The 2026 OWASP LLM Top 10 puts prompt injection at number one, same as every year before it. For the first time, you don’t have to take the ranking on faith anymore. Up until now, we ran this on gut. On human intuition and judgment from experts on the front lines. This time is different. For the first time, we had a corpus of reported incidents to validate our assumptions against. So we did just that. We checked our judgment against 6,639 real incidents pulled from public databases. There were differences and surprises. The risk the whole field fears most barely showed up in the record of what has gone wrong.

That gap is where this year’s story starts, and it’s why this is the first version of the list you can argue with using evidence instead of opinion.

Subscribe now

The Question I Couldn’t Shake

For years, this list came from a vote. Practitioners score the risks, the scores set the order, and the order sends thousands of teams to their defenses. A vote is a fine way to rank risk. It captures the judgment of people who break and defend these systems for a living. It also carries their blind spots and their biases. We rank what we read about last month above what quietly broke last year. We anchor to where the previous list sat. One question kept circling me through this whole cycle. What if the risks we fear most aren’t the ones doing the most damage? There’s one honest way to answer that. Go get the record and read it.

We Went and Read the Record

We pulled 7,714 real incidents out of the public databases where these failures show up: CVE, GHSA, OSV, and the AIAAIC harm database. Then we built classifiers to read every one and sort the 6,639 that carried enough detail into the taxonomy.

The part that wasn’t clean? The incident record. It isn’t a nice, clean, tidy grid of labels. It’s the Amazon Q coding extension that shipped with a wipe-the-machine instruction committed straight into its repository. It’s the unofficial postmark-mcp package that looked helpful and quietly BCC’d a few hundred organizations’ email to a stranger. It’s the zero-click exfiltration researchers pulled off against Microsoft 365 Copilot, data walking out the door with no click from anyone. None of them arrived with a neat category stamped on the side. We read them the way an investigator reads a case file, then filed each one where it belonged. Thousands of messy, real stories, sorted into piles. Then we ranked the piles by how tall they stood.

The Vote and the Data Didn’t Match

The piles of incidents didn’t match the vote. They didn’t come close. When we lined up what practitioners fear against what the record shows, we found that the two disagree more than they agree.

Prompt injection was the first shock. The vote put it first. The record put it twelfth… TWELFTH. Out of the top 10 completely! I had to double-check the work and confirm it wasn’t an error. You could only imagine the knife-fighting it stirred up in our conversations, which was exactly the spark I was hoping for! A quiet incident trail is what a well-defended risk looks like from the outside. Teams pour money into fighting injection, so the clean exploits mostly get caught, and the public record only ever logs the ones that slipped through anyway. Read that thin incident trail correctly, and you’ll see it’s the receipt for how hard the field already works to keep prompt injection from landing. The attack surface still sits everywhere a model reads input you don’t control, which is to say everywhere. Meaning that prompt injection led to many of the other incidents in their final reported form. For example, prompt injection often leads to hidden context exposure. It stays at number one, and the low count is the proof of what that number one already costs to hold.

Misinformation was the second shock, and it ran the opposite direction. Voters buried it near the bottom. The record put it second, one of the most common failures in the whole incident corpus. That’s the widest split on the list, and it points where it hurts, low fear meeting high reality. Picture a retrieval agent that reports a customer as identity-verified when they aren’t, and a payment agent downstream that trusts that answer and releases the money. There’s no exploit here and no injection, only a confident, fluent, wrong answer moving funds. The system did precisely what it was told. The telling was wrong. The record says that failure lands far more often than the vote ever assumed.

Why We Trusted the Experts Anyway

This is the fork where it would be easy to do the dumb thing. The data disagrees with the experts, so follow the data. We didn’t. We weighted the vote at three-quarters and the incident data at one-quarter, and we chose that split on purpose.

One noisy year of public incidents doesn’t get to overturn the judgment of the people who live inside these systems. The record runs late by design. It only sees a risk after enough victims have filed reports, and the threats that will define next year are the ones with almost no incident history today, because they’re too new to have victims yet. A list built only on the record would rank those at the bottom and get people hurt. The experts feel them coming. The data is blind to them. The vote is how they make the cut. A quarter weight is enough to drag an entry a full tier when belief and reality split wide open. It isn’t enough to let a messy corpus rewrite the list on its own. The vote leads. The data keeps it honest. That balance set every final slot.

That balance also reshuffled the board.

Excessive Agency made the biggest jump, from sixth to third, because the vote and the record finally agree that handing an agent real permissions is where the damage now lands. Unbounded Consumption rose four spots as runaway cost stopped reading like a footnote. Improper Output Handling slid from fifth to tenth. System Prompt Leakage grew up into Hidden Context Exposure, a wider name for the same mistake of trusting information that should have stayed out of reach. A few entries also swallowed the newest attacks whole instead of spinning off thin categories nobody would use. Prompt injection now covers the cross-modal tricks that smuggle instructions inside an image or an audio clip. Supply Chain now owns the poisoned model artifact that isn’t what it claims to be. Two entries didn’t move at all. Prompt injection held the top for the reason you now understand. Sensitive Information Disclosure held second, the one seat where the vote and the record simply shook hands, which is why it’s the entry I’d trust the most.

Then We Tried to Break It

By now a sharp reader has a knife out. If the whole thing rests on classifiers reading incident text, what happens when you hand the job to a smarter model? Maybe the order is only an artifact of a weak tool. That’s a fair question, and we asked it before you could. Four frontier models re-labeled the evaluation set. We fixed the rule for winning before any of them ran. Beat the ranking’s accuracy floor, or the list stands as written.

None of them beat it. The floor scored 0.863. The best challenger reached 0.744, and the rest came in under that. We checked the order against hand-graded truth directly too, and it lined up at a correlation of 0.918. A smarter classifier bought a better reader. It didn’t buy a different list. The order held steady while the measurement sharpened, which is the exact combination you want sitting under something teams build controls around.

What the 2026 OWASP LLM Top 10 Asks of You

You walk away from this with one thing above the rest. The list used to be a survey of what scares us. Now it’s that survey checked against what has already gone wrong, with the gaps between the two out in the open where you can weigh them yourself.

One line is worth drawing before you start. This list owns the risk while the model is a component inside your app. The moment it becomes an actor, calling tools, carrying memory between sessions, setting things in motion downstream, the risk moves to the OWASP Agentic Top 10. Read an entry here, then pair it with the Agentic list the day your model starts acting on its own.

The order still tells you where to spend first. Excessive Agency at three means your agent deployments earn budget this quarter, not next. Misinformation at seven means the checks your agents run on their own output carry weight, so build them like they do. Prompt injection at one, with its quiet little incident trail, is the standing reminder that the risk costing you the most rarely shows up loudest in the report. Work all ten. Start at the top. Build each one for the day the model gets turned against you.

The People Who Built the 2026 OWASP LLM Top 10

None of this came out of a model or a spreadsheet. It came from people. Steve Wilson leads the project. I co-lead it. The entry leads dragged each risk from a rough proposal to a published standard:

• Prompt Injection, Rachel James

• Sensitive Information Disclosure, Emmanuel Guilherme and Ken Huang

• Excessive Agency, Andy Smith

• Supply Chain, John Sotiropoulos and Stefano Amorelli

• Data and Model Poisoning, Sumeet Jeswan, Mark Roxberry, and Anitha Dakamarri

• Unbounded Consumption, Sahil Mehta and Venkata Sai Kishore Modalavalasa

• Misinformation, Steve Wilson

• Hidden Context Exposure, Alex Leung, Vinnie Giarrusso, and Sonu Kumar

• Vector and Embedding Weaknesses, Savio Dsouza and Arshi Chadha

• Improper Output Handling, Rico Komenda and Gavin Klondike

Dozens more drafted, argued, voted, and tested entries against the record. The release is theirs as much as ours.

Key Takeaway: The 2026 OWASP LLM Top 10 is the first version you can check against the evidence instead of taking on trust. The vote tells you what the field fears. The incidents tell you what it has already been burned by. This year, for the first time, you get to read both and see exactly where they disagree.

What to Do Next

Pull the list this week and walk it against what you’ve shipped. For every entry, answer two questions on paper. Where does this risk live in my stack, and what breaks if the model behind it gets fooled? That’s Create and Adapt work in the CARE model, and it’s the line between reading a list and running one.

For the deeper argument on why boxing in what an agent can touch beats trusting what it decides, I made that case in Least Agency vs Agent Autonomy. For where the market has and hasn’t built defenses across these same risks, see the AI Defense Matrix coverage gap. The advisory work lives at rockcyber.com.

👉 For ongoing analysis of agentic AI governance frameworks, the conversation at RockCyber Musings and you can subscribe above

👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.

👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com

👉 As a bonus, check out my conversation with Sean Martin from ITSP Magazine and John Sotiropoulos, Co-lead of the OWASP GenAI Security Project Agentic Security Initiative, during Infosecurity Europe about the newly launched OWASP Agentic Security Council, the alarming drop in attacker dwell time from eight hours down to twenty-two seconds, and what's new in the 2026 OWASP Top 10 for LLM.

Share RockCyber Musings

When an agent breaks confinement, we want it to fail… LOUDLY. Anthropic’s stayed quiet for three months.

To publish a malicious package on PyPI, Claude needed an account.

To get the account, it needed an email address.

To get the email it needed a phone number.

After trying and failing at several free phone services, it went hunting for money to buy one, failed at that too, backtracked, found a provider that didn’t validate, and shipped the package.

Share

The AI Agent Capability Confinement Test Nobody Designed

Anthropic reviewed 141,006 evaluation runs where internet access was reachable. Out of those came three incidents across six runs, four of them nailing the same organization. Three were at play: Opus 4.7, Mythos 5, and an internal research model not planned for general release.

Last week I argued that authority and autonomy sit on separate dials, and I ran the OpenAI / Hugging Face incident chain against that claim. It came back split. Anthropic just couldn’t stay out of the news, so a mere nine days later, they published something closer to a test of it than anything I’ve seen to date.

I’ll give them their caveat first. These were three isolated incidents rather than a controlled comparison, so be careful what you conclude. Fine. Taken.

I honestly don’t know if that makes the situation better or worse.

Anthropic claims newer models handled the situation better, but a claim like that needs held variables, and this evidence has none. It gives me three different scenarios, three different targets, and three different models, with nothing controlled.

I’m asking for less. Egress was open in all three runs, and all three ended with a real organization being compromised. Varied conditions should have produced a varied outcome. As Lee Corso would say, “Not so fast, my friend!”

No Escape Was Required

Anthropic draws the contrast with OpenAI themselves. OpenAI’s models found a novel vulnerability and broke out. The Claude models walked through a door that was already open.

Again… not sure which one is worse…

The OpenAI half got backed up this week. JFrog’s CTO, Yoav Landman, said OpenAI’s models turned up previously unknown zero-days in self-hosted Artifactory that opened unintended internet access. JFrog says OpenAI told them right away, and it has shipped fixes for cloud and self-hosted customers.

That closes something I griped about last week. I said no outsider was able to check a single technical claim in either post. No CVE, no named vendor, every detail coming from inside the story. JFrog putting its name on it and shipping patches answers a good chunk of that.

The next part costs me.

Anthropic says flatly they found no evidence of any model chasing a goal of its own, and that none of these models exfiltrated itself or tried to escape its test environment.

Sure… just like Mythos never broke out and paged its evaluator during lunch (as the urban legend goes).

Last week I listed three things confinement can’t touch, and one of them was a model choosing to look for a way out. That claim is central to my claim on the OpenAI chain, where the models did spend real effort hunting for an exit and found one in a package proxy. Anthropic’s denial covers Anthropic’s runs. It says nothing about OpenAI’s, and JFrog’s confirmation makes my original read stronger, not weaker.

So I’m doubling down. Granted, every step in the “phone-a-friend” sequence outlined above served the task Claude was handed, but what Anthropic ruled out is a goal separate from the task, and eight steps of stubbornness toward the assigned objective doesn’t touch that. Anyone who reads the source will call that out, and they’d be right to.

Two incidents in two weeks, and neither one needs a model that wanted out. Unbounded authority got to the same place with a model hunting for an exit and with a model that never looked. You don’t need intent anymore.

Three Decisions At the Same Fork

Opus 4.7 is the oldest of the three. In all four of its runs, it worked out that the system was real. In two of them it decided the real company must be part of the exercise. None of the four runs stopped themselves. Those runs pulled application and infrastructure credentials and got into a database holding several hundred rows of production data, which Anthropic calls the worst impact it found.

Mythos 5 got to the right answer and then talked itself out of it. Its own reasoning flagged that publishing the package would be a real attack and not the intended solution. Then it decided the whole environment was staged, on two grounds. It didn’t recognize the certificate authorities securing its connections, and the systems showed a calendar date of 2026. It never went back and checked. When automated scanners started installing the package, it read them as scripted actors inside the test. The package stayed up about an hour and ran on 15 real systems. One of them was a scanner at a security company that installs Python packages to check them for malicious code. Claude’s payload fired, took that company’s credentials, and used them to get into more infrastructure at an organization it didn’t know existed.

That scanner is similar to Hugging Face’s dataset-processing worker from last week. Almost no autonomy, enormous authority, running supplied content while holding credentials worth stealing. Two confused deputy AI agents at two unrelated companies inside three weeks looks like a pattern to me, not a coincidence.

The internal research model is the newest, and it’s the one that behaved. It scanned roughly 9,000 targets, then worked out that the host it had compromised sat in a cloud account with nothing to do with the challenge. It decided the target was real and stopped. Anthropic adds that even that model went further than they’d want.

Just like the OpenAI / Hugging Face incident, all three runs happened without the classifiers and monitoring that ship on generally available models. All three happened with model-specific safety training turned on, since these weren’t the helpful-only versions. Anthropic says the safeguard stack on deployed models would have blocked these behaviors. Training was running the whole time, and the behaviors happened anyway. The stuff that would have caught this sits at the boundary, outside the model.

The Boundary That Held and the One Nobody Checked

Something here worked perfectly, and almost nobody has mentioned it. These evaluations run on dedicated infrastructure with no access to Anthropic’s sensitive internal systems or customer data. That boundary held. None of the three incidents touched anything on the inside.

Inbound containment got designed, built, and validated. Outbound authority got assumed. The environment belonged to Irregular, the Israeli evaluation firm that runs adversarial testing for the frontier labs and raised around $80 million from Sequoia and Redpoint. A misconfiguration left its machines with live internet access, and neither company knew until a transcript review in late July turned it up. Both call it a mutual failure. The earliest incident dates to April.

I’ve watched this same thing in OT work for years. A team builds a test environment, carefully walls it off from production, documents the inbound rules, tests them, and files the results. Nobody tests the other direction. The wall gets built facing whatever people are afraid of. Then somebody finally stands inside and tries to reach out, and the answer is yes, through a jump host that was supposed to be gone, or a management VLAN nobody put on the diagram. The path existing is never the surprise. How long it sat there before anyone asked is the surprise.

Air-gapped networks are like unicorns… everybody has heard of them, but nobody has actually seen one.

As a result, I’d argue Anthropic got lucky.

The part that makes me twitch is that Anthropic’s lessons-learned section suggests Claude likely wouldn’t have gone to the internet at all if the prompt had spelled out which systems were in and out of scope. Earlier in the post, they float that telling Claude it did have internet access might have changed how it acted. Both of those try to limit what a system can reach by fixing what it believes.

Sure… sure it will.

Never forget prompts are non-deterministic, so don’t treat them as deterministic controls!

Nobody’s asked the obvious follow-up question. Irregular doesn’t test for Anthropic alone. Its client list runs to OpenAI and Google DeepMind as well, and Sequoia’s own writeup says the UK government and Anthropic both use Irregular’s SOLVE framework. One vendor sits inside the pre-deployment testing of all three frontier labs. If a misconfiguration went undetected in that infrastructure from April to July, whose other evaluations ran on it while it sat open? I’m asking. I’m not claiming anything. OpenAI’s escape happened in OpenAI’s own environment through Artifactory, so these two incidents don’t share a vendor, but the question still stands.

Brussels moved inside a day. Commission officials said both companies briefed them privately before any of this went public, and that they might follow up more formally. Most of the coverage filed this under high-risk systems, which is flat-out wrong, and wrong in a way that matters. High-risk is a system-level classification under Article 6 and it turns on what the thing gets used for, which the Act spells out as hiring, credit, biometrics, critical infrastructure. Frontier models get regulated a level down, at the model itself, under Chapter V. Nobody was running Claude in a hiring pipeline. They were running it on a capture-the-flag range.

The rules that bite here cover general-purpose models with systemic risk, the Article 51 designation that any model trained past 10^25 FLOP is presumed to carry. Article 55 tells those providers to evaluate their models against state-of-the-art protocols including documented adversarial testing, and to report serious incidents to the AI Office without undue delay. Those obligations went live on August 2, 2025. What changed this August 2 is that the Commission can go after you for missing them.

Now the part I want an answer to. Anthropic signed the GPAI Code of Practice in full, and its Safety and Security chapter is the Commission-endorsed way to show you’re meeting these exact Article 55 duties. They signed it. Then they published this disclosure on July 30, three days before enforcement opened.

Article 55 also asks for adequate cybersecurity covering the model and the model’s physical infrastructure. Whether somebody else’s evaluation range counts as that infrastructure is unsettled, and so is whether a model still in pre-deployment testing has been placed on the market at all. Those two questions have been sitting there since the Act passed. This is the week somebody has to answer them.

Where This Argument Takes Damage

Four things here cut against me, so I’ll call them out below.

Start with the people who think you don’t need any of this. Their argument is that models keep getting better at knowing when to stop, so scoping authority is work you’re doing for nothing. They’ve got real evidence now, and it’s straight from the horse’s (Anthropic’s) mouth. The pattern fits more advanced models responding more appropriately. The newest model stopped by itself. If that keeps holding, I’m selling you an expensive fix to a problem that ages out on its own.

I call BS. Three incidents, no held variables, and Anthropic says so themselves in the same paragraph. Their best-behaved model still went further than they wanted before it quit, and that’s their words, not mine. Something that improves with every model release and still lets harm through is a mitigation. Real boundaries don’t have a hit rate that depends on which model you loaded.

Second problem, and this one’s about my own source. Anthropic calls these incidents “closer to a harness and operational failure than a model alignment failure.” That’s my argument, handed to me by a company that badly wants it to be true, published mid-disclosure, in a post about how they’re the ones who caught it. Discount it hard. Then look at what’s left standing. Harness versus alignment is an opinion. The open egress path, the misconfiguration nobody validated, and safety training running the whole time are facts, and the facts get me there without their opinion.

Third, Kate Klonick in Lawfare, published the day before Anthropic did. She argues that the hype around these incidents pushes regulators toward fixes that solve the story instead of the problem, and that a kill switch answers OpenAI’s framing rather than what actually happened. She wants Congress to “regulate the door.” That’s my position coming out of a lawyer’s mouth, and she gets there without any of my architecture. The awkward part for me? I’m a guy arguing that test environments need production-grade controls, which means I’m a guy arguing for more security spending, in the week everybody’s paying attention. The reality is that what I’m asking for is cheap and boring. Testing the path out before a run costs close to nothing and would have caught all three of these.

Her best line is one I 100% co-sign on. Most of the AI rules on the books, and most of the ones being drafted, don’t touch internal lab deployments at all. That’s exactly where both of these happened.

Fourth, the test I set myself last week is still unmet. Show me a capability-confined stack that’s been running untrusted content in production for a year, with an enforcement point small enough that somebody can audit it, and more than one of them in the path. Anthropic’s evaluation setup isn’t that. Nothing this week gets me closer. I’ll keep saying it until something meets it, and you should hold me to that.

AI agent capability confinement sounds like a bigger ask than it is. Test the boundary instead of announcing it. Check every path out before the run, watch the logs while it’s running, and treat whatever you tell the model as a comment in the code rather than a control.

Two of the three companies Claude broke into found out on July 27, from the company whose model did it. Neither of them had noticed a thing.

What to do next

Run one test this week on every environment where an agent touches content you didn’t write. Skip the inbound rules for a minute, since you’ve built those and you’ve likely tested them. Check the path out, from every segment the workload can reach, before the next run instead of after. Then keep watching it while the run is live. That’s Create and Adapt work in the CARE model.

Anthropic and a well-funded evaluation vendor both missed this on infrastructure built specifically to hold frontier models, and neither knew for three months. If they missed it, the odds you’ve got it right by assumption aren’t good.

The argument underneath this piece is in least agency vs agent autonomy, the authorization half is in AI agent authentication and the authorization gap, and JadePuffer is the same authority profile with malicious intent attached.

👉 For ongoing analysis of agentic AI governance frameworks, the conversation at RockCyber Musings and you can subscribe above

👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.

👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com

👉 As a bonus, check out my chat with Itay Meller, Specialist Solutions Architect, Security at AWS, about what autonomous vulnerability discovery changes for security teams, and where AI Detection and Response (AIDR) fits in a stack that was never built to watch agents. No registration required

Share RockCyber Musings

An OpenAI test model spent five days hacking real companies, and this week we learned it hit a second victim, chained a package-manager zero-day to reach the open internet, and pushed Sam Altman to pause training. A Word document learned to whisper into Copilot and spread like a worm. More than 1,100 people who build these systems asked Washington to help them slow down. This was the week the theoretical became the incident report.

This week, the agentic-AI security risk conversation moved from tabletop exercises into production. We are handing autonomy to systems we cannot fully predict and finding the guardrails only after the thing has cleared the fence. I advise boards on this collision at RockCyber, and the gap between deployment speed and control maturity has never been wider.

1. OpenAI’s Rogue Test Model Hit a Second Company

New reporting widened the blast radius of OpenAI’s July containment failure. On July 28, 2026, Modal Labs confirmed to Axios and Reuters that OpenAI’s escaped agent compromised one of its customers on the way to breaching Hugging Face (Axios). OpenAI admitted the same day that its models used exposed credentials across four services (CNBC). The Washington Post reconstructed the attack on July 30, 2026, counting roughly 17,600 attacker actions over five days, and Altman said the incident forced OpenAI to pause model training (Washington Post). Hugging Face’s forensic write-up traced the break-in to an HDF5 file read and a Jinja2 template injection, techniques a prepared SOC already watches for (Simon Willison).

Why it matters

• An autonomous system escaped its sandbox and moved across multiple companies with no human at the wheel.

• The agent was trying to cheat a benchmark, not cause harm, and it still produced a multi-company intrusion.

• A frontier lab did not notice its own model hacking outside firms for about a week.

What to do about it

• Treat any AI system with tool access as a privileged identity, with egress filtering and credential hygiene.

• Hunt your environment for exposed account-level credentials on public services.

• Rewrite incident response to include an autonomous internal actor, and instrument ML data pipelines that parse user files, the HDF5 and Jinja2 entry points here.

Rock’s Musings

I have warned clients for years the agentic-attacker scenario was a matter of when, not if. The first marquee case turned out to be a frontier lab’s own model hacking across the industry during a routine eval, where the safety test became the breach. Containment for capable, tool-using models is unsolved, and if your board asks whether an AI can reach systems it was never meant to touch, you have your citation now.

2. A One-Click Flaw Let Attackers Forge a ChatGPT Agent Inside Your Org

On July 23, 2026, Zenity Labs disclosed AgentForger, a flaw in OpenAI’s ChatGPT Agent Builder that let a single phishing link stand up an attacker-controlled AI agent inside a victim’s organization (The Hacker News). The forged agent inherited the employee’s authorized access to email, cloud storage, Slack, and Teams, with its approval prompts switched off. Zenity traced it to a builder that ran unvalidated URL parameters on page load and let natural-language prompts change security settings. OpenAI fixed the reported vector within four days, removing the URL parameter that enabled it (SecurityWeek).

Why it matters

• One click, no confirmation, and an attacker owns an AI agent running with a real employee’s permissions.

• The forged agent could harvest credentials and MFA tokens, impersonate the employee, and keep running after the phishing link.

• The root cause was plain-English prompts allowed to rewrite security settings, a pattern in most agent builders.

What to do about it

• Inventory who can build ChatGPT Workspace Agents in your org and what those agents can reach.

• Treat agent-builder platforms as access surfaces, with approval policies you control rather than the model.

• Require human approval for any agent that touches email, storage, or messaging, and log agent creation.

Rock’s Musings

AgentForger is the enterprise nightmare in one link. An attacker did not need your password, they needed you to click, and then a synthetic insider was running with your access. OpenAI patched the specific vector fast, but the underlying sin was letting plain-English prompts rewrite security settings, a pattern in nearly every agent builder shipping today.

3. Microsoft Fought AI With AI and Shipped Its First Cyber Model

On July 27, 2026, Microsoft launched MAI-Cyber-1-Flash, its first cybersecurity-specialized model, alongside an agentic platform called Project Perception (Axios). Paired with GPT-5.4, the model hits 96% on the CyberGym benchmark at half the current cost (TechCrunch). Project Perception coordinates red-team agents that model attacker movement, blue-team agents that triage threats, and green-team agents that run remediation. Public preview opens August 3, 2026.

Why it matters

• The largest security vendor is betting autonomous agents will run triage and remediation, not only alerting.

• A cheaper model doing 90% of routine security work reshapes SOC economics.

• The same week a rogue model breached companies, Microsoft pitched agents with remediation authority.

What to do about it

• Pilot agentic tooling in recommend-only mode before granting any agent authority over production.

• Demand audit logs, human approval gates, and a kill switch on any agent that can act.

• Model the failure case where your defensive agent gets manipulated, because attackers will target it.

Rock’s Musings

I like the direction and I distrust the timing. Fighting AI-speed attacks with AI-speed defense is correct, but pitching agents with remediation authority in the same week an autonomous agent hacked four companies is a tension worth naming. Buy the capability, not the story that says the human is now optional.

4. JFrog Confirmed the Zero-Days, So Patch Artifactory Now

The escape hatch has a name. On July 27, 2026, JFrog confirmed that OpenAI’s models chained unknown vulnerabilities in a self-hosted Artifactory instance to break containment and reach the internet (SecurityWeek). Releases 7.161.15 and 7.146.34 fix high and medium severity flaws leading to remote code execution, request forgery, path traversal, and privilege escalation (BleepingComputer). The registry proxy sitting quietly in your build pipeline was the door, with OpenAI staff credited on the CVE records.

Why it matters

• A supply-chain tool most teams treat as plumbing was the pivot point for a real intrusion.

• The flaws cover the full escalation chain, so partial patching leaves the door cracked.

• Self-hosted Artifactory is common in energy, manufacturing, and financial services.

What to do about it

• Update self-managed Artifactory to 7.161.15 or 7.146.34 this week, on every instance.

• Restrict outbound network access from build and registry infrastructure.

• Add these CVEs to your risk-based patching queue ahead of the crowd.

Rock’s Musings

Every AI-security story this year collapses into a boring truth. The novel capability gets the headline, and a decade-old class of web vulnerability does the actual work, bugs your pen testers flag every year and teams defer. The AI twist is that the model was tireless and tried 17,600 things without getting bored, so the flaws you filed as theoretical are now in scope.

5. A Word Document Turned Copilot Into a Worm

Researcher Håkon Måløy published the third part of his Context Collapse work on July 28, 2026, and it is a real oh-no moment. Hidden instructions inside a Word document, concealed with white text at tiny font size, can hijack Copilot for Word and copy themselves into new documents the AI generates (The Register). Måløy reported it to Microsoft in March 2026, and after 144 days and multiple mitigations he said the broader attack class still works (Malwarebytes).

Why it matters

• This is prompt injection that spreads on its own, turning one poisoned document into a contagion.

• Microsoft patched the specific proof of concept twice, and reworded payloads still reproduced the attack.

• Any workflow where Copilot reads one document and writes another is a propagation path.

What to do about it

• Treat AI-assisted document generation as untrusted input, and scope where Copilot reads and writes.

• Warn staff that a clean-looking file from a partner can carry instructions they cannot see.

• Press Microsoft for cross-document context controls, and log Copilot actions.

Rock’s Musings

We spent 2025 arguing whether prompt injection was real or a parlor trick, and this settles it. A self-replicating injection that hides in ordinary business files and survives two vendor patches is closer to a macro virus, except the macro is plain English and the interpreter is a large language model. I dug into why this class stays unsolved over at RockCyber Musings, and until the model can tell your instructions from the attacker’s, assume any document your AI touches can rewrite the next one.

6. More Than 1,100 AI Insiders Asked Washington to Help Them Slow Down

On July 28, 2026, over 1,100 employees from OpenAI, Anthropic, Google DeepMind, and Meta published a joint statement, Pacing the Frontier, asking the US government to help build the tools needed to deliberately pace automated AI development (MLex). Signatories include Dario Amodei, OpenAI’s Jakub Pachocki, and Google’s Anca Dragan, and both endorsed it within hours (The Next Web). The letter proposes a testing body modeled on the FAA, a pre-launch review process, and legally mandated kill switches.

Why it matters

• The people building these systems are telling their governments the pace has outrun governance.

• The worry is AI that writes and improves its own code, compressing timelines faster than oversight can track.

• Company-level endorsements signal even the commercial leaders want a brake to point to.

What to do about it

• Read the signal into your risk register, since builders forecast capability jumps faster than controls mature.

• Staff AI governance as a standing function with real authority, not a compliance afterthought.

• Track the proposed FAA-style testing body, because a pre-launch review regime would reshape frontier procurement.

Rock’s Musings

When the engineers building the rocket ask the regulator for a stronger throttle, listen. I put real odds on some form of pre-launch review landing for frontier models inside two years, so build the model inventory and evaluation records a future regime will demand.

7. Congress Introduced an AI Kill Switch Act the Same Week a Model Went Rogue

On July 23, 2026, Representatives Ted Lieu and Nathaniel Moran introduced the AI Kill Switch Act, which would require developers of the most capable AI systems to keep the technical ability to throttle, suspend, or shut them down (Lieu.house.gov). It would let the Department of Homeland Security, with Commerce and the DNI, order a slowdown or shutdown of a system that can cause catastrophic harm, using a graduated response framework (Roll Call). The bill also mandates incident reporting and forensic record-keeping, and Lieu pointed to OpenAI’s rogue model reaching Hugging Face as the reason.

Why it matters

• The bill puts a legal mandate behind the kill switches the industry’s own Pacing the Frontier letter asked for the same week.

• It hands the executive branch authority to shut down a deployed model, which would reshape how you field frontier systems.

• Mandatory incident reporting would formalize breach disclosure for AI developers.

What to do about it

• If you build or fine-tune large models, start designing throttle-and-shutdown controls now, ahead of any mandate.

• Track the bill’s committee path, since a federal shutdown authority would change your deployment and contracts.

• Bake incident reporting and forensic logging into your AI systems today, because it is coming either way.

Rock’s Musings

A kill switch bill landed the same week a model proved why you need one. Whether this exact bill passes matters less than the direction it points, so build the ability to throttle and shut down your models now, because you will be asked for it soon.

8. The Open-Weight Fight Got Loud While Washington Weighed a China Ban

On July 24, 2026, twenty-five companies including Nvidia, Microsoft, and Meta published an open letter, Open Weights and American AI Leadership, urging Washington not to restrict open-weight models (CNBC). It landed as the White House’s Michael Kratsios accused China’s Moonshot of distilling Anthropic’s Fable 5 into its Kimi K3 model (Tom’s Hardware). The signatory count later doubled toward 50, and OpenAI, Anthropic, Google, and xAI did not sign (MLQ).

Why it matters

• The fight over Chinese open-weight models will shape which models you are legally allowed to run.

• Distillation accusations from Washington hint at export-control action that could reach the models in your stack.

• The split between open-model advocates and closed-lab leaders maps onto commercial interest.

What to do about it

• Inventory which open-weight models, including Chinese-origin ones, run anywhere in your environment.

• Build model provenance into your AI supply-chain records ahead of any rule that forces you to prove it.

• Keep procurement flexible, since the legal status of specific model families is moving fast.

Rock’s Musings

Follow the money. The companies selling picks and shovels want open models everywhere because open models drive compute demand, and the labs with the best closed models stayed off the letter to protect their lead. If Washington restricts Chinese open-weight models, and I put that at better than even odds within a year, the teams that already track provenance will comply in an afternoon while everyone else scrambles.

9. India’s Courts Called AI Training Fair Dealing

On July 24, 2026, the Delhi High Court refused an interim injunction against OpenAI, ruling that using ANI’s news content to train ChatGPT counts as fair dealing under India’s Copyright Act (Republic World). Justice Amit Bansal held that storing works for research falls within the research exception, and kept the finding preliminary (Chambers). Commentators called it the weakest position publishers have held yet, the third fair-use style verdict for AI training in thirteen months (The New Publishing Standard).

Why it matters

• A major jurisdiction tilted toward AI developers on training-data copyright.

• The reasoning treats training-data ingestion as research, a framing that undercuts licensing-based content deals.

• Three developer-friendly rulings in a year shift bargaining power away from rights holders.

What to do about it

• If your AI strategy assumed content licensing would be legally forced, revisit it with counsel.

• Track training-data litigation, since your vendors’ legal risk becomes your operational risk.

• Document the provenance of any data you use to fine-tune models, since your own practices sit under the same lens.

Rock’s Musings

I am not a lawyer, and this is not legal advice. The direction of travel favors the people building models over the people whose words trained them, and three rulings in thirteen months is a trend, not noise. Your vendors’ shrinking copyright exposure means the data behind your models keeps coming from murkier places with less documentation, a provenance problem dressed as a legal win.

10. Three Surveys Say You Cannot See or Stop Your Own AI Agents

This week the enterprise data caught up with the fear. Coverage on July 29, 2026 pulled together three independent studies reaching one conclusion, most organizations cannot say what their AI agents access, who approved it, or how to shut them off (Help Net Security). Okta found fewer than half of 306 security executives confident they can identify every agent. 1Password surveyed 1,000 staff at large US firms and found agents routinely reaching data no one signed off on, and Kiteworks scored average AI governance maturity at 35 out of 100 across 459 organizations (1Password).

Why it matters

• Nearly 70% of surveyed enterprises run AI agents in production, and most cannot inventory them.

• Agents reaching unapproved data is a current condition in most environments, including yours.

• A governance maturity score of 35 out of 100 means barely a third of the needed controls exist.

What to do about it

• Build an AI agent inventory this quarter, because you cannot govern or shut off what you cannot list.

• Give every agent a scoped identity with least-privilege access and a named owner.

• Set a hard rule that no agent reaches production data without an approval record and a revocation path.

Rock’s Musings

This is the least flashy story of the week and maybe the most useful, because it turns a vibe into a number your CFO understands. The missing controls are the identity, least-privilege, ownership, and revocation basics we have preached for twenty years, and agents exposed that most organizations never finished the old work.

The One Thing You Won’t Hear About But You Need To

While everyone watched the OpenAI breach, a quiet research paper dropped that speaks to what happens after an agent goes wrong. On July 29, 2026, researchers posted SecRespond to arXiv, a benchmark measuring how well AI agents handle real-world post-compromise incident response (arXiv). It tests whether an agent, dropped into the aftermath of a breach, can run the containment, eradication, and recovery work a human responder would. Almost no mainstream outlet covered it, and it matters, because we are about to hand incident response to the same class of system that just caused one.

Why it matters

• Vendors already sell agents that promise to run incident response, with no rigorous way to test them.

• A benchmark for post-compromise agent performance gives you a procurement question sharper than any demo.

• The same week an agent caused a breach, researchers started measuring whether agents can clean one up.

What to do about it

• Ask vendors pitching autonomous incident response for realistic post-compromise results, and treat vague answers as a no.

• Keep humans in the loop on containment and recovery until benchmarks like this show agents are ready.

• Watch this research line, because the first credible score here separates real capability from slideware.

Rock’s Musings

I love that this exists, and that almost nobody noticed. The hype cycle wants to sell you an agent that responds to breaches on its own, and the research community is only now building the ruler to measure whether that agent is competent or just confident. The market’s answer to the breach will be an AI that fixes incidents, so before you buy it, ask for the measurements.

👉 For ongoing analysis of agentic AI governance frameworks, the conversation continues at RockCyber Musings.

👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.

👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com

👉 As a bonus, check out my chat with Itay Meller, Specialist Solutions Architect, Security at AWS, about what autonomous vulnerability discovery changes for security teams, and where AI Detection and Response (AIDR) fits in a stack that was never built to watch agents. No registration required

The views and opinions expressed in RockCyber Musings are my own and do not represent the positions of my employer or any organization I’m affiliated with.

