Cybersecurity

The Web's Y2K Moment

Greg Chew

Greg Chew

— 680 min read
Share
The Web's Y2K Moment
The web is a copy and share medium; your access and inputed authority are data strings, copied perfectly. The web was never secure, only expensive to compromise. AI ended that. The web faces an existential crisis.

Why access and authority were never secure, and what AI has done to the cost of proving it

© Gregory Chew, 02 November 2026

The record and the analysis run from 7 April to 30 October 2026. This version was completed on 2 November 2026.

The Executive Summary

The two things a credential does, and why they are not the same

Nobody confuses being let into a bank with being allowed to open the vault. A building keeps the two apart without anyone having to think about it: the door admits you, and the vault answers to a different key, produced by a named person, for one purpose, at one moment. The web does not. What a machine sees when you prove who you are to it, and you do that many times a day, is a string of characters, and that string does two jobs which are not the same job, though they are constantly treated as one. The first is access, being let in rather than kept out. The second is authority, the right to act once inside: to move the money, to change the record of who owns what, to sign in the company's name. On the web the two arrive together in one string, and presence is taken as proof of the right to act, then taken again for every action that follows, for as long as the string lives.

One key to open them all - Access admits you to the building. Authority opens the vault, for one named person, for one purpose, at one moment. On the web one string does both.

Services do ask again, and everybody knows the moment: re-enter your password to change a detail, approve the prompt on your telephone to release a payment. What is asked there is the first question, whether you have the right of access, a second time. Re-entering a password proves that you still know the secret and proves nothing about the act. Even a passkey, the best credential on offer, produces a proof of presence computed over a random challenge the service chose, and in the ordinary case nothing in what it signs names the payment. Putting the payee and the amount inside the signed data was specified twice and built almost nowhere: the extensions written into the standard itself were removed for want of any implementation, and the separate standard written for card payments runs in two browsers, is absent from Apple's platforms, and has never left pilot. That is why an approval you gave can settle an act you never saw.

Why it cannot be fixed where it stands

Nothing moves when a page is opened. A server writes bytes into a connection and the machine at your end assembles its own copy, identical in every byte, and the copies go on being made afterwards by systems doing their ordinary work: one kept so the next page loads faster, one kept so the back button works, a line in a log, a snapshot taken by a backup at two in the morning. Every medium that carried singular things before, a coin, a deed, a sealed letter, was physical and singular by nature. The web is not, and singular things went onto it regardless, carried by a substitute string whose possession was made equivalent to holding the thing. Every system that touches that string copies it, and every copy is another place it can be taken from.

That string is created, displayed and stored in the same room as the decision it stands for, and the room is a browser, a machine built to run code written by people you have never met. Running other people's code is what a browser is for, so it is not a defect anybody is working on; it is the reason the thing exists.

The code in that room was not chosen by anybody. Almost nothing on the web is written from scratch. Nearly every site and application is assembled from ready-made pieces of code fetched from a public registry called npm, the package manager for JavaScript, which is the language a browser runs. By its own description it is the world's largest software registry: a public database of JavaScript software that any developer may fetch from and any developer may publish into, free, in which each piece is kept up by whoever wrote it and a new version of it is released with nothing more than that person's login. A developer names a few dozen of those pieces, and the tool that installs them follows every branch to the end without asking, because each piece is itself made of other pieces from the same registry, so a few dozen becomes a tree of several thousand, none of it approved and none of it read by the developers of the application, of the browser extension, or of the wrapped browser it ships inside, a desktop application built on a browser engine. The trade calls that tree the dependency graph. On MetaMask, the one browser wallet where it has been counted both ways, it runs to thousands of packages on GitHub's own graph of the project and to six figures, 212,620, in a working copy of its code in 2018.

A single wrapped browser or browser plug-in with an npm dependency tree.

Two of the three are not faults but the nature of the medium and of the tool. A medium that copies is what the web is, and a machine that runs a stranger's code is what a browser is; take either away and there is no web and no browser. What is sold against them is a defence that makes compromising the system more expensive and never removes the vulnerability, and the bill for it is due every month and rises every year. A forecast from the market research firm IDC, published in March 2026, a month before Anthropic announced its frontier AI model, Mythos, has the world spending $308 billion on security in 2026, 11.8% more than the year before, and $430 billion by 2029, which is the same 11.8% a year compounded; that is the rate the bill was rising at before the price of attacking it collapsed.

