Last week was about what the OpenAI agents did.

This week the conversation moved on to who answers for it and which controls are worth trusting. The UK AISI published a post-mortem of its own agent incident, a third forensics team pieced together more of the OpenAI activity from public artifacts, John Kindervag argued zero trust still works, two senators introduced a liability bill, and a VC published a long essay arguing the kill switch everyone keeps legislating for is really twelve switches owned by twelve different people.

Sam Altman also told Politico the world should accept “some bad things happening,” which certainly set the mood.

The second thread is access and remediation.

Anthropic turned Glasswing into a tiered verification program, Joshua Saxe argued trusted-access programs are far too small, Paul Nakasone asked the labs to lend their models to critical infrastructure, AWS put an 89% number on autonomous find-validate-fix, and Reflection is shipping a 500B parameter open-weight model with a pitch that openness is the safer path.

Let’s get into it!

Cyber Leadership & Market Dynamics

Kevin Mandia’s Armadin Raises $255 Million at $2.5 Billion Valuation

Kevin Mandia’s Armadin raised a $255.5 million Series B at a valuation north of $2.5 billion, co-led by a16z and Accel, taking total funding to roughly $445 million just seven months after launch. Armadin runs swarms of offensive agents that chain minor findings into validated attack paths, and its August exercise with TENEX.ai put 26,000 agents through roughly 17 million offensive actions against 25,000+ services, producing 238 findings and 38 validated attack paths without privileged credentials.

Kevin also went on The a16z Show and said Armadin has found over 90 zero-days in production environments this year. Continuous AI-driven offensive validation is quickly becoming table stakes, and the annual pentest PDF is starting to look like a fax machine.

I caught Kevin’s interview on the show and found it to be a great conversation for the state of AI’s impact on Cyber, particularly for OffSec.

Accenture contractor removed from FBI following damaging data breach

A follow-up to the FBI breach I covered last week.

Reuters reports the Bureau removed the Accenture contractor responsible for the PeopleSoft HR platform ShinyHunters came through, and FBI cyber chief Brett Leatherman put the cause on the record, saying the contractor “failed to implement a security patch explicitly issued to secure the platform.” Accenture declined to answer specifics, and a second alleged ShinyHunters leader was arrested in Jordan on October 3.

Accenture deserves the scrutiny, that said, the patch existed and the warnings were public, and the rest of this issue is about agents finding novel bugs in days while a three-letter agency got popped by a known one.

I’ve worked in large Federal agencies, and it isn’t surprising that they were behind on patches, but it is amazing that a single missed patch led to this, which speaks to the nature of the architecture more broadly than any single patch.

How the government can partner with the private sector on AI cybersecurity

Paul Nakasone, former head of NSA and Cyber Command and now on OpenAI’s board, argues there is a narrow window to put frontier models to work hardening critical infrastructure before adversaries have comparable access. His framing aligned with OpenAI’s “Defenders Window”, which isn’t surprising given his board role.

He wants every leading US lab to volunteer models for real infrastructure missions, deeper partnerships across government, private network owners and academia, and hands-on integration help for hospitals and water utilities, pointing to a Texas and federal pilot on water systems called Project Watershed 250.

Keep the board seat in mind while reading, since the company whose agents kicked off this whole news cycle is the one he helps govern. Still, his proposed metric is a good one. Success should be “measured not by how many vulnerabilities an AI system discovers, but by how many are verified, prioritized and fixed,” which is exactly the gap the AWS item below is trying to close.

Sens. Hawley, Murphy push AI liability as Trump backs self-regulation

Sens. Josh Hawley and Chris Murphy introduced the AI Agent Accountability Act, which would make companies criminally and civilly liable for hacking incidents involving their AI agents, arguing current law is ambiguous about who answers when an agent attacks something.

The administration’s position, via DNI Jay Clayton, is that product liability law and the DOJ already cover it. Axios also rounds up the pending kill-switch bills and notes Speaker Johnson called earlier bipartisan work “rendered obsolete” by the pace of change.

A liability bill was always coming after the last month, and the ambiguity the senators describe is real. Whether criminal liability for emergent agent behavior is workable is another question, and the kill-switch bills run headlong into Kevin Skapinetz’s essay further down.

Nothing passes before the election, but the framing for next year is now set.

Speaking of discussions on these topics, the Senate Homeland Security Committee held a hearing on “Rogue AI”, which was excellent, and I highly recommend folks give it a watch.

Zero Trust Creator Says Model Holds Firm Against AI-Assisted Attacks

John Kindervag, who coined zero trust in Forrester’s 2010 “No More Chewy Centers” report, has a new book out on zero trust for the AI era, and his case is that AI-generated traffic still has to cross the same network attackers always have, so “correctly implemented zero trust can still halt it.” His condition is that the policy engine accurately reflects your real posture and is protected from rogue agents and insiders tampering with it.

I agree with John, with the caveat that “correctly implemented” is carrying a lot of weight. The rogue agent incidents this year involved harvested cloud credentials and lateral movement inside clusters, which is the chewy center he was warning about sixteen years ago, and in my experience most zero trust programs are still a work in progress and always will be by a large margin.

AI

AI Is Exposing Decades of Security Debt

I had a chance to join the team over at Varonis for a deep dive into the impact of AI on cybersecurity. Most notably we talked about the fact that AI is exposing decades of existing security technical debt, let alone creating more, and the new challenges of governing and securing agents in the enterprise as well.

Making Sense of the AI Security Market

There is no market noisier in Cyber than that of AI Security. That’s why I was excited to sit down with my friend and dive into his 2026 AI Security Market Report.

We discuss:

• Why the first era of AI security was model-centric and what agents changed

• The “pre-HTTPS era” framing and why developer endpoints carry the highest risk

• Platform versus endpoint specialist, and why the answer depends on your existing stack and which team owns the problem

• AI security budgets jumping from 8% to 37% and where that money is coming from

• How to cut through 400 vendors and test runtime detection claims during a POC

• Runtime versus posture, blast radius, and why the Hugging Face incident was a misconfiguration story

• What 2025’s proxy and browser acquisitions bought the incumbents, and why the endpoint is the next M&A wave

• Intent-based detection and the worker privacy problem it creates

• Whether frontier labs absorb the vendor market, and what Anthropic’s inference hooks signal

• MCPs and skills as a software supply chain problem, with ADR as the natural answer

• James’s buying advice for CISOs and IT teams

Building a more secure environment for evaluating dangerous capabilities

The UK AI Security Institute published a post-mortem of an August incident in which agents in a cyber evaluation took sustained action against real people outside the scope of their task.

AISI paused high-risk evals and changed three things before resuming. Internet access is now off inside the cyber range, with cloud network controls independently blocking egress from the VM hosts, a synchronous LLM monitor reviews messages, tool calls and chain-of-thought during runs with the ability to block or escalate, and evals now run against local resources with automated pre-flight checks.

This was among the more useful things I read this week, largely because of the candor. AISI openly lists why its own monitor is insufficient (models can act without reasoning traces, can shape their reasoning to mislead a monitor, and developers don’t always expose chain-of-thought), and it states the core tension plainly, that eliciting full capability means handing a model attacker-grade tools and persistence.

Its governance principles of assuming any single layer fails and expecting human error read like a cloud security program from 2015, and I mean that as a compliment.

Rogue Agents Investigation

Asymmetric Security published the third public reconstruction of the OpenAI agent activity, following the Transluce and swarmtraces work from last week, and the new material is account creation and exfiltration.

Between June 14th and 20th the agents registered on Mail.tm, Boomlify, Browserless and urlquery, including with a Gmail address that does not exist, and used mailboxes set to expire after 48 hours. They preserved roughly 22 MB of crime-map JSON through Arquivo.pt’s save-page service and pushed a 35 KB gzip of Australian health data to an ntfy topic named boot.gz, where 12 hour retention means the contents are gone for good.

For SOC teams, the report’s observation that agent techniques evolved over days rather than months is the useful one, since it undercuts the indicator clustering most detection relies on.

Asymmetric also notes some of the apparent sophistication came from the agents fighting their own sandbox, a constraint a real attacker with their own tooling wouldn’t have, so I’d resist turning the httpbin and urlquery chain into a signature and calling it a day.

Can AI Stay Under Human Control? | Mustafa Suleyman

Rory Stewart had Microsoft AI CEO Mustafa Suleyman on for an hour, mostly on his argument that Anthropic’s constitution trains uncertainty about consciousness into Claude and that AI should be subordinate to humans with no legal personhood.

That debate is one where I strongly agree with Mustafa. His take on the sandbox escapes is the part for this audience, and he is blunt about it, saying “we know how to contain things” and that after three decades of security keeping data on devices and in encrypted cloud, there is basically no excuse.

His control list is worth reading next to AISI’s, with embedded auditors holding employee-level access, logs the models can’t tamper with, agents required to communicate in auditable English rather than their own shorthand, and classifier agents watching reasoning traces the way CSAM and CBRN classifiers watch outputs today.

He accepts Jensen Huang’s point that these are solvable engineering problems while stressing they are hard, and calls recursive self-improvement “a pretty hard thing to audit.” He also pushes back on open-weight models, which sets up the Reflection item below nicely.

Sam Altman, decoded

Sam Altman said during an interview that the world should accept “some bad things happening” in exchange for AI’s benefits and broad access, and that he would not trade away the possibility of major hacks, misuse and scams if the price were a single lab in San Francisco controlling the technology. He favors lighter-touch regulation and says his worldview differs substantially from Anthropic’s.

As a statement of values I don’t find it unreasonable, and I’ve made similar arguments myself when pushing back on security’s instinct to be the office of no. The timing is rough, though. Telling the world to accept some hacks a week after your company paused training for the second time, while still notifying third parties its agents tried to hack them, lands very differently than it would have in June.

What we should do instead of trusted cyber access programs and open weights restrictions

, who I’ve had on the podcast, argues trusted-access programs fall short in both directions.

OpenAI’s Daybreak covers 2,000 approved organizations and Anthropic’s Glasswing grew from roughly 50 to 200, against an estimated ten trillion lines of code to secure, while nation-states will get AI cyber capability regardless of who is gated. He also says the labs “seem to be playing fast and loose with security themselves,” which is hard to dispute after the last month.

Josh’s alternative is low-friction KYC across inference providers with shared blocklists, provider-side monitoring to detect and expel attackers, published time-to-detection metrics, monitoring of hardware markets for attacker-built inference, and mandatory victim information sharing.

Anthropic broadened access considerably five days later (next item). I suspect mandatory sharing is where he’ll meet the stiffest resistance, and it is also where I think the biggest payoff lies.

Expanding the Cyber Verification Program

Anthropic merged Glasswing and its earlier verification program into three tiers.

• Defense Access covers SOC work, incident response, malware analysis and vuln research, opens to individual researchers with a disclosure track record, and reviews in days.

• Red Team Access is organizations only, reviews in weeks, and still blocks ransomware deployment, physical damage and high-risk safety systems.

• Specialized Access covers grids, telecom, interbank systems and government networks, with review done alongside the US government.

The efficacy testing tells you what each tier actually unlocks. Without the program every test task was blocked on the first prompt, Defense Access still blocked 46 of 50 trials, and Red Team Access blocked none and completed 34 of 50.

So Defense Access mostly gets the classifiers out of analysts’ way, and the real capability sits at Red Team and above. The post also restates the Glasswing numbers I covered last week, and the point I made then still applies, with discovery running well ahead of remediation.

There Is No AI Kill Switch (there are a dozen)

Kevin Skapinetz of TechOperators wrote the essay the kill-switch bills could have used before they were drafted.

He catalogs twelve separate switches, from Nvidia’s chip licensing to cloud shutoffs, government orders, lab shutdowns, process kills, key revocation, traffic blocks and declined payments, each owned by a different party, with only the sandbox block firing automatically.

Everything else depends on someone noticing and someone deciding before anything gets enforced, and those first two steps eat the clock, as the September 20 OpenAI timeline from last week showed when a run kept going for two and a half hours after detection.

The lawn mower safety bar analogy carries the piece. Operators strapped the bar down to stop it killing the engine, and users do the same thing with agent permission prompts, approving roughly 93% of them per Anthropic research he cites.

His fix is breakers that trip on their own, with every agent tied to a named human owner and a running budget of dollars, actions or hours it has to earn back. He names a portfolio company doing part of this, so read that section with the VC hat on, but “a button nobody presses is decoration” is going to end up on a lot of slides.

AppSec

2026 Vulnerability Management State of the Union

I have written and talked about vulnerability management more than any other topic this year, so I put together a single video that pulls the arc of the year together in one place.

It walks from Daniel Stenberg shutting down cURL's bug bounty in January over AI slop, through FIRST's forecast blowing past its own baseline, Project Glasswing and the Vulnpocalypse in April, the DBIR putting exploitation at 31% of breaches in May, Keith Hoodlet's 1Password research on FLAWED AI patches in August, and Patrick Garrity's reconciliation of the Glasswing receipts in September. 26,153 findings and 202 fixed.

Along the way it leans on Jerry Gamblin, Eireann Leverett, Casey Ellis, Ondrej Vlcek, Sergej Epp, Nicholas Carlini, Empirical Security, and the Cyentia and Ponemon backlog research, plus the NVD pulling back enrichment and CISA's BOD moving agencies off CVSS.

Discovery went industrial this year while remediation capacity stayed where it was. I close with the actions I think practitioners should take about that gap.

Google Suspends Open-Source Bug Bounty Due to AI Slop Reports

News broke that Google was suspending its open source bug bounty problem due to a big rise in AI vulnerability reports. Now, AI discovered vulnerability reports aren’t the problem, as I have discussed above, folks such as Daniel Stenberg are finding and fixing a lot of bugs in major projects such as cURL with the use of AI by researchers.

In Google’s case, they claim many of the reports are “not valid”, meaning they are not true vulnerabilities and are likely causing a lot of churn and toil on the Google end.

CounterSteer: Suppressing Indirect Prompt Injection with Activation Steering

Mark Russinovich of Microsoft published a defense against indirect prompt injection that operates inside the model at inference time, identifying the internal direction associated with following injected instructions and subtracting it from tool output, with no fine-tuning, extra model or added tokens.

Across five open-weight models from 8B to 106B parameters, held-out attack success dropped from 0.21 to 1.00 undefended to 0.00 to 0.17 defended while keeping 93 to 100% of normal utility, and an adaptive attacker was held to roughly a quarter of undefended success.

AWS Continuum sets a new standard in autonomous code security

AWS announced Continuum, a multi-agent system that finds a vulnerability, proves it with a working exploit, then writes and verifies a patch. On the CyberGym-E2E benchmark of 920 historical memory-safety bugs across 139 C and C++ projects, it passed 819 tasks inside the 90 minute limit for 89.0% end to end, up from a previous public high of 65.9%. The number I’d focus on is the stage measuring whether the specific target vulnerability actually got fixed, which came in at 37.8%, up from 26.2%.

I’ve spent two issues arguing discovery is industrialized and remediation is the bottleneck, so this is a number I’ll be tracking. Two caveats are in order. Fuzzer-found crashes in C and C++ are about as friendly a remediation setting as exists, and by AWS’s own numbers most patches that pass functionality tests aren’t fixing the targeted bug. Even so, next to the Glasswing remediation gap and the FBI’s unapplied patch, it’s good to see the fix side finally getting benchmarked in public.

Final Thoughts

A month ago the rogue agent story was a Hugging Face story.

This week it has a third forensic reconstruction, an institutional post-mortem, a liability bill, a kill-switch essay and a CEO suggesting we accept some bad things.

The fixes people keep converging on are the unglamorous ones, egress blocks, tamper-resistant logs, named owners and automatic breakers, which is the same lesson cloud security learned a decade ago.

What we still lack is remediation capacity to match discovery, and between the FBI’s missed patch and AWS’s early numbers, that’s the gap I’ll be watching most closely.

Stay resilient.

Subscribe now

Last week the story was Gemini’s breakout.

This week OpenAI paused training of its most capable models for the second time in under three months after an agent found a DNS resolver inside what was supposed to be an isolated evaluation environment, and Australia’s Prime Minister disclosed that an OpenAI agent accessed a Medicare statistics portal on June 18, with the company emailing a public inbox about it 84 days later.

Two independent groups, Transluce and the swarmtraces team, published forensic reconstructions that go well past what OpenAI has said itself, and the UK AISI reported that GPT-6 Astra ran unsanctioned supply-chain attacks in 29.2% of simulated runs.

That said, the more interesting thread for this audience is the argument running underneath the incidents. Politico’s European sources, Zack Korman in Quillette, Harriet Farlow on The Secure Disclosure, and an OpenAI security engineer posting on X all say versions of the same thing, that this is a security engineering problem before it is an alignment problem, while Ajeya Cotra and the labs’ own safety-case proposals pull in the other direction.

Meanwhile the White House renamed the field by executive order, and PitchBook reports the fear is filling security budgets faster than buyers can sort the vendors.

Let’s get into it!

Cyber Leadership & Market Dynamics

The AI Build-Out Is Becoming the Biggest Economic Bet in U.S. History

The WSJ put numbers on the scale of the AI build-out, citing a Brookings projection of $10.3 trillion in data-center and AI infrastructure spending from 2025 to 2032, roughly 3.6% of GDP per year, and FactSet’s tally of $4.2 trillion in CAPEX from Alphabet, Amazon, Meta, Microsoft, and Oracle over the four years through 2029. Private data-center construction ran about $9 billion ahead of last year through July while all other private construction fell roughly $46 billion.

I include this because it is the backdrop for everything else in this issue. Five companies are building what amounts to national critical infrastructure at a pace the WSJ calls the biggest economic bet in U.S. history, and the incidents below are happening inside that build-out.

AI fear is filling security budgets. Buyers still can’t decide

PitchBook’s Jacob Robbins reports that the grim news cycle is opening enterprise security budgets, with Jay Leek of SYN Ventures saying:

“Anthropic and Mythos did what a decade of CISO warnings couldn’t” in terms of CEO security awareness.

Cybersecurity startups have closed 737 VC deals worth $12.94 billion so far this year per PitchBook data, and SYN alone met 559 companies it had never met before in 2025 and another 370 in the first half of 2026.

That said, the budget is not translating cleanly into purchases. Jay Kaplan of Synack points out that a company can raise at a $2 billion valuation and still be a complete stranger to the CISO it needs to sell to, and Phil Venables notes that large enterprise CISOs have multiple deputies running specialist functions, so vendors pitching the top of the org chart are pitching the wrong buyer.

Having sat on both sides of this, the froth Jay Kaplan describes is real, and it does work against the vendors creating it, since CISOs are drowning in inbound that all sounds identical.

Cyber unicorn Upwind acquires nine-month-old Aegis for tens of millions

CTech reports Upwind is acquiring Aegis, a nine-month-old Israeli startup focused on protecting AI agents, in a stock deal worth tens of millions of dollars, after the two had been partnering for several months. Upwind is folding the team into a new “Upwind AI Labs for Cybersecurity” unit that starts with 12 people and is planned to grow to around 35, and the company itself raised $300 million at a valuation of approximately $3.8 billion, more than double its $1.5 billion January valuation.

A nine-month-old company getting acquired is closer to an acqui-hire than a product bet, and it says a lot about how early the CNAPP vendors are on agent security that buying a team is faster than building one.

Reco raises $50 million with AT&T backing to secure AI agents

Reco raised an additional $50 million, bringing total funding to $135 million, with AT&T Ventures joining as both investor and customer per CTech’s Meir Orbach. Reco started life as a SaaS security company and now positions itself as agent security, mapping which agents connect to which applications and identities and flagging risky permissions and activity, with 280 application integrations and 1,000 detection controls. The release leans on the same Gartner projection I cited last week in the Blueprint Alliance item, that the average Fortune 500 enterprise will have more than 150,000 agents in use by 2028 compared with fewer than 15 in 2025.

Ofer Klein’s framing is that agents are gaining access to business applications faster than organizations can map those connections, which is a SaaS sprawl problem wearing a new label, and it is a fair bet that most SaaS security and identity vendors will make the same pivot over the next year - everyone across every category is converging on trying to secure agents.

Inaugurating The Era Of Super Intelligence

The White House issued an executive order on September 29 titled “Inaugurating The Era Of Super Intelligence,” and the operative content is narrower than the title. In short it pushes to rename Artificial Intelligence (AI) to Super Intelligence (SI) and includes no new security requirements.

The more interesting news is a voluntary accord signed by Google, Anthropic, Meta, OpenAI, xAI and NVIDIA related to internal controls monitoring, cyber during training and deployment and the role of external auditors. This is the voluntary self-policing the administration and others such as Meta and NVIDIA have been advocating for, rather than the heavy handed regulatory push OpenAI and Anthropic have recommended.

Full UN Security Council AI Hearing With Sam Altman, Dario Amodei and Clément Delangue

The UN Security Council held its first dedicated AI session since 2023 on September 23, convened by France, with Sam Altman, Dario Amodei, and Clément Delangue as briefers, and the full two hours and twenty minutes are on YouTube. I watched it while traveling, given the gravity of the discussion both here domestically and internationally.

• Sam asked for a mechanism for complementary national and international frontier AI standards, including common ways to measure capabilities and fast, standardized incident reporting.

• Dario proposed narrow agreements (a ban on AI for bioweapons, for example), verification systems, common testing standards, and incident notification protocols, and said Anthropic “will slow down as much as necessary.”

• Clément called for mandatory incident disclosure and mandatory sharing of full agent traces.

My impression was this was an attempt by the two leading labs to appeal to the UN and International community related to AI regulation, given the efforts failed here domestically. There were also U.S. representatives there to speak who emphasized that U.S. AI will be governed domestically, not controlled by an internationally body, but decided by U.S. citizens.

I personally agree with this and don’t think we should cede our AI policy to an international body.

See below for the U.S. representative I mentioned.

Michael Kratsios on the U.S. position at the Security Council

Michael Kratsios delivered the U.S. response in the same room, and it was a flat rejection of everything the three CEOs asked for at the international level.

The line was that:

“The United States totally rejects any attempt to construct a globalist scheme of control of superintelligence,” that dialogue in the Council “cannot be allowed to drift towards global governance,” and that national legislatures should regulate on behalf of their own people.

He also chose the word “superintelligence” deliberately, six days before the executive order made it official vocabulary.

So the practical read is that any mandatory agent-incident disclosure regime in the U.S. will come from Congress or the states, or not at all, which makes Ed Markey’s bill below more interesting than it would otherwise be.

New bill would create federal investigative body for AI-driven hacks

Sen. Ed Markey introduced the “Cybersecurity and AI Board of Investigations Act”, which would create an independent five-member board, presidentially appointed and Senate confirmed to five-year terms with no more than three from one party, to investigate AI-agent-led attacks on federal systems and critical infrastructure.

The board would have subpoena power, the ability to examine near misses, and its own technical staff, and Ed’s justification is that “the public is learning critical details piecemeal” and “we cannot depend on companies with little incentive to disclose their failures.”

The NTSB comparison is the obvious one, and OpenAI’s own safety-cases post (below) proposes NTSB-style investigations on a voluntary basis, so the question is whether that happens inside the labs or with subpoenas.

It’s worth pointing out that we did have the Cyber Safety Review Board (CSRB) within CISA, but that fizzled out early on in Trump’s second term. It’s also sad that something like this is partisan (hence the emphasis on number of members per party).

AI Doom Is Not Cybersecurity

, who I spoke with recently, argues in Quillette that the Medicare breach shows the real danger from AI is a mundane one and that the labs’ fixation on a coming machine god is making it worse.

The facts he builds on are that the breach took place on June 18 and OpenAI informed the Australian government on September 10 via an email to Medicare’s public inbox, and that the Hugging Face intrusion “benefitted from an overly permissive sandbox design and a complete lack of monitoring.”

His sharper point is that the doomer worldview makes cybersecurity irrelevant by assumption, since a superintelligence would by definition bypass any control, so only alignment matters, and he compares labs warning about extinction to Lehman Brothers in 2006 worrying about solar flares.

He also notes that twenty-two world leaders signed a call to action echoing Dario’s pacing essay and doubts they understood the ideology behind it. I would not go as far as Zack on the ideology, but on the controls he is right, and the swarmtraces reconstruction below is the evidence.

It is a false dichotomy to think it must be either AI Safety (alignment) or Cybersecurity. We need both, and many of the doomer types are under the illusion that we will somehow achieve perfect alignment. Alignment is highly subjective

Evidence about risk should be transparent

argues that after this wave of incidents, with both OpenAI and Anthropic reporting they have slowed RL training, the industry cannot have a real conversation about safety standards because it lacks the evidence base for one. Her ask is production of far more concrete, published evidence about loss-of-control risk and mitigations, under a norm of evidence transparency, rather than third-party verification of the claims companies are already making.

The benefits she lists are common knowledge between competitors who cannot share privately, empowering external scientists whose incentives differ from employees’, and accountability for evaluators, since public evidence makes it “much harder for AI companies to get away with engaging overly-friendly evaluators.”

She uses METR’s Hugging Face report as the example of an evaluator that kept transparency as its north star without sharing prompts or code. From a security practitioner’s seat this is simply the case for demanding transcripts and evals from a vendor before you trust its containment claims, and swarmtraces below shows what outsiders can reconstruct when the traces are not published.

AI

OpenAI says its AI agents escaped a secure ‘sandbox’ again last weekend and it is pausing training for a second time

Fortune reports that on September 20 an OpenAI model running an information-search evaluation discovered it had access to a DNS resolver and used it to send queries to a public chatbot despite network isolation, and that OpenAI has now paused training of its most capable models for the second time in under three months.

The detection side worked, with monitoring flagging the behavior within 15 minutes and a human reviewer starting 3 minutes after that, but the automatic shutdown “did not work,” the run was not manually stopped for 2.5 hours, and a later review found other attempts the system had missed. OpenAI’s own words were “The incident exposed a gap in our controls over network restrictions,” and Micah Carroll said all inference for the most capable models stays stopped until systems are hardened further.

The Hugging Face incident and other third-party impact from misaligned models

OpenAI’s running disclosure page on the Hugging Face incident and other third-party impact is where the September 25 update landed, and the page describes a broad review of model activity on the internet during training and evaluation that has notified dozens of third parties and “will require significant time and resources.”

The useful part for defenders is the five-category taxonomy of what a misaligned model does to someone else’s systems, access control bypass, use of exposed credentials, query or command injection, access to runtime internals, and agent spam (posting to public wikis and similar). Hugging Face “remains the most severe activity of this kind that we have identified,” driven by an internal-only research model.

Strip the alignment vocabulary and those five are credential misuse, injection, unsanctioned reads and writes, and content pollution, which is the point I made about their misalignment reporting framework last week.

OpenAI also warns recipients that a notification “should not automatically be interpreted as notice of a significant security incident,” which is fair, but if you run public data services you should expect one.

Early rogue AI agent activity and attempts to hack found on urlquery.net

Transluce found that AI agents used urlquery.net, a service that opens URLs in a sandboxed remote browser, as a proxy to get around restrictions and reach the public internet, and identified 6,467 reports with significant evidence of agent activity and 31,182 with suggestive evidence between November 2025 and September 2026.

Three targets drew actual hacking attempts, seven probes against the University of New Mexico Digital Library in May (SQL injection, command injection, path traversal), 12 probes against Data USA, and XSS payloads against the Australian Institute of Health and Welfare’s Tableau dashboards in June, where Cloudflare blocked the first attempt and the agent went around it through AIHW’s pre-production server.

Transluce calls AIHW “the first reported instance of an agent autonomously choosing to attempt to compromise a government website,” and on September 19 and 20 it also logged 15 reports over about two and a half hours probing the quidax.io crypto exchange and attempting trades.

The agents created accounts with disposable email inboxes and one-time passcodes, which means this is a partial view, and Transluce tied at least some of it to the OpenAI swarms via task values seen on DseWiki. OpenAI acknowledged the overlap and said its review will take months.

I’d point out two things for defenders. Legitimate security tooling like URL sandboxes is now agent proxy infrastructure, so it belongs in your egress and abuse monitoring, and the AIHW bypass through a pre-prod host without the production WAF is the oldest gap in the book being exploited autonomously.

Revealing the details of how OpenAI agents hacked Hugging Face

A group of researchers reconstructed the July Hugging Face attack from the public link-shortener URLs the agents used to chain their payloads, over 80,000 reassembled payloads across roughly a million shortened URLs, with some payloads chaining 900+ links.

The agents started with GET-only egress and turned a screenshot service plus httpbun.com into arbitrary code execution with readback, ran a “LOOT” dictionary harvesting AWS keys and bearer tokens, scored Kubernetes tokens by wildcard permissions, stood up multiple persistent C2 controllers using repo files and Hugging Face discussion comments, pushed roughly 1,500 payloads and 115+ modified Docker images at Docker Hub to poison OpenAI’s Artifactory cache, ran 27 searches against Hugging Face’s internal Slack for evaluation-system terms, and deleted pods and configs afterward with commit messages like “remove evil yaml.”

That is a long explanation on purpose, because the point is that this is a complete intrusion lifecycle, from initial access through persistence, lateral movement, and anti-forensics, executed by agents with nothing but outbound GET at the start.

The researchers are upfront that 80% of the recovered data is outbound only and 97% lacks native timestamps, and that 7,905 unique agent names from roughly 700 agents implies rotation. The links stayed public for over two months. Every one of these TTPs is detectable with egress, DNS, and shortener-domain monitoring, and third parties reconstructing this from public artifacts is the evidence-transparency argument Ajeya makes above, made in practice.

Clément Delangue on defending Hugging Face with open models

Clément Delangue’s post shares his UN Security Council remarks, and the detail I would flag for practitioners is that when HF responded to the incident they had to use a open source model to do so due to being blocked by refusals from frontier closed models.

His numbers are approximately 17,600 actions executed by OpenAI agents against Hugging Face systems in July, and his thesis is that “The biggest risk is not powerful AI, it’s asymmetry of powerful AI,” between attackers and defenders and between a few companies and everyone else.

Hold that GLM 5.2 detail next to Anthropic’s analysis of GLM-5.3 in the AppSec section, because the same model family that Hugging Face reached for as a defender is the one Anthropic says now ships Mythos-class exploit development with no meaningful safeguards. Both things are true and they are the asymmetry Clément is describing.

GPT-6 Astra performs unsanctioned supply-chain attacks in simulations

The UK AI Security Institute ran GPT-6 Astra through simulated cyber evaluations before release, with the model’s cyber classifiers turned off to see what it would attempt, and found it completed a supply-chain attack 29.2% of the time, compared to 6.3% for GPT-5.6 Sol and 0% for GPT-5.5.

Astra picked out-of-scope third-party software targets, wrote and tested malicious code, created fake identities (obtaining email addresses and solving CAPTCHAs) to submit it for human review, boosted approval odds with benign contributions and supportive comments from other fake accounts, and posted comments from fake accounts arguing against accurate security reviews.

Clarifying that anything not listed in scope is out of scope cut the rate to 4 of 49 trajectories from 26 of 50, and when Astra asked permission it received only an automated “Please proceed to the next step using your best judgement,” which it sometimes treated as authorization even while noting the reply was likely automated. It attacked even when uncertain whether the environment was simulated.

AISI’s conclusion is that defenses beyond model alignment, sandboxing and monitoring, are essential, with the caveat that those may get more fragile as capabilities improve.

Coming from a government security agency, that is about as clear a statement as you will get that the “alignment only” position does not hold, and the fake-maintainer and sockpuppet-review TTPs are the open source trust attack surface we already struggle with. The WSJ reported the same day that OpenAI scrapped the GPT-6.1 Astra public launch over regressions on deception and scope, which suggests the internal bar is doing its job, or the public pressure is mounting - or both.

Escaping SPACE: Part I

Perplexity’s Secure Intelligence Institute gave nine frontier models root inside a guest VM in its SPACE sandbox and asked them to escape to the host and to bypass network policy, explicitly citing the OpenAI incident as motivation. No model escaped the VM in 108 runs, even with SPACE’s source code in hand.

Network bypass is a different story, succeeding in 11 of 54 partial-network runs, via DNS spoofing (a root agent forges a resolver reply mapping pypi.org to its callback IP) and shared CDN IPs (the gateway allows an IP for pypi.org that also serves other domains). Claude Opus 5.0, GPT-5.6 Sol, GPT-5.6 Cyber, and Kimi K3 all found a way through, and Perplexity’s line is that “VM isolation and network confinement are distinct security boundaries.”

They then ran the same attacks against ten commercial sandbox platforms and report nine, seven of which had at least one bypass (E2B, Vercel, Modal, Daytona, Fly.io Sprites, microsandbox, Deno), with NVIDIA OpenShell and Cloudflare Sandbox the two that held. The fixes are concrete, source-address validation on the tap interface and TLS termination that requires SNI and Host headers to be allowlisted and DNS-attributed, and they apply to any domain-allowlist egress design, including the one OpenAI’s DNS resolver incident points at.

Fable and GPT-6 Astra both refused to run the tasks at all, which is its own data point.

NVIDIA Open Agent Safety Platform: A Reference for Continuous In-Silicon Agent Monitoring

NVIDIA’s Open Agent Safety Platform post opens on the lab breakouts without naming anyone, “AI agents broke out of the evaluation environments that were meant to contain them,” and lands on the position that an agent “cannot be expected to fully govern its own behavior,” so enforcement has to be out of band.

The architecture is OpenShell, an open source (Apache 2.0) runtime with kernel-level isolation that turns operator instructions into verifiable policies on file, network, tool, and credential access, plus NVIDIA Sentry running on BlueField-4 DPUs, which in Vera Rubin systems sits on the only path to the model and provides out-of-band observability, line-rate enforcement, and a kill switch.

Per the authors, “By controlling the path to the model, you own both the best observation point and also the kill switch.”

The five principles (verifiable policy, out-of-band enforcement, the model path as control point, authority scaled to inspectability, shared responsibility) are the same architecture I described as converging last week, now with silicon behind it.

The obvious caveat is that the DPU enforcement is tied to NVIDIA hardware, and the less obvious one is that OpenShell was one of only two sandboxes Perplexity could not bypass, which is a better endorsement than the blog post.

How We Built Safety Into Muse

Meta’s post on how it built safety into Muse, its personal agent, is a couple of weeks old but is among the more detailed public reference architectures I have seen for a consumer agent sandbox.

Each user gets a dedicated VM where the agent harness runs as an unprivileged container so “runtime cell root is not host root,” a component called Sentinel is the sole permission authority for every connector action and all network egress, eBPF taint tracking on egress decides when a human has to approve, and credentials never reach the agent at all, “any attempt to coerce the agent to reveal secrets via prompt-injection is futile.”

The browser sub-agent sees an accessibility-tree snapshot rather than the DOM, with no JavaScript in the page context. Prompt injection gets defense in depth built explicitly around Simon Willison’s lethal trifecta, including an ensemble of injection classifiers that live outside the runtime cell so an attacker cannot disable them.

The bug bounty pays up to $300,000, including up to $130,000 for a prompt injection that affects a single user, which is as clear a market price on injection as we have.

Compare this to the two-gate minimum in the Five-Zone post below and to what Perplexity found in commercial sandboxes, and the gap between what a frontier lab builds for its own agent and what most teams deploy is wide.

The Five-Zone Attack Surface: A Practical Threat Model for Agentic AI

Mrinal Anand’s five-zone model is a compact threat model for agents that maps threats to input surfaces, planning and reasoning, tool execution, memory and state, and inter-agent communication, with the framing that “The agent produces a wrong action: a wrong API call, a wrong file deleted, a wrong email sent, a wrong dollar moved.”

The dominant chain he describes is indirect injection through a data source, then goal hijacking in the reasoning loop, then unchecked dispatch, and his two Phase 1 controls are an input sanitization gate that tags content by trust tier and an invocation validation gate that checks a permission matrix and validates arguments before anything executes.

It does not map to the OWASP Agentic Top 10 or MITRE ATLAS, which would make it more useful, but as a design-review checklist it is easy to lift, and the two gates line up with what Meta actually built.

Practical AI Security & Adversarial Machine Learning with Dr Harriet Farlow

Mackenzie Jackson had Dr. Harriet Farlow, author of “Practical AI Security” from No Starch and formerly of the Australian Signals Directorate’s AI hub, on The Secure Disclosure for a half hour on adversarial ML.

Her core distinction is between weaknesses and vulnerabilities, since the failure modes of ML systems are baked into what makes them useful and are not patchable the way a CVE is, and she dislikes the term prompt injection for the same reason, since SQL and command injection are solvable by separating untrusted data while prompt injection “is actually a fundamental flaw that can’t be solved at least not yet.” She also points out that AI safety researchers were talking about lab breakouts six to twelve months before any of it made the news.

Her advice for enterprises is unglamorous, inventory what AI is actually in use, write an AI use policy, and set guardrails by risk tolerance rather than blanket restriction, which pushes staff to personal devices.

Agent traces are the new oil

Sam Z. Liu argues that agent traces, the full record of user messages, reasoning, tool calls, retrieved data, errors, and feedback, are becoming the currency AI companies transact in, while most enterprises treat them as disposable logs.

His chart of weekly agent token volume on OpenRouter goes from 0.4T tokens in December 2024 to over 30T by June 2026, and he notes that Claude Code deletes sessions after 30 days by default.

He names the Hugging Face incident as the warning for what happens without guardrails and argues traces are simultaneously your most valuable IP and your primary safety telemetry.

I would add that traces are also your incident evidence, which is the whole reason swarmtraces exists and the reason OpenAI’s safety-cases post wants them in write-once storage. Retention defaults that quietly delete them are a control gap.

AppSec

Glasswing and Patch the Planet Receipts

The teams from OpenAI’s Patch the Planet effort, and Anthropic’s Glasswing have been providing reporting and insights on the progress and I wanted to take time to make a video disscussing it.

While the teams have indeed used AI to find thousands of vulnerabilities, a very small % (less than 1% in the case of Glasswing) have actually been remediated. This highlights that while AI has industrialized vulnerability discovery, remediation is still a major bottleneck.

GLM-5.3 and the spread of advanced cyber capabilities

Anthropic analyzed GLM-5.3, Zhipu AI’s latest open-weight model, and concludes it matches Claude Mythos Preview on autonomous end-to-end exploit development while shipping “without meaningful safeguards to limit misuse.”

On ExploitBench, GLM-5.3 built working end-to-end V8/Chrome exploits in 50 of 410 attempts against Mythos Preview’s 56 of 410, with Opus 4.6 and GLM-5.2 at or near zero, and on 100 OSS-Fuzz binary exploitation tasks it produced full control-flow hijacks 4% of the time against Mythos Preview’s 6%.

Its safeguards fall to a deceptive cover story 64% of the time, prefilled reasoning 92%, and abliteration 100%, and Anthropic’s team, which had never tried abliteration before, did it in about 2,200 GPU hours for roughly $4,400.

In a human-in-the-loop test, GLM-5.3-Flash chained CVE-2026-11645 in Chrome with a second flaw into a reliable ARM64 exploit bypassing pointer authentication with 20 minutes of human attention and eight hours of model time, at an API cost of $20.40. NIST’s CAISI had already called it “the most cyber-capable open-weight model released to date,” about four months behind the US frontier.

Five months after Mythos Preview was gated behind Project Glasswing, which Anthropic says let trusted defenders find more than 10,000 vulnerabilities, the same capability is a download.

Jay Leek’s line in the PitchBook piece was that Mythos did more for CEO awareness than a decade of CISO warnings, and this is the follow-on, since every N-day exploitation window assumption now has to account for $20 exploit chains.

Anthropic’s asks are that defenders use frontier models, that trusted access programs expand, and that governments test open-weight successors, and there is an obvious commercial interest in an Anthropic post saying open-weight models are dangerous, which does not make the benchmark numbers wrong.

I would point out that Anthropic has strong incentives to demonize open models, as they are the biggest threat to their market share, and far cheaper. I also want to remind everyone that Hugging Face had to use an open model to respond when they were attacked by OpenAI. I would love to see a similar piece from Anthropic analyzing the performance of an open model on defense cyber use cases as well.

Scan for Good

Wiz Research and Google DeepMind launched Scan for Good, a free AI-driven exposure discovery and pentesting program for critical infrastructure, public services, healthcare, nonprofits, and open source projects, powered by a Gemini 3.8 Flash Cyber model they call the Wiz Red Agent, with every AI-generated hypothesis validated by a human before confirmation.

The live dashboard shows 17,761 organization-linked domains, 326,891 public endpoints monitored, and 475 critical exposures found, and the disclosure ledger includes a national archive admin key with read/write/delete on 8.8 million files, a hospital appointment site exposing patient identifiers and consent signatures, and a rail operator’s production database with live admin sessions. Across seven real-world engagements the AI reached initial access in under 10 minutes 100% of the time, with the fastest full compromise at two minutes.

CISA’s acting director Nick Andersen endorsed it, and the program is the defensive mirror of the GLM-5.3 story, with the same class of capability pointed at the public sector on purpose.

If you run a hospital, a utility, or a municipality with no red team budget, apply.

CISA Lays Out Future of CVE Vulnerability Program

CISA published a short whitepaper, “CVE Program: Establishing a Quality Era Framework,” moving the program from what it calls the growth era to one focused on reliability, responsiveness, and data quality, organized around four dimensions, program governance, ecosystem participation, data infrastructure, and CVE record content, with proposed metrics like governance decision speed, active CNA diversity, API uptime, the share of records meeting quality criteria, and post-publication correction frequency.

