper investigates how large language model agents can inadvertently leak confidential information by combining data from multiple documents—a phenomenon termed the "mosaic effect." Using 30 synthetic cybersecurity, medical, and military scenarios, the authors generate 10,800 simulated and 1,440 live answers from three LLM agents, finding that even the best model discloses forbidden composites in over 7% of simulated responses. While visible classification headers and aggregation rules reduce disclosure rates, unsafe disclosures remain in roughly one third of simulated answers, and increased refusals do not fully prevent leakage of prohibited conclusions.

Beyond Predictable Paths: Redefining AI Security Incident Reporting for Agents

The paper discusses the need to adapt incident reporting frameworks for AI agents, which are rapidly deployed and face unique security challenges. By comparing AI systems and agents and consulting 23 experts, the authors identify key reporting elements such as agent memory, autonomy levels, and tool usage. They also highlight open research questions, potential reporting weaknesses like data leakage, and outline privacy requirements for secure AI agent deployment.