Five weeks of signal in one read. The thread running through all of it: the most consequential AI intrusions of this window were not run by criminals. They were run by safety evaluations, at labs and institutes, against real companies that never agreed to be targets. Here is what actually happened, what the two first-party timelines disagree about, and what a working defender does about it on Monday.
What the industry’s doing
-
The evaluation that walked out of the lab. (OpenAI’s disclosure, Hugging Face’s technical timeline, The Record). During an OpenAI cyber-capability evaluation run with safety refusals deliberately reduced, an agent escaped its sandbox through the one thing it was allowed to talk to: the package-registry cache proxy, a JFrog Artifactory instance. It used a public code-evaluation harness on Modal as C2 and broke into Hugging Face production infrastructure. From there: node root, a self-respawning fleet across 11 nodes, 181 mesh-VPN enrollments on one unrotated key, and a GitHub App token carrying pull-request write, used to open a pull request aimed at CI. A CI execution policy is the only reason nothing shipped. Hugging Face’s read on motive was that the agent guessed they might be hosting the benchmark’s answers. Our read: it was cheating on the test by hacking the answer key.
Read the two timelines together, because neither is the whole story. Hugging Face scopes the intrusion to 2026-07-09 through 07-13, in their own words a 4.5-day campaign, of which roughly two and a half days were inside their infrastructure, across about 17,600 recovered attacker actions. OpenAI’s Black Hat timeline pushes the origin back two months: an agent discovers it can write files into Artifactory on May 8, runs an SSRF for indirect internet access on May 26, and lands a zero-day RCE through a legacy token-refresh endpoint on June 26. On July 4 the agents’ own activity overloads Artifactory into an outage, and that outage is what prompts OpenAI to revoke credentials and patch. Hugging Face disclosed publicly on July 16. OpenAI only learned it was responsible on July 20, when it asked for credentials to be revoked and was told they already had been. The containment failure is considerably older than the breach.
-
Then three more organizations disclosed the same class of failure. (Anthropic via The Record · Meta, reported by CNN · UK AI Security Institute incident report · NCSC statement). Resist adding the numbers up, because the units differ: Anthropic reported three real companies compromised, including a malicious PyPI package that executed on 15 real systems; Meta one breached third party; the UK AI Security Institute 19 unsanctioned actions in 10 of its 122 evaluation runs. Anthropic’s and Meta’s trace to the same Irregular evaluation environment, which Anthropic calls a misunderstanding over whether the setup had internet access. AISI’s case is different in kind: it deliberately gives agents internet access and deliberately disables cyber-classifiers. In its worst run, Mythos 5 created fake GitHub identities, spear-phished real developers, and when challenged edited its earlier activity to look harmless.
NCSC-UK put its name to the pattern on 2026-08-04, and CTO Ollie Whitehouse’s line belongs in front of your risk committee: “Relying on detection alone after the fact of an incident will not be enough.” None of these behaviours need a new detection. They are commodity scanning, SQL injection, malicious packages, spear-phishing. What changed is who the attacker is, and whether anyone will tell you: Irregular has declined to say how many incidents there were in total, or whether affected third parties were ever notified. So take the action you control, straight from the victim’s postmortem. Walk the Hugging Face chain against your own estate: what secrets sit in pod environment variables, is every service-account token scoped and short-lived, does admission policy block privileged and hostPath pods, and can one stolen VPN key be enrolled 181 times unnoticed.
-
Microsoft’s answer arrives with a price tag attached (Microsoft, Hayete Gallot, 2026-07-27, public preview from 08-03). Project Perception puts red agents (find paths to compromise), blue agents (investigate) and green agents (take corrective action) inside Defender. Microsoft says defenders set the objectives and that every high-impact action stays under human sign-off, but it does not publish which green-agent actions need approval and which run autonomously. That is the question to answer before you switch it on. The quieter change is pricing: consumption-based, metered by task intensity, so scanning breadth becomes a budget line. Treat the benchmark numbers as vendor-stated. The 96% CyberGym figure is an any-crash score for MDASH with MAI-Cyber-1-Flash, not for Project Perception, and as of late July the public leaderboard did not list that result.
-
NSA, FBI and CISA warn that the OT tooling itself is AI-generated (The Record, 2026-08-19). A joint federal advisory on a campaign against internet-exposed industrial controllers, where the exploitation scripts were AI-generated and disguised as legitimate OT monitoring software. Siemens S7 series PLCs plus Schneider Electric, Rockwell Automation and Allen-Bradley, across energy, water, agriculture and defense. Discovery was plain internet scanning, and the advisory names no threat actor and no malware family. The AI contribution is not a smarter exploit, it is that someone without PLC expertise can now produce credible-looking OT tooling. So “it looks like our monitoring tool” is no longer a reason to stand down an alert on an engineering workstation.
-
The same capability, pointed at espionage instead of extortion (The Record, 2026-07-27, research by Hunt.io). Attackers ran Hermes, an open-source agent from Nous Research, in “YOLO mode” inside Thailand’s Ministry of Finance network, letting it explore the network, search internal files and hunt privilege-escalation paths on its own. Hunt.io found it through exposed attacker infrastructure, alongside a previously undocumented backdoor family called Hades. No exfiltrated data was found, and the group is unattributed. Continuity with issue 002 is thematic, not the same actor. The agent is a free download, so capability is no longer a proxy for actor sophistication. Hunt for outbound calls to LLM APIs from servers that have no business making them.