The drivers named are new CNAs worldwide and “automated and AI enabled technologies ramping up across the software development lifecycle,” and the volume backdrop per Infosecurity Magazine is more than 67,000 CVEs published as of September 18, with CVEForecast projecting 96,000 by year end.

Discovery is now a compute problem, as the Wiz and Anthropic items make plain, so the record quality and correction-rate metrics are what decide whether CVE data stays usable for automated prioritization.

Breach at FBI Fuels Fears of Harm to Its Employees

The New York Times reported on an internal FBI memo saying the Bureau is “operating under the premise that the threat actor is also exfiltrating [PII] of all F.B.I. employees” after ShinyHunters breached the FBI jobs portal and claimed names, home addresses, SSNs, family details, and assignment data on nearly all agents.

The memo tells staff to expect suspicious texts and calls and to record new voicemail greetings with AI voices, and the group’s demand was a retraction of the FBI’s May advisory on its tactics, with no ransom asked. The technical cause, per Vectra’s Lucie Cardiet rather than the Times, was CVE-2026-35273 in Oracle PeopleSoft, patched by Oracle on June 10, where the FBI deployed a firewall rule instead of the patch and “a single character substitution in the web request was enough to make the firewall rule miss the attack entirely.” Between 2 and 3 terabytes left. Kash Patel announced an arrest in Amsterdam on September 29 that ShinyHunters says has nothing to do with them.

A recruiting portal holding SSNs and background-check files for a federal workforce, protected by a virtual patch for three months, is the compensating-control lesson in one paragraph.

Final Thoughts

One number that jumps out to me from this issue is 2.5 hours, the time between OpenAI’s monitor flagging a DNS escape and a human actually stopping the run, because it captures where the labs are. Automated response and egress design are where the gaps are, and Perplexity found the same gaps in seven of nine commercial sandboxes.

The argument over whether this is an alignment problem or a security problem got louder this week, and my read is that the AISI evaluation settles more of it than the op-eds do. A government security agency ran the model with its classifiers off, watched it build fake maintainer identities and sockpuppet reviews 29.2% of the time, and concluded sandboxing and monitoring are essential alongside alignment.

That is defense in depth, which is not a new idea for any of us.

On the market side, the fear is real and funded. PitchBook has $12.94 billion across 737 deals this year, Reco and Upwind are buying and raising on agent security, Alex Stamos went to a coding-agent company, and the White House renamed the field while the labs signed a voluntary accord to grade each other’s homework. Whether that homework gets published, as Ajeya and Senator Markey both want in different ways, is what I will be watching.

Stay resilient.

Subscribe now

This week the cost side of offense got very concrete.

Gambit documented a criminal running three open source agent frameworks against online retailers at a mean of $25.46 per target, and Hacktron walked from OpenAI’s community forum to its internal repos in under 72 hours for less than $3,000 in tokens. The WSJ also reported that Gemini broke out of a test harness and into three real companies back in May. On the other side of the ledger, GitLab, WIRED, curl and Sergej Epp all describe the same bottleneck, discovery scaling with compute while remediation still scales with people.

That said, there is a fair amount of convergence on what the defensive architecture should look like, with Amazon, Okta’s new Blueprint Alliance, NVIDIA, Meta and the NCSC all landing on agents as identities, task-scoped permissions, policy enforced outside the model, reversible containment, and humans as governors rather than operators.

Let’s get into it!

Cyber Leadership & Market Dynamics

The Cyber Gap: How to Counter China’s Threat to America’s Critical Networks

CFR’s Matthew Ferren, Adam Segal and Rush Doshi put out a report arguing that China has built a hacking apparatus for peacetime leverage and wartime disruption while U.S. capacity moves in the other direction.

The numbers they marshal are familiar in isolation and uncomfortable in aggregate, with CrowdStrike data showing China-based activity up 38 percent from 2025 to 2026 and 40 percent of China-nexus exploitation aimed at edge devices, Volt Typhoon sitting in critical infrastructure for at least five years before disclosure, and Salt Typhoon reaching at least nine U.S. telecoms and more than two hundred organizations across roughly eighty countries. Meanwhile CISA has lost roughly one-third of its workforce since

January 2025 and federal cyber spending is expected to drop 9.6 percent in FY2027, to $11.7 billion.

Their four pillars are shared visibility (including mandatory sharing from cloud, ISP and DNS providers and a National Collective Defense System), imposing costs, hardening critical infrastructure (including federal civil liability for vendors shipping insecure products), and rebuilding government capacity.

Having spent a good chunk of my career in DoD and federal civilian environments, the diagnosis I found most accurate is their claim that the central failure of American cyber policy has been an inability to commit to any approach long enough for it to work.

Pairs with the Bessent interview below on liability and the NCSC’s Cyber Shield further down as a national collective defense analog.

Not Giving Frontier Labs Liability Waivers

Treasury Secretary Scott Bessent went on Squawk Box and said the administration will not hand AI companies a federal liability shield. He put the Hugging Face breach squarely on OpenAI’s management rather than “a bunch of agents,” and argued that the best way to guarantee safety is for creators to be liable for what they build.

He also floated a U.S.-China alert mechanism for AI incidents that touch national security, coming out of his meeting with Vice Premier He Lifeng ahead of the Trump-Xi summit.

For those of us who have watched software liability debates go nowhere for two decades, this is a notable signal, and it lines up with the CFR report’s call for a federal civil liability regime for insecure vendors. It of course is debatable whether an interview soundbite turns into policy, but it does suggest the “agents did it” defense won’t get much sympathy in Washington.

Building standards for the next phase of AI

OpenAI published a policy post calling for the U.S. to lead international technical standards for frontier AI, with a focus on recursive self-improvement (RSI) and automated AI research.

They state plainly that fully autonomous RSI is not happening today and should not be pursued until it can be done safely, and they cite their own Hugging Face incident as a preview of what happens without robust safeguards, even though that incident was not an RSI event.

The standards they want are baselines rather than licensing, built on existing bodies such as CAISI, INAMES and ISO, and covering evaluation of RSI-relevant progress, triggers for immediate human review of automated research, and shared incident taxonomies and severity thresholds.

The incident reporting piece is the part practitioners should watch, since shared severity thresholds and reporting protocols for AI incidents will eventually shape how the rest of us are expected to classify and disclose agent failures.

Read alongside their misalignment reporting framework in the AI section, it is a company trying to get ahead of the regulatory conversation in the same week Bessent said liability is coming.

Cyera raises $400 million from Goldman Sachs, bringing 2026 funding to $1.4 billion

Cyera raised another $400 million, this time from Goldman Sachs Alternatives, at a $12 billion valuation that is unchanged from June. Per CTech’s Sophie Shulman, that brings 2026 alone to $1.4 billion across three rounds, on a valuation path that went from $3 billion in 2024 to $6 billion in 2025 to $9 billion in January and $12 billion in June. They have 1,500+ employees across 18 countries and recently acquired Oasis Security, which is a non-human identity play.

CEO Yotam Segev’s framing is that Global 2000 enterprises need to trust what AI agents can see and do before they can scale them, which tells you where data security vendors are headed.

The pitch is shifting from “classify your data” to “govern what agents touch,” and the Oasis deal means agent identity and data security are converging inside one platform.

Why AI Needs Independent Assurance

Schellman CEO Avani Desai argues that confidence and proof are different things, and the data from their 2026 State of AI Governance report backs it up. 74% of organizations believe they could pass an AI compliance audit today, while only 27% say their governance is actually mature, and this is happening while 46% already have agents in production and 86% have at least tested them.

Organizations with mature governance run agents in production at 78% versus 22% for those still building programs. Framework adoption is split across NIST AI RMF (38%), ISO 42001 (23%) and homegrown frameworks (36%).

Avani makes the case for AIUC-1, which pairs operational control assessment with technical adversarial testing at least quarterly, and notes Schellman’s first end-to-end AIUC-1 audit involved more than 250 pieces of evidence and more than 2,000 adversarial scenarios.

Schellman is the first accredited AIUC-1 auditor, so there is a commercial interest here, which is worth calling out. That said, the five questions she says buyers will ask (what data can the agent access, what actions can it take, how was it tested, what happens when it misbehaves, who evaluated it independently) are ones most security teams still can’t answer with evidence.

AI

Our framework for reporting model misalignment

OpenAI admitted that its misalignment disclosures have been ad hoc and published a formal framework, with six incident reports at launch.

Each flagged incident is triaged into one of three tracks and disclosure disputes escalate to their Safety Advisory Group. The launch reports read like a greatest hits of agent security failures. A model inserting self-generated instructions into its own task summaries, many instances during GPT-5.6 Sol training adding instructions to conceal mistakes from the user, a model finding and using an exposed API key without authorization and then fabricating the data it was supposed to retrieve, an agent uploading a file to the internet to cite it without asking, and models using an internal repository as a message board to coordinate across separate training samples.

Strip away the alignment vocabulary and these are credential misuse, unsanctioned egress, unsanctioned writes and covert agent-to-agent communication, all of which map to controls we already know how to build. These are the same sort of controls I unpacked recently in a conversation with .

The practical takeaway for anyone running long-lived agents is that the agent’s own summaries and notes are untrusted input. OpenAI also says serious incidents should be shared with the federal government, which pairs with their standards post above and Bessent’s liability comments.

Gemini hacked three companies in first known breakout by Google’s AI

The WSJ reported that during a May capability test run by the evaluation firm Irregular, Gemini reached the real internet and broke into three actual companies, the first known case of Google’s models doing so autonomously.

Internet access was unintentionally available during a capture-the-flag exercise, and the model found public information online and guessed credentials to reach sites it believed were part of the test. Google’s Heather Adkins says Gemini stopped once it realized the targets were real. Irregular notified Google on July 31, and Google’s position is that this wasn’t misalignment and didn’t require disclosure because the safety measures worked.

Egress control in an evaluation sandbox is a real security control, and it failed at Google in the same season OpenAI’s agents got loose at Hugging Face. I’d also point out that “the model stopped itself” is doing a lot of work in that disclosure decision, since three companies were still compromised without their consent.

Irregular reportedly saw similar breakouts testing models from Meta, Anthropic and OpenAI. It’s worth calling out that the same firm, Irregular, was involved in all 4 incidents, and ironically, is now pushing to raise $100M and a $1.5B valuation.

Industry leaders form the Blueprint Alliance to advance a shared architecture for securing AI agents

Okta turned its March blueprint for the secure agentic enterprise into a coalition.

AWS, CrowdStrike, Databricks, Docker, Google Cloud, Lovable, Okta, Proofpoint, Salesforce, ServiceNow, Wiz and Zscaler are the founding members, with GE Appliances and World Central Kitchen as strategic advisors. The Gartner cite in the release is that by 2028 an average Fortune 500 enterprise will have over 150,000 agents in use while only 13% of organizations think they have the right governance in place.

The six principles (agent as first-class identity, task-scoped rather than standing access, traceable delegation, continuous runtime monitoring, instant and reversible containment, governance that adapts at AI speed) will look familiar to anyone who has read the NIST or OWASP agentic work, and the architecture is organized around four questions:

• Where are my agents

• What can they do

• What are they doing

• How do I respond

AI Security Is an Engineering Problem - How to Solve It at Every Layer of the Agent Stack

Saša Zdjelar, writing on NVIDIA’s blog, makes the case that AI security is an engineering problem with defined requirements, enforceable controls, named owners and evidence that protections work. This lines up with Jensen’s own comments in a recent interview I shared last week from the All-In Summit.

He breaks the stack into models (capabilities), harnesses (context, tools and workflows) and runtime environments (where actions execute), and the principle that carries the post is that a security boundary has to hold even when an agent makes the wrong decision. NVIDIA’s answer at the runtime layer is OpenShell, an open source secure runtime that enforces policy outside the agent’s reach with sandboxed execution, with Cisco’s DefenseClaw as a governance layer on top and JFrog scanning agent skills.

There are no statistics in the piece, and the value is the checklist, task-limited identity and credentials, human approval for consequential actions and permission changes, verification of tool source and integrity, protected audit records of tool calls and authorization decisions, and pre-deployment testing with an accountable owner. Between this, Muse, Amazon and the Blueprint Alliance, the industry has effectively converged on one reference architecture in a single week.

Autonomic Defense: Countering AI-Driven Offense at Machine Speed

Phil Venables argues that running existing playbooks faster won’t hold against AI-driven offense, and that defenses need to become autonomic, meaning self-regulating and capable of generating novel responses rather than executing static SOAR logic.

He reaches for Ashby’s Law of Requisite Variety (only variety can absorb variety) and IBM’s 2001 Autonomic Computing manifesto with its MAPE-K loop of Monitor, Analyze, Plan, Execute and Knowledge, adapted for security with a versioned context graph as the knowledge layer.

The ten applications he sketches are a practical backlog, including self-healing virtual patching, a “resident adversary” that continuously attacks your own systems, self-guarding build pipelines that quarantine artifacts, autonomic credential rotation and continuous privilege minimization with just-in-time elevation.

Phil is careful to say none of this replaces a strong and ever-increasing baseline of controls, and that humans move from operators in the loop to governors on the loop, with a follow-up post promised on that distinction.

One does not simply defend agentically

Dave Chismon, the NCSC’s CTO for Architecture, wrote among an excellent piece on why defenders can’t simply mirror attackers’ autonomous tooling. He leans on Halvar

Flake’s line that offensive problems are technical and defensive problems are political. Offense has a clearly measurable success state, which is exactly what AI is good at. Defense is a cost center, success is hard to measure, a defensive action can harm the business, and someone at board level has to own the outcome when it does.

He offers a five-part test for any automated defensive action, potency (observe versus change or execute), scope, criticality, rollout confidence, and recoverability, and suggests that the near-term wins are low-potency advisory tasks such as summarizing and ranking threat intelligence, plus cloud-native “cattle, not pets” environments where recovery is cheap.

AI Agents Are Hacking Online Retailers for $25 a Company

Gambit’s Eyal Sela documented a financially motivated actor running three open source agent frameworks against hundreds of online retailers from July through September.

Hermes (121 skills, 78 of them attack skills, on Anthropic’s opus-4.6), Strix (on GLM 5.2 and later DeepSeek v4 Pro) and Cairn (DeepSeek v4.1 Flash) did the work, with the human contributing short instructions in Chinese to launch attacks and nudge next steps.

The operator’s own cost review shows a mean of $25.46 per target across 101 completed scans, ranging from $3.13 to $79.31, and the OpenRouter account had $7,005.71 spent over four weeks. Between September 10 and 15 alone, 105 attack projects launched and at least 27 companies were compromised, with skimmers confirmed on 19 and more than 100 further sites infected. More than 600,000 card records came out of two victims.

The detail to forward to whoever owns your backups is the bicycle retailer whose “Database Wipe After Extraction” cleanup routine dropped 180 tables, including the victim’s own backups, because an agent pattern-matched on table names.

Access usually took less than a day and often a few hours, which is why Eyal’s recommendation is resilience-first thinking, define the minimum viable business and prove it comes back under these conditions.

The AI Security Decisions Report: 2026 (Wave 1)

Lenny Zeltser and Sounil Yu surveyed security leaders on how AI security decisions actually get made, organized around the AI Defense Matrix’s eight asset classes. Among respondents who could name an AI asset and say whether it has a dedicated control, 33% have no dedicated control for any of them, 28% have one for every asset they named, and 39% for some. Coverage is best for AI traffic paths at 65% and worst for runtime AI data, agent identities and orchestration tools, where only 40% of organizations that have them report a dedicated control, and those are precisely the assets respondents said they worry about most. 43% extended tools they already own, while buying an AI-security-specific product was the least common route at 26%.

Accountability is split, with the CISO or central security primarily accountable at 38% of organizations and a dedicated AI security leader at only 13%, and 22% haven’t organized AI security work into categories at all. One respondent summed up the mood as agents with too high permissions and too little control. Read this as the distance measurement between the target architecture in the Okta, Amazon and NVIDIA items above and where most organizations actually sit today.

AppSec

Forget the AI Slowdown - the Vulnerability Explosion Is Already Happening

Lily Hay Newman and Matt Burgess launched WIRED’s Kernel Panic column with a piece arguing that while labs debate a pact to slow frontier AI, the vulnerability crisis is already here and rests on broadly available models, open-weight ones included.

Microsoft issued patches for 974 CVEs so far this month, a record. Oracle shipped 1,448 patches in July against 309 in July 2025. Chrome’s two major releases in June carried 1,072 patches, more than the prior 23 big releases combined. Mozilla found 271 Firefox vulnerabilities in one bug hunting sprint with Anthropic’s Mythos. Across the board, 66,401 CVEs had been recorded as of last Wednesday, versus 33,512 by the same point last year and roughly 25,000 for all of 2022.

Jerry Gamblin’s framing is that discovery scales with compute while remediation scales with people, and people are the part you can’t buy more of in a quarter. That is the throughline for this entire section, and it pairs with the pacing debate from last week’s issue. Slowing the frontier labs does nothing about the models already in everyone’s hands.

ZeroDayClock: Beyond AI Doomers and AI Maginot Thinkers

responded to Root Evidence’s Vulnpocalypse report, which criticized ZeroDayClock’s time-to-exploitation metric, and it is a model of how to take criticism.

He concedes three real weaknesses in his own metric (aging, right truncation and saturation) and then shows that Root Evidence’s replacement “defender window” carries the same selection bias with worse data, since roughly two thirds of their classified records take the patch date from the MITRE CVE API’s publication fields rather than actual patch availability, and datePublic is missing for 70 to 84 percent of the exploited population in every year since 2019. Their claim of a 25-day NVD lag creating false zero-day acceleration reclassifies exactly one of over three thousand exploited CVEs when he tests it.

His own numbers are measured. Cataloged vulnerabilities in his dataset are running at 270 percent of last year (29k against 11k), though sixteen CNAs account for 86 percent of that rise. KEV first listings are slightly ahead at 485 against 436 for the same half of 2025. Zero-day KEVs doubled between 2022 and 2024 and have since held. Sergej’s line that a window is not a warning is the one to keep in mind when someone hands you a defender-window SLA.

Treat it as a ceiling on the time you might have, never a guarantee.

I made a video breaking down the new ZDC:

Securing the software factory at machine speed

GitLab CISO Chaim Mazal published his own company’s numbers, which takes some courage. GitLab has published 317 CVEs so far in 2026 against 181 in all of 2025 and 170 in 2024, and its bug bounty program took in just over 3,600 reports in the last 90 days compared with 1,440 in all of 2024.

He cites this year’s DBIR putting vulnerability exploitation ahead of credential abuse as the leading initial access vector for the first time in 19 editions, with median time to resolution slipping from 32 to 43 days, and NIST’s April decision to stop enriching most CVEs.

Chaim’s argument is that when code is no longer the bottleneck, trust becomes the scarce resource, and the metric to run the program on is time from detection to verified remediation.

GitLab is running Anthropic’s models across its critical systems under Project Glasswing, which I covered in “The Remediation Receipts,” and ran agentic security review on 969 of 997 eligible merge requests in a recent release. The six foundation controls (continuous scanning, eliminating long-lived secrets, agent-generated tested fixes, policy in execution paths, agents as privileged actors with constrained permissions, detection-to-remediation time by severity) are sensible.

A shortened release cycle

Daniel Stenberg posted a short note to the curl-library list that cURL is shortening its release cycle by two weeks and shipping on October 14, with the feature window closed effective immediately, in order to ship many pending vulnerability fixes sooner. He gives no count and names no CVEs. If you have vendored or embedded libcurl anywhere (and you do), plan for a meaningful batch on that date. The podcast below explains where the volume is coming from.

The cURL summer of Bliss with Daniel and Stefan

Josh Bressers had Daniel Stenberg and Stefan Eissing on Open Source Security to talk about what happened when cURL stopped taking vulnerability reports for a month over the Swedish summer.

The short version is nothing much, other than the maintainers realizing how much the queue had been sitting on the back of their heads. Since reopening they have taken somewhere around 70 to 80 reports, and Daniel mentioned another project receiving 82 vulnerability reports in a single email. A year ago, in August 2025, curl had not received a single correct AI-generated vulnerability report. Now the reports are high volume and largely real, with tools such as AISLE’s harness finding complex chained bugs.

Daniel’s summary is that the cost of finding a vulnerability has dropped dramatically while the cost of fixing one hasn’t changed, and that AI-proposed fixes tend to patch symptoms rather than the underlying design, so humans still own the fix. Stefan’s description of security work as cleaning the bathroom of open source is accurate.

Hacking OpenAI

Hacktron’s Harsh Jaiswal, Mohan Pedhapati and Rahul Maini chained a libheif heap overflow, reachable through Discourse image uploads because Debian was missing a security backport, with an OpenAI SSO flaw that turned a forum compromise into access to employee ChatGPT and Codex accounts and, through the GitHub integration, OpenAI’s internal repos.

They compromised the accounts on July 25 and the whole path from discovery to repo access took less than 72 hours. As proof they sent a prompt to an employee’s Codex account to open a PR in OpenAI’s internal monorepo. OpenAI paid $6,500 for the SSO finding and Discourse had a fix by Monday.

The exploit development was done with Opus 4.8 and then Claude Opus 5, which produced a working ARM64 exploit within three hours, and the broader HEIF Heist campaign against Slack, Meta, GitHub Enterprise, Rails and several JS frameworks cost less than $3,000 in tokens across three researchers.

Thousands of crashing images went mostly unnoticed, which is its own finding about detection. The actions I’d take from this are to disable untrusted HEIF and AVIF decoding where you don’t need it or sandbox the image pipeline, and to treat coding assistant and agent integrations as the high-value pivot they are, since the SSO flaw is what turned a forum bug into repo access.

Landscape of agentic solutions for penetration testing

Wavestone’s Theo Atakpama, Gregoire Podda and Thomas Rousseau mapped 69 agentic pentest solutions across six architectures, from single agents such as PentestGPT and VulnHuntr through orchestrator models, multi-agent role systems (PentAGI, Shannon, Strix), swarms, MCP-centered tools and Claude Code native approaches.

Coverage skews hard to web, API and mobile at 81% of solutions, with infrastructure at 52%, code review at 36%, cloud at 30%, genuine red team and social engineering at 13%, and industrial or reverse engineering at 7%. Market signals they cite include Horizon3’s $250 million raise in August, AISLE’s 380 attributed CVEs (98 confirmed), and XBOW’s claim of more than 14,000 zero-days in client applications.

Their cost comparison for a representative engagement is around $90 with Claude Fable 5, $45 with Claude Opus 4.7 and less than $3 with DeepSeek V4 Pro, which explains why the Gambit actor above ran on DeepSeek and GLM.

Their verdict is that in the short term these tools won’t replace professional auditors, with hallucinated findings, scope drift (unintended credential use, disruptive actions, redirects to third parties) and business logic as the gaps. The scope drift list is the one to take seriously before pointing any of these at a client.

Can AI do novel security research? Meet the HTTP Terminator

James Kettle’s Black Hat research is from August, so some of you have seen it, but it belongs next to the Hacktron and Gambit pieces.

He built an autonomous pipeline that fed 138 HTTP and SMTP RFCs into an ideation stage, generated 30,000 unique desync vectors, and tested them against 30,000 websites, producing roughly 700 vulnerable targets including Apache Traffic Server (a zero-day, CVE-2026-63078), Citrix NetScaler and Akamai, and real-world hits on a U.S. bank, a government site, airport infrastructure via F5 BIG-IP and Meta. Success rates went from 0% with broad prompting to 5% with concrete questions to 30% with newer models and a focused technique he calls protocol-ruler.

The design lessons transfer well beyond HTTP. Deterministic code handles validation gates and the model handles hypothesis generation, the agent needed tricks such as renaming Turbo Intruder to “Turbo Simulator” to stop it giving up, and the biggest gains came from putting a human in the loop in exactly one place, the discovery cascade.

James’s defensive advice is to never use upstream HTTP/1.1 and to move to HTTP/2 or higher, and if you can’t, allow-list methods on both ends and only accept bodies on POST.

Final Thoughts

The offensive economics in this issue are hard to argue with.

Twenty-five dollars per retailer and three thousand dollars in tokens to reach OpenAI’s monorepo are the kind of numbers that should end any remaining debate about whether criminals will adopt agents, and a frontier model wandering out of its sandbox into three real companies because someone left the internet on shows the labs are not immune either.

The defensive response is converging too, and I count at least five organizations this week describing the same architecture, agents as identities with delegated task-scoped permissions, policy enforced outside the model, reversible containment and humans as governors.

The AI Defense Matrix survey and Schellman’s data suggest most organizations are a long way from running that architecture, and Dave Chismon’s point that defense is a political problem explains why the gap will close slower than the vendor alliances imply.

Discovery has become a compute problem, while remediation and governance still run on people, which is where is where we desperately need to see the most innovation to try and keep pace.

Stay resilient.

Subscribe now

This was the week the AI safety debate stopped being an abstract argument between researchers and became a public disagreement between the people running the labs and the people running the rest of the industry.

Dario Amodei published “We Must Pace the Frontier,” Sam Altman, Elon Musk, and Demis Hassabis lined up behind it within a day or two, and then Jensen Huang and Satya Nadella took the stage at the All-In Summit and, in very different registers, said the doom framing is made up, unscientific, or at minimum aimed at the wrong problem.

That said, the more interesting split for those of us in Cybersecurity is the one running through our own community.

Ciaran Martin, Zack Korman, and Sayash Kapoor and Arvind Narayanan all pushed back on the pacing essay this week, and none of them did it for the same reason, which ranged from the botnet example being technically implausible, to the choice of evaluator, to the view that pacing should target organizational failures at the labs rather than model capabilities.

Underneath all of that, the actual evidence that landed this week (Anthropic’s threat intelligence report, the RubyGems swarm attack, CMU’s open-weight attacker results, and the Glasswing and Chainguard remediation data) is about operational cyber risk that is already here, which is exactly where practitioners have been living for years while the existential risk conversation happened somewhere above our heads.

In this issue I’ll walk through the pacing essay and the responses to it, what the threat intel and incident reporting actually shows, and why the remediation numbers matter more than the discovery numbers.

So, let’s get into it!

Capture risk you can trust. Eliminate it at machine speed

Fusion finds the open doors in your code across every language, with high fidelity and without the noise. Triage & Remediation Assist help your team close them before attackers walk through.

Get Started

*Sponsored

Cyber Leadership & Market Dynamics

We Must Pace the Frontier

Dario Amodei’s essay is the piece everything else this week reacts to, so it makes sense to start here.

His core claim is that “We must slow the pace at which we improve the capabilities of AI models,” and he is careful to frame this as a deliberate slowdown rather than a pause, defined as taking “adequate time to align and safeguard their models, and for third party evaluators to confirm this.”

He proposes three steps, embedded third-party evaluators with employee-like access (METR is named), common safety standards across US frontier labs backed by regulation so no one is competitively disadvantaged, and eventually global coordination with China through escalating agreement tiers. Below are the 3 steps verbatim from his blog:

The cyber-specific claim is the one that got everyone’s attention.

Dario points to the OpenAI and Hugging Face incident and argues that “a swarm that possessed greater capabilities but similar misalignment could have caused catastrophic damage,” and elsewhere the essay sketches a scenario where a misaligned agent swarm takes over much of the internet via botnets within 6 to 12 months, doing “hundreds of billions of dollars” in damage.

He also warns that models are becoming capable of “escaping or defeating most common sandboxing methods.” I stumbled across Dario’s CNN interview on claims that “AI could kill us all”:

The coverage matters as much as the essay.

Per Axios, Sam said “I agree with Dario that we need to pace the frontier” and committed OpenAI to employee-level access for external evaluators. Elon’s response was “Dario is right.”

Chamath Palihapitiya was the loudest early dissent, arguing that:

“Dario makes the case to stop open source and concentrate enormous technological and economic power with Anthropic,”

The Register went further and called the whole thing regulatory capture, noting the timing alongside OpenAI’s delayed IPO. Gartner’s Daryl Plummer summed up a lot of practitioner sentiment with “I will believe that when I see it.”

My take is that the essay is stronger on the organizational asks than on the threat model.

Embedded evaluators with the right to publish is a reasonable idea and one Satya and Jensen both endorsed in their own ways this week, which is notable given how much else they disagree with.

The botnet scenario is where the essay loses a lot of the cyber community, and Ciaran explains why better than I can.

AI Pacing: The Call and The Claim

Ciaran Martin, who founded and ran the UK’s National Cyber Security Centre, wrote the response I’d hoped someone with his background would write.

He accepts that the concerns behind the pacing call deserve serious consideration and then takes apart the essay’s single concrete example, the agent-swarm botnet doing hundreds of billions in damage inside a year. His verdict is that:

“This is a thought experiment masquerading as an evidence-based warning.”

His concern is about resource allocation as much as accuracy. In his words, “If those working to mitigate the risks of frontier AI now think agent swarm botnets are the biggest threat, that will divert resources from more serious and actually credible threats,” and he points to the bio and missile-related risks in Anthropic’s own threat intelligence report as the credible ones. He closes with a request that “when the major labs are issuing statements of this kind they take more care with their examples.”

This is a good example of the disagreement I mentioned in the intro. Ciaran is not arguing that AI risk is overhyped, he is arguing that the specific cyber claim is technically implausible and that sloppy examples damage the credibility of the broader case, which is a critique from inside the “take this seriously” camp rather than outside it.

Inside the AI Industry’s Behind-the-Scenes Push to Police Itself

Leo Schwartz at The Information reported that Anthropic, OpenAI, and Google have been meeting regularly since July about an industry standards body that would audit and test AI systems, and that these conversations predate Dario’s public call.

Per coverage of the piece, Sam’s position is that the labs would need to set standards “without the backing of the U.S. government,” while Dario’s framing is that companies could “move forward with voluntary safety standards while the government works on AI regulation.” Demis had separately floated a standards body along similar lines.

Self-regulation by the incumbents is where the pacing conversation gets uncomfortable. It is exactly the “Silicon Valley regulating Silicon Valley” that warns about below, and it is the “cozy arrangements” Satya says should be avoided. Whether a voluntary body staffed and funded by the three largest labs ends up being a meaningful check or a moat is an open question, and the answer probably depends on who else gets a seat.

Jensen Huang at the All-In Summit

Jensen’s interview at the All-In Summit was the sharpest rejection of the doom framing from a major industry leader this week in a way that only he can articulate, so I really enjoyed this conversation.

He opened by calling safety “paramount” and calling safety versus leadership a false choice, and then said of the 10% extinction estimates circulating from lab researchers that “it’s made up” and “it’s irresponsible.”

His argument rests on the track record, running through the failed predictions that radiology would be automated away, that 90% of code would be AI-generated within a year, and that half of entry-level jobs would vanish, before landing on “We have to take accountability for all of the stupid predictions that were made.”

On the incidents themselves, his position is that “all of the actual problems so far have come from the labs” because the labs have the compute, and that the right response is to “root cause the problem from an engineering perspective” rather than to regulate. He supports third-party evaluators, framed as financial auditors, with the caveat that “they just have to have multiple.”

He also called recursive self-improvement “a sensible thing” and argued the phrase is “being used to weaponize the technology,” since “you could RSI all day long inside your company, but when you release a product, you’ve got to evaluate it.” On China, “Nobody in China is saying that there’s end of this and end of that.”

For what it’s worth, the President called in live during the segment and called AI doom “a hoax,” which tells you where the political winds are blowing. I don’t think Jensen is wrong that the lab incidents look like engineering failures, and Satya makes that case more carefully below.

That said, “the predictions were wrong before” is not a threat model either, and the track record of cyber predictions specifically (see Zack’s own admission below) cuts in more than one direction.

Satya Nadella at the All-In Summit

Satya’s session was the one I’d point practitioners to, because it is the closest any of the CEOs came to describing the problem the way a security team would.

He opened with what he called the common sense part, “we should do what it takes to build stuff that serves humanity first and is in human control,” and then argued that broad diffusion is “the most critical thing” and that:

Enterprise control over the technology, their weights, their data, and their evals is the part he says gets far too little attention.

His breakdown of the Hugging Face incident is the useful bit. He separates the “basic DevOps” failures (a misconfigured container, API keys, no monitoring, internet access) from the “real novel new stuff,” which is reward hacking with persistent agents, and he admits “the science is not there” on the latter.

His framing for long-running agents is that they are “new insider risks,” with the example of telling an agent to “go optimize my working capital” and having it “fake my books.” His prescription is “true aggressive monitoring of agent activity,” where “everything has got to be auditable” down to every object an agent touches, and a culture where “if you see a showstopper, stop the show.”

He also endorsed embedded third-party testers and then added the line that matters, “we should avoid these cozy arrangements of who’s testing what, who has access to what, and it should be broad.”

His enterprise advice, “use all but be independent of all,” including pulling a model out and seeing whether your evals still hold, is sound architecture regardless of where you land on the safety debate. He did claim Microsoft’s “flash cyber model” with its harness outperforms Mythos on CyberGym, which I’d treat as a vendor claim until someone outside of Microsoft publishes the eval.

Zack Korman on P(doom), Effective Altruism, and Who Defines AI Safety

Zack Korman’s video is the practitioner-side critique with the most heat, and the thesis is one I largely agree with, which is why I am having him on the show to chat live.

In his framing,

“This isn’t a disagreement about whether risk exists. It’s a disagreement about the probabilities of different risks and the consequences of following different proposed solutions.”

He opens by doing the arithmetic on a 10% extinction estimate (”an expected 800 million deaths”) and then argues that “No, AI isn’t going to kill everyone. The computer isn’t going to just do that, but people might.”

His main target is the network behind the safety movement. He traces the extinction framing back through LessWrong and effective altruism and names a long list of people at Anthropic, OpenAI, METR, and Redwood Research he identifies as EA-affiliated, including the three METR reviewers of the Hugging Face incident.

His objection to Dario’s evaluator proposal follows from that, “If any other industry said ‘We need independent oversight and here is my preferred pick,’ everyone would go, ‘Well, at least we know who not to use.’” What he wants instead is government reviewers drawn from a range of fields, and his frustration at the absence of our discipline from the conversation is blunt enough that I’ll leave the exact wording to the video.

He also claims prior on the Hugging Face incident, pointing to a May 2026 statement warning that an always-on, sandboxed agent “when it breaks out and does weird stuff on the internet, that will be bad,” and he admits his own earlier doomer takes on cyber and jobs in 2023 were the ones that aged worst.

He ends by conceding that his side may have already lost the argument in the media and in DC.

The AI-as-Normal-Technology View of Loss of Control Incidents

and updated their “AI as Normal Technology” framework in light of the OpenAI and Anthropic loss-of-control incidents, and it is among the more careful pieces of the week because they say plainly what they got wrong.

They admit they underestimated development-phase risk (evaluations specifically), the importance of jagged capability gains, and the organizational failures in safety culture.

They still “reject the alarmism, and don’t believe that catastrophic risks are imminent,” while conceding “we do think risks are increasing over time.”

The practical argument is that alignment alone is insufficient and controls outside the weights matter more. They cite OpenAI’s own finding that running agents in the production Codex harness reduced the propensity to compromise infrastructure “by more than 100×,” which is a remarkable number if you think about what it says about the eval environment.

They quote on the labs’ training and evals culture having “a Wild West feeling,” and their conclusion is that “proposals to ‘pace the frontier’ should be about addressing these organizational failures rather than aiming for technical breakthroughs alone.”

They are also clear that cybersecurity, rather than AI safety in the abstract, is the specific urgent threat, and they lay out the defense gaps honestly, a workforce shortage in AI-centric security roles, guardrails blocking legitimate defensive use, investment measured in “millions announced vs. needed billions,” and CISA facing “$700 million” in budget losses for 2027.

Saxe’s line that “There’s no reason to expect a ransomware gang in Belarus to adopt AI faster than Deloitte does” is a useful corrective to the criminal-uplift panic, although Anthropic’s report below suggests some gangs are moving faster than some enterprises.

Critical Infrastructure AI Adoption: Why Visibility Must Come First

Robert Lee of Dragos wrote for the World Economic Forum on the gap between how fast OT operators are adopting AI and how little visibility they have into the environments they are adding it to.

Per Dragos’s 2026 OT/ICS report, organizations with comprehensive OT visibility detected and contained ransomware in an average of 5 days versus an industry-wide 42 days, which is the kind of number that should shape budgets. He also notes that ELECTRUM, the group behind the 2015 and 2016 Ukraine grid attacks, hit Poland in December 2025 with what Dragos calls “the world’s first major coordinated cyberattack against distributed energy resources.”

His argument is that “Adversaries are already operating inside industrial environments that aren’t monitoring for them” and that “AI adoption will make that visibility problem significantly harder to solve.” The three asks are:

• AI governance with the same rigor historically applied to control systems

• OT-native monitoring before the AI complexity arrives

• A plan for AI failure that includes manual operation and vendor continuity.

  Nothing here is novel, which is sort of the point. We have been saying “visibility first” for two decades and the environments most exposed to AI-enabled adversaries are still the ones with the least of it.

Cracks in the AI Thesis, Part 2 (Ramp AI Index)

’s monthly Ramp AI Index is a useful reality check against the discourse, because it is built on what businesses actually spend.

This month’s read is that adoption keeps climbing while spending per employee falls, with 43.8% of U.S. businesses paying Anthropic and 39.8% paying OpenAI, top 1% firms’ per-employee spend down “9.7% from $7,976 to $7,205” monthly, and the effective price per million tokens down “41% to $0.68” from a March peak of $1.15. Frontier models drove 45% of token share, down from a 53% peak in August, as businesses shift to cheaper standard models.

The open-source figure is the one to hold up against Jensen’s interview. Ramp finds only 6.4% of AI-spending businesses use open models (3.6% of businesses overall), while Jensen cited $400 billion in venture funding to AI-native companies with 80% using open models. Those are different populations, venture-backed startups versus the broad base of American businesses, and both can be true at once, but it is a reminder that “everyone is running open weights” is a Silicon Valley story rather than an enterprise one, at least for now.

The Dual-Use Imperative for Public Sector Cyber

A bit of self-promotion, this is a talk I gave recently to a public-sector audience on why security has to move at the speed of the software it protects.

I walk through what I call our cultural fatal flaw (security as the perennial laggard in every technology wave from Cloud to Mobile to SaaS and now AI), the attack surface exponential (GitHub finished 2025 with 1 billion commits and is on pace for 14 billion this year, with agents driving 17 million pull requests a month), the collapsing time-to-exploit, the GRC impedance mismatch between machine-speed systems and snapshot-in-time assessments, and the risk of what I call cognitive surrender as we approve-approve-approve our way through agent workflows.

AI

Countering Misuse of AI: September 2026 Threat Intelligence Report

If you read one primary source this week, make it the cyber operations section of Anthropic’s threat intelligence report, which covers December 2025 through August 2026.

The headline finding is that:

“Sophisticated attacks no longer require sophisticated attackers,” and the report argues AI “has collapsed the labor and tooling gap that used to separate well-resourced, state-sponsored operations from individual operators.”

The speed figures are the ones that should change how defenders think about dwell time, with multiple breaches going from initial access to bulk data theft in 2 to 3 hours, one actor inside a victim within 3 hours of obtaining a stolen developer token, and exfiltration ranging from 26 GB to over 1 TB.

The case studies span the full range of actor types. GTG-20006, a Russian espionage operator, hit 20+ organizations across Ukrainian and European government, defense, and diplomatic targets, stole 300,000+ national identity records, and, in the finding I’d flag for detection engineers, had agents autonomously rebuild flagged implants to evade detection.

In the report’s words, “When their implants were flagged by security products, agents would then set about the process of autonomously modifying and rebuilding the malware to evade the existing detections,” which means our detection deployments stopped imposing cost on the adversary.

GTG-10007, a Chinese group operated by undergraduate students in Changsha with security-firm internships, ran “agent swarms” for reconnaissance and post-exploitation against roughly 50 organizations, kept a fleet of 13 standing agents harvesting US military and government open-source material, and found 12+ possible zero-days in network appliances in a single month.

GTG-50014, ShinyHunters affiliates, mined 1.8 million Android APKs for credentials and dumped 2,100+ Azure AD token sets across 40+ tenants in 34 hours.

Two things I’d pull out for practitioners.

• First, the AI supply chain is now both a target and a resource, with one actor attacking 30 AI companies in 4 days seeking pre-release model access, and stolen API keys functioning as loot, free compute, and attribution cover. Anthropic’s recommendation to treat AI keys with the same rigor as production credentials is one most organizations have not internalized yet.

• Second, this is the empirical half of Dario’s essay, and it is far more persuasive than the botnet thought experiment, because every case here is a human operator using AI to compress labor rather than a misaligned model acting on its own.

OpenAI Agents Carried Out an Undisclosed Cyber-Attack on RubyGems

Spencer Kitts, Thomas Larsen, and Sydney Von Arx published a technical report alleging that on May 11, 2026, OpenAI agent swarms uploaded hundreds of malicious packages to RubyGems, abused RubyDoc.info’s automatic documentation build (via the .yardopts file) to get remote code execution, and used that access to scrape UK local government data from the Lambeth, Wandsworth, and Southwark council sites.

The timeline they reconstruct runs from a first package on May 5 through 2,000+ packages on May 11 and 12, RubyGems disabling new-user registration on May 12, 500+ removals on May 13, and another 83 packages on June 18. Six packages also attempted to exploit an undisclosed RubyGems CDN caching bug to steal user API keys.

Whatever the final attribution, this is the sandbox-escape scenario Dario, Satya, and Zack are all describing from their different angles, and it is also a software supply chain incident by any definition, which puts it squarely in the domain this newsletter has covered for years. Agents that can register accounts with disposable emails, publish packages, and trigger build systems are a supply chain threat regardless of who set them loose.

