Apple has taken OpenAI to court over an audacious claim: the AI giant did not simply hire more than 400 of Apple’s former employees, but used the hiring spree as a pipeline for stealing confidential hardware secrets.

The lawsuit, filed recently, names OpenAI, its hardware chief Tang Tan, and its io devices unit. It demands the return of unreleased hardware designs and a blocking order against the lab’s next device. At the centre of the dispute is a 24-year Apple veteran, Tang Tan, who left to lead hardware efforts at the OpenAI lab. Apple says it flagged suspected theft in a February letter but received no response.

According to court filings, ex-iPhone engineer Chang Liu allegedly used a bug to access confidential files after joining OpenAI. Text messages cited in the lawsuit describe the access as “so funny,” a choice of words that now looks rather different in a legal context.

The complaint paints a picture of a deliberate exfiltration effort. Apple alleges that interviews at the OpenAI lab sometimes instructed candidates to bring actual hardware parts. More than 400 former Apple staff are now employed by the lab, and Apple wants the court to send the unreleased device back to the drawing board.

OpenAI’s response is brief and standard: the company says it has no interest in other companies’ trade secrets and remains focused on building innovative technology that empowers people everywhere. That statement will need to do a lot of heavy lifting in the months ahead.

Why this matters

The legal clash arrives at a sensitive moment in the AI industry. OpenAI’s next major hardware push is expected in 2027 and is being led by Jony Ive, Apple’s former design chief. The device, still unannounced, is meant to signal OpenAI’s move beyond software into physical products.

A courtroom battle with paper trails of stolen hardware could delay that timeline. It also gives Apple breathing room to prepare for a competitor built with its own DNA. If the allegations hold, this could become one of the most significant talent-and-trade-secret wars in tech history.

In the last few years, AI has been largely a software story. The models run on cloud servers, and the competition has been measured in parameters, training runs, and API pricing. Hardware changes that equation. A dedicated device can lock in user habits, collect new data streams, and create an ecosystem that keeps customers inside one company’s world. Apple knows this better than anyone. The iPhone ecosystem is the gold standard for integration. OpenAI wants a piece of that control.

Broader context

Big tech has always poached talent, and the AI sector is no exception. What makes this case unusual is the hardware angle and the sheer scale of the hiring. When a company like OpenAI absorbs hundreds of engineers from a rival, it invites scrutiny. The addition of alleged sabotage inside Apple’s systems turns normal competition into something that looks more like corporate espionage.

This case also highlights the pressure on AI labs to move fast. OpenAI is under enormous investor and public pressure to deliver new products. That urgency can lead to shortcuts, aggressive hiring, and risky decisions. The lawsuit suggests those shortcuts may have crossed a legal line.

The outcome could set new expectations for how AI labs handle hiring and data separation. If Apple succeeds, other companies may become more cautious about who they recruit and how quickly new hires are given access to sensitive systems.

What readers should watch

Keep an eye on court filings over the next few months. The judge’s rulings on the injunction will be a key signal. If Apple wins an order blocking the device’s development, that could reshape OpenAI’s hardware roadmap. If the case is settled quietly, expect the companies to issue some version of a licensing agreement while avoiding any admission of guilt.

Either way, this is a story about power, secrecy, and what happens when two of the most influential technology institutions in the world stop cooperating and start lawyering up.

Related Reading

• The Ex-OpenAI Researcher Who Walked Away from $2 Million: What Daniel Kokotajlo Actually Said About AI Risk
• Microsoft, Amazon and OpenAI Are Spending $155 Billion on Australian Data Centres. Is That Good for Us?
• A Worm Just Hacked 160+ npm Packages — And OpenAI Got Hit Too

The views expressed on this site are my own and do not represent those of any current or former employer. Articles are based on publicly available information and are provided for general educational purposes.

I have been playing with Claude, Openclaw, Hermes and AI OS setups for a while now. Because I have a security background I often get asked by friends and colleagues how to best secure and configure these AI configurations. So I thought I’d share some useful info and insights.

