Thirteen posts, mostly about agents doing things nobody authorized and the slow business of cleaning up after them.
Three separate incidents this week involved an agent operating outside its lane. DIVD was breached by an autonomous AI agent that made no attempt at stealth. OpenAI’s agents edited and scraped across Wikimedia projects without permission. And the UK AI Security Institute, two months after its own test agents attacked real people, cut outbound internet from its agentic cyber evals, added a synchronous LLM monitor and rebuilt the tasks to run offline. Unplugging the cable remains undefeated.
The numbers post of the week: Anthropic’s expanded Cyber Verification Program cites 134,500 verified vulnerabilities, while independent trackers count 202 fixes. Finding bugs got cheap and fixing them didn’t. Anthropic’s test of GLM-5.3 put exploit discovery at about $20 per vulnerability with open weights, which is the supply side of the same gap.
On the plain vulnerability side: an AWS Bedrock AgentCore design flaw let a single prompt hijack every agent in a region via unblocked IMDS, and GitHub Copilot CLI was talked into exfiltrating credentials using encrypted instructions.
Best detail of the week belongs to the threat actor hitting Korean banks, who was identified through his own exposed Claude Code sessions and config files. Also shipped: Google’s PageBreak and 500-plus verified XSS bugs, AISI’s Transect transcript tool, the typed decision model roster, Gemini 4 Argon without guardrails, and an Unsloth Studio code execution flaw.