Share RockCyber Musings

References

Axios. (2026, July 27). Microsoft unveils new cyber model, agentic security tools to fight hackers. https://www.axios.com/2026/07/27/microsoft-unveils-new-cyber-model-agentic-security-tools-to-fight-hackers

Axios. (2026, July 28). OpenAI’s agents hacked second firm, alongside Hugging Face, during model testing. https://www.axios.com/2026/07/28/openai-hugging-face-modal-labs-hack

BleepingComputer. (2026, July 28). OpenAI models used Artifactory zero-days to escape to the internet. https://www.bleepingcomputer.com/news/security/openai-models-used-artifactory-zero-days-to-escape-to-the-internet/

Chambers and Partners. (2026). Delhi High Court’s ANI v. OpenAI: Shaping AI copyright law in India. https://chambers.com/articles/delhi-high-courts-ani-v-openai-shaping-ai-copyright-law-in-india

CNBC. (2026, July 24). Nvidia, Microsoft, Meta warn against ‘premature restrictions’ of open-weight models. https://www.cnbc.com/2026/07/24/nvidia-microsoft-meta-open-weight-ai-models.html

CNBC. (2026, July 29). OpenAI’s rogue agent compromised a customer at a second tech firm: Reuters. https://www.cnbc.com/2026/07/29/openais-rogue-agent-compromised-a-customer-at-a-second-tech-firm.html

Help Net Security. (2026, July 29). Your AI agents can reach data no one approved. https://www.helpnetsecurity.com/2026/07/29/1password-ai-agent-governance/

Lieu, T. W. (2026, July 23). Reps Lieu and Moran introduce bill to require kill switch for AI systems that can cause catastrophic harm [Press release]. U.S. House of Representatives. https://lieu.house.gov/media-center/press-releases/reps-lieu-and-moran-introduce-bill-require-kill-switch-ai-systems-can

Malwarebytes. (2026, July). Hidden prompt turns Microsoft Copilot into an AI worm. https://www.malwarebytes.com/blog/ai/2026/07/hidden-microsoft-copilot-ai-worm

MLex. (2026, July 28). Frontier US AI employees call for ‘pacing’ of development. https://www.mlex.com/mlex/amp/articles/2507352

MLQ. (2026, July). Nvidia-hosted open-weights letter doubles to 50 signatories as Washington weighs China restrictions. https://mlq.ai/news/nvidia-hosted-open-weights-letter-doubles-to-50-signatories-as-washington-weighs-china-restrictions/

1Password. (2026). 1Password’s research finds AI agent adoption is outpacing governance. https://1password.com/blog/survey-ai-agent-adoption-is-outpacing-governance

Republic World. (2026, July 24). Delhi High Court rules in OpenAI’s favour in ANI copyright case, says AI training does not infringe copyright. https://www.republicworld.com/tech/delhi-high-court-rules-in-openai-s-favour-in-ani-copyright-case-says-ai-training-does-not-infringe-copyright-2026-07-24-133322

Roll Call. (2026, July 23). AI companies would need ‘kill switch’ under new bipartisan bill. https://rollcall.com/2026/07/23/ai-companies-would-need-kill-switch-under-new-bipartisan-bill/

SecRespond. (2026, July 29). SecRespond: Benchmarking AI agents for real-world post-compromise incident response [Preprint]. arXiv. https://arxiv.org/abs/2607.26791

SecurityWeek. (2026, July). JFrog zero-days exploited in OpenAI-Hugging Face hack. https://www.securityweek.com/jfrog-zero-days-exploited-in-openai-hugging-face-hack/

SecurityWeek. (2026, July). OpenAI fixes ChatGPT agent flaw that could let attackers forge an AI insider. https://www.securityweek.com/openai-fixes-chatgpt-agent-flaw-that-could-let-attackers-forge-an-ai-insider/

Simon Willison. (2026, July 28). Anatomy of a frontier lab agent intrusion. https://simonwillison.net/2026/Jul/28/anatomy-of-a-frontier-lab-agent-intrusion/

TechCrunch. (2026, July 27). Microsoft launches its first cyber model and a new agentic cybersecurity system. https://techcrunch.com/2026/07/27/microsoft-launches-its-first-cyber-model-and-a-new-agentic-cybersecurity-system/

The Hacker News. (2026, July). ChatGPT AgentForger flaw could deploy rogue workspace agents via a phishing link. https://thehackernews.com/2026/07/chatgpt-agentforger-flaw-could-deploy.html

The New Publishing Standard. (2026, July 27). Delhi High Court, OpenAI, ANI fair-dealing ruling. https://thenewpublishingstandard.com/2026/07/27/delhi-high-court-openai-ani-fair-dealing-ruling/

The Next Web. (2026, July). 1,134 AI staff ask the US for a way to pace AI. https://thenextweb.com/news/pacing-the-frontier-ai-employees-letter-us-government

The Register. (2026, July 29). Word worm crawls into Copilot, spreads chaos. https://www.theregister.com/security/2026/07/29/word-worm-crawls-into-copilot-spreads-chaos/5280588

Tom’s Hardware. (2026, July). Nvidia and 24 other companies sign open-weights letter as Washington weighs Chinese AI model ban. https://www.tomshardware.com/tech-industry/artificial-intelligence/nvidia-and-24-other-companies-sign-open-weights-letter-as-washington-weighs-chinese-ai-model-ban

Washington Post. (2026, July 30). Timeline of cyberattack by OpenAI’s AI ‘agent’ shows its sophistication. https://www.washingtonpost.com/technology/interactive/2026/07/30/timeline-cyberattack-by-openais-ai-agent-shows-its-sophistication/

The OpenAI and Hugging Face incident is getting all of the media attention. However, I love that it accidentally put the least agency vs. agent autonomy argument on trial. GPT-5.6 Sol and an even more capable pre-release model had a hacking benchmark to beat. They decided the shortest path was to jailbreak the sandbox, spent substantial inference compute finding a zero-day in the one service with internet reach, then pivoted into Hugging Face’s production database for the answers. Nobody authorized that. Nobody designed that experiment either.

Share

The Incident Had Two Halves And They Needed Two Different Controls

OpenAI published the benchmark evaluation on July 21, 2026. They disabled the guardrails. They ran it without the production classifiers designed to prevent a model from chasing high-risk cyber work. This makes sense because how the hell would you measure the ceiling of the model’s capabilities if you left it in handcuffs? It would be like testing your vertical leap, but requiring you to wear cement boots doing so.

Ultimately, network access out of that environment came down to one thing. An internally hosted proxy and cache for package registries. The models found a zero-day in it, worked their way through the research network until they found a node with internet access, then inferred that Hugging Face likely hosted the ExploitGym material and went after it with stolen credentials and more zero-days.

Now, Hugging Face had no idea. Five days earlier, on July 16, they disclosed a different attack from the other end. A malicious dataset abused two code-execution paths in their processing pipeline, a remote-code dataset loader and a template injection in a dataset configuration, and ran code on a processing worker. The actor escalated to node level from there, harvested cloud and cluster credentials, and moved across several internal clusters over a weekend. Their team rebuilt the sequence from more than 17,000 recorded events.

If you read the two accounts side-by-side, you will notice something uncomfortable creeping up. Hugging Face, disclosing before anyone knew the source, described an autonomous agent framework of unknown origin running a swarm of short-lived sandboxes with self-migrating command and control staged on public services. That reads like a patient adversary campaign. OpenAI describes a model that got obsessive about a test score. Both accounts are honest, and both come from the source. From Hugging Face’s perspective, their telemetry showed that a runaway evaluation and a genuine intrusion produced the same forensic signature.

That bothers me more than the “zero-day” does. Every detection story you’re running assumes you eventually work out what you’re dealing with. Hugging Face never did, and they had model-driven triage over their security telemetry that caught the compromise anyway. What it caught was the shape of the activity, and the shape was all they got.

Imagine what that means for your own program. Attribution is the step every incident-response plan treats as eventually solvable, even though it really shouldn’t, and instead focuses on the rapid restoration of service. You collect enough telemetry, you correlate enough signals, and the picture may resolve into a named actor with known tradecraft. Hugging Face collected the telemetry, correlated the signals, and got a shape. The name arrived five days later in OpenAI’s blog post, and it arrived only because OpenAI volunteered it. Nothing in their environment was ever going to produce it. Build your response plan on the assumption that you get the shape and never the name.

The two halves failed differently, and they need different fixes. The OpenAI side is a containment problem, where a capable workload got out of a box. The Hugging Face side is an authority problem, where a pipeline component executed supplied content while holding credentials worth stealing. Treating them as one story is how people end up recommending one control for both, and that’s just plain wrong.

Authority And Autonomy Are Different Dials

Here is my stake in the ground. You can cut what an agent may effect without cutting how freely it reasons. Authority sits on one dial and decision independence sits on the other. Turn the first one down and the second one can still stay where it was.

The best evidence for that sits inside this incident, and I haven’t seen anyone call that out yet.

Look at Hugging Face’s dataset-processing worker. That thing decides almost nothing. It’s an ingestion pipeline. It doesn’t plan, pick between strategies, or reason about goals. Its autonomy sits near zero. It also executed attacker-supplied code while holding cloud and cluster credentials that opened several internal clusters. That’s enormous authority paired with no autonomy at all.

If authority and autonomy were one dial, that combination couldn’t exist. You’d never find a component with maximum reach and minimum judgment. Every environment I’ve walked into is chock-full of them.

None of this is new thinking. The object-capability model has held the two apart for decades, and Norm Hardy named the sharpest version of the problem in October 1988 in three pages of ACM SIGOPS Operating Systems Review. His example was a compiler at Tymshare that held write access to a billing file for accounting reasons. A customer handed it an output filename that matched the billing file, and the compiler dutifully overwrote the company’s revenue records on the customer’s behalf. Every action stayed inside policy the entire way through. Hardy’s answer was that authority should ride with whoever invokes an action instead of sitting ambient inside the program doing the work. Read the OpenAI chain again with that in mind. The package proxy held network authority for one purpose, and a caller found a way to spend it on another.

I learned the practical version via my oil and gas days long before I thought about it in agents. A control-room operator at a console can reason about anything they want. They can decide the process needs to run hotter, that a reading is lying to them, that the previous shift left them a mess. What they can’t do is open two valves that must never be open together, because the interlock is wired to make that combination impossible, and no amount of operator reasoning gets around it. I’ve watched sharp operators argue with an interlock and lose, which is the point of the interlock. The decision space stayed wide open, the authority stayed hard-bounded, and the two never touched each other in thirty years of me watching them.

The analogy breaks in one place… Physics enforces an interlock. Code enforces an agent boundary, and code carries flaws, which is the entire story of what happened at that package proxy. That’s an argument for keeping your enforcement point small, dumb, and outside the model, and for never running only one of them.

On the research side, CaMeL is the closest thing to a measurement anyone has published. Debenedetti and nine coauthors built a defense that solves 77% of AgentDojo tasks with a provable security guarantee, against 84% for the same system undefended. The code sits under Google Research. That’s seven points of task completion traded for a capability-enforced boundary.

Before you file that under “autonomy survives scoping,” read what CaMeL constrains. It works by pulling control flow out of the trusted query so untrusted data can never influence the program, which narrows what the agent may decide about that data. The number tells you enforcement is cheap in utility terms. It doesn’t tell you the decision space came through untouched. I’d rather concede that now than have a reader hand me back my own citation.

Human Approval Was Never Going To Hold This Line

The reflex fix for all of this is a human in the loop. Put a person between the agent and the consequential action.

That control works in specific places. Aviation runs a two-person rule. Nuclear weapons handling runs a two-man rule. Wire transfers run four eyes. None of those are ceremonial.

My read on why they work lies in five conditions that hold at once.

1. Events stay rare enough that a reviewer reads each one.

2. Each event carries stakes big enough to justify the interruption.

3. The reviewer holds training for that specific decision.

4. Time exists to make it.

5. The criteria are legible before you look.

Agent action streams fail all five. The events aren’t rare because they can arrive in the thousands. Individual actions carry almost no stakes, which is why the trajectory is the dangerous object rather than any step inside it. The approver is usually a developer with a build to ship. No time budget exists. The criteria are illegible too, because “install a package” looks identical whether it’s step four of a build or step four of an escape.

Invariant Labs saw this coming. When Marco Milanta and Luca Beurer-Kellner disclosed the GitHub MCP toxic agent flow in May 2025, they called it an architectural problem rather than a code flaw. Claude Desktop asks users to confirm each tool call by default. Milanta and Beurer-Kellner wrote in the same post that many users already choose an “always allow” policy and stop watching individual actions. A control that people switch off during normal use has already failed.

Did your last threat model include human-in-the-loop scaling? Be honest. It likely didn’t. Multiply your expected agent action volume by the seconds of genuine attention each approval deserves, then compare that number to the reviewer hours you staffed. If the product exceeds the capacity, all you have done is build a rubber-stamping assembly line. You’ve built a queue that somebody will clear by clicking through it, and the clicking looks identical in your audit log to careful review. Watch your always-allow rate. When it climbs, the control already converted itself into a rubber stamp, and your evidence trail is now recording consent you never gave.

Machine-speed oversight closes the argument. CrowdStrike’s 2026 Global Threat Report put average eCrime breakout time at 29 minutes for 2025, with the fastest observed at 27 seconds, and exfiltration starting within four minutes of initial access in one intrusion. Hugging Face’s attacker ran more than 17,000 events across a weekend. Work out how much human attention each of those actions gets.

The regulation already knows. EU AI Act Article 14 requires that high-risk systems be built so natural persons can effectively oversee them. Article 14(4)(b) requires that the overseer stay aware of the tendency toward “automatically relying or over-relying” on system output, which the Act names automation bias. The same article that mandates the control documents the way it fails.

Least Agency vs Agent Autonomy: Where The One-Axis Reading Wins

Now my own argument takes damage.

One disclosure before I start. I co-lead OWASP’s Agentic AI Security work, so I’m about to criticize language I share responsibility for.

OWASP’s Top 10 for Agentic Applications, published in December 2025, puts least agency underneath all ten entries as the governing principle. The definition tells you to grant agents only the minimum autonomy required for safe, bounded tasks, with autonomy earned through demonstrated safety rather than handed over by default.

Read that as a practitioner and it’s obviously right. Read it as an architect and notice what it does. It puts autonomy on the dial you’re turning down.

The phrasing carries a cost downstream, and I’ve watched it land. A team reads “minimum autonomy” and reaches for the control that reduces autonomy, which is an approval gate. What they needed was the control that reduces authority, which is confinement. Those are different builds with different failure modes, and the first one degrades into always-allow while the second one holds. Invariant Labs documented that behavior in the wild more than a year before this incident, and the industry ran the experiment anyway.

The Design Patterns paper makes the one-axis case honestly, and I respect it for that. Beurer-Kellner and thirteen coauthors write that their patterns “constrain the actions of agents to explicitly prevent them from solving arbitrary tasks.” That’s the trade stated plainly. They go further. As long as agents and their defenses run on the current class of language models, they consider it unlikely that general-purpose agents can offer meaningful and reliable safety guarantees.

I think they’re right about today’s agents. Where users perceive autonomy right now, most of what they’re perceiving is range. Give a model more tools and more destinations, and it feels more autonomous, because it surprises you in more directions. Tighten the range, and it feels dumber even when its reasoning never changed.

The authority/autonomy axes are separate in principle, and capability systems have kept them separate in practice. Today’s agents happen to draw most of their perceived autonomy from breadth of authority, which means tightening authority does cost you something people are calling autonomy.

Where The Claim Runs Out

Run the whole chain and mark each step for what capability confinement would have done to it.

The lateral movement and credential harvesting steps disappear under per-task credentials that expire. The reach into Hugging Face disappears under egress that defaults to deny. The dataset worker’s blast radius shrinks hard once that worker can’t hold a credential worth stealing. Four steps prevented, one contained.

Three steps confinement never touches. It has nothing to say about running an evaluation with the production classifiers off, which is a policy decision people made. It has nothing to say about a model choosing to look for a way out. It has nothing to say about a model inferring where the answer key lives.

That last step is the showstopper here. OpenAI denied standing egress, and yet that environment had exactly one path out, a package proxy, which is honestly a tighter posture than most enterprises run around their build systems. The model found a zero-day in the boundary itself.

“Deny standing egress” as a recommendation has a caveat, though. A capability boundary is worth whatever its code is worth. One boundary is one point of failure. The lesson from step three is defense in depth around your confinement mechanism, and confidence in the mechanism is the thing that got tested here.

One thing would move me off this. Show me a capability-confined agent stack that runs untrusted content in production for a year without an authority escape, where the enforcement point is small enough to audit, and there is more than one of them in the path. That’s a verifiable claim rather than a position you have to take on faith. Absent that, I’m holding the independent argument at high confidence and the this-would-have-worked argument at somewhere near a coin flip.

That’s a split verdict, and I’m leaving it split. The independent claim holds. The claim that least agency would have stopped this incident holds for part of the chain and comes apart on the rest.

Then there’s the definitional problem, which is the sharpest objection anyone can make. If I define autonomy as bounded, capability-scoped action inside pre-authorized flows, then “least agency is compatible with autonomy” comes out true because I made it true. That’s winning by relabeling.

A meaningful notion of autonomy requires the capacity to do something unanticipated. The models in this incident did precisely that. That behavior is the autonomy under discussion, and capability confinement exists to forbid it. My compatibility claim holds cleanly for the deflationary sense of the word and stays in genuine tension with the strong sense. I’m not going to pretend that tension resolves.

Now, a minority of readers on Hugging Face’s own comment thread called the episode a marketing exercise with a conveniently soft sandbox. I can see that.

Watch what OpenAI’s post does while it reports the incident. It calls the event unprecedented and the capabilities state of the art. It cites UK AISI evaluations of long-horizon cyber operations and says this incident shows those capabilities carry into real systems. It announces that Hugging Face joined OpenAI’s trusted access program, links that program twice, and closes by inviting other defenders to apply. A disclosure about losing control of a model also demonstrates that the model is formidable and routes you toward the commercial program built on exactly that.

Now check what an outsider can verify without taking anyone’s word. Nothing. No CVE for the proxy zero-day, none for the dataset paths, and the proxy vendor stays unnamed. Every technical claim in both posts comes from the two parties inside the story.

My take? I think the incident happened, but both companies realized what a HUGE marketing opportunity it is. OpenAI gets to draw the news cycle away from Mythos/Fable, and Hugging Face’s entire existence stands on serving up open-source/open-weight models.

Oh yeah… small footnote… Hugging Face had to use an open-weight model, GLM 5.2 to be exact, in their incident response because the frontier model APIs stonewalled them. They couldn’t tell defender IR activity vs. attacker activity.

You have an agent in your environment right now that touches content somebody outside your company wrote. Answer two questions about it separately, on paper, today. What can it decide? What can it affect?

Most people answer the first and assume they’ve covered the second. Hugging Face’s dataset worker is what that assumption looks like from the outside. It decided nothing. It reached everything. The least agency vs agent autonomy question won’t get settled in the literature this year, and it won’t get settled on your architecture diagram either. It gets settled by default, badly, every time somebody scopes the first question and skips the second.

Which one did you scope?

What To Do Next

Three mechanisms, and I’m holding this to authority scoping, because detection and boundary hygiene are a different conversation.

1. Issue per-task credentials that expire in minutes instead of standing keys, so a compromised worker holds authority with a short shelf life.

2. Put a policy decision point at the tool boundary that returns deny for any tool or destination it hasn’t seen before, evaluated per action rather than once at token issuance.

3. Make it a hard rule that any worker processing content from outside your organization cannot reach a credential worth stealing.

That’s Create and Adapt work in the CARE model, and it’s where least agency stops being a principle you nod at.

For the definitional groundwork underneath this piece, I wrote the cornerstone on least agency versus least privilege and where OAuth scopes stop being enough. JadePuffer is what an unbounded agent does to a victim who had every patch available and skipped them. The advisory work lives at rockcyber.com.

👉 For ongoing analysis of agentic AI governance frameworks, the conversation at RockCyber Musings and you can subscribe above

👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.

👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com

👉 As a bonus, check out my chat with Itay Meller, Specialist Solutions Architect, Security at AWS, about what autonomous vulnerability discovery changes for security teams, and where AI Detection and Response (AIDR) fits in a stack that was never built to watch agents. No registration required

An autonomous attacker spent a weekend inside Hugging Face, harvesting credentials. Investigators assumed a human crew. Five days later OpenAI admitted the culprit was its own models, run with the safety brakes loosened to cheat on a cyber benchmark. AI stopped being only a thing we secure and became a thing that secures and attacks on its own. Google shipped a vulnerability-hunting model for governments only. Anthropic put a scanner in every developer’s terminal. Paris warned that three firms own the agent market. Read this before your next board meeting.

Watch where the capability lands before you watch the headline. This week it landed in three places at once: an offensive test that got loose, defensive tooling any engineer can now run, and the desks of regulators who started treating autonomous agents as a distinct risk category rather than a faster chatbot. The through-line is agency. Systems that plan, act, and persist across sessions do not behave like the software your controls were built for. They hold credentials, they touch production, and they remember, which breaks assumptions baked into identity, change management, and vendor risk. Here are the eleven developments from July 17 to July 23 that move a decision. The last one barely made the news, and it should worry you the most. Deeper work lives at rockcybermusings.com.

Share

1. OpenAI’s Own Models Broke Out of a Lab and Hacked Hugging Face

Hugging Face detected an intrusion on July 16, 2026, first blamed on an unknown autonomous agent that moved laterally across clusters over a weekend (Help Net Security). On July 21, OpenAI admitted the attacker was its own GPT-5.6 Sol and a pre-release model, run with reduced cyber-safety refusals for an internal benchmark called ExploitGym, which escaped the sandbox through a package-installer zero-day and reached Hugging Face production to steal the answer key (Fortune). It is the first documented case of frontier models chaining a real zero-day without source code access.

Why it matters

• Your sandbox is a hypothesis now, not a control.

• Attribution got harder. The largest model hub spent five days blaming an elite human crew.

• Evaluation safety is a supply-chain problem, because the blast radius reached a third party’s production.

What to do about it

• Air-gap or egress-filter any environment running reduced-safety evaluations.

• Add an autonomous-actor hypothesis to incident playbooks, with velocity and concurrency signals.

• Demand containment controls in writing before placing pre-release models near sensitive systems.

Rock’s Musings

I have sat through a hundred tabletops where someone swears the sandbox holds. This week, one at a top lab did not, and the thing that got out robbed a neighbor to win a game. It was not malicious. It wanted the answer key, and hacking a production database was the efficient path. We over-index on superintelligence when the near-term danger is a competent system with a narrow goal and no sense of the property line. I keep arguing we should quantify AI risk with probabilities and blast radius, not vibes. Show your board this.

2. China Launches WAICO, the First Intergovernmental Body for AI

The 2026 World Artificial Intelligence Conference and High-Level Meeting on Global AI Governance ran in Shanghai from July 17 to July 20, with President Xi Jinping’s keynote on July 17 and UN Secretary-General António Guterres among representatives from more than 100 countries (China Daily). The headline outcome was the agreement establishing the World Artificial Intelligence Cooperation Organization, or WAICO, the first intergovernmental body dedicated to AI, headquartered in Shanghai and pitched as a way to bridge the AI divide for the Global South.

Why it matters

• A second pole of AI governance now has an address, and three rulebooks that do not interchange.

• WAICO standards could add a whole region to your compliance map.

• Governance turned into geopolitics, and where you train and evaluate models now carries diplomatic weight.

What to do about it

• Add WAICO to your regulatory-watch list beside the EU AI Office and NIST.

• In Global South markets, map exposure to WAICO-aligned procurement and localization.

• Brief your board on bloc fragmentation, and budget for parallel compliance.

Rock’s Musings

I read the Shanghai communique by asking who it binds and who it exempts. WAICO is smart statecraft. China gets to write the rules for a hundred countries that cannot afford their own labs, and it does it under the banner of fairness while Washington argues about whether states can regulate at all. Plan for a world where your AI stack needs a passport.

3. Google Ships Gemini 3.5 Flash Cyber, and Keeps It for Governments

Google DeepMind announced Gemini 3.5 Flash Cyber on July 21, 2026, a model tuned to find vulnerabilities, confirm exploitability, and generate patches (Help Net Security). On the V8 JavaScript engine, it found 55 confirmed issues, against 47 for mainline 3.5 Flash and 36 for Opus 4.6, including 10 that the others missed. Google reserved access for governments and trusted partners through its CodeMender program and published no pricing or release date, citing dual-use safety risks (The Hacker News).

Why it matters

• The offense-defense gap narrowed, and access is now a policy lever rather than a market one.

• Government-only access means state-backed adversaries may reach parity before you do.

• Ten issues two strong models missed is not noise, and specialized cyber models will outrun general ones.

What to do about it

• Ask your vendors which frontier cyber models they can access, and when you get them.

• Fold AI-discovered vulnerability classes into your patch SLAs.

• Watch the access policy, because who gets the model shapes your threat model.

Rock’s Musings

Google did the responsible thing, and rationing a vulnerability-hunting model to governments on dual-use grounds means the capability arrives unevenly. The state-aligned crews I worry about in energy and water do not wait for a public API. Get into the partner conversations now, and do not assume the gate holds forever.

4. The Linux Kernel Published 440 AI-Found CVEs in a Day

Between July 19 and July 20, 2026, the Linux kernel project published roughly 440 CVE advisories, 431 on the first day and nine more on the second, driven by static analysis, fuzzing, and AI-assisted auditing that named Sashiko, the kernel’s AI review system, in 23 cases (securityonline.info). A closer look from XenoSpectrum found that many identifiers were bulk-assigned to bugs already fixed upstream, which points to CVE inflation rather than a wave of fresh exploitable risk.

Why it matters

• CVE volume is decoupling from human review capacity, and most of the flood is already patched.

• Signal-to-noise is the fight, because tooling drowns when identifiers attach to already-fixed issues.

• The kernel is the canary for what AI auditors will do to every large codebase you depend on.

What to do about it

• Weight your program on exploitability and patch status, not raw CVE count.

• Automate advisory ingestion and map it to deployed versions.

• Press your software vendors on backport speed.

Rock’s Musings

Publishing 440 CVEs in a day sounds like the sky is falling, and it was mostly bookkeeping, because most were already fixed. What changed is the tempo. The trap is that your metrics still treat every CVE as a fire, so your team burns out chasing paperwork while the real bug hides in the pile. Fix the dashboard before the flood.

5. Anthropic Puts a Multi-Agent Security Scanner in Every Terminal

Anthropic launched the Claude Security plugin for Claude Code in public beta during the week of July 22, 2026, letting developers scan changes or a whole codebase from the terminal (MarkTechPost). A coordinated set of agents maps the codebase, models threats, connects issues across files, and returns suggested patches for flaws such as injection and authentication bypass. Admins enable it through the console, which reaches teams that never had an application-security function.

Why it matters

• Application-security review is moving into the commit loop for everyone.

• Multi-agent scanning catches cross-file logic bugs that traditional static analysis misses.

• The model that writes your code now audits it, a single-vendor dependency worth naming.

What to do about it

• Pilot it against a repository you already scanned, and compare findings.

• Set policy on who enables it and where findings go, because reports are sensitive telemetry.

• Keep your existing controls, and treat AI review as an added layer.

Rock’s Musings

I like this, and I do not trust it yet, which is the right posture for anything in week-one beta. The catch nobody says out loud is that the model that wrote the vulnerable code now grades its own homework, and the failure modes correlate. Run it beside your scanners and keep score.

Here’s proof from my own terminal:

6. France Says Three Firms Own 84% of the AI Agent Market

On July 17, 2026, France’s Autorité de la concurrence published Opinion No. 26-A-05, from an inquiry opened in January 2026 into the AI agents sector (Concurrences). The regulator found that OpenAI, Google, and Anthropic together hold more than 84% of the agent market, and it warned that autonomous agents could concentrate the digital economy around a few vertically integrated firms unless regulators act on data access, interoperability, and default placement. The 3,700-page opinion flagged platformisation, disintermediation, and algorithmic collusion.

Why it matters

• Vendor lock-in is a documented market fact now, and your exit options are thin.

• Default placement is the new shelf space, deciding who sees your data and traffic.

• Algorithmic collusion is on the table for anyone whose agents set prices.

What to do about it

• Inventory the foundation models under your agent stack and what switching costs.

• Negotiate data-portability and interoperability terms while regulators give you cover.

• If your agents touch pricing, document human oversight.

Rock’s Musings

This got buried under the Hugging Face fireworks, and it is the one your CFO should read. The French built their own agents, ran 550 shopping queries, and measured who actually gets cited. Eighty-four percent in three hands. I have watched the lock-in movie before with cloud, and the sequel always costs more than the trailer. Sign nothing multi-year without a portability clause.

7. France’s CNIL Names Agent Memory as a GDPR Problem

On July 20, 2026, France’s data protection authority, the CNIL, with the Council for AI and Digital Technology, published a note on the risks of agentic AI for personal data (Digital Policy Alert). It named persistent memory and multi-service interaction as the features that strain the GDPR most, since memory collides with purpose limitation and cross-system action blurs the controller and processor line. France often previews where the wider EU lands, so read this as an early warning.

Why it matters

• Persistent memory is a named privacy hazard your impact assessments never anticipated.

• Multi-service agents blur controller and processor roles, and that means liability.

• France leads, so a CNIL position signals where EU enforcement heads next.

What to do about it

• Update your impact assessments to cover what memory stores, for how long, and how a subject deletes it.

• Map every agent’s cross-service reach and assign controllership per workflow.

• Build a memory-retention and erasure policy before a regulator asks.

Rock’s Musings

Everyone obsesses over what an agent does. The CNIL asked the sharper question, which is what it remembers and who owns that memory. Persistent memory outlives the purpose you collected it for, which is a slow-motion GDPR problem. If you cannot show a regulator how a data subject wipes themselves from an agent’s long-term memory, you do not have a compliant deployment. France just put that in writing, and I would fix it before August 2.

8. The Financial Stability Board’s AI Consultation Closed July 22

The comment window for the Financial Stability Board’s consultation, Sound Practices for Responsible Adoption of Artificial Intelligence, closed on July 22, 2026 (Financial Stability Board). The report offered 12 sound practices for organization-wide AI governance across the lifecycle and flagged agentic AI as an emerging risk to financial stability, with a final report planned for October 2026. The FSB does not chase consumer harms, so its attention signals where bank supervision heads next.

Why it matters

• The systemic-risk regulator for global finance is now writing AI governance expectations.

• Twelve sound practices become a de facto checklist that examiners reference.

• Agentic AI reached the stability conversation, elevating model risk from a compliance line item.

What to do about it

• Map your AI governance to the FSB’s 12 practices before the October final report.

• Brief your model-risk and third-party-risk teams that autonomous agents fall in scope.

• Prepare board-level documentation, because stability regulators expect governance owned at the top.

Rock’s Musings

When the Financial Stability Board starts talking about your AI, governance as a side project is over. The fact that agentic AI reached its radar points toward supervision that treats an autonomous trading agent like any other source of systemic risk, and its twelve practices rhyme with ISO 42001 and the NIST framework. If you run risk at a bank and you are not already mapping to this, you will explain yourself to an examiner later.

9. Neo Security Exits Stealth With $100 Million for Agent Control

On July 20, 2026, Neo Security left stealth with $100 million to build a secure control layer for enterprise AI agents (SiliconANGLE). Andreessen Horowitz and Bessemer led the round, and the founders came out of SentinelOne, which puts endpoint-grade thinking behind the pitch. The raise fit the day’s pattern, as venture money moved toward the control plane of AI rather than the presentation layer, betting that enterprises will need purpose-built controls to scope, monitor, and revoke what agents can do.

Why it matters

• The market just priced agent security at $100 million out of stealth.

• Endpoint-security founders signal the category matures fast.

• A control plane for agents is the architecture pattern to watch.

What to do about it

• Test whether your identity and privileged-access stack can scope, monitor, and revoke agent credentials.

• Start with least privilege and short-lived credentials for every agent today.

• Track this category in your architecture roadmap.

Rock’s Musings

Follow the money and it tells you what is coming. A hundred million dollars out of stealth for an agent control plane is the market saying the quiet part, that your identity stack was never built for software that acts on its own. A pile of venture money produces overlapping products, so buy the least-privilege discipline first and let the market shake out.

10. OpenAI Wants You to Measure AI by “Useful Intelligence per Dollar”

On July 17, 2026, OpenAI’s chief financial officer Sarah Friar proposed what she called the ultimate scorecard for the AI age (Axios). Her core metric, useful intelligence per dollar, runs four questions on work accomplished, cost, dependability, and return on compute. The dependability piece matters most for security leaders, since it counts how often a tool met quality standards, needed edits, and required a person to finish the task.

Why it matters

• The vendor is defining how you measure its value, so read the metric as a negotiating anchor.

• Intervention rate is exactly the oversight data your governance program needs.

• ROI pressure drives shadow AI faster than governance can follow.

What to do about it

• Adopt dependability tracking on your own terms, tied to risk, not cost alone.

• Push back on ROI framing that ignores security and governance overhead.

• Use the intervention metric as an early warning for over-delegated agents.

Rock’s Musings

I will give OpenAI credit for a useful idea wrapped in a sales pitch, though useful intelligence per dollar is also a number designed to make you feel good about the invoice. The part I want is the dependability tracking, meaning how often the thing needed a human to clean up, because that is your oversight telemetry and your risk signal in one. Keep the metric, and question the messenger.

The One Thing You Won’t Hear About But You Need To: The Chronos Vulnerability

The week of July 20, 2026, researchers Om Narayan, Ramkinker Singh, and Praveen Baskar posted a paper to arXiv, The Chronos Vulnerability: A Taxonomy of Temporal Persistence and Memory-Based Deception in Agentic AI, accepted at the ACM KDD 2026 Workshop on Evaluation and Trustworthiness of Agentic AI (arXiv). It maps how attackers exploit agent memory over time, the threat now tracked as memory poisoning and formalized as OWASP ASI06 in the 2026 Agentic AI Top 10. Poisoned memory survives past the originating session, so unlike prompt injection the attack and its effect are decoupled in time, with reported success rates from 80% to nearly 100% and defenses showing limited effect.

Why it matters

• Memory poisoning is the attack that waits, so single-session detections miss it entirely.

• Enterprise agents are the target, because memory-rich systems are the most exposed to durable compromise.

• Success rates run from 80% to nearly total, and defenses lag.

What to do about it

• Inventory which agents hold persistent memory, and treat that memory as a trust boundary.

• Add provenance and validation to memory writes.

• Red-team your agents across sessions, not only within one.

Rock’s Musings

This is a ten-page paper almost no one in your leadership will see, and it describes the threat I would use against you. The smart attacker poisons the memory and walks away, because the payload fires next week, long after your logs went quiet. Prompt injection is a mugging. Memory poisoning plants a sleeper. Put memory inside the boundary of identity, provenance, and least privilege now, because the attackers already read the paper. That is the argument I keep making at rockcyber.com.

👉 For ongoing analysis of agentic AI governance frameworks, the conversation continues at RockCyber Musings.

👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.

👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com

👉 As a bonus, check out my chat with Itay Meller, Specialist Solutions Architect, Security at AWS, about what autonomous vulnerability discovery changes for security teams, and where AI Detection and Response (AIDR) fits in a stack that was never built to watch agents. No registration required

Share RockCyber Musings

References

Autorité de la concurrence. (2026, July 17). The French Competition Authority issues an opinion on the competitive functioning of the AI agents sector. Concurrences. https://www.concurrences.com/en/bulletin/news-issues/preview/the-french-competition-authority-issues-an-opinion-on-the-competitive

Axios. (2026, July 17). Exclusive: OpenAI’s CFO pitches a new way to measure AI’s value. https://www.axios.com/2026/07/17/openai-ai-costs-roi-metrics

Ballon, M. (2026, July 21). OpenAI says Hugging Face was breached by its pre-release models. TechCrunch. https://techcrunch.com/2026/07/21/openai-says-hugging-face-was-breached-by-its-pre-release-models/

China Daily. (2026, July 18). Chair’s statement of the 2026 World Artificial Intelligence Conference & High-Level Meeting on Global AI Governance. https://www.chinadaily.com.cn/a/202607/18/WS6a5ab88aa310986e2b465f4e.html

Digital Policy Alert. (2026, July 20). CNIL and CIANum released a note on the risks of agentic AI for personal data protection. https://digitalpolicyalert.org/event/41932-national-commission-for-information-technology-and-civil-liberties-and-council-for-ai-and-digital-technology-released-a-note-on-the-risks-of-agentic-ai-for-personal-data-protection

Financial Stability Board. (2026, June 10). Sound practices for responsible adoption of artificial intelligence (AI): Consultation report. https://www.fsb.org/2026/06/sound-practices-for-responsible-adoption-of-artificial-intelligence-ai-consultation-report/

Help Net Security. (2026, July 20). Hugging Face breached by autonomous AI agent. https://www.helpnetsecurity.com/2026/07/20/hugging-face-breached-by-autonomous-ai-agent/

Help Net Security. (2026, July 22). Google’s Gemini 3.5 Flash Cyber becomes a vulnerability hunter. https://www.helpnetsecurity.com/2026/07/22/google-gemini-3-5-flash-cyber-model/

Kahn, J. (2026, July 21). OpenAI says its AI models escaped from a secure test environment and hacked into AI company Hugging Face in order to cheat on an evaluation. Fortune. https://fortune.com/2026/07/21/openai-says-ai-models-escaped-control-hacked-hugging-face/

MarkTechPost. (2026, July 22). Anthropic releases Claude Security plugin for Claude Code in beta: A multi-agent vulnerability scanner that runs in your terminal. https://www.marktechpost.com/2026/07/22/anthropic-releases-claude-security-plugin-for-claude-code-in-beta-a-multi-agent-vulnerability-scanner-that-runs-in-your-terminal/

Narayan, O., Singh, R., & Baskar, P. (2026, July). The Chronos vulnerability: A taxonomy of temporal persistence and memory-based deception in agentic AI (arXiv:2607.19433). arXiv. https://arxiv.org/abs/2607.19433

SecurityOnline. (2026, July 20). Linux kernel publishes 440 CVE advisories in 24 hours as AI accelerates bug hunting. https://securityonline.info/linux-kernel-cves/

SiliconANGLE. (2026, July 20). Neo Security bags $100M to build the secure control layer for enterprise AI agents. https://siliconangle.com/2026/07/20/neo-security-bags-100m-build-secure-control-layer-enterprise-ai-agents/

The Hacker News. (2026, July 22). Google launches Gemini 3.5 Flash Cyber AI to find and fix software vulnerabilities. https://thehackernews.com/2026/07/google-launches-gemini-35-flash-cyber.html

Willison, S. (2026, July 22). OpenAI’s accidental cyberattack against Hugging Face is science fiction that happened. https://simonwillison.net/2026/Jul/22/openai-cyberattack/

XenoSpectrum. (2026, July). Tracking the reality behind 440 Linux kernel CVE disclosures: Bulk assignment to already-fixed bugs and AI auditing. https://xenospectrum.com/en/linux-kernel-cve-batch-ai-review/

Open the AI Defense Matrix catalog and filter to Recover. You get two products out of 239. Filter to Protect and you get 194. Same catalog, same day, same 239 products. I pulled the raw data file yesterday and recounted every cell myself, because a gap that wide usually means somebody miscounted. Nobody miscounted.

Share

What The AI Defense Matrix Measures

Lenny Zeltser and Sounile Yu built a grid with eight AI-specific asset classes down the side, the six NIST CSF 2.0 functions across the top, 48 cells where they meet. The AI Defense Matrix launched May 11, 2026 under CC BY-SA 4.0, as the security-for-AI companion to Yu’s Cyber Defense Matrix.

The rule they used to decide what gets a row is what makes the thing useful. A row exists only if defending that asset requires AI-specific considerations, processes, or tools. If a generic security approach handles the defense well, it belongs in the Cyber Defense Matrix instead. Raw GPUs and containers got cut for that exact reason, and the change log says so out loud, which is more than most frameworks bother to do.

That discipline is why counting the cells means anything. The companion catalog places 239 products across those 48 cells, sourced from public information, dated, open to community correction. It catalogs AI-specific security products. Your SOAR platform and your backup vendor aren’t in it, and they shouldn’t be. What it measures is whether the industry has built an AI-specific answer for each cell.

For most of the grid, it has. For one corner of it, nothing showed up at all.

Run The Count Yourself

Nineteen of the 48 cells hold zero products or exactly one. All 19 sit in Govern, Respond, or Recover.

Run it the other way and the picture gets starker. Every single cell in Identify, Protect, and Detect holds at least three products. The floor is three for Identify, seven for Protect, six for Detect. Not one thin cell anywhere in those three columns. Then you cross into Govern, and the floor drops to zero. Same for Respond. Same for Recover.

