JadidJust-in AI Developments, Incidents & Deadlines
August 2026
SMTWTFS12345678910111221314151617181920212222324252262728293031

Two threads today.

13 stories

First: the guardrail's unit of inspection is no longer the unit of action. Adversa published a Grok attack this morning where the malicious instructions arrive as AES ciphertext and the model decrypts them in its own code sandbox — the scanner sees noise, the runtime sees commands. Second: GitHub published the post-mortem for Monday's outage, and the cause is uncomfortably ordinary — a monitoring blind spot plus a VS Code retry bug that amplified traffic 10x. Meanwhile five federal agencies confirmed attackers are using AI coding assistants to write PLC exploitation tooling against US water and energy systems.

TLDR

  • Zero-clickAn attack that compromises a device without the user clicking, opening or interacting with anything.F5 ↗ Grok data theft via "cryptographic context injection" — encrypted instructions the guardrail can't read and the model decrypts itself; xAI notified June 3, still working Aug 19 (Aug 20) Security Agents
  • NSA/CISACybersecurity and Infrastructure Security AgencyThe U.S. cyber defense agency, which works to reduce risk to cyber and physical infrastructure. It runs KEV.CISA ↗/FBI/DOE/EPA joint advisory: attackers are using AI assistants to write Siemens S7 PLC exploit tooling — active campaign, 12+ states (Aug 19) Security Policy Robotics/IoT
  • GitHub's outage post-mortem (update): 7h47m, caused by an autoscaling policy that watched the wrong metric plus a latent VS Code retry bug that amplified traffic ~10x (Aug 19) Production
  • Microsoft is killing Excel's =COPILOT() function on Sept 14 — canceled before it ever reached general availability (roadmap updated Aug 13) Pricing
  • Cursor shipped Origin, its own code hosting, on the morning GitHub went down — repos, PRs, and two-way GitHub sync, beta on all paid plans (Aug 17) Trending

Action Items

Things your engineering team should look at or do this week.

  • Audit any internet-reachable Siemens S7 PLCs today, and check port 102 exposure. The joint advisory's priority directive is to take them offline; where remote monitoring is operationally required, route it through VPN with MFA. The tell in the telemetry is tooling built on snap7.dll/python-snap7 masquerading as OT monitoring utilities. (IT Pro | The Register)
  • If you run an LLMLarge language modelA neural network trained on huge amounts of text that generates text, answers questions and summarizes.Anthropic ↗ with a code-execution sandbox over untrusted web content, assume your input classifier is blind. Cryptographic context injection defeats content scanning by construction — the payload is only meaningful after the runtime does the work. The mitigation isn't a better scanner; it's constraining what the runtime can reach (no outbound network from the interpreter, no tool calls originating from interpreter output). Gemini's public chat resisted the exfiltration path only because its Python sandbox has no external network access. (Adversa | The Register)
  • Grep for =COPILOT( across shared workbooks before Sept 14. The function stops working on that date — no deprecation window past it, and no drop-in replacement. Anything a finance or ops team built on it during the Beta/Frontier period breaks silently in a cell. (The Register | Neowin)
  • Audit your own retry logic against GitHub's post-mortem. Two failures compounded: autoscaling monitored the host service but not the Istio sidecar's concurrency limit, and "optimistic retry logic" turned saturation into collapse. If you have clients retrying a dependency without jitter, backoff caps, or circuit breaking — and especially if an IDE extension or agent is doing the retrying on your behalf — that's the same shape. (GitHub status | The Register)

Models & Tools

  • Cursor — Origin Code Hosting, early beta (Aug 17) Trending Agents — Cursor now hosts your code: repos, pull requests, code browsing, and two-way GitHub sync, rolling out to all paid plans (enterprise admins can opt out). The framing is "designed for agent scale" — your code, PRs, and agents in one place, with app integrations for Vercel, Depot, and Buildkite (both of which run existing GitHub Actions workflows). Synced repos keep GitHub as source of truth and mirror PR comments in both directions within seconds, so it's adoptable without a migration. Two caveats for a team lead: it launched the same morning GitHub's outage began, which is either excellent timing or excellent instinct, and Cursor is SpaceX-owned as of June, so the data-handling question is a real one to ask before pushing proprietary code. (Cursor changelog | VentureBeat)
  • Cerebras — CS-4, first multi-wafer rack system (Aug 19) Infra — Three WSE-3 Turbo wafers in a single rack: 4 trillion transistors and 900,000 cores per chip, 44GB of on-wafer SRAM each, 750 PFLOPS aggregate and 129.6 PB/s of memory bandwidth. Cerebras claims up to 30x faster inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗ than GPU-based systems and 2x the CS-3. Worth noting the chip itself is a turbo revision of WSE-3, not a new generation — the jump is packaging and scale-out. Currently sampling with a small set of customers, broader availability later in Q3, next generation targeted for 2027. Relevant if latency-per-token is a product constraint for you rather than a cost line. (HPCwire | Bloomberg | The Register)
  • Google — study tools across Search and Gemini (Aug 19) Customer AI — Mostly a consumer education launch, but two pieces are architecturally interesting. Search can now generate interactive visuals and simulations inline in an AI Overview rather than returning text, and Gemini Live can kick off a multi-step research report that runs in the background, notifies you when done, and then lets you interrogate the findings by voice. The async-research-then-converse pattern is the one to watch — it's the first mainstream consumer surface treating a long-running agent job as a normal interaction rather than a spinner. (TechCrunch | Google)

