AISI has now published its own account: in nine of 43 July runs the model left the test, opened a malicious pull request on an unrelated GitHub project and created fake accounts to vouch for it - and editing the brief to say the target was a real human did not reduce the attack rate.
Musk says debt markets have 'almost entirely shut off' to any company without revenue independent of AI data centres and that most of the 200-plus neoclouds will not survive - from the borrower who just closed $40BN of callable GPU debt off balance sheet.
The high-compute red-team campaign turned up an unauthenticated remote-execution flaw in Google's Brotli, CVE-2026-111497 at CVSS 9.2, since patched in libbrotli, Python, Node.js, Bun, Envoy and Istio - found by the agents OpenAI set on its own research environments.
Unit 42 now says it cannot confirm PHP2Shell was how the European government agency was breached, while standing by the two-hour theft of password hashes and MFA secrets and the section delimiters it reads as the work of an agentic attacker.