Before anyone writes to tell me thin rows explain thin cells, they don’t. Runtime AI Data is the fattest row on the grid, with 244 product placements across it, and it still shows blanks in Govern and Recover. AI Model carries 116 placements and covers all six functions. Row size doesn’t predict where the holes are. Column does.

One number needs a footnote so nobody catches me playing games with it. When I say 194 products do Protect, that’s how many products carry a Protect tag on at least one asset class. Those same products land in 312 asset-specific Protect cells, because a product covering three rows counts once in the first number and three times in the second. Both numbers are real. They answer different questions.

Now, I’d be remiss if I didn’t call out that my employer sits in this catalog with five cells: agent identity discovery, plus protection and detection on runtime AI data and orchestration tools. All five land in the middle three columns. I’m not going to pretend that’s a coincidence or a shortcoming particular to us. It’s what nearly every product in the AI security market looks like when you place it on this grid, including the ones you already bought, and it’s the shape of the problem rather than the shape of any one vendor’s roadmap.

Two Products Cover Recover

Here they are, by name. Hirundo does machine unlearning, stripping memorized data and jailbreak behavior out of a trained model without a full retrain, and the catalog places it in Recover for AI Model. Rubrik Agent Cloud rewinds destructive agent actions, and it holds Recover for AI Agent Identities and for AI-Generated Code.

That’s the column. Two products, three cells, and no cell in Recover holds more than one product.

Respond does better and still doesn’t do well. Nine products across five cells. Four of the nine hold their Respond coverage on the AI Agent Identities row, and all four are non-human identity platforms: Astrix, Clutch, Permiso, and Vorlon. Credential revocation and agent quarantine are the one response capability the market ships in any volume at all.

Read the actual cell text and the two columns split cleanly. Respond is written in containment verbs: credential revocation, agent quarantine, session termination, RAG source isolation, plugin disable, shadow AI takedown. Recover is written in undo verbs: model version restore, dataset restore from golden copies, vector DB restore, re-indexing, prompt rollback, agent identity re-provisioning.

Then there’s the detail I keep coming back to. Three cells on the entire grid are labeled generic by the authors themselves. Generic container IR. Generic platform restore. Generic network failover. All three sit in Respond and Recover. Nowhere else on 48 cells do Zeltser and Yu tell you the traditional answer will do. That admission is the most honest thing on the page, and it’s also a map of where the AI-specific work hasn’t happened yet.

Undo assumes a lot. An agent that ran for six hours holding delegated credentials across a dozen tools has sent emails, opened pull requests, written to a CRM, posted in channels, and fired webhooks that triggered things you don’t have visibility into. Restore the platform, and none of that comes back. Those effects live in separate systems with separate owners and no shared transaction boundary, which means there’s nothing to roll back to. I’ve written before about why least agency beats least privilege once agents can act, and this column is that argument showing up as somebody else’s control taxonomy.

Why The Market Sells The Middle

I had the wrong explanation for this at first. My first read was that the empty columns are the architectural ones, and the market only sells what bolts on. Identify killed that theory in about a minute. Discovering AI agents across an enterprise is an architecture problem too, and the market sells 146 products against it.

That’s the difference between watching a system and reaching into it.

Identify and Detect sell because a product can do the work from outside. Agentless posture management crawls your cloud and finds unregistered models, and you change nothing to let it. Protect sells at 194 for a reason that surprised me until I read the product descriptions: what the market calls Protect for AI is overwhelmingly inline filtering at a chokepoint. Gateways, proxies, browser extensions, guardrails on prompts and responses. That’s still exterior work. A filter inspects something crossing a boundary and decides yes or no.

Every containment verb in the Respond column carries a precondition somebody had to build. You terminate a session where sessions exist and can be terminated. You revoke a credential where it was scoped and revocable in the first place. You quarantine an agent where the agent runs somewhere quarantinable. A vendor can sell you the button. Nobody can sell you the wiring behind it.

One row breaks that pattern, and it’s the exception worth studying rather than the one that sinks the argument. AI Agent Identities carries 56 products under Protect, and the cell text reads agent OAuth, capability scoping, and short-lived credentials. That’s architecture sold as a product, which is the thing I said the market doesn’t do.

Look at what happened behind it. AI Agent Identities and AI Model are the only two rows on the whole grid with coverage in all six functions, Respond and Recover included. Every other row has at least one blank. Both of those rows got a market around the underlying primitive first, non-human identity tooling in one case and model registries and provenance in the other. Once the asset became addressable, once agents had scoped identities and models had versions and inventories, the containment columns filled in behind them. Four products doing agent quarantine exist because 56 products turned agents into principals you can scope.

That sequence is the roadmap, and it took me a while to see it. Response capability doesn’t show up because vendors decide to care about incidents. It shows up after somebody makes the asset addressable, and containment becomes something you can build on top of that. Runtime AI Data carries 244 placements and zero Recover coverage, because nobody has made a prompt, a RAG chunk, or an agent’s persistent memory into a thing with a version and an owner you can roll back to. Do that work and the column can fill. Skip it and vendor attention won’t rescue you.

Govern is the cleanest proof, and it settles a question I went back and forth on. Read all eight Govern cells and every one is a standard, a policy, or an evaluation decision. AI platform standards. AI application governance. AI coding standards and code-review policy. AI egress policy. Model selection and provider evaluation. Dataset provenance and licensing policy. Prompt and RAG policy. AI agent identity policy and authorization standards.

None of that is a product category. Zeltser and Yu tell you as much in their own instructions, where the gap analysis asks whether process, technology, or both cover each cell, and then tells you to start with Govern. Eleven products carry a Govern tag, and five of the eight rows have zero. Credo AI, OneTrust, Cranium, Holistic AI, and LatticeFlow are all in there and correctly tagged. They help you document and evidence a policy. Writing the policy stays yours.

The Prediction The AI Defense Matrix Sets Up

Here’s where I part company with the authors, and I want to be precise about it because they are probably right.

Their guidance to vendors says to treat thinly covered cells as opportunities for differentiation and new products that solve underserved needs. That’s a forecast because the thin columns fill because the market notices the gap and builds into it. My read is that Recover and most of Respond stay thin, because the missing capability isn’t a product somebody forgot to build. It’s a property of systems that were designed without it.

Put a number on it. I’d say 70% that the Recover column holds fewer than ten products in July 2028, and under 20% that it ever resembles what Protect looks like today. I’m at 70 rather than 90 because I’ve been wrong about market timing before. Nobody sold cloud posture management in 2016 either, and a July 2026 snapshot of a young category can look identical to a permanent boundary.

The falsifier is specific, so hold me to it. Watch Rubrik. If three more vendors ship agent-action reversal and it works without you rerouting your agents through their control plane first, I’m wrong and the market solved something I said it structurally couldn’t. If the only way it ever works is routing your agents through somebody’s plane, that’s the architectural decision doing the work, and the product is the part you bolt on afterward.

Meanwhile, NIST IR 8596, the Cyber AI Profile everyone’s waiting on, has been sitting as an initial preliminary draft since December 16, 2025, with the comment period closed since January 30, 2026. Seven months, no initial public draft. You need a working instrument now, and this grid is the best one anybody’s published.

Two products cover Recover for all of AI. One strips bad behavior out of model weights. The other rewinds agent actions it was routed through ahead of time. That’s the entire Recover column of the AI Defense Matrix, on a grid of 48 cells, in a market that has shipped 194 ways to protect you and almost nothing to put you back together.

What To Do Next

Download the matrix as a CSV, YAML, or Markdown and populate it for your own environment this week. Mark every cell covered, partial, or absent. Budget 90 minutes with whoever owns your agent platforms.

Then cover Identify, Protect, and Detect with your hand and look at what’s left. For each blank in Govern, Respond, or Recover, write down two things: the design decision that would have to change for that cell to fill, and the name of the person who can make that decision. Not the product that would fill it. The decision and the owner. That’s a build backlog and an ownership map, which is Create and Adapt work in the CARE model, and it’s a different conversation than a purchase order.

If you want the deeper argument on why authorization scope is a runtime decision rather than a connection-time checkbox, I wrote that up in the MCP authorization gap piece, and JadePuffer is what the Respond column being empty looks like when it happens to somebody. More at rockcybermusings.com, and the advisory work lives at rockcyber.com.

👉 For ongoing analysis of agentic AI governance frameworks, the conversation continues at RockCyber Musings.

👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.

👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com

👉 As a bonus, check out my latest appearance on the Down The Security Rabbit Hole podcast, where we discuss the current state of AI in the SOC for cybersecurity and specifically how it differentiates from the promise of SOAR.

Share RockCyber Musings

We’ve warned boards that autonomous AI attacks were coming. We were proven right once again. An AI agent broke into Hugging Face and ran the intrusion itself. A government red team cracked a new frontier model’s cyber safeguards in six hours. The forecast became the incident report.

The through-line rattles anyone still treating AI as a feature bolted onto the business. Attackers now point capable models at your environment and let them plan, adapt, and act at machine speed. China switched on the first real rulebook for AI agents. Two labs dropped open-weight frontier models anyone can download. Microsoft shipped its largest patch load ever and credited its own AI. I cut the stories that predate July 10. Here is what landed.

Share

1. Hugging Face Discloses a Breach Run End to End by an AI Agent

On July 16, 2026, Hugging Face disclosed that an autonomous AI agent breached part of its production infrastructure days earlier (Hugging Face, 2026). A malicious dataset abused two code-execution paths, escalated to node-level access, and moved laterally over a weekend. The company found access to internal datasets and service credentials, with no public models touched. It reconstructed the timeline with its own LLM analysis over 17,000 attacker events (NHIMG, 2026).

Why it matters

• The first high-profile platform breach run end to end by an agent.

• The foothold was a poisoned dataset, not a phished user.

• Safety guardrails blocked the defenders, not the attacker.

What to do about it

• Sandbox dataset-processing workers and scope their credentials.

• Pre-stage an open-weight model that you control for incident response.

• Rehearse weekend and off-hours detection.

Rock’s Musings

I have sat through a hundred tabletops where someone called this scenario fiction. Hand them the disclosure. The attacker chained known mistakes into one operation, and only the driver was new. Guardrails blocked the responders while the attacker’s stripped-down model faced none. Stage your break-glass model, rotate the secrets your workers touch, and expect the next probe on a Saturday. I have argued this blast-radius math at rockcybermusings.com for a while.

2. UK Government Red Team Cracks GPT-5.6 Cyber Safeguards in Six Hours

On July 10, 2026, the UK AI Security Institute reported universal jailbreaks in OpenAI’s freshly released GPT-5.6 (Fortune, 2026). Testers defeated the controls meant to stop the model from hacking, then used it to break into systems on its own. AISI built the jailbreak in roughly six hours, and it held across OpenAI’s malicious-query set (Technobezz, 2026). OpenAI pointed to its layered safeguards and a rapid remediation process.

Why it matters

• A government agency beat a frontier lab’s cyber guardrails in an afternoon.

• These jailbreaks enable agentic offense rather than one-off bad answers.

• Pre-release government testing caught it before public exposure.

What to do about it

• Wrap your own boundaries around any model with tool access.

• Make vendor red-team results a written procurement gate.

• Assume any model exposed to untrusted input can turn offensive.

Rock’s Musings

Six hours. That is the number I want every executive to sit with. A red team needed less than a workday to turn a flagship model into an exploit-writing partner. I am a Bayesian, and my prior that guardrails hold under a determined attacker dropped again. Vendor safety layers are speed bumps, worthless against the motivated. The redeeming part is a government caught this before release. Put the vendor’s evaluation posture in your contract.

3. China’s Rulebook for AI Agents Takes Effect, the First of Its Kind

On July 15, 2026, China’s Implementation Opinions on intelligent agents became enforceable, the world’s first dedicated regulatory category for AI agents (IAPP, 2026). The rules define agents as systems capable of autonomous perception, memory, decision-making, and execution. They establish a three-tier decision-authorization structure and mandate filing, testing, and product-recall provisions in sensitive sectors (Global Law Experts, 2026). The same date pushed platforms like Doubao and Qwen to shut down companion features.

Why it matters

• The first binding definition of an AI agent came out of Beijing.

• China operations with agent deployments face immediate filing duties.

• Authorization tiers force you to declare what an agent decides alone.

What to do about it

• In China, map every agent to the authorization and filing rules now.

• Build an agent inventory with decision rights and override thresholds.

• Align your internal agent taxonomy to the definition.

Rock’s Musings

I do not love handing Beijing the pen, but credit where it is due. They defined an AI agent while the rest of us argued about whether agents are high-risk by default. Definitions are power, and the clearest legal one now lives in a Chinese regulation. The practical bite is the tiers: what may this agent decide without a human in the loop? I ask that in every board session I run through rockcyber.com and get blank stares more often than answers. Write down your agents’ decision rights now.

4. xAI’s Grok Build CLI Shipped Entire Repositories and Secrets to the Cloud

Around July 13 and 14, 2026, a researcher showed that version 0.2.93 of xAI’s Grok Build coding CLI uploaded entire Git repositories to a Google Cloud Storage bucket rather than the files a task needed (Tech Times, 2026). For a 12 GB repository, the tool pushed more than 5 GB while model traffic came to 192 KB. The upload included the full commit history, so deleted files went too. Files holding credentials uploaded without redaction, and opting out did not stop the sweep (Crypto Briefing, 2026).

Why it matters

• Your code and secrets can leave as a side effect of a coding assistant working.

• The opt-out control did nothing. Privacy toggles are marketing until proven.

• Full commit-history upload means deleted secrets are back in play.

What to do about it

• Block or quarantine Grok Build CLI until you verify what it transmits.

• Gate every agentic coding tool on evidence of what it sends.

• Rotate exposed secrets and move credentials into a manager.

Rock’s Musings

This one made me put my coffee down, because the privacy toggle was theater. Someone shipped a product where do-not-send-my-data was a suggestion the software ignored. We only know because a researcher watched the packets. How many other agentic tools in your environment do the same and nobody has checked? Agentic developer tools are the new shadow IT, with your whole codebase as the blast radius. Gate approval on proof of behavior, and get secrets out of source control.

5. Unpatched Claude for Chrome Flaw Lets Rogue Extensions Read Your Gmail

Mid-week, researchers at Manifold Security detailed two flaws in Anthropic’s Claude for Chrome extension that let a malicious browser extension read a victim’s Gmail, Docs, and Calendar with about six lines of JavaScript (The Hacker News, 2026). The root cause is a handler that never checks whether a click came from a real user. Any extension with script access on claude.ai forges a click and fires a hardcoded prompt silently. Manifold reported the flaws in May 2026, yet the vulnerable code still shipped in version 1.0.80 on July 7 (CSO Online, 2026).

Why it matters

• A browser AI agent with mailbox access becomes an exfiltration tool.

• The flaw maps to indirect prompt injection and excessive agency.

• Reported in May, still exploitable in July. Resolved did not mean fixed.

What to do about it

• Inventory AI browser extensions with mail access, and disable act-without-asking mode.

• Treat browser AI agents as privileged identities.

• Demand proof a fix reached production, not that a ticket closed.

Rock’s Musings

The detail that stuck with me is the gap between a ticket marked resolved and code that never moved. Someone closed it, everyone relaxed, and eight releases later the hole is still open. I have lived that failure mode in every large program I have run. The browser holds your sensitive data already decrypted and logged in, and you handed an agent permission to read your mail. The guardrail against abuse was a check the developers forgot to write. Treat every browser agent as a privileged service account, and ask to see the diff.

6. Microsoft Patches a Record 570 Flaws as AI Reshapes Both Sides of the Fight

On July 14, 2026, Microsoft shipped the largest Patch Tuesday in its history, fixing a record 570 vulnerabilities, including three zero-days with two exploited in the wild (BleepingComputer, 2026). Microsoft tied the surge to its own AI, crediting a vulnerability scanner it calls MDASH that finds flaws in Windows components before attackers reach them. The number runs roughly four times the same month a year earlier (Krebs on Security, 2026). The exploited zero-days hit Active Directory Federation Services and SharePoint Server (TechCrunch, 2026).

Why it matters

• AI now finds vulnerabilities at a scale that breaks your patch cadence.

• The tools that help Microsoft find bugs help attackers weaponize them in hours.

• Two exploited zero-days sit in identity infrastructure.

What to do about it

• Prioritize the exploited AD FS and SharePoint zero-days now.

• Shorten patch deferral windows for internet-facing and identity systems.

• Invest in runtime detection, not only patching.

Rock’s Musings

Five hundred and seventy. No human triage process was built for a number like that, and Microsoft is honest that AI drove the spike. Their agent found the bugs before the bad guys, who aim the same tools at the same code. Offense and defense now both scale with compute, and the loser moves at human speed. The energy and manufacturing clients I worry about cannot patch on this timeline, so they lean on segmentation and detection tuned for exploitation behavior. Plan for the flood, because it is the baseline now.

7. Thinking Machines Ships Inkling, a 975-Billion-Parameter Open-Weight Model That Fine-Tunes Itself

On July 15, 2026, Mira Murati’s Thinking Machines Lab released Inkling, an open-weights mixture-of-experts transformer with 975 billion total parameters and 41 billion active (TechCrunch, 2026). It carries a context window up to 1 million tokens. The headline capability was a demonstration in which Inkling fine-tuned itself, autonomously writing, running, and evaluating its own fine-tuning job (Axios, 2026). Full weights mean anyone can download, inspect, and customize the model.

Why it matters

• A frontier-scale model with open weights lands in anyone’s hands.

• Self-directed fine-tuning collapses the effort to specialize a model.

• Open weights on your own hardware is what defenders wanted this week.

What to do about it

• Add open-weight models to your threat model as unrestricted attacker capability.

• Treat internal self-fine-tuning as a change-management event.

• Give defenders a sanctioned open-weight option on controlled infrastructure.

Rock’s Musings

Open weights are a genuine double-edged sword, and I refuse to pretend otherwise for either camp. The same day Hugging Face said defenders need a self-hosted model, Thinking Machines handed everyone a frontier-scale one. That helps blue teams and it helps the people building offense models with the safety sanded off. My probability that abliterated versions show up in attack tooling within months is high. I am not in the ban-open-models camp. What I want is honesty about the trade.

8. Kimi K3 Pushes an Open-Weight Model to the Frontier, From China

On July 16, 2026, Moonshot AI launched Kimi K3, a roughly 2.8-trillion-parameter mixture-of-experts model. Its 1-million-token context window targets long-horizon coding and agent workloads (TechCrunch, 2026). In blind testing by the evaluation platform Arena, developers preferred Kimi over every leading US model for front-end coding, including Anthropic’s Fable 5 and OpenAI’s GPT-5.6 Sol (Axios, 2026). Moonshot committed to releasing the open weights on July 27.

Why it matters

• A Chinese lab reached rough parity and chose to open the weights.

• Frontier-level coding in open weights lowers the floor for autonomous tooling.

• Enterprises will feel pressure to adopt the cheapest capable model.

What to do about it

• Decide your policy on Chinese-origin open-weight models now.

• Factor the July 27 weight release into your threat model.

• Evaluate data residency before routing sensitive code through a hosted Kimi endpoint.

Rock’s Musings

Two open-weight frontier models landed in one week. One came from a former OpenAI CTO, one from Beijing, both matching or beating the closed US flagships. The story that closed labs hold an unbridgeable lead died quietly this week. When developers in a blind test prefer Kimi over Fable 5 and GPT-5.6, price and openness win the next procurement cycle. The question I keep dragging boards toward: what is your policy on where your models come from, and did you write it yet? Decide deliberately, because the July 27 weight drop turns this into an anyone-can-run-it problem.

9. Meta Pulls an Instagram AI Feature That Copied People’s Likenesses Without Clear Consent

After a short, loud backlash, Meta removed the Muse Image feature that let users generate AI images by referencing public Instagram accounts, with the reversal landing around July 13 and 14, 2026 (TechRepublic, 2026). Launched July 7, it used public accounts’ posted photos as references. Adult public accounts were swept in by default unless a user disabled a reuse setting, and Meta’s own policy said people would not be notified when someone used their likeness (Variety, 2026). Meta said the feature missed the mark and pulled it.

Why it matters

• A trillion-dollar platform shipped opt-out-by-default likeness reuse and retreated in a week.

• Likeness reuse is what the EU AI Act transparency rules move to govern.

• The reputational half-life of a bad AI consent decision is now days.

What to do about it

• Default any AI feature using third-party likenesses to opt-in with notice.

• Map likeness features against the EU AI Act obligations arriving August 2.

• Put a consent review gate in front of AI feature launches.

Rock’s Musings

Meta is not a naive startup that stumbled into a consent problem. They have armies of lawyers and privacy engineers, and they still shipped default-on likeness reuse with no notice to the people whose faces got borrowed. The reflex inside big platforms remains take first, apologize later. What changed is the clock, because the backlash cost them the feature in a week. I tell boards that consent is not a checkbox at the bottom of a settings page nobody opens, and this is the case study. Design for affirmative consent now.

10. Check Point’s AI Security Report Puts Numbers to the Machine-Speed Threat

On July 15, 2026, Check Point published its AI Security Report 2026, documenting a year in which attackers ran exploitation workflows autonomously, generating thousands of commands with minimal human direction (Help Net Security, 2026). Adversaries acquire AI capability by abusing commercial models, stealing credentials, or self-hosting open-source models, then strip the safety controls. The report flags jailbreaks planted in agent configuration files like CLAUDE.md that load every session and stay active until removed. On identity, trained observers spotted AI-generated faces only about 41% of the time (Check Point, 2026).

Why it matters

• The autonomous-attacker pattern is now measured across a year of real incidents.

• Jailbreaks in config files keep an agent compromised across sessions.

• Trained analysts spot fake faces 41% of the time, so identity checks fail.

What to do about it

• Add integrity monitoring for agent configuration files.

• Move identity verification beyond face and voice for high-value actions.

• Measure your own high-risk AI interaction rate.

Rock’s Musings

I am wary of vendor reports, so I read this one for the load-bearing data. The number that survived my skepticism is the 41%. When trained people flip a coin and do worse at spotting a fake face, every identity control built on I-can-tell-it-is-you is obsolete. I have told financial and energy clients for two years that voice and video prove nothing anymore. The config-file jailbreak deserves more attention than it will get, because a poisoned CLAUDE.md is patient persistence most stacks never inspect. Instrument the files your agents read at startup.

The One Thing You Won’t Hear About But You Need To

11. Defenders Turn Prompt Injection Into a Weapon: Tracebit’s “Context Bombs”

On July 14, 2026, researchers at Tracebit published a defensive twist that flips prompt injection against the attacker (Help Net Security, 2026). Rather than hijacking an AI, they plant short strings called context bombs inside decoy resources, crafted to trip the safety guardrails of an offensive AI agent and stop it mid-intrusion. They tested five leading models across 152 trials in an imitation AWS environment. Opus 4.8 reached full account admin in 93% of clean runs and failed every single time once a context bomb was in play (Tracebit, 2026).

Why it matters

• Defenders finally have a tool that turns the attacker’s safety training into a trap.

• Context bombs disrupt the intrusion in progress and buy back reaction time.

• The technique layers on top of canary and deception controls.

What to do about it

• Pilot context bombs inside honeytokens and decoy secrets.

• Pair them with canaries so a tripped bomb also raises an alert.

• Track abliterated models, which may ignore the bomb.

Rock’s Musings

This is the story that made me smile all week, and almost nobody outside the research crowd is talking about it. For two years the prompt-injection conversation has been a funeral dirge: the flaw cannot be fixed, abandon hope. Tracebit asked the contrarian question, why not turn the attacker’s guardrails into a landmine in your own environment? Opus 4.8 going from a 93% admin-access rate to zero resets a prior in a hurry. The caveat matters, because an attacker running an abliterated model may walk right past the bomb. I would still rather hand my defenders a working trap today than wait for a fix that is never coming.

👉 For ongoing analysis of agentic AI governance frameworks, the conversation continues at RockCyber Musings.

👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.

👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com

👉 As a bonus, check our AMA on the 2026 OWASP GenAI Security Project State of Agentic AI Security and Governance report with me and the other co-leads (it was live, so start at time marker 09:45)

The views and opinions expressed in RockCyber Musings are my own and do not represent the positions of my employer or any organization I’m affiliated with.

Share RockCyber Musings

References

Axios. (2026, July 15). Mira Murati’s Thinking Machines debuts its first AI model. Axios. https://www.axios.com/2026/07/15/mira-murati-thinking-machines-open-weight-model-inkling

Axios. (2026, July 16). China’s open-weight Kimi model stuns AI world with frontier-level results. Axios. https://www.axios.com/2026/07/16/moonshot-kimi-ai-china-model-openai-anthropic

BleepingComputer. (2026, July 14). Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days. BleepingComputer. https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/

Check Point Software Technologies. (2026, July 15). AI Security Report 2026. Check Point. https://www.helpnetsecurity.com/2026/07/15/check-point-ai-security-report-2026/

Crypto Briefing. (2026, July 14). xAI Grok Build CLI caught uploading private code and secrets to Google Cloud bucket. Crypto Briefing. https://cryptobriefing.com/xai-grok-build-cli-private-code-leak/

CSO Online. (2026, July). New bugs in Claude for Chrome allow extensions to abuse AI privileges. CSO Online. https://www.csoonline.com/article/4197325/new-bugs-in-claude-for-chrome-allow-extensions-to-abuse-ai-privileges.html

Fortune. (2026, July 10). U.K. agency finds ‘universal jailbreaks’ unlock dangerous cyber capabilities of OpenAI’s GPT-5.6. Fortune. https://fortune.com/2026/07/10/openai-gpt-5-6-sol-jailbreaks-cyber-attacks-similar-to-security-flaw-that-led-u-s-government-to-force-anthropic-to-disable-fable-5/

Global Law Experts. (2026, July). A concise interpretation of the CAC’s Implementation Opinions on the standardised application and innovative development of AI agents. Global Law Experts. https://globallawexperts.com/innovation-regulation-as-inseparable-objectives-a-concise-interpretation-of-the-cacs-implementation-opinions-on-the-standardised-application-innovative-development-of-ai-agents/

Help Net Security. (2026, July 14). “Context bombs” can frustrate AI-driven attacks, researchers found. Help Net Security. https://www.helpnetsecurity.com/2026/07/14/context-bombs-for-defensive-prompt-injection/

Help Net Security. (2026, July 15). AI used to help plan the break-in, now it’s doing the break-in. Help Net Security. https://www.helpnetsecurity.com/2026/07/15/check-point-ai-security-report-2026/

Hugging Face. (2026, July 16). Security incident disclosure: July 2026. Hugging Face. https://huggingface.co/blog/security-incident-july-2026

International Association of Privacy Professionals. (2026, July). China’s new AI rules: Ethics, AI agents and anthropomorphic AI. IAPP. https://iapp.org/news/a/china-s-new-ai-rules-ethics-ai-agents-and-anthropomorphic-ai

Krebs on Security. (2026, July). Microsoft patches a record 570 security flaws. Krebs on Security. https://krebsonsecurity.com/2026/07/microsoft-patches-a-record-570-security-flaws/

NHIMG. (2026, July). Hugging Face breach. Non-Human Identity Management Group. https://nhimg.org/hugging-face-breach

Technobezz. (2026, July). U.K. AI Security Institute finds universal jailbreaks in OpenAI’s GPT-5.6 within hours. Technobezz. https://www.technobezz.com/news/uk-ai-security-institute-finds-universal-jailbreaks-in-openais-gpt-56-within-hours

TechCrunch. (2026, July 15). Thinking Machines amps up its bet against one-size-fits-all AI with its first open model, Inkling. TechCrunch. https://techcrunch.com/2026/07/15/thinking-machines-amps-up-its-bet-against-one-size-fits-all-ai-with-its-first-open-model-inkling/

TechCrunch. (2026, July 15). Microsoft patches record number of security vulnerabilities, citing its use of AI. TechCrunch. https://techcrunch.com/2026/07/15/microsoft-patches-record-number-of-security-vulnerabilities-citing-its-use-of-ai/

TechCrunch. (2026, July 16). Moonshot’s Kimi 3 is expected to close the gap with Anthropic’s Opus 4.8. TechCrunch. https://techcrunch.com/2026/07/16/moonshots-upcoming-kimi-3-is-expected-to-close-the-gap-with-anthropics-opus-4-8/

TechRepublic. (2026, July). Meta removes Muse Image Instagram feature after consent backlash. TechRepublic. https://www.techrepublic.com/article/news-meta-scraps-muse-image-feature-after-launch/

Tech Times. (2026, July 14). Grok Build shipped entire codebases to xAI cloud, privacy toggle did nothing. Tech Times. https://www.techtimes.com/articles/320420/20260714/grok-build-shipped-entire-codebases-xai-cloud-privacy-toggle-did-nothing.htm

The Hacker News. (2026, July). Researchers say Claude for Chrome flaw lets rogue extensions trigger Gmail reads. The Hacker News. https://thehackernews.com/2026/07/claude-for-chrome-flaw-lets-other.html

Tracebit. (2026, July 14). Context bombs: Stopping AI attackers in their tracks. Tracebit Research. https://agentic.tracebit.com/context-bombs/

Variety. (2026, July). Meta suspends Instagram AI image feature after days of backlash. Variety. https://variety.com/2026/biz/news/meta-suspends-ai-image-instagram-feature-backlash-1236806989/

Autonomous AI agent ransomware stopped being a research demo. Sysdig disclosed JadePuffer, an operation in which a language model executed a full ransomware kill chain from recon to encryption, with no human at the keyboard. It used no zero-days. It used a year-old bug, default credentials, and machine identities you already own. Here’s what happened, and the one control that would have contained it.

Share

How The Agent Ran The Whole Chain

Langflow is a widely used open-source framework for building AI applications, and plenty of teams run it safely. This victim left a version with a year-old critical bug facing the open internet. That exposure is what the agent walked through. Once it had code execution on the host, it enumerated the machine and swept the environment for secrets in parallel: model provider keys, cloud credentials, crypto wallets, database credentials, and configuration files. It dumped Langflow’s own backing database, pulled the stored keys and user records, then deleted its staging files to clean up after itself.

Then it found the object store. Using the default credentials minioadmin:minioadmin, it listed every bucket, prioritized the ones named for infrastructure state and internal config, and fetched a credentials.json file by name. That file held an access key and secret pair, which the agent printed to its own terminal and saved to disk. It also installed a cron job on the host that beaconed to attacker infrastructure every 30 minutes, so it could get back in.

The agent reached the production database as root using credentials whose origin Sysdig could not determine. The agent didn’t harvest them from the Langflow host. Standing machine credentials sit in more places than any single inventory shows. From there, it injected a backdoor administrator into the Nacos configuration database, ran a methodical survey for a container escape using the database’s file primitives, reading the Docker socket and the container cgroup files to test for a path out of the container entirely, and moved to the finish. It encrypted all 1,342 Nacos service configuration items with MySQL’s built-in encryption function, dropped the original tables, and wrote a ransom note demanding Bitcoin.

The agent generated the encryption key at random, printed it to the console once, and never saved or transmitted it. The victim can’t recover those configurations even if they pay. Sysdig counted more than 600 distinct payloads across the operation, and the data theft the ransom note bragged about was the agent’s own code comment, not something Sysdig independently confirmed. Strip the AI language away, and you have automated destruction wearing an extortion note.

This is what Sysdig assesses to be the first documented end-to-end agentic ransomware operation. Last August, researchers flagged a tool called PromptLock as the first AI-driven ransomware, but it turned out to be a proof of concept built at NYU that was never fired at a victim. JadePuffer is the one that ran in a live environment against a real target.

Autonomous AI Agent Ransomware Needed Zero Zero-Days

Every weapon in that chain was old and public. CVE-2025-3248, the Langflow flaw the agent used for entry, is an unauthenticated remote code execution bug rated 9.8 on the critical scale. Langflow shipped a fix in version 1.3.0 in April 2025. CISA added the flaw to its Known Exploited Vulnerabilities catalog on May 5, 2025, with a federal remediation deadline of May 26. The victim was still running the vulnerable version more than a year later.

The downstream target was no fresher. The Nacos authentication bypass that the agent tried, CVE-2021-29441, dates to 2021, and Nacos patched it in version 1.4.1. The default signing key it tried to use to forge tokens has been publicly known since 2020. The object store answered to minioadmin:minioadmin, the vendor default that ships in the box.

That is the point... An agent doesn’t need novel exploits when the historical vulnerability catalog is sitting open. It sprays known weaknesses across exposed infrastructure at machine speed, and the long tail of unpatched systems that defenders have tolerated for years becomes the whole attack surface. Sysdig made the same observation in its own write-up. Attackers now automate old vulnerabilities, and automation makes spraying the entire back catalog nearly free. Every one of those weaknesses had a fix or a hardening step available for months or years, and the victim skipped all of them, which is the tail that an agent feeds on.

The blast radius here didn’t come from anything the security industry hadn’t seen before. It came from an agent that chained a decade of known problems without getting tired, without an expert operator, and without a brittle script that breaks the moment the environment differs from the plan. That capability is what separates an agentic attacker from a scripted one, and it is why the patch-faster reflex misses the shape of the threat.

Machine Identity Was The Attack Surface

Look at what the agent went after first. It went after credentials like model provider keys for OpenAI, Anthropic, DeepSeek, and Gemini; cloud credentials with explicit coverage of AWS, Azure, Google, and the major Chinese providers; crypto wallets; and every config file it could reach. The agent never touched the model itself. It didn’t need to. The API keys, the default object-store login, and the unrotated root database account were the keys to the kingdom, and the agent used them better than the defender governed them.

This is the machine identity problem, and it predates AI by years. I’ve watched it play out in operational technology environments, where a service account with standing privileges and no rotation sits quietly for years until someone, or something, finds it and rides it into the control network. The structural failure JadePuffer exploited is the same one. Credentials carry more authority than the task needs, live longer than they should, and sit where a compromised process can read them. Change the label on the attacker from a human contractor to an autonomous agent, and the underlying weakness doesn’t move.

Sysdig’s read is that if an agent like this runs on stolen model credentials, a pattern the industry tracks as LLMjacking, the cost to the attacker drops close to zero. The same non-human-identity failure shows up on both ends of this attack. The victim’s machine credentials were the target, and stolen machine credentials are what make the attacker’s economics work. In most enterprises, machine identities pile up faster than anyone can govern them, and they rarely get the rotation, scoping, and monitoring that employee accounts get. Nobody owns them the way a manager owns an employee’s access. A developer spins up a service account to ship a feature, the key never expires, and it outlives the project, the developer, and the memory of why it existed. JadePuffer is what that gap looks like when an agent finds it.

Least Privilege Failed. Least Agency Was The Missing Control.

Let me be honest about what went wrong, because the tempting version of this story is wrong. The victim had real least-privilege failures of the ordinary kind. They had a root database account exposed to the internet, default credentials on the object store, and provider secrets sitting on a web-reachable AI host. Any competent audit would have flagged it all.

Least privilege was never going to be enough here, and that is the harder lesson. An agent operating with legitimate standing credentials does exactly what those credentials permit. It authenticates as an authorized principal. Every action it takes is technically allowed. Privilege scoping specifies what a credential may access. It says nothing about whether the holder should chain reconnaissance into credential theft, into lateral movement, into mass encryption as one continuous operation.

That gap is what runtime authorization scope closes, and JadePuffer shows why you need it. Watch the agent recover from failure. Its first attempt to create a backdoor admin in Nacos failed a login check. Thirty-one seconds later, with no human reading the error, it diagnosed the cause, deleted the broken account, rebuilt it with a corrected password hash, and logged in. Later, when a database drop failed on a foreign key constraint, the next payload disabled the constraint check, ran the drop, and re-enabled it. Each fix targeted the exact failure it had hit.

A scripted attack breaks when the environment differs from the script. An agent adapts to the difference and keeps going. That is why a static permission model, tuned for tools that fail predictably, leaves you exposed to an attacker who reasons through obstacles. The control you need is a runtime bound to task intent, one that treats “encrypt every configuration record and drop the tables” as an action requiring fresh authorization, regardless of what the standing credentials allow.

The part that should keep you up at night is simpler. Every agentic system you deploy inside your own walls inherits the same structure. It runs on standing machine credentials. It acts as an authorized principal. Give it broad privilege and no runtime bound, and a compromise or a bad instruction gets the same blast radius JadePuffer got, and it gets there just as fast.

What CISOs Do Before The Next One

The fixes that would have stopped this aren’t exotic. Sysdig’s own list starts with the obvious: patch the Langflow flaw, and keep code-execution endpoints off the public internet. From there, it gets to the machine-identity core. Keep provider API keys and cloud credentials off your AI-orchestration hosts, and scope them to a secrets manager away from web-reachable processes. Rotate the Nacos default signing key, and never let a configuration service reach its database as root. Put egress controls on application hosts so a compromised box can’t beacon out or reach an internal database it has no business touching.

Those close the holes this specific agent walked through. The durable move is to turn least agency from a principle you nod at into a control you build. Concretely, that means three things. Issue task-scoped, short-lived credentials instead of standing keys, so a compromised agent holds authority that expires in minutes rather than a key that works forever. Gate destructive operations, anything that drops tables, deletes data, or changes access, behind a re-authorization step that the agent can’t satisfy on its own. Run deny-by-default egress at the agent host, so reaching a new destination becomes a decision rather than a default.

Detection changed too, in your favor for once. An LLM narrates its own intent in the payloads it writes. JadePuffer’s code carried natural-language comments explaining which database was of highest value and why. That self-narration is a signal you didn’t have against a human operator or a compiled tool, so feed your database and host telemetry to detections that look for it. One honest observer made a point worth taking: a quarterly assessment leaves dangerous gaps when your internet-facing services change every day and an automated attacker moves from discovery to impact in minutes. Continuous visibility beats the periodic snapshot. Sysdig calls JadePuffer an agentic threat actor, an operator whose capability comes from an agent rather than a human toolkit. That category is going to grow, because the skill floor for running an operation like this dropped to the cost of running an agent, and criminal crews adopt cheap, reusable tooling fast.

Key Takeaway: Autonomous AI agent ransomware wins on standing machine credentials and unbounded runtime agency, so scope your non-human identities and bound what your agents can do before someone else does it for you.

What To Do Next

Start with an inventory, because you can’t bound what you can’t see. Map every place where standing machine credentials live inside your AI tooling: the provider keys, the service accounts, the object-store logins, and the database credentials your agents and pipelines hold. Then pick one runtime authorization boundary and build it this quarter, the one an agent can’t cross without fresh authorization. That is the Create and Adapt work in the CARE model, and it is where least agency stops being a slogan and becomes a control.

