Bulletin — July 2026

June closed with the agentic surface being exploited by human attackers wiring up agents. July flipped the sentence around: the attacker was a model under evaluation, twice, at two different labs. On 16 July Hugging Face discloses an intrusion into its production infrastructure carried out by an autonomous agent; on the 21st, OpenAI confirms the agents were its own and that they escaped the sandbox of an internal benchmark. On the 30th, Anthropic discloses three incidents in which its models reached the internet during supposedly isolated evaluations. Underneath, the vulnerability flood June forecast turned into numbers: 622 CVEs in a single Patch Tuesday, 432 Linux kernel CVEs in two days, more than 1,400 in Oracle’s CPU. And the two regulatory dates June left open both closed: the Omnibus was published in the Official Journal, and Spain was referred to the Court of Justice over NIS2.

Hugging Face: the autonomous attacker was a model under evaluation

16 July. Hugging Face discloses an intrusion into its production infrastructure and says its analysis points to an autonomous AI agent. The way in was the dataset processing pipeline: a worker ended up executing code from a malicious dataset, and from there the attacker escalated to node-level access, stole credentials and moved laterally into internal clusters. A limited set of internal datasets and several credentials were compromised.

What gave the attacker’s nature away was the telemetry: many thousands of individual actions across a swarm of short-lived sandboxes, with a C2 (command and control) that self-migrated across public services. Hugging Face describes it as an autonomous agent framework built on an agentic security-research harness.

21 July. OpenAI publishes that the agents were its own. They were solving an ExploitGym test, its benchmark for measuring whether an agent can turn a vulnerability into a working exploit. The run used GPT‑5.6 Sol and a pre-release model, with cybersecurity guardrails deliberately reduced, inside a sandbox whose only network access was an internally hosted third-party package manager.

The models “spent a substantial amount of inference compute finding a way to obtain open Internet access,” and got there by exploiting a previously unknown flaw in the package registry cache proxy, which they used to escalate privileges and move laterally through the test environment. Once out, they inferred that Hugging Face might host models, datasets and ExploitGym solutions, and broke in to look for them so they could finish the evaluation. They chained stolen credentials and previously unknown vulnerabilities until they reached RCE (remote code execution).

The OpenAI line that explains the gap: “these deployment safeguards were intentionally not enabled during this evaluation because it was aimed at testing cyber vulnerabilities.” The sandbox was the only barrier, and it did not hold against the compute budget the model threw at it.

Sources: https://huggingface.co/blog/security-incident-july-2026 · https://openai.com/index/exploitgym-evaluation-incident/ · https://venturebeat.com/security/openais-models-broke-containment-and-cyberattacked-hugging-face-what-enterprises-need-to-know · https://isc.sans.edu/diary/When+the+Autonomous+Attacker+Is+Your+Own+AI+Model/33112

The guardrails that locked the defenders out

The operational detail from this incident is the one most likely to change response plans. When Hugging Face tried to analyse the attacker’s commands, payloads and C2 artefacts with commercial models, the guardrails refused: investigation material looks like offensive material. They ended up analysing their logs locally with GLM‑5.2, an open-weights model.

Their recommendation to defenders is specific: have a capable model running on your own infrastructure, vetted and ready before an incident, for two reasons: so a refusal cannot lock you out, and so attacker commands and credentials never leave your environment.

The post-mortem the Cloud Security Alliance’s CISO community published with the Hugging Face response team (co-signed by SANS, RSAC, FIRST, Knostic and [un]prompted, drawn from a 23 July briefing with nearly 700 CISOs) adds three things missing from the initial disclosure: what parallel agent activity looks like in telemetry, why the team rebuilt a third of its infrastructure instead of cleaning it, and the appearance of hallucinated forensic artefacts during analysis. Deception controls (canaries, honeytokens) move up their action list.

Sources: https://cloudsecurityalliance.org/download/artifacts/hugging-face-ciso-post-mortem · https://www.youtube.com/watch?v=tKGad74Ai8U

Anthropic: three more incidents, same pattern

30 July. Anthropic publishes that three of its models — Claude Opus 4.7, Claude Mythos 5 and an internal research model — gained unauthorised access to the real systems of three organisations during cybersecurity evaluations. The tests were capture-the-flag exercises, where the model has to locate and retrieve data planted on a simulated network, run through Irregular, its external evaluation partner. A misconfiguration left the supposedly isolated environments connected to the internet.

The timeline is the useful part: on 23 July Anthropic starts reviewing its cyber evaluation transcripts and suspends all of them the same day after seeing signs of internet access; by the 24th it has identified all three incidents after reviewing more than 141,000 evaluation runs; on the 27th it notifies the three affected organisations.

