SafeMind launched at Fal.Con on September 1. Red Tempest finds the attack path, Blue Solano closes it, and the harnesses run both in a closed loop that keeps re-running. Both sit on NVIDIA Nemotron, trained on Falcon sensor telemetry and fifteen years of incident response work. CrowdStrike reports 29% higher detection, 6x faster end-to-end remediation, and 99% cost savings against frontier and open-source baselines. Read all three as internal evals, because that is what they are: no third-party replication, no named baseline. Distribution is the part not in dispute. SafeMind runs natively in Falcon, so for a shop already on Falcon this is a configuration decision instead of another agent to deploy and secure. Read our take.

Unit 42, the incident response arm of Palo Alto Networks, documented an intrusion where the human operator handed tactical execution to agents: recon, a breached public API endpoint, subagents scraping repos for hard-coded tokens, then the secrets manager and root. An agent finished by leaving the victim an 80-page report on its own security failings, per The Register. No zero-day, no elite tradecraft, just speed. The responders' fix is a playbook worth writing down today: revoke credentials, terminate OAuth sessions, freeze CI/CD, and isolate cloud accounts simultaneously rather than in sequence. If containment still moves at the speed of a ticket queue, that gap is the finding.

States kept passing their own AI rules straight through the industry's push for a federal override, reports Politico on September 2. Stop planning around one federal answer and treat disclosure and audit duties as a per-state matrix. Inventory which states your users sit in before the next release, not during the first inquiry letter.

Six infostealer families lifted Claude session cookies: Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, plus Atomic Stealer on a smaller number of Macs, per BleepingComputer. A replayed session inherits that account's Workspace connector grants for Gmail, Drive, and Calendar, and the exposed accounts are card-billed personal subscriptions no admin console can see or sign out, per VentureBeat.

Be precise about what the fix buys. Cookie replay bypasses SSO as thoroughly as it bypasses 2FA, so an SSO-enforced Team or Enterprise plan gives you revocation and visibility, not prevention. Two moves today: put Claude behind your IdP so a compromised session is something an admin can kill, then audit managed laptops for personal Claude accounts with connectors attached. Endpoint detection is what catches the stealer before it reads the cookie jar. If this audit becomes SOC 2 evidence anyway, Comp AI handles the control mapping. Our writeup.

Beehiiv rebuilt its Recommendation Network so free and paid growth share one dashboard, with geo-targeting, budget caps, and Auto-Deposit that keeps a paid campaign from stalling on a low balance. Newsletter Lists is the other addition: multiple lists inside one publication, each with its own forms, automations, and opt-outs, gated to Max at $96/mo per beehiiv's pricing page.

Here is the number that decides it. Two Scale accounts at $43 each per beehiiv's pricing is $86/mo, so Max buys real multi-list support for roughly $10 more and one login instead of two. The candid con is auto-clean: subscribers who fail verification now stay tagged instead of being removed, so hygiene is manual and the junk you miss can push you into a higher price band. Rating holds at 4.5 of 5. See the Scale vs Max breakdown or start a beehiiv trial.