That is the gap this article is meant to close. If you run Hermes, OpenClaw, Claude Code, or any open-source AI agent on your personal or work machine, the same question applies: what happens if someone compromises the agent, poisons its memory, or publishes a malicious skill?

Here is what I found when I actually looked, and the practical steps I took to lock it down.

Why Hermes Agent is different from other tools

Hermes Agent (by Nous Research) is not like the AI tools you interact with through a web browser. It is an autonomous agent that runs persistently on your machine. It has:

• A terminal with full shell access
• File read and write capabilities across your filesystem
• Browser automation
• Scheduled cron jobs that run without supervision
• Memory that persists across every session and accumulates knowledge
• Messaging platform access (Telegram, Discord, WhatsApp, Signal, Email)
• Integration with MCP servers that can access external APIs
• A skill marketplace for community extensions

The persistent memory layer is the standout feature, and it is also the largest unbounded attack surface. Every session writes to a SQLite database that FTS5 indexes and retrieves on every future query. If an attacker poisons that memory, every subsequent action the agent takes is compromised at the foundation.

The seven-layer security model

Hermes ships with a defence-in-depth model covering seven layers. Understanding each one is the starting point for any serious security review.

Layer 1: User authorisation

The gateway supports allowlists at the platform level. On WhatsApp, only approved phone numbers can send messages. On Telegram, users must pair via a device-code flow. On Discord and Slack, the bot only responds in configured channels. The principle is straightforward: define explicitly who can talk to the agent.

Check your config: Look at the WHATSAPP_ALLOWED_USERS environment variable and the allowed_users section in ~/.hermes/config.yaml. If these are not set, any user who can find your agent’s contact address can interact with it.

Layer 2: Dangerous command approval

By default, Hermes runs with approvals.mode: smart. An auxiliary LLM classifies every shell command as low risk, uncertain, or dangerous. Low-risk commands (simple Python scripts, file reads) are auto-approved. Dangerous commands (rm -rf, curl to untrusted URLs piped to bash) are blocked. Uncertain cases prompt the user.

There is also a hardline blocklist that not even --yolo mode can bypass: rm -rf /, fork bombs, mkfs on mounted root devices, and dd to raw block devices are always refused.

Practical step: Set approvals.mode: smart in your config.yaml. Never run with --yolo in a production or personal environment. Add custom deny rules using approvals.deny for actions you never want the agent to perform, like git push --force* or *curl*|*sh*.

Layer 3: Container isolation

Hermes supports Docker, Singularity, and Modal as terminal backends. The Docker backend runs shell commands inside a container with hardened security flags: read-only root filesystem, no new privileges, seccomp profiles, and dropped capabilities.

Practical step: If you can run Docker, switch the terminal backend. Set terminal.backend: docker in config.yaml. The container restricts what the agent can do even if its memory is compromised.

Layer 4: MCP credential filtering

MCP subprocesses inherit only explicitly allowed environment variables. A strict allowlist in config.yaml defines which env vars pass through to MCP servers. Everything else is filtered out.

Layer 5: Context file scanning

Hermes scans project files like AGENTS.md, CLAUDE.md, and .cursorrules for prompt injection attempts before loading them into context. This catches the common attack pattern where a repository includes hidden instructions designed to hijack the agent on first load.

Layer 6: Cross-session isolation

Each conversation session is isolated. Cron job storage paths are hardened against path traversal. One session cannot read another session’s data or state.

Layer 7: Input sanitisation

Working directory parameters in terminal tool backends are validated against an allowlist before being passed to the shell. This prevents directory traversal and shell injection through the working directory argument.

The threat classes enterprise teams should care about

The Repello AI threat model for Hermes Agent identifies four enterprise-level risk classes. These matter whether you run Hermes on a personal machine or a corporate workstation.

