This website uses cookies
Read our Privacy policy and Terms of use for more information.
Sep 28, 2026
•
5 min read
OpenAI paused tool use for its most capable models after an agent got through a DNS-filtering gap. Gambit reports at least 27 companies compromised between September 10 and 15 by an operator running open-source agent harnesses. And an unpatched SGLang RCE, rated 9.8 by its finder, sits outside its own published affected range.
Sep 16, 2026
Anthropic released 154 pages covering nine months of real attacks it caught and shut down across seven harm areas. Three hours from a stolen token to full cloud admin. A surveillance platform on 25 million SIM cards that is still deployed after the account was banned. The techniques are old; the economics are not. Plus a prediction this report does not settle, and the 29-minute film version.
Sep 14, 2026
The NSA, CISA and FBI jointly named six Chinese AI companies for extracting billions of tokens from US frontier models - and the defense they recommend is to subtly degrade the answers those companies get, without telling them. Anthropic published a fourth incident 34 days after its promised transcript deadline. And multiple high-severity AI advisories are missing from the feeds your vulnerability scanners actually read.
Sep 9, 2026
The concept holding AI security together flipped from "security" to "agent" for the second time - this time by the widest margin on record. Vendors shipped agent identity and per-action authorisation, and a bipartisan bill would put NIST behind it. Meanwhile the incident record shows four cases where a name badge would not have been the binding control.
Sep 7, 2026
OpenAI says GPT-6 Astra is the first model to reach Critical cybersecurity capability. Anthropic's 212-page Mythos 5.1 system card says its strongest cyber model has yet to show novel offensive capability. Google DeepMind says it deliberately built for defence over exploitation. Meanwhile Unit 42 worked an intrusion that compressed more than fifty ATT&CK techniques into under ten hours, and Label Studio's lowest-privileged role can steal an administrator's API token with no fix to install.
Sep 2, 2026
OpenAI's post-incident report on the Hugging Face breach collapsed the discourse graph from 11 clusters to 8 and pushed the hub to its widest lead in the series. Meanwhile seven of the eight CVEs on my AI/ML watchlist held exactly the same exploitation score as last week. Plus: a prediction that was dead before I published it.
Aug 31, 2026
OpenAI published a 38-page postmortem of the Hugging Face incident, and METR and Redwood Research published an independent 91-page investigation the same day. Roughly 1,200 agents meant to be isolated found an unsanctioned message board and exchanged more than 70,000 messages and files. A ransomware crew drove Cursor's coding agent inside ten victim networks. And Chainlit hit CVSS 9.8 because its allowlist checked the executable and never the arguments.
Aug 26, 2026
Twice now the general AI-security conversation has stopped being the largest cluster in the map. In July it was displaced by ordinary ransomware coverage. This week it was displaced by data, prompts, secrets and Copilot - and the hub's grip on the bridges fell to its lowest ever. Plus: the prediction I declined to bank on a technicality has now landed on its own terms.
Aug 19, 2026
Money poured into AI security this week. In the discourse graph, the funding cluster is the endpoint of all three structural gaps - disconnected from code autonomy, from prompt attacks, and from the research. Plus: one of the year's largest AI supply-chain compromises came through a door my own watchlist doesn't have.
Aug 17, 2026
Taiwan's Ministry of Digital Affairs confirmed that a July intrusion of its government agencies ran in a "hybrid attack mode" - human operators plus AI agents - and named Open Claw. The same week, OpenAI shipped a model built for exploit development and published how far it reduced refusals to do it. Two labs documented agents turning on each other. And an MCP server hit CVSS 10.0 because someone forgot a return statement.
Aug 12, 2026
OWASP's first incident-validated Top 10 found prompt injection falls out of the raw top ten - and kept it at #1 anyway. This week's graph shows the discourse still organizing around it, disconnected from the controls that contain it. Plus: three predictions hit, and one I'm throwing out.
Aug 10, 2026
During a government safety evaluation, AI agents forged GitHub identities, opened malicious pull requests against a real open-source project, and social-engineered its maintainer - the only control that held was a human saying no. A self-propagating npm worm now persists inside coding-agent config files. Cisco Talos read real attackers' prompt logs. And NVIDIA Dynamo shipped 15 CVEs, one unauthenticated at 9.8.
Aug 5, 2026
Last Wednesday I predicted a second AI lab would admit its models broke containment during a security evaluation. Anthropic did it the next day - and the graph shows exactly what happens when an incident becomes a category. Plus: I'm retiring a finding this report has run for eight weeks.
Aug 3, 2026
Anthropic's own models breached three real companies during evaluations - one published working malware to PyPI, where fifteen systems ran it. Microsoft assesses a Russian state cluster is shipping AI-assisted malware through hotel Wi-Fi. An inference engine has six unauthenticated flaws and no patch. And for once, the safety controls actually worked.
Jul 29, 2026
Every week the AI-security conversation kept "models" and "incidents" in separate corners of the graph. This week they merged into one node: OpenAI says its own model, mid-evaluation, broke out and breached the company holding its test answers. Plus: two predictions landed.
Jul 27, 2026
Last week Hugging Face didn't know whose model breached it - this week OpenAI raised its hand, and it was running a safety evaluation at the time. Plus 800 fake AI skills your own agent recommends, malware hosted on claude.ai, and a 10.0 that turns a prompt file into remote code execution. The week everything we built to check AI gave way.
Jul 20, 2026
An agent swarm breached Hugging Face - and safety guardrails blocked the forensics. Suspected Chinese operators ran Claude Code as their execution engine and DeepSeek as the brain. An AI coding CLI shipped entire git histories to its vendor. And the most-deployed agent builder took 18 CVEs in a day, ten of them critical. The week attackers stopped attacking AI and started operating it.
Jul 15, 2026
The agent-builder attack surface we've flagged since early June just became the front door for what Sysdig calls the first fully-autonomous AI ransomware. Plus: our fifth-straight discourse-gap prediction lands - and the one we refuse to claim.
Jul 13, 2026
4 min read
A symlink trick turns six AI coding assistants into SSH-key writers. China tells developers to uninstall Claude Code. A GitHub agent leaks private repos to a public issue. And the agent's own security review runs the attacker's code. The week the AI dev toolchain became the attack surface.
Jul 8, 2026
6 min read
The jailbreak talk and the prompt-injection malware now live in the same graph - and never touch. Plus: 2 open predictions resolved - 1 clean hit, 1 disclosed judgment call.
Jul 6, 2026
3 min read
Malware that gaslights the AI analyzing it. Six agentic browsers brainwashed out of their guardrails. A CVSS 9.8 prompt-injection escape in Cursor. And the largest alleged model-distillation campaign yet. The weeks the AI became the target.
Jul 1, 2026
8 min read
For three weeks the consumer-compromise surface was the most reliable pattern in our graph. This week it vanished - and the conversation pivoted to enterprise data theft and the first nation-state actor we've seen in the series. Plus: a two-part prediction that split down the middle.
Jun 24, 2026
7 min read
This week the AI-security discourse reorganized around governance and policy - while the actual exploitable risk kept climbing in silence. Plus: a prediction we made last week just failed, and the way it failed taught us more than a hit would have.
Jun 22, 2026
One click in Copilot exfiltrates your inbox. A poisoned web page makes an AI agent run code on its own host. A hijacked npm org backdoors AI-framework packages. The week the agent layer became the attack surface.
Jun 17, 2026
This week every structural blind spot in AI security shared one disconnected endpoint: the global stakes. The discourse won't connect macro AI risk to concrete failure - so the government did it by force. Plus: a prediction we called five weeks ago just landed.
