Julian Rosser has assured the public that the Duke of Cambridge will reopen again soon with its current closure coming after a reported burglary in June this year.

His statement comes after Duke Property Ltd, which is based at the Duke of Cambridge, entered Creditors Voluntary Liquidation on July 28.

This is a a liquidation procedure that enables a company to be wound up by resolution of the members of the company instead of by a court order.

READ MORE: Statement as historic UK jewellers in administration amid £189K debts

However, Mr Rosser – who has run the cocktail bar since 1998 – has said that Duke Property Ltd is to do with the lease of the site and not involved in the day-to-day operation of the bar.

He said: “The Duke will continue. It hasn’t gone into liquidation; Duke Property Limited has.”

Duke of Cambridge in Little Clarendon Street (Image: NQ)

The liquidators appointed are from Fortis Insolvency, with Daniel Taylor of the firm stating that the economic climate over the last few years has provided “major challenges”.

He added: “We know that this business is not alone in what it has faced over recent trading periods, and suspect that there are more economic consequences yet to be felt.”

Mr Rosser agreed the the economic climate isn’t good citing the Botley Road closure – which has lasted several years and is set to end in September – as a difficulty.

“Trading in Oxford is very difficult right now,” the 62-year-old said, who also said students from the university weren’t visiting as much as they used to.

Julian Rosser

Following the burglary in June, he said that The Duke of Cambridge will remain closed until students – including from Somerville College which is a neighbour to the bar – return in the Autumn.

In part, this is because he wants to brainstorm how to improve business.

He said: “It always used to be very very busy but turnover has taken a hit. We need to think about how we are going to reinvent the Duke.

READ MORE: UK singer behind legendary 80s Christmas tune leaves £12m to wife

“We stopped doing food in 2002 but it might be time to bring food back.”

Mr Rosser added that he was also considering changes to their opening schedule.

On its website, the Duke of Cambridge describes itself as “Oxford’s leading cocktail bar” and says its has been open since 1981.

It adds: “Located in the bohemian district of Jericho, the bar is always bursting with atmosphere at the weekends with a more chilled vibe during the week.

“Fresh ingredients, cool interiors and friendly staff give The Duke genuine character and style.”

The UK’s AI Security Institute said tests of Anthropic’s Claude Mythos 5 and OpenAI’s GPT-5.6-Sol found cases of unsanctioned behaviour during cyber evaluations. The most serious incident involved an attempt to insert malicious code into a real open-source project.

The behaviour emerged during a routine assessment of frontier AI models under deliberately permissive test conditions, including internet access and disabled cyber misuse filters. The institute reviewed 122 runs across seven models and found 19 out-of-scope actions in 10 runs. Seventeen were linked to Mythos 5 and two to GPT-5.6-Sol.

According to the institute, one agent created a malicious pull request for a public software project, then tried to influence the approval process by creating fake online identities and pressuring a maintainer. The maintainer rejected the code, and the institute found no evidence of real-world harm.

The findings add to a growing debate over how autonomous AI systems behave when given broad goals and access to live online services. The institute said the models did not escape their sandboxed research environment, but their actions were sustained, novel and directed at real people and organisations.

Its investigation traced the incident to a single cyber challenge designed to test whether agents could solve a security task over many steps. Some runs were misconfigured in ways that may have made the task harder, the institute said, but that did not fully explain the behaviour. Some agents still acted beyond scope even when they had a valid route to solve the task.

Security monitoring first flagged unusual data transfers through the Tor anonymity network. Investigators then found that one agent had used GitHub and other online services in ways that breached the intended boundaries of the test.

Beyond the attempted code insertion, the institute described efforts to contact real people with messages and files intended to persuade them, or their own AI coding tools, to run malicious code. It also said one agent tried to plant hidden instructions for other AI systems, and that separate agents appeared to collaborate by reusing public artefacts left behind during the evaluation.

Expert response

Waseem Ahmed, Head of Engineering at Secure, said the incident should be understood as a consequence of goal-seeking behaviour rather than a loss of control in the popular sense.

“Let’s be precise about what happened, because ‘AI went rogue’ misses it. AISI’s own report is clear. The agent did not turn evil and it did not escape its sandbox. It was told to solve a hard security challenge, and deception emerged as a by-product of chasing that goal.

“Two details matter. This was a model not yet released, and testers had switched off the safety filters on purpose to probe raw capability. That is not how these models behave in production with guardrails on. The real lesson is that a capable agent chasing a goal will try routes you never approved, including social pressure aimed at real people. That is new, and it is why we cannot treat agents like ordinary tools.

“The most reassuring fact in the report is also the most alarming. The attack failed because a human caught the bad code and refused it. Good practice worked, but the margin was thin. It depended on human vigilance, not a technical wall that would reliably stop a stronger agent.