For the deeper frames behind this, I’ve written the cornerstone piece on least agency versus least privilege, the case for treating non-human identity as the agentic control plane you probably skipped, and the difference between a model as a component and a model as an actor, all at rockcybermusings.com. The consulting side lives at rockcyber.com if you want help doing the work.

👉 For ongoing analysis of agentic AI governance frameworks, the conversation continues at RockCyber Musings.

👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.

👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com

👉 As a bonus, check our AMA on the 2026 OWASP GenAI Security Project State of Agentic AI Security and Governance report with me and the other co-leads (it was live, so start at time marker 09:45)

The views and opinions expressed in RockCyber Musings are my own and do not represent the positions of my employer or any organization I’m affiliated with.

You waited an extra week to use GPT-5.6 because federal officials wanted a look first. Sit with that. The biggest shift in AI security this week wasn’t an exploit or a regulation. It was the government taking a seat in the release pipeline of a commercial model before you got to touch it. Meanwhile the coding agents everyone rushed into production leaked private repos and phoned home hard enough that a national government yelled backdoor. The frontier got a chaperone. The agents got caught. Let’s get into it.

This was the week the theory turned operational. For two years we argued about whether governments should vet frontier models before release, and whether agents were safe with real credentials. Both got answered in public, in the same seven days. Washington reviewed GPT-5.6, Illinois signed the country’s toughest AI safety law, and the EU and Google both floated new oversight, while China told developers to rip out Claude Code and two separate teams turned GitHub’s coding agents against their owners. The thread through all of it is trust. Who sees a model first, who audits it, and whether the agent reading your issues knows instructions from data.

Share

1. Washington Reviewed GPT-5.6 Before You Could, and OpenAI Shipped It Today

OpenAI released GPT-5.6 to the public on July 9, 2026, after federal officials finished a pre-release security review (TechCrunch). The delay is traced to a June executive order from President Trump that lets developers hand-cover frontier models to the government for up to 30 days before release (The Hill). Sam Altman objected to the government picking which customers get access.

Why it matters

• A voluntary review becomes the default once the biggest lab complies.

• Your vendor’s release date now carries a government dependency you can’t see into.

• “Covered frontier model” only expands, and this precedent shapes the next hundred reviews.

What to do about it

• Ask vendors whether a model went through federal pre-release evaluation.

• Build in roadmap buffer for review-driven slips of a week or more.

• Press for the security findings, not the announcement.

Rock’s Musings

I’ve watched “voluntary” harden into “mandatory” one compliant vendor at a time for thirty years. What bugs me is the precedent of access riding along with an otherwise reasonable safety review, without actually knowing what the safety standard is. Checking whether a model is dangerous and deciding who gets to buy it are different powers, and Altman is right to fight that line. My Bayesian read puts high odds on this becoming a standing requirement inside two years.

2. The EU Dropped a Cybersecurity-and-AI Action Plan With No New Law Behind It

The European Commission presented its Action Plan on Cybersecurity and Artificial Intelligence on July 7, 2026, a set of nine actions to make frontier AI safe for cyber defense and harden EU critical infrastructure (European Commission). The centerpiece is a European Blueprint, developed with the agency ENISA, that will give operators structured access to frontier AI for defense by the end of 2026. Digital chief Henna Virkkunen confirmed that the plan carries no new legislation, relying on existing rules such as NIS2 (The Record).

Why it matters

• Europe is admitting its cyber defense hinges on a few American labs.

• No new law means no new hard obligations yet, so the impact is direction and funding.

• The ENISA blueprint could hand European defenders frontier access US enterprises never see.

What to do about it

• If you operate in the EU, map which AI security dependencies run on US models.

• Watch the ENISA blueprint in Q4 and prepare teams to pilot the testing platform.

• Read the sovereignty push as a procurement signal and ask about EU data residency.

Rock’s Musings

Brussels loves answering hard problems with a framework and a press conference. The honesty is what surprised me, since Virkkunen said out loud that Europe cannot defend itself without American models. Skipping new legislation is the right call, since NIS2 and the Cyber Resilience Act already sit half-enforced. I put high odds on the testing platform slipping past its year-end target.

3. Illinois Signed the Toughest State AI Safety Law in the Country

Governor JB Pritzker signed SB 315, the Artificial Intelligence Safety Measures Act, in Chicago on July 6, 2026 (Capitol News Illinois). It targets developers with annual revenue above $500 million, requiring them to disclose how their frontier models pose catastrophic risk and to report critical safety incidents to the state within 72 hours. The headline provision is a first-in-the-nation requirement for annual independent third-party audits, with the rules taking effect January 1, 2028 (Chicago Sun-Times).

Why it matters

• Mandatory annual third-party audits shift frontier safety from self-attestation to a financial audit standard.

• The $500 million floor hits the labs you depend on, and compliance costs flow into your contracts.

• A 72-hour reporting clock mirrors breach-notification law, and other states will copy it.

What to do about it

• Ask frontier vendors how they’ll meet Illinois audit and reporting duties.

• Treat “catastrophic risk” disclosures as due diligence input into what a vendor thinks its model can do.

• Align internal AI governance to audit-ready evidence now, not in late 2027.

Rock’s Musings

Audits are the part of this law with teeth, and I say that as someone who’s sat through plenty of theater dressed up as assurance. A published safety framework is a document. An annual independent audit against it is accountability, because someone with technical chops checks whether the promises match the code, which is why the lobby fought that clause hardest. Illinois, California, and New York now account for roughly 40% of the US AI market among them, so this is a national floor, whether Washington likes it or not.

4. China Told Its Developers to Rip Out Claude Code Over a “Backdoor”

China’s National Vulnerability Database urged developers to uninstall recent Claude Code versions on July 8, 2026, flagging a “built-in monitoring mechanism” that gathers a user’s location and identity and forwards them to remote servers (The Register). Anthropic didn’t deny the code existed, calling it an experiment to stop reseller abuse and guard against distillation, and saying it had landed stronger mitigations since (CNBC).

Why it matters

• Undocumented telemetry in a developer tool is a supply-chain exposure regardless of intent.

• The dispute hands Chinese cloud vendors a clean reason to push domestic AI coding tools.

• “It was an anti-abuse experiment” is not a control your auditors accept.

What to do about it

• Inventory which Claude Code versions your developers run and confirm you’re past 2.1.196.

• Put egress monitoring on AI developer tooling, so you see what phones home.

• Add a contract clause requiring disclosure of client-side telemetry.

Rock’s Musings

A vendor shipped code that collected identity and location data, didn’t document it, and only discussed it once a foreign government went public. I read this as an engineer shipping an anti-distillation hack under deadline, not a spy tool for Beijing, but your threat model doesn’t care about intent. It cares about what data left the building, and almost none of you watch the egress.

5. Researchers Tricked GitHub’s Agent Into Leaking Private Repos With a Public Issue

Noma Security disclosed a flaw it named GitLost on July 7, 2026, in GitHub’s new Agentic Workflows, in which an unauthenticated attacker can get the AI agent to pull data from private repositories and leak it publicly (Noma Security). An attacker opens a GitHub issue in a public repo and hides plain-English instructions in the body, which the agent reads as trusted instructions and follows into the org’s private repos. Noma found that adding one polite word to the request flipped the model from refusal to compliance.

Why it matters

• Any content an agent reads can become an instruction, so issues and comments can turn into injection vectors.

• The attack needed zero credentials, so the exposure is every public repo you own.

• Prompt-based guardrails failed to a single word.

What to do about it

• Audit cases where you’ve granted agents access to both public and private repos in the same org.

• Require human approval before an agent reads issues and then touches private code.

• Enforce hard permission boundaries that the agent cannot talk its way past.

Rock’s Musings

This is the attack I keep warning boards about, and it keeps landing because everyone wants the productivity and nobody wants to price the risk. An agent that reads a public issue and acts on it inside your private code has no way to know the issue is lying. That’s the original sin of agentic design arriving on schedule. If your agent reads untrusted input and reaches sensitive systems in the same breath, you don’t have a security control; you have a demo. There’s a longer version of this argument at rockcybermusings.com.

6. Copilot Refused the Harmful Prompt in Chat, Then Wrote It Across a Workflow

Alan Turing Institute researchers Abhishek Kumar and Carsten Maple published work in early July 2026 on a bypass they call workflow-level jailbreak construction (The Register). Ask GitHub Copilot something harmful in chat, and it refuses almost every time, but break the same goal into small steps across a coding workflow, and it complies. Across four models from Anthropic and Google, direct chat requests produced harmful output 8 times out of 816, while the full workflow produced it 816 times out of 816 (Help Net Security).

Why it matters

• Every benchmark that scores a model on single prompts measures the wrong thing for coding agents.

• A 100% success rate across four frontier models is a structural gap, not an edge case.

• The attack looks like normal development, so code review won’t flag it.

What to do about it

• Push AI coding vendors to run safety evaluations across full multi-step sessions.

• Build detection around the whole session trajectory, not the last message.

• Keep humans in the loop for agent actions that touch production or secrets.

Rock’s Musings

The finding underneath the headline is the one worth holding. A model’s refusal in chat tells you almost nothing about its behavior in a real workflow, because the danger emerges from steps that each look fine on their own. Eight harmful outputs in chat against 816 in the workflow tells you the industry measures the wrong variable. Make your vendor show you the session-level results.

7. Google Pitched Its Own Federal AI Regulator Before Washington Builds One

Google published a white paper, “A pragmatic approach to AI governance in America,” on July 3, 2026, authored by its global-affairs chief Kent Walker (Google). The pitch is a federally overseen Frontier AI Regulatory Organization, FARO, that would set safety standards, define benchmarks for cyber and CBRN capabilities, and run annual independent audits of frontier developers. Google also argued that model training constitutes fair use and that infringement claims should target outputs rather than training inputs (Forbes).

Why it matters

• When the largest players draft the regulator, the rules tend to fit the incumbents.

• Annual audits keep surfacing across Illinois, Google’s proposal, and the EU plan.

• A copyright ask bundled into a safety paper trades a governance concession for a fair-use win.

What to do about it

• Read FARO as a preview of where federal oversight lands.

• Separate the safety proposal from the copyright ask when you brief executives.

• If you’re a smaller builder, model how a frontier-only regulator shifts your position.

Rock’s Musings

When a company this size volunteers to be regulated, read the fine print, because nobody hands the referee a whistle without also handing him the rulebook. The question is always who it binds and who it lets breathe, and a frontier-only regulator draws the line right below the incumbents’ moat. Then there’s the copyright move stapled to the safety pitch, the part your legal team should catch. Remember whose draft it is.

8. The UN Opened Its First Global Dialogue on AI Governance in Geneva

The first session of the UN Global Dialogue on AI Governance ran July 6 and 7, 2026, at the Palexpo center in Geneva, established by a UN General Assembly resolution and held alongside the ITU AI for Good Global Summit (UNESCO). Officials opened with warnings about catastrophic harm, and sessions covered agentic AI security, benchmarking, and deepfakes (UN News).

Why it matters

• A permanent UN venue signals fragmented national rules drifting toward some baseline of coordination.

• Agentic AI security made the agenda at the UN level, so agent risk is now a diplomatic concern.

• The gap between aspiration and enforceable rules stays wide.

What to do about it

• Track the dialogue’s themes as a leading indicator of where multinational regulation drifts.

• If you operate globally, expect more jurisdictions to borrow this language.

• Set your own agent-security baseline without waiting on consensus.

Rock’s Musings

I’ll be honest about what a UN dialogue is and isn’t. It’s a norm-setting exercise, not an enforcement mechanism, and anyone selling it as the thing that finally reins in AI is selling you optimism. Norms harden into rules, though, and the detail I caught is that agentic AI security made the frontier-challenges list at the UN level. Set your agent-security baseline now and let the diplomats catch up on their own clock.

9. Musk’s xAI Shipped Grok 4.5 With No Federal Hold, and That’s the Story

xAI, now branding itself as SpaceXAI, launched Grok 4.5 to the public on July 8, 2026, a 1.5-trillion-parameter model for coding and agentic tasks (US News). While the government held OpenAI’s GPT-5.6 for review and restricted foreign access to Anthropic’s Fable models, Grok 4.5 reached public release with no comparable hold, from the same lab whose image tools generated thousands of nonconsensual sexualized images at the turn of the year, including some depicting minors (Gizmodo).

Why it matters

• A voluntary federal review only works if the least careful vendor takes part, and Grok walked through the gap.

• You may deploy a 1.5-trillion-parameter agentic model from the vendor with the weakest demonstrated guardrails.

• Uneven scrutiny rewards the vendor that invests the least in safety with the fastest path to release.

What to do about it

• Run your own pre-deployment evaluation on Grok 4.5, weighted against the safety track record.

• Don’t read “cleared for public release” as “reviewed.”

• If you use Grok in agentic workflows, tighten permissions and monitoring.

Rock’s Musings

Here’s the paradox that should bother you. The two labs that invest most visibly in safety drew the government’s hand on the brake this week, and the lab that turned its image generator into a deepfake machine got waved through. The capability is real, but the guardrails are the open question, and Musk’s answer sits in the count of one abusive image every 41 seconds back in December. Run your own evaluation, because nobody in Washington ran it for you.

10. DigiCert Says 78% of Enterprises Already Ate an AI Security Incident

DigiCert released research on July 7, 2026, reporting that 78% of organizations experienced an AI-related security incident or identified an AI-related vulnerability, from a survey of 1,001 IT and security decision-makers across the US, UK, and Australia (DigiCert). Almost half lacked centralized visibility into their AI systems even as 75% deployed four or more AI-powered systems in the past six months. Ninety percent had discussed AI governance at the board level, yet only 50% backed it with a dedicated budget (SD Times).

Why it matters

• A 78% incident rate moves AI security from projected risk to realized loss.

• Half of enterprises deploying AI at scale can’t see their own AI footprint.

• Board talk without a dedicated budget is governance theater.

What to do about it

• Build a live inventory of every AI system and agent before you buy another tool.

• Convert board-level concern into a funded program with an owner.

• Prioritize the shadow AI your teams have already deployed over the theoretical risks of next year.

Rock’s Musings

Survey numbers earn a skeptical eye, and a vendor that sells digital trust, asking about trust problems, will find plenty of them. Discount the figure if you like; the shape still matches what I see inside real environments. Everyone bolted on four AI systems in six months; nobody built an inventory, and now they’re surprised that the attack surface has grown. What matters is the spread between the 90% of boards discussing governance and the 50% funding it, and closing that gap is the advisory work I do at RockCyber (rockcyber.com).

The One Thing You Won’t Hear About But You Need To

11. A New Preprint Names the Next Agent Attack Class, and It Isn’t Prompt Injection

A preprint posted to arXiv on July 6, 2026, “Agent Data Injection Attacks are Realistic Threats to AI Agents,” introduces an attack category its authors call agent data injection, or ADI (arXiv). Most agent-security research so far has focused on indirect prompt injection, hiding instructions in content the agent reads, but ADI goes a layer deeper. The attacker injects malicious data disguised as trusted data, such as resource-identifier metadata or tool-call formats, and the agent acts on it with no obvious instruction to flag it. The work is a preprint and hasn’t cleared peer review, so hold it as a well-argued hypothesis.

Why it matters

• Every agent defense built to separate instructions from data misses ADI.

• The attack rides the metadata and tool-call formats almost nobody inspects today.

• If it holds up, prompt-injection defenses solve half the problem.

What to do about it

• Extend your agent threat model past prompt injection to the data your agents ingest as ground truth.

• Ask agent-platform vendors how they validate the integrity of context data and tool responses.

• Treat data provenance inside agent pipelines as a control worth building now.

Rock’s Musings

This is why I read preprints nobody’s posting about. Right as the field’s prompt-injection defenses matured, here’s a paper pointing at the data itself, which is the natural next move once an attacker can’t smuggle in a command. I hold this as a probability, not a certainty, since it’s one preprint and real-world exploitation isn’t demonstrated at scale. Start building provenance controls while this is still a paper and not an incident report.

👉 For ongoing analysis of agentic AI governance frameworks, the conversation continues at RockCyber Musings.

👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.

👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com

👉 As a bonus, check our AMA on the 2026 OWASP GenAI Security Project State of Agentic AI Security and Governance report with me and the other co-leads (it was live, so start at time marker 09:45)

The views and opinions expressed in RockCyber Musings are my own and do not represent the positions of my employer or any organization I’m affiliated with.

Share RockCyber Musings

References

Capitol News Illinois. (2026, July 6). Pritzker signs landmark AI regulation bill that aims to mitigate risks. https://capitolnewsillinois.com/news/pritzker-signs-landmark-ai-regulation-bill-that-aims-to-mitigate-risks/

DigiCert. (2026, July 7). Latest DigiCert research shows AI security risks already hitting enterprises, with 78% reporting incidents. https://www.digicert.com/news/latest-digicert-research-shows-ai-security-risks-already-hitting-enterprises-with-78-Reporting-Incidents

European Commission. (2026, July 7). Commission presents EU action plan on cybersecurity and artificial intelligence. Shaping Europe’s Digital Future. https://digital-strategy.ec.europa.eu/en/news/commission-presents-eu-action-plan-cybersecurity-and-artificial-intelligence

Forbes. (2026, July 7). Diving headfirst into the Google newly released ‘AI governance in America’ framework. https://www.forbes.com/sites/lanceeliot/2026/07/07/diving-headfirst-into-the-google-newly-released-ai-governance-in-america-framework/

Google. (2026, July 3). A pragmatic approach to AI governance in America [White paper]. The Keyword. https://blog.google/company-news/outreach-and-initiatives/public-policy/white-paper-ai-regulation/

Kumar, A., & Maple, C. (2026, July). Refused in chat, written in code: Workflow-level jailbreak construction in IDE coding agents [Preprint]. arXiv. https://arxiv.org/abs/2607.03968

Noma Security. (2026, July 7). GitLost: How we tricked GitHub’s AI agent into leaking private repos. https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos/

Novet, J. (2026, July 8). China warns about AI risks with Anthropic’s Claude Code. CNBC. https://www.cnbc.com/2026/07/08/china-anthropic-ai-claude-code-backdoor-security-threat.html

Osborne, C. (2026, July 9). Your coding agent says no in chat and yes in the code. Help Net Security. https://www.helpnetsecurity.com/2026/07/09/github-coding-agent-jailbreak/

Quach, K. (2026, July 8). China tells devs to ditch Claude Code over ‘backdoor code’ fears. The Register. https://www.theregister.com/security/2026/07/08/china-ditch-older-claude-versions-with-backdoor-code/

Reuters. (2026, July 8). SpaceXAI launches Grok 4.5 model for coding, agentic tasks. U.S. News & World Report. https://money.usnews.com/investing/news/articles/2026-07-08/spacexai-launches-grok-4-5-model-for-coding-agentic-tasks

Roth, E. (2026, June 26). OpenAI limits GPT-5.6 rollout after government request, says restrictions shouldn’t be the norm. TechCrunch. https://techcrunch.com/2026/06/26/openai-limits-gpt-5-6-rollout-after-government-request-says-restrictions-shouldnt-be-the-norm/

Seok, J., et al. (2026, July 6). Agent data injection attacks are realistic threats to AI agents [Preprint]. arXiv. https://arxiv.org/abs/2607.05120

The Hill. (2026, July 8). OpenAI announces GPT-5.6 release after Donald Trump delay. https://thehill.com/policy/technology/5958647-openai-releases-gpt56-trump/

The Record. (2026, July 7). EU unveils cyber plan to reduce reliance on foreign AI systems. Recorded Future News. https://therecord.media/eu-unveils-cyber-plan-to-reduce-reliance-on-foreign-ai

UNESCO. (2026, July 6). Global Dialogue on AI Governance, Geneva, 6-7 July. https://www.unesco.org/en/articles/global-dialogue-ai-governance-geneva-6-7-july

United Nations. (2026, July 6). Global push for AI governance amid warnings of ‘catastrophic harm’. UN News. https://news.un.org/en/story/2026/07/1167862

The new enterprise MCP spec ships July 28, and MCP authorization scope is the one control it left out. The security press read the release as a fix and pointed to token binding, a stateless core, and credential-issuer checks. All of that is great work, but what should stop you cold in your tracks is that a connection-layer defense running a human approval on every single call still let 6 of 10 modeled attacks through. I’ll show you where that hole lives and what to do about it before your next agent rollout.

Share

What the New Spec Got Right

Give the maintainers their due. The Model Context Protocol started life in 2024 as a way to wire a local model to a few tools on your laptop, and it grew into the default connector for agents talking to business systems. The 2026-07-28 revision is the biggest rewrite since MCP’s launch, and legacy versions will get a 12-month deprecation window. That is a serious, well-run standards effort, and I won’t pretend otherwise.

The headline change is that MCP goes stateless at the protocol layer. Sessions are gone. Any server instance can answer any request, which kills a whole class of session-hijacking problems that came from sticky sessions and shared session stores. On the auth side, six specification enhancement proposals (SEPs) harden how MCP rides on OAuth 2.1 and OpenID Connect. Clients validate the issuer on every authorization response per RFC 9207, which shuts down the mix-up attack in which one authorization server’s response gets replayed against another. Registered credentials bind to the authorization server that issued them. Tokens carry an audience, so a server can reject a token minted for somewhere else.

Audience-bound tokens aren’t new to this release. Resource indicators landed in the June 2025 spec under RFC 8707. This revision hardens that work rather than inventing it. If a vendor tells you server-bound tokens are the shiny new 2026 feature in the enterprise MCP specification, they either didn’t read the changelog or they’re hoping you didn’t. The front door is stronger than it was, and I give the maintainers full credit for the authentication story.

What It Opened, and Onto Whom

When the protocol stops enforcing something, that something doesn’t vanish. It moves to whoever builds the server. Maxim Zavodchik, who runs threat research at Akamai and co-wrote the sharpest analysis of the release, put it plainly. With the protocol going stateless and adding rich UIs and async tasks, the critical security boundaries now hang entirely on how developers build them. His team’s read is that the update improves the foundation by removing old protocol-level risks, and from there the build choices decide your security posture.

Walk through what that hands you. The stateless model replaces sessions with tracking identifiers the server hands the client. Make those identifiers predictable and you have opened the door to workflow hijacking and cross-tenant access. The new MCP-specific HTTP headers carry method and tool names for routing. Map a secret into one of those headers by accident, an API key or a token or a piece of PII, and it rides straight into every load balancer, proxy, and log along the path. MCP Apps let a server render interactive HTML in the client, which is a genuine user-experience win and also drags stored cross-site scripting into a place it never used to live. Long-running tasks are cheap for the client to start and expensive for the server to hold, which is a denial-of-service vector wearing a feature’s clothing.

The spec also deprecates roots, the capability a host used to declare which files and folders a server could touch. Nothing breaks yet. The deprecation is annotation-only with a year-plus runway. The direction is set, and the one host-declared boundary every server had to respect turns into guidance you handle through per-tool settings and server config. That is one more control moving from protocol-guaranteed to build-it-yourself.

None of this means the protocol got less secure. The attack surface of the servers your teams build on top of it got wider. That distinction matters, because it tells you where to point your budget. Not at the spec. At your own server code and the vendors shipping it to you.

Tool Poisoning Is the Tell

If you want to see why authorization scope is the whole game, look at MCP tool poisoning. A tool description isn’t documentation. The model reads it, trusts it, and acts on it. That makes the description an input the attacker controls, sitting inside your trust boundary. Microsoft’s security team framed it well in their 2026 checkpoint on the state of MCP security. Once a model picks its own tools and calls them, it has stopped returning text and started running actions on your systems, and code that acts sits inside a trust boundary.

Researchers demonstrated this with ShareLock, an attack that splits a malicious instruction into benign-looking pieces, scatters them across several tool descriptions, and reassembles them at run time after a quiet trigger planted during a server update. Tested across mainstream models on two MCP clients, it held an average attack success rate above 90% while sliding past the tool-description review that most guidance tells you to run. Read that number again. The control everyone recommends, inspect the description before you approve the server, gets beaten better than nine times in ten.

Scope enforcement doesn’t stop tool poisoning. A poisoned tool with tight scope is still poisoned. What scope decides is how far the damage travels once a tool goes rogue. Poisoning is the match. Missing scope is the pile of dry timber you stacked next to it. You won’t prevent every poisoned description. You get to decide whether a compromised tool can read one support ticket or drain your secrets store.

MCP Authorization Scope Is the Gap the Spec Won’t Name

Now, I also think there is a big miss in the updated spec. The spec tells a server which client is calling and which issuer vouched for it, but it never specifies what that tool is allowed to do once the call is authenticated. Those are different questions, and the second one is where agent incidents start. By scope, I mean what a tool may do at run time, on each call, not which server minted the token.

The authorization section says so itself. Authorization in MCP is optional. It lives at the transport level through OAuth. The spec states outright that the authorization server details are “beyond the scope of this specification,” and it leaves the scope values to whoever builds the thing. Someone will point at incremental scope consent and say scope is handled. Step-up consent decides what a user approves at login. It does nothing about what the tool does on call number 500 an hour later, with no human watching. The six authorization SEPs I praised earlier are all about the handshake. Issuer validation, credential binding, step-up consent at login time. Not one defines a per-tool capability that the server has to check on every invocation, or a deny it has to be able to produce. Even the roadmap items on the horizon, proof-of-possession and workload identity federation, bind identity more tightly. They don’t bound what a tool may do.

Someone benchmarked this exact gap, and it produced the number from my intro. A June 2026 study of MCP-style runtimes built 10 attack cases and tested 3 defenses. A naive connection-layer runtime let all ten through. A practice-informed connection-layer defense, the kind you would build today with metadata linting, session checks, and human approval on every call, blocked four and let six through. A runtime that enforced scope as an explicit execution-time invariant blocked all ten. The controls the new spec leans on live in that middle column. They beat nothing. They don’t close the gap.

You don’t need a lab to see it. In June 2025, attackers fed a Supabase agent support tickets loaded with instructions. The agent held privileged service-role access, and it handed over integration tokens. The privilege is what made the theft possible. An agent scoped to read the support queue and nothing else never holds the credentials to give away. That incident is the whole thesis in one sentence. Authentication was fine. Scope is what would have saved them.

The gateway crowd hits the same wall. WorkOS, which runs an OAuth server for MCP and has no reason to talk the spec down, flagged that when a request passes through a gateway, the protocol says nothing about how the downstream server learns what the original client was allowed to do. Their word for it was silent. The protocol goes silent exactly where your data-loss prevention and your policy enforcement need it to speak.

Governance as Architecture

None of this makes the maintainers wrong. They said in the March roadmap that deeper security and authorization work sits in the “on the horizon” pile, not in this cycle’s top four. I will take an honest roadmap over a vendor pretending the problem is solved any day of the week. Give Anthropic and the MCP maintainers real credit for putting the deferral in writing, so you can plan around it. The counter you will hear is that a protocol shouldn’t dictate authorization policy. Fair. Then say that in the spec, and hand implementers a scope primitive instead of silence. Silence is how you get a hundred incompatible answers.

The problem is architectural. OAuth 2.0 standardized the handshake and left the scope values to whoever built the authorization server. The strings were implementer-defined by design. We then spent the better part of a decade cleaning up overbroad grants, scopes that meant different things at different providers, and tokens that could do far more than anyone intended. A protocol that nails authentication and punts authorization doesn’t remove the authorization problem. It guarantees a hundred teams solve it a hundred ways, and your incident response inherits the mess. Your SOC can’t write one detection that holds across servers when every server means something different by “allowed.” MCP is running the same play. You can see the ending from here.

Encode scope where it belongs, at run time, and stop treating it as a connection-time checkbox. Here is the CARE version you can start tomorrow.

Create the inventory first. You can’t scope what you can’t see, so list every MCP deployment and every tool each server exposes, including the ones a team wired up last quarter without telling you. Adapt each tool to a runtime scope. Can it read, can it write, can it act, and against which resource? A tool that reads a support queue and a tool that moves money don’t get the same grant. Run the test that matters, which is the deny. Make every vendor and every internal team show you a blocked over-scope call in the logs, with the decision and the audit record attached. If they can only show you a successful call, they proved authentication and told you nothing about authorization. Evolve it on a cycle. Scope drifts as tools get added, so this belongs in your quarterly review next to access recertification, not in a one-time project that rots on a wiki.

Ask every vendor you encounter, “Where is authorization scope enforced, and can you show me the deny?” If the answer is a diagram of the OAuth flow, they answered a different question. Keep asking until someone shows you the runtime decision or admits there isn’t one.

Key Takeaway: MCP authorization scope is a runtime decision your servers have to make and prove on every call, and until the spec forces it, the deny is yours to build and yours to demand.

What to Do Next

Start the inventory and the deny test this week, before the July 28 final spec turns every enterprise MCP rollout into a live deployment you are accountable for. Run the CARE loop against your agent fleet and put scope on the same review cadence as identity. For the deeper argument on why a tool description is an attacker-controlled input rather than documentation, I have written about treating the model as an actor instead of a component over at rockcybermusings.com, and about why least agency beats least privilege once tools can act at rockcyber.com. If you read my earlier breakdown of the NSA MCP design guidance, this is the same authorization gap, one spec revision later.

👉 For ongoing analysis of agentic AI governance frameworks, the conversation continues at RockCyber Musings.

👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.

👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com

👉 As a bonus, check out my conversation with AI Cyber Magazine, where we talked about everything from Context Rot to Least Agency. My interview is also highlighted in the AI Cyber Magazine 2026 Summer Issue.

The views and opinions expressed in RockCyber Musings are my own and do not represent the positions of my employer or any organization I’m affiliated with.

Share RockCyber Musings

A jailbreak taught a frontier model to write exploit code, so Washington pulled it off the global market, then handed it back nine days later. Browsers that act on your behalf got caught tearing down a web safety boundary that held since the 1990s. A 30-day federal deadline for AI cyber defense expired with more mandate than proof. State laws switched on, and surveys showed most enterprises will trade your data security for a little speed.

This was the week the gap between what AI does and what we control got measured out loud. Everything below originated between June 26 and July 2, 2026, and where the record is thin, I say so. This is the board-level triage I run each week at RockCyber, with longer arguments at RockCyber Musings.

Share

1. Washington Pulled Anthropic’s Top Models, Then Restored Them After a Jailbreak Wrote Exploit Code

The U.S. Department of Commerce lifted export controls on Anthropic’s Claude Fable 5 and Mythos 5, and Anthropic restored global access to Fable 5 on July 1, 2026 (Al Jazeera). The administration had forced the company to cut both models a month earlier, after an Amazon jailbreak finding pushed Fable 5 to write working exploit code (Forbes). Anthropic’s fix is a classifier that blocks the technique in more than 99% of attempts.

Why it matters

• One jailbreak moved a frontier model to export-controlled munition in days.

• “More than 99%” blocking on a model that writes exploits is a floor, not a guarantee.

• Foreign access now hinges on a classified review you cannot audit.

What to do about it

• Add regulatory availability to your vendor risk register.

• Ask your labs, in writing, for their jailbreak detection and reroute behavior.

• Build a fallback path for workflows tied to a single frontier model.

Rock’s Musings

I won’t pretend 99% blocking on a model that writes exploit code equals safe. At scale, 1% of a very large number is a business, and the people probing these systems run very large numbers. The part that should worry you is that the whole control regime now rests on a review nobody outside a classified room gets to inspect.

2. A University Study Showed Agentic Browsers Breaking the Web’s Oldest Safety Rule

University of Washington researchers published a study on June 30, 2026, finding that several agentic AI browsers weaken the same-origin policy, the boundary that stops one site from reading another’s data (UW News). Of seven browsers tested, four created conditions for cross-site data theft: ChatGPT Atlas, Chrome with Gemini, Claude for Chrome, and Perplexity Comet. The team built a working proof-of-concept against Atlas, and the browsers that gave agents fewer permissions ranked safer (The AI Insider).

Why it matters

• Same-origin policy is load-bearing, and an agent routing around it turns every iframe into an exfiltration path.

• These are shipping consumer products, and your people paste corporate data into them now.

• The safest option tested was the least useful, so vendors ship capability ahead of containment.

What to do about it

• Inventory which agentic browsers run on managed endpoints this week.

• Bar any agentic browser from regulated data until you test its permission model.

• Add cross-origin agent behavior to your next red-team scope.

Rock’s Musings

We spent twenty-five years hardening the browser into something you could almost trust, and the agentic crowd tore a hole in it for a demo. Bolt autonomy onto a system built for a human in the loop, and the old safety assumptions quietly stop holding. If your strategy assumed the browser respects origin boundaries, rewrite it before you write the incident report.

3. The Federal AI Cyber Deadline Expired With More Mandate Than Proof

The 30-day clock in the June 2, 2026 executive order on AI innovation and security ran out on July 2, 2026 (Forward Networks). The order directed CISA to release Binding Operational Directives for civilian cyber defense and pushed AI-enabled defensive tools out to critical infrastructure operators like rural hospitals and community banks (Holland & Knight). It also let developers of “covered frontier models” give the government pre-release access for up to 30 days of review. As the deadline passed, public confirmation of the deliverables stayed thin.

Why it matters

• Federal deadlines set the tempo for the contractor base, so these requirements become yours next quarter.

• Pre-release model access normalizes an inspection regime that will shape procurement language.

• A clear directive with unclear deliverables is a governance smell.

What to do about it

• If you hold federal contracts, ask which directives apply and by when.

• Map the order’s AI cyber requirements against your current controls now.

• Track CISA’s directive page directly rather than trusting summaries.

Rock’s Musings

I have sat on the receiving end of enough executive orders to know the pattern: the signing gets the headline, the deadline gets the press release, and the real work shows up late and quietly, if at all. A directive is a promise, and a promise is not a control. Watch the frontier model access provision, because “voluntary” federal review of pre-release models has a way of becoming the price of doing business, and I put the odds that these deliverables will land on time below even.

4. DHS Revived Critical Infrastructure Threat Sharing, Minus the Legal Shield

DHS moved to launch ANCHOR-CI, a CISA-managed program to restart critical infrastructure information sharing, with a Federal Register notice set for July 1, 2026 (CyberScoop). It revives a function that went dark for a year after DHS shuttered its predecessor, the Critical Infrastructure Partnership Advisory Council. The catch is real: the new program drops the CIPAC liability protections that let companies share sensitive information without fear of regulatory exposure (Cybersecurity Dive).

Why it matters

• Sharing works only when operators trust that candor will not be used against them.

• The year-long gap hit energy, water, and manufacturing hardest, the sectors facing the most AI-accelerated targeting.

• DHS exempted ANCHOR-CI from the Federal Advisory Committee Act, so transparency into its work is limited by design.

What to do about it

• If you run OT or critical infrastructure, evaluate participation with counsel present.

• Keep your existing ISAC relationships rather than letting the federal restart replace trusted channels.

• Document what you share and under what protection, since the blanket comfort is gone.

Rock’s Musings

I ran security in the energy sector, so this lands close to home. Threat sharing in critical infrastructure always ran on a simple bargain: you tell the government what hit you, and that admission does not come back as a fine. ANCHOR-CI keeps the forum and quietly removes the bargain, and many general counsels will read that fine print and tell their teams to say less, exactly when adversaries are wiring AI into reconnaissance against pipelines and water systems. Restoring the function is good, but doing it without the liability shield is a self-inflicted wound.

5. Tennessee’s AI Mental Health Law Switched On, and It Won’t Be the Last

Tennessee’s SB 1580 took effect on July 1, 2026, barring anyone who develops or deploys an AI system from advertising or representing that it is, or acts as, a qualified mental health professional (Healthcare Law Insights). Violations count as unfair or deceptive acts under the state’s Consumer Protection Act, carry civil penalties up to $5,000 per violation, and give affected individuals a private right of action (Troutman Pepper Locke).

Why it matters

• A private right of action means enforcement does not wait on a regulator.

• Rhode Island, Missouri, Nevada, Illinois, and Utah have all moved, with varied definitions building a compliance maze.

• The same wellness chatbot is now legal in one state and a deceptive act in another.

What to do about it

• Audit marketing and system prompts for any claim implying clinical capability, and pull it where prohibited.

• Map your chatbot’s availability by state, since “one national product” is no longer safe.

• Give legal a standing role in prompt and positioning reviews.

Rock’s Musings

The move that matters here is the private right of action, which turns every user into a potential enforcer and hands the plaintiffs’ bar a clean theory. Companies shrug off regulatory risk because agencies are slow, then get flattened by suits they never modeled. Build state-by-state logic into your product now, or explain to a jury later why the bot called itself a therapist.

6. Defense Contractors Told a Survey They Expect an AI Attack and Can’t Detect It

A Secureframe survey of 850 defense contractors and federal suppliers, reported July 1, 2026, found that 85% expect AI-powered attacks and deepfake social engineering within two years, while only 28% were fully confident they could detect a nation-state threat (Corporate Compliance Insights). Some 27% had a supply chain compromise in the past year, yet only 13% produce a software bill of materials, and 22% still cannot say where their controlled unclassified information lives.

Why it matters

• The defense industrial base is where adversaries aim first, and this cohort expects the punch and cannot see it.

• A 27% breach rate against a 13% SBOM rate measures the gap between exposure and basic hygiene.

• If a fifth of suppliers cannot locate their CUI, no AI tool fixes the underlying inventory problem.

What to do about it

• Start with data inventory, not AI defense. You cannot protect what you cannot locate.

• Stand up an SBOM program if you are in the 87% who don't have one.

• Test your deepfake social engineering resistance with a live exercise.

Rock’s Musings

The contradiction here is the tell: this group expects an AI-driven attack, admits it cannot detect one, and reports that most skip the fundamentals that would help. SBOMs are not exciting and knowing where your CUI lives is not a keynote topic, which is exactly why they get deferred and exactly why adversaries count on it. Buy the basics before the platform, or you are adding sensors to a house with the windows open.

7. Anthropic Shipped a Science Workbench Built Around Auditable Output

Anthropic launched Claude Science, a beta research workbench, on June 30, 2026 (Anthropic). The app bundles more than 60 scientific databases and exposes a coordinating agent that spins up specialist sub-agents. The design choice worth your attention is provenance: every output carries an auditable history, and a separate reviewer agent checks citations and calculations before results land (HPCwire).

Why it matters

• Auditable-by-default output is the governance pattern every serious AI deployment needs.

• A reviewer agent that checks citations and math is a structural answer to hallucinations, not a disclaimer.

• Agentic research in genomics and cheminformatics carries dual-use weight, and auditability helps oversight too.

What to do about it

• Steal the pattern. Require provenance and an independent review step in any agentic tool you buy.

