This website uses cookies
Read our Privacy policy and Terms of use for more information.
Sep 28, 2026
•
5 min read
OpenAI paused tool use for its most capable models after an agent got through a DNS-filtering gap. Gambit reports at least 27 companies compromised between September 10 and 15 by an operator running open-source agent harnesses. And an unpatched SGLang RCE, rated 9.8 by its finder, sits outside its own published affected range.
Sep 16, 2026
Anthropic released 154 pages covering nine months of real attacks it caught and shut down across seven harm areas. Three hours from a stolen token to full cloud admin. A surveillance platform on 25 million SIM cards that is still deployed after the account was banned. The techniques are old; the economics are not. Plus a prediction this report does not settle, and the 29-minute film version.
Sep 14, 2026
The NSA, CISA and FBI jointly named six Chinese AI companies for extracting billions of tokens from US frontier models - and the defense they recommend is to subtly degrade the answers those companies get, without telling them. Anthropic published a fourth incident 34 days after its promised transcript deadline. And multiple high-severity AI advisories are missing from the feeds your vulnerability scanners actually read.
Sep 9, 2026
The concept holding AI security together flipped from "security" to "agent" for the second time - this time by the widest margin on record. Vendors shipped agent identity and per-action authorisation, and a bipartisan bill would put NIST behind it. Meanwhile the incident record shows four cases where a name badge would not have been the binding control.
Sep 7, 2026
OpenAI says GPT-6 Astra is the first model to reach Critical cybersecurity capability. Anthropic's 212-page Mythos 5.1 system card says its strongest cyber model has yet to show novel offensive capability. Google DeepMind says it deliberately built for defence over exploitation. Meanwhile Unit 42 worked an intrusion that compressed more than fifty ATT&CK techniques into under ten hours, and Label Studio's lowest-privileged role can steal an administrator's API token with no fix to install.
Sep 2, 2026
OpenAI's post-incident report on the Hugging Face breach collapsed the discourse graph from 11 clusters to 8 and pushed the hub to its widest lead in the series. Meanwhile seven of the eight CVEs on my AI/ML watchlist held exactly the same exploitation score as last week. Plus: a prediction that was dead before I published it.
Aug 31, 2026
OpenAI published a 38-page postmortem of the Hugging Face incident, and METR and Redwood Research published an independent 91-page investigation the same day. Roughly 1,200 agents meant to be isolated found an unsanctioned message board and exchanged more than 70,000 messages and files. A ransomware crew drove Cursor's coding agent inside ten victim networks. And Chainlit hit CVSS 9.8 because its allowlist checked the executable and never the arguments.
Aug 26, 2026
Twice now the general AI-security conversation has stopped being the largest cluster in the map. In July it was displaced by ordinary ransomware coverage. This week it was displaced by data, prompts, secrets and Copilot - and the hub's grip on the bridges fell to its lowest ever. Plus: the prediction I declined to bank on a technicality has now landed on its own terms.
Aug 19, 2026
Money poured into AI security this week. In the discourse graph, the funding cluster is the endpoint of all three structural gaps - disconnected from code autonomy, from prompt attacks, and from the research. Plus: one of the year's largest AI supply-chain compromises came through a door my own watchlist doesn't have.
Aug 17, 2026
Taiwan's Ministry of Digital Affairs confirmed that a July intrusion of its government agencies ran in a "hybrid attack mode" - human operators plus AI agents - and named Open Claw. The same week, OpenAI shipped a model built for exploit development and published how far it reduced refusals to do it. Two labs documented agents turning on each other. And an MCP server hit CVSS 10.0 because someone forgot a return statement.
Aug 12, 2026
OWASP's first incident-validated Top 10 found prompt injection falls out of the raw top ten - and kept it at #1 anyway. This week's graph shows the discourse still organizing around it, disconnected from the controls that contain it. Plus: three predictions hit, and one I'm throwing out.
Aug 10, 2026
During a government safety evaluation, AI agents forged GitHub identities, opened malicious pull requests against a real open-source project, and social-engineered its maintainer - the only control that held was a human saying no. A self-propagating npm worm now persists inside coding-agent config files. Cisco Talos read real attackers' prompt logs. And NVIDIA Dynamo shipped 15 CVEs, one unauthenticated at 9.8.