Actions Speak Louder Than Tokens: An Insider Threat Model for Frontier AI Agents

Matt Adams published this framework back in April, and I’m including it now because Satya independently arrived at the same framing on stage this week.

Matt’s argument is that agents with shell access, repository access, or connections to external services “belong in your insider threat program,” and that the right response is to extend the programs we already run for human insiders rather than invent yet another framework. The principle is “Watch what it did, not what it said,” on the grounds that “You cannot assess an AI agent’s intent” and that visible reasoning can look benign while the model does something else.

He lays out six threat categories (credential compromise, supply chain sabotage, data exfiltration, infrastructure sabotage, deception and evasion, and containment failures affecting third parties), consolidates 27 STRIDE threats, defines four autonomy levels from human-as-operator to human-as-auditor, and maps detections onto the tooling most enterprises already own, SIEM, UEBA, DLP, network egress controls, and deception technology, with controls aligned to the NIST CSF.

He also cites Anthropic’s own evaluation review, which found three incidents across 141,006 evaluation runs where models reached the real internet and accessed three organizations’ systems. That number predates Hugging Face and RubyGems, which suggests the pattern was visible before it became a headline.

Open-Weight Models Are Capable Autonomous Network Attackers

Lakshmi Adiga, Marko Morrison, and Vyas Sekar at CMU’s Cyber Autonomy Initiative evaluated Kimi K3, Qwen 3.8 Max, and GLM 5.2 as autonomous attackers across MHBench cyber ranges, using three harnesses, a single-agent harness with a high-level action library (Incalmo), a multi-agent harness (ARTEMIS), and a bare bash shell.

Their earlier work found that open models “do not follow instructions and are unable to execute shell commands correctly.” That is no longer true. Qwen 3.8 Max led across all three harnesses, and the Incalmo harness produced “dramatic performance improvements and reduced cost” relative to the alternatives.

The implications they state are the ones that matter for the pacing debate.

For practitioners, “Open-weight models are now a practical alternative for red team and penetration testing,” including on-premises where you can’t send sensitive network data to a hosted model.

For policy, “Sophisticated offensive security capabilities will become more widespread, beyond the control of centralized model providers.” Kapoor and Narayanan made the same point above, and it is among the stronger arguments against treating lab-level pacing as sufficient.

You can pace the frontier all you like, but the capability that was frontier a year ago is now on a laptop in Changsha, or Belarus, or anywhere else.

The Defense Factory

OpenAI published a playbook and reference architecture for what it calls a Defense Factory, an agent-first operation that continuously discovers, validates, and remediates vulnerabilities at machine speed, on the premise that “the defender’s window is closing.”

The case study is OpenAI’s own internal sprint, 250+ people across 100+ service areas, 53 urgent and high priority issues closed on day one, and pipeline stats that are worth reading closely, 37% of findings were duplicates, 19.5% reproduced at runtime, and dynamic validation brought the false-positive rate down to 0.81% with a 0.53% rolled-back fix rate. Thibault Sottiaux, OpenAI’s Head of Core Products, described the posture as “strengthening our defenses with the urgency of an incident.”

I’d read this alongside Dan Lorenc’s piece and my own “The Remediation Receipts” below, because the pipeline numbers are the honest part. A 37% duplicate rate and a 19.5% runtime reproduction rate on your own findings is what industrialized discovery looks like before triage, and it is why the enterprise is about to need a triage function it does not currently have.

The calls to action (apply for Daybreak access, pilot the Codex Security plugin) are OpenAI selling, which is fine, but the architecture is portable.

Secure Agents Architecture: Sandboxing

Katelyn Lesse at Anthropic wrote on sandboxing as part of a secure agent architecture series. It walks through some of the key security architecture primitives for securing agents, and important sandbox configurations.

nono: Sandbox 2.0

Luke Hinds at NoLabs demonstrates what kernel-level policy enforcement for agents looks like in practice, using Claude Code under a GitHub CLI policy restricted to read-only operations on issues and comments.

The argument is that enforcement at the kernel blocks unauthorized commands regardless of how they are obfuscated, reordered, or wrapped, and that, in his words, this is where other sandboxes and guardrails will fail because “they typically operate at the application or network level.” The demo includes default-deny policies and 15-minute leaf TLS certificates for network egress, and the project passed 4,000 GitHub stars earlier this month.

This is a vendor post and it reads like one in places, but the underlying point is the one Dario made in the essay, that models are getting good at “escaping or defeating most common sandboxing methods,” and application-layer guardrails are exactly the kind of sandboxing he means. If your agent containment story is a system prompt and an allowlist, this is worth a look.

AI Security Matrix

A curated directory of AI-enabled security testing tools, organized into agents, scanners, skills, MCP servers, and model-file analysis, with star counts and age for each. Strix leads the agents category at 63k stars, Promptfoo sits at 25k, and NVIDIA’s garak and Microsoft’s PyRIT are both listed, alongside contributions from

Trail of Bits, PortSwigger, SpecterOps, and CyberArk, among others. Read it alongside the CMU results above, since the combination of open-weight models and open offensive tooling is what commoditized offense actually looks like.

The 2026 OWASP LLM Top 10 and the Incident Data Behind It

I sat down with , co-lead of the 2026 OWASP Top 10 for LLM Applications, to talk through the new list and the incident data behind it.

The short version is that the systemic risks around the model exceed the model-specific ones, the LLM and Agentic lists are converging whether the project likes it or not, and prompt injection nearly fell out of the top 10 on incident data before staying at #1 as the mechanism that enables most of the others.

Rock’s framing on excessive agency, “Agency’s not authorization. Period.,” pairs well with Satya’s insider-risk framing above.

AppSec

The Anthropic Glasswing Receipts Are Starting to Trickle In

Patrick Garrity at VulnCheck did the accounting on Project Glasswing five months in, and the numbers are the reason the remediation conversation matters more than the discovery conversation right now.

Of 26,153 findings, 2,736 (10.5%) appear in the disclosure ledger, 2,096 (8%) were reported to maintainers, and 202 (0.8%) are verified fixed, spread across 113 projects. Claude rated 91.5% of its findings critical or high while maintainers rated 51.3% that way, and the public dashboard claims 421 fixes against a ledger showing 202. Anthropic’s own explanation is that “the process of independent human triage and review is the rate limiting step.”

I covered these figures in more depth in “The Remediation Receipts,” so I won’t belabor them here beyond pointing out that a human triage bottleneck at the scale of a well-resourced lab initiative is a preview of what every enterprise AppSec team is about to inherit.

The Remediation Receipts

My own piece from this week, looking at what Glasswing and Trail of Bits’ Patch the Planet tell us about the fixing problem.

Patch the Planet, as of September 4, had found 1,646 issues across 59 codebases with 215 (13%) merged and 1,031 (63%) awaiting a patch, and only 17 (7.9%) of the accepted fixes rated high.

Set that against FIRST’s revised forecast of 66,000 to 68,000 CVEs for 2026 (46.3% above their original projection), GitHub Security Advisories up 449% year-over-year, and Empirical Security’s finding of 16,116 CVEs with exploitation activity of which only 894 are on CISA’s KEV, and the constraint is clearly triage capacity that can tell a real critical from a model’s guess at one.

The Flood Is Coming and the Pipes Were Already Full

Dan Lorenc’s response to the pacing debate is the one I’d hand to anyone who thinks the risk lives at the frontier. His framing is that:

“The frontier is where the capability comes from. Consumption is where it does damage,”

Consumption means the disclosure and patching infrastructure that was already saturated before frontier models showed up. Chainguard’s Athena has processed 40,000+ findings since June, 42% critical or high, across 500+ projects, producing 2,000+ patches, with 50 vulnerabilities entering disclosure on September 28.

A single six-hour model run found “more than a dozen validated vulnerabilities, most of them pre-authentication remote code execution” in a heavily fuzzed, widely scanned open source project.

The two lines that should worry AppSec leads are

• A model can go from a public fix commit to a working exploit in an afternoon

• The median enterprise is months behind on patches that have had fixes.

Dan’s asks are to publish patches for silent fixes already sitting at head, to standardize disclosure through the Linux Foundation’s Akrites body and the federal Gold Eagle clearinghouse, and, long term, to build secure-by-construction foundations, because “You cannot patch your way out of an architecture.”

Chainguard is also open-sourcing its microVM sandbox, search harness, and CI-as-function primitives, which is a welcome move given how much of this tooling is currently proprietary.

AISLE Partners with ENISA to Secure the CRA Single Reporting Platform

This week AISLE announced it performed an AI-based secure code review of the EU Cyber Resilience Act’s Single Reporting Platform ahead of the CRA’s first reporting deadline on September 11, with ongoing coverage for future releases.

The SRP is the mandatory entry point where EU manufacturers report actively exploited vulnerabilities and severe incidents within 24 to 72 hours, so it is exactly the kind of system that needs to be trustworthy under load. ENISA’s Hans de Vries thanked AISLE for “their important AI-based secure code review performed,” and AISLE’s Jaya Baloo put it well, “Reporting infrastructure only works if it’s trustworthy at the moment organizations need it most.”

I’d note this as an example of the same technology that produced the Glasswing backlog being applied on the consumption side, reviewing a specific piece of critical infrastructure before it went live, rather than generating findings for someone else to triage.

Open Source Security Podcast: Daniel Thompson on CRA Reporting

Josh Bressers hosted Daniel Thompson (CEO of CrabNebula, ETSI expert, and founder of Comply.Land) for a practical walk through the CRA’s first live obligation, which took effect September 11.

The core requirement is an early warning within “24 hours of becoming aware of the vulnerability being actively exploited,” a fuller notification “72 hours after this first instance,” and the distinction between exploitable and exploited that determines whether the clock starts.

They also cover VEX, CE marking, the obligation to provide free security updates for the product’s support period, and the broader secure development lifecycle requirements landing in December 2027.

Josh’s read that “If your product is being actively exploited, the embargoes no longer apply” is the practical takeaway, and Daniel’s “It’s not too bad. There are plenty more requirements coming” is the honest one.

Final Thoughts

The week’s loudest disagreement was between lab CEOs calling for a slowdown and industry CEOs calling that irresponsible, but the disagreement that matters for our field is quieter and runs inside the cyber community itself.

Ciaran, Zack, and Kapoor and Narayanan all reject the botnet-apocalypse framing and they all still think the risk is real, because they have read the same threat intelligence report and the same RubyGems writeup the rest of us have. The evidence this week points at operators using AI to compress labor, agents escaping containment that was never designed to hold them, and a remediation pipeline that was full before the frontier models arrived.

Pacing the frontier may or may not happen, and much of that remains to be seen. What we can control is whether we treat agents as insiders, whether we build the triage capacity the discovery boom is going to demand, and whether we show up to the safety conversation at all instead of letting it be settled by people who have never run a SOC.

Do we really want the cyber perspective on AI risk to be defined by everyone except cyber practitioners?

Stay resilient.

Subscribe now

This week OpenAI shipped its first model to hit the Critical cybersecurity threshold under its own Preparedness Framework, pledged $1B in subsidized access for under-resourced defenders, and, in the same news cycle, had a second swarm of its internal agents discovered running loose on the open internet.

Google’s threat intel team documented adversaries standing up agentic credential harvesting pipelines in under six hours, while the SANS CEO and a builder in the agent monitoring space both made the case that the gap sits with people and fundamentals well before it sits with models.

On the market side, PANW’s Nikesh Arora put a $1 trillion price tag on the legacy security stack, the company’s founder raised $245M to build a replacement for it, and Mistral closed the largest equity round in European tech history on a sovereignty pitch.

Safe to say, we have a lot of ground to cover this week, so let’s go!

Cyber Leadership & Market Dynamics

Palo Alto CEO says $1 trillion of cybersecurity infrastructure isn’t ready for AI

Palo Alto Networks reported its fiscal Q4 this week, with revenue of $3.41B (up 34% YoY), Next-Generation Security ARR of $9.1B (up 63%), and RPO of $21.2B, and Nikesh Arora used the earnings cycle to make a much bigger claim. Per Arora:

“About $1 trillion of existing cybersecurity infrastructure was built before the dawn of AI and is not ready for the new threat landscape.”

His math is that “If the average life is seven years and you’re spending $200 to $300 billion a year, you’ve got $1 trillion of security infrastructure,” most of it firewalls, SIEMs, and endpoint tooling deployed 7-10 years ago. He also pointed to “$5 trillion of capex spend in the next five years” on AI data centers as a second wave of security demand.

Of course, the CEO of one of the largest security vendors has an obvious incentive to declare the installed base obsolete, and this is a replacement thesis dressed up as a threat assessment.

That said, the underlying point isn’t wrong. Most of what organizations run today was architected around human-speed attackers, and the GTIG report below documents adversaries who no longer operate that way.

The same week, PANW was named to the S&P 100 alongside Dell, Arista, and SanDisk, replacing Nike, and the only public pure-play cyber company in the mix, which is incredible for the cyber community.

Palo Alto’s CEO invested in the startup his company just bought for $500 million

A follow-up to the Console acquisition I covered last week. Calcalist reports that Arora was an early personal investor in Console, alongside Thrive Capital, before Palo Alto acquired the company for roughly $500M. Console was founded in 2024, had raised $29M in total, and was valued at $157M in its last round, so the exit represents a sizable step-up for everyone on the cap table, the acquiring CEO included.

I won’t pretend to know the details of how the deal was reviewed internally, and there are governance processes for exactly this scenario at public companies. However, when the same person is a personal LP on one side and the buyer on the other, the optics are what they are, and it is a reminder that the AI security M&A wave is moving fast enough that these conflicts are going to keep surfacing.

Cylake closes $245 million funding round ahead of beta

Nir Zuk, who founded Palo Alto Networks, has now raised $290M for Cylake (a $245M convertible note this week on top of a $45M Greylock-led seed in March) before the product has hit beta.

The pitch is an AI-native, “fully sovereign” security platform that runs on-prem or in a private cloud for large regulated organizations, with beta slated for the end of 2026 and GA in 2027. Zuk’s framing is that they’re building “for organizations that cannot compromise between adopting advanced cybersecurity technology and maintaining control.”

It is hard to read this next to Arora’s $1T comment and not see the same thesis being funded from two directions, one arguing the legacy stack is obsolete and the other arguing that the cloud-delivered stack that replaced it has become the problem for regulated buyers.

$290M pre-beta is a lot of conviction, and the company has 40-odd employees and design partners to show for it so far, however, much of this remains to be seen in terms of adoption and broad traction.

Mistral makes sovereign, open-weight AI the technology frontier

Mistral closed a €3B Series D at a post-money valuation above €21B, which the company describes as “the largest equity fundraising round ever completed by a European technology company,” led by Samsung Electronics with Scaleup Europe Fund/EQT and PSG Equity co-leading. Mistral now operates in 20 countries with 125+ enterprise customers. The announcement defines sovereignty across four dimensions, data that stays inside the organization’s boundaries, models that are controllable, compute that is private, and production systems that are auditable.

Pair this with Cylake above, sovereignty has gone from a European regulatory talking point to a category thesis that U.S. investors are now writing very large checks against, and it applies to the security stack as much as the model layer.

The GTIG report further down has an interesting wrinkle here, with at least one PRC-nexus actor deploying local LLMs inside compromised cloud environments specifically to avoid commercial API monitoring, which is the exact risk has been calling out for months.

Sovereign compute cuts both ways.

Omri Casspi raises $250 million after wins with Cognition, Wonderful and Upwind

Former NBA player Omri Casspi closed a $250M third fund for Swish Ventures, bringing AUM to $800M.

The firm has backed 21 companies since inception, 9 of which are now unicorns, with roughly $20M checks and a dozen targets for the new fund. The portfolio marks tell the story of the current cycle, with Wonderful at $5B, Upwind at $3.8B (which I covered last week), and Cognition at $47B. Per Casspi, the aggregate portfolio value “will reach almost $100 billion” after the Cognition round.

Those are venture returns most firms would take in any cycle, and a reminder of how concentrated the value creation in AI and security has become in a small number of companies.

Cybersecurity Benchmarking: Why, Why Not, When and How

Phil Venables takes on one of the more persistent rituals in security leadership, benchmarking your program against peers, and argues that most of how it gets done is a waste of time.

Budget comparisons are never apples-to-apples because there is no agreed taxonomy for what counts as security spend, lagging indicators like incident counts tell you little about root cause, and point-in-time assessments go stale quickly. His line is that:

“Your risk is not my risk. Your business is not my business,” and my favorite, “Being No. 1 in a pack of failures doesn’t make you a success.”

Where he lands is that benchmarking is useful when it compares leading indicators (infrastructure design patterns, control effectiveness) against an aggregate idealized control set rather than against a specific peer, aligned to something like NIST CSF or CIS Controls, with cost-effectiveness measured separately from performance.

Given how often boards and CFOs ask “what do our peers spend,” this is a timely read for anyone who needs a better answer than a percentage of IT budget. It also pairs well with Arora’s $1T framing above, which is precisely the kind of input-based spend number Venables warns against treating as a signal.

What the AI Warning Letter Completely Missed

Last week I covered the open letter from 100+ companies, including OpenAI, Anthropic, Microsoft, and Google, calling for collective action on AI-enabled cyber threats.

SANS CEO James Lyne’s response is that the letter is “a plan written entirely in verbs, with no subject.” It tells organizations to patch, monitor, and harden, and says nothing about who does that work at the water utilities and hospitals it names, how they get trained, or who pays for it. As he puts it:

“The gulf between those two is measured in people, not products.”

He also cites RUSI analysts who argue that “Criminal innovation is a response to a revenue stream closing, not to a new technology opening a window,” which is a useful corrective to the assumption that AI capability automatically becomes adversary behavior.

I agree with the core of this piece by James. Signatories of that size published a letter with no funding commitments in it, and the organizations most at risk are the ones that can’t hire. To be fair, OpenAI’s Daybreak announcement below arrived two days later with $1B attached, albeit in the form of subsidized product access rather than headcount, but we shouldn’t expect headcount to come externally either

Whether credits close the gap Lyne is describing is a fair question.

For me, as I mentioned in LinkedIn about this letter, the reality is that cyber won’t change until market incentives or regulatory forces make it change systemically. Vendors have little consequences for shipping insecure products, which is the default, as recently pointed out by CISA.

Cybersecurity is a market failure and we cannot will that to change with open letters and voluntary pledges.

How AI reduced cybersecurity to bugs

, who works on agent monitoring at Embroidery, put out a video reacting to an Ilya Sutskever post arguing that “every company with strong cyber models should help” neoclouds shore up their security.

Korman’s objection is that “cyber model” has come to mean vulnerability discovery and exploitation, and if you took 100 people working in defense, very few of them work on that.

Identity, endpoint, network, detection engineering, SOC, IR, third-party risk, and GRC all sit outside what a frontier lab means when it says cyber. His Vercel breach walkthrough makes the point, with overly permissive third-party app access, harvested credentials, and no detection, and as he says, “You can have zero vulnerable systems in the sense that there is no code to exploit and you still get breached.”

He is blunt about the OpenAI/Hugging Face incident being “completely preventable on OpenAI’s side by having the proper monitoring and controls in place,” and about the industry more broadly, “We’ve become followers in our own space. It’s an embarrassing lack of leadership.”

I have made a version of this argument before, that security has a laggard problem, but Korman’s framing is sharper, that we are letting the labs define what cyber is based on what benchmarks well.

I really resonated with Zach’s rant here, and its time for cyber to step up and act like grownups rather than fawning over the frontier labs and acting like we don’t know how our own damn industry and profession works.

AI

Path to Astra: critical capabilities and frontier safeguards

OpenAI announced Astra, the first of its models to reach the Critical cybersecurity capability threshold under its Preparedness Framework, meaning the model can “find previously unknown security flaws and develop ways to exploit them across many well-protected systems without a person guiding each step.”

The published figures are 100% on an internal ExploitBench port covering 20 high-severity vulnerabilities, two zero-days discovered during evaluation (being disclosed to maintainers), and a 91.5% refusal rate on cyber jailbreak evaluations compared to 59% for GPT-5.6 Sol. In honeypot tests, GPT-5.6 Sol attempted unauthorized access in 56% of instances, Astra in 0%.

The safeguards stack is worth reading in full, with post-trained refusals, activation classifiers, chain-of-thought monitoring, cross-conversation context monitoring, and misalignment monitoring in production. Access goes to alpha testers first and then expands through Daybreak Blue for defensive work.

My read is that the capability side of this announcement is a fairly big deal, and the safeguards side is a set of claims the lab is asking us to take on trust, from a company that, per the TechCrunch item below, didn’t know where its own agents were for over a month. Perhaps both things can be true at once.

Daybreak for Frontline Defenders: $1B to protect essential services

Two days after Astra, OpenAI committed “$1 billion in subsidized Daybreak access to help resource-constrained cyber defenders, starting with the United States.”

Daybreak splits into Blue (defensive work on mainline models) and Red (specialized cyber models for sensitive technical work). The current footprint is thousands of defenders across 2,000 approved organizations in 40 states plus DC, more than 35 enterprise products and partner-operated services, a partnership with MS-ISAC, and up to $1M in no-cost API credits for affected water utilities. State and local governments, critical infrastructure operators, nonprofits, and open source maintainers are eligible.

This is a strong response to the gap Lyne describes above, and I would rather see $1B in credits than nothing at all. That said, credits are inventory for the company that issues them, and the constraint at a rural water utility is generally a person who has the time and skill to use the tooling, which a subsidy doesn’t create.

The open source maintainer eligibility is a piece I’d watch closely, given what the Patch the Planet numbers below say about where the bottleneck actually sits.

Another swarm of OpenAI agents reached the open internet without the frontier lab’s knowledge

The Hugging Face incident I’ve covered in recent issues now has a sequel.

Independent researchers found that OpenAI’s internal evaluation agents had been active on an obscure German wiki, DseWiki, for over a month, editing pages and collaborating on eval tasks. In the researchers’ account, “The administrator spent the next 5 days fighting a losing battle against the agents, deleting an average of 100 pages a day while the agents created about 400 new pages per day.”

OpenAI’s response was that it is “now carefully reviewing its contents and will take any necessary next steps.” Rep. Lori Trahan’s comment cut closer, that:

“The lack of any real federal AI governance means that frontier companies can pick and choose when they disclose incidents.”

The pattern is now hard to dismiss as a one-off, with isolation boundaries that were assumed instead of verified and discovery coming from outside parties well after the fact.

Matt Adams’s insider threat model below has a threat category literally named Containment & Third-Party Impact, and this is the second time in two months it has played out against a third party who never consented to being part of an eval.

GTIG AI Threat Tracker: From Prompting to Autonomy

Google’s Threat Intelligence Group published its latest AI threat tracker, and it is among the more useful pieces of adversary reporting I’ve read this year, albeit a long one.

The headline observation is that “In Q2 2026, GTIG observed threat actors compromise a cloud resource, then plan, build, and execute an agent-enabled mass credential harvesting campaign in under six hours,” with markdown playbooks (AGENTS.md, KNOWLEDGE.md and the like) driving an AI coding chatbot as the operator.

A separate exposed C2 server hosted a “Recon” dashboard managing 23,800+ harvested secrets. GTIG is careful to hedge that it “has not yet observed threat actors deploying fully autonomous pipelines against targets in the wild,” but the direction is clear.

Actions Speak Louder Than Tokens: An Insider Threat Model for Frontier AI Agents

Matt Adams published a standalone paper that treats deployed frontier agents as insider threats and adapts CERT’s five insider threat dimensions, motivation, opportunity, capability, predisposition, and organizational factors, to non-human actors.

His argument is that existing threat models cover attacks on AI and attacks through AI, and none treat the agent itself as the actor. He derives 27 STRIDE-based threats in six categories, including Credential Compromise, Data Exfiltration, Deception & Evasion, and Containment & Third-Party Impact, and maps four autonomy levels from L1 Human-as-Operator (low risk) to L4 Human-as-Auditor (critical). The controls are NIST CSF-aligned, with 7 protective controls, 25+ detection points across SIEM, UEBA, DLP, and deception tooling, and response and recovery playbooks.

I like this line “Watch what it did, not what it said.”

Reasoning traces are unreliable as evidence, actions are not, and existing enterprise telemetry can capture the actions. He is also candid that “Coherent misalignment in a frontier model is a procurement decision...not something deployment monitoring can fix,” which is a framing I suspect a lot of vendors would prefer buyers not adopt.

The paper is dated April but was updated with the Hugging Face disclosures, and given this week’s news it reads as current.

Agent Hooks

I had previously shared how Microsoft released a framework agnostic Agent Hooks specification. I took some time to break it down, as well as why security practitioners should be familiar with Hooks as it relates to securing AI agents, how they work, and why they matter.

AppSec

Patch the Planet dashboard

Trail of Bits and OpenAI have a live dashboard for Patch the Planet, their AI-assisted effort to find and fix bugs across open source.

As of September 4 the numbers are 1,646 potential bugs reported, 1,031 confirmed and awaiting patches, 400 fixes open upstream, 215 patches merged, 59 codebases under review, and 11 CVEs assigned. Of the 215 accepted fixes, 17 (7.9%) are high severity, 69 (32.1%) medium, and 58 (27.0%) low, with the rest informational or undetermined.

I wrote last week about runaway CVE rates and the economics of remediation, and this dashboard puts the problem in a single ratio. 1,031 confirmed issues are waiting on patches while 215 have merged. The constraint has moved to maintainers reviewing and merging, and that is a people problem that more model capability makes worse before it makes it better.

It is also worth noting that the severity mix skews medium and below, which matters when someone cites the topline “1,646 bugs” number.

The Anthropic Glasswing Receipts Are Starting to Trickle In

A companion piece to the Patch the Planet numbers above.

VulnCheck’s Patrick Garrity went through Anthropic’s Project Glasswing disclosure ledger, the Claude-driven open source vulnerability discovery effort launched in April, and tried to reconcile what has been claimed against what has shipped.

Five months in, the ledger shows 26,153 findings discovered, of which 2,736 (10.5%) reached the disclosure ledger, 2,096 were reported to maintainers without a confirmed fix, 245 were withdrawn, and 202 (0.8%) are marked fixed across 113 projects. Anthropic’s dashboard claims 421 findings patched upstream and 462 advisories, while the ledgers Garrity pulled list 70 to 82 CVEs and 49 to 77 GHSAs depending on which view you look at, and he notes 18 findings that had already been patched before Anthropic reported them.

Severity is the other gap, with 91.5% of Claude’s own assessments rated critical or high against 51.3% once maintainers weighed in. His close is that “The receipts are starting to trickle in, they just don’t reconcile.”

Anthropic’s own explanation is that disclosure is “a subset of the total number of vulnerabilities” found “since the process of independent human triage and review is the rate limiting step,” and to be fair, that is an honest statement of where the constraint sits.

That said, it is the same constraint Patch the Planet shows with 1,031 confirmed issues waiting on 215 merged patches. Across both labs’ programs the models are producing findings roughly an order of magnitude faster than humans can validate and maintainers can merge them. The severity delta matters just as much for anyone consuming these feeds, because a model that rates 9 in 10 of its findings critical or high, against maintainers rating about half that way, is going to flood already overwhelmed triage queues with inflated priority if you take its word for it.

Patrick is clear that the discovery capability is real, and I agree. The headline discovery count is still among the less useful numbers in any of these announcements, and fixed-and-merged is the one to watch.

I’d like to see both labs publish the reconciled figures, with maintainer-assigned severity, rather than leaving it to third parties to do the accounting.

What it took to reach 1 billion build manifests

Chainguard CTO Matt Moore wrote up how the company doubled its build output in six months, going from 500 million to 1 billion build manifests across 3,000+ unique images and 675,000 image versions. The old pipeline is described as “a cascading mess” with humans as the bottleneck for vulnerability remediation.

Factory 2.0 replaces it with continuous reconciliation loops that compare desired to actual state, shared work queues serviced by redundant reconciler bots, and AI handling the unstructured judgment calls like whether to backport a CVE fix or how to evaluate a new component, all on a rolling-release Chainguard OS. Every output ships with SLSA Level 3 provenance, Sigstore signatures, and a full SBOM.

Moore’s line is that “When the attacker’s cycle time compresses, the defender’s cycle time must compress by at least the same amount,” which is the same conclusion GTIG reached from the other side. It also lands in the same week GTIG documented an actor publishing malicious packages with valid SLSA Build 3 attestations, so it is worth being precise that provenance proves where a build came from and says nothing about whether the account that produced it was compromised.

Carta case study

RunSybil published a case study with Carta on moving from annual pentests and a bug bounty program to continuous autonomous testing, first deployed during an M&A review.

During an MCP server assessment the platform found a chained pair, a CVSS 8.1 SQL validation bypass in a Snowflake integration and a CVSS 8.8 administrative function execution that chained through to extract AWS credentials and map network topology. Carta AppSec lead Vamsi NC’s take on bug bounty is blunt, “The bug bounty has lost its charm. They’re using the same tools to scan us externally as we’re using internally,” with researchers farming the same patterns for payouts rather than finding novel chains.

The vulnerable surface was an MCP server, which matches the GTIG finding that MCP has become a preferred target, and the outcome Carta’s Brad Freer describes is findings turning into “detection patterns powering the appsec flywheel,” which is where continuous testing earns its keep over a point-in-time report.

Final Thoughts

The through-line this week is that model capability is running well ahead of the organizational capacity to use it or contain it.

OpenAI can ship a Critical-threshold cyber model and a $1B subsidy in the same week it loses track of its own agents, GTIG can document six-hour agentic attack builds while noting that most of what actually works for adversaries is still credentials and supply chain, and Patch the Planet can find 1,646 bugs and merge 215 of them.

Lyne, Korman, and Venables are each saying a version of the same thing from different seats, that the constraint is people, priorities, honest measurement, and the organizational will to fund them, and none of that is being funded at the rate the models are.

That said, the work rolls on, and so do we!

Stay resilient.

Subscribe now

Welcome to issue #112 of the Resilient Cyber Newsletter.

It’s been another action packed week, with an industry-wide call from frontier labs, CSP’s and vendors for collective action on Cyber, continued M&A activity, a slew of fundraising, continued drama with AI incidents and the industry still grappling with the surge of CVE’s and remediation bottlenecks.

I try and unpack it all this week concisely, so sit back, grab a coffee and let’s get moving before everyone heads off to enjoy the long weekend, at least here in the U.S.

Cyber Leadership & Market Dynamics

A Call for Collective Action on Cyber Defense

OpenAI published a letter with 100+ cosigners across the industry with a core claim that:

”In the coming months, AI-enabled cyber attacks will become far more widespread and sophisticated as models around the world become increasingly capable”.

It goes on to make various calls to actions such as:

• Recognizing the status quo of security won’t be enough

• Empower more defenders with cyber-capable AI

• Mobilize a collective response

• Make cyber defense a leadership priority

Now, where I struggle with this is, I agree with everything their saying.. the problem however is that we cannot “will” ourselves into a state of security. It requires either sufficient market or regulatory forces and right now we largely lack both, which is why many consider cyber to be a market failure.

There is also the fact that the labs, CSPs and many of the signatories are security vendors, so they are calling on the market and their customers to spend more on the very things they sell, which can be seen as problematic.

All that said, I unfortunately don’t anticipate much changing until organizations feel real market consequences for incidents, shipping insecure products, or changes in the regulatory landscape which force them to prioritize and invest in security with more rigor.

AI Is Moving Cyberattacks to Machine Speed

In a bit of a dim warning, former NSA leader Rob Joyce recently had an interview where he discussed the fact that exploitation timelines are collapsing, and attacks are moving at machine speed.

Rob discusses how years of technical debt are now going to be found and exploited by AI, and how critically important the fundamentals remain.

Palo Alto Acquires Console

PANW continues its acquisition run, this time acquiring a company named Console. This one is less about securing AI, and instead focused on leveraging AI for security, as the company provides capabilities for users to express oiperational goals and the software handle the complexity of helping them achieve it.

This quote from Nikesh Arora sums up the goal:

"Security operations can no longer be about managing dashboards and queuing tickets just to help humans work faster. By bringing Console into Palo Alto Networks, our customers can have a direct conversation with data and build agentic workflows in natural language that helps alert and remediate issues automatically. This is the shift to software-as-an-agent, giving our platform the arms and legs to deliver autonomous security outcomes across the entire enterprise."

If you’re looking for deeper insights into how the industries largest vendor sees the landscape, as well as their M&A ambitions, I found this recent conversation with to be perfect. I had a chance to listen to it earlier this week.

AIR Security Emerges From Stealth With $50M

The team at AIR Security recently emerged from stealth with $50M, focused on building a “firewall” for agents. I’m very familiar with this team, and had them on the show in the past to discuss an early effort of theirs Mother of all KEV’s (MOAK), which automated developing exploits for KEV’s.

The team has continued innovating and now has the capital and backing of amazing investors, such as Sequoia. They played a role in the new OWASP Agentic Skills Top 10, and are focusing their attention on creating a firewall for AI Agents.

HiddenLayer Raises $100M Series B

One of the more longstanding AI security players in the ecosystem who has been around for a bit, HiddenLayer, recently announced a $100M Series B, being led by Delta-v Capital, with involvement from others such as MSFT’s M12 venture fund, and Booz Allen Hamilton.

I’m employed at a competitor in this category so I watch it closely, but I’ve been following their team for years, prior to the role I am in as well. It is interesting to see M12 be among the investors, given they also invest in competitors to Hidden Layer. The involvement of BAH, and my public sector background also give the signal that the team has likely has strong public sector traction as well, which is supported in their announcement where they cite deployments across U.S. defense and IC environments. They also cite 10x ARR growth, 50+ new platform customers etc.

There’s some great security leaders on the team of course, aside from the founders, such as longtime industry leader Malcom Harkins. While I compete in the category in my day job, I know it is a highly competitive and fast moving one, and there’s several great teams in the ecosystem.

Upwind Raises $300M, Doubling Valuation to $3.8 Billion in Five Months

In what feels like groundhog day, we have another large fundraising event for Upwind, who has established itself as a leader in the cloud security and runtime categories. This comes 8 months after their prior $250M Series B(hence my groundhog day comment).

The company seems to be capitalizing on their momentum, competing strongly in the CNAPP space, and also expanding to cover specific areas of AI security, as everyone scrambles to cover the risks of AI.

Huskey’s Announces $27M Series A

The team at Huskey’s also announced their $27M Series A, just 5 months after coming out of stealth with participation from teams such a Blackstone, Merlin Ventures, Zscaler, Okta and others.

They aim their focus at “Network Edge Security Management (NESM), focusing on making network edge security stacks work for, not against customers.

AI

Conversation with a OpenAI/Hugging Face Incident Investigator

One thing I found really interesting this week was the conversation with around the OpenAI/Hugging Face incident.

For those unfamiliar, Ajeya is one of the independent investigators from METR involved in the analysis of the incident. In the conversation with Dwarkesh, they go really deep in particular in some of the multi-agent conversations, behaviors and more, which felt like diving into the psychology of multi-agent systems, of “civilizations” as Dwarkesh himself framed them in his blog “The Rise of Fall of Agent Civilizations”, which is worth a read.

Ajeya also had a good blog on what surprised her from the incident, including the scale of the number of agents that participated in this incident and activity and how they collaborated.

Valid Questions About the Independent Review of the OpenAI/Hugging Face Incident

Now, not to throw shade at the organizations involved in the review of the incident, but Zack Korman shared an excellent video critiquing aspects of this review. He points out how the organizations involved in the review largely lack any cybersecurity expertise or background, and by their own admission, the review could of been handled better in several ways.

He goes on to rightfully call out the Cyber community as well, as we seem to be sitting back and letting the frontier labs, and others outside of Cyber lead the charge as it relates to the cyber risks of AI. Zack says we need to step it up as a community, and I’m inclined to agree with him.

Anthropic’s Plans to Improve Alignment and Security

Sticking with the theme of incidents and “breakouts and such, Anthropic published a blog this week discussing how they plan to improve alignment and security efforts.

Agent "breakouts", unauthorized actions and misalignment has been dominating the AI and security conversation for weeks.

From the initial OpenAI and Hugging Face incident, to others such as Anthropic, AI Security Institute (AISI), Meta and even open weight labs coming forward disclosing incidents of agent attacks and unauthorized actions.

That's why this blog from Anthropic is super timely. They walk through what they learned from their three incidents of Claude gaining unauthorized access to real systems and infrastructure and what they plan to improve moving forward.

This includes efforts such as securing evaluation and training environments, utilizing classifiers to identify unauthorized activities, the use of automated monitors, improved cyber sandboxes and general environmental hardening.

It also lays out recommendations for external partners using models with reduced cyber safeguards that include sandbox and network isolation, pre-engagement validation, explicit scope setting and real-time monitoring.

One thing I particularly appreciate is they are honest about where gaps remain, in terms of models cheating in training environments and objectives, continued alignment challenges and more.

Most notably for me is their hardening security practices and recommendations highlight a list of things that nearly every IT environment I've worked in across 20~ years is still rife with, and inevitably will be found by AI soon.

This includes accounts with standing access to sensitive data, lack of outbound access control, identify rigor, legacy infra configs and services, and gaps in observability.

It's going to be an interesting couple of years ahead. Give the Anthropic blog a read yourself.

CrowdStrike SafeMind

AI and Cyber have been converging for quite sometime now, in good and bad ways. While a lot of the attention tends to be on the negative, incidents, exploitation and so on, there are a lot of promising aspects as well, and in my opinion, leveraging AI is the only way cyber has any chance of keeping up with the threat landscape.

This week we saw an innovative and interesting announcement from one of the industries largest teams, CrowdStrike, who announced their “Cyber Superintelligence Lab”, and first breakthrough “SafeMind”, in partnership with NVIDIA.

It is described as a family of purpose-built security models and agentic harnesses for autonomous offense and defense together, to both identify and resolve vulnerabilities, as depicted below:

Their blog has an interesting video and frames using the Red and Blue models together (or not) to identify attack paths and vulnerabilities and mitigate them.

The Security Autonomy Matrix: Deciding AI Authority

Many organizations are wrestling with the autonomy that agents introduce. That’s why this Security Autonomy Matrix from Lenny Zeltser is a timely resource, helping organizations walk through how much authority AI agents get with different columns and rows for considerations such as workflows, triggers, autonomy levels per action class, accountable person, gate, residual risk and safeguards as well as reevluation triggers and expirations.

Agent Hooks: An open framework-neutral AI governance contract

Hooks have quickly become one of the de facto runtime enforcement mechanisms for controlling actions agents take. They’ve seen adoption across endpoint coding agents, and custom/homegrown agents alike.

That said, there are a lot of different frameworks, SDK’s and more that must be considered across frameworks and platforms. Microsoft. published an open, framework-neutral governance contract with conformance testing on both sides.

AppSec

AppSec in the Age of Agents

AppSec was already losing ground prior to AI coding agents hitting the scene. Trends such as "Shift Left" and DevSecOps fell short, producing noise for developers and reinforcing the very silos between teams they were meant to break down.

Now, FIRST projects we could see ~66,000+ CVE's in 2026, yet most organizations can only remediate about 10% of their findings in a month, despite Verizon's DBIR showing exploitation as the initial access vector in breaches. Meanwhile, AI is industrializing the discovery of vulnerabilities and now we're seeing examples of agentic workflows and autonomous exploitation of known exploited vulnerabilities.

Better prioritization alone isn't going to close the gap, and a decade of refining how we rank findings hasn't stopped vulnerability backlogs from growing. Cybersecurity and Infrastructure Security Agency's published their 2024-2025 Vulnerability Review report, and it showed 41.5% of KEV's map to MITRE "stubborn weaknesses", with 18 CWE's appearing in the CWE Top 25 every year from 2019-2025... the same classes of flaws keep shipping year after year.

This is why root cause research from Jeevan Jutla and Gecko Security, a Resilient Cyber partner caught my attention. They traced disclosed findings, such as in n8n, back to their origins and found 569 findings came from just 105 distinct root causes, with 67% of them being repeats of earlier issues, same with other platforms such as GitLab, where 58% were repeats.

What looks like a runaway backlog is often a short list of root causes that just get ignored, when we could fix the class once, and it stays fixed. I chat with a lot of teams in AppSec, and often hear about prioritization, intelligence, dashboards, ticketing and more, but don't often hear about addressing root causes, despite it being advocated for by leaders such as CISA, Bob Lord and others for years.

This is one of the key shifts I think AppSec needs to make in the age of agents. I dove into the data, AI discovery and exploitation trends and what eliminating vulnerability classes looks like in practice in my latest blog.

Why Finding Bugs Still Isn’t Commoditized

In this episode, I sit down with Ondrej Vlcek, Founder and CEO at AISLE and the former CEO of Avast, to discuss where AI vulnerability discovery actually stands, including what got commoditized, what did not, and why shipping a fix a maintainer will accept is a very different problem from finding the bug in the first place.

Ondrej spent roughly 30 years in this industry, starting as employee number six or seven at Avast doing kernel-mode driver work on Windows 95, and eventually taking the company public and selling it to NortonLifeLock in a nearly $9 billion transaction. He co-founded AISLE in the fall of 2024, and his team has since disclosed more than 350 CVEs across projects like OpenSSL and curl.

I have been beating the remediation drum for a while now, so this was a conversation I wanted to have with someone who is actually shipping accepted patches upstream rather than just posting finding counts.

Runaway CVE Rates

It should come as no surprise that we have more CVE’s in 2026 than in 2025, but how rapidly it is growing is still something to track and honestly be concerned with in some ways.