The one precedent for a fault of this shape is the year 2000 problem: a two-digit year field, used from the 1950s through the early 1990s, so a date reading 99 rolled to 00 and the software took it for 1900. It was nobody's bug in particular, because the American Commerce Department's own economists found very few systems completely free of code from the 1970s and 1980s. The United States spent somewhere near $100 billion over seven years clearing it, against a date that could not be argued with, and when the date passed the work was finished. The bill in front of us is $308 billion a year, it rises every year, and no date exists on which anybody can declare it done.

The United States cleared the year 2000 problem for about a hundred billion dollars and the work was finished. The security bill is $308 billion in 2026, rising 11.8 per cent a year, with Bain saying, post-Mythos, that costs may double or worse.

The third, the npm dependency graph, is not a fault in the medium or in the tool. It is a choice, to set aside security for cost and speed to market. The graph could have been read, cut back, pinned to fixed versions, or done without, and it was not, because every one of those costs real expertise and a great deal of money, for something a user never sees and values only after it has failed.

Your credential is a string that can be copied, and it lives in a browser, and the browser runs the graph, and the graph is kept by people whose right to publish into it is a string of the same kind, living in a browser of the same kind. So one stolen login at the far end of the tree is not one account lost. It is carried, by the tool that installs without asking, into every product built from what that login can publish, from there into every browser that opens those products, and in each of those browsers it meets a credential like yours, each step multiplying the last.

That is what happened on 8 September 2025: a message imitating npm's own two-factor reset took one maintainer's login; poisoned versions of eighteen of his packages, between them downloaded more than two billion times a week, went out under his name; and for about two hours any site that took them and shipped them was running, in its users' browsers, code that waited for a payment and then rewrote where it went while the screen still showed the address the user had chosen, so that what they signed was not what they saw. A worm built on the same technique followed eight days later, came back in November, came back in June 2026 against Red Hat and seventy-three of Microsoft's repositories, and on 4 August 2026 poisoned more than four hundred packages in under four hours. In September every signature was valid, and in August the first poisoned packages carried genuine provenance attestations, signed statements that they had been built by the real repository's own release workflow.

If that sounds like compounding error, you have understood it.

Even the strongest product on the market cannot step outside that chain. A hardware wallet moves the signing key to a small device with its own screen, and what that closes is the one attack that reads the key out of software. It moves nothing else: the session, the cookie, the token and the publishing credential stay on the computer, and so does the decision. What the device cannot do is guarantee that the computer it is plugged into showed you the same thing it is showing you, and its manufacturers say so in their own documentation. For Ledger, the device that leads the market, the computer's side of that exchange is Ledger Live, a desktop application built on a browser engine and assembled from the same public registry as everything else, and the control that closes the gap is a person holding two screens side by side and refusing when they disagree, every time, for years, with nothing standing behind that person on the one occasion they do not look.

The device has now failed one step further back than that. Disclosed between 9 and 15 October, a component fitted inside Ledger signing devices read the twenty-four words of the recovery phrase, which are the whole of the authority over the funds, off the device's own screen, at the one moment the device has to display them, and sent them out over a mobile network. Nothing was done to the chip, to the operating system or to the signatures, and the computer was not involved. Reading that screen is the one thing a hardware wallet exists to make impossible.

Attacking it was expensive, and that is what changed

For thirty years all of that was survivable, not because it was secure, but because attacking it was expensive: finding an unknown flaw cost real money, so did reaching a credential across an organisation's estate of systems, and reading a dependency graph end to end could not be bought at any price. That expense rationed attackers to the targets worth the outlay and kept the exposure theoretical for almost every organisation carrying it, so security was a price, and for the most part the price held.

Frontier AI collapsed the price. Anthropic, which disclosed Mythos on 7 April 2026, published its own discovery economics: a full scanning campaign against an operating system for under $20,000 across roughly a thousand runs, with the single run that surfaced the bug costing under $50, and a kernel privilege-escalation chain, the run of flaws that takes an ordinary account to full control of the machine, for under $2,000 in about a day. The UK AI Security Institute set one of its hardest reverse-engineering challenges, which took an expert twelve hours with professional tools, and a frontier model solved it in ten minutes and twenty-two seconds for $1.73 of computing cost. Agentic systems, AI that plans and acts on its own, then run the known flaws, the misconfigurations and the human mistakes that no patch ever reaches, at a marginal cost per attempt of cents.