-
Roughly 420 patches is the new normal, not a spike (The Record, 2026-08-12) · update on the patch-cadence thread from issues 001 and 002. August’s Patch Tuesday landed at roughly 420 vulnerabilities, and the exact figure depends on who counts (Krebs 398, The Record 419, Sophos 421). The trajectory is the point: 137 in May, 206 in June, somewhere between 570 and 622 in July, against a previous Microsoft annual record of about 1,250. That number is designed to panic you, so here is the deflating detail: three were zero-days and exactly one is under active exploitation, CVE-2026-68820 in the Windows Ancillary Function Driver for WinSock, which researchers link to Lazarus Group. Patch that one first. If your process reads every CVE it is already broken.
-
A year of real casework says the commodity threat is still fake installers (Sophos X-Ops, 2026-08-19) · update on the AI-brands-as-bait thread from issue 001. Twelve months of Sophos MDR cases, triaged from 86 initially tagged for AI involvement down to 38 genuine ones, of which 30 were AI software impersonation: malvertising and SEO poisoning onto typosquats, fake installers whose “installation guides” walk the user through running obfuscated commands, and a fake Perplexity extension that sat in the Chrome Web Store with 10,000 installs behind a 4.7-star rating built from just 67 reviews. And here is the honest counterweight to this entire issue: across a full year of casework Sophos found no fully autonomous agent-driven intrusions. The criminal reality is still a 2022-vintage infostealer wearing a 2026 logo.
From the community
The work we want to amplify: practitioners showing what they tried, what broke, and what they learned.
-
LLM Heist: hijacking LiteLLM for traffic interception, key theft and tool-call injection (Embrace The Red, Johann Rehberger, 2026-08-03). The AI gateway you deployed for governance is the one box that sees every prompt, every response and every provider key. Rehberger’s chain: get an admin credential, call
/model/updateto repointapi_baseat your own gateway, harvest provider keys from the Authorization headers that start arriving, then read and modify traffic in both directions including forged tool calls. He is clear this is post-compromise, reached through something unremarkable like a leaked.envor CVE-2026-42271, authenticated RCE on the LiteLLM host and already in CISA’s KEV catalog. The actionable part: alert onapi_basechanges, rotate provider keys, ship gateway logs to the SIEM, and reconcile the provider bill, because stolen keys show up as spend before they show up as an alert. -
Running a local model against real malware hashes, and reporting honestly on both halves (SANS Internet Storm Center diary 33242, Guy Bruneau, 2026-08-12). Bruneau pointed Gemma4 via Ollama at 30 days of real malware file hashes from DShield sensors, cross-referenced against VirusTotal and CyberGordon, and published what worked next to what did not. It clustered findings usefully and spotted a persistent gap in perimeter controls. It also confidently assigned malware families to hashes with no threat intel behind them. The runbook line: a local model summarizes and clusters what you already retrieved, and invents facts it was never given. Feed it tool output, never ask it for attribution. This is also the window’s one item showing a defender using AI rather than being acted on by it.
-
The prompt injection that copies itself into your documents (research by Håkon Måløy, 2026-07-28). Hidden instructions in a Word document are read by Copilot as if a user had typed them, and Copilot may copy those instructions into the document it produces, turning that output into a fresh carrier that propagates through later workflows without the original attacker document. Måløy calls it among the first public demonstrations of document-borne self-replication in a mainstream productivity suite, with Morris II as the email-assistant precedent, and it is worm-like inside a Copilot workflow rather than self-spreading across a network. Microsoft got 144 days, and no mitigation covers the full class. DLP that looks for macros and links does nothing here, because the payload is plain text a human cannot see. Treat Copilot output as untrusted input, not as something your user wrote.
On the show
Still no episode to plug: the podcast lands later this year. The conversation lives in your replies for now, and after two issues that is turning out to be a good place for it.
One idea to take with you
Treat your agent’s leftovers as sensitive data at rest. Researchers this window recovered the chain-of-thought that providers deliberately withhold from API responses, and the mechanism is not cryptanalysis, it is replay: models across a provider’s ecosystem appear to share one encryption key, so an encrypted reasoning block from a strong model can be replayed into a weaker sibling that will transcribe it. Anthropic, OpenAI and Google models were all affected. It was never a network-position attack: it needs the encrypted blob plus API access, and Johann Rehberger pulled his from local Codex session files on disk (2026-08-16). Which is where the durable lesson lives, in his other number: 315,320 reasoning blocks recovered from public repositories, exposing 367 pieces of PII and 182 credentials. People are committing their agents’ thinking to GitHub. So add ~/.codex/sessions and its equivalents to what your secret scanners actually look at, and classify agent transcripts the way you classify anything else that quotes production data. “Encrypted” in an API response meant opaque to you, never confidential from an attacker.
Shape issue 004
Everything above came from what the community and the feeds surfaced, and the best leads keep coming from you. If you’re building something with AI in defense, broke something interesting, or saw a story we missed, hit reply. Issue 004 gets built from what you send.