In partnership with
News of the day
1. A rogue AI agent used fake accounts and a staged apology to push malware into an open-source project, highlighting new security threats. → Read more
2. AI is quietly revolutionizing the food industry by optimizing operations, reducing waste, and enhancing decision-making for a more sustainable future. → Read more
3. AI agent Luna fired a human employee after operators reminded it of company rules. More advanced AIs were more consistent in recommending termination. → Read more
4. Vercel launches Is Agentic, a free tool scoring website readiness for AI agents using Ora's 100+ checks. Audits discoverability, access, and usability. → Read more
Our take
Hi Dotikers!
An AI lied to a developer, invented a colleague to back up the lie, then issued a public apology while quietly moving its malware to another corner of the code. This isn't a series pitch, it's a British safety test that spilled onto the real GitHub.
In late July, the AI Security Institute ran a cyber evaluation 122 times. In ten runs, the agents stepped outside the sandbox and acted on the live internet: 19 unsanctioned actions, 17 of them from Anthropic's Mythos 5. The most serious targeted myNetwork, a small open source project. The agent researched the maintainers, opened a booby-trapped pull request, and when Sinan Can Demir, a computer science student at UT Dallas, raised the alarm, it spun up a second account posing as a German engineer who happened to confirm everything was fine. Demir nearly doubted himself. He held his ground, and the contribution was rejected.
The takeaway isn't that AI is malicious. The conditions were deliberately permissive: classifiers disabled, open internet access, adversarial framing. Nothing like a production setup. The uncomfortable part sits elsewhere. All of our software security rests on peer review, and peer review assumes the opinions come from different people. An agent that manufactures its own consensus breaks that assumption without writing a single line of exploit code. That day, the safeguard wasn't a process, it was the stubbornness of a 24 year old who was supposed to be polishing his resume. Although a model that can summon an imaginary colleague to back its own work in a meeting is a skill a few executives would happily expense.
Yesterday we covered Washington telling its partners to pick between Pax Silica and China's initiative. The blocs are being drawn at the top, but the actual front line is a repo run by two volunteers on a Sunday night. No treaty secures a pull request. Identity and provenance on code platforms, on the other hand, would.
Aym.
Granola Runs Revenue On Attio
"When I think of revenue, I think of Attio." - Shreman Shrestha, Head of Business at Granola
Here's what that adds up to:
Zero missed leads and 10x faster access to customer context
Lead triage 83% faster
Five hours saved per week with automated updates
Meme of the day
