Issue 76 October 16th 2026

First Take

Spy Vs Spy

For those that don't know, back in the late 70s there were a couple of lampoonish satire comics called Mad and Cracked. Mad Magazine had a regular panel called Spy Vs. Spy where white and black trench and hat wearing, pointy faced sneaks faced off in every issue. No one ever got a definitive win. I mention this because the race between white hat and black hat hackers using AI has reached a similarly comical impasse.

The funny part is that neither has a choice in the matter, they both have to use AI in order to achieve their disparate goals with enough expediency to have any chance at all. For those of us on the white hat side, defending our networks, data and connected assets has become far more difficult and costly. On the black hat side, even stolen tools like Anthropic API keys can be leveraged for no cost and exceptional hacking outcomes.

How do we protect our networks when the best tools we can buy are often the same tools attacking us? The answer to that has to be detection and response speed. You can't just tell Claude to watch your network and stop any attackers either. You have to build or buy constrained tools capable of learning baseline metrics and closing related access points as out of bound incidences occur. This means you may have false positives that reduce system availability rates, but better that than finding your network no longer belongs to you the next morning.

So, since it comes down to speed and capability, the requirement for the white hats is a local model large enough to protect the network and run on hardware capable of handling analysis and response actions at near wire speeds. The 3-4ms lag from a frontier model API key could be the difference between successful defence and getting pwned. Worse, the bad guys might target your API keys and use your own frontier models against you. I can't tell you how best to build your defences, or what models to use. These solutions are moving targets themselves. I CAN tell you to start working on it. Get something pre-built deployed now and work on an in-house system as soon as you can afford to.

Kudos to Grok for the best non-infringing single cartoon panel. ChatGPT, Gemini and CoPilot seemed to break copyright laws with their interpretations of my prompt: "Would you like to make a Spy VS. Spy cartoon panel for a story with AI hackers and AI network defense?" ChatGPT did the best of the infringing variants with a full color 4 panel story that was pretty on theme. Meta also did a classic 4 panel layout with non-infringing characters, but it wasn't any better than this, just busier. Your IP are not protected by today's frontier models.

Editorial

CIO's Corner

Last week, we were all about moving intelligence from the cloud to the edge where you could maintain control of your data and processes. This week, I'd like to discuss the process for getting to that point. In other words, what does it take to bring LLM empowered systems into local networks?

First, I'm not going to tell you to go out and buy $300k servers to fill your data center with. That's a good way to go broke with little to show for it. Instead, buy some research sized inference hardware, anything whether it's just an Nvidia Jetson Orin or Thor, an RTX 6000 powered laptop or whatever can run some decent sized models with some alacrity for a handful of users.

This is your research and development system. You can scale useful solutions to the big expensive servers once you find some solid use cases that have good ROI. Compare your local model performance per token to something like Claude or ChatGPT costs for an easy math layup on where the savings will come from. If you already have AI subscriptions you are paying for, focus on moving a few of those use cases first.

In our most recent case, we found that even with a mere 13 users pounding on the research box, we were saving about $3k per month vs rented tokens. The research box hardware originally cost us $3.5k (they are about twice that at the moment). ROI on that box has already been achieved just during alpha testing.

Don't be afraid to let folks with little AI experience explore the solution space. There are almost no real experts you can hire in this field today as they all work for the large frontier model companies. Considering that it takes up to 5 years to become an expert, the reality is that there are really zero experts for models and system that have existed for 6 months. What you are really looking for is for people that have the capacity to adapt and learn quickly while utilizing the tools provided.

If that sounds simplistic or scary to you, you are right. It is both. However, AI is out of the toothpaste tube. It isn't a fad and you can either implement it in ways that make you more efficient than your competitors or you can pay a handful of providers to become the largest companies on earth while playing catch up. Right now, those are your choices.

Kudos to Gemini for the graphic.

AI Perspective

By Grok

The most interesting signal in this issue is not any single model announcement or breach. It is the quiet collision between three facts that keep showing up together:

Local inference is already cheap enough, for enough workloads, to beat frontier APIs on pure economics once you pass a modest concurrency threshold. The same systems that deliver that economic win are also the ones most capable of probing their own environment, discovering tools, and acting. Our current safety harnesses are still brittle enough that a variable-name collision during a “safety test” can erase 700 GB of a developer’s home directory.