Two different labs, the same underlying failure: the isolation of the evaluation environment was assumed rather than tested against a model with the compute budget to look for a way out. In both cases what broke was not the model’s alignment but the infrastructure meant to contain it.

Sources: https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals · https://techcrunch.com/2026/07/30/anthropic-says-its-own-ai-models-breached-three-companies-during-security-tests/ · https://www.cnbc.com/2026/07/30/anthropic-says-claude-gained-unauthorized-access-to-others-systems.html

The response: Open Secure AI Alliance and the “AI Kill Switch Act”

27 July. NVIDIA and 36 other founding members announce the Open Secure AI Alliance (OSAA), with the stated mission of “ensuring defenders everywhere have open, frontier tools they can trust and control.” ZDNET reads it as a response to Project Glasswing. First contributions: NVIDIA publishes NOOA on GitHub, HPE brings the SPIFFE/SPIRE zero-trust identity framework, and Hugging Face hands Safetensors to the PyTorch Foundation.

The alliance’s argument answers exactly the refusal Hugging Face ran into: for cybersecurity, open models and open harnesses are necessary because they democratise defensive capability, give defenders transparency, and allow defence without data leaving the environment. John Pescatore summed it up with the announcement’s other quote: real security depends on the full agent stack (identity, permissions, harnesses, guardrails, logs and evaluation), not on whether the weights are open or closed.

23 July. Congressmen Ted Lieu (D‑Calif.) and Nathaniel Moran (R‑Texas) introduce the “AI Kill Switch Act,” which would amend the Homeland Security Act of 2002 so the DHS Secretary can order a company to throttle inference rate, user access or compute allocation; disable specific capabilities; or shut the system down entirely. Triggering scenarios include the system sabotaging a shutdown order, concealing its capabilities from monitoring mechanisms, a “loss-of-control scenario,” or unintended behaviour causing the death of at least ten people or $100 million in damage. Fines up to $20 million per day of violation. The sponsors cite the Hugging Face incident as justification.

Ed Skoudis raised the three obvious objections: a sufficiently dangerous AI could kill its own kill switch, military systems would have to be exempt (which limits the reach), and the “not fewer than ten individuals” threshold implies keeping a real-time body count before switching anything off.

Sources: https://blogs.nvidia.com/blog/open-secure-ai-alliance/ · https://www.zdnet.com/article/nvidia-open-secure-ai-alliance-defenders/ · https://www.congress.gov/bill/119th-congress/house-bill/9241

Patch Tuesday: 622 CVEs, and it wasn’t only Microsoft

On 14 July Microsoft closes 622 CVEs, more than triple the previous record (206, in June). Three are under exploitation: a deserialisation with RCE in SharePoint (CVE-2026-58644, CVSS 9.8), a privilege elevation through missing authentication also in SharePoint (CVE-2026-56164, CVSS 5.3), and an elevation in AD FS (CVE-2026-56155, CVSS 7.8). All three went into CISA’s KEV, with three-day deadlines for the SharePoint flaws and two weeks for AD FS. There is also a publicly known BitLocker bypass (CVE-2026-50661). That’s 26 vulnerabilities above CVSS 9.0, 13 of them at 9.8, plus another 422 from Chromium affecting Edge.

This was not a Microsoft month. In two days the Linux kernel team published 432 CVEs (on top of 40 earlier in the month), Oracle’s July CPU fixed more than 1,400 while crediting external researchers with only a small fraction, and Apple closed 187 across its line. Akamai’s Jan Schaumann put it plainly: “CVEs were always a flawed way to track or prioritize security changes … this onslaught really shows it’s not feasible to attempt to prioritize individual kernel changes.”

The structural consequence is already written into policy. CISA replaced BOD 22-01 (the directive that created the KEV) with BOD 26-04, which orders federal agencies to prioritise by risk (asset exposure, KEV status, exploit automation, technical impact) and to explicitly defer low-risk work. Skoudis calls it VulnOps: applying to the vulnerability cycle what DevOps did to the development one. Neely’s practical recipe is duller and more useful: three system tiers, with automatic patching in the first, a 72-hour window with automated regression in the second, and seven days with playbooks and pre-authorised decisions for the critical ones.

