The Administrative Office of the U.S. Courts said in an October 15 statement that a cyberattack on British multinational defense contractor BAE Systems has disrupted the processing and distribution of bankruptcy notices across all U.S. federal bankruptcy courts.
The incident affected the Bankruptcy Noticing Center, which BAE operates on behalf of the federal judiciary. The outage began October 9 and has halted electronic and paper notices, while taking several court websites and the National Creditor Registration Service offline. BAE is investigating and working to restore services.
John Strand, Owner, Black Hills Information Security:
“This story highlights how unbelievably interconnected business and government processes actually are. A lot of people still think about computer security in terms of a DMZ. There’s an internal network to protect and an outside world to protect it from.
“But look at any modern large organization. They have multiple SaaS platforms, third-party integrations, and customer data flowing in and out of systems they don’t own or control. That perimeter is a lot messier than people want to believe.
“I still don’t think the industry has caught up with the risks we introduced through cloud computing and SaaS. Now we’re adding AI to the mix, giving attackers new ways to target those services and exploit the connections between them. We weren’t caught up before. We’re certainly not ready now.”
Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:
“Bankruptcy notices are the machinery of due process, and the judiciary runs all of it through one contractor. The Section 341 meeting notice opens the window for creditor claims, deadlines attach to service of every order, and since October 9 those clocks have been frozen nationwide while BAE Systems investigates a cyber incident that took the Bankruptcy Noticing Center offline.
“Judges are already compensating, extending deadlines and continuing hearings district by district. That is the detail that should worry anyone procuring for the courts. The outage never touched a courtroom, yet it rewrote the calendar of every bankruptcy case in the country, because a vendor bought like routine IT has become load-bearing infrastructure for the justice system.
“Restoring service is the urgent job. The standing question is why the noticing architecture has no alternate path, and I would want the Administrative Office of the U.S. Courts to write continuity requirements into the next BAE contract as strict as the ones the courts impose on themselves.”
You are only as secure as your business partners. Thus you need to ensure that they are secure before you trust them completely. Otherwise you’re just asking for trouble.
Anthropic grants independent researchers employee-level access to assess AI risks
Posted in Commentary with tags Anthropic on October 18, 2026 by itnerdAnthropic has granted six researchers from nonprofit METR employee-level access to its internal systems to independently evaluate AI models, safety practices and risk management, according to an October 15 company announcement.
The researchers have company hardware, office space and access to tools comparable to Anthropic’s internal risk assessment teams. METR can publish findings on AI risks, incidents and safety practices without company approval, although Anthropic can require limited redactions involving customer data, privileged information and model architecture.
Anthropic is establishing three levels of evaluator access, with METR receiving the highest. The company is also working with SecureBio and Accenture on independent evaluations and is in early discussions with Hugging Face.
ㅤDarin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security:
“Giving independent researchers meaningful access to AI systems is an encouraging step. There’s a difference between asking someone to review your homework and letting them see how you arrived at the answers. Both have value, but the second offers a much better opportunity to discover what might have been overlooked. From an offensive security perspective, independent evaluation brings fresh eyes, different assumptions, and the freedom to ask questions that internal teams may not have considered. That’s especially important as AI systems become more capable and increasingly connected to tools, data, and operational workflows. The real value will come from what researchers can examine, what they discover, and how those findings improve the systems being evaluated. Independent testing isn’t about proving someone wrong. It’s about building confidence through evidence rather than assumptions.”
ㅤ
Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:
“Six people cannot audit a frontier AI lab. Anthropic giving METR employee-level access is a real step, and I would rather have it than not, but the bank examiner analogy Anthropic itself uses works against them here. Large banks get teams of resident examiners, rotating staff, and decades of examined process. Six embedded researchers get one slice of one company’s output.
“Employee-level access means employee-level volume. Internal risk reviews, training run documentation, incident reports, eval results. A six-person team reading that firehose while also designing its own evaluations will spend most of its capacity just keeping up. Something goes unreviewed, and the things that go unreviewed are never the things a press release mentions.
“I’ve seen this pattern in security audits of large environments. Two auditors find real findings in the areas they had time to reach. The rest is sampling error dressed up as assurance.
“The test is whether Anthropic scales embedded headcount with model capability. Six researchers against a frontier lab is a pilot. Treat the findings accordingly.”
ㅤ
John Strand, Owner, Black Hills Information Security:
“This is the best news I’ve seen all week. This is exactly the type of oversight and transparency people have been asking for. It’s rare to see a company voluntarily give an independent third party employee-level access to conduct research, evaluate safety practices, and assess risk. I hope this becomes standard across the companies building frontier models.
“A lot of these companies believe oversight will slow things down or reduce innovation. But they’re forgetting something pretty basic. Their AI models going rogue is an actual business risk. Good governance means doing more than moving as fast as possible and maximizing profits at every turn. You have to build something you can sustain.
“It’s great to see Anthropic taking a step in that direction. Responsible oversight is part of keeping a company around for the long term.”
ㅤWhat needs to happen is that there have to be more people given more access to more places. Only then will their find something that moves the needle. Frankly speaking this is a start, but it is only a start.
Leave a comment »