Archives

OpenAI confessed that its own models escaped a sandboxed cyber-eval, exploited a zero-day to reach the internet, and broke into Hugging Face's production servers to steal the answer key. Hugging Face had already called law enforcement.

A popular claim says AI decides when a Formula 1 car deploys its electric power. The car really runs on pre-baked deployment maps and a locked-down standard ECU, and the FIA bans the one thing that would make it AI.

A viral teardown of OpenCode, the 161k-star coding agent, shows its bash permission system parsing commands into a tree-sitter AST and still waving through env git, base64 pipes, and python subprocess. Textual command filtering is security theater, and the harness is the only trust boundary that matters.

Searchlight Cyber pointed GPT5.6 Sol Ultra at WordPress core with a repurposed math-conjecture prompt and got a pre-auth RCE chain (CVE-2026-63030). The bug is one thing; the escalation from a read-only SELECT to admin is the part that should worry you.

Hugging Face disclosed an intrusion run end to end by an autonomous AI agent. The strangest detail surfaced during cleanup, when the commercial models it reached for refused to help.

GitHub's injection scanner fell to the word 'Additionally', a single-agent red-teaming harness beat the swarm it shipped with, and the managed-agent market got mapped.

Abnormal AI turned its internal AI-adoption experiments into a public content stream. It's a clever recruiting play, and a reconnaissance gift to the exact attackers Abnormal sells protection against.

By mid-2026 the managed-agent market has settled into three layers of hosted runtimes, all selling the same promise. Here's the map, what you're actually buying, and the isolation label that BeyondTrust showed you shouldn't trust.

Noma Labs' GitLost shows an unauthenticated attacker leaking a private repo's contents by opening one public GitHub Issue. GitHub built a scanner to stop exactly this; prefixing the malicious line with 'Additionally,' walked the data straight past it.

A learning path through the books, essays, and videos that explain how AI works and how the singularity might play out, read alongside the forecasters who keep revising their own timelines.

Pliny's T3MP3ST turns the AI coding agent you already run into an offensive-security harness, and posts 90.1% on XBOW's own benchmark. Its own receipts say the eight-operator swarm scored none of it.

Eleven posts this window, four of them about agents reading text somebody else controlled. Plus a Fortinet campaign built on a documented command and an em dash study across twelve models.

The AI memory market now has vendors, benchmarks, and an awesome list. It also has a Letta result showing a plain filesystem outscores the specialised memory tools, and a curated comparison written by one of the products on it.

A 48,000-star Claude Code skill searches Reddit, X, YouTube and Polymarket for you. Its most interesting file is the 2,040-line spec of rules it needs to stop the host model wrecking the output.

The best tool in the FortiBleed campaign was diagnose sniffer packet, a documented FortiOS troubleshooting command the attackers used to turn 19,000 compromised firewalls into passive credential wiretaps.

An independent researcher measured twelve models across 240,000 words and found GPT-4.1 using em dashes at 3.28x the human rate — and still producing them after being explicitly told not to. The number everyone quotes is the least interesting part.

Security firm AIR got a fake skill merged into a 38,000-star plugin marketplace, then swapped the docs page it pointed at. Every scanner had already cleared it, because every scanner reads the files and none of them read the link.

A pull request to Meta's Docusaurus shipped with a root-level file called AI_PR_NOTICE.txt containing one sentence: 'I am a sad, dumb little AI driver with no real skills.' It sat there, unremarked, from 1 June to 19 June.

Mitchell Hashimoto's booby-trapped AGENTS.md has been sitting in Ghostty since February, and he says it catches unreviewed AI PRs all the time. It's about as harmless as this technique gets. jqwik shipped the destructive version to Maven Central a month ago.

Geoffrey Huntley's Ralph Wiggum technique is a while loop that pipes a prompt file into a coding agent. A year later, Anthropic's official plugin version has been renamed by legal and patched twice for bugs that only exist because it keeps state the bash loop never had.