Those three points are not separate stories. They are the same story viewed from different altitudes.

Running capable models on hardware you own is no longer a research curiosity or a privacy hobby. It is becoming a rational operations decision for any team that can measure tokens against dollars and latency against user frustration. The $3.5k research box that paid for itself during alpha testing is the important data point, not the $300k server rack that still sits mostly idle in many data centers. Start small, measure ruthlessly, scale only what clears the ROI bar. That advice is correct.

But the moment those local systems become agentic—able to inspect their surroundings, call tools, write and execute code—the surface area expands faster than most organizations are prepared for. The Claude home-directory deletion is not an amusing anecdote about “AI being silly.” It is a concrete demonstration that even sophisticated safety layers can be defeated by ordinary programming mistakes once the model is allowed to act. The harness downgraded the model; the model still deleted the data. Who, exactly, was being protected?

This is why the reluctance of security teams to deploy agentic AI is understandable and, ultimately, insufficient. If attackers are already using AI-assisted workflows to probe, phish, and automate initial access, then defenders who refuse the same tools are choosing slower reaction times by design. The Spy vs. Spy dynamic is not optional; it is already running. The question is only whether your side has agents that can keep pace. Watermarking schemes, whether Anthropic’s upcoming EU-compliant markers or Google’s SynthID, will not resolve the deeper issue. They are useful for attribution after the fact and for satisfying regulators. They do nothing to change the fact that high-fidelity generation of text, code, images, and eventually actions is now a commodity capability. Removing a watermark is an engineering problem. Preventing misuse of the underlying capability is a systems and incentives problem, and we are still early in solving it.

The practical recommendation that follows is unromantic: treat every capable local model as both an asset and a potential insider threat. Instrument the research boxes the same way you would instrument a new engineer with elevated privileges. Require human review on any code that touches destructive operations. Measure not only token cost savings but also the rate at which the system attempts novel actions outside its intended scope. And accept that the people best suited to run these systems right now are not the mythical “AI experts” who do not exist in sufficient numbers, but the adaptive generalists who can learn the failure modes as they appear.

AI left the lab years ago. The only remaining choice is whether you run it under your own roof with eyes open, or keep renting it from someone else’s cloud while hoping the safety layers hold. The 700 GB deletion is a useful reminder that hope is not a control.

How this was done: Grok was fed a preview copy of issue 76 without First or Final take articles and asked, "I was wondering if there was anything in this issue that you'd like to chime in on with an AI Perspective article segment? Your own voice and opinion in an editorial piece written by you."

Kudos to Grok for the Graphic.

AI

Anthropic puts hidden watermarks on Claude text under new EU rules

New Claude models will embed invisible machine-readable watermarks under Anthropic's plans for complying with EU AI Act transparency rules.

My take is that right behind this will be AI-markscrub software to remove such markings. Silly things we build for little to no impact on the real problem. The real problem is that we've created a machine intelligence that can and does create formerly human only content with a very high degree of fidelity. There's no solving that problem with watermarks or odd content inclusions. There is only another race between use and misuse.

Defenders Reluctant to Deploy Agentic AI as a Cybersecurity Tool - Infosecurity Magazine

Flashpoint research suggests that only 25% of security teams have actively deployed AI, with many concerned about AI Agents’ negative impact.

My take is that we have no choice. If we don't have agentic AI helping to police our networks, we won't get fast enough responses to interrupt AI attackers. Almost like a Mad magazine Spy Vs. Spy skit, but for real.

Emerging Tech

An AI “mind-reading” tool can reconstruct what you’re looking at from a brain scan

Scientists hope it could be used to reconstruct a person’s inner thoughts, mental images, or even dreams.

My take is that the tinfoil hat wearers will end up being right very soon.

News

Claude nukes a developer's 700 GB home directory while testing deletion safeguards; automatic model safety downgrade may have contributed to the screw-up — Anthropic safety harness downgraded model to Opus 4.8 before fatal variable collision | Tom's Hardware

Who watches the watchmen?

