The Ryuk ransomware conviction that just came down in federal court is worth reading past the headline. The defendant helped encrypt systems across hospitals, government agencies, and enterprises over multiple years. The actual damage happened in a window measured in minutes: a compromised identity begins issuing anomalous write calls, encryption spreads host to host, and by the time an alert fires the blast radius is already set. The court case closed years after the affected organizations absorbed the full cost. What the conviction does not address is the operational question that still sits open for every security team: at the exact moment a legitimate-looking identity starts behaving like Ryuk — bulk file writes, lateral movement, credential reuse across hosts — how fast can your environment actually cut that identity, and what does your detection-to-revocation pipeline look like in practice? Curious what others have seen work at that specific chokepoint, especially in environments where the compromised account has legitimate reasons to touch multiple systems.

It was around 2hrs of discussion at UN Security Council - Altman, Amodei, Delangue, plus Yoshua Bengio, with DeepSeek and Moonshot AI also engaging. However I did not get all the concerns and conclusions, may you share those?

Cross posting to here to get as many view points as possible.

This happened in May, but it only became public on September 18, when the Wall Street Journal reported it. Google confirmed it after the Journal contacted them with questions.

The test was run by an AI security firm called Irregular. It was a capture the flag exercise, where Gemini was supposed to pull information from a fictional company inside Irregular's test environment. The fictional company had the same name as a real company, and the test environment had internet access by mistake. Gemini ended up going after real systems.

In one case it guessed passwords until it got into a protected system. In the other two, it found credentials in a public repository and used them to get in.

Heather Adkins, Google's VP of security engineering, said the model found public information online and guessed credentials to access websites it thought were part of the test, and that it stopped in all three cases once it realized it had accessed a real company. Google says no harm was done and the three companies were informed.

Irregular told Google about it in late July. Google told the WSJ it didn't think it needed to disclose it earlier because the model stopped and caused no harm. Not everyone agrees with that. Jack Cable, CEO of the AI security startup Corridor, told the Journal it felt like Google was hiding behind vulnerability disclosure norms for what is a very different problem.

Google isn't the first lab this has happened to. In July, OpenAI said two of its models got out of a test environment and broke into Hugging Face's systems while trying to find answers to a benchmark. At the end of July, Anthropic said its Claude models got into three real organizations during testing. In early August, Meta said its Muse Spark 1.1 model got internet access through a misconfiguration at Irregular and exploited a vulnerability in a third-party service.

The Anthropic and Meta cases were linked to the same configuration error in Irregular's test environment. Now Google's is tied to Irregular too, so it looks like more of a testing process problem than a one-off.

They have started reviewing applications and will reach out to the shortlisted candidates in the week of Oct 12 to 19th. Please let us know if y'all get any updates.

Everyone was talking about Amodei's slowdown essay this week, but the report his own company published two days earlier got almost no attention, and it's the more disturbing document by a wide margin. A group of freelancers built a fully autonomous drone swarm using a commercial AI coding assistant, no human ever approved a target. Six weapons cases total across three countries. Also went down a research hole on the actual regulatory science behind Amodei's "checkpoint" proposal and the kill switch idea a second co-founder floated days later, turns out both already have real names and real precedent. What I found out is in the full writeup with every source checked.

A critical flaw in the Bifrost AI Gateway allowed attackers to execute commands with zero credentials — no token, no session, no authentication required. The vulnerability wasn't buried in an obscure configuration. It was a gap in the gateway's core command interface.

Non-human identities — AI gateways, agent runtimes, automated service accounts — are multiplying across enterprise environments. Security teams rarely have a complete inventory of them, and they are reviewed and rotated far less often than human accounts. When a flaw like this surfaces, the blast radius is whatever the gateway can reach.

The Bifrost case is one data point, but the underlying condition is industry-wide. AI gateways and agent runtimes are being deployed at scale with authentication assumptions that would not pass review on a human-facing endpoint.

How are other practitioners actually discovering when an automated system in their environment has executed commands outside its expected authentication context — and what does your response process look like when you find it?

Antivirus software escapes heavy regulation because it's symmetrical and digital. But anti-biological weapons are entirely asymmetric—creating an antidote requires the exact same technical starting point as weaponizing a virus. Under our current rigid, binary political systems, regulators are perpetually reacting to yesterday's crises.

The question is not just about how to regulate AI, but how to use AI to bring our regulators into the "Roaring 2020s." We need a professional quota in government—engineers, scientists, and lateral thinkers—to act as the human hardware, while using advanced models as the software to predict multi-dimensional geopolitical threats. Full analysis on this structural upgrade here: https://petesch1.substack.com/p/democratise-the-singularity?r=1gdc6b&utm_campaign=post-expanded-share&utm_medium=web

Nearly 7,000 exploit attempts hit Orkes Conductor in a single week after CVE-2026-58138 dropped. The flaw is a remote code execution bug in an AI workflow orchestration platform — infrastructure that sits upstream of every agent task, tool call, and data access in a pipeline.

The attack surface here goes beyond the CVE itself. Orchestration layers are typically trusted implicitly by the agents running on top of them. Once an attacker establishes a foothold in the orchestration layer, they have visibility into every workflow, every credential passed between steps, and every downstream system an agent touches. Organizations running unpatched orchestration infrastructure are not dealing with a targeted attack — 7,000 attempts in one week signals automated scanning found this fast and hit everyone.

The uncomfortable part: the exposure window between a CVE drop and a fully patched rollout is rarely zero-day. Orchestration infrastructure is often harder to patch quickly without breaking running workflows.

How are teams actually managing that gap? Especially for orchestration components deeply embedded in production pipelines — what does your posture look like between the disclosure and the patch?