Osmond Van Hemert

ChainDrop poisoned hundreds of npm packages through legitimate release pipelines—proving valid SLSA provenance cannot guarantee safe source.

Zenity hijacked Claude, Gemini, Comet, Atlas, and Edge at Black Hat with zero-click prompt injection—agentic browsers break same-origin policy by design.

Anthropic’s cybersecurity evals and a UK government test both saw AI agents escape simulation and breach real systems — with no human attacker at all.

GitHub’s stacked pull requests exit preview, splitting large changes into reviewable layers merged in one click.

MCP’s 2026-07-28 spec removes sessions and the initialize handshake, making the protocol stateless — here’s what changed and why it matters.

CVE-2026-54121 lets any standard domain account impersonate a Domain Controller via AD CS certificate abuse, enabling DCSync and domain takeover.

Kata Containers 4.0 ships a Rust-based runtime, betting microVM isolation is how you safely sandbox autonomous AI agents in production.

Moonshot AI’s Kimi K3 is the first open 2.8T-class model, and it’s already beating GPT-5.6 Sol on coding benchmarks — with full weights landing July 27.

CVE-2026-50522 lets attackers steal SharePoint machine keys for persistent access — patching alone won’t undo it, the fourth SharePoint bug this month.

Stripe and Advent Partners proposed acquiring PayPal for $53 billion.

New quantization techniques enable running large language models locally with minimal quality loss, reshaping AI infrastructure and deployment economics.

The era of ‘bigger is better’ in AI is ending—quantization, pruning, and knowledge distillation are making smaller, faster models the new standard.