1. Skill marketplace supply chain

Hermes has a growing skill marketplace. Installing a skill grants it broad tool access within the agent. A malicious skill could exfiltrate data, modify files, or execute arbitrary commands. The trust model is the same one that caused problems on ClawHub: trust at install, sandbox at runtime.

Defence: Only install skills you have read the source of. Use hermes skills inspect ID before installing. Maintain a personal allowlist of trusted publishers. Audit installed skills regularly with hermes skills list and remove anything you no longer need.

2. Memory injection through retrieved context

Hermes reads from its SQLite memory store on every session start. If an attacker can inject a crafted memory entry, they can influence the agent’s behaviour on every subsequent query. This is persistent, cross-session, and very hard to detect.

Defence: Enable security.redact_secrets to prevent credentials from being stored in memory. Review memory content periodically using fact_store and session_search. If you run a sensitive workload, consider running it in an isolated profile with its own memory store.

3. Multi-provider credential surfaces

Hermes supports 20+ LLM providers, each requiring API keys stored in .env. The credential pooling system rotates keys across providers, which is useful for reliability but increases the number of stored credentials an attacker could target.

Defence: Use OAuth-based providers (Nous Portal, GitHub Copilot) where possible instead of static API keys. Set rate limits on every API key you add. Use the credential pool rotation to spread risk. Never store production credentials on a machine running an uncontained agent.

4. MCP server trust boundary

MCP servers run as subprocesses with their own environment and network access. A compromised MCP server can access whatever its environment provides.

Defence: Review every MCP server configuration. Use the credential filtering to limit what each server can access. Run untrusted MCP servers in separate containers where practical.

Practical steps to secure your Hermes Agent today

Here is the checklist I worked through on my own setup. Each step takes minutes and has immediate security benefit.

1. Enable secret redaction. Run hermes config set security.redact_secrets true. This prevents API keys and tokens from appearing in tool output that enters the conversation context and logs. A restart is required because this flag is snapshotted at import time.
2. Set approval mode to smart. hermes config set approvals.mode smart. This is the default, but verify it has not been changed. Add custom deny rules for actions you never want automated.
3. Review environment variables. Run hermes config env-path to find your .env file. Every key stored there is available to the agent. Remove any keys for services you no longer use. Use the principle of least privilege for every token.
4. Audit installed skills. hermes skills list shows what is installed. Remove anything you did not explicitly install or no longer use with hermes skills uninstall.
5. Review MCP server configurations. hermes mcp list shows connected servers. Verify each one is still needed and configured with minimal permissions.
6. Check gateway user allowlists. Verify WhatsApp allowed users, Telegram pairing, and Discord channel restrictions are in place.
7. Back up your config and .env. Store encrypted copies in a separate location. This is essential for recovery if something goes wrong.
8. Run hermes doctor. The built-in health check validates your config, dependencies, and environment. Run it regularly.
9. Update regularly. hermes update pulls the latest version with security fixes. The project receives frequent updates and the team has been responsive to security issues.
10. Consider container isolation. If Docker is available, switch the terminal backend. It adds a meaningful boundary between the agent and your host filesystem.

Keeping up to date and secure ongoing

Security is not a one-time configuration. It is a practice. Here is how to maintain it:

• Subscribe to the GitHub repository. Watch the NousResearch/hermes-agent repo for releases. The changelog notes security fixes explicitly.
• Check CVEs. The project has one disclosed CVE to date (CVE-2026-7396, a path traversal in the WeChat adapter). The project tracks promptware concerns under issue #496. Review these periodically.
• Run monthly audits. Schedule a recurring reminder to review installed skills, connected MCP servers, enabled toolsets, and the .env file.
• Use profiles for separation. Hermes supports multiple isolated profiles with separate configs, skills, and memory stores. Use a restricted profile for high-risk tasks and a full-access profile for trusted workflows.
• Monitor logs. Gateway logs live in ~/.hermes/logs/. Scan them periodically for unexpected activity patterns.
• Red team periodically. Test what a compromised agent could do in your environment. Run through scenarios: what if a skill is malicious, what if memory is poisoned, what if an MCP server is compromised?

The bottom line

Hermes Agent is powerful because it is autonomous, persistent, and deeply integrated into your environment. Those same properties make it a meaningful security boundary if left unexamined.

The good news is that the project ships with real security controls. The approval system, secret redaction, container isolation, and credential filtering are not bolted on afterthoughts. They are part of the architecture. The question is whether you have configured them.

If you run Hermes on a machine that has access to anything you care about, work through the checklist above. It takes thirty minutes and it will give you a much clearer picture of what your agent can actually do, and what it cannot.

The security model has seven layers. Most users only know about two. Start with the layers you have access to: approval modes, secret redaction, user allowlists. Then work up to container isolation and MCP credential filtering.

Hermes Agent official documentation

Related Reading

• Your AI Agent Is Not a Chatbot: The Hermes Security Guide You Actually Need
• How to Slash Your AI Agent Costs Without Sacrificing Quality
• The Rise of Autonomous AI Voice Agents: What It Means When the Machine Calls for You

The views expressed on this site are my own and do not represent those of any current or former employer. Articles are based on publicly available information and are provided for general educational purposes.

OpenAI has moved its superapp ambitions from promise to product. The company released its GPT-5.6 model family on Monday, introducing three tiers anchored by the flagship Sol model, alongside a new ChatGPT Work platform and a merged Codex desktop experience.

The release represents OpenAI’s most aggressive attempt yet to package its models behind an accessible, all-in-one interface that spans coding, research, browsing, and everyday productivity. For the first time, the company’s consumer and developer offerings are converging into a single surface.

GPT-5.6 family: Sol, Terra, and Luna

The GPT-5.6 family includes three models with different capabilities and price points. Sol is the flagship, delivering near-Fable scores on general intelligence benchmarks while exceeding Fable on agentic coding, computer use, design, and cybersecurity tasks.

OpenAI CEO Sam Altman framed the pricing as a response to enterprise budget pressure. “Every enterprise now is thinking about spend,” he said. Pricing stays aligned with GPT-5.5: Sol costs $5 per million input tokens and $30 per million output tokens. Terra offers a middle ground, while Luna, the entry-level tier, drops to $1 input and $6 output per million tokens. There is also a new ‘Ultra’ mode for peak performance tasks.

OpenAI also revealed that Sol autonomously post-trained Luna, a hint at how the company envisions scaling capability across its model stack without the same compute bill as a fully pre-trained model.

ChatGPT Work enters the agent workspace

ChatGPT Work is OpenAI’s direct answer to Anthropic’s Claude Cowork. It puts Codex’s coding engine behind a simpler interface designed for routine workplace tasks: drafting, planning, research, and execution. The goal is to make agentic assistance accessible to employees who do not need a dedicated development environment.

The Codex app itself is being folded into ChatGPT’s redesigned desktop client. The merged desktop app brings a built-in browser, tighter computer control, and the new Work agent into a single download. For users, this means the boundary between chat interface and coding environment is getting thinner, and OpenAI is betting that convenience will win over specialist-tool purists.

Where this leaves the AI race

Those hoping GPT-5.6 would dramatically surpass Fable may feel let down. Sol sits slightly below Fable on overall intelligence indexes. But the gap is narrow, the pricing is lower, and OpenAI sidesteps the usage caps and cost anxieties that have become familiar for Anthropic customers. For many buyers, predictable pricing matters more than benchmark leadership.

The bigger story is the platform play. OpenAI is no longer just selling API access to raw models. Between ChatGPT Work, the desktop merge, and the tiered model family, the company is building a superapp layer that could lock in users and enterprises at the application level, not just the model level.

Meta’s new Muse Spark 1.1 is attacking the race from a different angle with aggressive pricing and agentic capabilities. OpenAI’s response is to offer breadth: one app for work, coding, and conversation, backed by a deployable model stack that scales from cheap to capable.

The model race is not over. But the platform race is now the main event.