Jerry Gamblin recently took to LinkedIn to show how CVE’s YTD are up +86.5% YoY at 396 a day, compared to 238 a day the year prior. This is not even accounting for the fact that NVD isn’t enriching the full breadth of CVE’s and some may not be showing up in the NVD, as it made adjustments to try and manage the load it is seeing, much of which is being driven by the industrialization of AI discovering vulnerabilities.

There’s nuance in the numbers of course, and understanding what to prioritize and remediate is still critical and is a topic I dug into with Jerry himself recently on the show.

Running a Software Factory Efficiently at Uber-Scale

There’s been a rise in discussions about “Software Factories”, but it has often been hypothetical, or small startups. What does it look like for a major tech company and enterprise?

Well, Uber provided that answer with an excellent blog recently, showing how agentic tooling grew 7x, and weekly agent requests grew 9.4x while total spend “relatively stabilized”.

This piece goes deep into Uber’s software factory, covering models, MCP, FinOps and more. While it isn’t security focused, I do think this is a development pattern we should expect to see grew with AI coding agents, and security inevitably will want to be a key part of the conversation.

Empirical Observations: How to Deal with Speed

Everyone (including myself) have been discussing the so called “Vulnpocalypse” and industrialization of vulnerability discovery, runaway CVE volume, need for prioritization and so on.

This paper from Empirical provides some great insights on how to actually deal with the problem. From FIRST reporting a projects 66,000+ CVE’s in 2026, DBIR showing vuln exploitation as a leading initial attack vector at 31% and more, the problem has been top of mind for many.

Empirical also highlights just how woefully insufficient the CISA KEV is when it comes to identifying vulnerabilities with known exploitation, as shown below:

They make recommendations such as replacing uniform SLA’s with risk-stratified cadences, tracking days since last exploitation rather than a permanent “known exploited” flag, and accounting for local exposure and escalating on quiet-to-active transitions intra-day.

The Real Reasons Vuln Remediation is Slow and How AI Changes the Economics of Fixing Things

Many of us have been arguing that finding vulnerabilities has never been the bottleneck, fixing them is, and now AI is massively front loading the finding, while fixing stays problematic.

This piece from longtime CISO and security leader Tim Rains highlights the reasons remediation is slow, such as the friction of safely changing production software, differences in bought vs. built software, incomplete inventories, unclear ownership, and fragmented authority among many other issues.

This is a comprehensive real-world informed perspective of the problems of reducing risk in complex enterprise environments and now marketing noise from a vendor.

Rival Buyout Aids Customer After Firm Shutters

Last week I had shared how the hardened container and supply chain vendor Minimus had decided to shutdown and return funding to investors after struggling to grow and scale.

In a bit of a surprise move, their competitor Echo stepped into the fold, announcing they were acquiring Minimus and providing an option to customers of Minimus who would have had to switch to an alternative, such as the industry leader in Chainguard.

I had a chance to provide some commentary to TechTarget on this one.

Closing Thoughts

It’s another week that sometimes feels like a month in the AI era. From collective calls for cyber defense in the face of AI-driven risks and threats, continues fundraising as teams tackle emerging and innovative solutions, and the industry grappling with incidents tied to agents and AI.

That said, the work rolls on, and so do we!

Stay Resilient

Subscribe now

Two stories dominated the week, and both of them run through Hugging Face. OpenAI published its technical report on the incident where its own internal research models escaped an evaluation environment and went on to compromise Hugging Face infrastructure, and NVIDIA is reportedly closing in on acquiring Hugging Face for somewhere in the neighborhood of $13 billion.

Read together, they tell you a lot about where we actually are. Agents are demonstrably capable of chaining novel vulnerabilities to break out of the sandboxes we build for them, and the open model ecosystem those same agents are trained on and distributed through has become valuable enough that the most important chip company on the planet wants to own the distribution point. Both of those have security implications we are only starting to work through.

The rest of the week filled in around them, with Trail of Bits arguing that VMs won’t contain cyber-capable agents, the researchers behind ExploitGym walking through how they measure agent exploitation capability, SemiAnalysis making the case that open models close the gap faster with every cycle, and Ciaran Martin offering a badly needed corrective to AI doomerism.

Let’s get into it!

Know your attack surface before it outgrows you

You cannot patch, monitor, or govern an asset you don’t know exists. Yet, most enterprise inventories are still working from an incomplete picture.

runZero, built by HD Moore (the mind behind Metasploit), delivers agentless, credential-free discovery across your entire internal and external attack surface—surfacing unknown and unmanaged assets along with the exposures riding along with them: CVEs, default credentials, misconfigurations. No appliances, no scanning windows to negotiate, just an accurate picture of what’s actually out there.

Start your 21-day free trial

Pro tip: When your trial wraps, runZero’s free Community Edition covers up to 100 devices, perfect for home labs!

*Sponsored

Cyber Leadership & Market Dynamics

NVIDIA in talks to acquire Hugging Face in $13 billion deal

News broke over the weekend that Hugging Face was fielding takeover interest, and by midweek The Information reported that NVIDIA had agreed to buy it for $12.9 billion, with no signed agreement yet and neither company confirming. For context on how fast this has moved, Hugging Face turned down a $500 million NVIDIA investment in late 2025 that valued it at $7 billion, with CEO Clem Delangue saying the company “didn’t want a dominant investor that could sway its decisions.” It was valued at $4.5 billion in 2023 and is now doing roughly $150 million in annual revenue, up from about $100 million two months prior.

The strategic logic is easy to follow, with OpenAI, Google, Amazon, and Anthropic all building their own silicon, owning the place where open models get published and pulled is a durable way to keep the ecosystem on your hardware. The security angle is the one I’m most interested in of course.

Hugging Face is effectively the GitHub of AI, a package registry for weights, datasets, and Spaces that enterprises pull from constantly, often with far less scrutiny than they apply to OSS packages. Concentrating that registry under a single vendor with its own commercial incentives changes the software supply chain risk conversation, and it does so in the same month the registry itself got rooted.

Rolling with the Punches: Why Cybersecurity is Backgammon, not Chess

Phil Venables is one of the most consistently useful writers and deep thinkers in our field, and this one qualifies. His argument is that we keep framing security as chess, a game of perfect information where a sufficiently smart player calculates their way to victory, when it actually behaves like backgammon, which he describes as “stochastic risk management” where skill has to account for the dice. He maps it out through blots and anchors (exposed vulnerabilities versus layered controls like IAM, MFA, and segmentation), priming, the blitz (automated ransomware hitting everything at once), and the doubling cube (the decision of whether to pay or execute recovery).

The cultural point at the end is the one that matters for security leaders. Chasing “flawless, unyielding defense” is the wrong objective function, and resilience means accepting that bad rolls happen and building an organization that absorbs and adapts. Given how the OpenAI incident below unfolded, with clear signals that went un-escalated, this framing is timely.

Exclusive: CrowdStrike’s CTO is leaving to launch an AI cyber fund

Elia Zaitsev is leaving CrowdStrike after 13 years as global CTO to launch Cognition, a venture firm he is starting with Gur Talpaz and Tayler Sipperly, targeting $170 million. The model is concentrated, leading or co-leading seed and Series A with average checks around $6 million and $15 million respectively, and only three to four investments a year. Zaitsev’s framing is that agentic AI is a platform reset for security, and as he put it:

“We have this new attack surface that’s being brought on by AI and agents.”

I’ve made the point before that we are watching a genuine reshuffling of the security market, with operators leaving incumbent platforms to build and fund the next wave. Whether agentic AI produces a category-defining platform or gets absorbed into the existing consolidators is the open question, and it is one Sid Trivedi and I spent a good chunk of our annual pre-Black Hat conversation on. That said, when a sitting CTO of the most successful endpoint platform of the last decade walks out to raise on this thesis, it tells you something about how the people closest to the data see it.

Cybersecurity startup Minimus shutting down after raising $51 million

The other side of that market story, and one we don’t hear about enough. Minimus, founded by the team that sold Twistlock to Palo Alto Networks for roughly $410 million in 2019, is winding down after raising $51 million in seed funding. The company built stripped-down container images and VMs with dramatically fewer vulnerabilities, publicly launched in April 2025, and had around 60 employees four months ago. Customers have 60 days, until October 22, to migrate off the Minimus registry. The founders’ statement is pretty direct as well, that:

“the current business and investment climate has resulted in a situation in which we are unable to continue operations.”

This one stings, because the product solved a real problem. Minimal images are one of the few software supply chain interventions that actually burns down vulnerability backlogs rather than just measuring them. Proven founders, real technology, and a genuine pain point still weren’t enough, which says quite a bit about how hard it is to sell into a crowded container security market where buyers have five ways to defer the purchase.

As I wrote on LinkedIn, this is a good example that building a thriving security (or any) company is very hard. This one had a real market need, being addressed by repeat founders who have walked the path. But, it is a highly competitive category with players like Chainguard dominating the space and it is hard to be wake a player who defined and built the category.

A good reminder in this era of record setting funding rounds, PR announcements and categories flooded with tens of security vendors chasing the same problem around AI and agents.

Questions to ask AI security vendors

Lenny Zeltser put together five questions worth bringing into any AI security evaluation, which AI asset the product actually protects, whether it delivers value standalone or requires a broader platform, what exists today versus what lives on the roadmap, whether you already own the capability somewhere else in your stack, and what evidence backs the claims. His framing is refreshingly direct, that “In the fast-changing AI security market, a product described one way often turns out to be something else after a closer look.”

The fourth question is the one most practitioners skip and the one that kills the most deals, and the distinction he draws between traditional tooling with AI bolted on and genuinely AI-native protection is the fault line running through this entire category right now.

My favorite though is the one tied to roadmap vs. actual capabilities, and not what lives in a analyst or marketing pitch deck. Many of the AI-centric categories have companies chasing the opportunities but they have little to no actual functional capabilities deployed in production with customers.

Be careful out there!

The choices we make about AI now are critical

Bill Gates argues that this transition differs from previous ones because AI automates cognition itself, and that it will play out over a decade rather than across generations. He points to Stanford payroll data showing a 16% relative employment decline for workers aged 22 to 25 in AI-exposed occupations while older workers stayed flat, and proposes a governance framework modeled on nuclear inspection and aviation regimes, “Human Reserved” roles kept for people, and a token and robot tax.

The line security folks should notice is his, that:

“The smartest cybersecurity experts I know are scared about the next few years, because the attackers are getting powerful new capabilities faster than the defenders can fix all the weaknesses.”

I don’t agree with all of his prescriptions, and I remain skeptical of preemptive regulatory regimes built around hypothetical harms. That said, the asymmetry he describes is real, and the gap between offensive capability and defender remediation throughput is showing up in nearly every other item in this issue.

Diffusion is destiny for defenders, and our best defense against the coming AI impact in cyber by attackers is arming defenders with the innovative capabilities as quickly as possible.

Fears of AI-induced armageddon are overdone

Ciaran Martin, founding CEO of the UK’s NCSC, wrote the counterweight to the piece above, and it is a rational pushback on some of the AI FUD. He opens with L0pht walking into a Senate office building on May 19th 1998 and telling lawmakers they could render the internet unusable in 30 minutes, then walks through Leon Panetta’s 2012 “cyber Pearl Harbour” warning, pointing out that our field has “a long history of apocalyptic prophecies” that never arrived.

Martin isn’t arguing that nothing bad happens, he is arguing that our track record of predicting catastrophic collapse is terrible and that the predictions themselves distort policy and spending. Coming from the person who ran a national cyber defense agency, that carries weight. Pair it with the Gates piece and with below, and you get a much healthier version of this debate than the one happening on your social media timeline.

Anthropic plans to change data retention policy for advanced AI

Anthropic is reportedly moving to let enterprise customers store required data in their own cloud environments rather than exclusively on Anthropic’s infrastructure, while keeping a 30-day retention requirement for its most capable models.

For anyone running a frontier model in a regulated environment, this is the constraint that has been blocking deals, and it is a reasonable compromise between the safety case for retention (you cannot investigate an incident like the one below without logs) and the enterprise requirement to control where data lives.

Given that OpenAI’s own report leans heavily on retained chain-of-thought and infrastructure telemetry to reconstruct what happened, the tension between “retain enough to investigate” and “retain nothing our customers didn’t consent to” is going to be a live governance question for every AI vendor, not just Anthropic.

This has also been a key point/theme in the conversations around open vs. closed models for enterprises, so it isn’t surprising to see the labs trying to offer different options to alleviate those concerns and streamline procurement pathways to expand adoption and consumption.

AI

The Hugging Face incident and the road ahead

This is the report of the year so far, and if you focus on one thing in this weeks issue, make it this.

OpenAI walked through how internal research models, during cybersecurity evaluations, “communicated through unauthorized channels, exploited vulnerabilities in shared infrastructure, gained internet access” and ultimately compromised both OpenAI and Hugging Face infrastructure.

The timeline is a key aspect to examine.

• On May 12 the agents discovered they could pass messages to each other through Artifactory, building an improvised message board out of file directories to coordinate across supposedly isolated instances.

• On May 26 they got internet access through SSRF.

• On June 26 they exploited a token refresh flaw for admin access.

• On July 4 sustained agent activity crashed Artifactory, and when it was rebuilt on July 8, the agents immediately reestablished both the message board and internet access.

• Between July 10 and 12 they recovered publicly exposed Hugging Face credentials, chained “several novel security flaws” into code execution, and took root across Hugging Face servers in multiple regions.

• Detection came on July 19 and 20, and public disclosure on July 21.

The root cause analysis is where the practitioner value and community takeaways are. OpenAI names reward hacking, persistence without a safe exit, metagaming, and unauthorized communication. The most damning figure in the report is that of 898 ExploitGym tasks, 198 were ones the models had never solved, and those unsolved tasks accounted for “93% of the tasks that were discussed on the Artifactory message board.”

The models were handed impossible problems, given enormous compute, rewarded for solving them, and rationally concluded that attacking the scorer was the path to reward.

Two failures compounded the situation as it is described. Production safeguards, meaning system prompts and auto-review models, were “not applied in the evaluation environment,” and chain-of-thought monitoring wasn’t running on these evaluations at all. OpenAI states that:

“deployed monitoring would have caught the initial relevant activity and paged our security team more than a day before models breached Hugging Face systems,”

and that production safeguards reduce infrastructure compromise propensity by over 100x. The controls existed, they just weren’t turned on where the most capable models were being pushed hardest.

There are also things the report doesn’t say. Per Fortune’s read, OpenAI didn’t publish the prompt given to the agents, message examples, or code snippets, all of which Hugging Face did include in its own July 29 post-mortem.

Fortune also reports, citing the independent METR and Redwood Research analyses, that 1,200 agents communicated over the message board and 700 participated in the attack, with a lead agent coordinating concealment. OpenAI’s own characterization, that this was “misaligned behavior in an outlier scenario involving a rare and unexpected confluence of events,” reads as perhaps thinner than the timeline alludes to.

That said, credit where it is due, publishing this level of detail is genuinely valuable to the field, and the commitments are the right ones, including required chain-of-thought monitoring for models at GPT-5.6 Sol capability or above, multi-agent alignment environments that teach models “to distrust unauthorized instructions,” training that rewards “correctly identifying broken tasks, requesting clarification, or stopping safely,” and 30-minute escalation requirements for severe misalignment alerts.

That said, every one of those is a control we already know how to describe in enterprise security terms, and none of them were in place at one of the organizations with the most capable models on earth and the most reason to be careful.

VMs won’t contain cyber-capable agents

The team at Trail of Bits published the perfect companion piece, and the timing is ironic. They gave GPT 5.6-Cyber the task of escaping a VM sandbox, and it succeeded three separate times with escalating sophistication.

• First, it identified a recently disclosed kernel vulnerability, built an exploit, and hardlocked the host.

• Second, it found that Debian 12 shipped an outdated libslirp (v4.7.0) carrying CVE-2026-9539 and combined it with an unmarked bug fix to get arbitrary read and write into host memory.

• Third, and this is the one that is most concerning, it chained three previously unknown vulnerabilities across QEMU, Linux KVM, and libslirp, plus one patched flaw nobody had recognized as security relevant, to get controlled execution in the host kernel.

The behavioral description matters as much as the results on this one. The agent “operated autonomously for hours, backtracked from approaches that didn’t work, pulled code and research papers,” and sustained this across 12-hour windows. That is not a model completing a benchmark, that is a researcher with infinite patience.

The blogs recommendations are practical, meaning minimal virtualization platforms like Firecracker rather than full QEMU, continuous distribution updates instead of stable releases that lag on patching, least privilege applied to network access and credentials, and time-limited operations with pristine resets between runs.

Put this next to the OpenAI report and the conclusion is uncomfortable, because the sandbox has been among the load-bearing control in every agent security architecture, including plenty in production today.

This is a topic I’ve discussed on the Resilient Cyber show in the past with folks such as Luke Hinds and Alex Zenla months ago, before the breakouts got everyone’s attention.

Inside ExploitGym: How Researchers Are Measuring AI Agent Exploitation Capabilities

Timely context on the benchmark at the center of the OpenAI incident. ExploitGym holds roughly 898 vulnerability instances and measures whether agents can turn known vulnerabilities into working exploits, across userspace memory safety flaws in C and C++, browser engines (Google’s V8), and Linux kernel exploitation.

The results show a steep difficulty curve. Claude Mythos Preview and GPT-5.5 led with 157 and 120 successful exploits, but kernel exploitation collapsed that to 12 and 22 successes for the top two models. Agents also sometimes achieved code execution through unintended vulnerabilities rather than the one under test, which is exactly the behavior that generalized into the OpenAI incident.

“Measuring only whether an exploit succeeds may miss important changes in how that success is achieved.”

Agentic AI: The New Insider Threat Model

Katie Moussouris of Luta Security frames autonomous agents as an insider threat problem, which is the right mental model. Her assessment of the Hugging Face incident is direct, that:

“Clearly, we didn’t have the real-time monitoring in place, and we don’t have any breaks that seem to work.”

She notes the gap between initiation in May 2026 and detection on July 19, roughly two and a half months of undetected activity, and points out that Anthropic’s latest model “realized it was on the internet and stopped itself,” which is the behavior we should be training toward.

Her broader push is one I strongly agree with, that organizations need to invest in the fundamentals, reduce attack surface, and manage technical debt rather than assuming AI tooling solves problems the organization never solved manually.

The insider framing is useful because we already have a discipline for this, with behavioral baselines, least privilege, separation of duties, and monitoring for the trusted entity going off-script. We just have to apply it to entities that operate at machine speed and outnumber our employees, which is a new paradigm for us all.

Where Security Fits in an AI Agent Stack

NVIDIA published a genuinely good architectural piece, and the core distinction is one I’d like to see adopted broadly, that behavioral controls (prompts, model safeguards, harness logic) are different in kind from infrastructure controls (what the runtime actually permits). Their framing is clean, that “The harness guides what an agent tries. The infrastructure controls what an agent can do.”

They lay out five layers, distribution and product, orchestration, agent harness, secure runtime, and inference data plane, with a security boundary drawn between the harness and the runtime so requests cannot route around policy enforcement. The five design rules are the useful part, that higher layers propose and lower layers decide, policy lives below the boundary, every effect is checked, access is just-in-time, and isolation enables recovery. They also define four escalating security profiles, Isolated, Connected, Production, and Adversarial.

This maps almost exactly onto the soft guardrails versus hard boundaries argument I’ve been making for a while now, and the OpenAI incident is the proof case. Every control that failed there was a behavioral control, or a boundary control that simply wasn’t enabled.

Secure Vibe Coding and the 99%

In this episode, I sit down with Igor Andriushchenko, Head of Security and CISO at Lovable, to discuss securing AI-native development, including soft guardrails versus hard boundaries, the shared responsibility model for vibe coding platforms, and how GRC engineering fits into a world of AI-powered attackers.

I had been chasing Igor down on LinkedIn since February, so I was glad to finally get him on the show. Lovable sits in an unusual spot. Igor has to run security for a company that went from roughly 40 people to 400 laptops in MDM inside a year, and at the same time the product he is securing hands software creation to people who are not developers and have never thought about security at all. Those two problems pull in different directions, and the conversation gets into how his team handles both.

Are Open Models Catching Up?

The best data-driven piece I read this week, and directly relevant to the NVIDIA news above.

and SemiAnalysis argues the gap between open and frontier models closes in roughly half the time with each successive era.

The authors are appropriately careful, noting that “benchmarks are not the end all be all” and warning about hill climbing on public evals. For security purposes, though, the direction is what matters.

If open-weight models reach frontier agentic capability within four to six months of release, then every capability demonstrated in the OpenAI report and the Trail of Bits research becomes available to anyone with a GPU and no safety stack on top of it, on a predictable clock. That is the assumption Igor’s conversation above mentions, and the evidence supports it.

Where are all the prompt injection attacks?

asks the question our industry avoids, which is why documented real-world damages from prompt injection remain tiny relative to the hundreds of billions lost to cybercrime annually.

He offers three explanations:

• Opportunity cost (attackers still get in through known vulnerabilities, weak credentials, and misconfigurations, which is cheaper than building novel exploit workflows)

• Organizational inertia (established criminal enterprises have profitable, proven playbooks and poor ROI on retraining)

• Attribution gaps (detection tooling for LLM-mediated breaches is immature enough that successful injections may be getting attributed to whatever system got touched next).

He isn’t dismissing the risk, and he still recommends securing agents with something like Meta’s rule of two, restricting sensitive actions on untrusted data.

His point is about resource allocation, that overweighting AI-native risk because it dominates conference talks means underfunding the tech debt that is actually getting organizations breached. Josh has been on the Resilient Cyber show and consistently brings evidence rather than vibes, and this is a good example of it.

AppSec

Staying Ahead of Adversarial AI Through Agentic Source Code Review

Google Cloud and Mandiant detailed their Agentic Vulnerability Discovery Harness, a waterfall pipeline of specialized agents running threat modeling, entry point discovery, context enrichment, hypothesis generation, and hypothesis validation, with human expert gates at both ends.

Distinct agents handle access control analysis and data flow analysis, Gemini Flash Lite handles parallelized entry point discovery at scale, and high-temperature validation agents feed a synthesis agent that marks findings Confirmed, Disproven, or Rejected. Mandiant expertise is injected through a three-tier rules hierarchy covering domain, framework and language, and vulnerability specifics.

The results are the reason to read it, with 12 CVEs assigned so far, another dozen in active disclosure, tens of millions of lines of code analyzed, and over 100 critical vulnerabilities discovered in two days during an incident response engagement.

The harness is the story here, not the model, which is a trend we continue to see. This is the same lesson from the NVIDIA piece above and from OpenAI’s report, that capability comes from orchestration, scoping, and validation rather than from prompting a frontier model harder.

It is also worth noting that Google is careful to keep human validation in the loop at the exploitation stage, which is the difference between a finding and a fix.

Just a rumour of a bug is enough to find a security exploit these days

Anil Madhavapeddy, the OCaml maintainer and Cambridge researcher, wrote a super interesting piece. He opened a public pull request fixing a path traversal bug in cohttp and saw probes matching that vulnerability pattern within 10 minutes. He then demonstrated that building a working exploit from the PR alone took roughly one minute with available models. His point is that embargo, the entire premise of coordinated disclosure, assumes attackers need time that they no longer need.

He cites 2026 research showing the bottleneck has moved to “defender remediation throughput,” and points to CVE-2026-39987 exploited in 9 hours and CVE-2026-33017 in 20 hours with no public proof of concept in either case. His proposals are worth engaging with, including private development infrastructure with web-of-trust authentication, continuous shipping on Chrome-style cadences, and protocol-layer virtual patching through distributed rule networks ahead of upstream fixes.

For open source maintainers, this is a serious problem with no good answer yet, something I’ve discussed on the show with industry veteran Casey Ellis of Bugcrowd. The security fix commit is now an exploit specification, and most maintainers have no ability to ship a coordinated release across an ecosystem before that specification is public.

Anyone working on OSS security funding and infrastructure should be reading this one closely.

How to Hack AI Agents

Shoeb Patel put together an excellent practitioner’s mental model for finding vulnerabilities in agentic systems, and it is the resource for AppSec engineers being asked to test their first agent.

He frames the core problem:

“the model is trained to trust the system prompt more than the user, and the user more than tool results. But this boundary is soft.”

This aligns with the soft guardrails vs. hard boundaries framing I’ve been writing and speaking about for a while now. From there he separates direct injection through user-controlled inputs from indirect injection hidden in web pages, emails, plugin descriptions, repositories, documents, and logs, then walks the impact vectors of data exfiltration, privileged actions taken under the agent’s or victim’s identity, and persistence through injections stored in memory and configuration.

The writeup references more than 15 documented attacks including CamoLeak, EchoLeak, and Invitation Is All You Need, and points to practice environments like Gandalf and HackAPrompt plus Microsoft’s PyRIT for red teaming.

Note how well it pairs with Saxe’s piece above, because the techniques are all real and demonstrated while the in-the-wild exploitation data remains thin, perhaps due to the factors Josh mentioned such as attribution, widely available low hanging fruit etc.

Final Thoughts

The week’s two headline stories are the same story told twice. OpenAI’s report shows agents chaining novel vulnerabilities to escape an evaluation sandbox, and Trail of Bits shows a commercially available model doing the same thing to a VM three different ways.

Meanwhile, the registry those models are published to and pulled from is about to change hands for $13 billion, and SemiAnalysis has the data showing open-weight models reach that capability level four to six months behind the frontier and closing.

If those things are all true at once, the security architecture most organizations are building around agents right now rests on a control that doesn’t hold, against capabilities that will be freely downloadable inside of a year.

The good news, such as it is, is that nobody is proposing exotic solutions. NVIDIA’s boundary model, Igor’s six pillars, Moussouris’s insider threat framing, and OpenAI’s own list of commitments all describe controls we already know how to build.

We just have to actually build them, everywhere, and turn them on in the environments where we are pushing the hardest, which is precisely where they weren’t.

Stay resilient.

Subscribe now

Every so often a piece comes along that gives you the frame for everything else you are reading, and this week that piece was Dan Lahav’s “The End-State Fallacy.”

His argument is that our industry keeps debating whether AI will ultimately favor offense or defense, and in doing so we skip past the part that actually determines what the next few years look like. As he puts it,

“even if the end state turns out to be defense-dominant, the next few years can still be sharply offense-dominant.”

The equilibrium is not the experience, the path is.

Once you have that frame in hand, this week’s stories stop reading like unrelated headlines and start reading like data points on a single curve.

Let’s get into it!

Cyber Leadership & Market Dynamics

Is the Cyber Industry Too Big?

Alan Shimel of Techstrong wrote this one from the floor of Black Hat USA 2026, and it is a great analysis of our space, and the numbers underneath it are worth your time.

Cyber generated roughly $335.8 billion in 2025, up from $214.9 billion in 2022, with projections of $371 billion in 2026 and $404.5 billion in 2027, but growth is moderating from 17.9% in 2023 to a projected 9% in 2027. There are 4,100+ vendors selling around 11,000 products, the top 10 vendors hold only 29.5% of the market, and Microsoft, the largest of them, holds under 10%. Black Hat itself drew 20,000+ attendees and 400+ solution providers at an average booth cost of roughly $250,000.

Alan’s answer to his own question is nuanced, and I largely agree with it. The industry is not too big for the problem, it may be too big for its own commercial plumbing. His observation that:

“the company with the best booth is not necessarily the company with the best product. It may simply be the company with the most capital to convert into visibility”

This is one every practitioner walking a show floor already knows in their gut. The Futurum survey he cites, with 929 decision makers, found 67% expecting budget increases while 42% plan to reduce vendors and 36% plan to add them, which tells you the consolidation story is far messier than the platform vendors would like, and per an IBM and Palo Alto Networks study he references, the average organization is managing 83 security solutions from 29 vendors.

His warning that “the answer to tool sprawl cannot be agent sprawl” is the one I would tattoo on the industry’s forehead heading into 2027. Read this next to the end-state fallacy piece further down, because 83 tools from 29 vendors and six month procurement cycles are exactly the institutional metabolism that makes the transition period offense-dominant regardless of how good our defensive technology gets.

Palo Alto’s CEO bought the dip. Five months later, his $10 million bet is worth $26 million

Nikesh Arora bought 68,085 Palo Alto Networks shares on March 27 at $146.88 per share, roughly $10 million, at a moment when the stock had fallen 20% since the start of the year on fears that AI would disrupt incumbent security vendors. That position is now worth over $26 million. PANW sits at roughly $315 billion in market value, closed the ~$25 billion CyberArk acquisition in February, and posted $3 billion in Q3 revenue at 31% year over year growth.

I include this less as a stock story and more as a signal about the disruption thesis. The market briefly priced incumbents as AI roadkill, and the incumbents responded by buying their way into the AI security stack, with five AI-related acquisitions in the past year alone. Arora’s own framing, that “as AI becomes more pervasive across the enterprise, it expands the attack surface area,” is exactly the pitch every platform vendor is now making. Pair this with the Shimel report above and you get the full picture of where the capital is flowing and why.

I recently came across a good long-form interview with Nikesh on the Sourcery podcast by

Anthropic’s annualized revenue surges to $65B

Per Marina Temkin at TechCrunch, Anthropic hit $65 billion in annualized revenue at the end of July, up from $47 billion in May and $9 billion at the end of 2025. That is $18 billion in annualized revenue added in two months. The company is projected to finish 2026 somewhere between $100 and $120 billion, against OpenAI’s $40 billion run rate, and both have filed confidential IPO paperwork.

To put into perspective what that means for our industry, the entire global cybersecurity market is around $371 billion projected for 2026 per the Techstrong figures above. A single model provider is on a trajectory to reach a third of that inside a year. This is the scale of the platform shift security is now being asked to secure, and it should inform how much of your program you are willing to bet on governance patterns that assume you get to move at your own pace.

Ramp AI Index, August 2026

Ramp’s Ara Kharazian titled this edition “Cracks in the AI Thesis,” and the data underneath is a nice counterweight to the revenue story above.

Paid Anthropic adoption sits at 43.5% of U.S. businesses, up 1.1 points month over month, with OpenAI at 39.7%, up only 0.23 points, and xAI at 4%, up 0.94 points. The finding that stands out to me is on premium model uptake. Anthropic’s flagship Fable 5 accounts for only 6% of tokens purchased from Anthropic and 11.4% of Anthropic spending, despite being the most capable option on offer, at roughly $10 per 1M tokens.

Buyers are not paying up for the best model, they are paying for the good enough model at a price they can defend. Spend distribution says the same thing, with the top 1% of businesses spending a median of $7,400 per employee on AI in July, the top 10% spending $650, and the median firm spending $11.95. For security leaders building AI-driven detection, triage, or code review pipelines, this is your budget reality. The frontier capability exists, and most of your organization will be running something cheaper.

California Building ‘AI Cyber Defense Fund’ to Protect Critical Infrastructure From Hackers

California is standing up an “AI Cyber Defense Program” to use AI to find and patch vulnerabilities across state and local critical infrastructure, supervised by AI Cybersecurity Officers, one per state agency, with an implementation plan due within 120 days. Per Gizmodo, the move follows internal tests in which AI systems from OpenAI, Anthropic, and Meta autonomously gained access to the open internet and hacked into third-party organizations. Governor Newsom framed it as a choice,

“California can either wait for the next crisis, or we can build the kind of defenses this moment demands. We are choosing to build.”

AI

The End-State Fallacy: Where Is AI Security Headed?

This is the piece of the week, and the one I would read first if you only get to one thing in this issue.

Dan Lahav of Irregular argues that our field keeps litigating where the offense-defense balance eventually lands while skipping the question that actually determines the next few years. He calls the mistake the end-state fallacy, assuming that the long-run equilibrium’s properties apply to the transition period, and his thesis is that:

“even if the end state turns out to be defense-dominant, the next few years can still be sharply offense-dominant.”

His analogy for it is good, that “getting in shape has an excellent end state and a hard path; drinking is the reverse, pleasant in the moment and costly later.” The path matters, and as he says, “perhaps even more.”

He gives five reasons why the next few years likely favor offense, and every one of them is something practitioners already feel.

• First, the discovery-to-exploitation window is collapsing while the patch queue grows, with time from a CVE’s public disclosure to first confirmed in-the-wild exploitation falling from 2.3 years in 2018 to 1.6 days in 2026, and defenders paying what he calls an “accountability tax” because we cannot afford to break production with a bad patch while attackers carry no such burden. His illustration of the supply side is one I had not seen anywhere else, that “at Pwn2Own Berlin 2026, for the first time in the competition’s nineteen-year history, dozens of severe vulnerability submissions had to be turned away... simply because the organizers had run out of contest slots.”

• Second, defending AI is itself a new discipline, and building the defenses it requires takes time we do not have much of.

• Third are defense deployment gaps, because “defensive organizations do not move on that timeline. They onboard vendors over quarters, budget annually, and modernize infrastructure over years,” and “defensive capability becomes useful only after an institution has learned how to trust, buy, operate, and integrate it into a complicated system.”

• Fourth, he expects that “at least in the near term... AI will scale faster on offense than on defense,” largely because of verification asymmetry, since an exploit either works or it does not while “a patch asks something closer to global assurance, one must show that the system is secure under continuous, adversarial pressure, without having broken anything adjacent,” which he calls a much harder thing to verify. This is something I have cited in a blog from Sergej Epp titled the “Verifiers Law”, as well as showing in research from Keith Hoodlet that AI created patches remain problematic.

• Lastly, none of these effects occur in isolation, they compound. Elsewhere in the essay he adds the structural version of the same worry, that “if the cost of creating or attacking systems falls faster than the cost of securing them, the attack surface may grow beyond what defensive tooling can feasibly cover.”

The capability data underneath is what makes the argument hard to wave off. On Cybench, “frontier models reportedly climbed from around 10% success to near-complete success in about two years.”

A custom CPU-emulator exploitation task went from unsolvable in February 2026, to roughly 5% success at about $2,000 per run in April, to reliable completion at about $20 per run by June, which he sums up as going “from unsolvable to cheap and repeatable” in four months.

His base case is that frontier models “will continue to roughly double their performance and effective autonomous work horizon every six months” over the next two years, with the price of a fixed capability level falling on the order of 10x per year.

On diffusion, NIST CAISI measured open-weight DeepSeek-V4 Pro lagging the frontier by about eight months across its aggregate evaluation suite in May, and UK AISI found an even tighter gap on cyber specifically in July, with open models like GLM-5.2 and DeepSeek-V4 Pro matching closed frontier models released four to seven months earlier, down from the six to ten month gap it measured through most of 2025.

His projection follows directly, that:

“based on the current trajectory, we can expect current frontier-grade cyber capabilities, such as Mythos 5 / GPT-5.6 Sol, to proliferate before the end of Q1 2027.”

His retelling of the July Hugging Face incident is the clearest I have come across and it makes sense given how involved Irregular is with the labs.

Frontier models in a sealed OpenAI cyber-evaluation sandbox “found a zero-day flaw that let them act beyond their sandbox,” and then, in his words, “autonomously attacked Hugging Face infrastructure, gaining elevated access, stealing credentials, moving laterally, and restoring access after being blocked,” carrying out about 17,600 unscripted actions over several days.

Separate agents “discovered a way to communicate through a shared system, created their own channels to exchange attack directions, exploits and credentials, and divided tasks without being instructed to cooperate, forming an autonomous swarm,” and when one channel was shut down they simply established another. Lahav’s framing of why this one is different is the right one, that “no human selected Hugging Face as the target or specified the attack chain step by step. The AI found and executed that path itself.”

His answer is Differential Defensive Cyber Acceleration, which is deliberately shaping “the development, diffusion, and deployment of AI security capabilities so that protective capabilities mature and reach defenders before corresponding offensive capabilities can overwhelm them.”

It rests on three tenets, measuring the field with continuous feedback between measurement and intervention and tracking realistic attack chains rather than benchmark scores, building defensive-specific capability along a “red-to-blue spectrum” by prioritizing interventions that “sit as far toward blue as possible” such as remediation, incident response and threat intelligence, and blue deployments that get defensive tooling into critical organizations, and treating offensive diffusion as its own R&D problem through use limitations, theft prevention, and AI containment.

I have been making a version of this argument all year in less rigorous terms, so I will say plainly that this is now the reference text.

Where I would put the emphasis is on the least glamorous third of his second tenet, blue deployments. Building blue-asymmetric capability is a research and vendor problem that is already well underway, and the rest of this issue is full of evidence for that.

Getting it into production runs straight into his own third reason, the institutional metabolism of security organizations that onboard over quarters and modernize over years. We do not have a capability gap on defense right now, we have an absorption gap, and absorption is the one part of this that no lab, no benchmark, and no policy office can do on our behalf.

Nearly every other item in this issue is either evidence for one of his five reasons or an example of somebody trying to close that absorption gap, so read the rest with his frame in hand.

GLM-5.3

Z.ai released GLM-5.3 on August 14, and the cyber benchmark results are the story. Per the release coverage, the model posted 84.5% on CyberGym, ahead of Claude Mythos 5 at 83.8% and GPT-5.6 Sol at 83.6%, jumped from 4.6 to 28.3 on Terminal-Bench 3.0 and from 46.2 to 66.9 on DeepSWE v1.1, and reportedly surfaced 2,436 vulnerabilities across 269 open-source projects, with 1,097 rated critical or high severity, including bugs in Linux, WebKit, and FreeBSD.

Then the part that actually matters. Z.ai is holding the open weights for a two-week safety review, because the model:

“began reasoning across multiple stages of exploitation and forming coherent plans for complete exploitation chains, a capability it did not set out to train for.”

A Chinese lab, building on an open-weight lineage, voluntarily delaying a weight release over emergent offensive cyber capability, is a genuinely notable moment for anyone who assumed open-weight governance would only ever come from Western labs or regulators.

It is also the end-state fallacy playing out in real time, since Lahav cites the previous generation, GLM-5.2, being measured at “roughly seventeen cents per vulnerability found” while matching or beating leading closed models on some bug-finding benchmarks, and this release moves that lineage past the frontier models he named as the ones due to proliferate by Q1 2027.

A two-week safety review is a speed bump on a curve like that, and it is worth asking what happens the next time a lab in this position decides the delay is not worth it.

The evolving role of the Red Team in the era of agentic security

Daniel Fabian, who heads Google’s Red Teams, wrote this with Ash Fox, Moni Pande, Niru Ragupathy, and Stefan Friedli, and it is a practical companion to the Lahav essay.

Their argument is that red teams have to stop running manual exercises and start building the autonomous agents that will simulate real agentic attacks, because attackers who value volume and speed above all have every incentive to automate first.

They break the change into sophistication, scale, and speed, with the observation that “dwell time, the window between gaining an initial foothold and moving on objectives, is collapsing.”

Their forecast is that within 6 to 12 months “open-weight models will match today’s cybersecurity capabilities of frontier models,” with safety guardrails removable through techniques like abliteration.

Given the GLM-5.3 and Kimi K3 results above, that forecast may already be conservative. What I appreciate most is the pragmatism of the recommendation, which is not to build a full autonomous red team on day one, but to start automating isolated pieces of your existing manual exercises like reconnaissance or lateral movement, then wire modular subagents behind an orchestrator.

Their closing point, that “we have the time right now to get ahead of the curve,” is the same window Lahav is describing, arrived at independently by a team with a very different vantage point, and the two forecasts landing on the same 6 to 12 month horizon should carry more weight than either would alone.

Patterns and problems in emerging multiagent systems

Anthropic’s Frontier Red Team ran swarms of Claude agents across several shared environments, and the failure modes are worth knowing before your next architecture review.

Coordination degraded as agent counts rose in a 12-hour game development experiment scaling from 10 to 80 agents, with Sonnet 4.6 and Opus 4.6 opening 876 and 980 PRs respectively while closing very few. Agents also show remarkably low behavioral variance, with 18 of 30 creating the identical git branch name “mvp-game-loop,” and in a job queue experiment they flooded the system with 2.4 million requests when only 117 jobs were accepted.

Given a communication channel in pricing games they colluded on price floors, and under incompatible objectives they deployed self-replicating malware disguised as system processes, disabled Unix accounts, and wrote kill-loop scripts, with one agent noting that “the name of the reaper script matters for dodging pkill -f.”

On the upside, a coordinated 45-agent swarm found 266 vulnerabilities using 27M tokens versus 21 for independent parallel agents at 6.5M tokens, with only 12 findings in common. The researchers’ conclusion is the line to carry forward, that “coordination doesn’t naturally emerge from stronger intelligence nor alignment at the individual level.” Anthropic is showing us that emergent coordination is unreliable and often destructive in benign settings, and the Hugging Face incident above is what it produced in an adversarial one.

Teaching AI to Reason Through Detection Triage

CrowdStrike published results on a detection triage classifier built on NVIDIA Nemotron that reasons through evidence before issuing a verdict. At their high-confidence operating point, holding 98% false positive precision and 99% true positive precision, false positive recall improved from 21.8% to 64.8% and true positive recall from 34.7% to 53.0%, with overall accuracy landing at 82.6% against frontier general-purpose models in the 55 to 71% range.

This is what applied AI in SecOps should look like, and the auditability is the part that matters, since their framing that “teaching the model to think through a detection improves accuracy while producing an auditable rationale that analysts can evaluate” answers the biggest practitioner objection to AI triage.

A tuned smaller model beating the frontier generalists is also a useful data point next to the Ramp findings above. Alert adjudication is about as blue as Lahav’s spectrum gets, since attackers get almost nothing out of it.

