Ori Nimron has released functional exploit code for CVE-2026-40369, a Windows kernel vulnerability, three months after Microsoft issued a patch. The release of this code, rather than the existence of the vulnerability itself, represents the primary security concern for enterprise environments. While the vulnerability was addressed in the May 2026 Patch Tuesday cycle, the availability…
The Securities and Exchange Commission (SEC) has a peculiar way of signaling that the era of regulation-by-enforcement is nearing its expiration date. On August 18, 2026, the agency bypassed its own public meeting schedule, opting instead for a seriatim vote to release Regulation Crypto Assets (Release No. 33-11434). It was a quiet, surprise maneuver that…
Three independent security research teams, working across three different AI coding assistants, found the same thing: the tools were auto-executing workspace configurations before the developer ever saw a consent prompt. The pattern is systemic, and the attack surface it reveals sits inside the developer’s own IDE. The technical mechanism is straightforward. Tools like Amazon Q…
On July 28, Sam Altman told a podcast audience that OpenAI might need to pace the rate of AI development. Three weeks later, the company did something more concrete than pace. OpenAI has formally paused its largest planned reinforcement learning training run for its next-generation models, codenamed Astra, and halted portions of RL training across…
Visa is currently shopping for a new stablecoin settlement and over-the-counter (OTC) partner. While the move appears to be a routine vendor swap, it functions as a strategic decoupling. According to CoinDesk, which reviewed the request for proposal (RFP) issued on August 18, 2026, the payment giant is looking to fill a void left by…
The LiteLLM Breach and the New Reality of AI Infrastructure On March 24, 2026, the Python Package Index (PyPI) hosted malicious versions of the LiteLLM library—specifically 1.82.7 and 1.82.8—for approximately 40 minutes. Orchestrated by the threat actor Team PCP, this incident represents a structural shift in how we must evaluate the integrity of the tools…
The Two-Speed Regulatory Divergence in US Digital Assets On August 14, 2026, the SEC was scheduled to discuss its “innovation exemption” for tokenized securities under the “Reg Crypto” agenda. The meeting was canceled. The proposal – which would have given domestic crypto firms a conditional path to issue, custody, and trade tokenized equities, money-market funds,…
Something broke in how we think about agent security. The recent disclosure of CVE-2026-18830 in the Amazon Bedrock AgentCore harness does not just patch a bug — it reveals a structural vulnerability class that the industry has not yet adequately named. The vulnerability is straightforward in concept but significant in implication. CVE-2026-18830 (CVSS v4.0: 8.6)…
For the better part of two years, the AI infrastructure world has been obsessed with throughput. We treated LLMs like high-performance batch processors, feeding them massive queues of requests and optimizing for how many tokens we could squeeze out per second. It was a clean, predictable model. But as we move from simple chatbots to…
The European Union AI Office has initiated a recruitment drive for 40 contractual agents, marking the transition from establishing a regulatory framework to building an active inspection regime. By adding these roles—technology specialists, legal officers, operations specialists, and paralegals—the office is scaling its capacity to handle the practical demands of the AI Act. This expansion…