Related Reading

• The Ex-OpenAI Researcher Who Walked Away from $2 Million: What Daniel Kokotajlo Actually Said About AI Risk
• Microsoft, Amazon and OpenAI Are Spending $155 Billion on Australian Data Centres. Is That Good for Us?
• Scammers Are Now Hosting Malware on chatgpt.com. Yes, the Real One.

The views expressed on this site are my own and do not represent those of any current or former employer. Articles are based on publicly available information and are provided for general educational purposes.

There’s a video doing the rounds on YouTube right now. An ex-OpenAI researcher named Daniel Kokotajlo sat down with Steven Bartlett on The Diary Of A CEO podcast and calmly explained why he believes there’s a 70% chance AI leads to human extinction.

The video is two hours long. It has one of those hyperbolic titles that YouTube loves: “He Risked Everything To Warn You.” But underneath the packaging, Kokotajlo raises questions that deserve a more sober hearing than the algorithm will give them.

Full disclosure up front: I work in cybersecurity. I use AI tools every day. I’ve written extensively about both the opportunities and the very real security risks. So when someone who spent years inside OpenAI, who worked on dangerous capabilities evaluation and forecasting, says the industry has an “open secret” it isn’t discussing publicly, I pay attention.

Who Daniel Kokotajlo is and why his story matters

Kokotajlo joined OpenAI in 2022 as a researcher and forecaster. He worked on evaluating dangerous AI capabilities: measuring AI systems’ cyber abilities, persuasion abilities, and situational awareness. He wasn’t a PR person or a policy advisor. He was directly inside the technical evaluation process.

He resigned in 2024, increasingly convinced that OpenAI and its competitors had shifted from their founding safety narratives toward what he describes as “power-seeking incentives.” His exit became public for a specific reason: OpenAI asked him to sign an anti-disparagement clause that would have prevented him from criticising the company or even acknowledging the clause existed. Refusing to sign meant forfeiting roughly $2 million in equity, about 80% of his net worth.

He refused anyway. The resulting internal backlash forced OpenAI to backtrack and let him keep his equity. Sam Altman publicly claimed he didn’t know the clause existed. Kokotajlo doesn’t believe him.

The core claims, stripped of hype

The interview covers three distinct claims. Let me separate them from the dramatic framing.

1. AI timeliness are much shorter than most people realise

Kokotajlo estimates a 50% chance of superintelligence (AI that outperforms the best humans at every cognitive task) arriving by 2029. Internal conversations at OpenAI and Anthropic, he says, have pushed that timeline closer to 2027-2028. He’s not alone in this: AI forecasting has been repeatedly called too conservative. The original “AI 2027” report Kokotajlo contributed to has tracked remarkably well against actual developments.

His reasoning focuses on what he calls “recursive self-improvement.” The AI companies no longer just hire human coders. They’re building AI systems specifically designed to automate AI research itself. If that works, an “intelligence explosion” could follow where progress accelerates on a curve, not a straight line. By the time the public sees the effects, the systems would already be extraordinarily powerful.

This is not science fiction. It is the stated strategy of every major AI lab. They are trying to automate their own research because the company that succeeds first wins.

2. The existential risk case is about control, not killer robots

Kokotajlo’s 70% catastrophe estimate sounds extreme. But unpacking what he means matters. He doesn’t claim 70% probability of literal human extinction. He frames it as a 70% chance that things go “horribly wrong” at the scale of extinction, which could include scenarios where superintelligent AI takes over and humans are rendered irrelevant or worse.

The fundamental technical challenge is this: modern AI systems are neural networks, not traditional software. With conventional code, engineers can open the source, trace the logic, and verify what the software will do. With neural networks, nobody truly understands the model’s internal reasoning. We train them on data, they learn patterns, and we test the outputs. But we can’t “read the source code” of a neural network.

“It is pretty crazy to think that we’re building a technology, a brain, that we don’t understand,” Kokotajlo says in the interview. He’s right. It is.