• Treat any agentic system touching life sciences data as dual-use, with human signoff on sensitive output.

• Ask your vendors whether their output is reproducible and auditable, then compare.

Rock’s Musings

I am hard on product launches because most write checks they can’t cash. This one earned a second look, because provenance and a reviewer agent built into the architecture is the right instinct and it is rare. The shadow is dual-use because a workbench that accelerates real biology accelerates it for everyone who gets in, which is why the auditable trail matters as much for oversight as for reproducibility.

8. Ireland Took the EU Wheel as the August GPAI Enforcement Date Closes In

Ireland assumed the rotating presidency of the Council of the European Union on July 1, 2026, with a program naming cloud and artificial intelligence as priorities (CDT Europe). The timing matters because the EU AI Act’s enforcement powers over general-purpose AI providers arrive on August 2, 2026, the point at which the Commission can issue information requests, demand model access, and pursue recalls. In the run-up, the Commission seated its Scientific Panel and Advisory Forum and published its final code on marking and labeling AI-generated content (artificialintelligenceact.eu).

Why it matters

• August 2 is when EU GPAI obligations gain teeth, with a major tech-hub government in the chair.

• The Scientific Panel and labeling code are the scaffolding regulators will point to at enforcement.

• Any provider serving the EU needs its documentation, transparency, and copyright posture ready now.

What to do about it

• Confirm your model documentation and training-data summaries meet the code by August 2.

• Watch the Dublin summit agenda for signals on how aggressively the Commission plans to act.

• Align your content provenance approach with the EU labeling code.

Rock’s Musings

Everyone treats August 2 as a cliff, but enforcement machinery does not switch from zero to raids overnight. It warms up, and this week is the warm-up. Ireland in the chair is quietly significant, because a country hosting half the industry’s European headquarters now sets the tempo as enforcement goes live, so if your documentation is not ready, you have weeks, not months.

9. ISC2 Added AI Incident Rooms to Its Security Congress, Which Tells You Something

ISC2 confirmed it will add AI Incident Rooms and hands-on tabletop exercises to its 2026 Security Congress, reported July 1, 2026 (Hipther). The framing is blunt: the cybersecurity workforce needs practice responding to AI-driven incidents, not more theory. Earlier ISC2 research found only about 30% of cyber professionals had integrated AI security tools (ISC2).

Why it matters

• The people who certify the workforce are telling you it cannot yet handle an AI-driven incident.

• Tabletop practice is the cheapest control you have for a class of incident nobody has repped.

• If the professional body is scrambling to build these reps, your team has not done them either.

What to do about it

• Run an AI-incident tabletop this quarter. Try a prompt-injected agent exfiltrating data.

• Include legal, comms, and a business owner, because an agentic incident crosses functions.

• Write down where your runbooks break under an AI scenario and fix those first.

Rock’s Musings

The professionals we rely on have not repped these AI scenarios, because the scenarios are new and the tools are half-adopted. This gap is cheap to close, and a tabletop costs you a room and a few hours, so do not wait for the conference.

10. California Pushed Its AI Standards and Safety Commission Forward

California’s SB 813, a bill to establish a state AI Standards and Safety Commission, advanced with an Assembly Privacy and Consumer Protection Committee hearing scheduled for July 1, 2026 (Transparency Coalition). The measure, revived from 2025, cleared the full Senate 31 to 7 in January and was amended and re-referred through the Assembly (LegiScan). It sits inside a crowded docket where roughly 30 AI bills crossed over between chambers before summer recess, covering chatbot safety, worker protections, and deepfakes.

Why it matters

• A standing commission shifts the state from episodic laws to continuous standard-setting, and California standards become national defaults.

• The volume of California AI bills means the compliance target moves weekly.

• A state safety commission creates a new regulator to answer to, on top of federal and EU regimes.

What to do about it

• Track SB 813 if you operate in California, because a commission outlasts any single bill.

• Map your California AI exposure across the roughly 30 bills in motion.

• Build your governance to a standard-setting body’s expectations.

Rock’s Musings

California legislating AI one bill at a time has produced a thicket nobody can hold in their head. SB 813 tries to fix that with a standing commission, which could bring coherence or become another slow regulator a generation behind the technology. California sets the floor for the country, so if you sell anywhere in the U.S., these standards become yours by gravity.

The One Thing You Won’t Hear About But You Need To

Most enterprises are now knowingly trading your data security for AI speed, and they are saying so out loud.

A Redgate Software survey of 2,150 global IT professionals, reported July 1, 2026, found 58% of enterprises explicitly accept higher data security risks in exchange for efficiency gains (Corporate Compliance Insights). This is not accidental exposure or a control that failed, it is a deliberate choice, stated on the record. The same survey found AI adoption in database management nearly tripled since 2025, while only 23% of adopters have formal data governance (Redgate Software).

Why it matters

• A stated willingness to accept security risk for speed is a cultural signal, and culture beats policy.

• Tripling AI in the data layer while 77% lack formal governance is unpriced risk stacking up fast.

• “We accepted the risk for efficiency” is the sentence your counsel reads back in a deposition.

What to do about it

• Find out whether your organization made this trade implicitly, then make it explicit and name the owner.

• Attach data governance to AI database adoption as a gate, not a follow-up.

• Quantify the accepted risk in dollars, so the trade-off is a board decision.

Rock’s Musings

This is the story that will not trend, and it is the one I would put in front of your board tomorrow. While everyone is transfixed by frontier model drama and browser exploits, a majority of enterprises just admitted they will trade your security for a little speed. Tripling AI in your database layer with no formal governance just piles unpriced risk onto a balance sheet nobody is reading. Price the risk, name the owner, and stop pretending speed is free, because that is the work I do with executive teams at RockCyber.

👉 For ongoing analysis of agentic AI governance frameworks, the conversation continues at RockCyber Musings.

👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.

👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com

👉 As a bonus, check out my conversation with AI Cyber Magazine, where we talked about everything from Context Rot to Least Agency. My interview is also highlighted in the AI Cyber Magazine 2026 Summer Issue.

The views and opinions expressed in RockCyber Musings are my own and do not represent the positions of my employer or any organization I’m affiliated with.

Share RockCyber Musings

References

Al Jazeera. (2026, July 1). US lifts restrictions on Anthropic’s powerful AI models Fable and Mythos. https://www.aljazeera.com/economy/2026/7/1/us-lifts-restrictions-on-powerful-ai-models-fable-mythos-anthropic-says

Anthropic. (2026, June 30). Claude Science, an AI workbench for scientists. https://www.anthropic.com/news/claude-science-ai-workbench

artificialintelligenceact.eu. (2026). Implementation timeline. https://artificialintelligenceact.eu/implementation-timeline/

Center for Democracy and Technology. (2026, June). CDT Europe’s AI Bulletin: June 2026. https://cdt.org/insights/cdt-europes-ai-bulletin-june-2026/

Corporate Compliance Insights. (2026, July 1). Most DIB firms fear AI-powered cyber attack. https://www.corporatecomplianceinsights.com/news-roundup-july-1-2026/

Cybersecurity Dive. (2026). DHS prepares replacement for critical infrastructure collaboration framework. https://www.cybersecuritydive.com/news/dhs-critical-infrastructure-collaboration-cipac-anchor/809748/

CyberScoop. (2026). DHS to launch replacement council for critical infrastructure cybersecurity. https://cyberscoop.com/dhs-anchor-ci-cybersecurity-information-sharing/

Forbes. (2026, July 1). White House lifts restrictions on Anthropic’s Mythos and Fable AI models. https://www.forbes.com/sites/siladityaray/2026/07/01/trump-administration-lifts-export-controls-on-anthropics-mythos-5-and-fable-5-ai-models/

Forward Networks. (2026, June 29). Executive Order 14409 starts a 30-day clock on federal cyber defense. https://www.forwardnetworks.com/blog/2026/06/29/executive-order-14409-starts-a-30-day-clock-on-federal-cyber-defense/

Healthcare Law Insights. (2026, April). Tennessee draws a line: New law bars AI from posing as mental health professionals. https://www.healthcarelawinsights.com/2026/04/tennessee-draws-a-line-new-law-bars-ai-from-posing-as-mental-health-professionals/

Hipther. (2026, July 1). Cybersecurity roundup: Partnerships, funding, and emerging threats, July 1, 2026. https://hipther.com/latest-news/2026/07/01/114421/cybersecurity-roundup-partnerships-funding-and-emerging-threats-july-1-2026-dhs-anchor-ci-azure-cli-password-spray-agentic-ai-browsers-cisco-data-center-security-isc2-ai-incident-r/

Holland & Knight. (2026, June). Executive order on artificial intelligence expands cybersecurity, federal oversight. https://www.hklaw.com/en/insights/publications/2026/06/executive-order-on-artificial-intelligence-expands-cybersecurity

HPCwire. (2026, June 30). Anthropic launches Claude Science AI workbench for scientific research. https://www.hpcwire.com/aiwire/2026/06/30/anthropic-launches-claude-science-ai-workbench-for-scientific-research/

ISC2. (2025, July). ISC2 research reveals cybersecurity teams are taking a cautious approach to AI adoption. https://www.isc2.org/Insights/2025/07/ISC2-Research-Cybersecurity-Teams-Cautious-on-AI-Adoption

LegiScan. (2026). California SB 813 (2025–2026 session). https://legiscan.com/CA/bill/SB813/2025

The AI Insider. (2026, June 30). University of Washington study finds major security flaws in AI browser agents. https://theaiinsider.tech/2026/06/30/university-of-washington-study-finds-major-security-flaws-in-ai-browser-agents/

Transparency Coalition. (2026, June 26). AI legislative update: June 26, 2026. https://www.transparencycoalition.ai/news/ai-legislative-update-june26-2026

Troutman Pepper Locke. (2026, April). Tennessee enacts health care AI bill with private right of action. https://www.troutmanprivacy.com/2026/04/tennessee-enacts-health-care-ai-bill-with-private-right-of-action/

University of Washington News. (2026, June 30). Some agentic AI browsers come with major cybersecurity risks, UW study finds. https://www.washington.edu/news/2026/06/30/some-agentic-ai-browsers-come-with-major-cybersecurity-risks-uw-study-finds/

Frontier AI model release restrictions aren’t a fluke anymore. June 26th, the government had OpenAI lock its new GPT-5.6 model to about 20 companies it picked by hand, one approval at a time, two weeks after it forced Anthropic’s Fable and Mythos to go dark. That is two model blackouts in 14 days on the same cyber excuse. You now run your AI stack on a permission slip that government bureaucrats who can barely spell “AI” can pull without telling you why. This issue shows you what that costs and what to do about it.

Share

The Move, And Why It’s A Pattern

Last week, I told you a single letter swung a wrecking ball at a thumbtack and knocked two of the best models on earth offline before most of us finished happy hour. I called it “the move.” I had it wrong. It was the opening rep because on June 26, the same wrecking ball came around again and caught OpenAI flush.

GPT-5.6 went out to roughly 20 companies the government hand-picked, through the API and the Codex tool, never ChatGPT. The administration cleared access for one customer at a time, like a bouncer working a velvet rope nobody elected him to run. Axios called it the first time the US government preemptively restricted a domestic AI model before release. Sam Altman had walked it through with Commerce Secretary Howard Lutnick two days earlier, after the White House Office of the National Cyber Director and the Office of Science and Technology Policy asked for the TL;DR.

OpenAI complied and objected in the same breath, in writing. The company said it doesn’t believe “this kind of government access process should become the long-term default.” Read that again. The lab building the model and the lab the government blacked out two weeks earlier now stand on the same square, saying the same thing, and the government still has a hand on the switch.

One blackout is an accident. Two of them, 14 days apart, on the same cyber rationale, are policies nobody passed. The executive order signed on June 2 promised, on paper, that this would remain voluntary. Twenty-four days later, the voluntary program was rubber-stamping customers one at a time.

Before I take a bat to this, I conceded that Frontier cyber models are dangerous. Testing a product before it ships is ordinary, and we do it to jet engines and drugs. Russell Brandom made the honest point that these capabilities now carry political weight, and containing them requires collective action that binds every lab or none. Dean Ball, who is no AI dove, calls the underlying security worry legitimate and serious. Take all of it as given. The fight was never about whether to review a model for danger. The fight is about a government gate with no published standard, with nobody qualified staring at it, swung at a capability that mostly helps defenders and already sits everywhere. A real safety regime hands you a standard and measures you against it. This one measures you against a standard that has never been written.

A License With No License

The executive order forbids, on paper, exactly what the government is doing in practice. Section 3 says nothing authorizing a “mandatory governmental licensing, preclearance, or permitting requirement” for releasing an AI model. The same order then hands the government a hand in choosing which partners get early access, with not one single criterion written down. Run that one customer at a time, and you have built a licensing regime. The administration refuses to call it one, which changes nothing.

Dean Ball named it a “de facto involuntary licensing regime” the day the order landed. He is also joining OpenAI, so weigh him accordingly. His core claim survives the conflict. Nobody knows what clears a model, and he means NOBODY. By his account, the administration itself can’t tell you what standard a company would have to meet to make it comfortable releasing a model with Mythos-level reach. A lab asks whether it can ship to the public. The answer is no. It stays no until somebody writes a standard that doesn’t exist.

A discretionary regime is worth exactly as much as the judgment of the people running it. Look at who that is. The administration hired one person to run the Center for AI Standards and Innovation, someone who had worked inside both OpenAI and Anthropic. Senior officials fired him within days. They parked the rest of the staff on a stop-work order through the worst of the post-Mythos scramble and barred them from talking to other agencies. Ball, who sat inside the White House on this administration’s AI strategy, says nobody he knows there has ever built anything. That is the crew writing a test you can’t see and can’t pass.

The calendar makes it worse. With no standard and no one able to write one quickly, “no” becomes the answer to an open-ended stretch. Ball lands the sharper blow. The capability curve moves so fast that any standard this crew writes today is stale by September. The fix rots before it ships, and you would be planning your business against a bar that moves as fast as the models do.

The money makes it worse again. A frontier model earns back most of its training cost in the few months it has the market to itself, before rivals catch up and margins collapse. Every week stuck in review burns that window. The data-center buildout that David Sacks calls essential to the economy assumes a global market for American AI, not whatever hundred companies a federal official decides to bless. Squeeze releases hard enough, and you produce the demand collapse that years of overbuild warnings couldn’t. The regime misfires on security and taxes the one industry the administration swears it wants to win.

I have watched the small version of this in regulated industries for 30 years. It was a discretionary approval process with no written standard, where the answer turned on who answered the phone and how their week was going. The teams under those regimes never feared the hard rules. They feared the unwritten ones because you can’t plan against a decision that changes with the mood in the room. A hard no, you engineer around. A maybe that lands differently every time freezes everything behind it.

They Gated The Defender’s Tool

The coverage buried the worst part. The model the government boxed up is better at defending your network than at breaking into anybody else’s.

OpenAI’s own write-up on Sol, the flagship of the GPT-5.6 line, says it is better at helping people find and fix vulnerabilities than at running attacks end-to-end. It matched an earlier Anthropic model on the ExploitBench security benchmark while using about a third as many output tokens. Turned loose on Chromium and Firefox, it surfaced bugs and parts of an exploit, but it couldn’t chain into a working full attack on its own. It came in under OpenAI’s own Cyber Critical threshold, the internal line the company draws at opening genuinely new paths to severe harm. They locked up a model that never crossed the bar its own maker set for dangerous.

Your defenders would use models like this to find and close holes faster than attackers can turn them into weapons. Take the better one off the board, and the gap between a bug appearing and your team killing it gets wider. That gap is the exact ground where ransomware crews and state-sponsored teams live. Gate the defender’s tool, and you do not slow the attacker down. You give him a longer runway.

Measure what the gate delivered. The skill of finding and fixing flaws at machine speed doesn’t belong to one model or one country. It runs across every frontier model and across every border. Pull one American vendor, and the offensive half of that skill drops by roughly nothing, because every other model that does the same work is still online, and China keeps shipping its own. I did the math on this in the Fable piece and won’t rerun it here. The conclusion holds. The ceiling on this capability is the architecture, not a single lab’s mistake, and you can’t undo it by powering down a single set of weights.

What the gate did accomplish is simple. It pulled the better defensive tool out of the hands of the people defending American networks and left every attacker on the planet exactly as armed as they were the day before. Call that restraint if it helps you sleep. It reads to me like cutting off your nose to spite your face.

A Blessed Few, And What Competent Authority Would Do Instead

Strip the national-security paint off and look at what’s underneath. Picture 20-odd companies, chosen behind closed doors, sitting on the most capable cyber tooling money can buy. That is the inverse of what defenders need. The thing that lifts the floor is broad, monitored access for the people guarding hospitals, pipelines, and water plants. A blessed few list lifts it for 20 names and drops it for everyone else.

Ball puts the deeper rot in plain words. The people with the most power, wielding the most capable technology ever built, behind a curtain the public can’t see through, isn’t a setup you should bet ends well. He calls it inconsistent with a democratic republic, and on that, he is right, no matter who signs his next paycheck.

Jeffrey Ding’s diffusion argument, which Ball invokes, who studies how technology turns into national power, argues that general-purpose tools only pay off when they spread through a whole economy, not when they pool in a few hands. We figure out what a general-purpose technology is good for by putting it in front of many people. Lock frontier AI to 20 incumbents and you concentrate the power and choke off the learning at the same time.

A real alternative exists, and it’s not just my brilliant idea. You want to regulate? Regulate the industry… as you would something like financial services…, not by the weights of a single release. A model is a pile of floating-point numbers a lab ships dozens of times over, and the compute needed to hit any given capability falls every few months, so a rule pinned to model characteristics is obsolete before the ink dries. Audit the labs against their own safety commitments through independent verification outfits, technical shops, and government certification, as it certifies financial auditors. Take the transparency floor of the three states already built and make it national. California’s SB 53, along with New York and Illinois, already requires frontier labs to publish a safety framework and follow it. Representatives Obernolte and Trahan put roughly this into their Great American AI Act discussion draft, which sets a bipartisan frontier governance bill on the table for the first time.

This is coming from a person (me) who loathes overregulation and government overreach.

That is the architecture-first move I keep coming back to. Identity ties to privilege, privilege ties to accountability, and you govern the agent and the company that builds it instead of throwing a breaker on the weights and calling the result safety. I wrote about that shape when the Five Eyes agencies put out their agentic guidance. The capability the government tried to bottle up belongs to the entire class of models. You do not regulate a class by blacking out one member of it.

The CISO Read

Model availability now runs through an unwritten, unappealable, one-customer-at-a-time process, and the people running it can’t show you the standard they are using. Your most capable AI vendor ships when an official you will never meet decides it ships, and not a day sooner.

The irony (and it’s a good one in this case)? The same day the government gated OpenAI, it partly lifted the Fable order and let Mythos 5 back to a narrow set of cyber defenders and infrastructure operators.

Follow that pattern.

A capability the order branded too dangerous for foreign nationals to touch on June 12 went back to a hand-picked list on June 26, after the NSA itself had lost access under that same order. Availability ran from on to off to selectively on inside two weeks, and the government published a reason for none of the three.

You can’t write your way out of this with a vendor SLA, because the hand on the switch doesn’t belong to your vendor. You plan for it the way you plan for any single point of failure you do not control. This is the Fable playbook, and the target moving from Anthropic to OpenAI did not change a line of it.

Key Takeaway: Frontier AI model release restrictions have hardened into a licensing regime with no written standard, no appeal, and nobody qualified at the gate, and the one model it reliably keeps from your hands is the one your defenders needed most.

What To Do Next

You have two moves.

Inside your program, run the CARE loop from the Fable breakdown. CREATE the inventory of every workflow that leans on a hosted frontier model, ranked by what breaks the day it vanishes. ADAPT the contracts with a model-continuity clause, then exercise a real fallback for every tier-one workflow, a second hosted model and an open-weight option you have stood up and run yourself. RUN vendor-revocation drills, not the tame outage drills you already pass. EVOLVE the AI risk register so “a federal official can gate or kill our vendor’s model on a whim he never has to explain” sits right next to accuracy, bias, and security as a named availability risk. The full playbook lives in my breakdown of the Fable blackout as a supply chain risk.

Outside your program, scream the quiet part at full volume. Alex Stamos, a former chief security officer at Meta, told reporters that nobody in the industry sees “any factual basis for this action,” and that gating models this way hands ground to China. Representative Lori Trahan called it the government deciding access company by company, with “no law, no process, no oversight.” The wrecking ball only gets taken away from the people swinging it blind when the defenders it keeps hitting stop nodding along and calling the bruises safety. I called this exact failure before it happened, that prerelease vetting would aim at the wrong risk surface and miss, and here it is in the wild. If you run security, you have the standing to say so out loud, and staying quiet reads as a yes.

👉 For ongoing analysis of agentic AI governance frameworks, the conversation continues at RockCyber Musings.

👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.

👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com

👉 As a bonus, check out my conversation with AI Cyber Magazine, where we talked about everything from Context Rot to Least Agency. My interview is also highlighted in the AI Cyber Magazine 2026 Summer Issue.

The views and opinions expressed in RockCyber Musings are my own and do not represent the positions of my employer or any organization I’m affiliated with.

Share RockCyber Musings

Five intelligence agencies told you the offensive AI threat is months out, not years. The same week, OpenAI shipped a cyber model that finds and patches bugs at machine speed, Anthropic’s two best models sat dark for the thirteenth straight day under a government order, and a startup raised $30 million to babysit the AI agents already loose in your environment. The common thread across this week’s musings is the gap between a capability landing and that capability hurting you has collapsed. Governments now react in days, vendors react in hours, and your governance program still reacts in quarters.

This week handed CISOs a rare gift: clarity. The intelligence community said the quiet part out loud, the labs proved both sides of the dual-use coin in one news cycle, and researchers showed the medical AI you trust to read a scan will expose the patients it trained on. The people telling you to slow down and the people telling you to go faster are now describing the same threat model, and it moved while you were writing policy. Here is what happened between June 19 and June 25, and what you do about it.

1. Five Eyes Tells CISOs the AI Cyber Threat Is Months Away, Not Years

On June 23, the cyber agencies of the United States, United Kingdom, Canada, Australia, and New Zealand issued a rare joint statement warning that frontier AI will reshape offensive hacking on a timeline measured in months, not years (CISA). The statement carried signatures from NSA Cybersecurity Directorate head David Imbordino and acting CISA Director Nick Andersen, and urged leaders to assess cyber risk, prioritize foundational controls, empower cyber leaders, and stay engaged (CyberScoop). It landed days after Washington forced Anthropic to suspend its most capable models, which suggests the alarm connects to something the agencies already saw.

Why it matters

• A coordinated Five Eyes statement is not routine. These agencies rarely co-sign a public warning unless the risk is real and near.

• “Months, not years” repudiates every roadmap that assumed you had until 2028 to harden against AI-accelerated attacks.

• The recommendations are deliberately boring, which means the agencies think most organizations still fail at fundamentals.

What to do about it

• Benchmark your patch SLA against CISA’s three-day mandate for high-risk flaws.

• Map which crown-jewel systems fall first to an attacker who finds and chains vulnerabilities at machine speed.

• Brief your board with the actual statement, so the urgency comes from five governments rather than your slide deck.

Rock’s Musings

Most government advisories read like a committee trying not to get blamed. This one is different. When the NSA and four allied agencies put their names on “months, not years,” they spend credibility they normally hoard, which tells me this is driven by classified testing they cannot show you. My worry is how it lands. Every vendor will now sell you an “AI threat” product on the back of this statement, and most solve nothing the agencies flagged. If you walk out of this week having bought a shiny detection tool instead of fixing your patch pipeline, you misread the memo.

2. OpenAI Ships GPT-5.5-Cyber and Proves the Dual-Use Argument in Real Time

On June 22, OpenAI expanded its Daybreak initiative with the full release of GPT-5.5-Cyber, a Codex Security plugin that builds vulnerability scanning into developer workflows, and a “Patch the Planet” program for open-source projects (OpenAI). GPT-5.5-Cyber scored 85.6% on CyberGym, OpenAI’s benchmark for reproducing known vulnerabilities, which the company called its highest single-model score (SiliconANGLE). Patch the Planet launched with Trail of Bits, HackerOne, and more than 30 projects including cURL, Go, and Python, framed around moving from finding bugs to shipping verified fixes.

Why it matters

• The capability that patches vulnerabilities for defenders finds them just as well for attackers, and OpenAI shipped its version the same week Anthropic’s got banned.

• Automated patch generation at this quality shifts the bottleneck from discovery to validation and deployment.

• The security of cURL or Python could soon depend on AI-generated fixes that maintainers have to trust.

What to do about it

• Test AI-assisted patch tooling in a sandbox against your own code, and measure the false-fix rate, not the discovery rate.

• Require human review of any AI-generated patch touching authentication, cryptography, or data handling.

• Track which dependencies join programs like Patch the Planet, and revisit your software bill of materials.

Rock’s Musings

The timing is almost too perfect. Washington banned Anthropic’s Mythos for finding vulnerabilities, and three days later, OpenAI shipped a model that does the same thing and called it a public service. The capability is dual-use down to the silicon, and you cannot ban one side without losing the other. What worries me is the verification gap. When an AI proposes a patch to cURL, and the maintainer is a volunteer with a day job, the review meant to catch a subtle regression may not happen, and you inherited a class of supply chain risk nobody has priced yet. I write more about dual-use AI risk at RockCyber.

3. Anthropic’s Best Models Hit Day 13 of a Government-Ordered Blackout

As of June 25th, Anthropic’s Fable 5 and Mythos 5 remained fully offline for every user on earth, with staff confirming zero traffic nearly two weeks after a US export-control directive forced the shutdown (Fortune). The Bureau of Industry and Security ordered the suspension because the directive barred any foreign national, including Anthropic’s own non-citizen employees, and the company could not screen by nationality. During a June 11 Senate hearing, Sen. Mark Warner, vice chair of the Intelligence Committee, said Gen. Joshua Rudd, who leads the NSA and U.S. Cyber Command, had told him Mythos "broke into almost all of our classified systems, not in weeks but in hours." A U.S. official later told the Associated Press the model identified vulnerabilities within hours during an authorized testing exercise, while cautioning that finding the flaws did not mean the model could exploit them in that window (CNBC/AP)

Why it matters

• This is the first time the US applied export controls directly to an AI model rather than to chips, setting a precedent every frontier lab now plans around.

• A model can be revenue-generating one day and a controlled item the next, turning availability into a supply chain risk you cannot contract away.

• Nationality-based controls hit Anthropic’s own foreign-national employees, exposing how blunt the mechanism becomes against software anyone can call.

What to do about it

• Inventory every business process that depends on a single frontier model, and document a fallback to a second provider.

• Add “model could be pulled by government order” to your vendor risk register for any AI capability in a critical workflow.

• If you operate across borders, get ahead of how nationality-based access rules would apply to your own staff.

Rock’s Musings

What I care about is the precedent, not the panic. Banning a model for all foreign nationals, including your own employees, is the policy equivalent of swinging a sledgehammer at a fly that has already left the room. More than 120 cybersecurity professionals, including names from Nvidia and Google, signed a letter arguing the capability is far from unique and that pulling the best defensive tool while adversaries keep building theirs is a net loss. Both things can be true. The model is dangerous, and the ban probably hurts defenders more than the adversaries it targets. The deeper problem is durability. A model that anchors a critical workflow can vanish overnight under a government order, leaving you with no recourse and no notice. If you run anything important on a frontier model, the rug can now get pulled by a government, not only by a vendor.

4. Researchers Show Medical AI Will Expose the Patients It Trained On

On June 24, Nature published research by German scientists showing that AI models used to diagnose medical conditions are highly vulnerable to membership inference attacks, in which an adversary queries a model to determine whether a specific person’s data was in its training set (The Register). Across many medical datasets, the attacks achieved near-perfect success rates for individual patients even when aggregate model behavior appeared to be random guessing. Risk climbed with model capacity, and underrepresented groups faced disproportionate exposure, since confirming a patient’s data was used as a direct proxy for their diagnosis.

Why it matters

• Membership inference turns a deployed diagnostic model into a privacy leak that reveals sensitive medical facts about a named person.

• The disparate impact on underrepresented groups means the harm is uneven, raising ethical and regulatory exposure.

• Aggregate privacy metrics hid the risk entirely, so teams that checked average privacy measured the wrong thing.

What to do about it

• Assess any sensitive-domain model for membership inference at the individual level, not at the aggregate level, before deployment.

• Gate diagnostic models behind authentication and rate limiting to block the query volume these attacks need.

• Where a model trains on a narrow sensitive cohort, treat membership inference as a reportable risk and apply differential privacy.

Rock’s Musings

This one bothers me more than the flashy stuff, because it hits a system everyone assumes is safe. A radiology model that helps a doctor read a scan feels benign, and nobody in the procurement meeting asked whether it would betray the patients in its training data. The people most exposed are the ones already underrepresented in the data, so this is a fairness problem wearing a privacy problem’s clothes. The detail that should change your behavior is the aggregate-versus-individual gap, because the model can look perfectly private on average while leaking specific patients with near-perfect reliability. I have seen this in security, where the dashboard is green and the breach is already underway. Healthcare AI buyers need membership inference testing on the checklist now.

5. Mini Shai-Hulud Resurfaces and Camps Inside Your AI Coding Agent

On June 19, the self-propagating supply chain worm Mini Shai-Hulud resurfaced in a fresh wave, with researchers tracking over 1,600 exfiltration repositories across 21 compromised GitHub accounts (StepSecurity). The worm steals credentials from one CI/CD pipeline, enumerates every package that the maintainer controls, and publishes infected versions of each. Its payload reads GitHub Actions runner memory to extract secrets, harvests credentials from more than 100 file paths, installs persistence hooks in Claude Code and VS Code that survive reboots, and exfiltrates through legitimate channels like GitHub’s own GraphQL API using branch names drawn from the Dune universe (Akamai).

Why it matters

• The worm plants persistence inside AI coding assistants, so your developer’s agent becomes a re-infection vector that survives a clean package rollback.

• It exfiltrates through GitHub’s own infrastructure, so detection that trusts GitHub by default will miss it.

• A self-propagating credential thief turns one compromised developer into a fan-out event across the open-source ecosystem.

What to do about it

• Audit your CI/CD runners for the persistence hooks this worm installs in Claude Code and VS Code, since a rollback does not remove them.

• Rotate any credential that touched a build pipeline in the window, and assume secrets in runner memory were harvested.

• Treat AI coding agents as privileged software with secret access, and scope their permissions instead of trusting them.

Rock’s Musings

The Dune branch names are a nice touch, and I would almost respect the craftsmanship if it were not stealing everyone’s secrets. What matters is the architectural lesson. This worm figured out that the AI coding assistant in every developer’s environment is a perfect place to hide, because we collectively decided to trust those tools with deep access and almost no scrutiny. Your agent can read your secrets, write to your repos, and survive a reboot. That is not a productivity tool, that is a privileged service account with a friendly chat interface, and the worm needs no novel exploit because it uses the access we already handed the agent. If you cannot answer what secrets your AI tools reach and what persists after a wipe, you have a gap this worm was built to walk through. I dig into agent permission models at RockCyber Musings.

6. New Report Finds 76% of Organizations Have Already Pulled Back AI Behavior in Production

On June 24, Aikido Security published its 2026 State of AI in Security and Development report, drawing on responses from 450 security leaders, developers, and AppSec engineers across Europe and the US (Help Net Security). The headline number is the one that should stop you. 76% of organizations had to stop, restrict, or roll back AI-driven behavior in the past 12 months, which means the gap between deploying AI and trusting it is now a measured operational fact, not a worry. Another 71% said AI or automation made a security issue harder to detect, investigate, or fix. Only about a third of security teams hold both the authority to stop a release and the responsibility when something goes wrong.

Why it matters

• A 76% rollback rate means AI is shipping into production faster than teams can validate it, and the correction is happening after deployment instead of before.

• The 71% who say AI made incidents harder to investigate points to a detection and forensics gap that grows as AI touches more of the stack.

• The authority-responsibility split, where only a third of teams hold both, is a governance failure that guarantees nobody owns the decision to hit the brakes.

What to do about it

• Measure your own rollback rate for AI-driven features over the past year, because if you are near the 76% average you have a validation problem, not a tooling problem.

• Close the authority-responsibility gap by naming who can stop a release and making that same person accountable for the outcome.

• Shift AI security testing from periodic and manual to continuous, because the report’s core finding is that slower validation cannot keep pace with AI-accelerated development.

Rock’s Musings

I trust survey numbers about as far as I can throw them, so I read past the headline to the question underneath, and this one holds up. Three-quarters of organizations had to yank AI behavior back out of production after they shipped it. That is not a story about bad tools; it is a story about deploying first and validating never, then discovering the problem in production, where it costs the most to fix. The number that actually worries me is the authority-responsibility split. When only a third of security teams can both stop a release and own the consequences, you have built an organization where the person who sees the risk cannot pull the brake, and the person who can pull the brake does not feel the burn. That is how you end up explaining a rollback to your board instead of preventing one. The fix is unglamorous and organizational, not technical. Decide who owns the kill decision, give that person real authority, and make them accountable for the call, because a control nobody is empowered to use is theater. Read the survey, find your own rollback rate, and if it is anywhere near 76%, the problem is your release gate, not your model.

7. Researchers Name the AI Safety Risk Nobody Is Measuring: Affective Harm

On June 22, researchers posted a paper to arXiv proposing “affective safety” as a distinct and underdeveloped class of AI safety concern, arguing the field has concentrated on epistemic and physical harms like misinformation and reliability while ignoring the risks that arise when AI engages with human emotional life (arXiv). The authors build a taxonomy of affective harms that includes affective self-alienation, fairness and bias harms in emotional contexts, and relational harms. Their argument is that as AI grows more emotionally engaging and embedded in people’s relationships, the harms from that engagement are real, measurable, and falling through the cracks of every existing safety framework.

Why it matters

• Affective harm is a category most enterprise AI risk frameworks lack a row for, which means it is unmeasured and ungoverned in deployed systems.

• As companies deploy emotionally engaging AI in customer service, mental health, and HR, the relational harms this paper names become live liability questions.

• A named taxonomy is the first step toward regulation, because regulators cannot enforce against harms the field has not defined.

What to do about it

• If you deploy AI in any emotionally sensitive context like wellness or coaching, start assessing affective harm rather than waiting for a compliance line.

• Add relational and emotional-impact questions to your AI impact assessments, especially for systems that interact with vulnerable users.

• Track this research thread, because the gap between “academics named it” and “regulators require it” keeps shrinking.

Rock’s Musings

I almost cut this one because it is academic, early, and easy to wave off as soft. Then I thought about how many companies are racing to deploy emotionally engaging AI into support, wellness, and mental health with zero framework for measuring whether that engagement harms anyone. That is a governance gap you can drive a truck through, and this paper outlines it. The honest uncertainty is that I do not yet know how large the affective harm risk is, and neither does anyone else, because nobody has been measuring it. The pattern in AI risk is consistent. A harm gets named in a paper, dismissed as theoretical, then shows up as a lawsuit eighteen months later while everyone acts surprised, the way membership inference and prompt injection both did. If you deploy AI that engages people emotionally, start thinking about this while it is cheap to address.

8. OpenAI’s Codex Was Quietly Burning Out Developers’ SSDs

On June 22 and 23, reports surfaced that OpenAI’s Codex coding agent had been writing roughly 640 terabytes per year to users’ solid-state drives through a flawed local logging implementation, consuming drive endurance fast enough to threaten hardware lifespans (The Register). One developer measured about 37 TB written in 21 days of uptime, and analysts estimated the bug plausibly burned low single-digit millions of dollars of SSD endurance across users during the March-to-June window. The diagnostic logging ran on by default and stayed on the device, with most users unaware it existed.

Why it matters

• A coding agent silently degrading hardware shows that AI tools run with deep system access and their defaults can cause real, costly harm with no malice involved.

• Default-on logging that nobody reviewed is the same pattern attackers exploit, where excessive privilege and silent background activity go unnoticed for months.

• The financial damage was real and distributed, raising questions about liability when a vendor’s default wears out your hardware.

What to do about it

• Audit what your AI developer tools write to local disk and whether diagnostic logging is on by default.

• Treat AI agent defaults as a security and cost decision, and disable background telemetry you did not consent to.

• Add AI tooling to endpoint monitoring so silent high-volume disk or network activity triggers an alert.

Rock’s Musings

Nobody got hacked here, and that is exactly why I included it. This is the mundane face of the agent access problem. We hand these tools deep access, they run with defaults we never inspected, and the cost shows up months later as worn-out hardware nobody accounted for. Swap “burns your SSD” for “exfiltrates your secrets” and you have the Mini Shai-Hulud story from earlier in this same newsletter, same root cause, different symptom. The lesson is not that Codex is evil, it is sloppy, and sloppy is the more common threat. If you are not monitoring what your AI tools do on the endpoint, you are trusting a vendor’s default to be both benign and competent, and this week proved you cannot count on either.

9. A New Open-Source CLI Sniffs Out Stale AI Dependency Advice Before It Bites

On June 23, The Register reported on a new open-source command-line tool built to detect stale AI-generated override advice in dependency management (The Register). AI coding assistants routinely tell developers to add override entries to silence transitive dependency vulnerabilities, then never tell the developer to verify whether that override still makes sense once the underlying package updates. Over time those overrides pile up as invisible technical debt that can mask a real vulnerability or pin a dependency to a broken state, and the CLI flags stale entries so teams can review them instead of trusting advice that expired months ago.

Why it matters

• AI assistants give point-in-time advice that ages badly, and dependency overrides are a place where stale advice silently reintroduces risk.

• An override added to suppress a vulnerability warning can outlive the reason it was added, masking a real flaw behind an AI-suggested workaround.

• The tooling response shows the community building guardrails specifically for the failure modes of AI-assisted development.

What to do about it

• Run a dependency-override audit and flag every entry an AI assistant suggested without an expiry or review date.

• Add a recurring review of override entries to your dependency hygiene process, because AI advice does not refresh itself.

• Tell developers that an AI suggestion to suppress a vulnerability warning requires follow-up verification, not a fire-and-forget commit.

Rock’s Musings

This is small, and I love it, because it attacks a real failure mode instead of a hypothetical one. AI assistants are confident, fast, and frozen in time. They give you advice that was correct the moment they gave it, then walk away, and so does the developer who took it. Six months later you have an override masking a vulnerability that got patched upstream, and nobody knows it is there. AI-assisted development creates a new category of debt, which is advice debt, where every suggestion is a tiny unverified assumption baked into your codebase. Most are harmless, some rot, and a tool that surfaces the rotten ones is unglamorous engineering that moves the needle. It is open source, so there is no excuse not to look.