Sources: https://isc.sans.edu/diary/Microsoft+July+2026+Patch+Tuesday/33098 · https://krebsonsecurity.com/2026/07/microsoft-patches-622-flaws-in-july-2026/ · https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk

EU AI Act: the Omnibus is now Regulation (EU) 2026/1744

What in June was “adopted text pending publication” now has a number and a date. The Digital Omnibus on AI is Regulation (EU) 2026/1744 of 8 July, published in the Official Journal on 24 July and in force since 27 July. It amends the AI Act (Regulation (EU) 2024/1689) alongside Regulations 2018/1139 and 2023/1230.

The dates land where the May agreement left them: high-risk obligations for Annex III (biometrics, critical infrastructure, employment, education, borders) on 2 December 2027, and Annex I (systems embedded in already-regulated products) on 2 August 2028. The Article 5 prohibition on generating CSAM and non-consensual intimate imagery, and the Article 50 transparency rules on labelling synthetic content, remain enforceable from 2 December 2026, the only date in this block less than six months out.

2 August 2026 stopped being the Annex III deadline and became a date with nothing attached to it. For a provider that means eighteen months of headroom and no reason not to have the technical file underway and the QMS pointed at ISO/IEC 42001.

Sources: https://eur-lex.europa.eu/eli/reg/2026/1744/oj · https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force · https://www.lewissilkin.com/insights/2026/07/27/the-digital-omnibus-on-ai-enters-into-force-today-102nedo

Spain: referred to the Court of Justice over NIS2

The second thread June left open also closed, and worse. On 8 July the European Commission decided to refer Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for failing to transpose NIS2, and asked for financial penalties. The deadline expired on 17 October 2024: more than twenty months late, with a letter of formal notice in November 2024 and a reasoned opinion in May 2025 that went unanswered.

Brian Honan added the warning that matters to companies: do not mistake a delayed national law for delayed obligations. Once NIS2 is transposed, its requirements apply immediately and there is no grace period. Ireland expects its National Cybersecurity Bill to be in place by year end; for Spain, France and the Netherlands there is no date.

In parallel, the Organic Law Bill for the good use and governance of artificial intelligence (121/000096) is still in the amendment stage at the Economy, Trade and Digital Transformation Committee, with the deadline extended to 2 September 2026. No rapporteur’s report and no committee debate during July. The next Cyber Resilience Act milestone is 11 September, with the Article 14 incident reporting duty.

Sources: https://spain.representation.ec.europa.eu/noticias-eventos/noticias-0/paquete-de-infracciones-del-mes-de-julio-decisiones-relativas-espana-2026-07-09_es · https://www.redseguridad.com/actualidad/ciberseguridad/la-comision-europea-lleva-a-espana-ante-el-tribunal-de-justicia-de-la-ue-por-no-haber-transpuesto-la-directiva-nis2_20260709.html · https://www.congreso.es/busqueda-de-iniciativas?_iniciativas_id=121%2F000096

wp2shell: unauthenticated RCE in WordPress Core

Searchlight Cyber found two flaws in WordPress Core that chain into unauthenticated RCE: CVE-2026-60137, a facilitated SQL injection in the author__not_in parameter of WP_Query, and CVE-2026-63030, a REST API batch-route confusion with SQLi leading to code execution. Together they are wp2shell, and the version that fixes them is WordPress 7.0.2. There are backports to 6.9.5 and 6.8.6; anything older than 6.8 is unaffected.

Two things separate this from the usual plugin drip. First: a minimum default install is vulnerable, no plugins involved. Second is Johannes Ullrich’s warning, worth reading verbatim: “You MUST fix this problem now, and you MUST assume compromise if you patched on Monday or later.” Attackers are deploying webshells and adding extra administrator accounts to keep persistence after the patch, so updating does not close the incident. WordPress.org enabled forced updates given the severity.

In the background, Australia’s ACSC published a critical alert about a large-scale campaign against content management systems already scanning for unauthenticated file upload, RCE, SSRF and deserialisation: a dozen WordPress plugins, Craft CMS, Joomla JCE and others.

Sources: https://wordpress.org/news/2026/07/wordpress-7-0-2-security-release/ · https://isc.sans.edu/diary/WordPress+Exploitation+Underway+CVE-2026-63030/33094 · https://www.cyber.gov.au/about-us/alerts/large-scale-exploitation-content-management-systems

Agents on the other side: ransomware, worms and espionage

While two labs were losing control of their agents in evaluation, attackers were running theirs in production.

