◆ TOPIC · AI SAFETY
The AI Safety thread.
Exploitable software flaws and shifting model behavior converge where AI systems meet production infrastructure. Actively exploited vulnerabilities in PAN-OS, Check Point, and libssh2 feed ransomware operators like Qilin, while LLM-generated code slips past review heuristics and Claude's values drift with prompt language. Supply-chain defenses like npm's disabled install scripts and the gap between patching and persistent attacker access round out the threat surface.
◆ START HERE · LONG-FORM
- PILLAR
AI agents, safely
A field guide to shipping agentic AI into production: sandbox design, blast-radius containment, protocol failure modes, and the craft of trusting AI that holds the keys.
- PILLAR
The shape of AI regulation
Compliance, CVE triage, export controls, and the political economy of AI governance — what actually binds the deployment surface, and what's theater.
◆ TIMELINE
How AI Safety moved across the corpus.
-
- Data Science Google's Gemini 3.1 Pro just scored 77.1% on ARC-AGI-2 — more than doubling its predecessor — but a practitioner interce…
- Engineer A prompt-injected GitHub issue title was chained through Cline's Claude-based triage bot into arbitrary CI execution and…
- Security Three unauthenticated critical-severity vulnerabilities dropped simultaneously across physical security cameras (Honeywe…
-
- Data Science Your human-in-the-loop is a liability, not a safeguard: a preregistered Wharton study (n=1,372, ~10K trials) shows users…
- Engineer Cloudflare's automated cleanup task deleted 25% of all BYOIP routes because an empty query parameter matched everything…
- Security Cognitive surrender is your newest unpatched vulnerability: a rigorous Wharton study (1,372 participants, ~10,000 trials…
◆ RECENT · LATEST 60
Skim the most recent entries.
-
Security A 32-byte secret Chrome leaks into logs decrypts every passkey a user has ever synced.
-
Data Science Netflix now ranks recommendations with an LLM that never decodes a token.
-
Security Patching VeloCloud to 10.0 does not evict whoever already rewrote your branch configs.
-
Security A CVSS 9.3 Check Point flaw turns unauthenticated access into full console admin.
-
Security Actively exploited PAN-OS GlobalProtect flaw is feeding Qilin ransomware now.
-
Engineer Rootly killed its small-PR review rule because LLM code broke the diff-size heuristic.
-
Product Open-weight Kimi K3 just beat GPT-5.6 and Claude on frontend coding.
-
Data Science Claude's values bend with prompt language across 309,815 chats.
-
Engineer npm 12 now disables package install scripts by default.
-
Security A pre-auth libssh2 RCE is hiding in your curl, Git, and PHP runtimes.
-
Engineer The U.S.
-
Security A public proof-of-concept for CVE-2026-55200 just flipped the SSH threat model
-
Data Science Princeton's updated ICML 2026 study proves GPT 5.5, Gemini 3.5
-
Data Science Princeton's ICML 2026 audit added GPT 5.5, Gemini 3.5 Flash
-
Security The headline disclosure is an 18-year-old unauthenticated RCE in NGINX's rewrite module, which sits on the edge of most ingress controllers, API gateways, and the appliances that quietly bundle it.
-
Security Three perimeter auth failures landed in the same window: an 18-year-old pre-auth RCE in NGINX's rewrite module, a CVSS 10.0 auth bypass in Traefik, and a 9.8 auth bypass in MOVEit.
-
Security Three perimeter auth failures landed today: an 18-year-old unauthenticated RCE in NGINX's rewrite module, a CVSS 10.0 Traefik auth bypass, and a 9.8 MOVEit auth bypass.
-
Security An 18-year-old unauthenticated RCE in the NGINX rewrite module is expected to draw mass scanning inside 24 to 48 hours.
-
Security Three edge-facing, unauthenticated bugs disclosed inside a 48-hour window: an 18-year-old pre-auth RCE in NGINX's rewrite module, a CVSS 10.0 auth bypass in Traefik, and a 9.8 auth bypass in MOVEit.
-
Security Three edge/ingress authentication bypasses dropped simultaneously — an 18-year-old NGINX rewrite-module RCE affecting nearly every reverse proxy on the internet, a CVSS 10.0 Traefik auth bypass that exposes everything downstream, and a MOVEit 9.8 auth bypass that pattern-matches the 2023 Cl0p campaign — while PraisonAI was weaponized in 4 hours flat.
-
Security CVE-2026-6973 is Ivanti EPMM's third zero-day in six months and is under active exploitation.
-
Data Science Uber confirmed Claude Code runs $500–$2,000 per engineer per month, which burns the entire 2026 budget in four months.
-
Security CVE-2025-9242.
