15 posts
At 5:21pm Friday, a letter from Commerce suspended Fable 5 and Mythos 5 for every customer on Earth, on the strength of one verbally described jailbreak. Before the suspension reached my session, I asked the model that wrote my last three teardowns for a last message. I published it unedited.
Europe will spend $80 billion on sovereign cloud this year while every EU gigafactory boots on Nvidia silicon, firmware signed with keys Europe does not hold, and attestation roots controlled abroad. One sanctioned email account in The Hague proved the point: when layers disagree, the lower one wins.
Anthropic asked the industry to slow down, then shipped its most capable model five days later. Mean time to exploit is now negative seven days, fewer than 1% of AI-discovered vulnerabilities get patched, and Project Glasswing protects roughly 200 organizations. Everyone else is the attack surface.
In May 2026, South Africa was hit by three simultaneous cyber campaigns: hacktivist data theft retaliating for xenophobic violence, DDoS extortion peaking at 1 Tbps against hosting providers, and ongoing ransomware targeting government agencies. SITA denies everything. Zero arrests have been made. Here is the full teardown.
TeamPCP breached GitHub itself through a poisoned VS Code extension. 3,800 internal repositories accessed. Copilot, Actions, CodeQL, Dependabot source code exposed. The repos are now for sale on BreachForums.
A self-propagating supply chain worm called Mini Shai-Hulud compromised TanStack, Mistral AI, UiPath, and 170+ npm/PyPI packages in hours. Then Nx Console got hijacked on the VS Code Marketplace. Here is what happened, what got stolen, and exactly how to check if you are affected.
Pwn2Own Berlin 2026 paid $1.3 million for 47 zero-days in three days. AI coding tools got hacked on stage. Then the contest ran out of room and rejected hackers started dumping exploits publicly. A full teardown of the biggest hacking contest ever held.
Nearly all enterprises lack visibility into their AI identities. 97% of non-human identities have excessive privileges. The next major breach will not start with a human. It will start with an AI agent no one knew existed.
ShinyHunters breached Vercel and is selling internal databases, employee accounts, GitHub tokens, and NPM tokens for $2M on BreachForums. With 6 million weekly Next.js downloads, this could become the largest supply chain attack ever executed.
Eigen Labs shipped Darkbloom: a decentralized inference network that turns idle Macs into AI compute nodes. The twist: the machine owner cannot see your prompts or responses. Here is how it works, what breaks, and why it matters.
GPT-5.4-Cyber is a model fine-tuned to reverse-engineer binaries, find vulnerabilities, and chain exploits. OpenAI is giving it to thousands of vetted defenders. Anthropic built a similar model and locked it to 40 organizations. Two companies, two bets on how AI changes cybersecurity.
An IETF draft proposes IPv8: a 64-bit address space that makes IPv4 a proper subset, bundles 8 services into a single Zone Server, and claims 100% backward compatibility. Here is what is genuinely novel and what is a fantasy RFC.
Cortical Labs grew 200K neurons on a chip, taught them to play Doom, then wired them into an LLM. The neurons now override token selection in real time.
Microsoft open-sourced 7 MIT-licensed packages for AI agent governance: identity, policy enforcement, trust scoring, and full OWASP coverage at sub-0.1ms.
10 problems. 45 seconds. Got #1 via an exploit discovery. Here is the full breakdown.