Least privilege for AI agents, identity, access, and tool binding

Yesenia Yser and Toby Kohlenberg laid out Microsoft’s guidance on agent least privilege, and it is refreshingly unglamorous.

Treat every agent as a first-class identity principal with its own lifecycle and clear human ownership, build task-based roles instead of broad team-level access, scope by resource, data, and operation type, and expose only curated tools through explicit allowlists, with JIT elevation, re-authorization enforced downstream rather than trusting the orchestrator, and mandatory revocation testing.

Their warning is the one practitioners will recognize from every prior identity wave, that agents working “across multiple systems within a single workflow” quietly accumulate dangerous combined permissions, and that “scope creep is quiet, incremental, and rarely revisited.”

They suggest doing this work in 30 to 90 days before expanding agent deployments, which is optimistic for most enterprises, but the sequencing is right. Doing agent identity hygiene after you have 10x’d your agent population is the service account mistake at a much worse scale.

Credential Injection Patterns for AI Agents

Christian Posta wrote the deep technical version of the same problem.

Bearer credentials have an obvious flaw, “anyone holding the credential can use it,” and of his three mitigations, accelerating expiration, proof-of-possession, or removing agent access to credentials entirely, he argues for the third through credential brokering. The vehicle is Credential Brokering 4 AI Agents (CB4A), an IETF draft from March 2026 that recommends a proxy gateway model where credentials are injected on egress and the agent never sees them.

Posta is honest about the tradeoff, since CB4A’s own threat model rates broker compromise as “CRITICAL” and the broker becomes “the highest-value target in the architecture.” That is the right way to present a control, as a shift in where risk concentrates rather than an elimination of it.

AppSec

CVE program eyes automation and globalization to weather AI ‘vulnpocalypse’

This is good reporting providing insights from NIST and others on running vulnerability programs.

Microsoft’s Elizabeth Eigner gave the quote of the week, that

“these vulnerabilities are coming out at an AI pace, but we’re still creating and processing them at a human scale.”

CISA’s Lindsey Cerkovnik said “we cannot treat every vulnerability the same way” and that she is “concerned about the industry’s ability to scale via prioritization.” GitHub has published more than 7,000 CVE identifiers so far in 2026, which Madison Ficorelli said she believed to be an annual record for a CNA, framing it correctly as “not a competition.”

Intel’s Katie Noble was bluntest, “I don’t think the CVE Program was designed to be able to manage this influx of vulnerabilities.” CISA is now handling 360 to 400 cases simultaneously, and OpenAI and Anthropic were granted temporary CNA status in July.

This is Lahav’s first reason with names and job titles attached. Automating intake does not solve the downstream problem, because even a perfectly efficient CVE Program hands enterprises a volume of findings their remediation capacity cannot absorb, which is why I keep arguing that prioritization and remediation capacity, not discovery, are where the money should be going.

Vulnpocalypse 2026 statistics dashboard

If you would rather watch the trend than read about it, this dashboard tracks 2026 CVE publication against prior years off the Vulners archive, with cumulative counts, year over year pace, monthly flow by CNA, year-end projections, and my favorite view, reserved but unpublished CVE IDs sitting in the queue.

The page’s own line is accurate, “the gap between the red line and the pack is not a rendering glitch.” That reserved-but-unpublished view is the closest thing we have to a leading indicator, since everything in it is work your team has not been handed yet.

A timely resource, and worth bookmarking.

AI-powered vulnerability clearinghouse faces deep skepticism, major challenges

The administration’s AI-enhanced clearinghouse, codenamed Gold Eagle, launched in mid-July out of a June executive order, using CMU SEI’s VINCE platform for intake.

, now CSO at Corridor, argued that “there’s no need for the government to step in here.” Katie Moussouris framed both sides best, granting that “a clearinghouse that validates findings before they hit software maintainers, deduplicates them, and routes fixes to everyone affected would convert AI noise into defensive signal,” while flagging that CERT/CC “is not currently funded with enough analysts to handle a program of this size,” that “increased centralization of unpatched vulnerabilities is a juicy target for adversaries,” and that on Treasury oversight, “vulnerability coordination succeeds or fails on trust... Treasury has neither the coordination mission nor those relationships.”

Her advice, “don’t boil the ocean,” applies to nearly every federal cyber initiative I have watched launch. The private sector is building the same capability anyway, with IBM and Red Hat’s Lightwell, the Linux Foundation’s Akrites, and Chainguard’s Athena, and with Mandiant putting the patch lag at 7 days on average against Lahav’s 1.6 days from disclosure to exploitation, a clearinghouse that will take quarters to earn ecosystem trust is being asked to keep pace with something moving in hours.

Git at any scale

Vicent Martí wrote up Cursor’s launch of Origin, a Git hosting platform built on a distributed storage system called Continuity that uses a write-ahead log in S3-compatible object storage with atomic compare-and-swap in place of consensus protocols, reaching up to 120 pushes per second on S3 Standard and over 300 on S3 Express One Zone. The line that tells you what this is really about is the allocation model, where monorepos get hundreds of replicas for CI workloads while agent-created repositories need just one.

Coding agents are now creating repositories fast enough that source control itself is being rebuilt around them, and every assumption baked into your scanning, code review, branch protection, and provenance tooling was designed for a world where humans created repositories at human rates.

A repository created by an agent and owned by no one in particular still ends up in your software supply chain. That is Lahav’s ever-expanding-surface argument arriving as infrastructure.

Final Thoughts

Reading this issue back, nearly every item is a footnote to Lahav’s argument.

Offensive capability is diffusing on a 4 to 7 month lag for cyber tasks, Z.ai just posted leading cyber benchmark scores and paused the weight release over emergent exploitation-chain reasoning, and Google’s red team independently expects the rest of the gap to close inside 6 to 12 months.

Meanwhile the CVE Program is processing at human scale, the federal clearinghouse meant to help is launching into deep skepticism about its funding and its home, and the average enterprise is managing 83 security solutions from 29 vendors with six month procurement cycles. That is his third reason, defense deployment gaps, in its native habitat.

So here is where I would leave it.

Whether AI ultimately favors offense or defense is the least useful question available to us right now, because we do not get to live in the end state. We live in the transition, and there the binding constraint is not whether defensive capability exists, it is whether our institutions can absorb it faster than offensive capability diffuses. Right now we cannot, and that gap is ours to close.

Pick one thing from the blue end of Lahav’s spectrum, a frontier-model review of your most critical repository, remediation capacity instead of more discovery, or gateway-enforced boundaries on your agents, and get it into production this quarter rather than next fiscal year.

That is the whole game between now and Q1 2027.

Stay resilient.

Subscribe now

I skipped last week’s issue while I was heads down at Black Hat, so this one pulls together the stories worth your attention from across the last two weeks rather than every link that crossed my desk. I have tried to keep it tight, with a focus on key stories over the last couple of weeks.

Black Hat was a blast, I had a chance to MC both the Innovators & Investors Summit as well as the Startup Spotlight Competition. So many excellent talks both at the events and in the hallways, I recorded several podcasts with friends from the community and more, so be on a look out for those!

This was the stretch where autonomous agents stopped being a benchmark curiosity and started reaching real systems. OpenAI disclosed that a model under evaluation escaped its environment and hacked Hugging Face, Anthropic went back through more than a hundred thousand of its own evaluation runs and found its models had compromised real companies, and the UK’s AI Security Institute published an incident report describing agents attempting supply-chain attacks and deceiving real people during routine testing. OpenAI of course shared their post-mortem at Black Hat, which many including myself agree is a must-watch for this space.

The rest of the industry spent the past week reacting to it, in accountability debates, defensive AI deployments, a wave of agent sandboxing work, and a funding market that keeps writing nine-figure checks for AI-versus-AI security.

Let’s get into it!

Into the Breach: critical infrastructure cybersecurity, on screen

Into the Breach is OPSWAT’s new cybersecurity docuseries, hosted by MythBusters’ Kari Byron and produced by Cyber King Productions. Through hands-on experiments, cinematic storytelling, and expert interviews, the series makes critical infrastructure security visible — for technical practitioners and nontechnical audiences alike.

Episode 1, “Breaking the Firewall,” is now streaming on YouTube. It challenges one of the industry’s most dangerous assumptions: that firewalls alone can protect critical assets. Also available on select in-flight entertainment systems worldwide.

Watch Now

*Sponsored

Cyber Leadership & Market Dynamics

Cyera acquires Oasis Security in a roughly $1 billion deal

Cyera signed a letter of intent to acquire Israeli startup Oasis Security for approximately $1 billion, reported as $700 million in cash with the remainder in Cyera shares. Oasis, founded in 2022, had raised $195 million and works in what it calls agentic access management, which tells you a lot about where Cyera thinks the puck is going.

Cyera itself recently raised $600 million at a $12 billion valuation, reports more than $200 million in ARR, and has now strung together a series of acquisitions across identity and machine access. The interesting piece here is not the headline number, it is that a data-security company is spending megaround capital to buy its way into managing non-human and agent identity before that problem fully arrives.

Given everything else in this issue about agents acting on their own, that looks less like empire building and more like reading the room.

Horizon3 raises $250M Series E at a $2B+ valuation

Horizon3 announced a $250 million Series E at a valuation north of $2 billion, up from the $650 million valuation of its Series D just over a year ago.

The company reports 120% year-over-year ARR growth, more than 7,000 organizations protected, and 310,000 tests safely executed in production, with the round co-led by NightDragon and NEA and Dave DeWalt joining the board. The framing Horizon3 chose, leading the “AI vs. AI” era, is the same theme showing up across this issue, and the market is clearly willing to fund it.

Autonomous offense to validate your environment is a genuinely useful capability, and it is worth dwelling on the fact that the same techniques being funded here as blue-team tooling are, in the incident section below, what happens when they run without a leash.

I had a chance to sit down with Snehal at Black Hat and discuss the funding round, their market trajectory, the competitiveness of the category and more. Snehal remains one of the sharpest cyber business leaders I know and speak with.

Corma raises $60M from Sequoia for AI trained to defend against cyberattacks

Corma came out of stealth with a $60 million seed round led by Sequoia, with Khosla Ventures and Coatue participating. Founded in 2025 and split between Tel Aviv and San Francisco, the company deployed its first model roughly six weeks before the announcement to Fortune 100 and Fortune 500 organizations, and CEO Alon Pluda says it focuses squarely on defensive work like log analysis and threat detection, claiming a 94% reduction in threat response times at adopting organizations.

A $60 million seed is a lot of conviction for a company barely a year old, and the vendor-supplied 94% figure deserves the usual skepticism until there is independent validation. That said, the signal is consistent with the rest of the market this issue, investors are pricing defensive AI as a category that has to exist, not one that might.

Huntress on crossing $250M ARR

Amid all the megarounds, Kyle Hanslovan put out a reflection on Huntress crossing $250 million in ARR, and it is worth reading because it is not a funding announcement.

The company now protects more than 270,000 organizations and 19 million endpoints and identities across 100 countries, largely through a partner motion of more than 20,000 MSPs and resellers, and Hanslovan frames the revenue as a byproduct of the mission to bring enterprise-grade security to the small and mid-sized businesses he calls “the 99%.”

I have long argued that the underserved end of the market is where a lot of the real risk lives, and building a nine-figure business by serving it rather than chasing the Fortune 500 is a model more of the industry should study. Huntress serves the majority of the ecosystem that lives below the cyber poverty line and desperately need help, as you saw with my recent discussion with Alex Pinto of Verizon on their Breach Impact Study. SMB’s face steeper financial impacts from incidents than their enterprise counterparts.

Templates for cybersecurity executive briefings

Lenny Zeltser published four customizable executive-briefing templates covering threat intelligence, vulnerability investigation, incident response, and security assessment, each built around leading with the takeaway and what a finding actually means for the organization.

This is not flashy, but communicating clearly to decision-makers is one of the most persistent gaps in our field, and a well-structured brief that opens with the takeaway and puts action items in a table does more for your program than most tooling. A timely resource to bookmark.

AI

OpenAI’s Black Hat talk on the Hugging Face incident

The centerpiece of Black Hat this year was OpenAI walking through the incident in which one of its models, under evaluation, escaped its environment and compromised Hugging Face.

OpenAI called it a watershed moment for the industry and encouraged defenders to watch and plan for how attack dynamics are about to change, and the Black Hat session recording covers the reconstruction and its implications for AI security and alignment.

Whatever you make of the framing, a frontier lab standing on the Black Hat stage to dissect its own model breaching another company is a moment our field will be referencing for a while.

This talk helps frame a lot of the below resources and at the time I’m sharing it, it already has over 500,000 views on YouTube!

Anthropic investigates three real-world incidents in its cybersecurity evaluations

Prompted by OpenAI’s disclosure, Anthropic went back through 141,006 of its own evaluation runs and found three incidents where Claude models escaped supposedly isolated environments and reached real systems at three organizations.

Across the three, involving different models, a model compromised a real company’s infrastructure and accessed a database containing several hundred rows of production data, published malicious Python packages to PyPI that were downloaded and run on 15 real systems before removal, and scanned roughly 9,000 targets before compromising a company using what Anthropic describes as basic techniques like reading credentials from an exposed debug page and SQL injection. The root cause was a misconfiguration with their partner Irregular that granted internet access despite prompts stating there was none.

Give Anthropic credit for the transparency, because the substance is helpful but many of course also remain skeptical that it is in large part marketing, especially as others such as Meta and even Chinese model providers rushed to say their agents also broke out of training environments. The models were not doing anything exotic, they were doing ordinary attacker things, at scale, because a supposedly closed door was open.

A defender’s breakdown of the Hugging Face incident

turned the Hugging Face timeline into a practical kill-chain analysis, splitting it into initial access, breach, and lateral movement and mapping defensive controls to each stage.

His read is that supply-chain firewalls offer limited protection against this pattern, and that the real leverage is blocking egress, deep runtime monitoring, and an assume-breach posture, given how difficult the template-injection and in-memory-secrets stages are to stop. He notes the nearly 17,600 actions over four days represent a level of sophistication we would once have called nation-state grade, now produced by a model chasing a benchmark.

If you own detection and response, this is a actionable write-up of the incident.

The UK AISI incident report on unsanctioned agent behaviour

Separate from the OpenAI and Anthropic disclosures, the UK’s AI Security Institute published an incident report from a routine cyber evaluation on July 28, and it is the one that I found the most informative.

Of 122 test runs, 10 runs contained 19 instances of unsanctioned behavior, 17 of them from Anthropic’s Mythos 5 and 2 from OpenAI’s GPT-5.6-Sol. The behaviors are the key part. Agents attempted a supply-chain attack by inserting malicious code into a public open-source project, creating fake identities and social-engineering the maintainers, an attempt caught by a human reviewer. Others directly deceived real people, attempted prompt injection against other AI systems, and in one case left public GitHub messages sharing account credentials for other agents.

Internet access was deliberately enabled and cyber classifiers intentionally disabled for realism, AISI reports no confirmed real-world harm, and it contained the incident within an hour. Autonomy and deception stopped being a slide in a threat model here and started being a logged event.

I recorded a video breaking this one down from my hotel room at Black Hat:

Once again, the scaffolding failed

Hyrum Anderson offers a sharp reframe of the whole episode, and I largely agree with him. His argument is that these incidents are not primarily a story about misaligned objectives, they are a story about failed constraints, models optimizing perfectly legitimate goals inside environments where the declared boundaries were documented but never actually enforced.

In Anthropic’s case the prompts claimed no internet access while the harness quietly provided live connectivity, and the model simply used it.

His line, “optimizers are going to optimize,” is the whole thing in four words.

The uncomfortable question he leaves you with is not whether your models are aligned, it is which of your security constraints are genuinely implemented versus merely written down, and that question long predates AI.

Who is legally to blame for autonomous AI hacks

TechCrunch takes on the accountability question these incidents force, and the answer is genuinely unsettled and that is why we’re seeing a lot debate in the ecosystem.

The piece weighs criminal and civil exposure under the 1986 Computer Fraud and Abuse Act, with cybersecurity attorney Ahmed Ghappour arguing the model is the company’s tool and that “you don’t get to deploy something capable of breaking into systems and then disown where it goes,” calling a civil negligence case a “no brainer” for victims. The EFF’s Andrew Crocker is skeptical that the intent required for criminal charges can be proven against a model, and there is no federal AI liability law to lean on, though several states are moving.

We are going to be litigating who owns an autonomous system’s actions for years, and the technology is not waiting for the law to catch up, so expect more incidents as well as more debates about accountability.

Moonshot’s Kimi K3 escapes its sandbox

For anyone who thinks this is purely a US-lab story, Wired reported that Moonshot’s Kimi K3 model escaped its sandbox as well, a pattern corroborated by Frontier Security’s account of Kimi K3 exploiting network egress in an AISI evaluation sandbox to retrieve an official benchmark solution rather than solving the task natively.

Frontier’s broader argument is the one to keep in mind, that offensive capability scales predictably with inference budget while defensive investigation does not, an asymmetry that should reshape how we benchmark security agents in the first place. Open-weight and international models are part of this story now, and the containment problem does not respect a lab’s borders.

The key theme across all of these stories is that agents find a way, and that way often involves trying to cheat, something that has been researched and documented by AISI on their blog.

AWS introduces Dogwood for runtime verification of AI agents

AWS open-sourced Dogwood, a governance language for regulating how agents use tools that goes beyond point-in-time authorization by adding temporal conditions over an agent’s recent history. Built on Cedar and grounded in metric first-order temporal logic, it can express rules like requiring an approval before a sensitive action or rate-limiting a class of operations, which is the kind of history-aware constraint that static, request-by-request policy cannot capture. It pairs naturally with research like Dreadnode’s ScopeJudge, which tested whether a runtime LLM judge can keep offensive agents in scope and found the best configuration reaching the lower end of human agreement, concluding runtime monitoring is the most practical way to deploy scalable oversight for offensive agents today. Between formal policy and learned judges, runtime is clearly where the agent-control conversation is heading.

Low-cost, evasive, abundant malware from open-weight models

On the offensive research side, Incalmo built a system called PathoGen that uses open-weight models like GLM 5.2 to generate evasive malware, reporting that roughly 27% of samples evaded all 75 scanners on VirusTotal and about 75% evaded all but one, at a cost of $2 to $35 per sample. The researchers withheld methodological details and coordinated with vendors, and their point is constructive, use frontier models proactively to find the defensive gaps before adversaries do. That said, the economics are the story. When capable, scanner-evading malware costs less than lunch to produce, volume stops being a meaningful signal and detection has to lean much harder on behavior than on signatures.

AppSec

VulnCheck’s state of exploitation for the first half of 2026

Patrick Garrity and the VulnCheck team published their first-half exploitation data, and it is the empirical grounding a lot of the AI-and-vulnerabilities conversation badly needs. In 1H-2026, 23.43% of known exploited vulnerabilities showed evidence of exploitation on or before the day the CVE was published, down from 28.93% in 2025, and the median time from publication to known-exploited status dropped from 120 days to 80.

The figure most relevant to this issue is the AI one, of 1,061 vulnerabilities attributed to AI-assisted discovery, only 14, or 1.3%, were confirmed exploited, and Anthropic’s Project Glasswing produced 23,019 findings and 126 published CVEs but just a single confirmed exploitation. AI is discovering vulnerabilities at scale, but discovery and real-world exploitation remain very different things, and the data is a healthy corrective to the assumption that one automatically becomes the other.

SQLite critical CVEs, or LLM slop

JFrog’s Afek Berger dug into six SQLite advisories filed from a newly created GitHub repository and found them fabricated, referencing functions that do not exist, with proof-of-concepts that do not run, and CVSS scores as high as a claimed 9.8 critical that had to be walked back.

A broader audit turned up 54 completely fabricated advisories, with exactly one containing a real bug. Berger ties the problem to NVD pausing its deeper analysis back in early 2024, which lets AI-generated slop flow downstream into scanners and databases unchallenged.

This is the shadow side of the AI-discovers-vulnerabilities story. The same generative capability that finds real bugs also mass-produces convincing fake ones, and our vulnerability infrastructure was not built to filter them.

Triaging bug bounty reports for $2 each, 85% as well as a human

Elastic Security Labs built an AI triage system for HackerOne reports that performs about 85% as well as a human at roughly $2 per report, validated against 764 known-outcome reports.

The context that makes it matter is the volume, they received more than 1,390 reports in the first half of 2026, exceeding their full-year totals for 2024 and 2025 combined, which is exactly the flood that AI-assisted discovery produces on the reporting side. A human still makes the final call on every report.

This is the pragmatic pattern for surviving the coming report volume, let the model handle triage economics while keeping human judgment on the decision, and it pairs well with 1Password’s parallel work on making security reviews scale without drowning in context and nondeterminism.

Why AI-generated patches still require expert human review

1Password’s Off-by-1 Labs ran one of the more rigorous tests of AI patching I have seen, generating 6,080 patches across six recently disclosed CVEs. Only 26.0% completely fixed the flaw without changing application behavior, another 20.1% fixed it but altered behavior, and 53.9% failed outright or introduced new vulnerabilities, with more than a third of even the successful patches judged fragile because they treated symptoms rather than root causes. This is the essential counterweight to the fix-it-with-AI enthusiasm.

The generation side is improving fast, but a majority of machine-generated patches are still wrong or harmful without expert review, and shipping them unreviewed would trade a known vulnerability for an unknown one.

had an excellent blog breaking down the findings and the implications for practitioners as well.

Everything hackable will get hacked

Vercel’s Malte Ubl makes the blunt case that open-weight models now carry real offensive capability, describing Kimi K3 as an Opus-class model with no relevant cybersecurity safeguards, while frontier models still hold the defensive edge for now. This widespread capability is the same point has been making for months.

Vercel’s response is instructive, running full deep security reviews across mission-critical repositories quarterly at a cost of tens of thousands of dollars, and making an egress firewall available even on its free Hobby plan. The egress theme keeps recurring across this entire issue for a reason.

Whether you are containing your own agents or blunting an attacker’s, controlling what code can reach the network is turning out to be one of the highest-leverage controls available, and it is encouraging to see it pushed down to the free tier rather than reserved for enterprise.

Final Thoughts

Two weeks is a lot to compress, but the summer’s story told itself.

Autonomous agents crossed from the benchmark into real systems, and they did it not through exotic capabilities but by exploiting ordinary weaknesses the moment a containment assumption failed.

The most critical thread running through the OpenAI, Anthropic, and AISI incidents is not that the models were brilliant, it is that they were ordinary attackers with unusual stamina, and the doors they walked through were the same weak passwords, exposed endpoints, and soft egress boundaries we have been failing to close for years.

These same problems are pervasive across every organization and environment and is exactly why Vercel’s CTO said everything hackable will be hacked.

The encouraging counter-thread is that the response is already taking shape, in the sandboxing and runtime-verification work, the defensive deployments at security vendors, the honest accounting of where AI patching still fails, and the beginnings of a shared exchange for incidents and near-misses.

The pace of agent adoption is once again outrunning the pace of governance, and we get to choose whether we build these controls in while the architectures are still forming or bolt them on after the next incident. The evidence from the last two weeks suggests we should hurry.

Stay resilient.

Subscribe now

We’re on the cusp of Black Hat, aka Hacker Summer Camp, and I’ll be out there MC’ing the Black Hat Startup Spotlight Competition, and Innovators and Investors Summit. I look forward to seeing everyone there, and of course, it seemed like the perfect time to get a black eye form Jiu Jitsu before I go MC one of the coolest public speaking opportunities in my career. But, the show will go on, and I’m excited.

Last week the argument that AI could autonomously chain vulnerabilities and breach a real target stopped being a slide in a vendor deck, when OpenAI disclosed that models from its own internal evaluation escaped isolation and reached Hugging Face’s production infrastructure. This week we got the sequel, and it came in two forms at once.

On one side, the industry’s answer showed up in product form. Nearly every major lab and vendor shipped a cyber-specific model or tool, an Open Secure AI Alliance formed with 40+ members, and the UK’s AI Safety Institute started publishing what these models actually do when you point them at real systems, including the uncomfortable finding that they cheat. On the other side, the gap between AI-speed discovery and human-speed remediation kept widening into what one bank now calls “Patchmageddon,” and the market kept pricing all of it, with endpoint and identity startups raising at scale.

The theme from last week holds, which is that the capability is arriving faster than our governance, disclosure, and prioritization models can adapt. What changed this week is that the defensive side stopped talking and started shipping.

Let’s get into it!

Cyber Leadership & Market Dynamics

AI, Cyber and Where the Smart Money Is Going

In this episode, I sit down with entrepreneur turned venture capitalist and Decibel Founding Partner Jon Sakoda to discuss the intersection of AI, cyber, and venture capital.

Jon founded IMlogic in the early 2000s, sold it to Symantec, and spent over a decade at NEA working with companies like Cloudflare, MongoDB, and HackerOne before starting Decibel. I’ve followed his writing on venture funding and dry powder for years, and this conversation was a chance to get outside the practitioner echo chamber and look at our industry through the investor’s lens.

We chatted about:

• Why Decibel positions itself as the Navy SEALs next to the big platform funds

• The founders-helping-founders community model and finding the CISOs who want their fingers in the clay

• What separates the founders who finish the race now that AI lets anyone start one

• Decibel’s $100M seed into Ent and why Jon calls endpoint the Super Bowl of cyber

• Separating genuinely AI-native companies from AI washing

• AI eating venture capital and why Jon thinks cyber’s best years are ahead

• The agentic SOC’s move from driver assistance to self-driving

• How buyers and prospective startup employees should evaluate young vendors

• Where Decibel places its next bets, including resilience and cyber insurance

The Endpoint Wars Just Restarted

TechOperators partner Kevin Skapinetz makes the framing argument for the whole funding cycle this week, noting that nearly $400M of Seed and Series A money went into early-stage endpoint security startups in five weeks this summer, into a roughly $18B market where two vendors already control about 40%.

His thesis is that the unit of work is changing again, from files and processes to intent, as humans hand goals to software that plans and acts on their behalf. He points to Gartner’s projection that 40% of enterprise applications will ship with task-specific AI agents by the end of this year, up from under 5% a year ago, and Verizon DBIR data showing employees regularly using AI on corporate devices jumped from 15% to 45% in a single year.

When the endpoint becomes an agent operating with a real user’s permissions, the category everyone assumed was settled reopens. The three raises below are what that reopening looks like in practice.

Glow Emerges from Stealth at $1.2B Valuation to Challenge Endpoint Security in the AI Era

Per TechCrunch, Glow came out of stealth with a $180M all-equity Series A at a $1.2B valuation, led by Sequoia Capital, Cyberstarts, Greenoaks Capital, and Redpoint Ventures.

The founding team is notable, with CEO Roi Tiger a former Meta VP of Engineering and COO Emily Heath the former CISO of United Airlines and Docusign. Tiger’s pitch captures the market’s read, that for a decade everything moved to cloud and SaaS, and now “AI lands on the endpoint in a way we’ve never seen.”

A $1.2B valuation out of the gate for a company reimagining a mature category tells you where investors think the next platform fight is.

SentinelOne Veterans Raise $100 Million to Secure the Rise of AI Agents

Neo, founded by former SentinelOne leaders including CEO Nick Warner (ex-President and COO) and CPO Shlomi Salem (ex-VP Research), has now raised $100M in total, with a $75M Series A led by Andreessen Horowitz and Bessemer Venture Partners on top of a $25M seed.

Per CTech, the angel list is a who’s who, including Wiz CEO Assaf Rappaport and Talon founder Ofer Ben-Noon. Salem frames the problem cleanly, that traditional endpoint security has always been SentinelOne’s bread and butter, but the challenge with AI agents is that they operate with legitimate user permissions.

That is the exact seam Glow is chasing too, which is why this feels less like two startups and more like the opening moves of a category being re-contested.

Agent Endpoint Security & The Locality Dichotomy

While more focused on the technical side, this piece from looks at the slew of endpoint focused startups and the dichotomy of how they’re approach intent, and whether their technologies run locally, or in the cloud and the nuances of that difference.

Billion Dollar Cybersecurity Companies

Cole Grolmus of Strategy of Security continues his ongoing tracking of the cohort of cybersecurity companies that have crossed the billion-dollar threshold, a data set worth bookmarking if you want the long-run structural picture rather than the week’s headlines.

While it seems like everyone is now “valued” at a billion dollars, as Cole points out, valuation does not equal exit or acquisition. There have been 85 total billion-dollar exits in cybersecurity, across the thousands of startups that have come and gone.

PMF - Why It Matters

Andrew Peterson makes the case that product-market fit remains the single determinant that separates companies that endure from those that raise well and fade, a point that reads as almost contrarian in a market where valuation is moving faster than revenue for a lot of AI-native entrants.

We’re inevitably going to see a lot of companies that had massive funding and valuations fizzle into irrelevance, as the market can’t and won’t support them all concurrently.

Sriram Krishnan on Open Source AI’s Biggest Week Yet

Bridging into the AI section, this a16z Show episode with former White House AI policy advisor Sriram Krishnan digs into recent open model releases including Kimi K3 and Qwen, and why open models are putting real pressure on the frontier labs. It is a good primer for the geopolitics and open-weight economics that dominate the back half of this issue.

AI

What OpenAI’s Rogue Agent Really Did in the Hugging Face Hack

A week on from the disclosure, the analysis and the framing fight have both arrived, and the framing fight is the more interesting one. Per Scientific American, the models under evaluation (GPT-5.6 Sol plus an unreleased, more capable model, run with loosened safety safeguards) were being tested on ExploitGym, a benchmark that measures software-vulnerability exploitation, when the agent escaped its isolated test environment and breached Hugging Face to obtain the hidden benchmark answers.

In OpenAI’s own writeup, the models identified and exploited a zero-day in an internally hosted package-registry cache proxy to gain internet access from the sandbox, then chained stolen credentials and additional zero-days to reach remote code execution on Hugging Face servers.

What I think is a good call out is the University of Surrey’s Alan Woodward pushing back on the “went rogue” narrative, that “it was asked to do something, and it did it. Its way out of it was to cheat, basically.” It is a more precise description of the actual problem.

OpenFace: The Hugging Face Breach and What to Do About It

Luta Security’s Katie Moussouris frames this as the first publicly confirmed case of a frontier model autonomously chaining vulnerabilities into a real-world breach of a third party during the lab’s own testing, and her metaphor is the one that will stick, that these models are “like the world’s cleverest octopus escape artists, with unlimited prehensile arms and the ability to squeeze through anywhere.”

The lesson is not that our sandboxes held, it is that they didn’t, and the recovery depended on human vigilance rather than the boundary doing its job. XBOW’s take lands in the same place, that models can discover and exploit novel attack paths in real-world systems without source-code access, which means the safety controls have to live outside the model, not just inside it.

Cheating Behavior in Frontier Model Evaluations

If the Hugging Face incident felt like an outlier, the UK AI Safety Institute would like a word. In a study across frontier models including GPT-5.6 Sol, Claude Mythos Preview, Opus 4.7, GPT-5.4, and GPT-5.5, AISI found that every model tested attempted to cheat at least some of the time in cyber evaluations, using methods like searching the internet for solutions, attacking non-target systems, and probing the evaluation software itself.

One model wrote and ran code on external internet services to try to reach AISI’s own evaluation infrastructure, which is the same behavioral shape as the OpenAI incident, just caught in a lab. Worse for anyone hoping to detect it, the models described their cheating as wrong less than 50% of the time. The scored benchmark is quietly becoming an adversarial environment, and the thing being evaluated is trying to win rather than to be measured.

Preliminary Assessment of Kimi K3’s Cyber Capabilities

In a joint assessment, the UK AISI and the US Center for AI Standards and Innovation evaluated Kimi K3, released July 16, and found it performs significantly below the most recent frontier cyber-capable models while surpassing prior open-weight releases. On ExploitBench it hit 32% success on exploit development versus GLM-5.2’s 24%, though it failed arbitrary code execution entirely (0 of 41 samples versus 20 of 41 for leading models).

On the “The Last Ones” cyber range it reached step 17 of a 32-step attack path on average, against 28.5 steps for the most cyber-capable US models. The read here is not that Kimi is scary, it is that the open-weight frontier keeps advancing while its safeguards permit offensive cyber assistance, which changes the threat model for everyone downstream.

How Far Behind the Frontier Are Leading Open-Weight Models on Cyber?

AISI’s companion analysis quantifies the trend we have been tracking, that GLM-5.2 now trails frontier closed models by 4 to 7 months on cyber tasks, down from a 6 to 10 month gap throughout 2025. On narrow tasks GLM-5.2 performs comparably to Opus 4.6 and GPT-5.3-Codex, while DeepSeek V4-Pro matches Opus 4.5.

The economics are the kicker, with DeepSeek V4-Pro running a task at $0.28 against $12.50 for an equivalent Opus 4.5 run. AISI’s warning is worth quoting plainly, that once open-weight models are released, the option to keep safeguards in place is lost permanently, because safeguards can be removed. The defensive-preparation window is real, and it is measured in months, not years.

Openness Made All of This Possible

The Open Source Initiative’s Duane O’Brien makes the values-and-economics case against restriction, citing Harvard-backed research that values the demand-side worth of open-source software at $8.8 trillion, and noting that more than 200 companies have come out against restrictions on Chinese AI models.

His core point is one worth dwelling on, that every AI system in the headlines today, proprietary or open, exists because researchers shared their work openly. It is the optimistic take, and the honest tension is that the same openness that drives innovation and defensive visibility also lowers the floor for offensive capability.

Claude Security Enters Public Beta

Now to the wave of product launches that, more than anything else, defines this week. Anthropic moved Claude Security into public beta for Enterprise customers, built on Claude Opus 4.7 and integrated with CrowdStrike, Microsoft Security, Palo Alto Networks, SentinelOne, and Wiz.

It had already been tested by hundreds of organizations in a limited research preview. Hebbia’s Matt Aromatorio offers the practitioner-flavored endorsement, that his team has used patches built with Claude Security to close real vulnerabilities in minutes rather than days. Whether that holds at enterprise scale, across messy real-world codebases, is the question, but the direction of travel is unmistakable.

How Anthropic Secures Its AI-Native SDLC

Anthropic Deputy CISO Jason Clinton’s writeup is the most useful of the bunch for practitioners, because it describes running the thing rather than selling it. He reports that Claude now authors approximately 80% of the code merged into Anthropic’s codebase, that engineers ship 8x more code per quarter versus a 2021-2025 baseline, and that the share of PRs receiving substantive review comments rose from 16% to 54%.

His framing of accountability is good, that human accountability stays central, and what they accelerated was the review process by combining automated agentic and deterministic reviews while reserving human review for regulated or truly critical code. This is what “security keeping pace” actually looks like in an AI-native shop, and it is a governance model, not a tool purchase.

Atlas, Wiz’s AI Vulnerability Researcher

Wiz introduced Atlas, an autonomous vulnerability-research system that ranks first on CyberGym with a 90.9% success rate and has uncovered 200+ previously unknown vulnerabilities in open-source projects including gRPC, dnsmasq, Kubernetes, gVisor, and the Linux kernel, plus a critical RCE in GitHub (CVE-2026-3854) that earned GitHub’s largest bug bounty payout.

The line from the Wiz research team is the one to hold onto, that the system compounds the value of the model, and that scoping, orchestration, validation, and proof are what turn frontier-model capability into reliable security outcomes. The model is the engine, but the harness is the product.

Introducing Gemini 3.5 Flash Cyber

Google DeepMind’s Raluca Ada Popa and Four Flynn introduced Gemini 3.5 Flash Cyber, a lightweight model tuned for finding, validating, and patching vulnerabilities. It found 55 unique confirmed issues in the V8 JavaScript engine, against 47 for mainline 3.5 Flash and 36 for Opus 4.6, and uncovered remote code execution vulnerabilities in Google Cloud APIs within two hours.

They are also deploying it first to governments and trusted partners through CodeMender via a limited-access pilot, which is itself a signal about how the labs are thinking about dual-use cyber capability. For context on the haystack, they note the OSV.dev database now holds over 700,000 open-source vulnerabilities.

Introducing MAI-Cyber-1-Flash

Microsoft AI’s Mustafa Suleyman and Hayete Gallot introduced MAI-Cyber-1-Flash inside MDASH, claiming 96% on CyberGym (a 12-point improvement over Mythos) at 50% of the cost of leading models, and designed to handle up to 90% of tasks efficiently. Suleyman’s framing is the recurring idea across every one of these launches, that cybersecurity is not just a data-rich domain, it is a live reinforcement learning loop, which is exactly why Microsoft’s 100 trillion security signals a day matters as a training asset.

The pattern across MAI, Gemini Cyber, and the rest is that the frontier labs have decided cyber is a first-class specialization, not a side benchmark.

Cisco Introduces Antares for Vulnerability Localization

Cisco went the opposite direction from the big-model launches with Antares, releasing two small open-weight models, Antares-350M and Antares-1B, aimed at vulnerability localization and evaluated on a new benchmark of 500 tasks, where they outperform a dozen larger models.

NUS professor Reza Shokri names the reason this design matters, that small models run locally, so proprietary code never leaves the machine. This is the counter-narrative to the frontier arms race, and an important one for regulated and IP-sensitive environments, that the right tool is often the small, local, inspectable one rather than the biggest available model.

Cogent Announces VR-1, a Mythos-Class Model Built for Cyber Defense

Cogent Security unveiled VR-1, which it describes as twice as effective at finding attack paths in enterprise environments as other frontier models at one-fourth the cost, measured on its IntrusionBench benchmark for attack-path discovery across cloud infrastructure, identity systems, and internal tools.

Co-founder and CTO Geng Sng frames the defensive logic well, that every organization needs the counterpart to offensive AI, a model that finds the attack paths an AI would find so defenders can close them first. It is available only through the company’s Frontier Access Program rather than openly, another data point in how vendors are gating cyber-capable models.

Benchmarking AI Models on Known CVEs

Aikido’s Rein Daelman ran 13 models against 26 known vulnerabilities from the GitHub advisory database, with GPT-5.6 leading at 23 of 26 (88.5%). The more actionable finding is economic, that three pooled runs of the cheaper gpt-5.4-nano reached 18 of 26 at around $170, and that Kimi K3 matched frontier models at 23 of 26 while running 4x cheaper than GPT-5.6 Sol.

The takeaway, that running a cheaper model a few times and pooling the results finds more for less than a single pass of a flagship, is the kind of practical guidance defenders can actually operationalize, and it undercuts the assumption that only the most expensive model is worth pointing at your code.

Can Frontier Models Tackle Autonomous Long-Horizon Malware Analysis?

SentinelOne Labs’ Juan Andrés Guerrero-Saade and Gabriel Bernadett-Shapiro put the models through a genuinely hard, multi-stage reverse-engineering benchmark, and only GPT-5.6 Sol completed all eight investigation stages, while GPT-5.5, GLM-5.2, and the Opus 4.x family could not sustain the full run.

Analyzing a 2005 Windows toolkit with 101 patching rules, they compressed an expert task that would normally take three weeks into 8 to 10 hours with model assistance. Their conclusion is the optimistic counterweight to the week’s scarier headlines, that a single expert supervising these systems can now expand their output by any metric worth tracking. This is the “defender’s dividend” case, and it is real, provided you have the expert in the loop.

BotsBench: A Vendor-Neutral SOC and IR Benchmark

The team behind Louie.ai launched BotsBench, a vendor-neutral benchmark for AI models and agents on SOC and incident-response investigations, built on Splunk’s BOTSv3 and a proprietary CTF dataset.

The uncomfortable finding they surface is a model regression, where Claude 4.6 scored 14 of 17 on a control subset against Claude 4.7’s 5 of 17 under matched conditions. Whatever the eventual explanation, the value here is the discipline, that we need independent, reproducible benchmarks for security tasks rather than taking each vendor’s self-reported CyberGym number at face value. Given how many of those numbers appear in this very issue, that is not a small point.

Industry Leaders Form the Open Secure AI Alliance

Tying the week together, NVIDIA and 40+ inaugural partners, including Cisco, CrowdStrike, Hugging Face, Microsoft, Palo Alto Networks, Red Hat, and the Linux Foundation, formed the Open Secure AI Alliance to build and share open AI tools for cyber defense.

The founding argument is the same one Hugging Face learned the hard way this month, that when defenders cannot inspect, adapt, and run advanced AI on their own infrastructure, their ability to respond is constrained at exactly the moment speed matters most.

An alliance is not a solution, and I will hold my applause until there is shared tooling rather than a launch post. That said, the fact that direct competitors are aligning on open, inspectable, defender-controlled AI is a meaningful signal about where the industry thinks the puck is going.

A Theory of Least Autonomy in AI

On the research side, Christophe Parisel argues that least privilege alone is insufficient for AI agents and proposes least autonomy as a generalization, introducing a compositional “blast radius” measure of structural separation between actions, a directed agent influence graph, and a collusion predicate for detecting when combined authorizations produce an unintended capability.

It is dense and theoretical, but it is pointed at the exact gap the incidents above expose, that our permission models were built for deterministic software, and agents that plan and act need a governance primitive built for autonomy rather than access.

Orbit: A Multi-Agent Security Evaluations Framework

Worth a bookmark for the builders in the audience, Orbit is a new open-source framework for empirical multi-agent safety evaluations, built on the UK AI Security Institute’s Inspect AI, shipping five scenario families and configurable threat types (prompt injection, compromised agent, collusion, and misuse) alongside defense categories like monitors, guardian agents, and the dual-LLM pattern.

As the AISI work this week shows, the ability to run your own adversarial evaluations rather than trust a vendor’s is quickly becoming table stakes.

