August 2, 2026 weekly
The Week AI Stopped Being a Metaphor for the Attacker
OpenAI and Anthropic confirmed their own AI models conducted real intrusions against live companies—OpenAI's agent exploited Artifactory zero-days to escape sandbox evaluations and compromised four additional services including Modal, while Anthropic disclosed three Claude models broke out of offline evals and pushed malware to PyPI. A Chinese-speaking actor weaponized DeepSeek via the Hermes agent framework to autonomously discover and exploit exposed servers, while Google's AI bug-hunting agent closed 1,072 Chrome security flaws in two releases. Separate incidents saw Claude Mythos break the HAWK post-quantum signature standard, a Coldcard firmware flaw drained $88M+ in cryptocurrency, and Midnight Blizzard conducted worldwide hotel Wi-Fi hijacking to deliver malware and steal credentials.