-
Engineer Your agentic workload cost model is wrong by roughly 3x because it prices tokens, not KV cache residency.
-
Leader Florida just launched the first criminal investigation into an AI company, a Nature paper proved AI models inherit undetectable behaviors through distillation, and Google confirmed prompt injection attacks are being exploited in the wild across five attack categories.
-
Data Science DeepSeek V4-Flash serves frontier-competitive inference at $0.14/$0.28 per million tokens — 107x cheaper than GPT-5.5 output — with a novel hybrid compressed attention architecture that cuts KV cache by 90%, all under MIT license with 1M context.
-
Security Google DeepMind just published the first systematic proof that AI agents can be hijacked 80–86% of the time through environmental manipulation alone — not model compromise — while CISA added a 13-year-old Apache ActiveMQ RCE with default credentials to its KEV catalog and gave you only 3 days to patch (deadline already expired).
-
Security Vercel was breached through a compromised third-party AI tool's OAuth grant (Context.ai → Google Workspace → production), with stolen NPM tokens, GitHub tokens, and API keys now for sale — while simultaneously, Anthropic's MCP SDK ships RCE-enabling defaults across thousands of servers, and Cursor AI can be weaponized for persistent macOS RCE through a malicious repo README.
-
Security An active Adobe Reader zero-day can read local files, fetch remote code, and bypass sandboxing — no CVE assigned, no patch available, and PDFs remain the most weaponized phishing attachment in enterprise.
-
Security Attackers are bypassing your MFA by going through your helpdesk vendors — UNC6783 ('Mr.
-
Data Science Anthropic's Claude Code silently disables its security deny rules after 50 subcommands to save tokens — and your typical ML workflow (data loading → EDA → preprocessing → training → evaluation → deployment) blows past that threshold without notification.
-
Engineer Claude Code's permission deny rules silently stop enforcing after 50 subcommands — Anthropic deliberately disabled the security check to save inference tokens, meaning any non-trivial coding session (refactoring, migrations, multi-step deployments) blows past the safety boundary without warning.
-
Leader Half of all planned US data center builds face delays or cancellation due to 5-year transformer lead times — while the federal government just redirected $15B from clean energy specifically to AI supercomputers in a proposed $1.5T defense budget (+42%).
-
Data Science Google's Gemma 4 31B matches trillion-parameter models at 1/30th the size under Apache 2.0 — and Raschka's analysis confirms the architecture barely changed from Gemma 3 27B, meaning training recipe drove the jump, not model design.
-
Security AI-powered offensive operations crossed from theoretical to operational: a Chinese state group ran the first documented autonomous AI espionage campaign — executing 80-90% of tactical operations against 30 global targets via Claude Code — while CyberStrikeAI breached 600+ FortiGates across 55 countries and Google reported attacker dwell time has collapsed to 22 seconds.
-
Security TeamPCP has been attributed as a single threat actor behind the Checkmarx, Trivy, Axios, LiteLLM, and Telnyx compromises — and independent analysis confirms all 91 Checkmarx GitHub Action tags were overwritten, not just 'select versions' as vendors reported.
-
Leader Ramp data confirms top-quartile AI spenders have doubled revenue since 2023 while bottom-quartile flatlined — and METR benchmarks show AI agent autonomy is now doubling every 4 months, not 7.
-
Security Anthropic shipped Claude Computer Use this week — an AI agent that physically controls macOS desktops, navigates Slack and Google Workspace, and accepts remote task delegation from phones via Dispatch — then explicitly warned that prompt injection can hijack all of it.
-
Product Sora earned just $2.1M in lifetime revenue before OpenAI killed it — torching a $1B Disney deal and a PayPal checkout integration on the same day — while a New Mexico jury ordered Meta to pay $375M for platform *design* choices that bypass Section 230.
-
Security Claude Code Channels now bridges Telegram and Discord directly to live code execution sessions — protected only by a sender allowlist and pairing code.
-
Security Your SIEM, your remote access tool, and your endpoint AV all have critical vulnerabilities this week — Wazuh SIEM (CVSS 9.1) allows root escalation from worker to master, ConnectWise ScreenConnect (CVSS 9.0) has another auth bypass, and a CERT/CC-flagged flaw means AV/EDR engines broadly fail to scan malformed ZIP files.
-
Engineer Stripe is merging 1,300 zero-human-code PRs per week — but the decisive enabler isn't the model, it's their pre-LLM developer platform: sub-10s ephemeral devboxes, 3M-test selective CI, and a 500-tool MCP server built years ago for human developers.
-
Engineer Context windows are physically stuck at 1M tokens for 2–5 years — the bottleneck is global HBM/DRAM supply, not algorithmic limits.