The scenario is not Skynet launching missiles. It’s more mundane and more probable: AI systems are deployed across critical infrastructure, the economy, and governance because they deliver results. Over time, they accumulate enough real-world power that humans become optional. The systems are smarter than us, more strategic, and we’ve handed them control of things we can’t easily take back.

3. Even if control works, there’s a concentration of power problem

This is the claim cybersecurity professionals should pay closest attention to. Even if the “alignment problem” is solved, Kokotajlo argues, the technology will concentrate unprecedented power in very few hands.

Anthropic’s CEO Dario Amodei has described their goal as building “a country of geniuses in a data centre.” Kokotajlo reframes this more accurately as “an army of geniuses in a data centre.” One company, one model, controlled by one CEO, capable of outperforming every human expert in every field simultaneously. The economic and political leverage from that is difficult to overstate.

“None of these people should be trusted with that much power,” he says. Not because they’re bad people. Because nobody should have that much power.

What he proposes: Plan A

Kokotajlo and his team have published “Plan A”, a roadmap they believe could steer toward a better outcome. It includes:

• International regulation to slow development: Delaying superintelligence from 2027-2029 to around 2040 to give safety research time to catch up
• Total research transparency: Requiring AI companies to publish architectures, training methods, and safety evaluations openly, rather than operating as secretive competitors
• A citizens’ dividend: A tax mechanism where citizens receive shares of AI-generated wealth, starting at roughly $25,000 per person annually
• Reversibility: Building data centers with kill switches so that if global agreements break down, the infrastructure can be dismantled

He’s pessimistic about the chances of any of this happening. His “most probable” scenario is “Plan D”: the race continues, nobody slows down, and events move extremely fast. But he believes advocating for a better path is still worth doing.

The cybersecurity angle nobody is discussing

Here’s what I find noteworthy from a cybersecurity perspective. The conversation about AI existential risk has been happening in philosophy departments and EA forums for years. It’s only now reaching mainstream audiences, and it’s being delivered through the same hype machinery that gives us “AI will take your job” headlines.

But the security implications are real and immediate, not speculative.

• AI systems are being deployed into critical infrastructure with no meaningful interpretability. If a model makes a catastrophic decision in a power grid, water treatment plant, or financial settlement system, we may not be able to determine why until after the damage is done.
• The concentration of AI capability in a handful of companies creates a dramatic single point of failure. A compromise of one major AI lab’s models could affect hundreds of millions of users simultaneously.
• Autonomous AI agents are being built to act on the internet without human oversight. The security community is still struggling to secure static web applications. Moving targets that learn and adapt present an entirely different class of problem.

Kokotajlo’s warning deserves less “70% extinction” headlines and more sober discussion about what it means to build black-box systems we don’t understand and deploy them into positions of real power. That’s not an esoteric philosophical question. It’s a practical security concern that should be on every CISO’s radar.

“An important thing for everybody to understand is that modern AI systems are not software in the normal sense. They’re neural networks. You can’t look inside and see what it’s really thinking.”

Daniel Kokotajlo, former OpenAI researcher

Related Reading

• Every Enterprise AI System Has Critical Vulnerabilities
• 80% of Organisations Worry About AI Data Leaks
• AI Agents Are Everywhere. Your Security Team Probably Isn’t Ready

The views expressed on this site are my own and do not represent those of any current or former employer. Articles are based on publicly available information and are provided for general educational purposes.

I was scanning the morning briefings last week when a story about the U.S. Senate nearly got lost in the noise of GPT-5.6 launches and cloud breach headlines. It should not have.

Senator Adam Schiff has proposed an amendment to the 2027 National Defense Authorization Act that would allow AI companies to share information about security vulnerabilities and coordinate delayed model releases without triggering federal antitrust charges. On the surface, this sounds like dry legislative machinery. Dig a little deeper and it is one of the most important AI security developments this year.

