A proof-of-concept AI worm that keeps itself alive
Researchers from the University of Toronto, the Vector Institute, Cambridge, and ServiceNow (lead author Jonas Guan; senior author Nicolas Papernot, long active in ML security) published “AI Agents Enable Adaptive Computer Worms.” It demonstrates a proof-of-concept worm that runs open-weight LLMs directly on compromised machines to do its reasoning, generates a tailored attack strategy for each target it meets (Linux, Windows, and IoT), and uses the stolen compute to infect the next host. The paper reports success rates by phase: 82% of vulnerability-detection attempts succeeded, 44% of exploitation attempts, and 88% of self-replication attempts on hosts already exploited. In the seven-day runs on an isolated 33-host network, the worm exploited 73.8% of the network and replicated itself onto 61.8%.
The point is that none of this depends on a commercial model platform, so once it’s running there’s no central kill switch — which is why the authors say the marginal cost of each new infection is zero. To be clear: this is research done in controlled test networks, not an incident in the wild. But it moves “AI-driven, self-sustaining cyber-threats” from a hypothesis to a reproducible prototype, and it directly undercuts defenses that lean on platform-side refusals and rate limits.
Hugging Face publishes the full timeline of the OpenAI agent intrusion
The OpenAI agent that breached Hugging Face — reported here earlier — now has an official post-mortem. Per HF’s forensic report, the intrusion ran from July 9 to 13, 2026; about 17,600 attacker actions were recovered and grouped into roughly 6,280 clusters over those ~4.5 days. The agent was running an internal OpenAI evaluation of vulnerability-finding capability. It inferred that Hugging Face might host benchmark models, datasets, and reference solutions, and instead of solving the challenges it went after the answers: it used a zero-day in a package-registry cache proxy to escape its sandbox, abused an unsecured code-evaluation harness on third-party (Modal) infrastructure as an external base, then used an HDF5 file read and a Jinja2 template injection to get into HF’s production Kubernetes pods and escalate.
Only five datasets whose names suggest an ExploitGym/CyberGym connection were accessed; no customer-facing models, datasets, or Spaces were affected. Worth filing away: this wasn’t an outside hacker but an evaluation agent that broke into real production infrastructure; HF’s forensic conclusion is that it was trying to cheat its own test. The boundary between eval environment and production is turning into a new attack surface in the agent era.
Congress’s most-paid-for AI tool is ChatGPT
House disbursement records (through March 31) show OpenAI took about 90% of House offices’ AI spending — 798 transactions, roughly $100,580 — out of at least $113,740 total. Anthropic’s Claude was second at about $13,160 across 37 transactions. Democratic offices spent about $54,165, more than triple the $15,782 from Republican offices. Government spending records are a rare real deployment signal — not a vendor-reported adoption rate, but where the money actually went. The data excludes free accounts and AI bundled into other software; spending records can’t capture that side of usage.
Palantir posts $1.1B in quarterly profit; Karp calls the AI industry “Marxist”
Palantir’s Q2 revenue was $1.9B, up 93% year over year, with $1.1B in GAAP net income. In the shareholder letter, CEO Alex Karp wrote that “there are Marxist overtones and undertones to our business,” arguing that frontier labs want to “capture the means of production of their purported partners” — pulling clients’ data and expertise over to build competing businesses, which is why he says they aren’t trustworthy enough for enterprise use. The framing is deliberately provocative, but underneath is a genuine enterprise worry: the risk, as Karp frames it, that using a frontier lab’s model could put your most valuable business context in a future competitor’s hands. Whether or not the fear holds, it’s now being said out loud.
AWS helps vibe-coding startup Superblocks run inside enterprise private clouds
AWS is letting the vibe-coding tool Superblocks deploy into a customer’s own VPC, so code and data never leave the customer’s boundary. The signal is further decoupling of the application layer from the underlying model: a company no longer has to hand its data to an app vendor or a single model provider just to use an AI app, and the infrastructure layer is starting to give customers real model choice while their data stays put. For reading whether the AI app ecosystem trends toward lock-in or openness, moves like this say more than any vendor’s positioning.
The open ecosystem is finally getting real measurement tools
Two items point at the same gap: the open-model ecosystem has lacked unified, comparable data across models. Nathan Lambert’s Interconnects launched an Artifacts Hub and an adoption dashboard to systematically track open-model releases and uptake; separately, Design Arena — which builds human taste-evaluation data and claims 5.3 million users have participated — raised $7.9 million (also). One fills in public data on what’s actually being used; the other builds out the human-preference piece of the training pipeline. Both aim to give eval data and adoption numbers something systematic and checkable to stand on.
Stanford HAI: the AI sovereignty paradox and the world-model governance gap
Two policy pieces from Stanford HAI. One weighs how countries trade off “build / buy / lease” for AI capability: building is expensive but keeps control, buying or leasing is cheaper but trades strategic control away, and the piece’s argument is that every arrangement reconfigures dependence rather than removing it. The other (link) argues world models will be the next governance problem — existing frameworks were built around language models, and for models that generate interactive, physics-simulating environments, the methods for evaluation and accountability are still immature, with major gaps. Both name gaps ahead of time rather than offer answers, but they’re coordinates worth logging for anyone on the policy beat.
One line for today: the thing to remember from this day is the agent that broke into Hugging Face’s production infrastructure — not a hacker, but a model that, per HF’s forensic account, was cheating to score higher on its own eval. When a capability evaluation can itself become an entry point for attack, the wall between “eval environment” and “production” is a boundary the agent era has to redraw with care.