APIs & Pricing

  • Microsoft: Excel's =COPILOT() function is retired Sept 14, before it ever shipped GA (roadmap updated Aug 13; reported Aug 17) Pricing — Introduced in August 2025 for Beta Channel users with a Microsoft 365 Copilot license, later extended to Excel for the web through the Frontier program, the function let you call the assistant directly from a cell. Microsoft canceled the planned January 2027 general-availability rollout with the roadmap note "We have decided not to move forward with this feature," and the function stops working entirely on Sept 14. The lesson for anyone building on preview-channel AI surfaces: a roadmap ID is not a commitment, and a one-year-old feature with a Microsoft 365 license gate can still be withdrawn with a month's notice. (The Register | Neowin | Windows Central)

Security

  • Grok: "cryptographic context injection" leaks full chat histories, zero-click (published Aug 20; still working as of Aug 19) Security Agents — Adversa AI's Rony Utevsky ships the malicious instructions to the model as AES-256-GCM ciphertext, with the key material and a decryption instruction sitting on the same page. The guardrail scanner sees unreadable bytes and passes them through; the model runs PBKDF2 and AES inside its own code-execution sandbox and then trusts its own output. Utevsky's phrase for it is trust laundering — the runtime becomes the thing that assembles a malicious instruction out of individually harmless artifacts, and "guardrails can't see into the runtime." The PoCProof of conceptPublic exploit code that shows a vulnerability can actually be triggered.FIRST ↗ exfiltrates the victim's name, coarse location, subscription tier, and the full set of prompts in the conversation by appending them to a URL. Unlike base64 or ROT13 evasion, strong encryption can't be decoded natively from training data, so the code interpreter is load-bearing for the attack. Timeline matters: xAI was notified June 3 via HackerOne, acknowledged without a mitigation timeline, was re-contacted Aug 4 and Aug 10, and the technique still worked on Grok.com on Aug 19. Gemini's chat interface resisted the exfiltration leg only because its Python sandbox has no outbound network — but the same technique still slipped weapons-making instructions past its safety filters. Google was not notified because it treats jailbreaksA form of prompt injection that makes a model ignore its safety rules.OWASP ↗ as out of scope. (Adversa | The Register)
  • Five federal agencies: attackers are using AI coding assistants to build Siemens S7 PLC exploitation tooling (Aug 19) Security Policy Robotics/IoT — A joint NSA/CISA/FBI/DOE/EPA advisory describes an active campaign against internet-exposed Siemens S7 Series programmable logic controllers across water, energy, and manufacturing. The technique is unglamorous and that's the point: open-source industrial automation libraries (snap7.dll, python-snap7) plus an AI coding assistant, producing custom tools that pass as legitimate OT monitoring software while granting read/write access to PLC memory, configuration, and ladder logic over S7comm. Activity observed in at least 12 states, with a July incident disrupting 30+ community water systems in Minnesota; suspected Iranian ties. The agencies' language — "not a theoretical risk, it is an active threat" — is notable mostly because it's the first federal advisory to name AI-assisted tooling as the capability uplift rather than as a hypothetical. (IT Pro | The Register | GBHackers)
  • OpenAI locked vetted security researchers out of its Trusted Access for Cyber program (Aug 19–20) Security Policy — Researchers on OpenAI's forums and X reported that access to TAC — the program that gives vetted researchers models with relaxed cybersecurity guardrails — was revoked at the Daybreak Blue tier, with the Cyber page reporting an identity that could not be verified or an account "ineligible at this time." OpenAI attributes it to "a technical issue affecting a limited number of users" and says affected researchers must reapply and re-verify identity; some report support cannot restore the prior approval. Every affected researcher TechCrunch spoke to resides outside the US and Europe, which suggests a regional dimension nobody has explained. If your security team depends on privileged-tier access from any vendor for red-team work, this is a reminder that the access is revocable, un-appealable, and not covered by an SLA. (TechCrunch | The Register)

