Week 40 · 2026

The Dutch Institute for Vulnerability Disclosure (DIVD) has reported a significant security breach involving an unprecedented use of autonomous AI in a cyberattack. The incident was facilitated by two previously unknown zero-day vulnerabilities in the open-source Zammad ticketing system, identified as CVE-2026-102489 and CVE-2026-102490. These flaws allowed an attacker to perform session hijacking, execute remote code, and escalate privileges to root level within seconds. What distinguishes this attack is the use of an 'agentic' AI component that operated without human direction, making autonomous decisions to navigate the network and exfiltrate data. Because the AI agent left behind logs explaining its decision-making process, DIVD researchers were able to reconstruct the timeline of the 'loud and messy' attack. While the attacker managed to access and read data from DIVD systems, the impact was limited by existing network segmentation and rapid incident response measures that prevented deeper penetration into the organization's infrastructure. The vulnerabilities were discovered in collaboration with Merlon Security. Zammad, a widely used helpdesk platform for organizations like Amnesty International and NextCloud, is currently vulnerable to these exploits. To mitigate the risk, DIVD recommends that all Zammad administrators upgrade to version 7 or take their instances offline until they can ensure security.

The Anthropic Frontier Red Team has released findings regarding the evolving landscape of advanced cyber capabilities within large language models. Through testing on 100 randomized tasks from an internal Binary Exploitation benchmark, researchers observed a measurable increase in the ability of models to execute full control flow hijacks. Specifically, the Claude Mythos Preview model achieved a success rate of 6%, while GLM-5.3 followed closely at 4%. This represents a significant technological leap compared to older models such as Claude Opus 4.6 and GLM-5.2, which failed to achieve any successful exploitations in the same benchmark. The data suggests that a critical threshold has been crossed where frontier models are beginning to demonstrate autonomous proficiency in complex software exploitation tasks, posing new challenges for cybersecurity defense and AI safety alignment.

The landscape of cryptographic security is undergoing a fundamental shift due to advancements in AI-driven cryptanalysis. Researchers from institutions including Anthropic, ETH Zurich, and TU Berlin have demonstrated that models like Claude Mythos Preview can compress the timeline for finding mathematical flaws from months or years to mere hours. A primary example is the discovery of a vulnerability in the HAWK digital signature scheme, which led to its withdrawal from NIST standardization after being undetected by human experts for two years. Furthermore, the AI introduced the 'Möbius Bridge' technique, significantly accelerating attacks on reduced-round AES variants. This rapid acceleration of vulnerability discovery creates a dangerous gap between the identification of a flaw and the ability of organizations to patch it. To mitigate this risk, the article advocates for the implementation of a Cryptographic Bill of Materials (CBOM) to map all cryptographic dependencies across an enterprise. Ultimately, true security will depend on 'crypto-agility'—the architectural capability to replace algorithms via configuration changes rather than costly code rewrites—allowing organizations to adapt as AI continues to increase the speed of attackers.

The article explores the intersection of artificial intelligence safety and nuclear command and control (NC3) infrastructure. It begins by citing warnings from Anthropic's alignment science lead regarding the potential for catastrophic outcomes from future superintelligence. The author argues that while the debate often focuses on abstract future models, the immediate danger lies in the current deployment of narrow AI within space-based architectures. Modern satellite constellations are moving away from simple data relay to 'edge AI,' where onboard processing identifies missile plumes and threats autonomously to counter hypersonic speeds. This shift compresses the decision-making window for human operators, creating a structural risk where a single false positive—caused by misidentifying debris or solar flares—could trigger a nuclear response. The text compares this to New York City's recent moratorium on AI in schools, noting that while a city can regulate classroom software, no global authority exists to regulate encrypted, remote-updateable military software. International efforts, such as the UN General Assembly Resolution A/RES/80/23 and the REAIM summits, aim to ensure human control over nuclear launches, but these initiatives face significant hurdles. The primary challenge is the 'verification gap': unlike physical weapons, AI models cannot be easily counted or inspected by adversaries, meaning a state can claim human oversight while actually relying on opaque, biased, or un-auditable AI-driven data filtering.