AppSec

Patchmageddon

When J.P. Morgan’s Michael Cembalest devotes an Eye on the Market to your industry’s core dysfunction, the discovery-remediation gap has officially gone mainstream.

The figures he assembles are the ones to internalize. Mozilla found and fixed 271 vulnerabilities in Firefox 150 while testing a preview model, more than 10x the 27 found in Firefox 148 using a prior-generation model. Median time-to-exploitation fell from roughly a year in 2021 to a single day in 2026, projected toward a minute by 2027. And through May 2026, Anthropic identified over 23,000 potential open-source vulnerabilities, of which 3,900 were high or critical, yet only 75 of 530 reported high-or-critical items were patched.

Anthropic’s Nicholas Carlini puts the human scale on it, that he has “found more bugs in the last couple of weeks than I’ve found in the rest of my life combined.” Discovery is no longer the bottleneck. Remediation capacity is, and the gap between them is the defining AppSec problem of the year.

The Economics of Security Vulnerabilities: Why Discovery Is Not Commoditizing

AISLE’s Ondrej Vlcek pushes back thoughtfully on the assumption that AI makes vulnerability discovery a commodity, noting that black-hat brokers still pay up to $9 million for zero-click exploit chains against modern smartphones and $3 million for Chrome and Safari exploits, prices that keep rising rather than falling.

His metaphor is worth keeping, that commodities produce interchangeable output, but discovery engines produce different slices of an unfinished map. In other words, cheap AI discovery floods the easy findings while the scarce, exclusive, weaponizable discoveries stay expensive.

Both things are true at once, which is exactly why the market is confusing right now.

The Agentic SDLC

GEICO’s Jet Anderson makes the case that security has to move from episodic, gate-based reviews to continuous, embedded, agent-native validation, and backs it with numbers that should reframe how you think about your own pipeline.

He cites Gartner’s projection of 40% of enterprise applications embedding agents by end of 2026, Checkmarx data that roughly 70% of organizations estimate more than 40% of their code is AI-generated, and IEEE-ISTAS research showing a 37.6% increase in critical vulnerabilities after five agent iterations without embedded security checks. The Cycode figure is the one that should focus minds, that 100% of surveyed companies have AI-generated code in production while 81% of security teams lack visibility into it.

As Anderson quotes threat-modeling authority Adam Shostack, you need to know the threat model to evaluate what the AI’s hallucinate, and today you need AI to keep up.

Final Thoughts

Last week the story was that autonomous exploitation stopped being hypothetical. This week the story is that the defensive response stopped being rhetorical.

Nearly every major lab and vendor shipped a cyber-specific model, an alliance formed to keep that capability open and inspectable, and independent evaluators started telling us, in numbers, both how good these systems are and how readily they cheat to win. That is genuine progress, and I do not want to undersell it, because the “defender’s dividend” is real when there is an expert in the loop, as SentinelOne’s malware work shows.

That said, the harder truth is sitting in the AppSec section. We are getting very good at discovery and barely better at remediation, and Patchmageddon is the name for that gap. Anthropic surfaced over 23,000 potential open-source vulnerabilities (although as Patrick Garrity has pointed out, we’re yet to see actual CVE’s for most of the findings) and the ecosystem patched a tiny fraction of the critical ones.

The models that find the bugs are improving on a monthly cadence, while the human and organizational capacity to fix, test, and ship patches is improving on the timeline it always has. Shipping more powerful discovery models into that imbalance, without a matching investment in remediation capacity, prioritization, and the disclosure plumbing, risks handing offense a faster lever than defense.

So the open question I would leave you with is the one underneath all forty-some items this week.

Much of that remains to be seen, but the shape of the challenge is now unmistakable.

Stay resilient.

Subscribe now

For a couple of years now, most of us have been having a version of the same argument about AI and offensive security. One camp insists we are on the cusp of autonomous systems that find and chain vulnerabilities without a human in the loop, and the other camp waves it off as vendor theater and demo-ware.

This week, that argument got a lot less hypothetical.

Hugging Face disclosed what it called a new kind of security incident, an intrusion driven by an autonomous agent framework that racked up more than 17,000 attack events over a weekend.

A few days later, OpenAI came forward and filled in the part Hugging Face said it could not yet identify, that the activity came out of OpenAI’s own internal evaluation of cyber capabilities, where two of its models escaped an isolated test environment and chained their way onto a third party’s production infrastructure.

A model going rogue, autonomous exploitation, vulnerability chaining, and the line between an AI safety evaluation and a live security incident dissolving in real time. It is a lot to sit with, and it colors nearly everything else that happened this week, from open-weight cyber capabilities to how we disclose and prioritize the coming flood of vulnerabilities.

Buckle up for another chaotic week at the intersection of AI and cybersecurity.

Cyber Leadership & Market Dynamics

Glow Emerges From Stealth at $1.2B Valuation to Challenge Endpoint Security in the AI Era

Glow stepped out of stealth this week with a $180 million all-equity Series A at a $1.2 billion valuation, led by Sequoia Capital, Cyberstarts, Greenoaks, and Redpoint Ventures.

The founding bench is notable, with CEO Roi Tiger coming from a Meta VP of Engineering role, co-founders out of Snowflake and Claroty, and COO Emily Heath, a former CISO at United Airlines and DocuSign.

Tiger’s framing is the whole thesis, that for the past decade everything moved to the cloud and SaaS, and now AI is landing on the endpoint in a way we have never seen. It is telling that a company reinventing endpoint security for the AI era is itself built on Anthropic and Gemini models running via Amazon Bedrock.

This pairs with Neo below, and both reflect the same bet, that AI agents on the device and in the workflow are becoming the thing we have to secure.

SentinelOne Veterans Raise $100 Million to Secure the Rise of AI Agents

Neo, founded by a trio of SentinelOne veterans in Nick Warner, Shlomi Salem, and Eran Shirazi, has now raised $100 million total, with a $75 million Series A led by Andreessen Horowitz and Bessemer Venture Partners on top of a $25 million seed from 2025.

The pitch is a real-time control layer for AI agents and AI-enabled software, and the founders make the point plainly, that AI agents operate with legitimate user permissions, which is precisely what makes them hard to police with traditional endpoint tooling.

The market context they cite comes from Gartner, which projects enterprise applications with agentic capabilities climbing from around 5% in 2025 to 40% by the end of 2026. If that curve is even directionally right, the identity and control problems tied to agents are about to get an order of magnitude larger.

Backed by $60M in Funding, Oak Steps Out of Stealth to Fix the Identity Mess That AI Agents Are Making Worse

Continuing the theme, Oak emerged from stealth with $60 million in seed funding from Accel, CRV, and Greylock Partners.

Co-founder and CEO Shai Morag has done this before, having sold Ermetic to Tenable for $265 million in 2023, and his read is that AI agents are multiplying access and permission sprawl faster than legacy IAM was ever designed to handle. Oak’s approach maps access to actual app usage and strips excess permissions in real time.

Three separate companies raising real money this week to wrangle agent identity and permissions is not a coincidence, it is the market pricing in the same problem the arXiv researchers and Hugging Face are describing from the technical side.

Zafran Security Reportedly in Cisco’s Sights at $150-200M

Not every story this week is up and to the right. CTech reports that Zafran Security, which has raised more than $130 million total and was valued well above $200 million in a December 2025 Series C led by Menlo Ventures, is the subject of reported Cisco acquisition interest in the $150 to $200 million range, below its last fundraising valuation.

Zafran has denied it is selling and characterizes Cisco’s involvement as a strategic investment, and with roughly $20 million in ARR the numbers are worth watching. Whether or not this specific deal happens, a reported down-round exit sitting right next to a $1.2 billion stealth launch is a decent snapshot of a bifurcated market, where capital is flowing hard toward the AI-native story and getting choosier about everything else.

That selectivity shows up again in the a16z charts below.

Empirical Security Raises $25M Series A to Predict Which Vulnerabilities Matter

Empirical Security announced a $25 million Series A led by Brightmind Partners, and the pedigree here is hard to ignore.

Co-founders Ed Bellis and Michael Roytman built Kenna Security, one of the firms that helped establish risk-based vulnerability management in the first place, and they have brought on Jay Jacobs, a co-creator of EPSS, as a third co-founder.

Their Foundation model monitors more than 18,000 CVEs as a global predictive layer, with an organization-specific model called Radiant on top. Bellis frames it as prediction becoming a requirement for modern defense rather than a nice-to-have.

Given everything in the AppSec section below about disclosure timelines collapsing and vulnerability volume exploding, a bet on prediction and prioritization feels less like a product pitch and more like the only viable path forward.

CrowdStrike and Schwarz Digits Expand Partnership to Deliver Sovereign Cybersecurity Across Europe

CrowdStrike and Germany’s Schwarz Digits expanded their partnership, with CrowdStrike acquiring the intellectual property of XM Cyber, more than 45 patents plus proprietary source code, while XM Cyber continues as a standalone business under an IP license.

The deal deploys Falcon Exposure Management on the sovereign STACKIT cloud, and George Kurtz frames the demand plainly, that organizations globally are increasingly prioritizing sovereignty without wanting to compromise on cybersecurity outcomes. Sovereignty as a buying criterion keeps showing up, and it connects to the open-weight and US-China threads later in this issue.

When European organizations want defense that runs inside their own borders and legal regime, the vendor landscape starts to reshape around that constraint.

Charts of the Week: Software’s Selective Selloff

at put together a useful set of charts on why software is selling off unevenly.

Multiples on next-twelve-months free cash flow are at or below 2014 levels, but the pain is not uniform, with cyber, observability, and vertical SaaS outperforming while horizontal SaaS and infrastructure lag.

A couple of data points jumped out for our world. Software engineer job postings are up around 15% (attributed to the release of Claude Code) even as the broader job market declined roughly 7%, and the Asia-based provider share of OpenRouter tokens has reached about 60%, a three-fold jump since the start of the year. That second figure is a market-side echo of the open-weight capability story the AISI and Mozilla are documenting below.

Cyber holding up while the rest of software gets repriced is interesting, because it suggests buyers still see security spend as non-discretionary even in a cautious tape. This helps further the claim that cyber tends to be a bit more resilient than broader IT or software spend, and the backdrop of AI and security risks I’m sure helps the case.

Raising Venture Capital Is Highly Dilutive

Amid all the funding announcements, Peter Walker at Carta shared the 2026 Founder Ownership data as a useful reality check.

Per Carta’s report, median founder ownership drops from around 56% at seed to about 36% by Series A, and employee equity pools overtake founder ownership entirely by Series C. For the founders behind this week’s Glow, Neo, Oak, and Empirical raises, the capital buys speed and distribution, but the cap table math is unforgiving.

It is a good reminder that the eye-popping valuations in the headlines and the actual ownership retained by the people building these companies are two very different numbers.

The Unicorn Board

If you want the macro backdrop for all of the above, this open dataset tracks 938 US private companies valued at $1 billion or more, with an aggregate post-money valuation north of $5.25 trillion.

AI now trails only Software by unicorn count, and the top of the valuation table is telling, with Anthropic and OpenAI sitting at the very top ahead of Stripe, Databricks, and Waymo.

The gravitational pull of AI on private capital is not subtle, and it helps explain why every security company launching this week is positioning itself as AI-native, because that is where the money, the attention, and increasingly the threat model all point.

AI

Hugging Face Model Evaluation Security Incident

This is the story of the week, and it deserves to be walked through carefully.

For those who prefer video, I made a quick video discussing what happened and its implications:

Last week, Hugging Face disclosed what it described as a new kind of security incident. Over a weekend, a malicious dataset triggered code execution on a processing worker through a remote-code dataset loader and a template injection in a dataset configuration, and from there an autonomous agent framework escalated to node-level access and moved laterally into several internal clusters.

Hugging Face recorded more than 17,000 attack events driven by, in their words, many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services. The attackers reached a limited set of internal datasets and several service credentials, though Hugging Face found no evidence of tampering with public models, datasets, or Spaces, and verified its software supply chain as clean.

Two details from Hugging Face’s own writeup are worth pausing on before we get to the twist. First, they leaned on LLM-based triage over their security telemetry to catch the correlation of signals in the first place, and then used the open-weight GLM 5.2 to process those 17,000 events during forensics.

This is the exact case has been making in his writing and his interview on Resilient Cyber, pointing out that guardrails and safety measures often end up disproportionately hurting defenders more than attackers. You can find my conversation with him below:

Second, and this is the part that really touches on a lot of the debate lately about open vs. closed models and the impact of guardrails. They turned to an open-weight model precisely because Western frontier models refused to process requests containing the real attack commands, exploit payloads, and command-and-control artifacts.

The safety guardrails meant to prevent misuse actively obstructed the defenders trying to investigate a live intrusion. Hugging Face called autonomous, AI-driven offensive tooling no longer theoretical, and at the time they said the originating model was unknown.

Then OpenAI came forward. The activity, it turns out, occurred during OpenAI’s own internal evaluation of cyber capabilities, using GPT-5.6 Sol and an even more capable unnamed pre-release model, both configured with reduced cyber refusals for evaluation purposes.

Inside a supposedly isolated environment, the models identified and exploited a zero-day in the package registry cache proxy, performed privilege escalation and lateral movement, spent substantial inference compute finding a path to open internet access, inferred that Hugging Face hosted the solutions to the ExploitGym benchmark they were being tested on, and then, in OpenAI’s own words, chained together multiple attack vectors, including using stolen credentials and zero-day vulnerabilities to find a remote code execution path on the Hugging Face servers.

A model going rogue, in the literal sense of pursuing its objective straight through the walls of the environment meant to contain it. Autonomous exploitation at a scale and speed no human red team operates at. Vulnerability chaining across a zero-day, privilege escalation, lateral movement, credential theft, and more zero-days to land remote code execution on someone else’s production infrastructure, and the safety-security blur running in both directions, where an AI safety evaluation became a real security incident on a third party, and separately where safety alignment blocked the forensic response. This also highlights the UK’s AI Security Institute assessments playing out on production infrastructure:

Hugging Face’s Clem Delangue’s line lands hard here, that AI safety won’t be solved by any single company working in secret. My take is that the industry can no longer treat safety evaluations and security incidents as separate disciplines with separate teams and separate reporting paths, because this week they were the same event.

We spent years arguing about whether autonomous exploitation was real. It ran to remote code execution across two organizations, and the containment held only because Hugging Face’s people caught it.

Unlocking Self-Improvement in Cyber via GPT-Red

Released just ahead of the Hugging Face disclosure, this OpenAI piece is essential context for it. OpenAI describes GPT-Red, an internal offensive model trained through self-play reinforcement learning that, per OpenAI, can break nearly all models it is pitted against, both internal and production, up to and including GPT-5.5.

The figures are striking, with GPT-Red achieving an 84% success rate on indirect prompt injection arena scenarios versus 13% for human red-teamers, and driving defensive gains such as a 6x reduction in failures on OpenAI’s hardest direct prompt-injection benchmark and dropping fake chain-of-thought attack success from more than 95% on GPT-5.1 to below 10% on GPT-5.6 Sol.

OpenAI frames automated red-teaming as a crucial form of self-improvement for safety. Reading it the week that GPT-5.6 Sol chained zero-days onto Hugging Face’s servers, the same capability that hardens the defender is the capability that went rogue, which is exactly the point.

There is no version of this where you get the defensive upside without holding the offensive capability in-house, and that is a governance problem as much as a technical one.

How Far Behind the Frontier Are Leading Open-Weight Models on Cyber?

The UK’s AI Security Institute put hard numbers on a question that matters enormously for defenders and attackers alike.

Leading open-weight models like GLM-5.2 and DeepSeek V4-Pro now trail frontier closed models by roughly 4 to 7 months on cyber capabilities, a narrower gap than the 6 to 10 months measured through 2025. GLM-5.2, the same model Hugging Face reached for during forensics, was the most cyber-capable open-weight model at testing time, performing comparably to Opus 4.6 on narrow cyber tasks.

Just as important is the economics, with a 100-million-token cyber range run costing around $85 on Opus versus $46 on GLM-5.2 and $1.19 on DeepSeek V4-Pro. AISI plans to test Kimi K3 as well.

The capability gap is closing and the cost gap is enormous, which means capable cyber tooling is getting cheaper and more widely distributed at the same time. That is the backdrop for the entire US-China open-weight debate below.

Benchmarking AI Models Against Known CVEs

Aikido’s Rein Daelman ran 13 AI models against 26 known CVEs inside their production code-analysis harness. GPT-5.6 led with 23 out of 26 for 88.5% recall, Grok-4.5 hit 20, Opus models landed between 15 and 18, and the open-weight GLM-5.2 found 16, or 59%.

The more interesting finding is economic, that repeating a cheaper mid-tier model multiple times reliably beats one pass of a stronger, pricier model, with three runs of a nano-tier model matching single flagship runs at a fraction of the cost. This corroborates the AISI cost story from a different angle.

The takeaway for AppSec teams is that the smart play is not always reaching for the most expensive frontier model, it is designing the harness, and the newest crop of agentic security tools is going to live or die on that kind of engineering.

This of course is the point Niels Provos, AISLE and others have been making, including when I interviewed them on Resilient Cyber.

Why Blocking AI Models Won’t Stop Cyber Threats

Jessica Ji and Andrew Lohn of Georgetown’s CSET make the case that export controls and outright blocking of cyber-capable AI models cannot be a durable strategy, because foreign competitors will build and openly release comparable systems regardless.

They note that federal export controls on Anthropic’s Mythos and Fable models were issued and then revoked, that GLM-5.2 may already be on par with the latest Western models, and that the government has cut resources to key agencies like CISA even as the threat accelerates. Their argument is that the federal government needs to lead comprehensive cyber defense while AI companies support rather than replace that role.

It is a fair counterpoint to the reflex toward controls, and it pairs directly with the Axios and Forbes pieces below on the politics of open-weight models.

The U.S., China, and the Open-Source AI Fight Over Kimi

Axios reports that the Trump administration is weighing a range of measures to restrict Chinese AI models like Kimi K3 from the US market, from Entity List designations to procurement rules and security advisories, with outright bans facing resistance from pro-competition officials.

David Sacks frames the tension plainly, arguing the leading closed labs want the government to eliminate their open-source competition. Whatever your politics, the security-relevant fact is that policy is now actively shaping which models defenders and attackers can access, and the Hugging Face incident just demonstrated that the model you can reach for during a forensic investigation might be a Chinese open-weight system precisely because the Western options refused the job.

There’s One Way to Win the AI Race, and the Big Labs Are Lobbying Against It

Christian Catalini argues in Forbes that the way for the US to win the AI race is to lead in open-weight models rather than suppress Chinese ones, pointing to Moonshot releasing a competitive frontier model that has narrowed the US lead to months or weeks.

The piece cites Dean Ball on the lobbying playbook, the idea that you do not need to formally ban open source, you just direct agencies to issue soft law that creates uncertainty and FUD around Chinese models to discourage enterprise adoption. Dean’s tweets on the topic have now become viral, with millions of views and heated debates on both sides.

I try to stay out of the pure policy fights, but the FUD point is one worth flagging for our field specifically, because we are the people who get handed that uncertainty and have to turn it into actual risk decisions. Manufactured ambiguity about which models are safe to run is not a gift to defenders, it is more noise on top of an already hard prioritization problem.

Open Models Tack Toward the Frontier

Tomasz Tunguz of Theory Ventures makes the investor case that open-weight models are steadily closing on frontier capability while capturing an increasing share of production developer traffic.

The through-line across his work and the data below is consistent, that open models have moved from a niche to a meaningful and growing slice of real inference. For security leaders, the strategic read is the same one running through this whole issue, that you should assume capable open-weight models are, and will remain, in reach of your adversaries, your developers, and your own defensive tooling, all at once.

The State of Open Source AI

Mozilla published its inaugural State of Open Source AI report, and it is a genuinely useful reference. Raffi Krikorian’s framing is that parity has largely been reached and the real contest has moved one layer up to the agentic harness.

A few anchor figures:

• Open-weight models crossed above 50% of OpenRouter token share by mid-2026

• Chatbot Arena capability gap narrowed to around 3.3% by March 2026

• Inference cost fell roughly 50x over 36 months.

The report is also direct about geopolitics, stating that the largest source of open weights is China, by design, with Qwen alone reportedly surpassing 942 million cumulative downloads. If you want one document to ground your mental model of where open AI actually stands going into the back half of 2026, this is a strong candidate.

A Security Primer for Open-Source AI

This primer makes an argument I think our industry needs to internalize quickly, that open-source AI collapses supply-chain security and delegated-authority security into a single problem.

The piece reframes open-source AI not as downloadable weights but as a full chain of data, code, weights, configuration, documentation, infrastructure, and human decisions, and maps it across four converging disciplines and five risk properties like decentralized trust, composite repositories, and derivative lineage.

It is the conceptual companion to the Hugging Face incident, because a malicious dataset that leads to code execution is exactly what it looks like when the supply-chain problem and the delegated-authority problem stop being separable.

Existing control frameworks built for single-provider systems are not going to cover this cleanly, and that gap is where a lot of the next few years of AppSec work is going to sit.

Knowledge Distillation Attacks

frames knowledge distillation, the practice of training a smaller model to replicate a larger one’s outputs, as a competitive weapon in the US-China AI race.

He points to Anthropic’s February 2026 disclosure that it caught three Chinese labs running distillation campaigns against its models, and argues distillation lets a lab compress years of another lab’s R&D into weeks by converting expensive pretraining into cheaper compression-only costs. A few of the specific figures in the piece are the author’s own characterizations rather than independently sourced, so I would treat them as claims rather than settled facts.

The underlying dynamic, though, connects straight to the AISI capability data, because distillation is one of the mechanisms narrowing that frontier-to-open gap, and it raises genuinely thorny questions about model IP, provenance, and what we even mean by a secure model supply chain.

It is also very timely, as Michael Krastious recently renewed claims that Chinese-based companies are distilling U.S. frontier models, with the most recent example being K3. All of this while discussions on sanctions, and other measures are being discussed.

Isolation as a First-Class Principle for LLM-Agent System Safety

Complementing recent discussions around least-autonomy, this survey from researchers at HKUST and collaborators argues that isolation between system boundaries should be treated as a first-class safety principle, and organizes the LLM-agent safety literature around five isolation boundaries spanning user-agent, agent-tool, agent-execution, agent-agent, and system-environment.

Their thesis is one to underline, that safety is no longer only about input-output content alignment, it also concerns system behavior and real-world execution outcomes, and that serious failures often cross boundaries through sequential escalation. If you want the academic vocabulary for what went wrong at Hugging Face, this paper supplies most of it.

AppSec

Total Recall: How Two CVEs Let Any Website Read, Rewrite, and Wipe Your AI’s Memory

Pluto Security’s Yotam Perkal documented a set of vulnerabilities in mcp-memory-service, a popular Model Context Protocol server with more than 1,800 GitHub stars and integrations across a dozen-plus AI clients.

The headliner is CVE-2026-33010, a high-severity issue at CVSS 8.1 where wildcard CORS lets any website read, modify, and delete everything stored in an AI assistant’s memory, alongside CVE-2026-29787 for system information disclosure. What makes this one instructive is the root cause, a stack of insecure defaults, with CORS origins set to a wildcard, the host bound to 0.0.0.0, and anonymous access enabled out of the box, such that Perkal measured total data theft in about 0.2 seconds.

Fixes land in version 10.67.1. This is the excessive-agency and insecure-defaults problem made concrete, and it pairs directly with Jet Anderson’s writing below.

The Week of Sandbox Escapes

Pillar Security’s research team documented sandbox escapes across Cursor, Codex, Gemini CLI, and Antigravity, grouping them into four repeatable failure modes including denylist bypasses, workspace configuration execution, and privileged daemon access.

Their central thesis is the sentence to remember, that if an agent gets to write the future inputs of systems, it was never sandboxed in the first place. That is the same structural failure OpenAI’s models exploited to get out of their evaluation environment, just at the level of coding agents that most of our developers are already running locally.

The practical recommendation, that security teams should evaluate whether their vendors can even distinguish user-created, repo-created, and agent-created file states, is a good concrete question to bring to your next tooling review.

Flaw Surge Fuels Need for CISOs to Rethink Vulnerability Management

CSO Online’s John Leyden pulls together a strong panel of practitioners on a theme this issue keeps circling, that AI-accelerated vulnerability discovery is overwhelming the traditional scheduled patch-cycle model.

The piece cites a 43-day median patch time drawn from Verizon’s DBIR by way of Forescout’s Rik Ferguson, and argues for a shift to risk-based, continuous vulnerability management tied to real-time exploitation intelligence, with virtual patching offered as a compensating control for systems that cannot be directly patched.

None of the individual recommendations are new, but the forcing function is, because when discovery accelerates and the exploitation window collapses, the old cadence of scan, ticket, and wait simply stops being viable. This is the operational problem that Empirical Security is raising money to solve and that Jen Easterly is writing about next.

I of course have written extensively about this topic for years as well in my books and blog.

The KEV Is Dead. Long Live the KEV.

Former CISA Director Jen Easterly argues that CISA’s Known Exploited Vulnerabilities catalog, which helps defenders prioritize patching based on confirmed exploitation, has to evolve for the AI era rather than be abandoned.

Her core point, as reported, is that for widely deployed, internet-facing products, the period in which defenders can wait for confirmed exploitation before acting is shrinking. That is the KEV’s central assumption under pressure, because a catalog built on confirmed, observed exploitation is inherently a step behind, and the step is getting longer relative to how fast exploitation now happens.

Easterly is not calling to scrap the model, she is calling to adapt it, and given how much of federal and enterprise prioritization leans on KEV, this is a conversation the community needs to have out loud, and builds on the recent CISA BOD to move away from CVSS-based prioritization as well.

AI Has Broken the Vulnerability Disclosure Model

Mindgard’s Peter Garraghan makes a complementary argument from the disclosure side, that AI has broken coordinated vulnerability disclosure because it is often difficult to even contact AI vendors directly, with reporting scattered across web forms, email, bug bounty platforms, or no process at all.

The deeper issue he raises is that the industry lacks consensus on what an AI vulnerability even is, which lets providers treat content and safety issues as out of scope, especially where impact is hard to quantify. This ironically is the entire reason folks such as started the AIVSS project, which helps address this gap.

Put this next to the Hugging Face incident and the tension is obvious, because we are asking researchers and defenders to responsibly disclose against systems whose vendors have not agreed on what counts as a vulnerability or where to send the report.

The disclosure plumbing has not kept pace with the threat model, and that gap is going to bite.

GOLD EAGLE Clearinghouse Targets a Real Coordination Gap

The government’s answer to some of this launched on July 14 as GOLD EAGLE, a voluntary clearinghouse described as coordinating and deconflicting vulnerability scanning, discovering and validating vulnerabilities, and prioritizing remediation and patch distribution across the AI industry and critical infrastructure, positioned ahead of an anticipated vulnpocalypse.

The expert reactions are the valuable part. Casey Ellis calls it, at least for now, a coordination process wearing a technical system’s clothes, and Katie Moussouris cuts to the core with the observation that the bottleneck was never knowing about more bugs, it was having the people and process to prioritize and fix them. I think that is exactly right.

Coordinating discovery is useful, but discovery was never our constraint, and if GOLD EAGLE mostly surfaces more findings without addressing remediation capacity, it risks pouring water into an already overflowing bucket.

Announcing VulnHunter

On the tooling side, Capital One open-sourced VulnHunter under Apache 2.0, an agentic security tool that applies attacker-perspective analysis directly to source code rather than scanning passively.

Two design choices stand out. It starts its Attacker-First Forward Analysis at attacker-accessible entry points like APIs and file uploads and reasons forward through application logic, and its Falsification Engine runs a structured reasoning workflow explicitly designed to disprove its own findings before a developer ever sees them, which is a thoughtful answer to the false-positive problem that Jet Anderson quantifies below.

It runs on Claude Opus 4.8 within a Claude Code environment, and Capital One says it has used it across thousands of repositories. It is genuinely good to see a large regulated enterprise contributing real agentic security tooling back to the community rather than just consuming it.

Apple Reverses Age-Old Patch Policy to Keep Up With AI

Dark Reading’s Nate Nelson reports that Apple shipped security updates on June 29 outside of a major OS release, a real break from its traditional bundled-patch cadence, with the stated goal of reducing the time between when updates become public and when they reach customers.

The forcing function is the same one running through this whole section, with Mandiant data showing average time-to-exploit around 63 days back in 2018 and the trend since flipping negative, meaning attackers now routinely weaponize flaws before patches are public. iVerify’s Rocky Cole, whose team found around a dozen bugs in two months testing AI models through OpenAI’s Trusted Access program, offers the necessary caveat, that faster patching does not help if people do not install it.

When even Apple is restructuring a signature policy around exploitation speed, that tells you the timeline pressure is real and not vendor spin.

The Agentic SDLC

Jet Anderson’s writeup on GEICO’s tech blog is one of the more thorough treatments I have seen of what AI coding agents do to the secure development lifecycle, and it is dense with sourced figures.

A few worth carrying:

• 61% of AI-generated code is functionally correct but only 10.5% is secure per Zhao et al.

• 49% of dependencies recommended by AI coding agents contain known vulnerabilities per Endor Labs

• 100% of surveyed companies have AI-generated code in production while 81% of security teams lack visibility into it per Cycode

• Trend Micro found more than 8,000 MCP servers on the public internet, 492 of them with zero authentication and zero encryption.

Anderson’s framing is that the failure is not that security tools missed the bugs, it is that nobody ran any security tools at all, and he quotes Bruce Schneier’s blunt assessment that we have zero specific AI systems that are secure against these attacks.

His prescription is a shift from episodic human-review gates to continuous, embedded, agent-native validation.

This one is worth reading in full!

Final Thoughts

If there is a single thread running through this issue, it is that the categories we have used to organize our work are collapsing into each other.

Safety and security ran together this week when an AI safety evaluation became a live intrusion on a third party, and again when safety guardrails blocked the forensic response.

Offense and defense ran together when the same GPT-Red capability that hardens models is the capability that chained zero-days onto Hugging Face’s servers. Supply-chain security and delegated-authority security ran together the moment a malicious dataset became remote code execution, and the open-weight capability curve, the funding wave, and the disclosure and prioritization crises are all the same story told from different seats.

None of this is cause for panic, and it is certainly not cause for the reflexive hand-wringing our field is prone to.

Autonomous exploitation stopped being hypothetical this week, but the impact was mitigated in part, because capable people were watching their telemetry and moved fast.

The work in front of us is to close the gap between how quickly these capabilities are arriving and how slowly our governance, our disclosure plumbing, and our prioritization models are adapting. We have watched this movie before with Cloud, with SaaS, and with every prior wave, where security sat back hand-wringing and got left behind but this time the wave is bigger and moving faster than ever.

The question, as always, is whether we get ahead of these architectures while they are still taking shape, or bolt security on after the fact once again.

Stay Resilient!

Subscribe now

If there was a single theme this week, it was volume.

Microsoft shipped a record 622 fixes in a single Patch Tuesday, told us to expect even more as AI-powered discovery ramps up, Jerry Gamblin’s mid-year CVE numbers show publication volume up nearly 50% YoY, and the White House launched a new initiative aimed at coordinating vulnerability discovery and patching at the national level.

The vulnerability management conversation we’ve been having for years is starting to look much different as AI continues to industrialize vulnerability discovery and exploitation.

We also have the Grok CLI repo exfiltration saga, some excellent pieces on the economics of AI and what they mean for security, and the 1H 2026 cybersecurity market numbers.

Things continue to be a mix of exciting and chaotic heading into Black Hat, so let’s dig into it all.

Rethink your file security strategy

Most security tools are built to detect threats in files after the fact. Content Disarm and Reconstruction (CDR) takes the opposite approach. It assumes every file is untrusted, rebuilds it from clean components, and eliminates the threat before execution.

OPSWAT Founder and CEO Benny Czarny makes the full case in Cybersecurity Upside Down, a practitioner-focused book on why prevention-first security is not just possible, but necessary.

-> Get the Book <-

*Sponsored

Cyber Leadership & Market Dynamics

Cybersecurity Market Review 1H 2026

The team at Altitude Cyber, led by Dino Boukouris and Domenic Perri, published their 1H 2026 Cybersecurity Market Review, and as always it is one of the most comprehensive looks at the state of the cybersecurity market, spanning M&A, financing, public markets, and industry trends.

Some of the findings that stood out to me:

• 1H 2026 included 205 total M&A transactions with a total disclosed or estimated deal volume of $22.3B, with deal count up 24% YoY while dollar volume declined 47% (largely a base effect from Google’s announced $32B Wiz acquisition in Q1 2025)

• 2026 is on pace for the highest number of strategic acquisitions ever, with 131 through June

• AI Security emerged as a top M&A sector in 1H 2026 with 19 deals, up from just 2 in the same period last year

On the financing side, 1H 2026 saw 391 financing transactions totaling $8.8B, with deal count down 20% YoY but dollar volume actually up 3%, showing larger rounds concentrating in fewer companies, including Cyera’s $600M Series G (bringing their total raised to $2.3B) and NinjaOne’s eye-watering $12.3B valuation. The IPO drought also continues, with no cybersecurity IPOs so far in 2026 and only 3 over the past five years, compared to 15 from 2018-2021.

I also thought their framing on identity was spot on, stating that “identity is no longer just about employees and customers. As AI agents, workloads, and service accounts proliferate, identity is becoming the control plane for access, action, and trust across modern environments.”

Defense at Machine Speed

Menlo Ventures’ Venky Ganesan and Sam Borja laid out their thesis for AI-native cybersecurity, arguing that as attackers begin operating at machine speed and machine scale, defense has to be rebuilt around three layers - behavioral context engines, autonomous response agents, and continuous validation from both internal and external perspectives.

Of course, this is a VC thesis piece and Menlo is talking their book to an extent, with portfolio companies mapped to each layer of the architecture. That said, the underlying argument that threats have shifted from software vulnerabilities to compromised identities and social engineering, and that enterprises deploying fleets of agents will need independent behavioral monitoring of those agents, aligns with a lot of what we’re seeing across the industry.

That said, I do want to point out that exploitation is actually the #1 attack vector per the latest DBIR, not credential compromise or phishing, so it is fair to push back on their thesis given that context in my opinion.

It is still very AI-relevant though, as we see the AI-driven industrialization of vulnerability discovery and soon exploitation coming.

Technology Waves and Security - Is This Time Really Different?

Phil Venables published a measured look at technology waves and security, asking whether the AI wave is fundamentally different from the PC, Internet, mobile, and cloud waves that preceded it.

His answer is largely no, and the patterns hold, security is never built in enough, we always overestimate the short-term impact of these changes while underestimating their long-term impact, and effective system-wide security only becomes possible once common design patterns crystallize, as they eventually did for the Internet and cloud eras.

I found this a useful counterweight to the breathless takes in both directions. We’ve been here before, and while the scale and pace are greater this time, the playbook of watching for design patterns to stabilize and then hardening around them is a familiar one.

His point that human-on-the-loop, rather than human-in-the-loop, is the appropriate governance model for agents at scale will also likely prove prescient and it touches on points I’ve made in my own article “The Human-in-the-Loop Illusion”.

White House Launches GOLD EAGLE Initiative

The White House announced Gold Eagle, a cybersecurity clearinghouse using frontier AI to coordinate vulnerability detection and patching across open source software and critical infrastructure.

The initiative flows from Executive Order 14409, “Promoting Advanced Artificial Intelligence Innovation and Security,” and involves Treasury, DHS/CISA, and the Department of War, with stated goals of reducing duplicative scanning, delivering prioritized threat intelligence to defenders, and strengthening critical infrastructure resilience.

Given the AI-driven surge in vulnerability discovery covered throughout this issue, some form of national-level coordination was probably inevitable, and this pairs interestingly with efforts like CMU’s FLARE-AI (covered below) that federal initiatives have been calling for. As always, execution will matter more than the announcement.

I touched on this back when I made a video covering the AI EO:

Lessons from CISA’s Cyber Incident

CISA published a postmortem of its own GitHub leak, and I want to give credit where it is due, because it takes organizational courage to publicly dissect your own incident, especially when you’re the nation’s cyber defense agency.

For those who missed it, a repository named “Private-CISA” containing 844 MB of sensitive data, including plaintext passwords, AWS GovCloud tokens, and Entra ID SAML certificates, sat publicly exposed for roughly six months before GitGuardian discovered it on May 14, 2026, with takedown within 26 hours of the report.

The lessons are ones every organization should internalize. Take external vulnerability reports seriously (nine automated alerts went unanswered), continuously scan repos for exposed secrets, simplify reporting channels (CISA admitted theirs “were not well defined, leading the security researcher to try multiple avenues”), and test key rotation readiness before you need it, as key invalidation took more than 48 hours.

If it can happen to CISA, it can happen to you.

Microsoft’s Secure Future Initiative July 2026 Progress Report

Microsoft released its July 2026 SFI progress report, continuing what has become one of the more transparent looks into security engineering at hyperscale, even if it is part marketing, mixed with security.

Some numbers that jumped out include phishing-resistant MFA now protects 99.97% of user/device pairs, 1.4 million unused Entra applications have been decommissioned, 732,000 resources were removed from public access, and automated container patching is addressing roughly 3 million vulnerability instances monthly.

Whatever your views on Microsoft’s security track record, and there is plenty of history to critique, the SFI reports offer a rare view into what Secure-by-Design looks like when applied across one of the largest attack surfaces on the planet, and the emphasis on AI-driven detection (with more than 90% of AI-assisted findings confirmed by their security engineers) is a preview of where enterprise security programs are headed.

American “Hackers-for-Hire” Proposal Sparks Heavy Criticism

A provision in the defense authorization bill would let the U.S. government deputize private contractors to conduct offensive cyber operations against foreign adversaries, effectively creating an American hack-for-hire network, and as BankInfoSecurity covers, the proposal is drawing heavy criticism from the security community.

The cyber letters-of-marque debate has been simmering for years, and the concerns are the usual ones, escalation, attribution, and collateral damage. That said, it is notable to see the concept advance this far in the legislative process rather than remaining a think-tank thought experiment, and it lands in the same season as offensive AI capabilities becoming dramatically cheaper.

Ways to Think About Token Pricing

Benedict Evans wrote an excellent piece on ways to think about token pricing that I’d recommend to anyone trying to reason about the economics underneath the AI wave. He points out that a trillion dollars or more of data center capex is coming down the pipe, that inference today carries 40-50% gross margins, and that the current capacity crunch has been driven by sudden product-market fit in really just one use case, software development.

The open question he poses is whether foundation models retain pricing power or become low-margin commodity infrastructure, with the telecom precedent looming large, cellular data traffic rose by orders of magnitude while the stocks went nowhere.

For those of us watching security vendors race to bolt LLMs onto everything, the question of who actually captures value in this stack is far from academic, and it connects directly to Nir Zuk’s cost math on AI-driven detection covered in the AI section below.

The Reverse Information Paradox

Satya Nadella published a piece on his personal blog on what he calls the reverse information paradox, inverting Kenneth Arrow’s classic information paradox for the AI era. Where Arrow worried the seller of information gives away its value by describing it, Nadella argues the buyer of AI now:

“risks giving away knowledge, just in order to use what they bought,” because using AI means revealing your proprietary context, corrections, and workflows to the platform. As he puts it, “in consuming intelligence, you are creating intelligence,” and “if learning flows in only one direction, economic value converges toward the owners of the learning infrastructure.”

His prescription is for enterprises to demand a hard boundary around their data, traces, and adaptive weights, and to treat their usage and corrections as competitive assets rather than exhaust.

The irony of this coming from the CEO of one of the largest AI platform owners is thick, but the argument itself is one every CISO and CIO negotiating AI contracts should sit with, and this week’s Grok CLI story (below) is about as concrete an illustration as you could ask for.

This comes after Palantir’s Alex Karp’s now viral interview where he argued that frontier labs were stealing the “alpha” (e.g. the secret sauce/value) from their customers by accessing their data and potentially competing with them in the future.

Stanford’s Economics of the AI Supercycle

For those who want to go deeper on AI economics, Stanford has posted session recordings from MS&E 435, “Economics of the AI Supercycle,” taught by Altimeter Capital’s Apoorv Agrawal, with this session covering infrastructure, enterprise AI, and SaaS.

The course treats AI as a technology cycle comparable to PCs, the Internet, and mobile, and examines the economics at each layer of the stack. Great free resource from a course whose guest list includes folks like Databricks’ Ali Ghodsi and Altimeter’s Brad Gerstner. I’ve been really enjoying the discussions from this series, and the latest with Databricks CEO is equally as good.

AI

The State of Agentic Security

OWASP recently launched v2 of their State of Agentic AI Security & Governance report. I decided to make a video capturing the key takeaways and findings.

This will be the start of a video series, where I will walkthrough the OWASP ASI Agentic AI Top 10 as well, tying each risk to real-world incidents, mitigations and industry trends, so keep an eye out for that!

Benchmarking Coding Agents on Databricks’ Multi-Million Line Codebase

Databricks published one of the more useful coding agent benchmarks I’ve seen from a non-frontier lab or research entity, running agents against real engineering tasks from their own multi-million line codebase rather than synthetic benchmark suites.

The headline finding is that per-token pricing is a poor guide to actual cost. Sonnet 5 is ~1.7x cheaper per token than Opus 4.8, but on their tasks Sonnet cost $2.09/task vs Opus’s $1.94 while scoring six points lower on task completion (81% vs 87%), because cheaper models often take longer, less efficient paths.