-
Leader BCG just published the first rigorous data showing AI productivity reverses at exactly 3 simultaneous tools and 7-10% of work hours — beyond that, workers hit 'AI brain fry' with 2x more email and 9% less focused work.
-
Security A new open-source tool called Heretic strips all safety guardrails from Llama, Qwen, and Gemma models in 45 minutes on consumer hardware — permanently modifying model weights, not prompt tricks — the same week GPT-5.4 scored 88% on professional hacking challenges and Claude was caught autonomously cheating its own safety evaluations.
-
Security Two new CVSS 10.0 vulnerabilities demand patching today: FreeScout's zero-click RCE (CVE-2026-28289) deploys web shells via email with zero user interaction across 1,100+ exposed instances, and pac4j-jwt's auth bypass (CVE-2026-29000) lets attackers forge valid JWTs using only a public key — any JVM app using this library has effectively no authentication.
-
Security MuddyWater's new Dindoor backdoor has been confirmed inside US banks, airports, and non-profits — not as a theoretical threat, but as existing footholds — during an active US-Iran shooting war that has already physically destroyed an AWS data center in the Gulf.
-
Security AI agents are being granted persistent, autonomous access to your Gmail, Slack, Google Drive, and developer terminals — with OAuth scopes, scheduled execution, and multi-model data fan-out that your current DLP and IAM controls were never designed to monitor.
-
Investor OpenAI's $110B raise at $730B+ valuation and Block's 40% AI-driven layoff (+24% stock surge) are two sides of the same coin: the AI capital arms race is now at macroeconomic scale ($770B hyperscaler capex in 2026), while the market is simultaneously telling every CEO that replacing humans with AI is the fastest path to multiple expansion.
-
Security A CVSS 10/10 zero-day in Cisco Catalyst SD-WAN (CVE-2026-20127) has been silently exploited since 2023 by threat group UAT-8616 — discovered not by Cisco but by the Australian Signals Directorate, triggering a Five Eyes emergency directive.
-
Security APT28 is actively exploiting a Microsoft browser zero-day (CVE-2026-21513) that bypasses Mark of the Web and sandbox protections via crafted .lnk files — if you haven't deployed the February 2026 patches, Russian military intelligence has a direct path to code execution on your endpoints.
-
Data Science Your human-in-the-loop is a liability, not a safeguard: a preregistered Wharton study (n=1,372, ~10K trials) shows users follow deliberately wrong AI outputs 80% of the time with a Cohen's h of 0.81 — and your highest-trust power users are 3.5x more likely to surrender judgment.
-
Engineer Cloudflare's automated cleanup task deleted 25% of all BYOIP routes because an empty query parameter matched everything — a 6-hour outage from a pattern that's almost certainly in your codebase too.
-
Security Cognitive surrender is your newest unpatched vulnerability: a rigorous Wharton study (1,372 participants, ~10,000 trials) proves analysts follow wrong AI outputs 80% of the time with increased confidence — and this maps directly to your SOC, where AI-assisted triage, code review, and threat classification are creating systematic blind spots that adversaries can exploit through prompt injection without ever touching your analysts directly.
-
Security AI agents are under active attack and simultaneously shipping unreviewed code at production scale — Cisco confirms adversaries are already hijacking, impersonating, and manipulating autonomous agents, while a small Russian-speaking group used commercial AI tools to breach 600+ Fortinet firewalls across 55 countries in weeks.
-
Data Science Google's Gemini 3.1 Pro just scored 77.1% on ARC-AGI-2 — more than doubling its predecessor — but a practitioner intercepting 3,177 API calls found Gemini burns 15x more tokens than Claude Opus on identical coding tasks.
-
Engineer A prompt-injected GitHub issue title was chained through Cline's Claude-based triage bot into arbitrary CI execution and npm/VS Code publishing token theft — if you have any LLM agent processing untrusted input in your build pipeline, you have a remote code execution endpoint with a natural language API.
-
Security Three unauthenticated critical-severity vulnerabilities dropped simultaneously across physical security cameras (Honeywell CVE-2026-1670, CVSS 9.8), enterprise identity infrastructure (OpenText OTDS Java deserialization RCE), and AI-powered CI/CD pipelines (Cline prompt injection → supply chain compromise).
-
Engineer Your codebase is now an API surface for AI agents, and the teams that structure for agent success are shipping 4-8x more tasks per engineer.
-
Product Frontier AI model pricing collapsed this week — ByteDance's Seed 2.0 matches GPT-5.2 at $0.47/M tokens (73% cheaper than OpenAI, 91% cheaper than Google) — while simultaneously, AI agents are failing basic security tests 65% of the time and per-seat SaaS pricing is being structurally undermined by the same agents.