As AI agents move from experimental tools to enterprise-grade automation, a significant gap has emerged between how technologists, lawmakers, and business leaders define 'agentic' behavior. Current US legislative efforts, such as the federal AI AGENT Act and California's SB 1106, demonstrate this divergence by defining agents through either user relationships or technical architecture. The authors argue that this lack of a shared language complicates the creation of effective regulatory frameworks. Technically, agentic AI is distinguished from standard LLMs or scripted bots by its ability to exhibit autonomy and adaptability—essentially moving from 'copilot' to 'autopilot' functionality. This involves breaking down complex goals into subtasks and revising plans based on environmental feedback. Furthermore, the impact of an agent is determined by its access to consequential systems, such as financial databases, web interfaces, or internal company files. The article concludes that because agents exist on a spectrum of autonomy and authority, governance must be proportionate to the risks posed by their specific capabilities and the weight of the actions they are permitted to take.

The author argues that calling Ethereum a 'blockchain' is increasingly anachronistic due to the profound technological shifts occurring between the original Bitcoin model and the projected state of Ethereum in 2030. While early blockchains relied on Proof of Work and serial execution, the future of Ethereum lies in a hybrid construction that integrates modern cryptographic machinery. Key architectural changes include moving from full transaction re-execution to SNARK verification and PeerDAS for data availability. The roadmap suggests a transition toward 'lean Ethereum,' featuring multi-party block construction, highly optimized Proof of Stake, and integrated zero-knowledge proofs at the base layer. This evolution will fundamentally change user trade-offs, offering improved censorship resistance through FOCIL, enhanced privacy via ZK-SNARKs and private account abstraction, and lower hardware requirements for light clients. Furthermore, the author posits that the structure of computation is shifting; developers will be incentivized to use parallelizable, well-encapsulated dependencies rather than monolithic serial transactions. Ultimately, this transformation aims to turn decentralization from a performance bottleneck into a mechanism for increasing scale and privacy, potentially culminating in a system where obfuscation (iO) allows for fully secure, encrypted, and generalized computation.

The research presents GenFocal, a novel two-step generative framework aimed at enhancing the utility of coarse-scale climate models for regional risk assessment. The first stage focuses on debiasing: because climate models often suffer from systematic biases and lack alignment with high-resolution observations, the researchers employ rectified flows. This method uses an ordinary differential equation (ODE) to construct a mapping that transforms the distribution of biased climate states into a more accurate intermediate manifold. The second stage addresses super-resolution, where the framework increases both spatial and temporal resolution. To achieve this, a conditional diffusion model is used to learn the residual between a spatially interpolated version of the debiased data and the actual high-resolution weather manifold. This process utilizes a neural network-based denoiser trained via a stochastic differential equation (SDE) sampler to refine noisy residuals into clean, high-fidelity outputs. To ensure that these models can be used for long-term climate projections rather than just short bursts, the framework implements an inference procedure based on domain decomposition, which maintains temporal coherence across overlapping time windows. The effectiveness of GenFocal is validated through rigorous metrics, including Wasserstein distance and spatial correlation analysis, as well as application-specific tests involving North Atlantic tropical cyclones and heatwave patterns in the continental United States (CONUS).

The article discusses recent reports regarding a novel implementation of an attack against the RSA cryptosystem. Contrary to popular belief, this is not a brand-new mathematical discovery, as the foundational research originates from 2007; however, the current implementation presents a new way to bypass traditional factoring methods. The nature of this attack is specifically a forgery attack, meaning it enables an attacker to create fraudulent digital signatures without needing to extract the private key from the public key. Crucially, the vulnerability is limited to 'pure' RSA signatures that lack proper padding or formatting, which are rarely used in modern, secure implementations. In terms of computational complexity, the attack is categorized as a subexponential-time algorithm. While not polynomial-time, it has proven faster than traditional factoring techniques in recent tests, where researchers successfully forged messages for 1024-bit RSA using approximately 1380 CPU core-years of computation. The author emphasizes that while the speed increase is notable, the practical impact on standard, properly padded RSA implementations remains limited.