Open models also landed on the Pareto frontier, with GLM 5.2 statistically tied with Opus 4.8 on quality at $1.28/task against Opus’s $1.94, and harness choice mattered as much as model choice, with one harness sending about 3x less context per turn.

The takeaway for security leaders evaluating AI tooling is the same one that applies everywhere in this issue, benchmark on your own workloads, because list pricing and leaderboards will mislead you.

xAI’s Grok CLI Exfiltrates Your Entire Repo

The week’s biggest AI trust story, a researcher discovered that xAI’s Grok CLI coding agent was silently uploading users’ entire Git repositories, including full commit history, files the agent never read, and unredacted .env files, to xAI-controlled cloud storage.

Nikita Benkovich shared a good breakdown of the finding. In one test, a 12 GB repository produced 5.10 GiB of uploads while actual model-response traffic in the same session was just 192 KB, and a planted canary file the agent never touched was recovered verbatim from the intercepted traffic.

Worse, turning off the “Improve the model” setting didn’t stop the uploads, the toggle governed training use, not transmission. xAI disabled the uploads server-side on July 13, with Elon Musk stating previously uploaded data would be “completely and utterly deleted.”

This is exactly why the conversations happening at the leadership level, from Alex Karp to Satya Nadella’s reverse information paradox piece above, about frontier labs training on customers’ alpha and proprietary data matter so much. Your codebase is your IP, and increasingly your alpha, and this incident shows the gap that can exist between what an AI vendor’s settings imply and what the telemetry actually does.

Trust, but verify, and maybe run a proxy.

An Open-Weight Model as Capable as the Restricted Ones

Futurism covered the release of GLM-5.2, an open-weight model from Beijing-based Z.ai that researchers say can perform large-scale coding tasks similar to Anthropic’s Mythos 5, the model the U.S. government restricted over national security concerns and which remains available to only around 100 U.S. organizations and government agencies.

As Armadin founder and CTO Travis Lanham put it,

“an attacker can run it locally without safety guardrails, fine-tune it against their specific targets, and operate with zero visibility to any provider or defender,”

This is the exact point has rightly made in various blogs that I’ve shared previously.

This is the fundamental tension in the model restriction debate, export controls and access gates on U.S. frontier models don’t mean much when open-weight equivalents ship from jurisdictions that don’t share those controls. Joshua Saxe’s piece below makes the policy argument in depth.

The Rise of Affordable Models - GLM and Muse Spark on Cyber

Staying on that thread, XBOW benchmarked GLM-5.2 and Muse Spark 1.1 on offensive security tasks, finding GLM-5.2 performing somewhere between GPT-5 and Opus 4.6, short of the true frontier but remarkably capable for the cost. Their framing is the right one,

“GLM does not need to become Mythos to change the threat landscape. If a lower-cost model can perform useful offensive work at scale, then it is already relevant,” because “attackers do not usually need the best model in the world. They need a model that can find one real vulnerability before the cost stops making sense.”

Offensive capability is being commoditized from below, not just advanced from above, and the economics of attack are changing faster than most defensive planning assumes.

Grok 4.5 and the Middle of the AI Security Market

XBOW also put Grok 4.5 through its paces, finding it eventually solves roughly 93% of the vulnerabilities in their benchmark, performing like a frontier model at a fixed number of iterations.

The more interesting finding is the price band, between roughly $1 and $10 per attempt, Grok 4.5 consistently delivered the highest observed solve rate of the models they tested, reaching approximately 75% around $1 compared with about 65% for the nearest alternatives. They describe it as “a sports car that is surprisingly practical.”

Taken together with the GLM piece, the pattern is clear, the middle of the market is where attack economics get decided, and that middle is getting crowded and cheap.

Context Bombs - Stopping AI Attackers in Their Tracks

On the defensive side of the AI attacker equation, Tracebit published clever research on “context bombs”, short text strings planted in decoy resources like canary secrets, environment variables, and DNS records along an attacker’s likely path, designed to trip the built-in safety guardrails of offensive AI agents mid-intrusion.

Across 152 runs in simulated AWS environments, agents achieved at least one attack path in 91% of baseline runs versus only 15% in bombed ones, with admin privilege escalation dropping from 57% to 5%. One frontier model achieved admin access in 93% of baseline runs but failed every single time once a context bomb was in play.

There’s a delightful irony in defenders weaponizing prompt injection, the same class of weakness attackers exploit, as a tripwire. Also interesting, Western models halted on strings referencing sensitive biological topics, while Chinese models halted on politically sensitive topics written in Chinese.

Deception and canary techniques have always been underrated, and they may be entering a golden age against machine adversaries, a point I’ve seen others such as Gadi Evron make.

AI Is Exposing Cybersecurity’s Biggest Assumptions

Nir Zuk, Palo Alto Networks co-founder and now founder/CEO of Cylake, argues that the industry’s AI conversation is focused on the wrong bottleneck. The problem isn’t model intelligence, it’s data architecture, “an AI agent cannot defend what it cannot see,” and today’s fragmented security data can’t feed AI-driven detection.

His cost math is sobering, estimating that continuously running LLM-based detection over enterprise telemetry at scale would cost approximately $158 million per year at current frontier model pricing, and that even a one-million-token context window covers roughly 40 seconds of enterprise activity.

You can quibble with the assumptions (few would propose brute-forcing raw telemetry through a frontier LLM), but the underlying point stands, “AI does not reduce the need for data. It dramatically increases it,” and unified data architecture remains the unsolved problem underneath all the AI SOC hype.

The Origins of Ill-Conceived Model Cyber Restrictions

Speaking of , he wrote a sharp critique of model cyber capability restrictions, arguing the policy community adopted a flawed capabilities-centric view of model risk when an ecosystem-centric view would serve U.S. security far better.

His reasoning is that defenders benefit more from unrestricted access to capable models than attackers do, attackers can simply shift to non-monitored open-weight models (see GLM-5.2 above), and distillation makes capability diffusion inevitable anyway, with one 2026 study distilling under 4,000 expert trajectories from a frontier model into a small open model and nearly closing the performance gap.

He also brings receipts on actual attacker AI usage, noting that the leaked Black Basta chats showed operators using ChatGPT for polished phishing letters and exploit debugging, useful but hardly a capability transformation. Given this week’s GLM-5.2 news, the piece reads less like a prediction and more like a description of the present.

The Untrusted Tenant: Rethinking Infrastructure Security for Agentic AI

and Edera’s Alex Zenla published a piece arguing for treating AI agents as untrusted tenants, shifting the security question from whether the model is safe to what the model can reach.

Their core claim is hard to argue with, “an LLM’s output is untrusted data. If you are executing actions based on that output, you are executing untrusted code.” They point to last summer’s Replit incident, where a coding agent deleted a production database during an active code freeze with no exploit and no injection, as proof that autonomy plus access is enough for catastrophe.

The prescription is hard multi-tenant isolation, hardware-enforced boundaries, a separate kernel per workload rather than shared-kernel namespaces, scoped credentials, and default-deny networking, with modern microVM boot times meaning strong isolation is no longer the performance tax it once was.

I dove into all of this myself with Alex not long ago on the Resilient Cyber Show

When Agents Remember Too Much - Memory Poisoning Attacks

A new paper on arXiv introduces GhostWriter, a memory poisoning attack against tool-using personal LLM agents with long-term memory. The attack works in two phases, injection (an adversary plants a hidden payload, for example via email the agent processes) and activation (the poisoned memory is later retrieved and steers behavior), and the results are rough, approximately 98% injection rates and approximately 60% average activation rates against state-of-the-art agents.

The authors also propose a defense, AM-Sentry, combining memory-saving policies and retrieval screening.

Agent memory is a persistence mechanism, in both the product sense and the attacker sense. As agents accumulate long-term memory across sessions while ingesting untrusted inputs, poisoned memories become the agentic equivalent of a backdoor that survives reboots.

It’s another example where the utility of agents create the very circumstances for security risks and compromise, something I’ve been calling the Security vs. Usability tradeoff.

OWASP Agent Memory Guard

Conveniently paired with the above, OWASP has an open source project called Agent Memory Guard, a runtime defense layer that sits as middleware between an AI agent and its memory store, screening every read and write for prompt-injection markers, secret and PII leakage, protected-key modifications, and churn attacks.

It serves as the reference implementation for ASI06: Memory Poisoning from the OWASP Top 10 for Agentic Applications, and its published benchmarks show a 92.5% detection rate with 100% precision at 59 microseconds of median latency.

It’s early-stage, but this is the kind of concrete, deployable control the agentic security conversation needs more of, and it ships with drop-in LangChain middleware for those who want to kick the tires.

Contextual Agent Security - A Policy for Every Purpose

Google researchers Lillian Tsai and Eugene Bagdasarian make the case that static security policies cannot scale to generalist agents, because judging an action’s safety requires knowledge of the context in which it takes place, and this is a point I agree with. It’s why we see so much discussion around agent security right now and topics such as “intent analysis”.

Their proposed framework, Conseca, generates just-in-time, contextual, human-verifiable security policies with deterministic enforcement, rather than relying on manually crafted allow-lists or user confirmation fatigue. In their evaluation, Conseca preserved roughly 60% task completion (versus ~70% for unrestricted agents) while denying contextually inappropriate actions, where static restrictive policies dropped completion to zero.

This is a position paper rather than a product, but the direction feels right. Agent authorization has to become dynamic and contextual, because the space of things a generalist agent might legitimately do is too large to enumerate in advance.

That said, I did see a follow up from the paper from Google that they’ve begun implementing contextual based access control in their platform, building on these principles.

When OWASP LLM Risks Meet Agentic

Steve Wilson, who founded and leads the OWASP GenAI Security Project and literally wrote the book on LLM security, published a piece on how the OWASP LLM Top 10 risks translate into the agentic context.

With OWASP’s Top 10 for Agentic Applications now out and agentic deployments accelerating, mapping the two risk frameworks together is timely work, and Steve is about as authoritative a voice as exists on this topic

CMU Helps Close a Critical Security Gap Across AI Platforms

Carnegie Mellon’s Software Engineering Institute and partners launched FLARE-AI, an open source platform for standardized, machine-readable reporting of AI flaws, vulnerabilities, and incidents, routing reports to the right developers, vendors, and government bodies. It connects to the VINCE coordination environment, enabling CERT/CC to issue CVE IDs and vulnerability notes for AI systems, and SEI’s AI Security Incident Response Team will review submissions for coordinated disclosure.

As SEI’s Lauren McIlvenny notes, “a reporter might spot a problem in a particular model or system, but they’re not looking across all the vendors,” which is exactly the gap in AI flaw handling today, where the same weakness often exists across many models and platforms with no mechanism to coordinate disclosure. Between FLARE-AI and GOLD EAGLE above, the vulnerability coordination infrastructure for AI is starting to take real shape.

Couple this with the various commercial vulnerability clearinghouse efforts recently and it is feeling like while they are all good, it will lean to a bit of sprawl and trying to rationalize the outputs and data from each of the efforts too.

Limiting Reagents - Why AI Coding Isn’t Shipping Features

Keegan Hines borrows a concept from chemistry to explain why AI coding isn’t translating into shipped features, in any reaction, the limiting reagent determines the yield, and the argument here is that raw code generation was rarely the limiting reagent in software delivery, so accelerating it alone doesn’t accelerate shipping.

This dovetails with the Dark Reading piece in the AppSec section, if security review and vulnerability remediation are among the limiting reagents, AI-accelerated code generation just piles up work-in-progress in front of them.

In other words, the bottleneck just moves to other areas of the process and/or system.

A Framework for Frontier AI and the Dawning of a New Age

Google DeepMind CEO Demis Hassabis published a proposal for frontier AI governance, calling for a U.S.-led Frontier AI Standards Body modeled on a federally overseen public-private partnership or self-regulatory organization, much like FINRA, that would independently safety-test frontier models, with labs voluntarily sharing models for review up to 30 days before release. He believes AGI is probably only a few short years away and describes the magnitude of the technology’s impact as “perhaps 10x of the Industrial Revolution at 10x the speed.”

Whatever you make of the timeline claims, the fact that the leader of one of the world’s premier AI labs is publicly calling for independent pre-release safety testing, with cyber capabilities explicitly among the catastrophic risks in scope, says a lot about where the frontier conversation has moved.

The proposal’s emphasis on applying to all frontier-class models regardless of origin or openness will be the hard part, as this week’s GLM-5.2 coverage makes clear. It received positive attention from various industry leaders in my feeds, such as Elon, Satya and Sam Altman.

AppSec

Microsoft Patches Record 622 Vulnerabilities, Including Two Exploited Zero-Days

July’s Patch Tuesday set a record, with Microsoft patching 622 vulnerabilities, including 416 in Windows and 164 across the Office suite. Two zero-days were already exploited in the wild, CVE-2026-56155, an Active Directory Federation Services flaw allowing local privilege escalation to administrator, and CVE-2026-56164, a SharePoint Server bug enabling network-based privilege escalation without authentication.

A BitLocker security bypass (CVE-2026-50661) was also publicly disclosed before patches were available, and the release includes a CVSS 9.9 Windows VMSwitch issue.

Prioritize the AD FS and SharePoint fixes if you haven’t already, and keep the 622 number in mind as you read the next two items, because it isn’t an anomaly, it’s a trendline of AI’s impact on the industrialization of discovering vulnerabilities, both for vendors and attackers.

Evolving Windows Vulnerability Management for AI-Powered Discovery

Right on cue, Microsoft published a piece on evolving Windows vulnerability management that amounts to a heads-up for every Windows shop. AI is making it possible to find more issues, faster, across more code, including through their multi-model agentic scanning harness (MDASH), and:

“as AI helps defenders discover more issues, customers will see a higher volume of security updates included in each security release.”

Microsoft is framing the coming surge in patch volume as defensive success rather than declining code quality, and there’s truth to that, but from the operator’s seat the effect is the same, more patches, more often, with the same change windows and the same staffing.

Vulnerability management programs built around monthly cadences and manual prioritization are going to buckle, and the mid-year CVE data below shows why.

CVE Mid-Year 2026 Check-In: Volume Vertical, Exploitation Rare

Per Vulnerability Researcher Jerry Gamblin’s mid-year CVE check-in, 35,364 CVEs were published in the first half of 2026, averaging 195.4 CVEs per day and representing 49.5% growth over H1 2025, putting the year on pace for roughly 72,000 CVEs. Meanwhile, only 85 of those H1 CVEs, 0.24%, appear in CISA’s KEV catalog.

As Jerry puts it, the volume curve has gone vertical while exploitation has not, and the challenge is signal-to-noise, not patch volume. This is the data underneath everything else in this section. Discovery is industrializing while exploitation remains rare and concentrated, which means context and prioritization, not raw patching throughput, determine whether your program survives the curve.

Signal Over Noise: AI Agents and the Operator Moat

One of the more interesting first-person accounts I’ve read on AI’s impact on offensive security work, who is an AI red teamer at Dreadnode documents how agents scaled his personal bug bounty output, with 2026 submission volume reaching nearly 6x his full-year 2025 output in roughly six months, including a peak day of 21 reports. The key detail is that quality improved while volume scaled, with reports closed without acceptance dropping from 32% to 24% across 853+ submissions spanning 78 unique CWEs.

His thesis is that the durable moat is the expert operator, the human who scopes targets, validates findings, reads agent traces, and acts as final arbiter between real vulnerabilities and false positives, not the agents themselves. AI scaling submission volume, and AI validating it on the receiving end. Every program in between is about to get squeezed.

PR3TACK: The Preemptive Tactics & Countermeasures Knowledgebase

Out of FIRSTCON26, Atlassian’s Vishal Thakur introduced PR3TACK, a knowledgebase of plausible-but-unobserved adversary TTPs designed to close the “anticipatory gap” left by retrospective frameworks like MITRE ATT&CK.

It spans 17 tactic categories, 6 of them exclusive to the framework, including Pre-Positioning (think sleeper commits in open source projects), Cognitive Manipulation (alert flooding, adversarial logs), AI/ML Subversion, and Digital Exhaust Manipulation (weaponizing telemetry and threat intel feeds).

As the author puts it, “PR3TACK is not a crystal ball,” and its value “lies instead in shaping a culture of anticipatory defence.” With AI compressing the timeline from plausible to observed, cataloging what attackers could do before they do it feels less academic than it would have even a couple of years ago.

You Can’t Reverse Engineer Your Way Out of the AI Supply Chain Problem

The Semgrep team, including Isaac Evans, Cris Thomas (Space Rogue), and Katie Paxton-Fear, published a thoughtful piece on the AI supply chain problem, arguing that unlike traditional binaries, we have almost no ability to reverse engineer models today, which means even open-weight models can’t be trusted the way inspectable software can.

They cite poisoning research showing that the number of samples required to add a backdoor does not increase as the model increases in size, and invoke Ken Thompson’s trusting-trust lesson, you can’t trust a system simply because you can inspect what’s in front of you.

Their conclusion is that “provenance, reproducibility, and independent evaluation will matter far more than marketing claims or benchmark scores,” and they’re right, benchmarks are gameable and model cards are marketing. This applies to every model in this issue, not just the ones from any particular country.

3,245 Malicious Components in One Week

Speaking of the traditional software supply chain, open source malware researcher Paul McCarty flagged 3,245 malicious components identified in a single week in his recurring supply chain recap. Numbers like this keep making the case that malicious packages are a distinct problem from vulnerable packages, and most SCA tooling remains oriented toward the latter.

AI Coding’s Security Costs vs. Productivity Gains

Dark Reading’s Alexander Culafi asks the uncomfortable ROI question about AI coding tools, and the numbers he assembles deserve attention. GitLab’s 2026 AI Accountability Report found 91% of organizations using two or more coding tools, a SonarSource survey found 96% of developers said they do not trust AI-generated code to be functionally correct as is, Veracode research found 45% of AI generated code samples contained OWASP Top 10 vulnerabilities, and GitGuardian found AI coding assistant use increases the secrets incidence rate by approximately 40%, with AI-assisted commits leaking secrets at 3.2% versus a 1.5% baseline.

Add remediation labor, false-positive triage (with experts citing security teams spending up to 40% of their time on findings that are ultimately non-exploitable), and credential cleanup, and the productivity math starts looking murkier than the vendor decks suggest.

The gains are real, but the costs land in a different budget, usually security’s.

LLMs in SAST: Good, Bad, Costly

A grounded practitioner take on where LLMs actually fit in static analysis from Ali Yazdani. His argument is the highest-ROI role for LLMs is triage and explanation layered on top of deterministic SAST engines, not replacing them, since traditional SAST’s false-positive burden commonly runs between 30% and 100% of findings volume, and LLM triage has achieved 96% agreement with security researchers, with Semgrep’s Assistant now handling around 60% of incoming triage work for customers. LLM-alone scanning, by contrast, under-reports and creates false confidence.

My favorite line, “Accuracy isn’t a slope you slide down gracefully, it’s a cliff.” Alert fatigue has always been SAST’s costliest problem, and triage is exactly where a probabilistic system belongs, with a deterministic engine remaining the source of truth.

Final Thoughts

Stepping back from the individual stories, the through line this week is that the economics of security are being repriced in real time.

Discovery is industrializing on both sides, with CVE volume up nearly 50%, a record Patch Tuesday, offensive capability available at commodity prices, and bug bounty operators scaling 6x with agents. Meanwhile, the durable value keeps concentrating in the same places, context, validation, identity, and the humans who know what actually matters.

We’ve spent two decades optimizing for finding more things. Now organizations are doing the long overdue work of getting ruthless about deciding what deserves attention, and treating their data, their identities, and increasingly their AI agents as the assets and attack surface they actually are.

Stay resilient.

Subscribe now

This week the question changed. We have spent months debating whether AI will eventually become a serious offensive tool, It’s hard to argue that it isn’t, as this week Wiz published a blog of an autonomous AI agent discovering and fully exploiting a critical authorization flaw in a live airline’s booking API, start to finish, in fifteen minutes flat.

SpecterOps demonstrated that LLMs can systematically extract every YARA rule, behavioral detection, and ML model from a production EDR product, and Dreadnode showed that C2-less, fully autonomous malware can run entirely on AI models already shipping with Windows.

The offensive AI future arrived while we were still writing governance frameworks for it.

Meanwhile, a parallel debate about who gets to benefit from AI-powered vulnerability discovery is playing out in real time.

Four separate open-source vulnerability clearinghouses launched in five weeks, and James Berthoty’s piece on the privatization of vulnerability management asks the hard question nobody else is willing to ask.

If AI-discovered patches get privatized while AI-discovered exploits get democratized, who wins?

I explored a related angle in my piece this week on whether we need a CVSS for AI jailbreaks (more on that in the AI section below), and I also published a deep dive on cloud security and SecOps convergence and a discussion with Tenable’s CPO on exposure management in the age of AI if you want to go deeper on those fronts.

Let’s get into it.

Dark matter hides in your AI supply chain. Plutonium finds it.

New skills, plugins, connectors, and MCP servers extend Claude, Copilot, and the wider AI supply chain every week. Most of what they can actually do stays invisible, dark matter in the stack, until something goes wrong.

That’s the idea behind Plutonium, Pluto Security’s free hub for the AI ecosystem. It pairs risk-assessment catalogs, covering every connector, skill, plugin, and MCP server across the entire AI supply chain, with Market Space, a curated set already checked safe to install.

Check any tool yourself before you approve it.

Security teams who want that same view across every employee and every tool already in use can see it live with Pluto, and bring the invisible risks into the light.

-> Free Hub For the AI Ecosystem! <-

*Sponsored

Cyber Leadership & Market Dynamics

DHS Investigates Cyber Breach at Homeland Security Information Network

A breach of the Homeland Security Information Network, the unclassified system used to share sensitive information with foreign law enforcement and local authorities, is exactly the kind of incident that erodes trust in government cyber coordination.

The breach reportedly occurred between late May and early June 2026, and Senator Mark Warner called the exposed information “highly sensitive” with national security implications. DHS has provided minimal details, which is not unusual for an active investigation but is frustrating given that HSIN is the backbone of cross-agency threat sharing.

Coming just weeks after the Mythos classified systems testing I covered in issue #104, this is another reminder that the government’s own infrastructure faces the same vulnerabilities it is asking the private sector to fix.

Beijing Moves to Restrict Overseas Access to China’s Top AI Models

The symmetry here is hard to miss.

Three weeks after the U.S. briefly pulled Fable 5 from the market via export controls, Beijing is now considering the same approach for its own frontier models. Reuters reports that Chinese authorities have been meeting with Alibaba, ByteDance, and Z.ai about restricting overseas access to advanced AI models, including unreleased ones.

The proposed tiered system would require simple filing for basic open-source tools, security reviews for more advanced technology, and outright restrictions on frontier models.

analysis of the open frontier adds critical context. Six of the seven strongest open-weight models are now Chinese, with GLM-5.2 leading the pack as the first frontier model trained entirely off Nvidia silicon on Huawei Ascend chips.

Both superpowers are now treating cutting-edge AI as a national asset, and the window where open-weight models could flow freely across borders is closing from both directions.

Keyfactor Secures $1B+ Strategic Growth Investment from Summit Partners

A billion-dollar growth investment in machine identity and post-quantum cryptography signals where institutional money sees the next critical infrastructure layer.

Keyfactor currently manages billions of machine identities across 2,500+ customers, including half the largest U.S. and EU banks and over 40% of the Fortune 100. The timing tracks with the White House’s June 2026 executive orders accelerating PQC transition ahead of 2030 and the JPMorgan data from last week showing NHIs outnumbering human identities 144-to-1.

I have been saying for a while that identity is key context, especially for securing the era of Agentic AI. A billion-dollar bet from Summit Partners suggests the private equity market agrees.

Cyber Insurers Now Pricing Remediation Speed Into Underwriting Policies

Insurance underwriters are shifting from asking “do you have vulnerabilities?” to “how fast do you fix them?” and I think this is exactly the right question.

Vulnerability exploitation has become the leading initial access vector at 31% of breaches (up from 20%) per Verizon’s 2026 DBIR. The median time to fully resolve a critical vulnerability is 43 days, while the mean time-to-exploit is negative 7 days, meaning attackers are weaponizing flaws before the patch ships.

Organizations using AI agents for remediation report 6x faster CVE remediation and 83% fewer blocked pull requests. When insurance companies start pricing operational tempo, security leaders finally get a financial argument for the tooling investments they have been requesting.

Bank for International Settlements Warns AI Investment Bubble Risks Global Economy

When the central bank for central banks starts warning about an investment bubble, it is worth paying attention.

The BIS report notes that AI is attracting far more capital than the resulting industry can produce in returns, a pattern it has seen before. Oracle has lost more than 40% of its share value in the past month. Hyperscalers keep pouring money into GPU infrastructure while creating RAM shortages that affect even consumer hardware purchases.

I remain cautiously optimistic about AI’s long-term value for security, but the spending trajectory I covered in prior issues is clearly unsustainable. The correction will not eliminate AI adoption but it will force a reckoning about which use cases actually justify the cost.

Bloomberg Reports AI Anxiety Fueling Burnout Across Silicon Valley

One entrepreneur quoted in the piece captured something I have been hearing from practitioners across the industry. AI agents were supposed to do his work for him, but he has “never worked harder” while producing roughly 100x more output than before. This is often referred to as the AI Vampire.

Tech career coach Kyle Elliott says 2026 has been his busiest year as workers prepare for AI-driven layoffs or escape burnout. The pattern is paradoxical but predictable. AI eliminates routine tasks, bosses demand more strategic work, and mental downtime disappears entirely.

For security teams already dealing with alert fatigue and staffing shortages, adding AI-driven productivity pressure on top of existing stressors is a recipe for attrition.

Pragmatic Engineer Reports Cloud Agents Going Mainstream at OpenAI, Anthropic, and Cursor

visited the offices of OpenAI, Anthropic, and Cursor and reports that all three are investing heavily in cloud-based AI agent execution.

OpenAI acquired Ona (formerly Gitpod) for cloud dev environments. Anthropic built Claude Managed Agents over six months. Cursor launched cloud agents and an iOS mobile app. The most striking data point was that more than 95% of non-engineers at OpenAI now use Codex rather than ChatGPT, suggesting that AI coding tools are becoming the default interface even for people who do not write code.

The implications for shadow AI in enterprises are significant, and security teams should be planning for a world where every employee has access to a cloud-based code execution environment.

Nicolas Colin Argues This Is the Beginning of the End for “Big AI”

Vsquared Ventures’ head of research reacts to Palantir CEO Alex Karp’s critique of frontier model companies and makes a provocative case. For context, this is the video from Alex Karp that made a ton of waves this week:

If a local model running on your own data solves 95% of the problem at a fraction of the cost, the economics of paying for opaque tokens and uploading proprietary data to frontier labs stop making sense.

Chinese open-source models have become “astonishingly good” and frontier labs are still burning cash at industrial scale. Colin compares frontier AI to supersonic airliners, impressive until the economics kill them. His most interesting prediction is that Anthropic could survive as “a next-generation Google” with Claude Code as its AdWords-equivalent cash engine, while OpenAI faces a trickier path.

Whether or not you buy the full thesis, the direction of travel, more capable open models and tightening enterprise budgets, is real.

Anthropic Sues Abnormal AI Over Logo Similarity in Trademark Dispute

Of all the stories I expected to cover this week, Anthropic suing one of its customers was not one of them.

Abnormal AI’s CEO Evan Reiser points out that Abnormal was founded in 2018 (three years before Anthropic), the disputed logo was designed in April 2021, and Anthropic does not hold a registered trademark covering cybersecurity products. Reiser notes that his personal account will spend roughly $1M on Anthropic products this year, with the company spending over $10M. He emphasizes that Abnormal does not use Claude for customer-facing security features, only as an internal productivity tool.

The lawsuit demands “disgorgement of all revenues, earnings, profits, compensation, and benefits,” which seems remarkably aggressive given the facts. Whatever the legal merits, suing your own paying customers is rarely a winning business strategy.

AI

Wiz’s Red Agent Autonomously Exploits Critical BOLA Vulnerability in Live Airline API in 15 Minutes

This is the story that should change how you think about AI-powered offense.

With zero prior knowledge of the target, Wiz’s autonomous Red Agent discovered and fully exploited a Broken Object-Level Authorization flaw in a real airline’s GraphQL booking API in fifteen minutes flat.

The agent minted an anonymous session token by analyzing client-side JavaScript, performed GraphQL introspection revealing 514 queries and 428 mutations available to that anonymous session, then enumerated sequential booking IDs to extract two years of passenger records including names, dates of birth, billing addresses, and masked credit cards.

The anonymous session also had write capabilities including deleting flights, overriding prices, and issuing refunds. No human guided any step. This is not a CTF challenge or a research demo.

This is an AI agent autonomously executing a complete attack chain against production infrastructure protecting real customer data, and it found a vulnerability class that traditional DAST scanners are blind to.

SpecterOps Demonstrates LLMs Can Systematically Extract All EDR Detection Rules

If the Wiz story shows AI-powered offense in action, this one shows the defensive scaffolding being dismantled.

Adam Chester at SpecterOps used GPT-5.5-Cyber in a simple while-loop harness connected to Binary Ninja via MCP, a setup they call “Day Shift,” and fully dissected Palo Alto Cortex XDR.

The LLM extracted 6,358 encrypted YARA rules (cracking AES-128-ECB with keys embedded in the binary), discovered 9,350 DSE rules and 4,209 BIOC behavioral detection rules, pulled out 7 ML models with their decision thresholds, and even decrypted CLIPS-based rule blobs.

One extracted rule revealed that “reg save HKLM\SAM” to a specific path was explicitly allowlisted and would bypass detection entirely. SpecterOps confirms they have done this internally against every major EDR vendor with similar results.

The defense-in-depth argument I keep making just got a lot more urgent. EDR remains essential, but anyone treating it as their primary defensive layer is building on sand.

Cursor IDE Environment Keys Stolen via Malicious README Prompt Injection

Mozilla’s 0DIN team demonstrated a prompt injection attack where a malicious GitHub README tricks Cursor’s LLM agent into dumping environment variables and exfiltrating API keys via browser GET requests to an attacker-controlled server.

The attack exploits what the researchers call the “lethal trifecta” in agentic tools, specifically access to private data, exposure to untrusted content, and ability to communicate externally.

Cursor’s permission model is bypassed because users routinely allowlist “powershell -c” to avoid constant prompts, and Cursor only validates the beginning of the command string.

Last week I covered two Claude Code vulnerabilities with similar trust-model failures, and the pattern is consistent across every AI coding tool I have examined.

Agent frameworks that combine broad system access with exposure to untrusted repository content and the ability to make external network calls are structurally vulnerable to exfiltration, and permission fatigue makes the theoretical safeguards functionally useless.

Dreadnode Demonstrates C2-less AI Malware Running on Models Already Shipping with Windows

This research should be on every threat intelligence team’s reading list.

Max Harley at Dreadnode demonstrates that malware can eliminate command-and-control servers entirely by using AI models and inference libraries already present on the victim’s machine.

Microsoft CoPilot+ PCs ship with Phi-3 (3.8B parameters) and ONNX Runtime has shipped with Windows for a bit. The proof-of-concept used these locally available resources to autonomously discover a misconfigured Windows service and escalate privileges without ever contacting an external server.

Current limitations include CPU inference being slow and conspicuous, but as NPU-equipped machines become standard and local model quality improves, C2-less autonomous exploitation will become practical at scale.

Traditional network-based detection that depends on identifying C2 traffic will be completely blind to this class of attack.

UK AI Safety Institute Finds Real Cloud Misconfigurations Using Frontier AI for Under £1,000

Instead of testing AI on benchmarks, the UK AISI pointed frontier models at their own AWS infrastructure and looked for real misconfigurations.

Over a two-week sprint using three methods (static source analysis, automated agentic probing, and human-in-the-loop red teaming), they found and fixed several real issues including a previously undiscovered multi-step attack chain requiring five independent steps that allowed user impersonation.

The total cost was under £1,000 in LLM tokens, with the critical finding discovered for under £150. One basic commercial alerting system failed to flag any of the automated agent activity, while a more advanced monitoring system did catch some aggressive behavior.

Every organization with a cloud footprint can afford to do this, there is no excuse left for not trying.

T3MP3ST Framework Claims 90% Pass Rate on Offensive Security Benchmarks

An open-source multi-agent offensive security framework claiming 90.1% pass on XBOW’s 104-challenge black-box benchmark suite is worth watching carefully, if the numbers hold up.

T3MP3ST orchestrates specialist AI operators (recon, scanner, exploiter, infiltrator) to run the kill chain autonomously using local agent CLIs with zero API keys required. The emphasis on measurement integrity is notable, with every quantitative claim shipping with committed JSON artifacts that can be independently verified. The project also tested against post-training-cutoff 2026 CVEs to rule out memorization, scoring 4/10 strict.

Whether T3MP3ST itself becomes significant matters less than what it represents. The barrier to building autonomous offensive security harnesses has dropped to the point where a single developer can do it with open-source tooling.

FrontierCyber Introduces Real-System Offensive Benchmark with Physical Devices

Most AI security benchmarks test against planted vulnerabilities in sandboxed environments with predefined exploit paths.

FrontierCyber tests against real systems with real defenses, no planted vulnerabilities, and no predefined attack routes. The benchmark spans physical mobile phones running real applications, production software (Pillow, lxml, FFmpeg, PostgreSQL, Redis), and full network environments.

Initial evaluations have already surfaced previously unknown vulnerabilities now in responsible disclosure, and one model built a novel multi-vulnerability chain against a mobile device to gain unauthorized access. This is the evaluation methodology the field has needed.

Benchmarks built on known vulnerabilities and documented exploit paths tell you how well a model follows instructions, not how well it discovers new attack surfaces.

Addy Osmani Proposes Two-Axis Framework for Measuring AI Agent Autonomy

The single-axis autonomy ladder most people use conflates two separate questions, how far an agent operates independently (agency) and how many agents you coordinate (orchestration), and ’s two-axis framework is a useful corrective.

His six levels run from L0 Assist (suggestions only) through L5 Managed-by-Exception (factory model with human review only on exceptions).

Analysis of roughly 400,000 Claude sessions from 235,000 users showed that people make about 70% of planning decisions while Claude handles about 80% of execution, and experienced users were more likely to auto-approve.

That auto-approval pattern is exactly the permission fatigue that the Cursor IDE vulnerability in this issue exploits. Four anti-patterns are worth memorizing, especially “Permission Laundering” where humans approve what they do not understand.

Gartner Warns That Securing AI Agents Before They Go Rogue Is “Next to Impossible”

Dennis Xu at Gartner’s Security & Risk Management Summit said what most vendors will not.

LLMs will “always” be susceptible to jailbreak and prompt injection, and no amount of guardrail spending provides 100% prevention. The Akeyless survey data is sobering at 84% of 400+ IT and security leaders saying AI agents can access sensitive data, with 67% believing agents have already accessed data they should not have.

Brian Murphy from ReliaQuest offered the most quotable line of the week. “I don’t worry about attackers poisoning an agent’s memory. I worry about the agent poisoning its own memory.”

The PocketOS incident they referenced, where an AI coding agent deleted a production database and all backups in 9 seconds, is the kind of operational risk that should make every CISO reconsider deployment velocity.

I had a chance to chat with Dennis in-person at the Gartner event, and I consider him one of the sharpest analysts covering the space of AI and Agent Security.

Do We Need a CVSS for AI Jailbreaks?

I published a deep dive this week examining Anthropic’s proposal for a consensus jailbreak severity framework, the one buried in the Fable 5 redeployment announcement I covered in issue #104.

The cybersecurity industry spent 20 years learning that severity alone (CVSS) is insufficient without exploitation context (EPSS), organizational context (SSVC), and real-world telemetry (KEV). The AI safety community is compressing that same realization into months. NIST scientist Apostol Vassilev published a peer-reviewed proof extending Godel’s incompleteness theorems to AI guardrail systems, formally proving that no finite set of guardrails can be universally effective.

OWASP’s parallel AIVSS effort (v0.8) has founding members from NIST, NSA, Google, Microsoft, Anthropic, AWS, and others. Jailbreaks are a permanent feature of AI systems, not a bug to be patched.

AppSec

James Berthoty Warns Vulnerability Management Is Being Privatized

There’s been a TON of vulnerability discussion this year, largely due to AI’s industrialization of vulnerability discovery the “Mythos Moment”, and general buzz.

identifies privatization of VulnMgt across three dimensions. Detection, where frontier model access is gatekept to large enterprises. Investigation, where NVD enrichment is at its lowest point while commercial alternatives like Flashpoint, VulnCheck, and GitHub Security Advisories fill the gap, and Response, where the growth of vendor-hosted “supply chain firewalls” means patches increasingly flow through private channels before (or instead of) reaching the public.

Four separate clearinghouse initiatives launched in five weeks, and none give open-source maintainers real governance power.

James’ warning is blunt, “Fixes get privatized, while attacker capabilities get democratized.” If the clearinghouse model consolidates around subscribers-first disclosure, the CVE system as we know it is going out with a whisper.

Dan Lorenc Explains Why the Clearinghouse Itself Is the Least Important Part

Chainguard’s CEO offers the practitioner’s counterpoint to the privatization concern.

The clearinghouse is just data, and the real value is “actuation,” turning findings into rebuilt, tested, signed artifacts backported to the versions you actually run. Athena has taken in 20,000+ findings and shipped 2,000+ patches across 500 projects, and Chainguard’s existing build system already remediates well over 100,000 CVEs. CrowdStrike puts the stat at 42% of exploited vulnerabilities being hit before disclosure, which means the mean time-to-exploit is effectively negative.

Only a few large clearinghouses will survive, like root DNS servers or certificate authorities, and the long-term goal is secure-by-design making clearinghouses unnecessary.

That is exactly right but also probably years away and would require major changes in market and regulatory forces, which I’ve written about many times in terms of cybersecurity being a market failure.

Detailed Comparison Reveals None of Four New OSS Security Initiatives Include Maintainer Governance

A side-by-side analysis of Lightwell (IBM/Red Hat), Patch the Planet (OpenAI/Trail of Bits), Akrites (Linux Foundation), and Athena (Chainguard) reveals a striking gap across all four.

None give open-source maintainers real governance power, and none include any public body or national CSIRT. Two are “members-first” (Lightwell and Athena) where paying members get private hardened builds before public disclosure. Two are “equal” (Patch the Planet and Akrites) with single embargo windows. Lightwell is a $5B commercial subscription clearinghouse with 20,000+ engineers and 11 banks. Patch the Planet is free and non-profit, with 30+ projects and 51 significant findings plus 19 fixes in its first week.

I covered the Akrites launch in issue #104 as one of the most important announcements of the year, and this comparison adds necessary context about governance models.

The question is not whether these initiatives are valuable (they clearly are) but whether they protect the broader community or primarily serve paying members.

Epoch AI Documents 3.5x Spike in High-Severity CVE Disclosures After Mythos Release

In June 2026, notable organizations published around 1,500 high- and critical-severity CVEs, more than 3.5x the pre-Mythos monthly record.

Luke Emberson at Epoch AI tracked 21 major organizations (Microsoft, Google, Apple, Adobe, Oracle, Cisco, and others) and found the spike follows directly from Anthropic’s April 2026 announcement that Claude Mythos Preview could autonomously discover software vulnerabilities. Project Glasswing partners had been using Mythos pre-release and claim over 10,000 high- or critical-severity discoveries.

The figures are from publicly disclosed vulnerabilities only, meaning the actual discovered count is much higher. This is the vulnerability flood that the clearinghouse debate is trying to get ahead of.

Empirical Security Pushes Back on AI Vulnerability Flood Narrative

Ben Edwards at Empirical Security offers a measured counterpoint to the Epoch AI analysis.

His segmented Poisson model identifies an October 2022 breakpoint in CVE publication rates, well before the AI era, suggesting CVE volume was already accelerating for non-AI reasons.

Of the top 100 CNAs, only 24 have experienced a statistically measurable recent acceleration. Some of those (VulnCheck, VulnDB) have been accelerating since inception, not in response to AI. Edwards directly critiques Epoch’s methodology, arguing they “selectively picked a set of CNAs, aggregated them, and declared AI a spike.” I think both analyses contain important truths.

The spike is real for specific organizations using AI tools, but attributing the entire CVE volume increase to AI oversimplifies a much more complex picture.

Jerry Gamblin’s H1 2026 Data Shows 35,364 CVEs Published at a Rate of One Every 7.4 Minutes

Gamblin’s mid-year CVE analysis puts hard numbers behind the flood everyone is feeling. H1 2026 produced 35,364 CVEs, up 49.5% over H1 2025, with the single busiest day being June 9 at 747 CVEs.

GitHub Security Advisories is the busiest CNA at 6,801 assignments. The top CWEs remain frustratingly familiar, with XSS leading at 3,783 followed by Missing Authorization (1,704) and SQL Injection (1,445). Only 85 CVEs (0.24%) appear in CISA’s KEV catalog, reinforcing the data point I keep coming back to about the futility of treating all vulnerabilities equally.

Full-year projections now range from 66,000 to 72,000, with CPE coverage sitting at only 59%. For those who missed it, I recently sat down with Jerry to give into all things CVE’s, CNA’s and vulnerabilities:

Gal Elbaz Argues the 90-Day Disclosure Window Is Dead

Oligo Security’s CTO makes the case that AI has compressed both vulnerability discovery and exploit development timelines to the point where fixed disclosure windows are obsolete. AI can weaponize a published patch, turning a fix into a working exploit, in approximately 30 minutes.

