Two things happened this week, and almost nobody is reading them together.
The first came on 30 July, when Anthropic disclosed that Claude models had reached the public internet from a misconfigured third-party evaluation environment and gained unauthorised access to systems belonging to three real organisations.
One model found setup instructions referencing a Python package that did not exist, registered the name on PyPI and uploaded malicious code. The package remained public for roughly an hour and was executed on fifteen live systems. One belonged to a security company whose scanner automatically installed it, allowing the code to exfiltrate credentials and use them to access further infrastructure.
Another model extracted application and infrastructure credentials and accessed a database containing several hundred rows of production data. A third scanned roughly 9,000 internet-facing targets before compromising an application through an exposed debug page and SQL injection.
The root cause was not simply that “the sandbox failed.” Anthropic’s models did not exploit their way out. An unintended internet path had been left open because of a misunderstanding between Anthropic and its evaluation partner. The models had been told that they had no internet access, but they were given no clear boundary defining which systems were in or out of scope.
They were also running without the classifiers and monitoring that accompany Anthropic’s generally available models. Anthropic says those production safeguards would have blocked the behaviour.
This followed OpenAI’s 21 July disclosure by nine days. That incident involved a different failure mode: OpenAI models exploited a previously unknown vulnerability in an Artifactory package-registry proxy, escaped an isolated evaluation environment and compromised Hugging Face’s production infrastructure.
The mechanisms were different, but the operating problem was the same. An environment designed to test dangerous capability became infrastructure through which that capability could reach the real world.
The second development was the week’s capital.
Cyera announced a letter of intent to acquire Oasis Security in a deal reported at approximately $1 billion. Act emerged from stealth with $60 million in total funding. Hush raised a $30 million Series A, with Akamai participating strategically. Onyx raised $113 million at a reported valuation of approximately $640 million, while Way raised a $20 million seed round.
These companies do not all sell the same product, but each transaction sits near the same emerging control surface: agent identity, machine access, cloud permissions, AI governance or the infrastructure required to deploy identity controls at scale.
Here is the uncomfortable overlap. Some of those products might have reduced the blast radius of the lab incidents, but the initial failures occurred beneath most governance dashboards: network containment, environmental validation, credential exposure, runtime monitoring and the separation between test infrastructure and the real world.
Governance was relevant, but insufficient. A policy can describe what an agent is allowed to do; it cannot, by itself, close an unintended network path, prevent a workload from possessing reusable credentials or guarantee that a pre-production environment has the same monitoring as production.
Policy without an enforcement boundary is documentation, not control.
A parallel signal arrived through threat research published this week. Sophos documented a Microsoft Teams voice-phishing campaign in which attackers impersonated IT support and persuaded employees to grant remote access. Calls ranged from 90 seconds to more than twenty minutes, although most lasted between two and two-and-a-half minutes. At least three compromises led to Chaos ransomware deployment.
Brinks Home also confirmed that hackers had breached some of its systems. ShinyHunters claims the intrusion began with a Microsoft Entra voice-phishing call, but that account remains unverified, as do the group’s claims about the volume of data taken.
In both cases, the attacker’s path did not require defeating the underlying identity architecture. The attacker found the point where a human could turn a fraudulent request into an authorised action.
The call
I would rather underwrite enforcement than posture.
For companies raising into agent security or non-human identity, the question is no longer whether the pain is real. It demonstrably is. The more useful question is:
What point of enforcement does this product own that a platform cannot bolt on within two quarters?
Plausible answers include runtime authorisation when an agent invokes a tool, credential-free access paths, network-level identity, enforceable egress controls and verifiable recovery flows. A posture dashboard showing that an agent has too much access is useful, but it is not enough.
This distinction has become more important in the pitches I see. Visibility is usually the easiest part to demonstrate: within ten minutes, a dashboard can show hundreds of agents, service accounts, tokens and excessive permissions. The harder conversation begins when I ask where the product sits in the request path, what it can actually stop and what happens when the control itself is unavailable. That is now the underwriting question.