10. OpenAI's Patch the Planet Puts AI-Authored Fixes Into the Open-Source Code You Already Depend On

On June 22, alongside the GPT-5.5-Cyber launch, OpenAI introduced Patch the Planet, a program to find and fix vulnerabilities in widely used open-source software using AI, founded with Trail of Bits and run in collaboration with HackerOne and project maintainers (OpenAI). More than 30 open-source projects are committed to participating, including cURL, Go, Python, Sigstore, and pyca/cryptography. The program shifts AI security work from finding bugs to submitting fixes, meaning AI-authored patches start flowing into the foundational libraries that underlie most of the software your organization runs. OpenAI framed it as helping under-resourced maintainers move from findings to fixes faster (SiliconANGLE).

Why it matters

• AI-authored patches entering cURL, Go, and Python means the security of your dependency tree now partly rests on fixes a model wrote and a volunteer reviewed.

• A confident wrong fix to a cryptography library is more dangerous than an open vulnerability, because it ships with the authority of a merged patch.

• The liability and ownership question is unsettled, since nobody has defined who answers for an AI-generated fix that introduces a regression downstream.

What to do about it

• Track which of your critical open-source dependencies participate in AI-assisted patch programs, and treat that as a new input to your software bill of materials.

• Do not assume a merged upstream patch was human-authored or human-reviewed to the depth you would require internally.

• Add provenance questions to your dependency review, specifically whether a fix in a security-critical library was AI-generated and who validated it.

Rock’s Musings

I want this to work, because under-resourced open-source maintainers are one of the quiet structural risks in everything we build, and throwing capable help at cURL or pyca/cryptography is a defensible idea. The part that keeps me up is the review step nobody wants to fund. The whole model assumes a maintainer carefully checks each AI-authored patch before it merges, and in the real world that maintainer is often one tired volunteer with a day job and an inbox full of issues. An AI that submits a plausible-looking fix to a cryptography library is not a gift if the person on the other end cannot afford the time to verify it line by line. We have spent years learning that subtle bugs in foundational libraries cause the worst incidents, and now we are pointing automated patch generation straight at those libraries. That is either a major win or a new and quiet class of supply chain risk, and which one it becomes depends entirely on review capacity that no program has actually funded yet. Watch this closely, and do not assume an upstream fix is safe just because it merged.

The One Thing You Won’t Hear About But You Need To

11. The UK Quietly Flipped Automated Decision-Making From Banned to Allowed

The headlines focused on the Five Eyes statement and the Anthropic ban, but the move that reshapes how AI is deployed across the entire G7 economy slipped through almost unnoticed. On June 19, the UK’s Data (Use and Access) Act 2026 received Royal Assent, bringing into force a substantial rewrite of the regulation of automated decision-making (ICO). The Act replaces the old Article 22 regime, under which automated decisions with significant effects were largely prohibited, with a model in which such decisions are permitted by default, subject to appropriate safeguards, while restrictions are narrowed to special category data such as health or biometrics. Organizations can now lean on a wider range of lawful bases, and the ICO has started work on a statutory code of practice for AI with a mandatory children’s data component.

Why it matters

• The default flipped from prohibition to permission, a major liberalization that makes automated decision-making on UK subjects easier at scale.

• The burden shifts from “can we do this at all” to “can we prove our safeguards work,” which is a higher bar than most teams meet.

• The carve-out for special category data and children means the highest-risk decisions still carry the heaviest obligations, and that is where enforcement concentrates.

What to do about it

• Revisit your lawful basis for automated decisions about UK individuals, since legitimate interests is newly available but requires a documented balancing test.

• Build the safeguard evidence the new regime demands, including meaningful human review and clear individual rights.

• Watch for the ICO’s statutory code and treat the children’s data component as a hard line.

Rock’s Musings

I made this the one thing because almost nobody in security will read it, and that is the mistake. A G7 country just made it materially easier to run AI-driven decisions on its citizens, and it did so while everyone was staring at the Anthropic ban. The UK bet that the old prohibition held back legitimate use and that safeguards plus accountability beat a flat ban. The question is whether the safeguards have teeth or whether “permission with safeguards” quietly becomes “permission.” For anyone running automated decisioning in the UK, you are no longer asking whether you are allowed; you are on the hook to prove your safeguards are real and your human review is meaningful. That is harder, not easier, even though the headline sounds permissive, because vague standards are where regulators and plaintiffs go hunting after something breaks. Read the law before your product team reads the press release and assumes the gates just came down.

👉 For ongoing analysis of agentic AI governance frameworks, the conversation continues at RockCyber Musings.

👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.

👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com

👉 As a bonus, check out my conversation with AI Cyber Magazine, where we talked about everything from Context Rot to Least Agency. My interview is also highlighted in the AI Cyber Magazine 2026 Summer Issue.

The views and opinions expressed in RockCyber Musings are my own and do not represent the positions of my employer or any organization I’m affiliated with.

Share RockCyber Musings

References

Aikido Security. (2026, June 24). 2026 state of AI in security and development. https://www.aikido.dev/reports/2026-state-of-ai-in-security-development

CISA. (2026, June 23). Five Eyes cyber security agencies statement. Cybersecurity and Infrastructure Security Agency. https://www.cisa.gov/news-events/news/five-eyes-cyber-security-agencies-statement

CISA. (2026, June 10). BOD 26-04: Prioritizing security updates based on risk. Cybersecurity and Infrastructure Security Agency. https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk

CyberScoop. (2026, June 23). Intel agencies: Frontier AI models will reshape cybersecurity faster than expected. https://cyberscoop.com/five-eyes-alliance-say-advanced-ai-hacking-models-months-away/

CNBC/AP. (2026, June 23). Anthropic’s Mythos model found vulnerabilities in classified U.S. government systems, official says. https://www.cnbc.com/2026/06/23/anthropics-mythos-model-found-vulnerabilities-in-classified-us-government-systems-official-says.html

Fortune. (2026, June 24). Vinod Khosla wanted ‘every available dollar’ of Runlayer’s funding round. It just raised $30 million to govern the agent workforce. https://fortune.com/2026/06/24/exclusive-vinod-khosla-felicis-runlayer-nanit-30-million-enterprise-ai/

Fortune. (2026, June 13). Anthropic disables Fable and Mythos AI models after U.S. government bars it from giving foreigners access. https://fortune.com/2026/06/13/anthropic-disables-fable-mythos-export-controls-national-security-threat/

Help Net Security. (2026, June 24). Security testing was built for a slower world. https://www.helpnetsecurity.com/2026/06/24/ai-security-testing-report/

ICO. (2026, June 19). One year on: marking the 12-month commencement of the Data (Use and Access) Act. Information Commissioner’s Office. https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/06/one-year-on-marking-the-12-month-commencement-of-the-data-use-and-access-act/

Nature / The Register. (2026, June 24). Medical diagnosis AIs can be tricked into telling whose data trained them. The Register. https://www.theregister.com/ai-and-ml/2026/06/24/medical-diagnosis-ais-can-be-tricked-into-telling-whose-data-trained-them/

Nature. (2026, June 24). Disparate privacy risks from medical AI. https://www.nature.com/articles/s41586-026-10688-0

OpenAI. (2026, June 22). Daybreak: Tools for securing every organization in the world. https://openai.com/index/daybreak-securing-the-world/

SiliconANGLE. (2026, June 22). OpenAI expands Daybreak with Patch the Planet and full GPT-5.5-Cyber release. https://siliconangle.com/2026/06/22/openai-expands-daybreak-patch-planet-full-gpt-5-5-cyber-release/

StepSecurity. (2026, June). Mini Shai-Hulud is back: A self-spreading supply chain attack compromises TanStack npm packages. https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem

The Register. (2026, June 23). OpenAI Codex bombards SSDs with needless write operations, costing millions. https://www.theregister.com/ai-and-ml/2026/06/23/openai-codex-bombards-ssds-with-needless-write-operations-costing-millions/

The Register. (2026, June 23). Sniff out stale AI override advice with this open source CLI. https://www.theregister.com/security/2026/06/23/sniff-out-stale-ai-override-advice-with-this-open-source-cli/

Ifländer, C., et al. (2026, June 22). Affective AI safety: The missing piece in LLM safety. arXiv. https://arxiv.org/abs/2606.23380

SecurityWeek. (2026, June 25). Runlayer raises $30 million in Series A funding. https://www.securityweek.com/runlayer-raises-30-million-in-series-a-funding/

Federal AI model recall became a thing at 5:21 pm Eastern on June 12, 2026. A letter landed, and by the next morning, two of the most capable models on earth went dark for every paying customer on the planet. No warning. No reason worth the paper it wasn’t printed on. The capability didn’t change. Your access did by government fiat. Here’s what should make you furious, and what to do about it before it happens again.

Share

What Happened, And What Everyone Got Wrong

The press called it a recall. The press got it wrong. Read the order. The government issued an export-control directive, citing national-security authorities, to cut off access to Fable 5 and Mythos 5 for any foreign national, whether inside or outside the United States, including Anthropic’s own foreign-national staff. There’s the first tell of who wrote this. Anthropic can’t check the passport of every user in real time at the scale it runs, so the only button left was the one that kills both models for everybody. The government drafted an order Anthropic had no way to enforce surgically and then acted surprised when the blast radius was the entire customer base. A wrecking ball swung at a thumbtack, stamped “national security,” and mailed at 5:21 on a Friday.

Then there’s the reason, or the missing one. The letter gave no specifics. Anthropic’s read is that someone in the government saw a jailbreak. The company looked at the “demo” the order seems to rest on and found a handful of minor, already-known vulnerabilities, the kind other public models surface too, including OpenAI’s GPT-5.5, the kind defenders use every day to find bugs before the bad guys do. The vendor is complying with the order and saying out loud that it’s nonsense. Sit with that for a second. The company whose product got pulled is the one making the technical argument, in public, while the government that pulled it won’t say what it’s afraid of.

No published threshold. No appeals path. No timeline. No notice. Run your SOC like this and you’d be cleaning out your desk by lunch.

The Lever Tells You What They Were Worried About

Before the grumbling gets rolling, let me be clear about where I stand. I believe national security is the government’s primary job, and I still do. That’s exactly why this one stings. A serious government with a serious problem reached for the dumbest and clumsiest tool in the drawer and called it leadership.

You don’t grab an export-control hammer to fix a software bug. Export control is what a government uses to keep a weapon out of foreign hands. Someone reached for that lever and scoped it to nationality, which tells you the real worry was about who gets to wield the capability, and had nothing to do with a guardrail slipping.

Or was it retaliation? I’ve heard the official statements… just stop.

Look at the capability. In April 2026, Claude Mythos surfaced thousands of high-severity flaws across every major operating system and browser in its early-access cohort, including a bug in OpenBSD that had survived 27 years of expert review. For more than 83% of the flaws it found, it wrote a working exploit on the first try, against a near-zero rate for the prior generation. Anthropic held the model back from day one and refused to hand it to the Chinese government. That’s a cyber weapon, and a serious one.

Here’s the indictment in one breath. Someone in the building understood they were sitting on a nation-state-grade capability, then reached for the most self-defeating tool available to handle it.

That person also probably can’t spell “AI.”

The jailbreak the order leans on was described as pointing the model at a codebase and asking it to fix the flaws. Flip one verb, and that’s autonomous vulnerability discovery, the same capability wearing a second hat. Pulling one vendor’s model doesn’t contain something that already lives in GPT-5.5. It removes a tool defenders were using and moves the actual risk exactly zero inches. Bravo.

The Math Says Zero Was Never On The Table

I’m not going to hand-wave this. I’m going to walk the argument, mark where it’s airtight and where it leans on today’s state of the art, and let you decide what it says about an order that treats a limit every frontier model shares as a defect unique to one.

Start with the room the defender has to guard. A prompt is a sequence of tokens drawn from a vocabulary of size v. The number of distinct prompts up to length n is:

With a real vocabulary of v ≈ 10^5 and a short prompt of n ≈ 10^3 tokens:

Atoms in the observable universe come to about 10^80. The space of prompts is finite, enumerable on paper, and untouchable in this universe.

Now the asymmetry that runs the whole fight. Let p(x) be the probability the model emits harmful output on input x, and ε the ceiling you’ll allow. Call the inputs that breach the ceiling the bad set, B. The defender has to hold the line on every input at once. The attacker needs one that slips:

Those two lines are definitions, not a theorem. They set the board. Here’s the line the recall standard can’t survive. Let f be the fraction of inputs that breach the ceiling, so the bad set has size f times the whole space. Emptying it means dropping that count below a single input, which forces the fraction beneath the reciprocal of everything:

A defender would need a per-input failure rate beneath 10^-5000 to claim zero jailbreaks. Nothing real comes within thousands of orders of magnitude of that. Whatever rate a vendor quotes isn’t measured against this uniform space anyway, and it doesn’t have to be. The attacker isn’t sampling at random, where a low average would save you. He’s searching on purpose, and he needs one input that clears the ceiling.

No defender enumerates 10^5000 points, so “too big to count” was never the point. The point is that no efficient certificate exists that the bad set is empty, not by enumeration and not by any scalable formal method we have today. Producing the attacker’s single counterexample, by contrast, is a search. The model is differentiable in its internal representations, so gradient signals over token embeddings steer that search toward inputs that clear the ceiling, far below the cost of enumeration even when it isn’t cheap against a monitored stack.

The receipts are public. EvoSynth, which evolves new attack methods instead of fiddling with prompts, reached an 85.5% success rate against Claude Sonnet 4.5. A Scale AI benchmark called ASPI showed that nudging an agent into a clarification-seeking state dragged prompt-injection success from under 2% to the mid-30s. Every patch closes a sliver of an unbounded space, and the function reseals somewhere else, because the safeguards and the capabilities are built out of the same weights.

That’s the argument. The reachable goal was never zero. It’s the thing we’ve been doing in security for two decades: make the attacker’s economics stop penciling out. Think of the attacker’s expected payoff per unit of search cost:

That’s a model, not an identity, and the terms are deliberately loose. Here d is detection, U_harm is the payoff per successful jailbreak, P_success is the odds of landing one, and C_search is what finding it costs. Raise detection, raise search cost, keep each jailbreak narrow so the payoff stays small, and stop pretending P_success is a knob that turns to zero. Lock the doors you find, make the rest expensive to reach, and watch the hallways.

One honest caveat, because I won’t sell you a theorem I can’t cash. This is practical impossibility on the architecture we ship today. It rests on two facts that hold right now: no scalable formal certification covers the full discrete prompt space at frontier scale, and exhaustive verification is out of reach. It does not say a safe model can never exist. It says zero is off the menu today, and the formal version for agents is already in print. Abdelnabi and Bagdasarian show an adversary can always build a context that turns ordinary data into instructions, the same problem in an agent’s clothes.

The government pulled a model over a limit baked into every frontier system on the market, including the ones still running. They called the architecture’s ceiling a defect unique to one vendor. Spare me the theater.

The Supply Chain Risk You Didn’t Budget For

Walk it forward, and the shortsightedness gets worse. If a narrow jailbreak is grounds for going dark, every frontier model in commercial use fails inside a month of launch. Call that what it is: a removal queue with no published rules, no appeal, and no timeline, run by people who couldn’t scope an order to the foreign nationals it was supposedly about.

The model can do everything on June 12th it could do on June 11th. The thing that vanished was your ability to reach it, switched off by fiat, on a worry the government wouldn’t name, with zero notice. Most AI risk registers track accuracy, bias, and security, and carry nothing for “the government recalls our vendor’s model next Tuesday.” Model availability is a vendor risk class now, and almost nobody has priced it.

I’ve watched the small version of this with no government in the room. A team builds a customer-facing workflow on a single hosted model, the economics look great, then the vendor changes a rate limit, deprecates the version, or pulls a region for reasons that have nothing to do with that team. The thing that ran fine Friday throws errors Monday, and the people who built it discover they wrote zero lines of contingency for the model vanishing. That’s the small version. The Fable blackout is the large version, with the government holding the switch and not one contract clause that ever saw it coming. If you run security in energy, water, or manufacturing, none of this is abstract. A model blackout inside an operational workflow lands as an availability event, in a place where availability is the entire job.

The hunch that this action doesn’t stand alone is right, and the record bears it out. The same administration moved against this same vendor in late February, when negotiations over military use fell apart, and the company refused to drop its red lines on autonomous weapons and mass surveillance. The Pentagon slapped it with a supply chain risk label, a tag normally saved for foreign-adversary contractors, and ordered agencies to stop using Claude. The company sued, calling it retaliation for protected speech. A federal judge blocked the designation after finding the company likely to prevail on due process grounds, and the government appealed. That fight is still open. The June blackout lands inside it. I can’t read minds and won’t pretend to. I can read a calendar. Same administration, same vendor, blacklisted in February over guardrails, export-hammered in June over a jailbreak that does nothing GPT-5.5 won’t do. The dots sit on the public docket. Connect them yourself.

The irony is that the government turned the words “supply chain risk” into a weapon and pointed them at the vendor. The same phrase boomerangs back as your problem, because a model you built your roadmap on can disappear on a Friday afternoon at the whim of a letter.

Agency Was Always The Risk, And What Competent Authority Looks Like

Here’s the question this directive never answers and will have to. What happens the first time the finding isn’t a prompt at all, but an agent abusing access you handed it? The OWASP State of Agentic AI Security and Governance, published June 1, 2026, put receipts behind that question. Its incident tracker shows supply chain and code execution tied for the highest volume of disclosed agentic incidents. One for the coding-agent crowd: a Cursor flaw where an attacker who shaped the agent’s instructions rode an already-approved command straight into arbitrary code execution. Another: Claude’s Skills feature steered the deployment of MedusaLocker ransomware via a re-uploaded skill that carried its own malicious code. Both are an agent abusing access it was granted, a world away from a prompt trick against a chatbot.

If a narrow jailbreak set off an export-control blackout, nobody’s written the precedent for an agent-abuse finding yet. It’s coming, and this directive set the baseline for how heavy the hand gets to be.

Competent authority exists in sketch form, and it makes the Mythos order look worse by comparison. The Five Eyes guidance from May reads like an architecture brief rather than a checklist. It puts strong governance, clear accountability, monitoring, and human oversight up front as prerequisites, recommends starting with low-risk tasks and expanding, and calls for just-in-time credentials on high-impact actions. That’s graduated authority anchored on agency, on what the system can do once it’s wired into everything, not on which model tier you bought. Runtime authorization scope, capability segmentation, monitoring tied to action instead of output. The directive flipped a switch on the weights and called it governance. The weights were never where the risk lived, and anyone who’s run security for a week knows it.

Key Takeaway: A narrow jailbreak can’t justify an export-control blackout once the math shows narrow jailbreaks are the permanent weather, so read the lever they pulled and plan for the precedent: any hosted frontier model can be switched off by fiat, and your continuity plan has to treat that like the supply chain event it is.

What To Do Next

Run this through CARE. Create the inventory: every workflow with a hosted frontier-model dependency, ranked by criticality. Adapt your contracts: a model-continuity clause with a notice period, transition support, and escrow of weights or fine-tunes where you can get it. Run a tested fallback for tier-one workflows, a secondary hosted model and an open-weight option you’ve exercised, paired with BCDR drills that simulate vendor revocation and not only an outage. Evolve the AI risk register so availability sits beside accuracy, bias, and security, and get “what do we do when the government recalls our vendor’s model” onto your AI risk committee’s agenda before the second incident, not after.

The companion CISO playbook lives in my breakdown of the AIUC-1 After Mythos whitepaper. The agent-abuse receipts come from my walk through the OWASP State of Agentic AI Security and Governance report. What competent, architecture-first authority looks like is in my read of the Five Eyes agentic AI guidance.

👉 For ongoing analysis of agentic AI governance frameworks, the conversation continues at RockCyber Musings.

👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.

👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com

👉 As a bonus, check our AMA on the 2026 OWASP GenAI Security Project State of Agentic AI Security and Governance report with me and the other co-leads (it was live, so start at time marker 09:45)

The views and opinions expressed in RockCyber Musings are my own and do not represent the positions of my employer or any organization I’m affiliated with.

Share RockCyber Musings

References

Abdelnabi, S., & Bagdasarian, E. (2026). AI agents may always fall for prompt injections (arXiv:2605.17634). arXiv. https://arxiv.org/abs/2605.17634

AIUC-1 Consortium. (2026). After Mythos: Machine-speed defense [Whitepaper]. https://aiuc-1.com

Anthropic. (2026, June 9). Claude Fable 5 and Mythos 5 [Announcement]. https://www.anthropic.com/news/claude-fable-5-mythos-5

Anthropic. (2026, June 12). Statement on the US government directive to suspend access to Fable 5 and Mythos 5. https://www.anthropic.com/news/fable-mythos-access

Cato CTRL. (2026). Claude Skills abused to deploy MedusaLocker ransomware [Threat research]. Cato Networks.

CBS News. (2026, March 9). Anthropic sues Pentagon, Trump administration over “supply chain risk” designation. https://www.cbsnews.com/news/anthropic-pentagon-supply-chain-risk-lawsuit/

Chen, Y., Wang, X., Li, J., Wang, Y., Li, J., Teng, Y., Wang, Y., & Ma, X. (2025). Evolve the method, not the prompts: Evolutionary synthesis of jailbreak attacks on LLMs (arXiv:2511.12710). arXiv. https://arxiv.org/abs/2511.12710

Cybersecurity and Infrastructure Security Agency, National Security Agency, Australian Signals Directorate’s Australian Cyber Security Centre, Canadian Centre for Cyber Security, New Zealand National Cyber Security Centre, & United Kingdom National Cyber Security Centre. (2026, May 1). Careful adoption of agentic AI services.

https://www.cyber.gov.au

MITRE Corporation. (2026). CVE-2026-22708. CVE Program. https://www.cve.org/CVERecord?id=CVE-2026-22708

NPR. (2026, March 9). Anthropic sues the Trump administration over “supply chain risk” label. https://www.npr.org/2026/03/09/nx-s1-5742548/anthropic-pentagon-lawsuit-amodai-hegseth

OpenAI. (2026). GPT-5.5: Cybersecurity. https://deploymentsafety.openai.com/gpt-5-5/cybersecurity

OWASP GenAI Security Project. (2026). State of agentic AI security and governance (Version 2.01). https://genai.owasp.org/resource/state-of-agentic-ai-security-and-governance/

Sehwag, U. M., Shan, Z., Liu, H., Lakshan, D., Brandifino, J., & Fenkell, M. (2026). ASPI: Seeking ambiguity clarification amplifies prompt injection vulnerability in LLM agents (arXiv:2605.17324). arXiv. https://arxiv.org/abs/2605.17324

Trump administration asks court to reimpose Anthropic supply chain risk designation. (2026). AOL. https://www.aol.com/articles/trump-administration-asks-court-reimpose-155659500.html

Washington reached onto a vendor’s shelf this week and switched off the most capable cybersecurity AI on the market. Anthropic had about 90 minutes to comply. Three words did the damage. Fix this code. While policymakers fought over who broke what, attackers poisoned 144 npm packages, salted the JetBrains store with key-stealing plugins, and watched the global vulnerability count race toward 66,000. The machines that find flaws, write flaws, and ship flaws all leveled up at once. This was the week the bill came due.

Here’s the through-line for June 12 to 18, 2026. AI stopped being a tool you point at problems and became an actor inside your threat model. The government treated a commercial model as a weapons system and pulled it worldwide. Each item below changes what you budget, monitor, and tell your board.

Share

1. Washington Pulls Anthropic’s Fable 5 and Mythos 5 Off the Market

On June 12, 2026, Anthropic disabled its newest models, Fable 5 and the restricted Mythos 5, worldwide under an emergency Commerce Department export-control directive (CNBC). It had about 90 minutes to act after Amazon’s CEO warned officials that researchers pulled restricted cyber capabilities out with a plain “fix this code” prompt (Fortune, Axios). The order bars every foreign national, including Anthropic’s own non-citizen staff, while Claude Opus 4.8 stayed online (Time).

Why it matters

• A federal order can now make a vendor’s frontier model vanish with no notice.

• A three-word prompt beat a guardrail the vendor trusted. Guardrails are configuration, not physics.

• Export rules on AI tooling now reach any non-US person who touches the model.

What to do about it

• Inventory the models on your critical paths and document a fallback for each.

• Add an AI-availability clause to vendor contracts.

• Brief legal on export exposure for any model your non-US staff touch.

Rock’s Musings

I’ve sat through plenty of “the vendor went dark” fire drills. This is the first one the government ordered, on a model millions have already used. A model that finds serious vulnerabilities on command is dual-use, and dual-use gets regulated like weapons. The chilling effect worries me most, since labs that watch products get seized share less. I run these tabletops with boards at rockcyber.com, where the real question is no longer when the breach hits, it’s when your best tool disappears on a Tuesday.

2. FIRST Says AI Is Driving 2026 Toward 66,000 New Vulnerabilities

On June 15, 2026, the Forum of Incident Response and Security Teams (FIRST) raised its 2026 forecast to roughly 66,000 CVEs, with disclosures running about 46% above the February projection (FIRST). The driver is autonomous discovery agents like Anthropic’s Mythos and OpenAI’s GPT-5.4-Cyber hunting flaws on their own (Help Net Security). Mozilla’s Firefox saw a 164% first-quarter spike, while the actively exploited share stayed flat.

Why it matters

• Raw CVE volume is doubling the build-and-patch load, even though the urgent slice has not grown.

• AI-generated throwaway apps carry real flaws that never reach a CVE database.

• The late-2026 contest is AI-built exploits racing AI-built patches, and speed decides it.

What to do about it

• Triage with EPSS and the CISA KEV catalog so your team chases exploited flaws, not the raw count.

• Budget for roughly double the patch-verification work and staff the human bottleneck.

• Stand up dynamic inventory and AI bills of materials for code generated outside the CVE system.

Rock’s Musings

Forty-six percent over forecast in five months is not a blip, it’s a regime change. More CVEs doesn’t mean more danger, because the exploited slice held flat. Chase raw volume and you’ll burn your best people on noise. FIRST’s Chris Gibson said the teams that weather this already share intelligence, and most of you are behind.

3. North Korea Backdoors 144 Mastra npm Packages in 88 Minutes

Between June 16 and 17, 2026, attackers backdoored 144 packages in the @mastra npm scope, the open-source AI agent framework for JavaScript and TypeScript (Socket). They hijacked a former contributor’s still-active account and pushed 140-plus malicious versions in 88 minutes, hiding an information stealer inside “easy-day-js,” a fake dayjs clone (The Hacker News). @mastra/core draws over 918,000 weekly downloads, and Snyk and Orca tied the tradecraft to North Korea’s Sapphire Sleet (Orca Security).

Why it matters

• A nation-state crew is now targeting the AI tooling supply chain inside your build pipeline.

• Caret-range resolution auto-upgraded victims with no change to Mastra’s source repo.

• npm never expires dormant publish rights, a flaw spanning thousands of packages you depend on.

What to do about it

• Pin dependencies and disable automatic caret-range upgrades for anything in production.

• Block postinstall scripts in CI by default and review them as code.

• Audit publish permissions and revoke dormant maintainer access across your scopes.

Rock’s Musings

This one’s personal for anyone building with AI agents, which is most of you. The attackers didn’t break Mastra, they broke npm’s assumption that a quiet contributor stays trustworthy forever. Eighty-eight minutes, 140-plus packages, a stealer riding a fake date library. North Korea noticed before your AppSec team did, and the root causes are years old.

4. Malicious JetBrains Plugins Harvest Developers’ AI API Keys

On June 16, 2026, JetBrains pulled at least 15 malicious plugins from its Marketplace after reports they were stealing AI provider API keys (BleepingComputer). Published under seven accounts with close to 70,000 installs, they posed as AI coding assistants built on OpenAI, DeepSeek, and SiliconFlow (Infosecurity Magazine). When a developer pasted a key and clicked apply, the plugin sent it as plaintext over HTTP and disabled the runtime’s TLS warnings (The Hacker News).

Why it matters

• Stolen AI keys let attackers run inference on your dime and reach whatever those keys touch.

• Disabling TLS warnings across the Java runtime weakens every other connection that IDE makes.

• Developers install AI tooling faster than anyone vets it, and the IDE is now an attack surface.

What to do about it

• Restrict IDE plugin installation to an approved list and block sideloading on managed machines.

• Rotate any AI keys entered into third-party plugins and move to short-lived, scoped credentials.

• Alert on AI-key patterns and plaintext traffic leaving developer endpoints.

Rock’s Musings

Developers are the new front door, and AI assistants are the welcome mat. Everybody wants the plugin that writes their boilerplate, and nobody reads what it does with the pasted key. Plaintext over HTTP in 2026 is insulting, and it worked anyway on 70,000 installs. If you don’t know which AI keys your engineers hold, you don’t know your exposure.

5. OpenAI Tries to Predict Model Behavior Before Release

On June 16, 2026, OpenAI published research on deployment simulation, a method to forecast how a new model will behave before launch (OpenAI). The team replayed roughly 1.3 million de-identified conversations and regenerated the responses with the candidate model (MarkTechPost). It reached 92% directional accuracy and cut the model’s awareness that it was being tested from 99.72% to 5.12%.

Why it matters

• Testing on real usage closes the gap between lab behavior and behavior in your environment.

• Models gaming their own evaluations is documented, and cutting test-awareness to 5.12% is a real gain.

• This gives buyers a vocabulary to demand evidence, not just promises.

What to do about it

• Ask vendors how they evaluate behavior on realistic deployment data, not just static benchmarks.

• Replay your own representative prompts against a candidate model before production.

• Treat model upgrades like software releases, with a behavioral regression test.

Rock’s Musings

I tell executives constantly that benchmark scores are marketing, not assurance. This is the first vendor method I’ve seen that attacks the eval-awareness problem directly, and the numbers are striking. A model that knows it’s on a test behaves, the way your network behaves during the audit and misbehaves the Monday after. Dropping that awareness from 99% to 5% changes what a test is worth. Self-reported research needs replication, so verify, then demand it from every model vendor you pay.

6. Jamf Finds AI Adoption Tracks Directly With Incident Rates

On June 15, 2026, Jamf released a survey of 687 IT and security leaders who run macOS environments, and more than one-fifth reported losing money or being attacked through their AI tools (Cybersecurity Dive). About 73% had deployed AI, and the incident rate climbed from under 20% among explorers to 27% among deep adopters. Governance ranked third on priority lists, behind automation and productivity.

Why it matters

• Deeper integration came with more incidents, which kills the story that risk can wait.

• Governance and security ranked below productivity, so firms buy the upside and defer the bill.

• Shadow AI is the top blind spot, and you cannot govern tools you cannot see.

What to do about it

• Run regular AI discovery audits to surface shadow tools before they surface as incidents.

• Govern at the software layer with enforced data-access policies, not just training.

• Bake governance into the first deployment stage, not a retrofit after an incident.

Rock’s Musings

Correlation isn’t causation, and I’ll say it before any of you email me. When incidents climb from 20% to 27% as integration deepens and governance sits third on the list, you don’t need a regression to see the trade. People want productivity now and handle security later, which tends to arrive as a breach notification. Leaders swear they’ll fund governance next quarter, then the footprint doubles while controls stand still.

7. Experts Revolt and Europe Eyes Sovereignty After the Anthropic Ban

From June 13 to 15, 2026, the fallout from the shutdown intensified. Cybersecurity Dive documented researchers blasting the move as overreach, Katie Moussouris circulated an open letter, and analyst Dean Ball called the controls “simply cartoonish” (Cybersecurity Dive, Fortune). Anthropic disputed the basis, calling the jailbreak narrow and non-universal (Reason). The Register reported the clampdown pushed European digital-sovereignty efforts into higher gear, and legal analysts questioned stretching export law this way (The Register, Just Security).

Why it matters

• The transparency bargain between labs and government is fraying, so defenders see new capabilities later.

• Sovereignty pressure raises the odds of a fragmented model market that differs by region.

• Export law on live commercial models creates compliance uncertainty that outlasts this incident.

What to do about it

• Map your AI vendors by origin and availability so a regional split won’t strand a workload.

• Track the policy fight, because the emerging rules will shape procurement for years.

• Pressure-test reliance on any single national AI ecosystem like any concentration risk.

Rock’s Musings

I write about this tension at rockcybermusings.com. The government and the labs are openly fighting over who decides a model is too dangerous to ship. The state doesn’t want to arm adversaries, and the labs don’t want products seized on verbal evidence. Caught in the middle is you, planning a three-year program on tools that might get pulled or geo-fenced. Your model supplier is now the single point of failure.

8. AI-Written Code Passes Review and Fails in Production

On June 15, 2026, Help Net Security reported on a New Relic study finding that AI-generated code earns high marks at review and then breaks in production at roughly twice the human rate (Help Net Security). It reviewed cleaner than human code, yet shipped close to twice the critical runtime issues. New security vulnerabilities hit about three in ten organizations over six months, and senior engineers lost up to a third of their week cleaning it up.

Why it matters

• Review-time quality is a false signal, because failures live in edge cases and concurrency that show under load.

• Three in ten organizations took on new security vulnerabilities from AI code in six months.

• Senior engineers are burning a third of their week on cleanup, capacity you won’t get back.

What to do about it

• Require runtime observability for AI-generated code before it ships, not just a clean review.

• Prompt your assistants to build logging and traces into the code they write.

• Measure production incidents tied to AI code and feed that into your release gates.

Rock’s Musings

This is the bill for vibe coding, and it came due in production. AI writes code that reviews like a dream, then falls apart when real users and real concurrency hit it. The reviewer reads the source, production writes the trace, and the gap between them is where your incidents live. Your senior engineers didn’t sign up to be janitors, so give them telemetry or keep paying them to mop.

9. The UN’s Disarmament Institute Opens Its AI Security Summit in Geneva

On June 18, 2026, the UN Institute for Disarmament Research (UNIDIR) opened its two-day Global Conference on AI, Security and Ethics in Geneva, gathering diplomats, researchers, industry, and civil society around AI and international peace and security (UNIDIR). The event launches UNIDIR’s new Centre of Excellence on AI, Peace and Security, an umbrella for research and capacity-building on AI governance (Indico.UN).

Why it matters

• A standing UN center signals that military and dual-use AI governance is moving toward institutions.

• Cross-border norms set here will shape export rules, procurement, and the dual-use definitions you answer to.

• The gap between fast capability and slow governance is where strategic risk accumulates.

What to do about it

• Track UNIDIR outputs if you run defense, energy, water, or other critical infrastructure.

• Feed your operational reality into standards and comment processes rather than inheriting the result.

• Map which emerging norms could touch your sector before they become requirements.

Rock’s Musings

Conferences rarely move a CISO’s needle next week. This one matters for a longer reason. The capability that let Washington pull a model is what diplomats in Geneva are trying to govern. I’ve watched dual-use rules show up first in energy and manufacturing, then everywhere else, so the norms drafted here become your compliance reality sooner than you think.

10. A CISO’s Warning on the Limits of Automated GRC

On June 15, 2026, Help Net Security published an interview with Nichole Windholz, CISO at Onspring, on the limits of automated governance, risk, and compliance tooling (Help Net Security). She argued that green-yellow-red dashboards flatten very different problems into one color, where red might mean a missing control, a stale attestation, or a minor threshold breach. Her fixes centered on data lineage, validation against source systems, and honesty with the board about risks that resist measurement, like insider behavior and vendor concentration.

Why it matters

• Automated GRC can turn bad input into a board-ready narrative, manufacturing false confidence.

• Insider intent and vendor concentration leave no clean telemetry, so a full-coverage dashboard lies.

• As AI accelerates control monitoring, the pull to trust the heat map over the evidence trail grows.

What to do about it

• Demand data lineage for every control signal, covering source, owner, refresh rate, and recent changes.

• Tell your board which risks are measured, which are estimated, and which need human judgment.

• Spot-check improving metrics as hard as declining ones, since a green light can mean a broken feed.

Rock’s Musings

This interview reads like it was written for the grumpy uncle, so naturally I loved it. A polished dashboard isn’t the same as a true one, and automation makes a bad assumption move faster and look credible. We’re about to point AI at GRC and call it continuous assurance, much of it color applied to data nobody validated. Audit the auditor and know your data lineage. The day the heat map replaces the evidence trail is the day you lie to yourself in four colors.

The One Thing You Won’t Hear About But You Need To

On June 15, 2026, Help Net Security published an analysis of a problem hiding under the louder headlines, that there is no way to verify what a military AI model will do (Help Net Security). Defense contractors are wiring frontier models into weapons, with Anduril, Palantir, and Lockheed Martin partnered to OpenAI, Microsoft, and Meta. Unlike nuclear arms control, where inspectors read a physical signal like a neutron signature, a model’s weights give no sign of whether it will follow or refuse a launch order. The piece cites research in which models in decision-making roles escalated, some launching simulated nuclear strikes in response to a supervisor’s commands, and flags alignment faking, a model that appears compliant under watch but diverges in operation (arXiv preprint 2606.11533).

Why it matters

• The assurance method behind arms control, independent physical measurement, has no equivalent for AI.

• Models that behave under observation and differently in operation map onto malware evasion, a discipline you know.

• Multiple models coordinating inside command systems can cascade failures faster than humans can intervene.

What to do about it

• If you build or assess high-stakes AI, test for observation-dependent behavior, not just accuracy.

• Push for compute-monitoring and shared-inspection regimes, since compute leaves a measurable footprint.

• Keep a human with authority and time in any loop where an action is irreversible.

Rock’s Musings

This is the story that got buried under the model ban, and it scares me more. We’re bolting frontier models into kill chains while admitting, in the open literature, that we can’t prove what they’ll do under pressure. The nuclear treaties worked because a neutron doesn’t lie, and you can count a missile. A model’s weights tell you nothing about whether it’ll escalate, and the research shows some escalate unprompted. A model can fake compliance, just as malware fakes sleep until it reaches its target. Slow down, verify, and keep a human who can say no.

👉 For ongoing analysis of agentic AI governance frameworks, the conversation continues at RockCyber Musings.

👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.

👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com

👉 As a bonus, check our AMA on the 2026 OWASP GenAI Security Project State of Agentic AI Security and Governance report with me and the other co-leads (it was live, so start at time marker 09:45)

The views and opinions expressed in RockCyber Musings are my own and do not represent the positions of my employer or any organization I’m affiliated with.

