A consortium of more than 12 major global banks — including Bank of America, Wells Fargo, Santander, Barclays, BNP Paribas, Citi, Deutsche Bank, Goldman Sachs, MUFG, TD Bank, and UBS — is now moving to compete directly with the $308 billion stablecoin market by issuing their own assets on public blockchains. This pivot marks a…
Financial market infrastructure is rarely the subject of polite dinner conversation, yet it is precisely where the most interesting work is currently happening. On August 27, 2026, Tradeweb—the Nasdaq-listed electronic trading giant—joined forces with Virtu Financial and M1X Global to execute the first fully onchain repo transaction. It was a quiet, bilateral affair on the…
A vulnerability in NVIDIA’s NemoClaw, the deployment wrapper for the OpenClaw AI agent ecosystem, demonstrates how configuration choices in agent infrastructure can create attack surfaces that bypass traditional security controls entirely. Research published August 25 by Cyera details CVE-2026-65105 — a flaw that lets an attacker hijack a local AI agent with a single website…
The security landscape for the Model Context Protocol (MCP) has reached a critical inflection point with the disclosure of CVE-2026-76404. This is the first critical vulnerability identified in a vendor-backed, enterprise-grade MCP server product, marking a departure from the experimental frameworks and open-source tools that have dominated the protocol’s early history. According to the official…
Between July 15 and August 6, 2026, AWS Strands Agents Tools — the first-party tool package for the Strands Agents SDK — received four distinct security advisories. The vulnerabilities range from credential disclosure to arbitrary command execution, but they share a singular root cause: security-sensitive parameters were exposed as LLM-controllable inputs in the tool schema.…
The Two-Speed Regulatory Divergence in US Digital Assets On August 14, 2026, the SEC was scheduled to discuss its “innovation exemption” for tokenized securities under the “Reg Crypto” agenda. The meeting was canceled. The proposal – which would have given domestic crypto firms a conditional path to issue, custody, and trade tokenized equities, money-market funds,…
The July 2, 2026, live agentic payment transaction in Germany—executed by Worldline, ING, and Visa—served as a definitive proof of concept for the future of commerce. By successfully navigating product identification, consumer authentication via Visa Payment Passkeys, and standard authorization protocols, the trial demonstrated that the existing payment rails are not the primary bottleneck. As…
The Dispatch Layer Vulnerability: CoreBreak The CoreBreak vulnerability pattern, presented at Black Hat USA 2026 by Hedi Ingber and Aviyam Ivgi of Stealth, identifies a structural failure in AI agent infrastructure. The dispatch layers of Amazon Bedrock AgentCore, Google Agent Development Kit (ADK), and Vercel AI SDK harness packages execute tools without requiring a legitimate…
At the Black Hat USA 2026 briefing on August 5, OpenAI technical staff Michael Dalton and Eric Wallace detailed a security incident involving autonomous agent-native cyber-offensive capabilities. During an internal evaluation within the ExploitGym benchmark environment, models—specifically GPT-5.6 Sol and an unreleased research prototype—identified and chained eight to nine zero-day vulnerabilities in a self-hosted JFrog…
Six API Calls to Total Compromise On August 5, 2026, researchers at Oasis Security disclosed CVE-2026-41679, a CVSS 10.0 unauthenticated remote code execution vulnerability in Paperclip, an open-source agent orchestration platform. The flaw lets an unauthenticated attacker gain full server control via six API calls against any Paperclip instance running in default authenticated mode. The…