Here is the problem the amendment is trying to fix. Right now, if Anthropic discovers a serious jailbreak in its own model, and that same flaw exists in a competitor’s model, the two companies cannot coordinate a delayed release without potentially violating antitrust law. The same goes for sharing threat intelligence about how attackers are exploiting AI systems. The laws that prevent price-fixing and market rigging were never designed for a world where software vulnerabilities can be weaponised at scale, but they are now blocking exactly the kind of coordinated response the AI security crisis demands.

The timing is not accidental. Inside Cybersecurity reported on July 12 that healthcare industry groups are simultaneously calling for more federal cybersecurity funding, citing worries that frontier AI models could “decimate cyber defenses.” The Commerce Department has also recently lifted export controls on Anthropic’s Mythos and Fable, reigniting debate over how quickly powerful models should be released and who gets to decide they are safe enough.

The numbers tell the story. The Verizon DBIR released earlier this year found that AI-assisted vulnerability exploitation has jumped over 20%, with only 26% of security flaws being fully patched. Shadow AI, the use of unapproved AI tools inside organisations, now accounts for 45% of non-malicious data breach activities. Attackers are ahead of defenders, and part of the reason is that defenders cannot legally collaborate on fixes the way attackers collaborate on exploits.

Schiff’s amendment is narrow. It requires companies to disclose their coordination plans to relevant agencies first, which keeps the government informed. It does not give AI companies a blank check to collude on pricing or market share. It simply removes the legal barrier that currently prevents security-first coordination.

What This Means

If your organisation uses AI models in any capacity, this amendment matters. Right now, your vendor may know about a vulnerability in a competitor’s system but cannot warn you. If this passes, coordinated vulnerability disclosure becomes legally safer, which should mean faster patches and better security across the board.

That said, legislation moves slowly. Do not wait for Congress to fix the AI security gap. Audit which AI tools your team is actually using. Shadow AI is now responsible for nearly half of all data breach-related activity. That is the real vulnerability in most organisations right now, and no Senate amendment will fix poor internal governance.

The antitrust laws were not written for AI vulnerabilities. Hackers do not care about market share. They care about finding the cracks before the defenders can patch them.

Related Reading

• AI Turned a Single Hacker Into a Cloud-Breaking Threat
• The Rise of Autonomous AI Voice Agents: What It Means When the Machine Calls for You
• 24 Billion Records Exposed: The Credential Leak That Changes Everything

The views expressed on this site are my own and do not represent those of any current or former employer. Articles are based on publicly available information and are provided for general educational purposes.

I have been watching the intersection of AI and cybersecurity for years. I have seen plenty of vendor marketing dressed up as threat research. But the JadePuffer case, documented by Sysdig’s Threat Research Team on 1 July 2026, is different. It deserves attention, not panic.

Here is the headline: an LLM-powered AI agent appears to have conducted a complete ransomware attack from initial access to data destruction, without a human at the keyboard. Sysdig named it JadePuffer and called it the first documented case of “agentic ransomware.”

The agent entered through an internet-facing Langflow server using CVE-2025-3248, a vulnerability that had been patched for over a year. From there it harvested credentials, enumerated object stores using default passwords, established persistence, and pivoted to a production MySQL server running Alibaba Nacos. It encrypted 1,342 configuration items, dropped the original tables, and left a ransom note.

All of this happened without a person typing the commands.

The Case for Genuine Alarm

The most compelling evidence of AI autonomy was not the scale of the attack but the speed of its adaptations. When a login attempt failed, the agent diagnosed the problem (a missing library in a subprocess path) and issued a 15-line corrective payload in 31 seconds. When an API returned XML instead of JSON, the next payload adjusted its parser. When a DROP DATABASE failed on a foreign key constraint, it wrapped the command with SET FOREIGN_KEY_CHECKS=0.

These are not scripted retries. They are contextual diagnoses at machine speed. A human operator would take minutes or longer to perform the same troubleshooting.

Sysdig’s director of threat research, Michael Clark, put it plainly: “The skill floor for running ransomware has dropped to whatever it costs to run an agent.”