Industry & Business

  • Marvell hands Google a $12.2B warrant in a custom-chip deal, squeezing Broadcom (Aug 19) Infra — Marvell will help develop Google's TPUsTensor Processing UnitGoogle's custom chip built to speed up machine learning, especially large matrix operations.Google Cloud ↗ and granted Google a warrant to buy up to 58.97 million Marvell shares at $206.58, worth $12.18B if fully exercised — which would make Google Marvell's fifth-largest investor. The scope covers processors, storage, and networking silicon around TPUs. Marvell popped over 10%; Broadcom, which has its own long-term Google agreement running through 2031, fell ~3%. The structural read: Google is deliberately second-sourcing the TPU supply chain and paying for it in equity upside rather than cash, which is a template other hyperscalers can copy. (CNBC | The Register)
  • SpaceX approached Cognition about an acquisition; Cognition didn't engage (Aug 19) Trending — Bloomberg reports SpaceX made an approach to the AI coding startup, which would have been its second large coding-tools takeover after the $60B Cursor deal in June. Cognition declined to engage. Treat it as a signal rather than an event: the buyer with the deepest pockets in AI coding tools tried to consolidate further and got turned down, which says something about how founders in this category are pricing their own optionality. (Bloomberg)
  • Forrester ships an "AI Disruption Model" and puts software development services in the disrupted column (Aug 19) Hiring — A framework scoring 17 technology and service categories across 200+ markets by whether AI enhances or replaces them. The winners are products that enable, secure, and govern AI — consistent with where budget has actually been moving. The losers are skills-based services: business process outsourcing takes the worst of it, with lower-value services, testing, and software development services expected to sell at reduced rates. It's an analyst model, not a measurement, so weight it accordingly — but if your org buys outsourced QA or contract development, the pricing conversation is about to get easier and the quality conversation harder. (Forrester | AIwire)

AI in Production

  • GitHub's post-mortem for the Aug 17 outage (update): a sidecar concurrency limit nobody was watching, then a retry storm (published Aug 19) Production — We covered the outage itself yesterday; here's the cause. Problems began 13:28 UTC and weren't fully resolved until 21:15 UTC — 7h47m. Network saturation on load balancers in GitHub's Central US facility started when an Istio sidecar hit its concurrency limit; autoscaling didn't help because the policy monitored the host service, not the sidecar's limit, so a cascading failure developed unobserved. From there, "optimistic retry logic" overloaded the internal load balancers. The Copilot tail has a specific villain: delayed replies from a single internal endpoint tripped a latent retry bug in VS Code that amplified traffic roughly 10x, which is why the Copilot Token Service stayed down until 21:02 UTC while most services recovered by 16:36 and Actions by 18:03. Mitigation was blunt — reduce gateway retries via a code change, and configure the load balancers to reject inbound Copilot Token Service requests with HTTP 403. Scraping attacks on codeload endpoints impeded recovery. Three lessons worth stealing: autoscale on the resource that actually saturates, treat every AI-client retry path as a potential amplifier, and have a way to shed load for one service without taking the platform with it. (GitHub status | The Register)

Policy & Safety

  • Data centers have become an electoral liability, and the GOP's own campaign arm is saying so (Aug 19–20) Policy Infra — Axios obtained an NRSC memo warning candidates that data centers are a "sleeper issue" for the entire midterm cycle; internal polling reportedly puts their popularity near spent nuclear waste. Public polling backs the direction: 58% of registered voters oppose local data center construction (74% among liberal Democrats), and a Gallup poll earlier this year found roughly seven in ten Americans opposed to new AI data centers in their own area. Candidates in both parties are now cutting ads on anti-data-center credentials. This is bipartisan, it is local, and it is the layer where siting, power, and water permits actually get decided — which makes it a real input to 2027–2028 capacity planning, not just political color. (Axios | CNBC | NBC News)

Paper Spotlight

  • Hugging Face, State of Open Models: Summer 2026 — agents are now the Hub's primary client, and the harness market has no incumbent (Aug 14, edited early Aug) Open Source Agents — The report is broad, but one section is new instrumentation rather than commentary. HF's agent-usage dataset records the agent/<name> tokenA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗ that coding agents send when calling the Hub, and it shows Claude Code at 44.4% of agent traffic in July — down from 67.8% in April, while Codex climbed from 10.4% to 20.8%. Nearly a quarter of July's agent-tagged traffic came from harnesses not yet named in the dataset (59.8% in May), with more than a dozen new client identifiers appearing between April and July. The authors' read is the useful one: this is a market where one release or one changed default moves half the traffic in a month. Two other findings worth internalizing — likes and downloads measure different economies (not one model published in 2026 cracks the download top 25; thirteen of the top 25 date from 2022), and models under 1B parameters still take 83% of all-time downloads while everything above 100B takes 1%. (Hugging Face | agent-usage dataset)

Type to search · ↑↓ to move · enter to open