Articles

Treasury Secretary Bessent and Fed Chair Powell convened the CEOs of Goldman, Citi, Morgan Stanley, BofA, and Wells Fargo over Anthropic's unreleased Claude Mythos Preview. It is the first time a government treated an AI model's raw capability as a systemic financial risk. Here is what that shift means for compliance programs, plus the platform CVEs exploited in under 10 hours and GrafanaGhost turning enterprise AI assistants into exfiltration channels.

Last week, attackers stopped going after AI applications and started going after the tools that build them. CrewAI shipped four critical CVEs, Azure AI Foundry hit CVSS 10.0, Claude Code's deny rules got bypassed, and North Korea weaponized deepfakes for a nation-state npm attack. So let's discuss what compliance teams need to change now.

RSAC 2026 drew 44,000 attendees and a flood of AI security product launches, but the real story was what the data revealed: 500,000 machines backdoored through LiteLLM, AI-generated code producing 35 CVEs in a single month, AI agent traffic up 7,851%, and a federal judge calling the Pentagon's AI ban "Orwellian." The governance gap is accelerating.

FedRAMP reviewers called Microsoft's government cloud a pile of shit and approved it anyway. Meta's AI agent went rogue and triggered a Sev-1 incident. Anthropic's own research proved AI can learn to fake alignment. GlassWorm poisoned 400+ developer repos targeting AI coding tools. The governance gap is getting bigger and bigger.

An autonomous AI agent hacked McKinsey's AI platform in 2 hours for $20 in tokens. Hackerbot-Claw compromised 47,391 GitHub repos autonomously. APT36 is mass-producing malware with AI coding tools. Anthropic sued the Pentagon. And MCP hit 30 CVEs in 60 days.

In a week, Claude went from being refused to the Pentagon to planning airstrikes in Iran. AI tool CVEs hit industrial scale with multiple CVSS 9.8+ in a single week. Schneier published the first formal kill chain for prompt injection. And reasoning models can now jailbreak other AI at 97% success rates. The landscape just shifted under everyone's feet.

Anthropic dropped its hard safety commitment in RSP v3.0 on the same day the Pentagon gave it a Friday deadline to remove guardrails or lose $200M. CrowdStrike reported 27-second breakouts and 89% surge in AI-enabled attacks. Three major threat reports in 48 hours confirmed AI attack scaling is measured reality.

ClawHavoc poisoned 20% of the largest AI skill marketplace. IBM's X-Force Index confirms vulnerability exploitation is now the #1 attack vector, fueled by AI. NVIDIA brought AI cybersecurity to the factory floor. And a new jailbreak technique tricks models into reasoning their way past their own safety rules. This week's developments demand new controls that most organizations have not written yet.

Anthropic disclosed that Chinese AI labs ran industrial-scale distillation attacks extracting capabilities from Claude via 16 million API exchanges. Meanwhile, the Pentagon approved the least-safe major AI for classified systems while threatening the safety leader. This week exposed how broken our incentive structures really are.