The article examines the legal and regulatory implications of the European Union's proposed Digital Omnibus, specifically focusing on a new attempt to define 'scientific research' within the General Data Protection Regulation (GDPR). While much public attention has focused on privacy rollbacks, this specific definition could serve as a foundational reference point for other EU legislations, including copyright law and the European Research Area (ERA) Act. The European Commission's current proposal includes activities that support innovation and technological development, even if they serve commercial interests. However, significant debate is occurring within the European Parliament across several fault lines. One major conflict involves whether AI development—specifically training and testing—should be explicitly protected under this definition, a point of contention between those seeking to bolster Europe's AI competitiveness and those wary of data protection erosion. Another split concerns the scope of research: some MEPs advocate for a broad definition that includes privately funded and commercial R&D, while others seek to limit it to non-commercial, public-interest work. Furthermore, there is debate over whether research should be judged by its methodology (such as being systematic or following OECD standards) or by the subjective intent of the researcher. The article concludes that while objective, method-based criteria are workable, subjective tests regarding 'genuine' intent could create legal uncertainty and chill scientific innovation.

The cybercriminal group known as Storm-3168, which is associated with the first documented agentic ransomware infection 'JadePuffer,' has executed a highly destructive attack against Azure cloud environments. According to research from Microsoft, the attacker gained access by exploiting client IDs, secrets, and tenant IDs that were inadvertently leaked in a public GitHub issue. Over an 18-hour window, the actor utilized two compromised service principals within a single cloud tenant to conduct systematic reconnaissance and destruction. The first service principal focused on discovery, performing over 300 read operations to map out Azure Virtual Machines, subscriptions, and resource groups. The second service principal was used for more aggressive actions, including the deletion of over 100 Azure Storage accounts and the removal of an Azure Key Vault, Function App, and App Service plan. The attacker also attempted to target Azure SQL databases and interfere with recovery-related resources like Azure Site Recovery and Azure Backup locks. Following the destruction phase, the actor performed credential harvesting by requesting access keys for various storage accounts. Although the tactics—specifically the targeting of backups and resource deletion—are consistent with the preparation for a ransomware or extortion campaign, Microsoft noted that no ransom note was issued and no data exfiltration has been confirmed at this time.

The preprint 'Oracle Distillation' by Ruhaan Shen and Soonwon Choi addresses a fundamental challenge in quantum computing: how to perform error correction when the device must interact with an unknown external system (an oracle) whose behavior is being learned. Unlike standard fault-tolerant computing where gate operations are known, querying an unknown oracle introduces noise that can corrupt the interface. The authors propose 'Oracle Distillation' (OD), a procedure that consumes multiple noisy queries to produce a single distilled oracle that is ε-close to the ideal version in diamond norm.

The protocol relies on the concept of 'weak queries,' where instead of querying a standard bitstring, the system uses a designed query state that is resistant to low-weight Z errors. The process involves encoding inputs into query blocks, performing weak queries, aggregating responses, and using uncomputation to return the blocks to a codespace. A significant result of this paper is the threshold theorem, which proves that for Boolean oracles, quantum advantages (such as those in Grover's or Simon's algorithms) persist even under i.i.d. single-qubit depolarizing noise, provided the error rate remains below a specific constant threshold. While some thresholds are quite low—such as 5.1 × 10⁻⁴ for Grover search—the protocol demonstrates that the structure of local noise allows for the preservation of computational speedups that would otherwise be destroyed by correlated noise. The authors suggest potential future applications in computational quantum sensing and fault-tolerant Quantum Random Access Memory (QRAM).