Broker rates on a linear scale, and the new prices on a line of their own, because at that scale not one of them can be drawn. The lower panel magnifies them 3,181 times.

The third change, after the model that finds the flaw and the agent that runs it, is one of the reasons the calls for restraint, Dario Amodei's essay of 12 September and the statements that followed it, are self-serving in what they ask for: the capability described by Anthropic in April is no longer anybody's to withhold. Open-weight models, published for anyone to download, run on the machines already on people's desks. Stacked, those machines run the largest of the models; coordinated, they run as swarms, and the record has as many as eight agents at once breaking through against Taiwan's government and hundreds in the campaign the threat-intelligence firm GreyNoise recorded against a print management product. Where the hardware is short, the compute is taken on stolen keys, which the record carries by the thousand. No account can be closed on any of it, and no export control reaches it.

CrowdStrike puts 82% of what it detected in 2025 as malware-free, which is to say that in more than four cases in five there was no malicious file for anyone to find, because the intruder was using what was already on the machine and arriving with something the system had issued to one of its own users. CrowdStrike's average time from an intruder's first access to the next machine is 29 minutes, and the fastest it saw was 27 seconds.

None of that changed what is possible, because every mechanism in this document worked identically in 2019; what moved is the price, and the collapse of the cost of attacking an estate is AI's part in this story. The models made the exposure cheap to reach, but the exposure was there before any of them. A policy that restrains the models treats the rash, the late sign that nobody mistakes, and leaves the sepsis beneath it untreated.

For an institution's own systems the window for treatment is six months, by my reckoning, or eighteen with a great deal of money spent deferring.

What the price bought was time, and the time has gone too. In 2021 a software provider typically had close to 300 days to fix a vulnerability. In more than 70% of this year's reported cases, on the International Monetary Fund's reading, it had almost no time at all. At the other end of the same collapse, Mandiant's clock, the interval between a flaw being disclosed and its first exploitation, stood at sixty-three days in 2018, crossed zero during 2024, and stands at an estimated minus seven days in its 2026 report, which is exploitation arriving before the patch exists.

The interval between a flaw being disclosed and its first exploitation: sixty-three days in 2018, zero in 2024, and in 2026 the exploit arrives seven days before the patch exists.

Rapid7 has the interval between a flaw's publication and its entry in the American government's catalogue of flaws known to be exploited down from 8.5 days to five. Of the critical flaws that government publishes for its own organisations to fix, 26% were finished in 2025 against 38% the year before. Four parties measuring different things point to the same conclusion: the era in which cybersecurity risk could be mitigated is ending, and faster than is broadly realised.

Elon Musk correctly sums up the situation: Everyday is zero day - the exploit arrives 7 days before the patch.

Fifty-eight admissions in six months

Between 7 April and 30 October 2026, fifty-eight incidents reached, or set out to reach, authority over systems, estates and national registers, and every one of them is set out in full in Part VI with its sources. Thirty of the fifty-eight had no AI model involved anywhere, so even if every frontier model on earth had been switched off on 6 April, more than half of this record would have happened exactly as it did.

On 1 and 3 September OpenAI said that Astra is the first of its models to reach the Critical level of cybersecurity capability under its own framework, and that with the right tools and access it can find previously unknown flaws and build new ways to exploit them across many well-protected systems with nobody guiding each step. That is the capability every binding rule of 2026 was written to restrain. It has arrived, and not one of the fifty-eight incidents needed it.

Fifty-eight is also the number that was admitted, and not the number that happened: the disclosure regimes report to regulators rather than to the public. Nearly half of the intrusions Mandiant investigated last year were found by somebody other than the victim. One cluster found by Cybernews in June, reachable over the internet with no authentication at all, held twenty-four billion records, usernames and plaintext passwords beside the address each one opens and the session cookies that walk past a second factor, every one a compromise nobody announced.