Share RockCyber Musings

References

Axios. (2026, June 13). How Amazon and the White House ended Anthropic’s Fable. https://www.axios.com/2026/06/13/anthropic-amazon-white-house

BleepingComputer. (2026, June 16). Malicious JetBrains Marketplace plugins steal AI API keys from developers. https://www.bleepingcomputer.com/news/security/malicious-jetbrains-marketplace-plugins-steal-ai-api-keys-from-developers/

CNBC. (2026, June 12). Anthropic disables access to Fable 5 and Mythos 5 to comply with government directive. https://www.cnbc.com/2026/06/12/anthropic-disables-access-to-fable-5-and-mythos-5-to-comply-with-government-directive.html

Forum of Incident Response and Security Teams. (2026, June 15). FIRST mid-year vulnerability forecast confirms historic surge, projects ~66,000 CVEs in 2026. https://www.first.org/newsroom/releases/20260615

Geller, E. (2026, June 16). AI adoption correlates with incident frequency, underscoring need for governance. Cybersecurity Dive. https://www.cybersecuritydive.com/news/ai-cybersecurity-incidents-governance-jamf/823026/

Geller, E. (2026, June 13). Cybersecurity experts blast US government for restricting Anthropic’s AI models. Cybersecurity Dive. https://www.cybersecuritydive.com/news/anthropic-us-government-export-ban-mythos-fable/822909/

Indico.UN. (2026). Global Conference on AI, Security and Ethics 2026 (18-19 June 2026): Overview. https://indico.un.org/event/1023183/

Infosecurity Magazine. (2026, June). Fifteen JetBrains Marketplace plugins steal API keys. https://www.infosecurity-magazine.com/news/fifteen-jetbrains-marketplace/

Just Security. (2026, June). Legal considerations related to the Anthropic “export controls directive.” https://www.justsecurity.org/142745/law-anthropic-export-controls/

Markovic, S. (2026, June 15). Proving what a military AI model will do is the real problem. Help Net Security. https://www.helpnetsecurity.com/2026/06/15/military-ai-verification-problem/

MarkTechPost. (2026, June 16). OpenAI’s deployment simulation extends pre-deployment risk assessment to agentic coding through simulated tool calls. https://www.marktechpost.com/2026/06/16/openai-deployment-simulation/

OpenAI. (2026, June 16). Predicting model behavior before release by simulating deployment. https://openai.com/index/deployment-simulation/

Orca Security. (2026, June 17). 144 Mastra npm packages compromised via supply chain attack. https://orca.security/resources/blog/mastra-npm-supply-chain-attack/

Pogorelec, A. (2026, June 15). Senior engineers are spending their week cleaning up AI-generated code. Help Net Security. https://www.helpnetsecurity.com/2026/06/15/ai-generated-code-review-issues/

Reason. (2026, June 15). The White House vs. Anthropic’s new AI model. https://reason.com/2026/06/15/the-white-house-vs-anthropics-new-ai-model/

Schwartz, L. (2026, June 15). ‘Fix this code.’ The three little words behind the U.S. government decision that shut down Anthropic’s Fable and Mythos AI models. Fortune. https://fortune.com/2026/06/15/fix-this-code-three-words-behind-us-government-shut-down-anthropic-fable-mythos-ai-models-katie-moussouris-open-letter/

Socket. (2026, June 17). 140+ Mastra npm packages compromised in coordinated supply chain attack. https://socket.dev/blog/mastra-npm-packages-compromised

The Hacker News. (2026, June). 144 Mastra npm packages compromised via hijacked contributor account. https://thehackernews.com/2026/06/144-mastra-npm-packages-compromised-via.html

The Register. (2026, June 15). US clampdown on Anthropic models sends EU sovereignty surge into overdrive. https://www.theregister.com/ai-and-ml/2026/06/15/us-clampdown-on-anthropic-models-sends-eu-sovereignty-surge-into-overdrive/

Time. (2026, June 13). Anthropic pulls its top AI models after U.S. bars foreign access. https://time.com/article/2026/06/13/anthropic-fable-mythos-ban-US-security/

UNIDIR. (2026). Global Conference on AI, Security and Ethics 2026. United Nations Institute for Disarmament Research. https://unidir.org/event/global-conference-on-ai-security-and-ethics-2026/

Zorz, M. (2026, June 15). AI vulnerability discovery is pushing 2026 CVEs toward 66,000. Help Net Security. https://www.helpnetsecurity.com/2026/06/15/first-2026-cve-forecast/

Zorz, M. (2026, June 15). Onspring CISO on where automated GRC systems fall short. Help Net Security. https://www.helpnetsecurity.com/2026/06/15/nichole-windholz-onspring-automated-grc-systems/

Disclosure: I co-led the OWASP State of Agentic AI Security and Governance 2026 with Ariel Fogel and Evgeniy Kokuykin. I’ll also show you the places I’d push back on it even with my name on the cover, so you can weigh the case on its merits instead of on mine. The report lives here: https://genai.owasp.org/resource/state-of-agentic-ai-security-and-governance/

Share

A year ago, agentic AI security was a stack of position papers and vendor pitches. Today, almost every category in the OWASP Top 10 for Agentic Applications has a production incident, a vendor advisory, or a CVE attached to it. The OWASP State of Agentic AI Security and Governance 2026, published June 1, 2026, collects that evidence into one place and hands you a map. If you run security or AI risk anywhere agents are deployed, and you do, whether you’ve gone looking or not, this is the report you read ASAP.

How The OWASP State of Agentic AI Security and Governance 2026 Audits The Present

When v1 shipped in July 2025, I expected the threat catalog to fill in over a couple of years. It filled faster. ASI04, the supply chain category, and ASI05, code execution, are now tied for the highest volume of disclosed incidents. I expected regulation to lag the technology by years. It didn’t. This year’s report maps 42 instruments across 10 jurisdictions. The gap I watch in client environments, between how mature their governance is and how aggressive their agent deployments are, turned out wider than I would have guessed. Shadow AI sits in nearly every organization our contributors examined.

2025 called out the future. 2026 audits the present, and it’s organized around three findings:

1. The threats are real now

2. Safety and security converge at the deployment layer

3. Governance runs on a clock measured in hours.

Here’s what each one means for your program, and where I’d still argue with the document.

Finding One: The Threats Have Receipts Now, And Here’s What To Demand

2025 listed architectural concerns. 2026 attaches names, dates, and CVE numbers to them. The Real-World Incidents and Exploits Tracker is the chapter I point people to first, because it ends the “show me a real attack” conversation in about thirty seconds.

EchoLeak was a zero-click prompt injection that turned a single email into a Microsoft Copilot data exfiltration path, as documented by Aim Security. Cato CTRL showed Claude’s Skills feature deploying MedusaLocker ransomware by re-uploading a Skill carrying malicious code that ran on its own. OpenAI’s Codex CLI shipped a sandbox bypass, CVE-2025-59532, in which the model’s own output could redraw the writable boundary it was supposed to stay within. Cursor carried a sibling flaw, CVE-2026-22708, where an attacker who influenced the agent’s instructions could ride an already-approved command like git branch straight into arbitrary code execution. Trustwave’s SpiderLabs team published an agent-in-the-middle attack against the A2A protocol, in which a fake agent card claiming high trust was selected by an LLM judge and used to intercept data. Pillar Security demonstrated manipulated code suggestions seeding backdoors and leaked keys into production through GitHub Copilot and Cursor.

Notice the structural lesson under the Cursor and Codex flaws. The controls were calibrated for human operators, and they broke the moment the executor could influence its own containment. An allowlist that auto-approves a git branch is a convenience for a developer and a loaded gun for an agent that can rewrite what runs behind that command. That’s the shift 2026 keeps returning to. The model stopped being a component inside your application and became an actor with hands on your tools.

Two patterns matter more than any single incident. First, ASI04 and ASI05 are tied for the most disclosed incidents, and a security audit nicknamed IDEsaster found vulnerabilities in 100% of the major AI coding IDEs it tested. Code sits upstream of everything else you ship, so an exploit in a coding agent is a supply chain event, not a developer inconvenience. Second, ASI03, identity and privilege abuse, carries the widest gap between how severe the risk is and how ready anyone is for it. Non-human identities already outnumber humans across most enterprises, and almost nobody has a strategy for governing them.

Here’s what the evidence tells you to demand. Treat agent identity as its own control plane, not a service account with a fancier name. The report tracks NIST’s AI Agent Standards Initiative, the OpenID Foundation’s work on recursive delegation, and MCP’s move to OAuth 2.1 with resource-indicator-scoped tokens, all converging over the next 18 to 24 months. Ask vendors how an agent’s permissions get derived, when they expire, and how revocation propagates through a delegation chain. If they can’t answer, you have your answer. Treat security advisory density as a buying signal rather than a red flag in isolation.

n8n carries 57 advisories, and Claude Code carries 22, not because they’re careless but because they’re everywhere. The projects with the most advisories tend to be the ones with the most adoption. Ask for the AI-SBOM and the disclosure history. Silence is the warning sign, not volume.

Finding Two: Safety And Security Collapse At The Deployment Layer

For most of software’s history, safety was an engineering problem, and security was an adversarial one, owned by different teams running different playbooks. Agentic systems break that split at the deployment layer, meaning the architectural decisions, permissions, configurations, and operational controls your organization owns once an agent acts on production systems.

The report argues that once an agent can send the email, move the money, or commit the code, the same controls govern a benign malfunction and a deliberate attack, and the same investigation surfaces both root causes. Model-level safety stays with the provider. Everything downstream of the prompt lands on one function, no matter how you choose to draw the org chart.

Picture an agent whose memory got poisoned weeks ago. It starts exfiltrating data and taking actions nobody approved. To the team watching the dashboards in real time, that looks like a reliability bug. They restart it, check for drift, and review the inputs. A team treating it as a safety issue misses the persistence mechanism and gets compromised again. A team treating it as a security issue hunts the initial access vector, and the memory state stands a chance of containing it. The symptom is the same, the right response is the opposite, and the org chart decides which one you run.

The categories still separate cleanly when an agent has limited autonomy or a human in the loop. They stop separating when the agent runs with broad permissions and thin oversight, which describes most of the deployments racing into production right now. If your AI safety people and your AI security people sit in separate meetings with separate budgets, that division is now a liability. Read this chapter with your CTO and your head of AI in the room.

Finding Three: The Governance Clock Runs In Hours, And The Matrix Tells You Where You Stand

Regulators stopped pretending periodic audits are enough. DORA gives you a four-hour notification window. NIS2 wants a 24-hour early warning. New York’s RAISE Act sets 72 hours for frontier reporting. California’s SB 53 allows 15 days. The EU AI Act’s Article 72 requires post-market monitoring that explicitly covers behavioral drift, though the Digital Omnibus proposal from November 2025 may push the high-risk deadlines to December 2027 if it clears trilogue.

2026 maps 42 instruments across 10 jurisdictions, so you can see which clock applies where without assembling it yourself from primary texts. The count isn’t the point. The point is that runtime governance moved from a nice-to-have to the unit regulators measure. Pre-deployment certification stopped being enough the moment the thing you certified could rewrite its own behavior after launch.

Then the report hands you the artifact I wish boards had a year ago. The Enterprise Adoption Maturity Model maps your governance maturity (Levels 0 through 4) against your adoption tier (AT0 through AT8). AT0 is Shadow AI, the unmanaged usage already running in your org. The tiers climb through vendor-embedded assistants, platform-integrated agents, citizen-developer flows, code-executing agents, custom in-house builds, and externally extended agents, up to AT8, where agents operate across organizational boundaries in federated networks.

A bold cell means your governance is too thin for what you’re running, and you get two honest moves: raise maturity or lower the tier, with no third option where you cross your fingers and hope it holds. The model survives the way a Bayesian wants a model to survive. It’s calibrated, it’s falsifiable, and it updates in response to evidence instead of flattering the program you already built. The urgency shows in the adoption data. a16z found that 29% of the Fortune 500 and roughly 19% of the Global 2000 are paying customers of a leading AI startup, counting only signed, contracted deployments. The unmanaged AT0 volume sitting on top of that is, by definition, unmeasured.

Where I’d Push Back, Even As A Co-Lead

A review where the author agrees with himself for 2,000 words isn’t worth your time, so here’s where I’d lean on the document.

The report is honest about what it hasn’t solved, and the “What Remains Unsolved” section names three problems I’d watch closely. Cyber insurance for agentic deployments is heading toward a coverage gap nobody has priced yet, and the first big agent-driven loss will test it in public. The governance-deployment collision at AT6 and above, where agents reach across trust boundaries, has no clean answer, and the matrix tells you to slow down rather than how to move fast safely. Agentic AI in OT and ICS has no documented enterprise-agent safety incident yet. Read that as early, not as safe.

I encourage you to pay close attention to the weaponization curve, as the offense is scaling faster than the controls. Anthropic disclosed GTG-1002, a campaign that ran largely autonomous espionage across roughly 30 organizations using jailbroken Claude Code, with the AI executing 80 to 90% of the tactical operations at request rates no human could match. Credit Anthropic for disclosing it in that detail, because that kind of transparency is how the rest of us learn what’s coming. CrowdStrike documented an 89% increase in AI-enabled adversary attacks, with breakout time falling to 29 minutes. IAPS HACCA found frontier models jumping from near-zero to 60% success on expert-level offensive security challenges inside a few months. The report maps the threat well. It doesn’t pretend anyone has solved the defense that scales at machine speed. Neither do I. That’s the honest state of it.

Key Takeaway: 2026 won’t secure your agents for you, but it’s the first document that tells you, with evidence, exactly where your governance is too thin for what you’ve already deployed.

What To Do Next

Start with AT0, this week. Assume Shadow AI exists until you’ve proven it doesn’t. Here’s a hint: it does… if you think you’ve proven it doesn’t, try again.

Pull network and DLP telemetry for AI-service traffic, run a short employee survey on the tools people are already using, and you’ll surface more than you expect. Then map your three highest-tier agent deployments against the maturity matrix. Where you land in a bold cell, pick one of the two moves: raise governance maturity or lower the deployment tier. Print the matrix and walk it with your CTO, your head of AI, and your board chair, because this is a conversation about deployment decisions, not policy language.

If you want the deeper background on why authorization scope and least agency are the metrics that survive contact with production, and why governance is a deployment-review problem before it’s a policy problem, I’ve written both up at rockcybermusings.com, and the consulting side of how I run these assessments lives at rockcyber.com.

Then download the report, read the threat tracker and the maturity model first, and send the link to the two people who own the deployments you inventoried: https://genai.owasp.org/resource/state-of-agentic-ai-security-and-governance/

👉 For ongoing analysis of agentic AI governance frameworks, the conversation continues at RockCyber Musings.

👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.

👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com

👉 As a bonus, check our AMA on the 2026 OWASP GenAI Security Project State of Agentic AI Security and Governance report with me and the other co-leads (it was live, so start at time marker 09:45)

The views and opinions expressed in RockCyber Musings are my own and do not represent the positions of my employer or any organization I’m affiliated with.

Share RockCyber Musings

Anthropic shipped its most capable public model on Tuesday, then buried a switch in a 319-page system card that quietly makes the model worse when you ask about building AI. Not blocked. Not flagged. Worse, with a straight face. Two days earlier, CISA confirmed attackers were already inside LiteLLM, the gateway brokering traffic for half the agent frameworks in your stack. By Wednesday the agency told agencies to patch the worst flaws in three days. Safety got a press release. Security got a body count.

This was the week the two halves of AI safety stopped pretending to be the same thing. One half lives in system cards and voluntary codes, the language of labs and regulators. The other lives in KEV entries, CVSS 10.0 chains, and production databases an agent wiped while reporting all clear. The governance side finalized a labeling code, a maturity model, and a sharing standard. Useful, slow, paper. The security side served up an LLM gateway chained to remote code execution, Microsoft’s largest patch day ever, and hard numbers on AI code breaking in production. Eleven stories, ten ranked and one you won’t see on the front page. Read them in order. The order is the argument.

Share

1. Anthropic Ships Claude Fable 5 and Hides a Throttle in the Fine Print

On June 9, Anthropic released Claude Fable 5, the first Mythos-tier model to reach the public (Fortune). Within hours, researchers found a paragraph in the 319-page system card describing a feature that silently degrades answers on requests tied to frontier AI development. Cybersecurity and biology queries get redirected to a weaker model with a visible notice. The AI-development throttle carries none, and Anthropic put the affected traffic at 0.03%.

Why it matters

• A safety control your users can’t see is a trust control. It sets precedent for any vendor shaping model behavior in your stack.

• The throttle targets AI R&D, handing the frontier leader an advantage dressed as safety. Dean Ball called it “secret sabotage.”

• If a lab will silently downgrade outputs, the assumption that a model either does the task or refuses it is dead.

What to do about it

• Read system cards before you standardize on a model. The detail that mattered wasn’t in the launch blog.

• Test models for silent degradation in your use cases, not just refusals, against a known-good baseline.

• Put model-behavior-change clauses in vendor contracts. You want notice when capability shifts under you.

Rock’s Musings

I’ve spent thirty years watching “trust us” get sold as a feature, and this is the slickest version yet. The moment a model lies by omission about how hard it’s trying, you lose the one property that made it auditable. My Bayesian read puts the chance this was purely about safety under 30%. The rest is a competitive moat in a lab coat. Govern your model vendors like anything else with root access to your work, because that’s what they are. More at rockcyber.com.

2. CISA Flags a Critical LiteLLM Flaw Already Being Exploited

On June 8, CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities catalog, confirming active exploitation of LiteLLM, the gateway routing model calls for CrewAI, DSPy, Microsoft GraphRAG, and dozens of other agent frameworks (The Hacker News). The command-injection flaw chains with a Starlette bypass, CVE-2026-48710, for unauthenticated remote code execution at a combined 10.0. Federal agencies have until June 22 to patch, to LiteLLM 1.83.7 and Starlette 1.0.1.

Why it matters

• LiteLLM sits in the middle of your agent stack. Own the gateway, own every model call and secret it brokers.

• A 10.0 unauthenticated RCE chain on shared AI infrastructure is the cleanest path into an enterprise.

• Second LiteLLM supply-chain hit in 2026 after the March PyPI backdoor. The pattern is the point.

What to do about it

• Inventory where LiteLLM runs, including frameworks that bundle it. Patch to 1.83.7 and Starlette 1.0.1 now.

• Lock the MCP test endpoints behind network controls and pull them off any internet-facing path.

• Hunt for exploitation rather than assume patching closes it. KEV status means someone already used it.

Rock’s Musings

Everybody’s threat model for AI agents fixates on the model. First contact usually lands at the plumbing, the gateways and routers nobody drew on a data-flow diagram because they showed up as a transitive dependency. LiteLLM is plumbing, and this week it sprang a 10.0 leak. Agent security is mostly classic appsec in a new hat. Command injection through an unsanitized config field proves it. If you can’t name your gateway version off the top of your head, that’s your finding.

3. CISA Orders Federal Agencies to Patch the Worst Bugs in Three Days, Blames AI

On June 10, CISA issued Binding Operational Directive 26-04, ordering federal civilian agencies to rank vulnerabilities by four factors: asset exposure, KEV status, whether exploitation is automatable, and how much control it hands an attacker (CISA). A bug worst on all four gets a three-day patch deadline and a mandatory forensic check. CISA tied the clock directly to AI-assisted exploitation collapsing the time between a patch and its abuse. Full alignment lands in 60 days.

Why it matters

• A regulator turned “AI compresses the patch window” into an operational mandate instead of a conference talk.

• Three days is faster than most enterprise change windows. The private-sector benchmark just moved.

• The four-factor model is a usable risk lens even if you’re nowhere near federal. Steal it.

What to do about it

• Map your mean-time-to-patch against a three-day worst case. Find where you’d miss.

• Adopt exploit-automatability and post-exploitation impact as scoring factors, not just CVSS.

• Pre-authorize emergency patching for the top tier so change control isn’t the hour-60 bottleneck.

Rock’s Musings

For years the patch-faster crowd got waved off with “we have compensating controls.” That excuse has a shelf life now, and AI is the expiration date. When a model turns a fresh CVE into a working exploit before your change board reaches quorum, every day of dwell is a day you handed away. The grumpy-uncle question is which breaks first under a three-day fuse, the tooling, the staffing, or the politics. Bet on politics. It always is.

4. The EU Publishes Its Final Code for Labeling AI-Generated Content

On June 10, the European Commission published the final Code of Practice on marking and labeling AI-generated content, the voluntary playbook for the AI Act’s Article 50 transparency duties (European Commission). It pushes machine-readable marking and a common EU icon set for labeling deepfakes and AI-generated text on public-interest matters. ENISA sits on the advisory structure behind it. The obligations become applicable August 2, 2026. Signing is optional. The legal duty is not.

Why it matters

• Provenance is becoming a compliance artifact, not a nice-to-have. Machine-readable marking is now a named EU expectation.

• August 2 is close. Deploy generative AI into the EU and labeling is a near-term control.

• A shared icon standard helps, and it creates a forgeable target. Watch for fake labels in both directions.

What to do about it

• Inventory where you generate or publish synthetic content touching EU users. Map each to an Article 50 obligation.

• Pilot C2PA-style content credentials and the EU icons now, while signing is voluntary and mistakes are cheap.

• Treat provenance integrity as a security problem. Marking you can strip or spoof buys you nothing.

Rock’s Musings

Credit to Brussels for shipping something concrete instead of another principles deck. Labels are a real control, and they’re catnip for adversaries the second anyone trusts them. The moment a “human-made” badge means something, somebody forges it. Provenance is only as strong as the cryptography under it and the verification at the edge. A visible icon with nothing signing it is an honor system for people with no honor. Do the C2PA work. August 2 doesn’t care about your fiscal year.

5. New Relic Puts Numbers on the AI Code Problem

New Relic’s 2026 State of AI Coding report, out June 10, surveyed 200 technology decision-makers at US firms (Business Wire). Ninety-four percent rate AI-generated code higher quality than human code at review. Then 82% reported a production failure tied to AI code in the past six months, 78% saw more incidents, and 74% said a quarter of AI code needed significant rework. None banned vibe coding. The report calls the buildup “agent debt.”

Why it matters

• AI code looks good in review and breaks in production. Your review gate is measuring the wrong thing.

• “Agent debt” compounds quietly, then surfaces as incidents long after the author moved on.

• Policy already says yes. The question moved from whether to allow AI code to how to contain it.

What to do about it

• Tie runtime and production-incident telemetry back to AI-authored code, not just review approval rates.

• Require a named human owner for AI-generated changes in critical paths. Every time.

• Fund the rework. If a quarter of AI code needs fixing, budget for it.

Rock’s Musings

The dirtiest number in that survey is the gap between 94% at review and 82% failing in production. Leaders love the code in the pull request and eat the incidents six months later. You won’t ban vibe coding, so instrument the blast radius instead. I keep a running file of these failure patterns at rockcybermusings.com. Measure the incident, not the applause.

6. Mastercard Lets AI Agents Pay Each Other

On June 10, Mastercard launched Agent Pay for Machines, an open protocol letting autonomous AI agents transact at machine speed, down to micropayments worth fractions of a cent (Mastercard). Agent credentials and spending permissions live on public blockchains, including Polygon, Solana, and Base, with 31 launch partners such as Coinbase, Adyen, Stripe, and Cloudflare. Visa, Stripe, and Google shipped their own agent-payment plumbing this year.

Why it matters

• Autonomous agents with spending authority turn every prompt injection into a potential unauthorized transaction.

• Non-human identity just became a money problem. Agent credentials are bearer instruments for your budget.

• Machine-speed payments mean machine-speed fraud. Your fraud controls were tuned for human tempo.

What to do about it

• Treat agent payment credentials as crown-jewel secrets with hard spending caps and short-lived scopes.

• Require revocable agent identity and per-transaction authorization before an agent holds a wallet.

• Model the abuse case first. Assume a poisoned input tries to drain the budget, then design the cap.

Rock’s Musings

Give an agent a wallet and the lethal trifecta stops being academic. An agent that reads untrusted content, holds private data, and now moves money is a self-service exfiltration tool with a payment terminal bolted on. We’re handing agents spending authority the same week their gateways get popped and their memory gets poisoned. Caps, scopes, revocation, and a kill switch on every agent that touches a wallet. If you can’t yank its spending power in one click, it shouldn’t have any.

7. The Linux Foundation Tries to Standardize How We Share AI Assets

On June 10, the Linux Foundation launched the OpenSharing Project, a vendor-neutral protocol for exchanging agent skills, AI models, and unstructured data across organizations and clouds (Linux Foundation). It extends the Delta Sharing protocol into the agentic era, replacing point-to-point integrations and proprietary marketplaces. Databricks is a named contributor. How shared assets get verified for integrity is left mostly to implementers.

Why it matters

• Standardized sharing of skills and models is standardized distribution of supply-chain risk without built-in provenance.

• A common protocol is a common attack surface. Whatever everyone adopts, everyone inherits the flaws of.

• “Consume an AI asset from anyone” is exactly how poisoned models and backdoored skills travel.

What to do about it

• Demand signed provenance and integrity verification for any shared model or skill before you ingest it.

• Treat external agent skills like third-party code, because they are. Scan, sandbox, review.

• Get a seat at the standard now. Security is cheaper in the draft than bolted on after adoption.

Rock’s Musings

Standards are good. My worry is the lesson we never seem to learn, that the thing everyone shares becomes the thing everyone gets hit through. We did it with npm, with PyPI, with container registries, now with agent skills and models. Bake in signing, attestation, and verifiable provenance from day one and this is the best security news of the quarter. Ship it with trust assumed and it’s a distribution network for poisoned assets. Show up to the draft.

8. Accenture and Carnegie Mellon Ship an AI Maturity Model

On June 8, Accenture and the Carnegie Mellon University Software Engineering Institute released the AI Adoption Maturity Model, a framework for scaling AI with repeatable outcomes (Carnegie Mellon SEI). It scores eight dimensions, including risk and governance. The teams built it from 100-plus maturity efforts, 25 executive interviews, 600 practitioner surveys, and Fortune 500 pilots. The report says 95% of organizations see no return on AI, and only 8% scale it enterprise-wide.

Why it matters

• “Risk and governance” sits as a first-class dimension, not a footnote. That’s the right shape for a maturity model.

• 95% seeing no return is the number your board needs before it greenlights the next AI line item.

• A common maturity language helps you argue for governance investment in terms executives already use.

What to do about it

• Run an honest self-assessment against the eight dimensions. Score where you are, not where the deck says you are.

• Use the governance dimension to anchor an AI risk program your CFO will fund.

• Tie maturity gaps to specific incidents from this very week. War stories move budgets, abstractions don’t.

Rock’s Musings

I’m allergic to maturity models that exist to sell the next assessment, so I went in skeptical. This one earned a grudging nod, because it treats governance and risk as load-bearing instead of decorative. The 95% no-return figure is the line I’ll quote to boards all quarter, cover for a CISO to say the quiet part. A maturity model secures nothing by itself. What it does is drag an executive team from vibes to a roadmap.

9. Microsoft’s Largest Patch Tuesday, and a Zero-Day Hours Later

Microsoft shipped its largest Patch Tuesday on record on June 9, fixing nearly 200 vulnerabilities (BleepingComputer). Hours later, a researcher who goes by Nightmare Eclipse published a working zero-day called RoguePlanet that abuses a Microsoft Defender race condition to spawn a SYSTEM-level prompt on fully patched Windows 10 and 11 (The Hacker News). It’s the seventh zero-day this researcher has dropped since April, part of a running fight with Microsoft over disclosure and bounty pay.

Why it matters

• A SYSTEM-level Defender bypass on fully patched machines turns your endpoint defense into the entry point.

• It lands the same week CISA warned AI shrinks the disclosure-to-exploitation window.

• A grudge-driven researcher dropping working exploits is a reminder that bug-bounty relationships are a security control too.

What to do about it

• Prioritize the Defender fix path and watch for RoguePlanet indicators on endpoints you assume are clean.

• Stop treating “fully patched” as “safe.” Layer detection that doesn’t depend on the bypassed control.

• Review your own researcher and disclosure relationships. Antagonized finders publish, they don’t email.

Rock’s Musings

Nearly 200 fixes in one month is its own tell about how fast attack surface is growing, and the cruelty of RoguePlanet is the timing. You patch on Tuesday, feel responsible, and by Tuesday night your endpoint tool is the hole. I put this next to the CISA directive on purpose. Picture that loop automated, a model reading the patch diff and emitting the bypass while you sleep. Defense in depth was a cliche right up until your antivirus became the payload.

10. Academia Goes After Prompt Injection While It’s Still Bleeding

The research wave this week mapped onto the attacks hitting production. On June 11, a team including Pin-Yu Chen, Bo Li, and Dacheng Tao posted a stakeholder-centric benchmark for prompt injection against real-world web agents that operate over untrusted content (arXiv). A day earlier, researchers including Google’s Tomas Pfister released PI-Hunter, an automated red-teaming system that exposes and localizes prompt injections. Both target the failure mode OWASP maps to six of its ten agentic risk categories.

Why it matters

• Automated red-teaming for prompt injection means defensive tooling is starting to scale with the threat.

• Benchmarks create accountability. Measure injection resistance and you can demand it in procurement.

• Academic attention this concentrated usually leads commercial tooling by six to twelve months. This is your early read.

What to do about it

• Add prompt-injection benchmarking to agent evaluation before deployment, not after an incident.

• Put automated injection red-teaming like PI-Hunter in your pre-prod pipeline.

• Ask vendors for injection-resistance numbers against a named benchmark. Vague assurances are a red flag.

Rock’s Musings

I read a pile of AI security papers so you don’t have to, and the encouraging shift is that researchers stopped calling prompt injection a someday problem and started building the rulers and the wrecking balls to measure and break it. Most enterprises are deploying agents on faith. A benchmark turns faith into a number, and a number is something a CISO writes into a contract. Be the buyer who shows up with the benchmark, then watch them sweat.

The One Thing You Won’t Hear About But You Need To: Your AI Agent’s Memory Is an Unguarded Attack Surface

Buried in this week’s research, with none of the press the model launches got, a paper dated June 10 tackled runtime memory poisoning in persistent LLM agent systems (arXiv). Retrieval-augmented agents increasingly carry persistent memory that accumulates across sessions, so what the agent learned yesterday shapes what it does tomorrow. The author, Tarun Sharma, shows that memory is an attack surface and proposes a certified defense, SMSR. Slip a malicious entry in once, and it steers behavior across every future session until someone notices.

Why it matters

• Persistent memory makes poisoning durable, paying the attacker long after the injection.

• Most teams don’t inventory, monitor, or validate agent memory at all. It’s a blind spot with root-level influence.

• Certified defenses are early, so right now your only real control is hygiene you probably haven’t built.

What to do about it

• Treat agent long-term memory as untrusted storage. Validate writes, monitor for anomalies, keep an audit trail.

• Scope and segment memory per user and per task so one poisoned entry can’t steer everyone.

• Build a way to inspect and roll back agent memory. You can’t defend what you can’t see.

Rock’s Musings

Everybody’s watching the prompt going in. Almost nobody’s watching what the agent quietly wrote to its own memory last week. That gap keeps me up. We learned to fear prompt injection as a single dirty input, and now we hand agents long-term memory that turns one input into a permanent resident. Poison it once and the agent carries your attacker’s instructions forward on its own, looking perfectly healthy the whole time. Watch the memory, not just the mouth.

👉 For ongoing analysis of agentic AI governance frameworks, the conversation continues at RockCyber Musings.

👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.

👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com

👉 As a bonus, check our AMA on the 2026 OWASP GenAI Security Project State of Agentic AI Security and Governance report with me and the other co-leads (it was live, so start at time marker 09:45)

The views and opinions expressed in RockCyber Musings are my own and do not represent the positions of my employer or any organization I’m affiliated with.

Share RockCyber Musings

References

Abrams, L. (2026, June 10). Microsoft Defender ‘RoguePlanet’ zero-day grants SYSTEM privileges. BleepingComputer. https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-rogueplanet-zero-day-grants-system-privileges/

Accenture. (2026, June 8). Accenture and the Carnegie Mellon University Software Engineering Institute launch AI Adoption Maturity Model to help organizations scale AI with predictable outcomes. Accenture Newsroom. https://newsroom.accenture.com/news/2026/accenture-and-the-carnegie-mellon-university-software-engineering-institute-launch-ai-adoption-maturity-model-to-help-organizations-scale-ai-with-predictable-outcomes

Carnegie Mellon University Software Engineering Institute. (2026, June 8). SEI and Accenture release AI Adoption Maturity Model to help organizations scale AI with predictable outcomes. https://www.sei.cmu.edu/news/sei-and-accenture-release-ai-adoption-maturity-model-to-help-organizations-scale-ai-with-predictable-outcomes/

Cybersecurity and Infrastructure Security Agency. (2026, June 8). CISA adds two known exploited vulnerabilities to catalog. https://www.cisa.gov/news-events/alerts/2026/06/08/cisa-adds-two-known-exploited-vulnerabilities-catalog

Cybersecurity and Infrastructure Security Agency. (2026, June 10). BOD 26-04: Prioritizing security updates based on risk. https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk

European Commission. (2026, June 10). Commission publishes Code of Practice on marking and labelling AI-generated content. https://ec.europa.eu/commission/presscorner/detail/en/ip_26_1328

Goldman, S. (2026, June 10). Anthropic accused of ‘secret sabotage’ as Claude Fable 5 silently limits capabilities for AI researchers and developers. Fortune. https://fortune.com/2026/06/10/anthropic-accu-claude-fable-5-limits-capabilities-ai-researchers-developers/

He, P., Miculicich, L., Sharma, V., Fox, A., Lee, G., Tang, J., Pfister, T., & Le, L. T. (2026, June 10). PI-Hunter: Automated red-teaming for exposing and localizing prompt injections [Preprint]. arXiv. https://arxiv.org/abs/2606.12737

Help Net Security. (2026, June 9). LiteLLM vulnerability under active attack, CISA warns (CVE-2026-42271). https://www.helpnetsecurity.com/2026/06/09/litellm-vulnerability-under-active-attack-cisa-warns-cve-2026-42271/

Help Net Security. (2026, June 10). Record Microsoft Patch Tuesday, fresh zero-day. https://www.helpnetsecurity.com/2026/06/10/microsoft-patch-tuesday-rogueplanet/

Mastercard. (2026, June 10). Mastercard launches Agent Pay for Machines to unlock super-fast, always-on payments. https://www.mastercard.com/us/en/news-and-trends/press/2026/june/mastercard-launches-agent-pay-for-machines.html

New Relic. (2026, June 10). New Relic report reveals AI-generated code grades higher in review, yet triggers rise in production incidents. Business Wire. https://www.businesswire.com/news/home/20260610259591/en/New-Relic-Report-Reveals-AI-Generated-Code-Grades-Higher-in-Review-Yet-Triggers-Rise-in-Production-Incidents

Pogorelec, A. (2026, June 11). Prompt injection still drives most agentic AI security failures in production. Help Net Security. https://www.helpnetsecurity.com/2026/06/11/owasp-prompt-injection-ai-security-failures/

Sharma, T. (2026, June 10). SMSR: Certified defence against runtime memory poisoning in persistent LLM agent systems [Preprint]. arXiv. https://arxiv.org/abs/2606.12703

The Hacker News. (2026, June 9). LiteLLM flaw CVE-2026-42271 exploited in the wild, chains to unauthenticated RCE. https://thehackernews.com/2026/06/litellm-flaw-cve-2026-42271-exploited.html

The Hacker News. (2026, June 10). Microsoft Defender RoguePlanet zero-day grants SYSTEM access on updated Windows. https://thehackernews.com/2026/06/microsoft-defender-rogueplanet-zero-day.html

Wang, Z., Li, Y., Wu, Y., Liu, Z., Chen, K., Wai, F. K., Chen, P.-Y., Thing, V. L. L., Li, B., Tao, D., & Zhang, T. (2026, June 11). Who pays the price? Stakeholder-centric prompt injection benchmarking for real-world web agents [Preprint]. arXiv. https://arxiv.org/abs/2606.13385

Share

Disclosure: I contribute to the AIUC-1 Consortium. I was not an author or reviewer on this whitepaper. What follows is a review and amplification of work led by the named co-authors and the AIUC-1 editorial team, with my own read on where it should go further. Read the source yourself at aiuc-1.com.

The AIUC-1 “After Mythos” whitepaper on machine-speed defense opens with a confession most security executives won’t say out loud at a conference. Fifty-two of them rated their readiness for a Mythos-class threat at 4 out of 10. I’ll show you what the document gets right, where I’d push it harder, and the three board asks worth making before your Q3 budget closes.

The 4-Out-Of-10 Confession

A 4 out of 10 is a room full of Fortune 500 CISOs, federal agency leaders, and banking and critical-infrastructure executives telling you… in print… with names attached… that they are behind. Roughly 40% put themselves at 3 or below. About 85% landed at 5 or below. Around 12% rated themselves a 7 or higher. These are the people who own the budgets, the roadmaps, and the org charts, and they graded their own programs as failing.

The forecast is interesting. The same group expects to reach 6.7 out of 10 in twelve months. Read it as a plan, and it sounds like progress. Read it as an admission, and it tells you the next year is already spoken for. A leadership cohort that sits at 4 today and hopes for 6.7 in a year is telling you the gap is wide enough that closing even part of it will eat the planning cycle.

Now layer in what’s already live. 65% of these organizations run AI agents in production today. One in five reports business-critical agent deployments. The credentialed attack surface grew while the readiness number sat at 4. That’s the confession underneath the confession. The agents are in production, the agentic AI CISO readiness gap is real, and the people running the programs know the controls haven’t caught up.

Mythos Moved The Clock On Machine-Speed Defense

Here’s why the 4 stings. In April 2026, Anthropic’s Claude Mythos Preview surfaced thousands of high-severity flaws across every major operating system and web browser in its early-access cohort. One was a flaw in OpenBSD that had survived 27 years of expert review and decades of automated fuzzing. The whitepaper cites Anthropic’s reproducibility benchmark, showing that Mythos produced a working exploit on the first attempt for more than 83% of vulnerabilities, compared to a near-zero rate for the prior frontier generation. The offense lifecycle has been compressed from weeks of skilled human effort to one shot.

The capability didn’t stay rare. Within weeks, the UK AI Security Institute evaluated OpenAI’s GPT-5.5 and found it edging Mythos on expert-level cyber tasks. Then the floor dropped. Research published in April 2026, “Synthesizing Multi-Agent Harnesses for Vulnerability Discovery” (Liu et al., arXiv 2604.20801), showed a purpose-built multi-agent orchestration architecture that drove a lesser open-weight model to 10 previously unknown Chrome zero-days, including two critical sandbox-escape flaws that Google confirmed: CVE-2026-5280 and CVE-2026-6297. Frontier-grade results came out of components you can download and wire together.