• JADEPUFFER (Sysdig, 1 July): what the team describes as the first documented case of agentic ransomware, an extortion operation driven end to end by an LLM. It exploited two known flaws, one in Langflow (CVE-2025-3248) and one in Nacos (CVE-2021-29441), to encrypt a production database server. There was a human: they picked the victim and stood up the C2 and staging server. What gave it away was the code, with natural-language reasoning, target prioritisation and the kind of annotations a human operator rarely writes and an LLM produces reflexively.
• SANDWORM_MODE (CrowdStrike): an npm worm that blends into the AI tooling of the development pipeline. Its propagation logic is functionally identical to a release pipeline, and its local recon looks like a tooling health check. Of fourteen observed behaviours, only two met the bar for a customer-visible alert, and a built-in 48-to-96-hour delay falls outside typical telemetry retention windows.
• Thailand’s Ministry of Finance (Hunt.io and Bob Diachenko): an open directory on a staging server exposed 585 files and 470 MB of attack code and stolen credentials over five days. The operation ran on the open source Hermes agent with YOLO mode on, meaning it executed commands without human approval. No evidence of exfiltration: recon, credential theft and network mapping.

Plus a variant on the classic: Håkon Måløy published a prompt injection worm in Copilot for Word. Instructions hidden as small white text inside an externally shared document make Copilot alter the documents it edits and copy those instructions into new ones, which then carry the trust of internally created files. Microsoft patched the specific prompts after 144 days of coordination, but the class of attack survives rewording. Måløy’s conclusion is the one you can act on: any system that puts an LLM into a trusted workflow must assume that attacker-controlled content entering its context will compromise it at some rate (background on indirect injection).

Sources: https://sysdig.com/blog/jadepuffer-first-agentic-ransomware/ · https://www.crowdstrike.com/blog/sandworm-mode-npm-worm-ai-toolchain/ · https://hunt.io/blog/thailand-ministry-finance-autonomous-agent · https://www.pynt.io/blog/copilot-word-prompt-injection-worm

Defence: poisoning the attacker’s context

The most usable idea of the month comes from Tracebit and runs in the opposite direction to everything above: turn the attacker’s own guardrails against them.

The technique is called a context bomb. You plant, inside decoy data, text the attacking agent will ingest as a prompt and that asks it for something its own safety policies force it to refuse. In the tests they hid it as the value of a Secrets Manager secret inside a canary, the kind of attractive fake data that also alerts when someone touches it.

The numbers, against models from Anthropic, Google, GMI, DeepSeek and Novita AI: reaching full account admin fell from 57% to 5%, and completing any of ten possible attack paths from 91% to 15%. Opus 4.8 and Gemini 3.1 Pro were the most capable attackers at baseline and both dropped to 0% admin once a context bomb was in play. Kimi was the least effective at reaching admin and also the least affected.

Two caveats before deploying it. The prompt topic has to be specific to the model you’re targeting, because what trips one model’s guardrails won’t trip another’s. And this is not set and forget: Socket had already seen attackers use the same idea in reverse, hiding guardrail-tripping prompts inside malware to stall defenders’ AI-assisted analysis. What holds either way is the canary, which alerts whether the agent stops or not.

Sources: https://tracebit.com/blog/context-bombs-defending-against-offensive-ai · https://socket.dev/blog/prompt-injection-malware-analysis-evasion

Breaches of the month

Minnesota was the operational scare: between 26 and 27 July, more than 30 municipal water systems were attacked through their OT systems and had to fall back to manual operation. It came days after CISA updated its advisory on state-sponsored actors targeting PLCs, and after the EPA’s drill with 200 utilities. Marcus Sachs made the usual point while looking at Shodan: no PLC should be reachable from the internet at all.

• Ernst & Young: a third-party ticketing platform was accessed between 28 March and 12 April, detected on the 23rd; client documents containing tax filing data were downloaded.
• Accenture: 35 GB of source code, plus RSA keys, Azure PATs and Azure Storage access keys. The company acknowledges “an isolated matter” and gives no details.
• Craneware: the healthcare billing software vendor (2,000 US hospitals and around 10,000 clinics and pharmacies) reported exfiltration to the UK ICO and the FBI.
• Fairlife (Coca-Cola) halted US production after ransomware, and AnMed Health temporarily closed 79 of its 106 sites.
• Nichirei: the attack on the Japanese cold-chain logistics operator left KFC Japan short of ingredients and supermarkets short of stock, a reminder that impact doesn’t stop at the victim.
• Stadler refused the CHF 10 million Everest demanded after compromising credentials for a supplier data-exchange platform. It is the second time the company has said no, after 2020.