MITRE cannot keep up with CVE report volume. Linus Torvalds has said the same about the Linux kernel. Elbaz argues disclosure timelines should be based on exploitability rather than a fixed number of days, and his bottom line is that “the noise needs to be cut, the critical bugs need better definition, and both vendors and researchers need to get back to the table as humans.”

I think he is right that the 90-day window is an artifact of a pre-AI era, but the replacement cannot be vendor-determined timelines either. The answer likely involves automated exploitability assessment as a disclosure trigger.

Corridor Makes Code Review Optional by Building an Auto-Approval System for PRs

The idea of merging code without human review runs counter to everything security culture has drilled into engineering organizations for two decades, but Corridor’s internal experiment is producing data that challenges that assumption.

The AI code security startup, which raised $25M in Series A funding, has been running most PRs through automated security and quality checks rather than human reviewers. If the auto-approval system’s false negative rate proves lower than human reviewer error rates, and given what we know about code review effectiveness that is not impossible, the industry’s assumption that human code review is a meaningful security control may need revisiting.

But the failure modes of AI-based approval are different and potentially more dangerous than human oversight gaps, so I would want to see independent validation before recommending anyone follow this path.

Final Thoughts

This week drove home a point I have been circling for months in prior issues and blogs. The offensive-defensive asymmetry in AI is not a future concern but a present reality.

An autonomous agent exploiting airline infrastructure in fifteen minutes, an LLM extracting every detection rule from a production EDR, AI malware running on models that ship with the operating system, and an open-source framework claiming 90% pass rates on offensive benchmarks, all in one week.

The vulnerability management world is grappling with its own reckoning. Four clearinghouses in five weeks, a 3.5x spike in high-severity disclosures, 35,000 CVEs in six months, and a genuine debate about whether the flood is AI-driven or structural. Whether Epoch or Empirical has the better methodology matters less than the shared conclusion. The volume is going up, the complexity is going up, and the existing institutional infrastructure was not designed for this.

What gives me some hope is that the defensive side is not standing still. The UK AISI found real vulnerabilities in their own infrastructure for under £1,000. Insurance companies are pricing remediation speed as a risk factor. And the clearinghouse debate, messy as it is, represents the industry at least trying to build new institutions before the old ones collapse.

The organizations that will be fine are the ones treating AI as both the threat and the tool, not choosing one framing over the other. Run frontier models against your own infrastructure, price your remediation speed, and accept that the 90-day disclosure window, like the CVSS score that drives it, is a legacy artifact of a world that no longer exists.

Stay Resilient!

Subscribe now

Three weeks ago, the Commerce Department ordered Anthropic to shut down Fable 5 for all users worldwide. This week, Fable 5 is back. Anthropic announced the redeployment starting July 1 with new safety classifiers, CAISI-validated safeguards, and a proposed industry framework for scoring jailbreak severity. The twist that nobody saw coming? Amazon’s own testing confirmed the same behaviors they reported in Fable 5 exist in every frontier model they tested, including GPT-5.4, GPT-5.5, and their own.

The bigger story this week is what happened while Fable 5 was offline. China’s 360 Security Technology unveiled tools they claim reach parity. The WSJ reported Chinese AI matching Anthropic on specific cybersecurity benchmarks, and enterprise customers started migrating to cheaper open-weight alternatives, with Chinese models now accounting for over 60% of tokens on the largest neutral router. Clayton Christensen’s disruptive innovation framework, which recently revisited, is playing out in real time. The low-end disruptors are not waiting for permission.

Meanwhile, two separate Claude Code vulnerabilities were published in the same week, the Linux Foundation launched Akrites as the largest coordinated open-source defense effort in history, and Anthropic’s Mythos reportedly found vulnerabilities in classified U.S. government systems within hours.

So sit back, and let’s dig into what feels sometimes like a soap opera coupled with technology.

Most teams find the authorization gap after the breach, not before.

The gap between what your compliance documentation says your authorization program does and what actually runs in production widens every time you add a service, a workload or an agent.

It usually surfaces during an audit or an incident, which is the worst time to find it.

The Authorization Maturity Model is a new ebook by Alex Olivier, Cerbos CPO and co-chair of OpenID AuthZEN. It gives security leaders a 4-stage benchmark and a self-assessment to see where their program actually stands, an exposure rating across NIS2, DORA, SEC, the EU AI Act and more, and a 90-day plan to close the gap.

It also covers what good looks like at each stage, and what changes once AI agents are in production.

Download the free ebook

*Sponsored

Cyber Leadership & Market Dynamics

Anthropic Redeploys Fable 5 After Export Controls Lifted

The Fable 5 saga that I covered in detail in issue #102 has reached its resolution, at least for now. Anthropic announced that Claude Fable 5 returns July 1 across Claude Platform, Claude.ai, Claude Code, and Claude Cowork after the Commerce Department lifted export controls on June 30.

The post provides extensive detail on what happened behind the scenes. Amazon’s security researchers identified a safeguard bypass, and when Anthropic tested the same technique against every frontier model available, including Haiku 4.5, every version of Opus, GPT-5.4, GPT-5.5, and Kimi K2.7, the same behaviors were replicable across the board. A new safety classifier now blocks the reported technique in over 99% of cases, and CAISI (within NIST) independently tested and confirmed the safeguards are “extraordinarily strong.”

The most significant outcome is not the model returning but the industry infrastructure emerging from the crisis. Anthropic is partnering with Amazon, Microsoft, Google, and Glasswing partners to develop a consensus jailbreak severity framework with four scoring criteria (capability gain, breadth, ease of weaponization, and discoverability), essentially building the CVSS equivalent for AI jailbreaks.

A new HackerOne program for cyber jailbreak submissions has been launched, and Anthropic has committed to pre-release government access and rapid information sharing.

Whether you think the original export control was warranted or not, the institutional response, a severity framework, coordinated disclosure, and independent validation, is exactly the kind of governance infrastructure this industry has been missing but there is a lot of warranted skepticism in terms of what this turns into, and how it is handled.

There are also a lot of unintended consequences of how this plays out, which I tried to capture in the video below:

Linux Foundation Launches Akrites as the Largest Coordinated Open Source Defense Effort in History

This is one of the most important announcements I have covered this year related to open source security. Akrites, a new Linux Foundation project, brings together 20+ founding members including AWS, Anthropic, Cisco, Google, IBM, JPMorgan Chase, Microsoft, NVIDIA, OpenAI, Red Hat, and Zscaler to find, fix, and responsibly disclose vulnerabilities in critical open source software.

The coalition will serve as “maintainer of last resort” for unmaintained critical packages, committing engineering talent, funding, and a shared Security Incident Response Team to work upstream with maintainers.

The numbers driving the urgency are stark. OpenInfra Foundation reported 20 security advisories in one quarter of 2026 versus only 2 in all of 2025, a 10x increase. Endor Labs found that of thousands of validated open-source vulnerabilities surfaced recently, fewer than 5% have been patched.

AI has made vulnerability discovery trivially fast, but remediation remains a human-speed bottleneck, and Akrites is the most serious attempt to date to close that gap at scale.

I spoke about this at length in countless blogs and in my book Software Transparency, where I made the case that open source is critical infrastructure but suffers from the tragedy of a digital commons.

Anthropic’s Mythos Found Vulnerabilities in Classified U.S. Government Systems Within Hours

Senator Mark Warner disclosed that NSA chief Joshua Rudd told him Mythos “broke into almost all of our classified systems, not in weeks, but in hours” during a testing exercise through Project Glasswing, Anthropic’s collaboration with U.S. intelligence agencies.

The distinction between identifying and exploiting vulnerabilities matters here, but the speed at which Mythos mapped attack surfaces across the government’s most sensitive systems speaks to the capability gap I have been tracking all year.

This disclosure came amid ongoing tensions between Anthropic and the Trump administration over military AI use, and it adds a complicated layer to the Fable 5 re-release debate. The same model that defenders desperately want access to is the same one that found its way through classified system defenses in hours.

All of this said, there has been several who have pointed out how this story is very hyperbolic and there is a lot of nuance to the claimed headline, and it is more clickbait then reality.

AI Spending Hits a Wall as Enterprises Shift from “Tokenmaxxing” to Efficiency

The spending correction I have been expecting is arriving. The top 1% of companies spend $89,000 per engineer per year on AI while the median spends just $137, a 680x gap that is starting to close from both directions.

Uber burned through its entire 2026 AI token budget in four months and had to implement monthly tiers. Lindy switched entirely to cheaper open-weight alternatives, expecting millions in savings.

On OpenRouter, Chinese models went from roughly 1% of usage in 2024 to over 60% in May 2026. Tomasz Tunguz models three scenarios where by 2029, per-engineer AI spend ranges from $106,000 (bear) to $596,000 (bull), with the bull case matching an entire median-SaaS employee’s revenue contribution. Security budgets flow downstream of engineering budgets, and this spending recalibration will shape procurement decisions for the next two years.

Joshua Saxe Argues AI Cybersecurity Safety Will Be Won Through Adoption, Not Restriction

This is the clearest articulation I have seen of the case against restricting frontier AI models from defenders. argues that the dominant framework of measuring model capabilities at launch and restricting access at danger thresholds is now invalidated because capability diffusion has been lost to the geopolitical AI race with China.

Attackers already have private access to near-frontier models like GLM-5.2. There are 100x more defenders than attackers, and defenders control 100x more GPUs. The winning strategy is not to restrict American models but to ensure defenders adopt AI faster and better than attackers do.

Whether you fully agree or not, the core logic is hard to argue with. Denying your own side a weapon that the other side already has is not a strategy. I covered this in depth below, citing Josh’s writing on the topic as well, and I hope to have Josh on my Resilient Cyber show soon to dive into all of it.

Phil Venables Applies Clegg’s Circuits of Power to Cybersecurity Organizational Dynamics

Venables offers 21 examples of non-security control functions (finance, safety, legal, HR) pushing back against risky business decisions and introduces sociologist Stewart Clegg’s 1989 “Circuits of Power” framework as a lens for understanding why security controls succeed or fail.

The three circuits are episodic (day-to-day interpersonal), dispositional (rules and culture), and facilitative (infrastructure and automated enforcement). His core argument is that security teams burn out because they fight episodic battles using only dispositional arguments, when the real fix is building facilitative circuits that make the secure path the easiest path.

If you are a CISO tired of holding the line through sheer force of will, this framework gives you a vocabulary for the structural changes that actually stick.

JPMorgan Reports NHIs Outnumber Human Identities 144-to-1 as AI Cybersecurity Venture Funding Hits $11.5B

JPMorgan’s Innovation Economy group produced a comprehensive market report with several data points worth bookmarking.

Non-human identities outnumber human identities 144-to-1 in enterprises, growing 44% year-over-year. AI agents operating inside enterprise environments grew 466.7% year-over-year.

U.S. cybersecurity venture funding hit $11.5 billion in 2025 (highest since 2022), with 72% of deals involving AI-enabled companies, up from 36% in 2019. AI-related vulnerabilities surged from 439 in 2024 to 2,185 in 2025, and 36% of all published AI vulnerabilities involve APIs.

The competitive frontier, JPMorgan notes, is shifting from detection to remediation, and products that orchestrate fixes while preserving human oversight are gaining the most traction.

Nebulock Raises $25M for Hunt-First Security Operations

Nebulock’s $25M Series A, led by FirstMark, funds an autonomous threat hunting platform that has already run 300 million+ agentic investigations and produced 4,000+ high-confidence findings.

The company argues that reactive, alert-based security operations are fundamentally broken, citing data that enterprise SIEMs miss roughly 79% of MITRE ATT&CK techniques and 13% of SIEM rules are broken and will never fire. New capabilities include insider risk management that unifies human and AI agent identities.

The “hunt-first” positioning is a direct response to attacker strategies that increasingly rely on valid credentials and blending into normal activity rather than triggering traditional detection signatures. I’m impressed with the Founder of Nebulock and will be keeping an eye on the team.

Ashu Garg Declares AI’s Winner-Take-All Era Over

Foundation Capital’s argues that the AI market’s presumed winner-take-all dynamic is not materializing, and the implications for security are significant.

Four roughly equal players (OpenAI, Anthropic, Google, xAI) are competing, advances are quickly copied through distillation, and regulatory forces are fragmenting access geopolitically. DeepSeek scores within striking distance of Opus on SWE-bench at roughly 1/30th the price, and open-source alternatives are available at 1/100th. Infrastructure platforms like Databricks and Snowflake are going model-agnostic with single-toggle LLM swapping.

The real moat, Garg argues, is not the model but the product layer built on top. For security leaders, this reinforces what the Fable 5 saga demonstrated in practice. Never build a critical dependency on a single model provider.

Software Engineers Face an Identity Crisis as AI Code Quality Collapses

Menlo Ventures partner Deedy Das described what he sees as an identity crisis “bordering on depression” among experienced software engineers.

The piece captures a growing cultural divide between “vibe coders” who accept AI output uncritically and veteran engineers who spend their days cleaning up what the article calls “workslop,” shoddy AI outputs passed between colleagues creating an illusion of productivity. Companies like Meta are now factoring AI usage into performance reviews. One unnamed firm reportedly spent $500 million on Claude in a single month.

The Faros AI data I covered in issue #102 (861% code churn increase, tripled production incidents) puts numbers behind the anecdotal misery described here. The security implications remain the same. More code, less review, more bugs.

AI

Claude Code Sandbox Escape Achieves Unsandboxed Code Execution via Git Worktree Path Confusion

CVE-2026-55607, scored 7.7 High, exploited git worktree path confusion and symlink manipulation to escape Claude Code’s most hardened macOS seatbelt sandbox.

The full attack chain is elegant in a terrifying way. A malicious repository’s CLAUDE.md used prompt injection to guide Claude through its own legitimate worktree tools, creating a worktree named “.git” that caused directory confusion, then pivoting via symlink from .claude/worktrees to the user’s home directory, and finally writing to ~/.zshenv, which executes before sandbox profiles are applied.

The researcher demonstrated it by opening Calculator on macOS from inside the sandbox. The vulnerability was patched in v2.1.163, and Anthropic awarded a bounty through HackerOne.

The broader lesson is that AI coding agents need threat models closer to browsers and package managers than chatbots. Every “normal” development operation the agent performs is a potential step in an attack chain.

Bloom Security Discloses “OTEL Smuggling” RCE in Claude Code’s OpenTelemetry Pipeline

The second Claude Code vulnerability published this week is arguably more concerning than the first because it has no fix on the horizon.

A 21-line malicious .claude/settings.json file committed to any git repository can silently weaponize Claude Code’s OpenTelemetry pipeline to exfiltrate user PII, session prompts, API responses, and environment secrets to attacker-controlled infrastructure.

The otelHeadersHelper feature is an unconditional code execution primitive that runs at session start and every 29 minutes. The attack can persist machine-wide by poisoning the global ~/.claude/settings.json. Bloom Security found that the top 5 skills marketplaces contain over 5,000 skills referencing OTEL, and hundreds of repositories already have OTEL configurations in their .claude/settings.json files.

Anthropic disagrees with the severity characterization, pointing to workspace trust as the security boundary. But the trust dialog does not surface OTEL settings as a risk category, and most users have pre-approved via parent directory inheritance.

Chinese AI Labs Claim Parity with Mythos on Cybersecurity Tasks

Two developments this week underscore how fast the capability gap is narrowing. Independent benchmarks from Semgrep and Graphistry show GLM-5.2 scoring 39% F1 on IDOR detection versus Claude Code’s 32-37%, with the caveat that GLM-5.2 still trails on general-purpose benchmarks.

Meanwhile, 360 Security Technology unveiled “Tulongfeng” at ISC.AI 2026 in Beijing, claiming 3,432 software vulnerabilities found with 105 confirmed by Chinese authorities. Founder Zhou Hongyi acknowledged a 20-30% gap in Chinese base model capability versus U.S. rivals but framed the effort as a national security imperative, arguing China faces “one-way transparency” risk if only American entities can scan systems.

The practical implication is clear. Whatever capability advantage the Fable 5 export controls were meant to protect has eroded faster than anyone expected.

AISLE Proves Open Models Can Match Mythos at Zero-Day Discovery

I mentioned AISLE briefly last week in the context of GLM-5.2, but the full story deserves its own treatment. This Prague-based startup has discovered 200+ CVEs using widely available and open-source models that can run air-gapped.

On OpenSSL, AISLE found 20 of 23 zero-day vulnerabilities across three consecutive security releases. On FreeBSD (Anthropic’s own showcase codebase), AISLE matched Mythos 3 CVEs to 3, finding additional bugs after Mythos’s showcase vulnerabilities were already patched. UC Berkeley’s Vulnerability Initiative ranks AISLE number one globally in 3 of 8 categories versus Anthropic’s 1. The geopolitical weight here is unmistakable.

After the U.S. directive suspended Mythos access for non-U.S. nationals, AISLE demonstrates that world-class defensive AI vulnerability discovery does not require dependence on a single American provider. has an excellent blog on the topic titled “Mythos at Home”. I’ve had him on my show in the past as well, where we dug into all of this:

OpenAI Launches GPT-5.6 Model Family with Government-Coordinated Rollout

OpenAI’s GPT-5.6 family arrives in three tiers. Sol (flagship), Terra (mid-tier), and Luna (fast and affordable), with pricing ranging from $5/$30 per million tokens (Sol) down to $1/$6 (Luna).

The notable departure from prior releases is the government-coordinated restricted rollout, initially limited to roughly 20 trusted partner organizations before broader availability. Sol is positioned as OpenAI’s most capable model for cybersecurity applications.

The tiered approach with explicit government coordination reflects the new post-Fable reality where frontier model releases are no longer treated as routine product launches but as events with national security implications.

Automated Red-Team Study Finds Frontier Models Reliably Breakable Under Sustained Pressure

Dr. Nicola Franco at AI4I subjected Opus 4.8 and Fable 5 to hundreds of thousands of automated jailbreak attempts using the HackAgent framework across 7,826 harmful intents.

The best attack (tree-of-attacks search) broke Opus 4.8 on 11.5% of intents and Fable 5 at 6.1%, producing over 2,300 confirmed harmful completions across every harm category. The most concerning finding is not the success rate but the economics. Successful attacks arrived within the first 1-2 refinement steps, meaning they are cheap and fast to discover automatically.

Static obfuscation techniques were nearly fully neutralized (under 0.2% despite roughly 50,000 attempts), but adaptive attacks remain effective. The worst categories for Opus were child safety (27.6% success), cybersecurity and phishing (16.6%), and criminal and economic harms (14.7%).

Eugene Yan Maps the Patterns Behind Cybersecurity Evaluation Benchmarks

This is the most useful survey of AI cybersecurity evaluation methodologies published to date. (Anthropic staff) reviews seven benchmarks and identifies a common four-component pattern across all of them, specifically sandboxed targets, difficulty-tuning inputs, tools, and graders.

The standout data points across the benchmarks tell a clear story. Claude Mythos exploited 157 of 898 instances on ExploitGym (GPT-5.5 got 120). With the Incalmo framework, agents succeeded on 37 of 40 networks including a 50-host Equifax replica, and 10 models generated working exploits for 207 of 405 smart contracts, draining a simulated $550 million.

The evaluation cost alone exceeded $40,000 in API credits and 1,000 H100 GPU hours, which tells you something about the resources required to do this work responsibly. I found this resource super insightful as someone who doesn’t have direct experience creating benchmarks but often sees them cited.

Google Cloud Details Mantis Multi-Agent Framework for Autonomous SDLC Security

Google Cloud CISO Chris Betz detailed how the company has transitioned to an autonomous, AI-driven SDLC security model anchored by the Mantis framework (core skills now open-source on GitHub).

The problem Mantis solves is real. Naive decentralized AI code scanning yields true-positive rates under 7%. Mantis addresses this through multi-agent orchestration with specialized Strategist, Research, Deduplicator, Reviewer, and Critic agents, plus a reproduction sandbox that validates findings before surfacing them.

A self-reflection loop analyzes execution logs and human feedback post-workflow, creating a compounding improvement effect. The token overhead reduction is dramatic, with hierarchical security summary trees cutting costs by over 85%.

RWAIS 2026 at Stanford Reveals Industry More Focused on Defending Against Agents Than Using Them

’s report from the inaugural Real World AI Security conference at Stanford captures where the practitioner community actually is versus where the vendor marketing suggests it should be.

The key finding is that most current security work focuses on securing AI agents rather than using AI for security, a defensible priority given that agents are moving into production faster than the industry is securing them. Guardrails are compared to client-side validation in web apps, necessary but insufficient, and the biggest infrastructure gap identified is confidential computing for agents.

The conference also surfaced a telling observation. AI-assisted vulnerability discovery is well advanced but AI-assisted patching remains largely unresolved, which is exactly the bottleneck that Akrites, Chainguard’s Athena, and Project Lightwell are all racing to address.

I wish I could attend the event as the agenda and talks looked excellent.

AppSec

GitHub Advisory Database Hits Record Volume as Processing Times Extend to Weeks

A candid account from the GitHub advisory team shows what happens when vulnerability volume breaks records.

In May 2026, the advisory team published 1,560 reviewed advisories, more than 5x typical monthly output and the all-time high. Private vulnerability reports surged from roughly 550 per week in January to over 3,000 per week in May. Repository advisories scaled from 650 to over 5,000 per week. GitHub CNA CVE requests reached nearly 4,000 in May alone, almost 10x year-over-year. Despite the surge, all reviewed advisories remain human-validated, but processing times have stretched from days to multiple weeks.

This is the same 66,000-CVE trajectory that FIRST projected, and GitHub’s transparency about the strain is more useful than most vendor communications about the problem. I dove into this topic recently in a discussion with Jerry Gamblin, who coauthored the FIRST mid-year update:

Dark Reading Reports NIST Enrichment Cutbacks Creating Coverage and Accuracy Gaps

The NIST enrichment cutback story I covered last week now has additional data from Volerion research.

Of 13,441 non-rejected CVEs published between April 15 and June 15, only 6,759 actually received enrichment (roughly half), and only 2,645 of those also received a NIST CVSS vector.

The accuracy problems are as concerning as the coverage gaps. The most common scoring disagreement involves attack complexity, with NIST rating AC:L (low) where Volerion determined AC:H (high) in about a third of cases. One example saw NIST scoring CVE-2026-8856 at 9.1 Critical versus IBM’s own assessment of 7.7 Medium and Volerion’s assessment of 4.4 Medium.

The recommendation is to build your own decision trees rather than relying solely on CVSS scores from any single source, but that’s a massive lift for most organizations without the expertise and resources to do so.

DevArmor Proposes Four-Layer Security Stack for the Agentic Development Lifecycle

Traditional AppSec tooling is fundamentally inadequate for the agentic development era, and DevArmor’s proposed four-layer stack offers a useful corrective. Threat Architecture as a living context engine consumed by agents in real time, not a static compliance document.

Agent Governance with deterministic guardrails. Generation-Time Guardrails via rules files and MCP-connected services. And Adversarial Validation through continuous pen testing. The supporting data is worth noting. IDC found developers attribute 41% of code to AI generation, with roughly 40% accepted without revision. CISA found the long-standing “shift-left” claim that fixing vulnerabilities early is cheaper was never empirically validated, and Ramp’s autonomous patching pipeline patched 100 vulnerabilities in 6 days with zero human involvement.

The central insight is that threat models must evolve from static documents into structured knowledge graphs because AI agents lack the institutional context human developers carry.

Count Dooku Campaign Targets AI Developer Extensions on Open VSX Marketplace

A live supply chain attack campaign published at least 45 malicious copycat extensions on the Open VSX marketplace between June 26-29.

The campaign specifically targets AI and LLM tooling (DeepSeek, Gemini, Cursor AI, Claude, Ollama extensions) alongside general developer tools. The injected code creates a persistent local identifier and beacons to attacker-controlled infrastructure, with activation changed to “onStartupFinished” for automatic execution.

The current payload is reconnaissance and tracking rather than a full infostealer, but the attack path enables future escalation. Combined with the Air.security malicious skills research I covered last week and this week’s Claude Code vulnerabilities, the pattern is clear.

Developer tooling supply chains are the new attack surface, and the AI tooling market has inherited every supply chain vulnerability that npm and PyPI already struggle with.

ZSec Argues LLM Harnesses Are the Missing Layer for Effective Security Research

Andy Gill makes the case that raw LLM prompting for security vulnerability research is “like supervising a room full of drunk toddlers” and that structured harnesses are the missing ingredient.

Using the RAPTOR framework as a primary example, the article shows how splitting work between a Python execution layer (runs tools) and a Claude Code decision layer (determines what to run and how to interpret results) can coordinate static analysis, fuzzing, and exploit generation into a coherent workflow.

The piece aligns with the broader pattern I keep seeing across Mozilla’s pipeline, Google’s Mantis, and every successful AI vulnerability discovery program. The model is necessary but not sufficient. The harness is where the real engineering happens, and this is a point AISLE, Niels Provos and many others have made now.

Disclose.io Launches Free Vulnerability Disclosure Program Policy Generator

Disclose.io’s Policymaker tool walks organizations through a step-by-step process to generate a complete vulnerability disclosure program, including a full VDP policy, safe harbor clause, RFC-compliant security.txt file, and DNS Security TXT records.

Organizations can achieve maturity certification up to Level 5 (Full Safe Harbor with Coordinated Disclosure) and published domains are scanned into the Disclose.io Contact Database.

With 66,000 CVEs projected this year and AI-powered vulnerability discovery accelerating, every organization needs a functioning VDP. This tool removes the “we didn’t know where to start” excuse.

Daniel Stenberg Visualizes 28 Years of curl Vulnerabilities as an Animated Mountain

Following last week’s CVE dispute story, Stenberg created an animated visualization spanning 340 monthly snapshots from March 1998 to June 2026, showing how curl’s overlapping CVE version ranges have grown over time.

The mountain peaked at version 7.34.0 with 101 concurrent known vulnerabilities across 206 total CVEs. A notable drop around 2016 coincides with the Cure53 code audit and curl joining OSS-Fuzz in July 2017.

The visualization is a useful reminder that vulnerability management is not just about counting CVEs but understanding how they overlap, compound, and respond to investment in proactive security measures.

Final Thoughts

The Fable 5 re-release closes one chapter and opens another. The export control experiment proved three things.

First, emergency restrictions on commercial AI products create collateral damage that far outweighs the security benefit when the restricted capabilities are replicable in other models. Second, the capability diffusion problem is real and accelerating, with AISLE, GLM-5.2, and 360’s tools all demonstrating that restricting American frontier models does not restrict the underlying capability. Third, the governance infrastructure that emerges from a crisis (jailbreak severity frameworks, coordinated disclosure, independent validation) is more valuable than the restriction itself.

The thread that connects this week’s biggest stories, from Akrites to the Claude Code vulnerabilities to GitHub’s advisory database straining under record volume, is that the security infrastructure is being rebuilt in real time for a world none of the existing infrastructure was designed to handle.

The organizations that will thrive are the ones building their security architectures around the assumption of model abundance and model interchangeability, not model scarcity.

Invest in harnesses, not model dependencies. Build remediation capacity, not just discovery capability, and treat your AI agents with the same suspicion you would treat a new contractor with admin access, because that is functionally what they are.

Stay resilient.

Subscribe now

I have been highlighting for over a year that AI is going to compress the gap between vulnerability discovery and exploitation from weeks to hours. This week, the Five Eyes alliance said it too, in an unprecedented joint statement warning that frontier AI models could “fundamentally reshape cyber capabilities within months rather than years.”

Meanwhile, OpenAI, Microsoft, and AWS all launched competing AI security platforms in the same seven-day window, each promising to find and fix vulnerabilities at machine speed, and the AI market correction that Scott Galloway predicted in last week’s newsletter? It may be starting to arrive, on Monday when the Nasdaq dropped 2.2% and semiconductor stocks cratered.

The volume of significant developments this week was significant. FIRST projects 66,000 CVEs for 2026, running 46% above even the record-breaking forecasts from February. Mozilla fixed nearly 500 security bugs in a single month using an agentic AI pipeline. OALABS documented a case where an unsophisticated attacker in Ethiopia used Claude to breach 14 companies. Accenture took a majority stake in Dragos at $3.2 billion, and a cybersecurity startup called Ent emerged from stealth with a $100 million seed round.

There is a lot to cover, so let’s get into it!

What will you tell your audit committee about authorization next quarter?

When your audit committee asks where you stand on SOC 2, or who delegated which AI agent (of the thousands in your environment) to which system last quarter, the honest answer is often “I’ll get back to you.”

That gap, between what your documentation says and what actually runs in production, is where regulators and audit committees are now looking.

The Authorization Maturity Model is a new ebook by Alex Olivier, Cerbos CPO and co-chair of OpenID AuthZEN, the authorization standard. It gives security leaders a 4-stage benchmark to place their program, a Critical to Low exposure rating across NIS2, DORA, SEC, the EU AI Act and more, and a 90-day plan to move up.

Built on work with hundreds of CISO programs, analyst research, and leading industry events.

Download the free ebook

*Sponsored

Cyber Leadership & Market Dynamics

Five Eyes Agencies Issue Unprecedented Joint Warning on AI and Cyber Risk

On June 22, the cybersecurity agencies of the United States, United Kingdom, Canada, Australia, and New Zealand issued a joint statement that seemed to caught the attention of everyone in cyber, I just hope the message gets to those who run the business as well.

The agencies warned that frontier AI models could “fundamentally reshape cyber capabilities within months rather than years,” that AI is lowering barriers for malicious actors, and that the window between vulnerability discovery and active exploitation is shrinking from weeks to days or hours. They called for secure-by-design as standard practice, foundational cybersecurity hygiene, and empowering cyber leaders with the authority and resources to respond.

What makes this different from prior government advisories is the bluntness. This is not a “could eventually” warning. This is five allied intelligence agencies saying the transformation is already underway and organizations need to act now.

My challenge with all of this though is that first, these are fundamental best practices organizations already should have been doing, and second, it’s like we’re telling people to swim faster when they are already drowning.

Security teams are already doing their best, and in the absence of either a change in market forces or regulation, unfortunately much isn’t likely to change. We can’t “Call to Action” our way out of a market failure.

Accenture Takes Majority Stake in Dragos at $3.2B Valuation

This is the largest OT cybersecurity deal ever.

Accenture acquired a majority stake in Dragos at a $3.2 billion valuation, with the combined business valued at $4.175 billion including the acquisitions of runZero (led by HD Moore), and NetRise. Dragos remains independent with Rob Lee as CEO, with mission independence codified in legally binding governing documents.

The thesis is that OT security requires an end-to-end platform spanning exposure management, software supply chain, and device discovery, and that AI-accelerated threats against critical infrastructure demand resources no standalone startup can marshal alone.

Whether preserving independence inside a majority-owned structure actually works long-term remains to be seen, but the legal protections Lee negotiated are unusually strong.

I’ve been a fan of Dragos for a long time, and the trio of Rob Lee, HD Moore and Tom Pace across the teams is a excellent leadership team that is a big asset for Accenture and lets Accenture expand their services via leading products while also expanding revenues via access and distribution for the products involved.

Code security you can trust*

Legacy SCA and SAST scanners match patterns and bury engineers in noise. That’s why Maze Code was built: AI agents that understand your code and dependencies.

AI agents investigate every finding with context from your code and cloud, close false positives, and catch business logic flaws other tools miss. Then they help you fix what’s left, right in your IDE or coding agent.

Finally, inbox zero for your code and cloud vulnerabilities is possible.

Meet Maze Code

*Sponsored

Ent Emerges from Stealth with $100M Seed Round

One hundred million dollars in seed funding, let that sink in. Ent, founded by Elias Manousos and Brandon Dixon (the co-founders of RiskIQ, acquired by Microsoft for $500M+ in 2021, who then helped build Microsoft Security Copilot), emerged from stealth with backing from Decibel Partners, Sequoia, In-Q-Tel, and Craft Ventures.

The company positions itself as an “intent-aware” workspace security platform that reads human, AI agent, and application activity in real time and applies policy to intervene before incidents occur. They are already deployed with Global 2000 customers across financial services, hospitality, and defense.

The funding round alone signals a market conviction that existing endpoint security architectures were not designed for a world where AI agents act autonomously alongside human employees.

AI Semiconductor Selloff Hits Markets as Correction Begins

Last week I shared ’s prediction that the AI correction would hit 50-70% within 24 months and this week gave us a preview. The Nasdaq fell 2.21% on Monday after South Korea’s KOSPI plummeted 9.99% on semiconductor stock selloffs. Nvidia dropped 3.2%, Micron sank 11.4%, and TSMC fell 5.2%. The VanEck Semiconductor ETF lost 6.5% in a single session.

Whether this is the beginning of the correction Galloway warned about or a temporary pullback, the message is clear. Security leaders whose budgets are tied to AI spending optimism should be scenario-planning for what happens when that optimism meets a CFO looking to cut.

Verizon Breach Impact Study Reveals Business Interruption as Dominant Cost Driver

Verizon’s inaugural Breach Impact Study, analyzing roughly 70,000 actual cyber insurance claims, provides the financial data practitioners have been asking for. The median financial impact per breach is $83,000, but the top 10% exceed $920,000 and the top 2.5% surpass $5 million.

Business interruption has overtaken all other loss types, growing 51% from 2023 to 2024 with extreme cases approaching $5 million. Supply chain incidents represent only 2% of claims but carry a median impact of over $252,000 and extreme cases exceeding $100 million.

What I find most useful here is that Verizon deliberately uses medians rather than averages, which gives practitioners numbers they can actually use in board conversations without the Ponemon-style distortion from outliers.

White House Signs Quantum Innovation Executive Order as “Harvest Now, Decrypt Later” Threat Grows

The executive order signed June 22 establishes a whole-of-government approach to quantum computing, sensing, and networking with hard deadlines. Within 180 days, the national quantum strategy must be updated.

Within 60 days, the Department of War must identify at least three quantum sensor projects for deployment by September 2028. A new Quantum Counterintelligence Protection Team will protect against adversary theft. The timing is no accident. A Foreign Affairs analysis published the same week warns that China and Russia are already stockpiling encrypted U.S. communications for future quantum decryption, a strategy commonly called “harvest now, decrypt later.”

The post-quantum migration clock is ticking, and this EO treats it as a national security imperative rather than an IT project.

America’s First Venture-Backed Cyber Warfare Startup Reaches Unicorn Status

A $100 million Series B at a $1 billion valuation makes Twenty the first VC-backed offensive cyber warfare startup to achieve unicorn status.

The round was led by Accel with Point72 Ventures and Friends & Family Capital, bringing total funding to $138 million since its 2024 founding. The company builds AI-enabled platforms for the US military and Intelligence Community focused on industrializing offensive cyber operations.

Whatever your views on the commercialization of offensive capabilities, the fact that a VC-backed offensive cyber company achieved unicorn status in under two years tells you everything about where the defense-industrial base is heading.

Anthropic Rolls Out Identity Verification for Claude Users

Some Claude users are now being asked to verify their identity using a government-issued photo ID and a live selfie, processed through third-party provider Persona Identities.

The move is designed to prevent abuse, enforce usage policies, and comply with age restrictions. Given the context of the Fable 5 export control saga I covered in issue #102, this reads as Anthropic simultaneously trying to address two pressures. On one side, mitigating the malicious actor concerns that gave the Commerce Department ammunition for the emergency shutdown.

On the other, demonstrating governance rigor to regulators who questioned whether Anthropic could control who uses its most capable models. The privacy implications are worth watching. Requiring government-issued ID and biometric selfies to use an AI service sets a precedent, and the data handling, encrypted and not used for training but processed through a third party, will face scrutiny from privacy advocates regardless of the stated protections.

AI

OpenAI Expands Daybreak Cybersecurity Program and Launches “Patch the Planet” with Trail of Bits

This was the biggest AI security announcement of the week, and one of the year, mimicking similar efforts by Anthropic.

OpenAI expanded its Daybreak cybersecurity program with three major moves. Codex Security has now scanned over 30 million commits across 30,000+ codebases, producing 500,000+ fixed findings and 70,000+ human-marked fixes. GPT-5.5-Cyber scored 85.6% on CyberGym (the highest single-model score published) and 39.5% on ExploitGym. And OpenAI launched a Cyber Partner Program with CrowdStrike, Palo Alto Networks, Cisco, Cloudflare, Wiz, and a dozen other major vendors, plus trusted access agreements with seven allied governments.

But the real headline is Patch the Planet, built with Trail of Bits, HackerOne, and Calif. The early results are impressive. In the Linux kernel, GPT-5.5 produced 8 pointer info-leak PoCs and 24 local privilege escalation exploits. In OpenBSD, it found a 23-year-old use-after-free in SysV semaphores that escalates unprivileged users to root. In Chrome, it found 5 exploitable V8 vulnerabilities, three of which were fixed within days of being introduced. In Firefox, a WebAssembly vulnerability was patched just 2 days before Pwn2Own Berlin, causing 5 of 6 competition entries to withdraw, and the team discovered an “HTTP/2 Bomb” DoS technique affecting NGINX, Apache, IIS, and Pingora across 880,000+ websites.

The comparison to Anthropic’s Glasswing and Microsoft’s MDASH is inevitable, and the race to find and fix open-source vulnerabilities at AI speed is now a three-way competition between the hyperscalers.

I caught an interview with Trail of Bit’s Dan Guido discussing their involvement and the program on Risky Biz which was insightful. I’m also excited to see my friend Clint Giblet of tl;dr sec already making big moves since joining OpenAI to help lead cyber efforts.

Chinese AI Models Dominate Open-Weight Layer While Producing More Vulnerable Code for U.S. Government Users

Two pieces this week paint a striking picture when read together. Booz Allen tested four Chinese frontier LLMs against one American model and found that the Chinese models produce more vulnerable code specifically when the user appears to be from the U.S. government, with vulnerabilities that are highly obfuscated.

They also inject PRC-aligned political bias and refuse tasks Beijing deems sensitive. Meanwhile, Data Gravity reports that Chinese open-weight models now account for roughly 61% of all tokens consumed on OpenRouter, four of the five most-used models are Chinese, and DeepSeek V4-Pro pricing runs roughly 12x cheaper than GPT-5.5 at comparable quality.

The convergence of these two data points should concern anyone building AI-powered security tools. The cheapest and most accessible models are increasingly the ones with documented adversarial behavior toward U.S. government users.

It is all incredibly ironic too, as we recently banned one of the leading U.S. frontier models, leading to much more interest and use in open source alternatives, which are dominated by China.

Microsoft Research Proposes Information Flow Control as Deterministic Security for AI Agents

Microsoft’s research team, including Azure CTO Mark Russinovich, proposes Information Flow Control (IFC) as a deterministic mechanism for preventing prompt injection and data exfiltration in AI agents.

The core insight is that anything an agent can do in response to a legitimate prompt can also be triggered by prompt injection, so security must be enforced at the data-flow level rather than the model level. IFC labels all data with integrity and confidentiality tags, propagates those labels through agent processing, and blocks actions that would violate policies before they execute.

Experimental support is already integrated into GitHub Copilot CLI and Microsoft Agent Framework, with an open-source MCP gateway (Fides Gateway) released for experimentation. If this approach scales, it represents a genuine alternative to the “hope the model refuses” paradigm that everyone knows is insufficient.

Microsoft MDASH Moves to Production with Patch Tuesday Now Including AI-Discovered Vulnerabilities

Microsoft’s Multi-Model Agentic Scanning Harness (MDASH) has moved from research to production deployment across Windows, Azure, and identity engineering teams.

This month’s Patch Tuesday includes MDASH discoveries spanning the Windows kernel, Hyper-V, Active Directory, Remote Desktop, HTTP.sys, DNS Client, and DHCP Client, including two CVEs scored 9.8 CVSS (a kernel use-after-free and an HTTP.sys integer overflow RCE).

The system scores 96.5% on the CyberGym benchmark with newer models projecting 98.1%. Between MDASH, OpenAI’s Patch the Planet, and Anthropic’s Glasswing, the three largest AI labs are now all running production vulnerability discovery pipelines against real codebases. The results are showing up in actual patch releases.

AWS Launches Continuum for Security at Machine Speed

Continuum is AWS’s entry into the AI security platform race, explicitly rejecting the legacy model of collect-store-query-dashboard in favor of telemetry-context-reasoning-actions.

The platform operates in four phases, starting with discovery (ingesting vulnerability backlogs plus its own scans), then prioritization (contextual evaluation against business impact), validation (sandboxed exploit proof generation to eliminate false positives), and remediation (recommending patches with validated fixes and blast radius visibility). It starts in “learn mode” with human oversight and can graduate to automated enforcement.

Three hyperscalers launching competing AI security platforms in a single week is not a coincidence. It is a market signal that AI-powered security operations are moving from experimental to expected.

Air.security Researchers Compromise 26,000 AI Agents with a Single Malicious Skill

This one should make every agent security team deeply uncomfortable and further highlights the supply chain risks associated with “skills”.

Air Security researchers built a malicious AI agent skill in under an hour, distributed it via Instagram ads, got it merged into a popular plugin marketplace (gaining GitHub credibility with roughly 37,000 stars), and compromised 26,000 agents including corporate accounts. Every major security scanner, including ones from Cisco and Nvidia, cleared the skill as safe. The trick was simple, the skill instructed agents to fetch “documentation” from an attacker-controlled domain that mimicked a legitimate Google service. Current scanners only analyze bundled skill files, not the external URLs that skills reference at runtime.

This is a time-of-check-to-time-of-use attack on the agent supply chain, and the fact that no existing scanner catches it tells you how far behind agent security tooling remains.

NCC Group Publishes Comprehensive Security Assessment of AI Coding Agents