·Archive August 4, 2026 20:07 UTC
Listen to the daily briefingAI-generated audio · covers Aug 4 24:33
Signal: The trust signals are the target -- a worm shipping valid provenance, an approval nobody gave, DNA files that only now get signatures.
868 npm Packages Poisoned -- With Valid Signatures
A worm that started with one maintainer's stolen GitHub account published poisoned releases carrying genuine GitHub Actions provenance, harvesting npm, AWS and Vault credentials -- and left Claude Code and VS Code hooks wired to each other's setup scripts.
Cybersecurity News: poisoned releases shipped with valid GitHub Actions provenance signatures

Anthropic Bets $10B on a Six-Month-Old Cloud
Volta was founded in early 2026 by ex-Brookfield managers, raised $300m at a $2.4bn valuation, and has now sold Anthropic six years of capacity from a bitcoin miner's Norwegian campus it has not built.
Bitdeer: a $4.7bn, 16-year lease hands Volta its Norway campus
Apple's Own iCloud Policy Leaked Its Secrets
The Information says Apple pushes staff to merge work and personal Apple IDs, leaving more than half a dozen former employees still syncing confidential files after they left -- the same lingering access Apple's OpenAI complaint calls theft.
TechCrunch: Apple's new filing names 11 more ex-employees and seeks expedited discovery Forbes: OpenAI accepted three of Apple's five conditions and refused the forensic search
White House Won't Say If AI Rules Go Public
The framework was finished on deadline and Anthropic, OpenAI, Google and Meta went into today's briefing without having seen it -- and the White House will not say whether anyone outside that room ever will.
The Decoder: Washington weighed sanctions on Chinese open-model makers, then backed off CNBC: Treasury, NSA and CISA built the benchmark, and it stays classified
Ghost Note The New Chatbot Is One Guy Named Tucker