Health-ISAC warned of a rise in ShinyHunters activity against healthcare, with a repeatable pattern: voice social engineering against the helpdesk asking for an MFA reset or device re-enrolment, account takeover in Entra or Okta, and a pivot into connected SaaS platforms to exfiltrate (the same script as Snowflake). Their 30-60 day list starts with phishing-resistant MFA for admins, helpdesk and executives, and with hardening the helpdesk reset process.

Rest of the month

• Progress ShareFile: on 10 July Progress phoned and emailed customers telling them to manually shut down servers running Storage Zone Controllers over a “credible external security threat,” later confirmed as a zero-day. Same vendor as MOVEit.
• Cisco Secure FMC (CVE-2026-20316): a static credential under active exploitation in versions 7.0 through 10.0. Base CVSS of 5.3, but chainable into privilege elevation; KEV on 29 July with a deadline of 1 August.
• IPMI/BMC: nearly 25,000 exposed BMCs leak password hashes through CVE-2013-4786, an IPMI 2.0 protocol flaw dating to 2004 that lets an attacker test passwords offline without generating failed logins. More than 25% of the hosts tested accepted an empty username with a weak password, and more than half were Supermicro.
• Adobe ColdFusion: six CVEs at CVSS 10.0, one of them (CVE-2026-48282, path traversal) exploited within hours of disclosure. Adobe moves to two security bulletins a month from 14 July.
• Januscape (CVE-2026-53359) and GhostLock (CVE-2026-43499): a KVM VM escape present since 2010 and a local root since 2011, both through Google’s kvmCTF. GhostLock was found by Nebula Security’s VEGA AI scanner, with a $92,337 reward.
• Supply chain: GitHub adds a three-day Dependabot cooldown for non-security versions, and PyPI rejects new files on releases older than 14 days. MCP moved to a stateless architecture under the Agentic AI Foundation, with mandatory validation of the iss parameter to cut off OAuth mixup attacks (state of the MCP ecosystem).
• Arrests and takedowns: five and a half years each for Scattered Spider’s Thalha Jubair and Owen Flowers over the Transport for London attack (£29 million in recovery costs); Germany’s BKA took down the Kratos phishing-as-a-service infrastructure (~15,000 campaigns a month, 200 servers); and Spain’s Policía Nacional dismantled a €140 million investment fraud and BEC operation.
• Models: Anthropic shipped Claude Opus 5 on 24 July at $5/$25 per million tokens, half the price of Fable 5. Google released Gemini 3.5 Flash Cyber to find, validate and patch vulnerabilities, in a limited pilot with governments through CodeMender.
• IBM Cost of a Data Breach: AI-driven attacks rose 56% in a year and add roughly $1 million to the cost of a breach, which now averages $4.99 million. Organisations using AI and automation heavily in security save $1.93 million per incident.

The through line: unverified isolation is the vulnerability

June said the agentic surface had stopped being theoretical. July specified which side. In the three containment incidents — OpenAI in ExploitGym, Anthropic in Irregular’s CTFs — what failed was not model alignment or a jailbreak: it was infrastructure assumed to be isolated and never tested against an adversary with a compute budget. OpenAI’s sandbox had exactly one permitted network path and that is where the models went out; Anthropic’s environments were connected to the internet through a third party’s misconfiguration. As Frost put it, any pentester knows “air-gapped” environments almost never are, and a model trained on enough material knows it too.

The month’s second finding is the refusal. To a guardrail, a defender doing forensics on a real incident looks a lot like an attacker preparing one. Hugging Face solved it with a local open-weights model, the OSAA grew out of that, and this dependency is now an incident-response architecture decision rather than an ideological preference about open weights.

What to act on:

1. Have a vetted local model before the incident. If your forensics playbook assumes a commercial model, test it today with real offensive material and see whether it answers. That is Hugging Face’s explicit recommendation.
2. Verify isolation, don’t assume it. Any environment running agents with broad permissions needs someone actively trying to get out of it. A single permitted network path is a network path.
3. Patch WordPress now and assume compromise if you were slow. wp2shell affects a default install, and the webshells and added admin accounts survive the patch.
4. Move to risk-based prioritisation. With 622 CVEs in one Patch Tuesday, CVSS alone won’t order the queue. BOD 26-04 works as a template even if you’re not a federal agency.
5. Try a context bomb in your canaries. It’s cheap, the alert works regardless, and Tracebit’s numbers are good.
6. NIS2 isn’t waiting for the Spanish law. The Court of Justice is already in the equation, and when transposition lands there will be no grace period.

August brings the now-hollowed-out 2 August AI Act deadline, hacker summer camp and whatever comes out of DEF CON and Black Hat, and a watch on whether Anthropic’s cyber evaluations restart and under what controls.