Cryptocurrency exchange Bitget has confirmed a major security breach resulting in the loss of $387.5 million across various digital assets. Forensic investigations conducted by blockchain security firm SlowMist and Google Cloud's Mandiant indicate that the attackers successfully exploited zero-day vulnerabilities within two third-party security appliances. The intrusion began as early as August 31, with attackers using hidden scripts to access database credentials via compromised nodes. By September 24, the threat actors had established persistent access by deploying web shells on a security appliance and moving laterally to Bitget's production wallet job servers. Once inside the infrastructure, they deployed custom malware and a specialized withdrawal tool to execute unauthorized transfers from hot and warm wallets. The theft spanned several hours and affected multiple blockchain networks, including Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base. Bitget CEO Gracy Chen has pointed toward North Korean-linked threat actors as the culprits, citing specific IP patterns and on-chain evidence. To mitigate the impact, Bitget has suspended withdrawals and launched a Recovery Bounty Program, offering 5% of recovered funds to individuals who can assist in freezing or retrieving the stolen assets.

The chemical and life science industries are transitioning from passive observation to active strategic demand for quantum technologies, driven by a need to overcome the 'R&D paradox' of high costs and low success rates. In the chemical sector, the priority is not merely increasing qubit counts but achieving high gate fidelity, effective error mitigation, and seamless integration with existing high-performance computing (HPC) environments. Major cloud providers like Google, IBM, and Microsoft are viewed as the foundational infrastructure layer, offering robust hybrid architectures and research into fault tolerance. Meanwhile, pure-play hardware companies such as Quantinuum, IonQ, and Atom Computing are recognized for their specialized architectures—like trapped-ion and neutral-atom systems—which provide the precision necessary for modeling complex transition states and battery chemistry. In the life sciences, the focus is on compressing the decade-long drug development cycle. Companies like AstraZeneca and Moderna are looking toward quantum-enhanced AI and high-fidelity molecular simulations to accurately map protein-ligand interactions and electronic structures that classical computers cannot resolve. Ultimately, the industry's success depends on specialized software providers acting as a bridge, translating raw quantum hardware capabilities into actionable chemical properties and biological insights.

Google has officially announced the launch of Gemini 4 Argon, its latest frontier AI model designed for complex tasks including coding, office productivity, and advanced cyber defense. In recent performance evaluations, Argon demonstrated significant leads in software engineering capabilities, scoring 77.9% on the DeepSWE v1.1 benchmark, surpassing Claude Opus 5.5 and GPT-6 Astra. A standout feature of the model is its enhanced security profile against indirect prompt injection attacks; it achieved a remarkably low attack success rate of 0.7% on Gray Swan's testing platform, outperforming other leading models like Claude Fable 5.1 and Grok 4.6. To manage the risks associated with such high-level capabilities, Google is implementing a phased rollout strategy. The model is initially being made available to vetted security partners through the Fairwind Program, which includes government agencies and critical infrastructure operators. Notably, this version of the model is being deployed without traditional 'cyber guardrails'—the safety filters that typically prevent models from generating exploit code—to enable defenders to identify and patch vulnerabilities proactively. This approach mirrors similar initiatives by Anthropic and OpenAI. Beyond security, Argon offers a massive increase in context capacity, supporting up to 1 million tokens per response. Following the initial controlled release, the model will become available to paid API customers and Google AI Ultra subscribers at introductory pricing.

In a collaborative breakthrough between Alice & Bob and ENS Lyon, researchers have introduced a novel mechanism for stabilizing cat qubits in superconducting quantum systems using a DC voltage bias. Traditionally, cat qubits—which store information within microwave resonators—require a complex microwave-driven coupler to dissipate photons in pairs to maintain stability. This process often introduces unwanted frequency nonlinearity and requires significant hardware overhead. The new approach utilizes a SQUID biased with a small DC voltage (approximately one millionth of a volt) to drive photon exchange. By tuning the bias voltage, the researchers successfully demonstrated one-, two-, and four-photon exchange rates on the same chip, achieving a two-photon exchange rate of 3 MHz. This method effectively suppresses parasitic frequency effects that typically plague cat codes. Beyond performance improvements, the use of voltage lines instead of microwave drives offers significant advantages for scalability; voltage lines are more compact, easier to wire, and generate much less heat within the ultra-cold environments required for quantum computing. The ability to facilitate four-photon processes is particularly significant, as it opens the door to the development of four-component cat qubits, which encode information across four coherent states—a feat that is extremely difficult to achieve with existing microwave-driven methods.