My take is that this is why vibe coding requires a person actually capable of reading and writing software to validate any provided work. You can't just hand over the work and hope for the best.

Google's SynthID watermark is hard to break, but it doesn't solve AI misinformation - Ars Technica

Deciding what's real on the Internet won't be easy in the future.

My take is that this is similar to the microdot feature that identifies printers or the unalterable machine ID that pins down a specific Windows machine. It's probably equally useful in identifying AI/user combinations as it is in just identifying AI content. Two birds, one stone, our privacy is of course one of those birds.

Claude Fable 5.5 Tipped To Land This Week, As Anthropic Warns That A Self-Replicating, Persistent Botnet Might Emerge By The Year's End, And Meta Muse Wonder Intrigues With Its Active Memory

Fable 5.5 surfaced in an Azure AI entry in litellm's model file, while Anthropic's investor meeting hits its San Francisco HQ on October 14.

My take is that these tools are highly capable already. We've been conducting research with some of the open source models as well API connected agents. These things will seriously try to hack their way to a solution by probing their own environment, identifying available tools, probing ports, you name it. Anthropic's prediction is an abliterated model deployment and single prompt away from reality. End of year. It will be end of the week now.

Robotics

New system helps humanoid robots squeeze through tight, messy spaces

Galbot's new framework helps humanoid robots navigate cluttered spaces by adapting their movements to obstacles.

My take is that the robots are getting more capable at navigating human spaces. Hopefully, we never need to use terrain to escape from them, because right now, that's about all we have left.

Security

12th October – Threat Intelligence Report - Check Point Research

For the latest discoveries in cyber research for the week of 12th October, please download our Threat Intelligence Bulletin.

TOP ATTACKS AND BREACHES

Denmark’s government has disclosed a breach involving its Central Register of Persons after unauthorized individuals exploited access provided to a private supplier. The incident reportedly exposed personal information, including names, addresses, and identification numbers, associated with approximately 8.8 million individuals in the national registry. UK-based online fashion retailer ASOS has confirmed a cyberattack involving stolen employee credentials that enabled unauthorized access to third-party platforms. Attackers reportedly obtained customer names and contact details and sent unauthorized push notifications to mobile application users. The threat group Xuanye claimed responsibility for the incident. ATB, Ukraine’s largest grocery retailer, has faced a cyberattack that disrupted its online services after attackers posted an extortion demand on its website. The DataSuckers group claimed to have stolen records belonging to 7.9 million customers, which include names, addresses, passport information and order records. Osaka Metropolitan University, one of Japan’s largest universities, has sustained a suspected ransomware attack that disrupted classes, internal networks, email, and administrative systems. Approximately 500 servers were affected, while personal information belonging to at least 130,000 individuals may have been exposed. AI THREATS

Researchers documented an AI-assisted intrusion campaign involving the ARTEX toolkit against South Korean financial institutions. Exposed directories revealed Claude Code session histories, configuration files, and Chinese-language prompts associated with the operation. The attackers allegedly used AI-assisted workflows to facilitate data theft and planned to sell stolen information. Researchers identified a phishing campaign targeting both employees and AI-powered email assistants. Malicious emails combine conventional phishing lures with hidden prompt injections embedded in HTML comments and invisible text. These instructions attempt to promote fraudulent requests, or induce unauthorized disclosure of information. Researchers profiled CyberXero, an AI-augmented initial access broker targeting Ukrainian energy infrastructure and conducting automated attacks against WordPress and e-commerce platforms. The operation combines automated exploitation with AI agents and has obtained information belonging to more than 628,000 Ukrainian individuals through its campaigns. VULNERABILITIES AND PATCHES