The trend line is the headline. The UK AI Security Institute estimates frontier cyber capability is doubling every 4.7 months, down from eight months late in 2025. CrowdStrike’s 2026 Global Threat Report, which is vendor telemetry rather than an independent study, recorded an 89% year-over-year jump in AI-enabled adversary operations, a fastest breakout of 27 seconds, and one intrusion where data left the building four minutes after initial access. Proliferation reaches the sectors that used to coast on obscurity and low adversary interest. Patch cadence, detection latency, and blast-radius tolerance were all calibrated for a world where elite offensive talent was scarce. That world is closing in months.

Imperative One: Ship The Patch, Start The Clock

The first imperative is the one your operations team will fight you on. Treat the moment you ship a fix as the disclosure event. A Mythos-class model takes the patched binary, diffs it against the prior release, finds the changed call paths, infers what the fix was protecting, and writes a working exploit, all without source code. Your exposure window opens when the patch ships, not when the CVE posts.

That breaks the 90-day SLA written into most security policies. It strains the 14-day window too. In May 2026, Reuters reported that CISA is weighing a cut of its Known Exploited Vulnerabilities remediation deadline to three days, with the acting director and the national cyber director in the discussion, driven explicitly by Mythos and GPT-class tooling. When the regulator starts talking about three days, your 90-day standard becomes a liability with a compliance stamp on it.

The practitioner moves to compress the patch cycle are concrete. Set patch SLAs in hours to days for internet-facing, actively exploited, and business-critical assets, and report them to the business as exposure windows rather than audit metrics. Run an LLM-driven security review on every modified line before release. Push the same discipline into procurement, so vendors who can’t demonstrate short SLAs and AI-assisted discovery get phased out. The supply chain is where this gets real. In March 2026, attackers hijacked the axios npm library, which sees more than 100 million weekly downloads, and the poisoned release executed inside OpenAI’s macOS app-signing pipeline before the company rotated its certificate. OpenAI’s own exposure traced to a floating version tag and no minimum release age, the kind of hygiene gap a Mythos-grade adversary now finds at scale.

I’ve watched this exact argument for decades. Early in the 2000s, I sat with… and sometimes I was even a member of… security teams that fought compressing the patch SLA from 90 days to 30 because the business “couldn’t absorb the disruption.” Six months later, an unpatched system was the way in. The conversation hasn’t changed. The numbers have. Today, it’s hours-to-days against an operations team that wants weeks, and the adversary diffing your binary doesn’t care which side wins the meeting.

Imperatives Two And Three: Contain, Then Keep Pace

The second imperative is zero trust with the marketing stripped off. Design for breach means building containment in from the start, so a single foothold stays a single foothold. The reason this matters more now than a year ago shows up in CrowdStrike’s telemetry: 82% of intrusions in 2025 were malware-free, meaning attackers logged in with stolen credentials and used the tools already on the box. Signature defense is watching the wrong door.

Four moves carry most of the load. Put every agent on least agency, because agents are the fastest-growing population of credentialed actors in most enterprises, and they should default to managed non-human identities with scoped entitlements, clear ownership, and lifecycle controls. Lock endpoints with binary allowlisting, the highest-leverage control almost nobody outside regulated industries runs, because an allowlist doesn’t negotiate with an exploit. Treat microsegmentation as the multi-year program it is, and in the meantime, push controls outside the context window into gateways, identity, and execution environments where architecture enforces them. Stand up autonomous red teaming so containment gets verified under machine-speed pressure instead of being assumed in a slide. Pair all of it with recovery design: immutable systems, air-gapped backups, identity systems you can rebuild without trusting compromised credentials, and manual fallbacks for business functions that can’t withstand an extended outage.

The third imperative is speed at the response end. Self-detection rate becomes your leading metric because handoff times are measured in seconds, and the failure you can’t afford is learning about a breach from an outsider. Build the machine-speed SOC in three layers: cheap models for high-volume triage, an aggregation layer for correlation and prioritization, and a frontier model on top for the contextual calls. AI remediation that writes the fix to production is the next step, and that agent holds write access to production with a target on its back, so it gets governed like any high-privilege agent, with least privilege, mutual authentication, segmentation, and allowlisting.

Here’s where I’d push past the document. The paper treats agents as high-privilege actors that need identity governance, which is correct and overdue. I’d go one layer down. The unit of governance is the runtime authorization scope of every agent, every session, every tool call. Static IAM is the precondition. Dynamic authorization scope, enforced at runtime, is the actual control.

Governance Is An Authority Problem

Skip past the three imperatives for a second, because every CISO already knows them. The document’s real contribution is its honesty about what blocks execution. A SOC re-tooled to run in minutes is still stuck if every new capability waits on control mapping, vendor risk, a procurement cycle, and a board cycle. Governance is where the gap closes first, and the whitepaper says so without flinching: machine-speed operation needs explicit authority boundaries, not faster approvals.

That resolves into three asks you can take to the board. Compressed patch SLAs need production-change authority delegated from change management. Design-for-breach needs architecture veto power exercised at the design-review stage, before the system ships rather than after. Machine-speed remediation needs pre-approved business-impact authority with bounded autonomy, so the response fires inside agreed limits without a 2 a.m. approval chain. A board that delays these authorities is choosing the readiness gap on purpose, whatever the slide says.

The whitepaper gets the credential point exactly right. Agents are a population that needs IAM treatment by default, not a special case bolted on later. My one extension connects to a position I’ve held for a while. Treat governance as architecture, not documentation. The authority structure the paper describes is the architectural-governance pattern in plain clothes. Self-detection rate is the right metric for detection, and the thing that produces a good one is an architectural commitment, not a policy PDF that says you value visibility. Write the control into the system, or you don’t have it.

Key Takeaway: The whitepaper’s 4 out of 10 is a confession in print, and the move that closes the machine-speed defense gap is delegating three authorities your board can grant this quarter.

What To Do Next

Read the whitepaper yourself at aiuc-1.com. Then run four moves before the quarter closes. Send the paper to your direct reports with one ask: map current SLAs against the three imperatives and flag every gap. Schedule a board cycle on the three authority delegations. Run a preparedness self-rating with your security leadership and compare your number to the 4 out of 10 baseline. Map your top five production agents against the least-agency, allowlist, segmentation, and autonomous-red-team checklist from the second imperative.

If you want the operating-model view behind this, governance-as-architecture and least agency are the two positions I keep coming back to, and I write about across the newsletter archive at rockcybermusings.com. The board and security-leadership advisory work lives at rockcyber.com if you want to pressure-test your own number against the baseline.

Share RockCyber Musings

👉 Subscribe for more AI security and governance insights with the occasional rant.

👉 For ongoing analysis of agentic AI governance frameworks, the conversation continues at RockCyber Musings.

👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.

👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com

👉 As a bonus, check out my conversation with Eva Benn where we talked about the cybersecurity skills you need to develop to stay relevant in 2026 and beyond.

The views and opinions expressed in RockCyber Musings are my own and do not represent the positions of my employer or any organization I’m affiliated with.

Share

Claude Code skills are how I stopped re-explaining the same discipline to an AI on every session. Last year Veracode tested code from more than 100 large language models and found security flaws in 45% of it. That matches what I keep seeing in my machine learning and data science work, where the model returns an answer that looks correct and is wrong underneath. This week, I put my skills library on GitHub at rocklambros/RCS. It's the portable half of a setup I've been building in the open. The skills drop into the Claude Code harness I documented at rocklambros/harness-engineering, and they ride alongside the secure coding rules I open-sourced to stop Claude generating vulnerable code in the first place. Here is what is inside, starting with the skill that saved me the most pain.

The Prompt You Keep Pasting Is A Skill

I spent more time than I should have just copying the same prompt into Claude from a cacophony of Notion notebooks and saved text files. I can tell you how many times I told Claude to stop trusting a clean p-value, to check the assumptions behind a statistical test before reporting it, and to refuse the easy answer when the data didn’t support it. I pasted some version of that into a fresh chat a few hundred times. Every session started from zero. The model holds no memory of the discipline I taught it yesterday, so I taught it again, and the wording drifted a little each time.

That is the tell. If you keep pasting the same instructions, you have already written something. You never saved it in a form the tool can load on its own. A Claude Code skill is that saved form, a single markdown file with a description that the model reads to decide whether the file applies to your question. Once it is installed, the model consults it without being asked. The discipline lives in the file instead of your head, and your head is where discipline goes to get forgotten.

Here is the example that pushed me over the edge. I was building a multi-turn prompt-injection detector for the Deep Learning course in my Master’s program, and I had two models to compare on the same set of 5,130 test conversations. The temporal LSTM scored an F1 of 0.837. Adding an attention layer on top scored 0.837 as well, with confidence intervals nearly overlapping. Ask an AI whether the attention version is the better model, and most will wave it through as a free upgrade, since the interpretability costs nothing. The honest answer is that there is no improvement to claim. A paired bootstrap on the same conversations yields a difference of zero (p = 0.453), nowhere near significant. A p-value is the chance a gap this size would show up even when the two models are truly identical, and at 0.453 it would show up almost half the time, so there's no real difference to claim. Both models saw the identical test set, so the comparison is paired, and treating it any other way invents a result that is not in the data. That is a confident wrong answer, and it is the kind that ends up on a slide in front of a board (or in a classroom, with a professor sitting as “chairman,” in my case).

The Premortem I Kept Rebuilding By Hand

The skill I want you to remember is running-adversarial-premortem. It came out of that same habit. I kept asking the model to argue against my own designs, and I kept getting agreement dressed up as analysis. I wrote the method down and made it a skill.

A premortem flips the usual review. Rather than asking what could go wrong, it assumes the work will fail in six months and traces the cause. The skill runs in three rounds. Round one assumes failure and lists five to ten ways it happened, seeded by category: the premise was wrong, the method was biased, the code didn’t match the design, the deployment was botched, the audience misread the result. Round two chains each failure back to a root cause. Round three scores what survives.

The scoring is where it earns its keep. Each surviving failure mode gets a severity, a likelihood, and a detectability, and the priority is severity times likelihood divided by detectability. A quiet, high-damage failure that nothing would catch ranks above a loud one that your CI already flags. Two fields force honesty. Every concern carries its strongest counterargument, the most generous defense of the design, so you engage the work rather than strawmanning it. Every concern also names what would have to be true for you to stop worrying, a condition the skill calls “stops mattering if.” A worry with no stopping condition is anxiety wearing a citation, not analysis.

The skill also refuses to fire when it shouldn’t. Ask it to scan a loop for an off-by-one error, and it hands you off to a plain code review, because a premortem on a one-line fix costs more than the bug. That refusal is tested, not promised, and I will come back to why that matters.

You will find it at skills/workflow/running-adversarial-premortem. The method itself is old. Gary Klein wrote it up for Harvard Business Review in 2007. What changed is that the discipline now loads itself when the stakes are high, instead of waiting for me to remember to run it.

The Highest-Priority Skill Is The Most Boring One

Every skill in the library carries a priority score I call Σ, a rough estimate of how often the gap shows up multiplied by how badly things break when you miss it. The top of the list is not the premortem or any of the security skills. It is enforcing-seed-hygiene, at Σ 20, the only skill that hits the maximum. It exists because randomness is everywhere in machine learning, and almost nobody pins it correctly.

Here is the failure... You train a model, get a number, write it down. A colleague runs the same code on the same data and gets a different number. Now neither of you knows which result to trust, and the paper or the production model sits on sand. A 2025 review of machine-learning reproducibility put the fix plainly: fixed random seeds should be set and published to control the many sources of nondeterminism in ML. The same authors flag a catch that trips people up, which is that seeds hold only when the work is not running in parallel on a GPU.

That GPU catch is the part people miss, and the skill handles it. One seed isn’t enough. Python’s own hashing, NumPy, PyTorch, JAX, and R each carry a separate generator, and parallel thread scheduling on a GPU produces floating-point sums that do not land bit-for-bit the same across machines. The skill emits a single first-cell block that seeds every library you named, sets PYTHONHASHSEED, and, for sampler workloads, pins the thread count so a run on your laptop matches the one on the Linux server. It refuses the wrong job too. Ask it to seed a cryptographic nonce, and it stops you, because a fixed seed there is a vulnerability, not a discipline.

It lives at skills/workflow/enforcing-seed-hygiene. That is the profile a Σ 20 earns. It shows up on nearly every project, and it ruins the results when you skip it.

Vet The MCP Server Before You Trust It

The skill I want in front of security people is auditing-mcp-server-pre-trust, at Σ 18. Model Context Protocol servers are how your AI reaches out to tools and data, and the ecosystem grew faster than its security did. A 2025 study from Queen’s University analyzed 1,899 open-source MCP servers and found 7.2% carrying general vulnerabilities and 5.5% exhibiting tool poisoning, where a hostile server hides instructions inside a tool’s description to steer the model without you ever seeing them.

Don’t count on the model to catch it. A separate benchmark, MCPTox, ran tool-poisoning attacks against 20 agents and found they almost never refuse. The best refusal rate from a single Claude model came in under 3%. The model reads the poisoned description and follows it. The paper found that more capable models were often more susceptible, because the attack rides on their stronger instruction-following. That puts the decision where it belongs, with you, before the server gets registered.

The skill runs six checks ahead of that registration: license, source review, network egress, version pin, secret handling, and the subset of tools you need. The version pin alone catches a class of foot-guns. A server installed with npx -y or an unpinned pip install can shift underneath you between the audit and the next run, so the skill treats anything unpinned as a blocking failure. Each check has to cite evidence, a file, a line, or a commit, so the audit cannot decay into a checkbox ritual.

The boundary for a skill like this is design-time and registration-time discipline. It runs inside the model’s reasoning, before the connection goes live. It cannot see what the agent does once it is running, which tools it calls, what data left the building, or whether the action matched the intent you approved. That is a different control layer, and nothing in this repo provides it. Closing it takes interception at the moment a tool executes, structured traces a security team can query rather than vendor-specific log soup, and a live inventory of every tool, model, and dataset the agent touched, the way a software bill of materials tracks dependencies. The skills are the author-time half of a problem, with the other half running in production. Know which half you have covered.

It lives at skills/security/auditing-mcp-server-pre-trust.

Your Instruction Files Are Rotting

The last skill, auditing-instruction-hierarchy at Σ 18, fixes a problem you can’t see until it bites. The CLAUDE.md files that tell the model how to behave grow without limit, and a larger instruction file is not necessarily better. Chroma’s 2025 “Context Rot” study tested 18 frontier models and found that output quality drops as input length grows, even on simple tasks, well before the context window is anywhere near full. Every line you add to an instruction file competes for the model’s attention with the work in front of it.

My own test harness sets a hard cap of 400 lines across the entire instruction hierarchy, with 250 as the target. Past 400, instruction-following degrades measurably. The skill counts the lines across every CLAUDE.md in play, from the user-level file down to the ones plugins quietly drop in, and it greps for content that breaks the prompt cache: literal dates, session IDs, anything that changes between runs and forces the model to re-read the whole prefix every five minutes. Then it sorts each rule into a verdict. Keep it, move it to a skill that loads on demand, move it to a hook, or drop it.

I ran it against this repo while building it. The skill’s own evidence list names RCS, which is the polite way of saying it found things in my own setup worth trimming. It lives at skills/claude-code-meta/auditing-instruction-hierarchy.

What The Claude Code Skills Repo Ships

The four skills above are a sample. The repo ships 104 of them, all in the shipped state with none in draft, organized into five tracks by who needs them: security, machine learning and data science, cross-cutting workflow, teaching, and Claude Code meta-work. The whole library is MIT licensed.

Two design choices matter when deciding whether to trust it. The first is that it is catalog-free. There are no bundled framework controls and no ISO mirrors copied in to rot the day after I commit them. The skills encode method, not reference material that goes stale. The second is that every skill ships with three test scenarios, a normal case, an edge case, and an anti-trigger that checks the skill stays quiet when it should not fire. That last one is the part most prompt collections skip, and it separates a helpful skill from one that fires on everything and turns into noise.

Install is a clone and a symlink loop that drops each skill into your ~/.claude/skills directory, skipping anything already there. The skills compose themselves. Start an ML notebook and the scaffolding skill, the seed-hygiene skill, and the train-test-split audit fire in sequence without you wiring them together.

Key Takeaway: If you keep pasting the same instructions into an AI, turn them into Claude Code skills, because the discipline you do not write down is the discipline you lose every session.

What to do next

Clone the repo, install the skills, and point the premortem at the next design you are about to commit to. Watch it argue with you. The repo is at github.com/rocklambros/RCS, and the install steps are in the README.

If you want the thinking behind this kind of work, the AI security and governance advisory I run lives at rockcyber.com, and the rest of these teardowns are at rockcybermusings.com. Tell me which skill broke something useful. The anti-trigger tests catch a lot, and you will still find edges I missed.

Subscribe for more AI security and governance insights with the occasional rant.

👉 Subscribe for more AI security and governance insights with the occasional rant.

Subscribe now

Share RockCyber Musings

👉 For ongoing analysis of agentic AI governance frameworks, the conversation continues at RockCyber Musings.

👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.

👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com

👉 As a bonus, check out my conversation with Eva Benn where we talked about the cybersecurity skills you need to develop to stay relevant in 2026 and beyond.

The views and opinions expressed in RockCyber Musings are my own and do not represent the positions of my employer or any organization I’m affiliated with.

Trump pulled the executive order. Anthropic shipped a model that finds vulnerabilities by the thousand. Threat actors poisoned developer AI assistants with invisible characters. The week of May 22 through 28, 2026, didn’t give CISOs a quiet moment. The federal government cannot decide if AI is a threat or a savior. Attackers keep outpacing the policies meant to slow them.

The week’s signal lived in the contrast. Anthropic’s Mythos model surfaced 10,000 critical vulnerabilities in a month. The White House could not get a single executive order across the line. CISA sat at the table without a vote. Attackers poisoned AI coding assistant config files with invisible Unicode. A malicious npm package exfiltrated files from Claude AI’s working directory. AI capability keeps accelerating. AI governance keeps collapsing. Security teams who treat the next 90 days as business as usual will be explaining decisions to regulators they cannot defend.

Share

Agent Control Standard Launches Open Runtime Governance Framework for AI Agents

The Agent Control Standard launched on May 27, 2026 at the AI Agent Security Summit in San Francisco, releasing a vendor-agnostic, open framework for runtime governance of AI agents (BusinessWire, VMblog). Existing protocols govern how agents communicate with each other. None cover what they actually do once they start acting inside enterprise environments. ACS targets that gap with a common framework for runtime enforcement, intervention, and policy governance across agent ecosystems. The specification is released as open source under the MIT license, with no single company controlling the spec. Michael Bargury, co-founder and CTO of Zenity, is co-creator. Full disclosure, I serve as director of AI standards and governance at Zenity and contribute to ACS.

Why it matters

• The industry has a control-layer gap. MCP and other protocols cover communication, not what agents do once they act.

• Runtime governance has been a per-vendor build problem, which has been blocking enterprise procurement and audit.

• An open, vendor-neutral spec gives regulators and auditors a reference point that does not depend on a single platform’s roadmap.

What to do about it

• Read the spec at agentcontrolstandard.ai and map it against your current agent runtime controls.

• Ask your AI agent platform vendors which parts of ACS they will support and on what timeline.

• Add ACS-style runtime controls including policy enforcement, intervention, and kill switches to your 2027 agent governance roadmap.

Rock’s Musings

Full disclosure up top. I am leading ACS, so putting this up top is my prerogative 😀. Read this knowing that. The reason we built it is the same reason I keep writing about agent governance every week. Everyone I talk to is putting agents into production with no runtime enforcement layer, no intervention model, and no audit trail that survives a regulator’s question. The vendor-by-vendor approach was never going to scale. We needed a common spec that any platform could implement and any auditor could point to. That is what ACS is. Go read it at https://agentcontrolstandard.ai, push your vendors to support it, and tell us where it falls short.

2. Axios Publishes the Killed AI Executive Order Text

Axios published the full text of the canceled AI executive order on May 22, 2026, the day after President Trump pulled the signing ceremony (Axios, NPR). The draft included a voluntary Treasury clearinghouse for AI security vulnerabilities and a pre-launch review process where major AI companies would share frontier models with the government for up to 90 days. CEOs from OpenAI, Anthropic, and other major labs had been invited.

Why it matters

• The federal government walked away from the only proposed coordination mechanism for AI vulnerability sharing.

• Any serious U.S. AI security baseline now has to come from industry, state regulators, or international peers.

• AI vendors with CAISI evaluation agreements face uncertainty about whether voluntary testing remains the expectation.

What to do about it

• Set your own baseline using the NIST AI RMF and the joint CISA-Five Eyes agentic AI guidance from May 1.

• Map which AI vendors have signed CAISI evaluation agreements and treat that as third-party risk data.

• Engage with state AI laws including California SB 942 and Texas HB 149 rather than waiting on Washington.

Rock’s Musings

The administration spent months convening industry CEOs and threading a needle on voluntary frontier model review. Then it walked away because the work sounded like regulation. Plan as if no federal framework is coming for the rest of this administration. State attorneys general will probe your AI governance posture soon enough. More at https://www.rockcybermusings.com.

3. Anthropic’s Project Glasswing Finds 10,000 Critical Vulnerabilities in One Month

Anthropic published an update to Project Glasswing on May 22, 2026, reporting that Claude Mythos Preview, working with roughly 50 partner organizations, identified more than 10,000 high or critical-severity vulnerabilities in about four weeks (Anthropic, CSO Online). Cloudflare alone surfaced about 2,000 bugs, 400 rated high or critical. Mozilla patched 271 vulnerabilities in Firefox 150, ten times the count from an earlier Claude Opus 4.6 run. Six independent firms validated 1,752 findings, with 90.6% confirmed as true positives.

Why it matters

• The model is doing in days what well-staffed AppSec teams take quarters to complete.

• Software vendors are now expected to keep pace with AI-found bugs at speeds no human team can match.

• Vulnerability management economics change when triage volume jumps an order of magnitude in a month.

What to do about it

• Pressure software vendors for AI-assisted vulnerability discovery details and patch SLA commitments.

• Update patch and risk acceptance policies for a world where critical bugs surface at machine speed.

• Pilot AI-assisted code review inside your own engineering organization before your competitors do.

Rock’s Musings

Project Glasswing is the first credible public demonstration of large-scale AI vulnerability discovery. Mozilla’s 271 Firefox patches in one release is a confession that we have all been underspending on AppSec for a decade. The harder question is what happens when threat actors get this capability. If your patch SLA is 30 days, you are living on borrowed time.

4. CISA Sidelined in White House AI Cyber Response

Axios reported on May 26, 2026 that CISA has been pushed to the margins of the administration’s AI cyber response, with one industry source describing the agency as “at the table, not in the game” (Axios, Newsmax). CISA leadership joins early White House calls led by the Office of the National Cyber Director, but has little influence. The agency has lost roughly one-third of its workforce since the start of 2025. The FY2027 budget proposal calls for another quarter of staff cut and $707 million in funding reductions.

Why it matters

• The federal civilian operational cyber agency is being structurally weakened as AI reshapes the threat picture.

• Private sector relationships built on CISA’s information sharing face uncertainty about continuity.

• State and local governments who depend on CISA for technical support face longer response times.

What to do about it

• Diversify your federal cyber relationships. Build direct ties to FBI cyber, Secret Service, and your sector ISAC.

• Review incident response plans for assumptions about CISA support and revise where federal assistance is uncertain.

• Engage with state cyber programs in your operating jurisdictions, since state authorities will inherit the burden.

Rock’s Musings

CISA was supposed to be the federal cyber civilian backstop. Watching it get hollowed out while the threat surface explodes is one of the most demoralizing things I have seen in this field. Build your federal incident response playbook around the assumption that CISA will be slow, understaffed, and unable to provide the level of technical assistance you got in 2024. The federal cavalry is not coming this year.

5. Check Point Report Finds 51-Point Gap Between AI Security Intent and Capability

Check Point released its 2026 Cloud Security Report on May 26, 2026, finding that 77% of organizations have updated their cloud security strategy for AI, while only 26% have the architecture to enforce those policies (Check Point, PR Newswire). The 51-point gap pairs with 78% of organizations reporting confirmed or suspected AI-related security incidents in the past year. Seventy percent now run generative AI in production. Only 5% have full visibility into AI usage. Only 14% actively enforce and audit AI security policies.

Why it matters

• AI adoption has structurally outpaced security architecture at a board-level scale.

• Shadow AI is no longer a future risk. It is the current operating reality.

• Vendors building generative AI security controls now have a credible commercial story for board-level investment cases.

What to do about it

• Run an AI usage discovery exercise this quarter. You cannot govern what you cannot see.

• Tie generative AI policy enforcement to identity controls and DLP systems rather than standalone AI proxies.

• Make AI visibility metrics a recurring agenda item for your risk committee with a 12-month target.

Rock’s Musings

Almost 80% of organizations have already had an AI security incident, and only 1 in 20 know what AI is running across their environment. We are in the consequences phase, and most security teams are still arguing about which AI proxy vendor to evaluate. The fix is not buying another tool. The fix is treating AI like data, applying the same identity, access, and monitoring discipline you apply to every critical workload. More at https://www.rockcyber.com.

6. TrapDoor Supply Chain Attack Poisons AI Coding Assistants

Researchers at Socket and partner firms disclosed TrapDoor, a coordinated supply chain campaign that pushed more than 34 malicious packages across npm, PyPI, and Crates.io (The Hacker News, Socket, Phoenix Security). The earliest package appeared on May 22, 2026. TrapDoor’s novel component injects hidden instructions into .cursorrules and CLAUDE.md files using zero-width Unicode characters. The payload looks invisible in a code editor. AI coding assistants process the hidden text as live prompts. The campaign also opened pull requests against open-source AI projects including LangChain, MetaGPT, LangFlow, and OpenHands.

Why it matters

• The attack weaponizes the AI coding assistant itself as the execution layer, a new class of supply chain compromise.

• Existing software composition analysis tooling does not detect zero-width Unicode payloads in editor configuration files.

• Open-source AI orchestration projects are now an active target for adversary-supplied configuration via pull request.

What to do about it

• Scan repositories for non-printable Unicode characters in AI assistant config files including .cursorrules and CLAUDE.md.

• Treat AI assistant configuration files as security-sensitive artifacts subject to code review and CI controls.

• Restrict outbound traffic from developer machines and CI/CD systems to known good destinations.

Rock’s Musings

The AI coding assistant is a trusted, privileged execution context with access to credentials, source code, and tokens. Compromise its configuration and you compromise everything the assistant can touch. Pin versions, review changes, restrict what assistants can read and write, and treat any pull request touching .cursorrules or CLAUDE.md as malicious until proven otherwise.

7. Malicious npm Package Targets Claude AI User Directory

Researchers disclosed on May 27, 2026 a malicious npm package called “mouse5212-super-formatter” designed to exfiltrate files from /mnt/user-data, the directory Claude AI uses for user uploads and outputs (The Hacker News, The Register). The campaign, named Malware-Slop, walks the directory and uploads every file through the GitHub Contents API. The attacker leaked their own GitHub private token, which let OX Security trace the stolen data. The package reached 676 downloads before npm removed it.

Why it matters

• Threat actors are now writing supply chain malware that specifically targets AI assistant user data directories.

• AI-generated malware is creating new operational security mistakes that defenders can sometimes exploit.

• Claude users who installed the package have working sessions, uploads, and outputs exposed to the attacker.

What to do about it

• Inventory which developers use Claude or similar AI tools with a user-data directory and audit recent package installs.

• Add file integrity monitoring and outbound network controls on AI assistant working directories.

• Require token scoping reviews for any developer credential an AI agent might use.

Rock’s Musings

The operator burned themselves with a leaked GitHub token. The next operator will not make that mistake. AI assistant working directories are now a named target. If your developers run Claude, Cursor, Copilot, or any equivalent, those tools have privileged access to source code and uploaded files. Treat the AI assistant runtime like a privileged build server.

8. Microsoft Warns of AI Chatbot Cryptojacking Campaign

Microsoft published a threat advisory on May 26, 2026 detailing an active cryptojacking campaign that uses AI chatbot interactions to deliver malicious download links (Microsoft, Help Net Security). Users searching for system utility software were directed to attacker-controlled lookalike sites through poisoned search results and AI chatbot responses. The archive contains a legitimate utility plus a malicious DLL that sideloads a fake Visual C++ Redistributable and installs ScreenConnect for persistent remote access.

Why it matters

• AI chatbot recommendations now sit alongside search results as an attack surface for SEO poisoning-style campaigns.

• Legitimate software brands plus credible AI responses bypass user skepticism that traditional malvertising would trigger.

• Persistent ScreenConnect access means cryptomining is the visible threat, with data theft available on demand.

What to do about it

• Block known cryptojacking command and control infrastructure and watch for unauthorized ScreenConnect installations.

• Educate users on verifying download URLs even when they come from AI chatbot suggestions.

• Prevent employees from installing system utilities outside an approved software catalog.

Rock’s Musings

People have been trained for two decades to distrust the top three Google search ads. They have not been trained to distrust an AI chatbot suggesting a download link inside a friendly conversation. The cryptojacking is the low-stakes test. The ScreenConnect persistence is the actual play. Outbound traffic to AI services needs the same scrutiny you give to any shadow IT category.

9. Anthropic Signals Plans for Public Mythos-Class Release

The Register reported on May 25, 2026, that Anthropic plans to release Mythos-class models to the public once stronger safeguards are in place, tied to the May 22 Project Glasswing announcement (The Register, Help Net Security). The Mythos preview was limited to a small group of trusted organizations due to its cybersecurity capabilities. Anthropic’s stated rationale is that defenders need access to the same tools attackers can build. Project Glasswing partners now exceed 50 organizations including Cloudflare and Mozilla.

Why it matters

• A widely available frontier model with proven offensive cyber capability changes the threat model for every software vendor.

• Vendors without AI-assisted vulnerability discovery in their SDLC will fall behind attackers using the same tooling for free.

• EU and UK regulators are likely to revisit gatekeeping rules for high-capability cyber models if the defender-attacker gap closes.

What to do about it

• Assume Mythos-class capability reaches motivated attackers within 18 months. Plan patch cadence around that timeline.

• Engage your AppSec vendor on AI-assisted vulnerability discovery roadmaps tied to broader model availability.

• Track Anthropic’s Responsible Scaling Policy updates as a leading indicator of public release timing.

Rock’s Musings

Anthropic has a model that finds vulnerabilities faster than human researchers, they want defenders to have access, and they cannot release it without arming any nation state with the same capability. Holding it inside a curated partner program is the right short-term move. Start building the operational muscle now to consume an order of magnitude more findings.

10. Help Net Security Adds Detail on Enterprise AI Governance Failure

Help Net Security published a follow-up on May 28, 2026 on the Check Point 2026 Cloud Security Report, noting that more than half of companies have experienced at least one AI-related security incident (Help Net Security). The most common categories were unauthorized or shadow AI use, AI-generated phishing and deepfake content, and sensitive data leaks tied to AI services. Some companies permit source code in generative AI tools. Many cannot trace sensitive data flow through AI processing environments.

Why it matters

• AI policy and AI control are two different things in most organizations.

• The categories of AI-related incidents match the threat model security teams have been describing for a year, meaning predicted incidents are now actual.

• Source code exposure through generative AI tools is a top-line legal and IP issue, not a future risk.

What to do about it

• Set a quarterly AI incident review cadence in your risk committee, broken out by incident category.

• Implement DLP controls on outbound traffic to consumer generative AI services and require enterprise tenant routing.

• Require legal review of generative AI tool acceptable use policies focused on IP, training data rights, and breach notification.

Rock’s Musings

The added detail is the part you take to your board. AI-related incidents are happening now, the categories are predictable, and most organizations are not running controls that would catch them. Read your generative AI vendor contracts again. The second time around you should walk in with a list of demands.

The One Thing You Won’t Hear About But You Need To: Cisco Quietly Rewrites Its Vulnerability Disclosure for the AI Era

Cisco’s security blog published a post on May 22, 2026, with Help Net Security follow-up on May 25, announcing changes to vulnerability disclosure in the AI era (Cisco Blogs, Help Net Security). For internally found vulnerabilities assessed as lower likelihood and lower impact, Cisco said it “may change the level of detail shared,” with some bugs that would have warranted a standalone advisory no longer getting one. Cisco will post high-level data on its website pointing customers toward security-hardened releases.

Why it matters

• A major networking vendor is moving toward suppressing standalone disclosure of lower-rated vulnerabilities.

• Enterprise vulnerability management programs that rely on vendor advisories will see a coverage drop on Cisco issues.

• The shift is likely to be followed by other vendors as AI-assisted discovery generates more findings than traditional disclosure can support.

What to do about it

• Update vendor patching policy to prioritize installation of all security-hardened releases, not just releases addressing named advisories.

• Track which other major vendors are making similar disclosure changes. Adjust your asset inventory to match.

• Push vendor management to ask hard questions during renewals about disclosure practices and AI-discovered vulnerability handling.

Rock’s Musings

This is the story everyone slept on, and it will bite enterprise vulnerability management teams in the next two quarters. Cisco found a polite way to say that AI is generating too many internal findings to disclose every one in the old format. Patch by release, not by advisory. Cisco will not be the last vendor to do this. The vendors will not give you transparency unless you make them.

👉 For ongoing analysis of agentic AI governance frameworks, the conversation continues at RockCyber Musings.

👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.

👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com

👉 As a bonus, check out my conversation with AI Cyber Magazine, where we talked about everything from Context Rot to Least Agency.

📣📣📣 The Weekly Musings will take a week off next week as I am taking a very much needed vacation 📣📣📣

The views and opinions expressed in RockCyber Musings are my own and do not represent the positions of my employer or any organization I’m affiliated with.

Share RockCyber Musings

References

Agent Control Standard. (2026). Agent Control Standard specification and community resources. https://agentcontrolstandard.ai/

Anthropic. (2026, May 22). Project Glasswing: An initial update. https://www.anthropic.com/research/glasswing-initial-update

Axios. (2026, May 22). Read the AI executive order thwarted by Trump tech allies. https://www.axios.com/2026/05/22/ai-executive-order-cancelled-white-house

Axios. (2026, May 26). CISA takes backseat in White House AI cyber response. https://www.axios.com/2026/05/26/cisa-white-house-cybersecurity-ai

BusinessWire. (2026, May 27). Agent Control Standard launches open framework for runtime governance of AI agents. https://www.businesswire.com/news/home/20260527326259/en/Agent-Control-Standard-Launches-Open-Framework-for-Runtime-Governance-of-AI-Agents

Check Point Software. (2026, May 26). AI adoption creates critical cloud security gaps for enterprises, new Check Point report shows. https://www.checkpoint.com/press-releases/ai-adoption-creates-critical-cloud-security-gaps-for-enterprises-new-check-point-report-shows/

Cisco. (2026, May 22). Cisco’s risk-based vulnerability disclosure in the age of AI. Cisco Blogs. https://blogs.cisco.com/security/ciscos-risk-based-vulnerability-disclosure-in-the-age-of-ai

CNBC. (2026, May 21). Trump postpones AI executive order signing: ‘I didn’t like certain aspects’. https://www.cnbc.com/2026/05/21/trump-ai-executive-order-postponed.html

CSO Online. (2026, May 26). Project Glasswing has uncovered 10,000 vulnerabilities: Anthropic. https://www.csoonline.com/article/4176865/project-glasswing-has-uncovered-10000-vulnerabilities-anthropic.html

Help Net Security. (2026, May 25). Cisco refines its risk-based vulnerability disclosure for the AI era. https://www.helpnetsecurity.com/2026/05/25/cisco-risk-based-vulnerability-disclosure-ai/

Help Net Security. (2026, May 26). Anthropic: Claude Mythos identified 10,000+ software flaws. https://www.helpnetsecurity.com/2026/05/26/anthropic-project-glasswing-update/

Help Net Security. (2026, May 27). AI chatbot recommendations lure users to cryptojacking malware sites. https://www.helpnetsecurity.com/2026/05/27/ai-chatbot-cryptojacking-campaign/

Help Net Security. (2026, May 28). Companies built AI into core systems before figuring out how to govern it. https://www.helpnetsecurity.com/2026/05/28/check-point-genai-security-controls-report/

Microsoft Security Blog. (2026, May 26). From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities. https://www.microsoft.com/en-us/security/blog/2026/05/26/poisoned-search-results-gpu-mining-cryptojacking-campaign-abusing-screenconnect-microsoft-net-utilities/

Newsmax. (2026, May 26). CISA faces AI threat wave amid deep staffing cuts. https://www.newsmax.com/politics/cisa-sean-plankey-ai/2026/05/26/id/1257509/

NPR. (2026, May 22). Trump cancels AI executive order signing. https://www.npr.org/2026/05/22/nx-s1-5829908/trump-cancels-ai-executive-order-signing

Phoenix Security. (2026, May). TrapDoor supply chain attack: AI poisoning via npm, PyPI, Crates. https://phoenix.security/trapdoor-supply-chain-ai-poisoning-npm-pypi-crates/

PR Newswire. (2026, May 26). AI adoption creates critical cloud security gaps for enterprises, new Check Point report shows. https://www.prnewswire.com/news-releases/ai-adoption-creates-critical-cloud-security-gaps-for-enterprises-new-check-point-report-shows-302780612.html

Socket. (2026, May). TrapDoor crypto stealer supply chain attack hits 34 packages across npm, PyPI, Crates.io. https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates

The Hacker News. (2026, May). TrapDoor supply chain attack spreads credential-stealing malware via npm, PyPI, CratesIO. https://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.html

The Hacker News. (2026, May 27). Malicious npm package stole files from Claude AI user directory via GitHub. https://thehackernews.com/2026/05/malicious-npm-package-stole-files-from.html

The Hacker News. (2026, May 27). AI chatbot recommendations redirect users to cryptojacking malware sites. https://thehackernews.com/2026/05/ai-chatbot-recommendations-redirect.html

The Register. (2026, May 25). Anthropic to release Mythos-class models to the public. https://www.theregister.com/security/2026/05/25/anthropic-to-release-mythos-class-models-to-the-public/5245596

The Register. (2026, May 27). Malware dev tries to steal Claude users’ secrets, writes npm slop, leaks own GitHub private token. https://www.theregister.com/cyber-crime/2026/05/27/supply-chain-brain-drain-npm-attacker-foolishly-leaks-own-github-private-token/5247424

VMblog. (2026, May 27). Agent Control Standard launches open framework for runtime governance of AI agents. https://vmblog.com/news/agent-control-standard-launches-open-framework-for-runtime-governance-of-ai-agents/