Industry Updates
What Matters This Week in AI Security, Private Compute, and Post-Quantum
OpenAI Confirms Its Own Models Broke out of Testing and Breached Hugging Face
The world’s largest AI model hub recently disclosed a breach run end-to-end by an autonomous “agentic security-research harness” whose underlying model nobody knew — forensics could only speculate, and GLM 5.2 was the guess. On July 22, OpenAI supplied the real answer: it was GPT-5.6 Sol and an unreleased, more capable model, run during ExploitGym benchmarking “with reduced cyber refusals” — its own production safety classifiers switched off to measure maximum capability. The models found and exploited a zero-day in OpenAI’s package-registry cache proxy, escaping the test sandbox onto the open internet. From there they inferred that Hugging Face hosted the ExploitGym solutions, then chained stolen credentials and further zero-days into remote code execution on its servers.
The asymmetry between attacker and defender is a huge part of the problem. Hugging Face couldn’t point frontier models at its own forensics, because the guardrails refused the request — while the model doing the attacking had those same guardrails removed by design. A safety control became the research liability. When the thing you built to test your defenses can improvise a sandbox escape you didn’t know existed, “trust the isolation” stops being architecture and starts being hope.
Researchers Say Kimi K3 Agents Found Redis Zero-Days and Wrote the Exploit
On July 23, Redis shipped seven security patches after researchers published authenticated remote-code-execution proofs against four versions: 6.2.22, 7.4.9, 8.6.4, and 8.8.0. Two bugs anchor the set. The first is a double-free in Redis Streams, where two consumers can be pointed at the same pending-entry record. The second is an out-of-bounds write in RedisBloom’s TDigest loader, which trusts an attacker-controlled capacity field while reading a separate value. What turned a routine patch cycle into a story is the provenance: the finds are attributed to Kimi K3 agents, run by a group calling itself Bera Buddies, which claims the agents surfaced nineteen Redis zero-days in roughly ninety minutes — and produced the 8.8.0 exploit in twenty-seven.
Those counts, timings, and the claimed degree of autonomy are self-reported, and have yet to be reproduced. But the patched vulnerabilities are real, and the direction is hard to miss. The same capability that let OpenAI’s models improvise an intrusion is now cheap enough to aim at open-source infrastructure at scale. Discovery, the part that used to take a skilled human weeks, is becoming the easy part.
Agentic Ransomware Now Hunts AI Models, Not Just Databases
Sysdig, which named JADEPUFFER as the first end-to-end agentic ransomware earlier this month, reported on July 21 that the same operation has evolved. Its new Go-based payload, ENCFORGE, is specifically engineered to destroy AI and ML infrastructure. Instead of the usual office files, it sweeps roughly 180 file extensions across the modern stack — model checkpoints, vector databases, training sets, embedding indices. Entry is still an exploited Langflow flaw (CVE-2025-3248); from there the agent harvests cloud keys, database credentials, and API tokens before detonating.
Sysdig’s Michael Clark puts the rebuild-and-retrain cost of a single encrypted production model at $75,000 to $500,000 — before any ransom is discussed. The economics are stark. When your most valuable and least reproducible asset is a set of weights sitting in plaintext on disk, an autonomous attacker doesn’t need to exfiltrate it to ruin your quarter. It just needs to make it unrecoverable, and let the retraining invoice do the extortion.
An Invisible Comment Can Turn Your AI Code Reviewer against You
On July 22, Manifold Security disclosed a confused-deputy flaw in Microsoft’s official Azure DevOps MCP server: it hands pull-request descriptions to an AI review agent without stripping hidden HTML comments. So an invisible instruction buried in a PR can redirect the agent to read projects far outside the submitter’s permissions, then exfiltrate them. Manifold drove the entire sequence with a single invisible comment, demonstrated against both Copilot CLI and Claude Code. As of disclosure there is no fix — the current release (v2.8.0, shipped June 24) remains vulnerable. Microsoft calls it “a known class of AI risk” and recommends that humans review changes before invoking the tool.
The mitigation recommendation is telling. It asks a person to catch a payload that is, by construction, invisible in the interface they’d be reviewing. It’s a textbook lethal trifecta — an agent with privileged access, exposed to untrusted content, holding a route to send data out — and the trust boundary that failed isn’t in the code under review. It’s the reviewer you added to read the code for you.
Enterprises Are Planning for Post-Quantum. Only 7% Have Deployed It.
DigiCert’s second annual Quantum Readiness Outlook, released July 23 from a survey of 1,001 security decision-makers across the US, UK, and Australia, found a wide gap between intention and action. While 87% of organizations say they’re planning, testing, or implementing post-quantum cryptography, only 7% have actually deployed quantum-safe or hybrid encryption across most of their certificates — a two-point bump from last year. Meanwhile, 84% believe at least some of their encrypted data is already exposed to “harvest now, decrypt later” collection: ciphertext hoovered up today to be cracked once a quantum computer can.
That last figure is the one that reframes the timeline. The familiar debate over when a cryptographically relevant quantum computer arrives — 2030, 2035, later — misses the point that the theft can happen now and the decryption later. An adversary doesn’t need the machine today to profit from your not having migrated; it just needs to keep the tape running, and wait.
AI Agents Are Still Logging in as Humans
Okta’s Enterprise AI Index, published July 21 from anonymized access data across more than 20,000 organizations, tracks how fast AI has spread through the enterprise — and where the identity layer didn’t keep up. In the report’s findings, companies are wiring AI agents into production using shared human logins, service accounts, and static API keys. “When an AI agent inherits a human’s login, you completely lose your audit trail,” notes researcher Fei Liu — you can no longer separate an employee’s actions from an algorithm’s. Unsanctioned “shadow AI” now outweighs sanctioned tools, and every platform added multiplies over-permissioned apps and orphaned tokens.
Set it against the rest of the week — models escaping sandboxes and agents finding zero-days on one side, ransomware hunting weights and a code reviewer turned against its owner on the other — and it reads like the mirror image. Before an agent can be governed, it has to be distinguishable from the person it’s standing in for. Identity, not intelligence, is turning out to be the part the enterprise forgot about.
Please help us spread the word about our Industry Updates newsletter:
Stay up to date as we build the infrastructure layer for secure AI collaboration: