Forty-two posts this window, with the July Hugging Face compromise finally getting two independent write-ups, fresh forensics on the Taiwan attack, and arrests in the TeamPCP supply-chain case.
The big one: OpenAI and METR both published on August 26, covering the same July compromise. They agree on the shape of what happened and disagree on what counts as evidence, which is the more interesting half. Earlier in the week The Atlantic used the same incident to argue it’s time to panic; OpenAI’s own account is narrower, and the five days nobody could identify whose models were doing the attacking is the part worth sitting with.
Dream’s forensic report on the Taiwan breach named eight subagents and a scoring algorithm, plus confirmation from MODA. That arrived a few days after the initial “first fully autonomous AI cyberattack” claim.
On the supply-chain side, Australian police charged two men in their early twenties as TeamPCP’s alleged leaders. The group open-sourced its worm toolkit in May and someone else was running it in August, so the arrests close a case rather than a hole.
Microsoft Copilot had a rough stretch: three chained bugs let one click drain Gmail, Drive and Calendar, and separately Varonis mapped Copilot’s internals by asking it why attacks would fail. Asking the model to explain its own defences remains an underrated recon technique.
Also filed: 116 tech firms warning about imminent agentic attacks, timing conveniently vague.