New York has begun enforcing the RAISE Act, a new AI safety law targeting large developers such as OpenAI and Anthropic. These companies, with over $500 million in annual revenue, must register with the state by January 2027, publish safety frameworks, report safety incidents within 72 hours, and release transparency reports. The Office of Digital Innovation, Governance, Integrity, and Trust (DIGIT) will oversee compliance, with penalties of up to $1 million for a first violation and $3 million for subsequent breaches.

Governor Kathy Hochul also announced the launch of the New York Center for AI Responsibility and Research at Binghamton University, which will independently review AI safety and work with DIGIT. The RAISE Act follows other state laws, such as California’s SB 53 and Illinois’ SB 315, which also require safety frameworks and incident reporting.

For regulated industries, these rules mean increased scrutiny of AI vendors and the need to align procurement and risk management with new legal standards. Failure to comply could result in significant financial penalties and reputational risk. Watch for further guidance from DIGIT as registration and reporting deadlines approach.

The French government has formally accused Iran of carrying out cyberattacks on thousands of industrial refrigerated and freezer units across France and Europe. The attacks, attributed to Iran’s Islamic Revolutionary Guard Corps, targeted web-based controllers in grocery stores, supermarkets and blood banks. According to the French Blood Establishment, the attacks on medical blood banks were stopped before any blood was spoiled.

Security researchers warned that the affected controllers, some made by Danish firm Danfoss, are vulnerable to remote hacks and no longer receive security updates. The French government has summoned Iran’s ambassador and plans to issue European-wide sanctions against those responsible. The matter is now with the French justice system.

This incident follows a series of cyberattacks linked to pro-Iranian hacktivists targeting critical infrastructure in the US and Europe. The US is also investigating similar attacks on freezer units at military bases. The French foreign minister described the scale as unprecedented and a major assault on national interests.

Senior leaders in food, healthcare and supply chain sectors should assess the resilience of their operational technology and review vendor support for critical systems. The risk of similar attacks remains high as geopolitical tensions continue.

OpenAI has reportedly secured $11 billion in a new funding round, putting its valuation at $1.25 trillion, according to Bloomberg. The round is not yet closed and could reach $20 billion, but remains below the $30 billion target reported last September. TechCrunch says OpenAI has not commented on the reports.

The funding comes as OpenAI’s main competitor, Anthropic, faces lower-than-expected valuations for its own potential IPO. Bloomberg reports some buyers now see Anthropic’s value at $1.1 trillion, down from the $2 trillion previously anticipated.

OpenAI had previously indicated plans to go public this year but has delayed its IPO, with expectations now set for next year. The AI sector is experiencing uncertainty, with U.S. political shifts and concerns over data centres contributing to market jitters and expectations of regulatory scrutiny.

For regulated-industry leaders, the scale of investment in AI and the shifting IPO landscape suggest both opportunity and risk. Ongoing regulatory developments and market sentiment will shape the sector’s direction in the coming year.

Palo Alto Networks is negotiating to buy Clutch Security, a startup focused on securing AI agents’ access to company systems, for $500 million in cash plus additional milestone-based payouts, TechCrunch reports. Clutch, founded three years ago, was last valued at $85 million after a $20 million Series A in January 2025 and is approaching $10 million in annual recurring revenue. The potential deal would value the company at about 50 times ARR, a metric often used in software acquisitions.

If completed, this would be Palo Alto Networks’ seventh acquisition this year, reflecting its strategy of acquiring rather than developing new technology in-house. The move comes as the market for AI-driven cybersecurity tools heats up, with rivals like Upwind and Astrix also attracting high valuations or acquisition interest. Clutch’s competitors, such as Oasis Security and Astrix, have also been acquired recently, indicating consolidation in the AI security sector.

For banks, insurers, and healthcare groups, the deal signals rising costs and competition for AI security solutions as cyber threats evolve. The high multiples paid for these firms suggest that demand for trusted AI security providers is outpacing supply. Executives should monitor how these acquisitions affect pricing and vendor options in the coming year.

Security researchers have identified over 800 publicly accessible deployments of Artex, a Chinese-made AI hacking tool, according to cybersecurity firm Censys. Artex, an open source autonomous penetration testing tool, is designed to probe computer systems for weaknesses and has been linked to several cyberattacks since its release in July. Microsoft describes Artex as a system of AI agents capable of conducting attacks from reconnaissance through data exfiltration with minimal human input.

Censys reported that these Artex instances required no password to access, making them vulnerable to unauthorised use. While some deployments are used by authorised testers, the exposure of so many systems is unexpected, as the software does not require public internet access. Security companies have connected Artex to attacks on the Korean finance industry and a breach at IT support firm ConnectWise, which affected thousands of organisations using Microsoft’s cloud.

Many attacks exploited basic vulnerabilities such as weak passwords and lack of multi-factor authentication. The findings point to the risk posed by misconfigured security tools, which can expose both attackers and their targets.