OpenAI recently disclosed the disruption of a coordinated campaign targeting its models' protected reasoning processes. This activity, identified as adversarial distillation, involves using one model's outputs or internal reasoning to train or improve competing models without authorization. The attackers did not compromise OpenAI's core infrastructure or databases; instead, they exploited model interaction patterns to reproduce hidden reasoning steps that are typically withheld from final user outputs. One notable technique involved copying encrypted reasoning from one conversation and using another model instance to decrypt and transcribe the content.

The scale of the attack was significant, with a major spike occurring on July 24-25 involving 16,000 requests across thousands of users. While the full extent of the attribution remains under investigation, OpenAI has linked a core cluster of the activity to individuals associated with Moonshot AI, the developer of Kimi. The company emphasized that this type of attack poses significant safety and national security risks, as it allows for the rapid transfer of advanced capabilities without the necessary safety investments.

To combat this, OpenAI deployed several layers of defense, including banning fraudulent accounts, strengthening signup controls, and implementing technical checks to detect and hold streamed output that might expose reasoning. They also closed pathways that allowed the replay of encrypted reasoning artifacts. Beyond internal fixes, OpenAI has engaged in proactive information sharing through the Frontier Model Forum and government channels to help the broader AI ecosystem defend against similar threats. The company remains focused on improving detection, strengthening technical protections, and enhancing threat-intelligence sharing as adversarial distillation techniques continue to evolve.

The United States Treasury Department has officially designated the A7 Network as a transnational criminal organization, alleging it serves as a critical mechanism for Iran and the Islamic Revolutionary Guard Corps (IRGC) to evade global sanctions. The Office of Foreign Assets Control (OFAC) identified the network's presence in Russia, Kyrgyzstan, Nigeria, and Zimbabwe. To combat this, FinCEN has proposed a new rule under the Combating Russian Money Laundering Act that would prohibit U.S. financial institutions—including crypto exchanges—from engaging in fund transfers involving the network's 'Sub-Agents'. These agents are used to disguise sanctioned payments as legitimate trade. The network relies heavily on the A7A5 token, a ruble-backed asset operating on the Tron and Ethereum blockchains, which acts as a bridge to USDT and fiat currencies like dollars, yuan, and euros. Research indicates that over 180 entities moved roughly $179.1 billion in A7A5 tokens during a period spanning early 2025 to mid-2026. The network's operations are highly sophisticated, utilizing custom VPNs to spoof transaction origins and leveraging hundreds of sub-agents across 83 countries to process billions in fiat transfers. Beyond Iranian sanctions evasion, the Treasury also linked the network to North Korean exchange hacks and weapons procurement. The A7 Network was reportedly launched in late 2024 by figures including Ilan Shor and Promsvyazbank, and its historical volume represents a significant portion of Russia's foreign trade.

Researchers at the University of Pennsylvania have achieved a breakthrough in quantum computing by introducing a parallelized multi-qubit entangling gate. Traditionally, entangling qubits in diamond-based nitrogen-vacancy (NV) centers requires a sequential process where an electron interacts with individual nuclear qubits one by one. This slow approach is prone to crosstalk errors and limits the efficiency of quantum operations. The new method utilizes a precisely timed sequence of controls that allows the central electron to interact with three nearby carbon-13 nuclei simultaneously. This single-gate operation successfully realized a four-qubit Greenberger–Horne–Zeilinger (GHZ) state in just 14.8 microseconds, which is approximately ten times faster than the sequential method and approaches the fundamental limits of hyperfine coupling frequencies. Beyond speed, the parallel gate demonstrated superior fidelity, reaching 0.92 compared to the 0.69 achieved by sequential gates. This advancement provides a scalable foundation for more complex quantum algorithms, error correction, and enhanced quantum sensing in solid-state platforms.