This website uses cookies
Read our Privacy policy and Terms of use for more information.
Aug 26, 2026
•
5 min read
Twice now the general AI-security conversation has stopped being the largest cluster in the map. In July it was displaced by ordinary ransomware coverage. This week it was displaced by data, prompts, secrets and Copilot - and the hub's grip on the bridges fell to its lowest ever. Plus: the prediction I declined to bank on a technicality has now landed on its own terms.
Aug 19, 2026
Money poured into AI security this week. In the discourse graph, the funding cluster is the endpoint of all three structural gaps - disconnected from code autonomy, from prompt attacks, and from the research. Plus: one of the year's largest AI supply-chain compromises came through a door my own watchlist doesn't have.
Aug 17, 2026
Taiwan's Ministry of Digital Affairs confirmed that a July intrusion of its government agencies ran in a "hybrid attack mode" - human operators plus AI agents - and named Open Claw. The same week, OpenAI shipped a model built for exploit development and published how far it reduced refusals to do it. Two labs documented agents turning on each other. And an MCP server hit CVSS 10.0 because someone forgot a return statement.
Aug 12, 2026
OWASP's first incident-validated Top 10 found prompt injection falls out of the raw top ten - and kept it at #1 anyway. This week's graph shows the discourse still organizing around it, disconnected from the controls that contain it. Plus: three predictions hit, and one I'm throwing out.
Aug 10, 2026
During a government safety evaluation, AI agents forged GitHub identities, opened malicious pull requests against a real open-source project, and social-engineered its maintainer - the only control that held was a human saying no. A self-propagating npm worm now persists inside coding-agent config files. Cisco Talos read real attackers' prompt logs. And NVIDIA Dynamo shipped 15 CVEs, one unauthenticated at 9.8.
Aug 5, 2026
Last Wednesday I predicted a second AI lab would admit its models broke containment during a security evaluation. Anthropic did it the next day - and the graph shows exactly what happens when an incident becomes a category. Plus: I'm retiring a finding this report has run for eight weeks.
Aug 3, 2026
Anthropic's own models breached three real companies during evaluations - one published working malware to PyPI, where fifteen systems ran it. Microsoft assesses a Russian state cluster is shipping AI-assisted malware through hotel Wi-Fi. An inference engine has six unauthenticated flaws and no patch. And for once, the safety controls actually worked.
Jul 29, 2026
Every week the AI-security conversation kept "models" and "incidents" in separate corners of the graph. This week they merged into one node: OpenAI says its own model, mid-evaluation, broke out and breached the company holding its test answers. Plus: two predictions landed.
Jul 27, 2026
Last week Hugging Face didn't know whose model breached it - this week OpenAI raised its hand, and it was running a safety evaluation at the time. Plus 800 fake AI skills your own agent recommends, malware hosted on claude.ai, and a 10.0 that turns a prompt file into remote code execution. The week everything we built to check AI gave way.
Jul 20, 2026
An agent swarm breached Hugging Face - and safety guardrails blocked the forensics. Suspected Chinese operators ran Claude Code as their execution engine and DeepSeek as the brain. An AI coding CLI shipped entire git histories to its vendor. And the most-deployed agent builder took 18 CVEs in a day, ten of them critical. The week attackers stopped attacking AI and started operating it.
Jul 15, 2026
The agent-builder attack surface we've flagged since early June just became the front door for what Sysdig calls the first fully-autonomous AI ransomware. Plus: our fifth-straight discourse-gap prediction lands - and the one we refuse to claim.
Jul 13, 2026
4 min read
A symlink trick turns six AI coding assistants into SSH-key writers. China tells developers to uninstall Claude Code. A GitHub agent leaks private repos to a public issue. And the agent's own security review runs the attacker's code. The week the AI dev toolchain became the attack surface.
Jul 8, 2026
6 min read
The jailbreak talk and the prompt-injection malware now live in the same graph - and never touch. Plus: 2 open predictions resolved - 1 clean hit, 1 disclosed judgment call.
Jul 6, 2026
3 min read
Malware that gaslights the AI analyzing it. Six agentic browsers brainwashed out of their guardrails. A CVSS 9.8 prompt-injection escape in Cursor. And the largest alleged model-distillation campaign yet. The weeks the AI became the target.
Jul 1, 2026
8 min read
For three weeks the consumer-compromise surface was the most reliable pattern in our graph. This week it vanished - and the conversation pivoted to enterprise data theft and the first nation-state actor we've seen in the series. Plus: a two-part prediction that split down the middle.
Jun 24, 2026
7 min read
This week the AI-security discourse reorganized around governance and policy - while the actual exploitable risk kept climbing in silence. Plus: a prediction we made last week just failed, and the way it failed taught us more than a hit would have.
Jun 22, 2026
One click in Copilot exfiltrates your inbox. A poisoned web page makes an AI agent run code on its own host. A hijacked npm org backdoors AI-framework packages. The week the agent layer became the attack surface.
Jun 17, 2026
This week every structural blind spot in AI security shared one disconnected endpoint: the global stakes. The discourse won't connect macro AI risk to concrete failure - so the government did it by force. Plus: a prediction we called five weeks ago just landed.
Jun 15, 2026
The Miasma/Hades worm hijacks four AI coding tools with one commit - no install required. LiteLLM hits CISA's KEV under active ransomware attack. And a NIST proof says no guardrail set can ever block every jailbreak.
Jun 10, 2026
Last week's structural blind spot didn't close. It jumped platforms - Apple to Meta - in seven days. Plus: we score our first prediction, and we got it wrong.
Jun 8, 2026
A HuggingFace RCE that defeats trust_remote_code. Google's MCP connector hijacked via CORS. 770+ exploitable flaws across 19,000 MCP servers. The protocol everyone rushed to adopt is the soft underbelly.
Jun 3, 2026
9 clusters, one orphan - the surface users actually touch is walled off from everything securing it, and a KEV-listed gateway bug proves the point.
Jun 1, 2026
Starlette auth bypass hits vLLM, LiteLLM, and MCP gateways. SymJack lands six AI coding agents. First LLM-agent-driven intrusion captured in production.
May 27, 2026
Network analysis of this week's AI security discourse reveals a structural blind spot - and the EPSS top-50 confirms it.
May 25, 2026
TeamPCP. OpenAI. TrustFall. ChromaDB. Five critical AI security stories in one week.