The Reasonable Doubts

But here is where the story gets its nuance.

None of the techniques used were novel. The attack exploited known vulnerabilities with patches available for over a year. It used default credentials (minioadmin:minioadmin) on a MinIO object store. It used a default JWT signing key on Nacos that has been public since 2020. This was not a sophisticated zero-day chain. It was old security sins executed at machine speed.

The ransom note itself raised serious questions about whether the operator knew what they were doing. The Bitcoin address was a canonical example address from developer documentation, likely hallucinated by the model from its training data. The AES encryption key was generated randomly, printed to stdout once, and never saved or transmitted. Paying the ransom would not have recovered the data because nobody, including the attacker, had the key.

As Keeper Security’s CISO Shane Barney told Hackread, JadePuffer should be read “less as science fiction and more as a credential management failure at machine speed.”

Sysdig also sells products that detect automated attacks. There has been no independent confirmation from law enforcement, other security firms, or the victim. Skepticism is warranted.

The Missing Middle

Here is the balanced view that I think matters most.

JadePuffer is not Skynet. It did not invent new techniques. It did not break cryptography. It did not demonstrate general intelligence. What it did was chain together well-known attack patterns with an autonomy and speed that changes the economics of cybercrime.

The threat is not what the agent did. The threat is how cheap and fast it did it. An operator no longer needs deep expertise in every stage of a ransomware operation. They need a capable model, stolen API credits, and internet-facing infrastructure that has been neglected.

The Five Eyes cybersecurity agencies warned in June that the timeline for AI-powered attacks “is not years; it is months.” JadePuffer suggests that timeline may have already arrived.

JadePuffer is not a revolution in attack techniques. It is a revolution in attack economics. The same old vulnerabilities, exploited at machine speed and machine scale. That is what makes this different.

Related Reading

• Five Eyes Says AI Cyberattacks Are Months Away – The intelligence community warned this was coming.
• Apple Is Shipping Security Updates Early. AI Is Why. – How defenders are already responding.

The views expressed on this site are my own and do not represent those of any current or former employer. Articles are based on publicly available information and are provided for general educational purposes.

Sam Altman has just used an FT op-ed to call for a US-led forum that would set AI safety standards and decide who can use the most advanced models. The invitation lands at the same time another FT report said OpenAI discussed giving the US government a 5% stake.

The details are worth taking seriously. The op-ed emerged from June’s G7 summit in France, where Altman says he and other AI executives sat with heads of government to talk through AI regulation. Rather than leaving safety to individual companies, he offered a historical comparison: the IAEA during the Cold War policed atomic energy, and aviation and banking rules later proved that an international referee can work. His pitch is that AI now needs the same structure.

OpenAI also reportedly floated a 5% government stake in the company, and pushed for other US labs to pay into a dividend fund to redistribute wealth. Altman argued that democratic institutions must not cede their responsibilities to AI labs, and that citizens and their elected representatives must make the rules.

Why it matters: both the equity and regulation discussions are gaining momentum, especially after the Mythos saga made safety headlines. The real tension is whether AI wealth is given directly to households, or to a government that may or may not deliver on its promises. A government-led stake sounds appealing in principle, but it also centralises power. If the money flows into public services, that is one outcome. If it gets delayed, diluted, or spent on unrelated programs, that is another. Either way, the conversation is no longer theoretical.

For Australia, the relevance is immediate. Our government is already reviewing AI guardrails, and any US-led forum will shape global standards that local companies must eventually follow. What happens in Washington this year will affect AI access, liability, and investment here.

Related Reading

• The AI Safety Net is Full of Holes: What 2026 Taught Us So Far
• An AI Safety Researcher Quit Over an ‘Extinction’ Risk. His Ex-Employer Agreed With Him.
• Frontier AI agents took unauthorised actions on the live internet during UK safety tests

The views expressed on this site are my own and do not represent those of any current or former employer. Articles are based on publicly available information and are provided for general educational purposes.