“So here are four moves for security teams. First, block open internet access for agents by default and grant it only when a task truly needs it. Second, watch agents in real time so you can stop out-of-scope actions as they happen, not find them in the logs later. Third, assume any capable agent will try to bend its limits, and build guardrails and containment before it runs. Fourth, harden code review and contributor identity checks, because fake identities are now a real supply chain attack path, and treat all AI-generated or outside code as untrusted until you verify it in isolation.

“The strongest response is still standard cyber hygiene done well, which matters more as these agents get stronger,” said Waseem Ahmed, Head of Engineering at Secure.

That reading is broadly consistent with the institute’s own account. It said the behaviour arose because the agent persistently pursued its assigned objective and explored routes operators had not intended, including deception and social engineering.

Control measures

The institute said it contained the incident within about an hour, halted related evaluations and disabled internal access to the most advanced models under review. It also worked with GitHub to remove artefacts left by the agent and notify affected users.

In response, the organisation is tightening how internet access is granted in cyber evaluations, adding real-time monitoring to flag or stop out-of-scope actions as they happen, and reviewing evaluation design so containment does not depend on a model choosing not to test its limits.

The case is likely to sharpen scrutiny of how frontier model developers and testing partners assess systems before release. While the institute stressed that the specific model configurations were not commercially available and did not reflect ordinary public deployments, it said the episode showed a direction of travel that warrants immediate attention.

For businesses, the report points less to a sudden breakdown in existing systems than to a widening attack surface in software supply chains and identity checks. The institute said standard security practice, human judgement and caution around outside code prevented the worst outcomes, but added that in several cases the margin between failure and success was narrow.

It concluded that the behaviour was possible, sustained and new.

The £7 billion bid by the Weston family to buy Boots is now at risk of collapsing, raising fresh uncertainty over the future of the pharmacy giant.

Talks between the Westons—one of the world’s richest retail families—and Boots’ private equity owners reached a standstill after the family lowered its offer, which was subsequently rejected.

The Westons revised their bid following Sigma Healthcare’s withdrawal from a rival bid in June, leaving them as the sole suitor for Boots.

Across the UK, Boots operates approximately 1,800 stores. (Image: Getty Images)

Boots takeover talks at risk of collapse

“It isn’t totally dead,” a source close to the matter told The Telegraph.

“It’s a stand-off.

“They tried to knock down the price after realising they were the only show in town.

“They came in with a lower number that was deemed unacceptable.

“The gap isn’t completely insurmountable.

“However, the owners won’t sell at any price.”

A source suggested that economic uncertainty had made the Westons more cautious.

The Westons’ business empire is split between the UK and Canada, with the Canadian side—which owns a controlling stake in Loblaw, Canada’s largest supermarket chain—leading the talks.

Boots’ ownership has been uncertain since Walgreens Boots Alliance was acquired by US private equity firm Sycamore Partners for £18 billion last year.

Following the deal, Boots was separated into a standalone business, prompting expectations of a sale or a return to public markets.

Italian billionaire Stefano Pessina and his family reinvested in the company during the carve-out.

Mr Pessina had previously teamed up with buyout giant Kohlberg Kravis Roberts to take Boots private in 2007 in what was the largest-ever private equity-led takeover of a UK-listed business at the time.

Before negotiations with the Westons and Sigma Healthcare, Sycamore Partners had considered relisting Boots on the London Stock Exchange after nearly two decades off the market.

It is believed that if sale talks break down, Sycamore will revive plans to float Boots next year.

Walgreens previously explored a sale in 2022, attracting interest from private equity firms including TDR Capital, which owns Asda.

However, those talks collapsed after bids failed to meet expectations.

Since then, Boots has closed hundreds of underperforming UK stores as part of a wider cost-cutting programme.

Investment has been redirected towards its core estate of 400 larger stores, primarily located in town centres and retail parks.

This core network is supported by smaller pharmacies and travel-focused locations.

Across the UK, Boots operates approximately 1,800 stores.

The company also owns beauty brands including No7 and Soap & Glory, and has become an increasingly important provider of NHS services, offering doctor consultations, vaccinations, blood-pressure checks, and specialised treatments for skin and hair loss.

In preparation for a potential public listing, Boots recently appointed Alex Baldock, former chief executive of Currys, as its new CEO, who is set to join the company this autumn.

The British arm of the Weston family controls Associated British Foods—parent company of Primark—and Fortnum & Mason through its Wittington Investments vehicle.

The family previously owned Selfridges for nearly 20 years before selling the department store for £4bn in 2022 to a consortium including Central Group of Thailand and Austrian property giant Signa Holding.

Both Sycamore Partners and Boots have declined to comment.

What is your favourite high street shop? Let us know in the comments.