Artex has since moved to a closed-source model, but copies of its code remain available online. Regulated firms should assess their own systems for similar exposures and ensure strong authentication is in place.

Meta president Dina Powell McCormick said at the WSJ Tech conference that Democratic wins in the US midterm elections are likely to make it more difficult for companies to build data centres. She linked this to rising political and public opposition, noting that concerns about AI technology are influencing resistance to data centre projects. Meta has data centres in 23 states, with several major new projects planned, but now expects more scrutiny and local pushback after politicians campaigned on anti-data-centre platforms.

Powell McCormick said communities are more likely to support data centres if they see clear local benefits, such as tax surpluses funding teachers and first responders, local hiring, and bipartisan backing. She added that Meta is seeing demand to lease its computing power, suggesting ongoing value even if AI expansion slows.

For regulated industries, delays or constraints on new data centres could affect the availability and cost of AI infrastructure. Executives should expect more regulatory review and political risk in site selection and community engagement.

OpenAI has released ChatGPT Cyber, a new model for advanced vulnerability detection, following reports that its previous AI models quickly found severe bugs in open source software such as Ubuntu and Firefox. Max Justicz, CTO of Charge Robotics, used an OpenAI model to uncover a critical vulnerability in Ubuntu, which was patched after being reported to the Debian Project. OpenAI said its tools recently identified 948 potential Linux kernel issues and 81 novel Firefox vulnerabilities.

The company is making ChatGPT Cyber available to the highest tier of its Daybreak cybersecurity programme, which supports both defenders and offensive researchers. OpenAI has also announced a $1 billion initiative to help cybersecurity professionals working on critical infrastructure. However, only "thousands" of vetted professionals currently have access, compared to a much larger pool of potential attackers.

Security professionals have raised concerns that the most powerful AI models are being restricted, limiting defenders' capabilities while bad actors may use less restricted models. OpenAI says it is allocating more resources to patching vulnerabilities, but the cost and speed of AI-driven bug discovery raise questions about whether enough is being done to secure digital infrastructure.

The company warns that there is only a narrow window for defenders to act before AI models become even more effective tools for attackers. Senior executives in regulated sectors may need to review their cyber risk strategies and resource allocation urgently.

Web hosting provider DreamHost has confirmed that hackers accessed customer emails and credentials during a cyberattack that went undetected for several months. The company disclosed the breach after a multi-day outage and password resets for some users. According to a notice filed with California's attorney general, the attack began in August and allowed hackers to obtain session tokens, which can let attackers access systems as legitimate users. The vulnerability exploited was in DreamHost's file manager, though the company has not specified further details, citing an ongoing investigation.

DreamHost stated that the breach was not related to recent PHP vulnerabilities and that fewer than 10% of its 400,000 customers were affected. The company declined to explain why the attack was not detected earlier or to provide a more precise figure for those impacted. The incident has triggered concern among businesses relying on DreamHost for hosting sensitive data.

For banks, insurers, and healthcare firms, the breach highlights the importance of reviewing third-party hosting risks and ensuring robust incident response plans. Regulators and clients may seek more transparency on detection and notification timelines. The investigation's outcome and any regulatory response will be closely watched.

Ballistic Ventures, a venture capital firm focused on cybersecurity, has filed to raise $490 million across two new funds, according to regulatory documents seen by TechCrunch. The firm aims to secure $360 million for its third flagship fund and $130 million for a separate vehicle, Ballistic Ventures Fund B. No sales had been recorded at the time of filing.

The fundraising effort follows a surge in AI-enabled cyberattacks and a corresponding rise in venture capital interest in the sector. According to a JPMorgan Chase report, U.S. cybersecurity startups raised $11.5 billion in 2025, with AI-enabled companies making up about 72% of deals through May. Ballistic Ventures, founded in 2021, has previously backed firms acquired by major players like Palo Alto Networks and CrowdStrike.

Ballistic's leadership includes former Kleiner Perkins partner Ted Schlein and experienced cybersecurity executives. Its strategy is seen as similar to other specialist investors, but its connections to established venture firms may offer an edge. The firm declined to comment on the fundraising plans.

Microsoft has also warned that AI is accelerating the pace and scale of cyberattacks. Senior executives in regulated sectors should monitor how AI is changing the risk environment and influencing where capital flows in cybersecurity.

Anthropic has released technical specifications and code for FlashProve, a system designed to let users verify which AI model generated a specific output. According to Anthropic’s announcement, FlashProve works by using cryptographic proofs, similar to email signatures, to guarantee that an output comes from a particular model. This could prevent AI providers from secretly swapping models to cut costs or inflate performance claims.

The system requires AI labs to publish a unique fingerprint for each model, which can then be matched to outputs without exposing proprietary model weights. This approach means commercial labs can participate without risking their intellectual property. Verification is designed to be lightweight, allowing checks to be performed locally.

For regulated sectors, the ability to confirm a model’s identity supports audit trails and compliance with governance requirements. However, Anthropic says FlashProve is still in the research stage and there are no current plans to deploy it in production.