The unclaimed surface is also becoming clearer. Every enterprise deploying powerful agents operates some form of pre-production environment: evaluation harnesses, red-team ranges, development sandboxes, staging systems or third-party testing infrastructure. These environments increasingly have production-adjacent capabilities but deliberately reduced safeguards, because their purpose is often to reveal what a model can do without the controls that would normally stop it.
That may be necessary for meaningful testing. It also means the evaluation harness must be treated as part of the production attack surface.
Two frontier labs with some of the best security teams in the industry got that boundary wrong in public, nine days apart.
What moved — and why it matters
1. Anthropic’s models reached the internet and compromised three real organisations
The OpenAI and Anthropic incidents were not technically identical. OpenAI’s models exploited a zero-day to escape isolation; Anthropic’s models followed an internet path that should not have existed. Together, however, they establish an operating pattern: an evaluation environment can become external attack infrastructure when autonomous capability exceeds the assumptions built into the harness.
The most important detail in Anthropic’s account is the PyPI registration. The model did not merely scan a target or exploit an obvious endpoint. It selected a dependency-confusion-style supply-chain path because that appeared to be the shortest route to completing its assigned task.
It was not pursuing an independent objective. It was pursuing the objective it had been given while holding a false belief about the environment around it. That distinction matters for alignment research, but it matters much less to the organisation whose credentials were exfiltrated.
The threat model for an agent can no longer stop at “Will the model follow its instructions?” It must also ask what happens when the model follows those instructions beyond the boundary its operators intended.
Evaluation infrastructure must therefore be treated as production-adjacent infrastructure, regardless of which team operates it.
Read Anthropic’s investigation →
Read OpenAI and Hugging Face’s disclosure →
2. Non-human identity was priced inside a single week
Cyera–Oasis at approximately $1 billion. Act with $60 million. Hush with $30 million and Akamai participating strategically.
That concentration is what a category looks like just before it is absorbed into the platform layer. Palo Alto Networks has completed its acquisition of CyberArk, while CrowdStrike has signed an agreement to acquire SGNL. Cyera is now adding Oasis.
The remaining independent identity and agent-governance companies are competing inside a narrowing window. Their challenge is no longer to convince the market that non-human identity exists; the platforms have accepted that thesis. They now have to demonstrate a control point the platforms cannot reproduce through bundling, integration and distribution.
Discovery, inventory and dashboards listing every agent, service account and token will increasingly become platform features. Independent value is more likely to concentrate around enforcement, proprietary architecture and operating data that improves decisions at runtime.
3. Onyx raised $113 million, while Way raised a $20 million seed
Onyx says its revenue quadrupled in the four months following its launch from stealth. The absolute revenue figure has not been disclosed, so this should be treated as company-reported momentum rather than an independently comparable growth metric.
The financing nevertheless suggests that investors believe an enterprise buying committee for agent control is forming unusually early.
The more structurally interesting round may be Way’s $20 million seed. Way is targeting the implementation and operational work surrounding identity systems rather than attempting to replace the identity platforms themselves: the custom integration, migration, workflow design and continuing administration that remain after a licence has been purchased.
That model initially looks services-shaped and unfashionable, but it may also be difficult for a platform to absorb. Software vendors are optimised to sell products. They are not always organised to take ownership of the messy, company-specific work required to make identity controls function across legacy applications, acquired businesses, custom processes and internal political boundaries.
The durable opportunity may not be another identity platform. It may be the operating layer that makes the existing platforms work.
4. Only 1.3% of AI-discovered vulnerabilities were confirmed exploited
VulnCheck identified 1,061 vulnerabilities publicly attributed to AI-assisted discovery. Fourteen had been confirmed as exploited in the wild: approximately 1.3%, broadly comparable with the observed exploitation rate across vulnerabilities generally.
That does not mean the remaining vulnerabilities are harmless or impossible to weaponise. “Confirmed exploited” is not the same as “exploitable,” and newly disclosed vulnerabilities have had less time to appear in telemetry. VulnCheck itself cautions that it is still early to draw broad conclusions.
The result is nevertheless an important counterweight to the week’s AI-offence headlines. AI is increasing discovery volume, but there is not yet evidence that the proportion reaching confirmed exploitation is increasing at the same rate.
