Frontier AI on the Front Line, Browser Side Channels, and Space-Based GNSS Jamming

#

This episode focuses on six storylines: the U.S. government–Anthropic dispute over offensive AI cooperation, the White House frontier-model access framework, a proposed U.S. Cyber Force, the browser FROST side channel, Russian Molniya satellite space-based GNSS jamming, and disclosure lag plus Claude abuse mapped to ATT&CK. Short items cover Anthropic IPO, Microsoft Scout “addiction design,” and Amazon’s AI leaderboard shutdown.

Government and Anthropic: Mythos, executive order, and a cyber service branch

#

What happened. Per the Financial Times as relayed by secondary coverage (Times of India summary), Anthropic has embedded roughly half a dozen forward-deployed engineers inside the NSA to help customize and deploy an AI model called Mythos for cyber operations, with goals including penetrating highly defended networks in China, Iran, and similar targets—running in parallel with its legal dispute with the Department of Defense (including the NSA). The FT original could not be read directly due to a paywall; the fact chain above relies on secondary relay. Neither Anthropic nor the NSA has issued official confirmation.

On the policy track the same day, Trump signed the executive order Promoting Advanced Artificial Intelligence Innovation and Security on 2026-06-02: for covered frontier models, it establishes a voluntary framework requiring developers to provide the federal government access for up to 30 days before release to other trusted partners—not mandatory licensing for all publicly released models; the text explicitly states it must not be read as creating mandatory licensing.

Deseret News reports that CSIS’s 83-page Cyber Force Generation study recommends that, if approved, a Cyber Force could be established under the Army structure (analogous to the Space Force within the Air Force). The report discusses implementation paths; it does not equal a decision to stand up the force.

Technical takeaway. If the Mythos reporting holds, frontier LLMs are sliding from “coding assistant” toward orchestration of offensive cyber operations; voluntary frameworks and embedded engineers can coexist, and public legal disputes do not rule out behind-the-scenes cooperation—boundaries must be judged from official documents, not media narratives.

What engineers should do. Track your organization’s AI use policy and export-compliance posture; endpoint/proxy AI call logs will become the foundation for audit and ATT&CK mapping (see P07 below). Speaker view: Anthropic may be drawing a line between “kinetic lethality” and “intelligence/offensive cyber”; each service branch might get its own Mythos variant—unsupported by official documentation.

FROST: OPFS exploits SSD contention to infer cross-tab activity

#

What happened. Researchers proposed FROST (paper PDF); Ars Technica reports that malicious sites use JavaScript to create ≥1GB files in the Origin Private File System (OPFS) and perform sustained random reads, measuring latency swings from SSD I/O contention, then use a CNN to infer visitor activity in other tabs, other browsers, and even local applications. Authors fully validated on M2 Mac, validated the underlying primitive on Linux, and did not test Windows; Ars notes no in-the-wild exploitation so far.

Technical takeaway. This remoteizes a physical-layer side channel through a Web API: no user interaction required—simply opening the page begins sampling. OPFS capacity and same-origin isolation raise detection difficulty; combined with bot detection, it could form a new fingerprinting chain.

What engineers should do. Browser teams can evaluate OPFS quota caps and alerts on abnormally large files; enterprises can monitor endpoints for anomalous Web Storage/OPFS usage. Speaker view: “close the tab” mitigations look thin against modern single-page apps shipping gigabyte-scale JS; why Windows was untested is unknown.

Space GNSS jamming: “Chasing Lightning”

#

What happened. A UT Austin / Stanford team paper arXiv:2606.03673 states that since 2019, ground GNSS reference stations across Europe, Greenland, and Canada have repeatedly seen synchronized transient wide-area interference; via power detection and TDOA fusion, the source was localized to Russian Molniya-orbit early-warning satellites—not GNSS satellites, not a known signal anomaly—which the paper calls a qualitative escalation in GNSS jamming. Inside GNSS adds L1-band CNR drops of roughly 10 dB (secondary source; the arXiv abstract does not state this figure).

Technical takeaway. If space-based, intercontinental synchronized jamming holds, impact exceeds regional jamming; spoofing (fine timing deception) poses higher risk to aviation and maritime than jamming alone—regional jamming in the Mediterranean, European airports switching to manual approaches, etc., mentioned by speakers were not independently verified in this briefing.

What engineers should do. Critical-infrastructure GNSS receive chains should plan multi-constellation, inertial, and RAIM degradation strategies; security teams rarely operate GNSS directly but must understand OT/ICS and timing dependencies.

Breach disclosure: HIBP’s 1,000th entry and compliance carve-outs

#

What happened. Troy Hunt’s blog 1,000 Data Breaches Later records HIBP’s 1,000th breach entry; the core observation is longer disclosure lag and missing individual notification. Case in point: Carnival attacked by ShinyHunters—8.7 million records including 7.5 million emails and loyalty data; Hunt notes 43 days between corporate awareness and user notification. Hunt cites GDPR “high risk” and CCPA “sensitive PII” definitions, noting email and loyalty data may not trigger mandatory individual notice—legal wording allows “technically compliant, effectively silent.”

Technical takeaway. Compliance teams often classify breaches by regulatory letter, while attacker exfiltration often exceeds “sensitive PII” checklists; for most users HIBP remains the only way to learn they were hit—and by the time of HIBP ingestion it is usually late.

What engineers should do. Incident-response playbooks should separate “regulatory notification duty” from “user risk communication”; credential rotation and MFA should not wait for an official breach letter.

Claude abuse map: LLM ATT&CK Navigator

#

What happened. Anthropic’s red team analyzed 832 Claude accounts banned for malicious activity between 2025-03 and 2026-03, mapped to all 14 MITRE ATT&CK tactics and 482 sub-techniques, and published the interactive LLM ATT&CK Navigator. Key data: medium/high-risk accounts rose from 33% to 56% (about 1.7×); 84.4% involved defense evasion; T1587.001 (Malware Development) was used by 560 actors; agentic scaffolding enables multi-stage autonomous attacks, with some behaviors lacking standalone ATT&CK IDs.

Technical takeaway. AI lowers the bar for malware development and evasion; risk is not “whether you use Claude Code” but attack-chain depth and autonomous orchestration.

What engineers should do. If you have endpoint AI usage logs, prioritize detection of develop-capabilities and defense-evasion behaviors against the Navigator heat map; red teams can reuse the same framework to assess internal AI abuse surface.

Short items

#

Unverified boundaries summary: P01 FT direct link, Mythos operational details; P02 executive-order scope; P03 Cyber Force approval; P05 speaker-cited regional jamming/spoofing cases; P08 valuation and profit targets; P10 management performance and token wording. Treat the above labels as provisional until primary sources update.