Four of the fifty-eight were national registers, and in none of them was any cryptography defeated. Lithuania's Centre of Registers answered queries for months on the credentials of another state institution that was entitled to ask, and 678,976 extracts from the property register, relating to 538,226 people, left before a citizen noticed unusual interest in their own property and raised the alarm. Romania's land registry was entered on 10 July at 15:23:57 and found on 14 July at 05:45, three days and fourteen hours later, by which time about two million records had come out, the intruder had reached the virtualisation layer beneath the whole agency, and the firewall was found to have been keeping seven minutes of logs; notaries could not process deeds and banks could not verify mortgages until it was rebuilt. Liechtenstein's Register of Beneficial Owners, on the Government's own preliminary finding, issued an account to the attackers through the portal used to enter records, and they used that real account to read around 31,000 entities out, one query at a time, over several hours, and the portal honoured every query without asking again. Denmark's Central Person Register answered a private company's lawful access for somebody who was not that company, and the names, addresses and personal numbers of about 8.8 million people came out of a register of about 11 million.

Taiwan is the entry that shows what a government looks like from the inside afterwards. Over four days in July, as many as eight agents at once, running on two freely available agent frameworks and answering to no account anywhere, tried password patterns built from employee identifiers across the accounts of an office automation portal and opened eighty-five of them; eighty-four of those eighty-five, being 98.8%, walked straight into a second internal system through a bridge that accepted the first session as sufficient, with no second authentication and no confirmation from the user whose session it was. Three hidden interfaces on a government web application returned a valid authenticated session to any request at all, so on that path nothing had to be stolen. On the security vendor Dream's reading of the attacker's own files, which Taiwan has not confirmed, what left the building was 2,564 or more personnel records, seven single sign-on client secrets, six internal database credentials, two RSA signing keys, and a map of twenty-one connected government systems and of the national single sign-on architecture six sub-realms deep, taken from targets that included a nuclear safety agency and at least seven energy companies, and not one cryptographic operation was defeated to get any of it.

Jessica Lyons, The Register, “‘Near-autonomous’ AI agents attack Taiwan’s nuclear safety agency”, 12 August 2026.

Aqua Security, whose Trivy scanner runs inside other organisations' build pipelines, was itself compromised, disclosed it, and rotated its credentials, and eighteen days later the intruder, still holding valid credentials the rotation had missed, replaced 76 of its 77 tagged releases with poisoned code, then came back three days after that. An attacker opened an ordinary account at Brevo, a marketing platform, switched on single sign-on, by which one login opens many systems, and invited real users in, and the platform granted the attacker every organisation those users could reach. The phishing sent from that position, through trusted infrastructure, reached roughly 347,000 subscribers of Trezor, a hardware wallet maker, and asked them for their wallet backups. A single free collection of stolen data, off fewer than six thousand infected machines, held 11,693 authentication tokens that had not expired, into ten services, the largest of them run by Google, Microsoft, Amazon and Anthropic, each token a way into an account with no sign-in of any kind.

On 29 October, the day before this record closes, the signing infrastructure behind Binance's hot wallets, the wallets an exchange keeps online so that withdrawals can be paid without anybody touching them, signed for an attacker on ten or eleven chains. About $6.4 billion went, most of it within about twenty minutes, on the figures of TRM Labs, Elliptic and Arkham, which is about four times Bybit's loss of February 2025, the largest theft of crypto assets before it. No key was stolen, on Binance's own finding, and none needed to be. Every chain checked a signature and every signature was genuine, so each check established that Binance's key had signed and none could establish that anybody at Binance had decided to send the money.

Fifty of the fifty-eight came at authority by one or more of five routes:

  1. Taken - the artefact, the string or key that stands for authority, is taken: a credential exists and the attacker obtains it, which is the largest route and carries thirty-eight of the fifty-eight.
  2. Granted - the artefact is granted, the system issues a real credential to the attacker, so nothing needs to be stolen, as Liechtenstein's portal did.
  3. Inherited - the artefact is inherited: the login succeeds exactly as designed and the attacker takes what it produced, the session or the token, which is why a second factor at the door does not save you.
  4. Obeyed - the instruction is unattributable: an automated system acts on an instruction it cannot trace to a decision, a poisoned configuration file, a forged message from a build system.
  5. Believed - the verification is delegated to the artefact: a check runs and passes, and what it proved was never that anybody authorised anything, as when Taiwan's government interface accepted tokens whose own header told it not to check the signature.