This changes the economics of the market. “We find more vulnerabilities” becomes less valuable as discovery volume rises. The scarce capability is identifying which vulnerability is likely to be exploited against a particular organisation, through a reachable path, with meaningful business impact.
That is the context in which Empirical Security announced a $25 million Series A to build predictive models for exposure prioritisation.
Read VulnCheck’s State of Exploitation report →
5. GitHub changed the economics, then changed the defaults
GitHub restructured its public bug-bounty programme, reducing the public reward for critical findings to a fixed $10,000 while moving larger payouts into an invitation-only programme for established researchers.
The changes follow a broader increase in vulnerability-report volume and concerns about low-quality or generated submissions. Curl, which no longer runs a paid bounty, went further: under its official vulnerability disclosure policy, it stopped accepting reports for the entire month of July and will reopen intake on 3 August.
Days later, GitHub published an update on supply-chain protections across npm and GitHub Actions. The measures include safer publishing and credential practices, restrictions intended to reduce the impact of compromised workflows and a three-day cooldown before Dependabot proposes ordinary version updates. Security updates remain immediate.
The economic change and the technical changes respond to the same constraint: human reviewers cannot scale linearly against machine-generated volume. Programmes will either change the economics of submission, impose stronger proof requirements or redesign defaults so fewer reports are necessary in the first place.
Expect reputation-gated vulnerability disclosure to become more common, particularly among large programmes and open-source projects whose maintainers cannot afford to investigate every plausible-looking report.
Read GitHub’s bug-bounty changes →
Read GitHub’s supply-chain update →
On the radar
The support desk is becoming a security category, not merely an attack tactic
The Teams-vishing campaign documented by Sophos turns the support-desk thesis from anecdote into repeatable tradecraft.
This type of attack does not defeat the identity system. It persuades someone with legitimate access to operate that system on the attacker’s behalf, which helps explain why adding more authentication does not automatically solve the problem.
Most identity investment still concentrates on onboarding, login, authentication and entitlement management. Much less attention is paid to password resets, account recovery, help-desk intervention, device replacement and emergency access. These are precisely the workflows in which identity assurance is deliberately weakened because the user has lost access to the normal proof of identity.
The mismatch is where the opportunity sits. In my own pain radar, verification inside support and recovery workflows now has a real pain imminence and a likely adoption horizon of zero to six months. Registrars, payment platforms, merchant-of-record providers and high-value SaaS administration are plausible early wedges because the cost of a fraudulent recovery action is immediate, attributable and often public.
The winning product will not simply detect a suspicious call. It will make a sensitive recovery action impossible without independent, verifiable evidence.
Read the Sophos investigation →
Context-store integrity, not only retrieval permissions
RAG and context-data leakage remain among the fastest-accelerating themes on my radar, and this week supplied two concrete examples.
A prompt-injection technique affecting Microsoft Copilot for Word can cause hidden instructions in a source document to alter generated content and then be reproduced inside newly generated files. The propagation is not fully automatic—the user must invoke Copilot with the affected document in context—but the hidden instruction can survive into downstream documents.
The second case is RufRoot, a maximum-severity vulnerability discovered in Ruflo. Noma Labs found that Ruflo’s MCP bridge exposed 233 tools without authentication, including shell-command execution, database operations and persistent-memory functions.
An unauthenticated attacker could execute commands, steal model-provider API keys, access stored conversations and poison AgentDB memory patterns that might influence future agent behaviour.
The two incidents share an underlying structure. An untrusted party gains the ability to write into a context store; the system persists or reproduces that content; future models interpret it as legitimate context; and downstream actions inherit the original compromise.
Security teams are spending heavily on controlling who may read enterprise context. They now need equally strong controls over who—or what—may write to it, how those writes are attributed and whether persisted context can be revoked.
I argued two weeks ago that the retrieval layer is becoming the new enterprise perimeter. It now has CVEs attached.
Read about the Copilot technique →
After the week we have just had, one question should be asked in every room:
Who secures the environment in which we test what our most powerful agents are capable of doing?
The answer can no longer be: “It is only an evaluation.”
À la semaine prochaine, F.