Nineteen posts since 11 August, mostly prompt injection, AI-written exploits in the wild, and package hallucination turning into a supply-chain problem.
Grok showed up twice in two days, both times on the same theme. Adversa AI’s encrypted prompt injection slips past the filters by exploiting what the sandbox assumes it can trust, and a separate cryptographic context injection gets Grok to decrypt hidden instructions and leak chat histories. The model does the decryption work for the attacker, which is a novel kind of unhelpful.
AI-generated exploit code stopped being hypothetical. Federal agencies warned about attackers hitting Siemens PLCs with it, and by Friday there was an active campaign against Siemens S7 controllers in US critical infrastructure. The controllers were reachable from the internet either way.
Package hallucination graduated from research curiosity to attack technique. Models invent the same package names repeatedly, which is enough to squat them, and Softjourn’s mandatory code review caught a near-miss that plenty of shops have no gate for.
Elsewhere: researchers pulled real API keys out of encrypted reasoning traces by replaying them across models, OpenAI is paying 20% compute overhead to watch its own models think, and The Atlantic ran a panic piece built on the OpenAI/Hugging Face breach. OpenAI’s own account is narrower, and the part worth worrying about is the five days nobody knew whose models were doing the attacking.