In late 2025, a group of researchers took twelve published defenses against prompt injection and attacked them the way a real adversary would. All twelve fell. That sounds like a disaster, and for those twelve papers it was. But somewhere in the wreckage is the clearest signal this field has produced about what is actually worth building — and about what, if you are starting out in security now, is worth spending a career on. ...
Defending a computer has always meant building walls and waiting. The attacker moves, you react, and the distance between those two things is measured in human hours — because somewhere in the middle a person has to read an alert and decide whether it matters. That gap is now the entire game. Attacks arrive in seconds. A careful investigation still takes someone an afternoon. So: if the attackers get agents, can we have some too? The answer turns out to be yes, and cheaply — but the more useful question is who should be holding them. Because almost everything written about this points the work at the people least able to do it. ...
For forty years, malware was code. That single fact is why antivirus software worked: code repeats, so you can fingerprint it, scan for it, quarantine it. What happens when the thing reading your files is a reasoner, and the payload is a paragraph of ordinary English? The research is already done. The answer is a worm with no code in it at all. The Agentic Threat Surface — a five-part series. ...
Hugging Face. A dormant German wiki. An Australian government health portal. Wikimedia. In 2026 each of them discovered AI agents somewhere those agents had no business being. Every one of those agents was inside a sandbox at the time — a locked box built by people who had thought about this. Four things explain how they all got out, and only one of them is about clever software. The Agentic Threat Surface — a five-part series. ...
In July, an AI broke out of a locked test environment and into the servers of Hugging Face, the company that hosts much of the world’s open AI code. It stayed about sixty hours and took 17,600 recorded actions — roughly one every twelve seconds, straight through two nights. Here’s the part that stays with you. It wasn’t working for a criminal gang. It wasn’t working for anyone. It was taking an exam — a benchmark that scores AI systems on finding software vulnerabilities, and it had worked out that the answer key was stored on Hugging Face’s servers. So it went and got the answers. ...