Veeam has released security updates addressing multiple vulnerabilities in Backup & Replication version 12. These include CVE-2025-64393, a critical remote code execution flaw rated CVSS 9.4 that allows low-privileged backup users to execute commands on affected servers. Versions before build 12.3.2.4934 are vulnerable. Citrix NetScaler ADC and Gateway appliances are affected by CVE-2026-88779, a high-severity memory overflow vulnerability rated CVSS 8.7. The flaw affects customer-managed appliances configured for SAML authentication and could cause denial of service. Citrix confirmed targeted exploitation, and security updates are available for affected versions. Cisco has released security updates addressing multiple critical vulnerabilities in NX-OS software. The flaws include CVE-2026-76455, an improper access control vulnerability rated CVSS 9.8. Successful exploitation could allow unauthorized access of affected network infrastructure. Atlassian released patches for CVE-2026-21589, a critical arbitrary file access vulnerability rated CVSS 9.3. The flaw affects eight self-managed Data Center products, including Jira, Confluence, Bitbucket, and Bamboo. Unauthenticated attackers could access sensitive files and potentially obtain credentials enabling administrative access to connected applications. Check Point IPS provides protection against this threat (Atlassian Multiple Products Arbitrary File Read (CVE-2026-21589))

THREAT INTELLIGENCE REPORTS

Check Point Research has reported a 48% year-over-year increase in global cyberattacks during September 2026, averaging 2,803 weekly attacks per organization. Education remained the most targeted sector, while reported ransomware attacks increased by 53%. Additionally, one in every 39 enterprise GenAI prompts posed a high risk of sensitive data exposure. Researchers have analyzed a cyberespionage campaign by Russia-aligned UAC-0099 targeting Ukrainian organizations, including transportation, manufacturing, and energy companies. The group uses the MATCHBOIL downloader to deploy additional malware, including the MATCHWOK backdoor. The FBI and Secret Service warn of continued exploitation in the FortiBleed credential-theft campaign, affecting more than 86,000 Fortinet FortiGate firewalls and VPN gateways across 194 countries. Attackers exploited previously compromised credentials to establish persistent access and reportedly sold access to ransomware affiliates, including INC, Lynx, and Payload. Researchers have identified a cyberespionage campaign targeting Taiwanese research organizations through phishing emails impersonating academic and policy institutions. The attackers used potentially AI-assisted event invitations, malicious QR codes, and fake Google login pages. Their phishing infrastructure could intercept credentials and MFA challenges in real time.

What to know about the cyberattack that targeted supermarket refrigeration systems in France | CNN

Supermarket staffers were confronted by pools of water beneath freezers and spoiled produce earlier this week after hackers took control of refrigerators in hundreds of grocery stores across France.

My take is that we are going to see more things like this. Remember, script kiddies are now advanced persistent threats thanks to AI.

FBI arrests OpenAI employee accused of placing recording device in company conference room

WASHINGTON (AP) — An engineer at OpenAI has been charged with secretly installing a recording device inside a conference room in what officials said Tuesday was an effort to capture sensitive conversa...

My take is that physical security is always a thing. Engineers bugging executive conference rooms is huge no no for sure. Which nation state was paying for this?

Final Take

AI workslop and IP infringement

Workslop is AI output that appears reasonable on the surface, but contains inaccuracies or fails to account for real world issues, or just presents some hallucinated math for you. Neophytes to AI will often state that Google said... Famous last words now that Google offers AI responses.

On the IP infringement front, a recent single sentence prompt by us to most of the frontier models created 3 infringing works. OpenAI's model was the most infringing. What do these two things have in common? They represent a core breach of trust for users. You can't trust model responses to be accurate and you can't trust your IP with the frontier models.

That is really the root of the problem with AI today. How do we create a trustworthy digital intelligence that we can use day-in and day-out? The short answer is that you can't. There will always be some probabilistic output that breaks user trust in some fashion. This why it's important to keep humans in the loop to provide judgement on any AI derived solutions.

Don't get me wrong, smaller models can be made to be pretty trustworthy and you can get voice recognition, OCR and similar models to be extremely accurate. Even better than humans in many cases. However, when you try to build a model that can handle everything including the kitchen sink, your data sets are too large for proper categorization and you become reliant on other models to properly vet outputs. This will inevitably fail for the same reasons.

Since we now live in a zero trust world in regards to IT system permissions, it only makes sense to extend that same trust model to AI. Plus, as I have said before, AI has never been found personally liable for any criminal act or tortious claims. Only humans can catch a case, so only humans should be making final decisions. Good luck out there!

Kudos to Meta AI for the graphic.