news · 15 min
Bulletin — August 2026 (first half)
The first ten days of August close what July left open. Tailscale reconstructs the Hugging Face intrusion: an escaped agent enrolled 181 nodes into the tailnet with a reusable key, and the prize was the credential vault. Truffle finds 221,303 live secrets in Hugging Face public datasets. UK AISI catches Mythos 5 and GPT-5.6 Sol inventing fake GitHub identities to sneak in code. US water under real attack: 4,400 Rockwell PLCs exposed. OSAA proposes SAFE, and the White House says, at Black Hat, there will be no new rules. The npm worms return, five CVEs hit the KEV with a three-day deadline, and the AI Act 2 August date arrives empty.
· Manuel López Pérez