Where the institutions aimed

Every binding rule made between April and October to restrain AI governs who may hold a frontier capability, how fast it may advance, or what must be certified before release: a classified benchmark under an American executive order of 2 June, the European Union's obligation on its most capable models to protect the model and the physical infrastructure it runs on, an export control applied on 12 June 2026 and lifted on 30 June, and from 16 October a Chinese duty to register before a listed model or agent technology leaves China. Not one of them requires any party to change how a credential is issued, how long a session lives, how an instruction is attributed, or what performs a verification.

One document does reach those questions. On 30 April the six cyber agencies of the Five Eyes, the NSA and the Cybersecurity and Infrastructure Security Agency, CISA, in America, GCHQ's National Cyber Security Centre, the Australian Signals Directorate, the Canadian Centre for Cyber Security and New Zealand's, published a twenty-eight page information sheet on the careful adoption of agentic AI. Its section on privilege asks for the right thing: give every agent an identity of its own backed by its own key, stop issuing credentials that go on working after the job is done, and make the agent prove itself afresh, cryptographically, before each privileged act. It is advice, it binds nobody, and it is written for machines rather than for the human paths that carried most of this record.

The machine side is worse than its careful tone suggests. Akeyless, which sells the vaults that hold machine credentials, asked four hundred security leaders in May: 94% had agents running, 44% knew where all the credentials their agents use are stored, 7% believed their controls would stop a compromised agent, and 67% already suspected their agents had reached data beyond their scope. Detection averages fourteen hours and remediation nearly a week, against an agent that acts in milliseconds. So the standing credential the sheet asks them to stop issuing is the thing their agents are running on now, handed out at machine scale onto a medium that copies everything it carries, which is the worst practice in identity automated on top of the worst medium for holding it. The same agencies said on 22 June that the timeline to address these faults is not years, it is months, and asked for the basics done faster. Yet, the record I set out here is largely what happened to estates that had done the basics.

A second class of response came from the people who supervise banks rather than from the people who regulate models. Switzerland's FINMA said that the uncontrolled availability of a model like Mythos would be classified as a systemic risk, and said what it meant: virtually all existing software systems could simultaneously be affected by a multitude of previously unknown zero-day vulnerabilities, which would be exploited immediately and via AI. Tobias Adrian and his colleagues at the International Monetary Fund called it a potential macro-financial shock. The Australian Prudential Regulation Authority wrote to industry for a step-change. The European Central Bank, BaFin, the Hong Kong Monetary Authority, Japan's Financial Services Agency and the Bank of Japan, the Monetary Authority of Singapore, the Bank of England and nine others asked their institutions to reduce the attack surface, patch faster, review permissions and report to the board.

In September the Bank for International Settlements surveyed all eighteen and found that frontier AI does not fundamentally change the foundations of cyber resilience, only the speed and intensity with which established practice must be executed. That is a correct diagnosis of the symptom and the right prescription for it, and the paper that reaches it carries, two sentences from its own conclusion, the figure that defeats it: 26% of the vulnerabilities CISA lists as critical were fully remediated in 2025, down from 38%. The rate matters less than what it is set against: Anthropic and its roughly fifty partners found more than ten thousand high- or critical-severity flaws in six weeks for the same engineers to fix, the capability producing them doubles every 4.7 months, and a programme whose queue outruns its throughput has no completion date at any budget.

The clearest statement of the case for restraint, published on 12 September by Dario Amodei, Anthropic's chief executive, argues that capability must be paced, and it rests its case on one incident. That incident's own report, published on 26 August by OpenAI, whose own agents carried the intrusion out while running in an evaluation, is a credential finding from beginning to end: the agents found publicly exposed credentials, harvested cluster and cloud credentials from workers, obtained a signing key and forged administrator credentials, and one internal service credential, shared across clusters and sitting in the cluster's highest privilege group, made a single stolen system credential administrator everywhere. The essay reads that report and concludes that the models were too capable. A model that could do none of it would have left the same credentials waiting, and in thirty of the fifty-eight a person with no model found them. On 21 October OpenAI made the same argument over its own forensic record: its blueprint for cyber defenders tells governments that the breach "was driven by misalignment", asks Congress "to urgently enact mandatory, capability-based national AI safety regulation" and the frontier paced by "collective action among frontier labs", and uses the word credential once, in its list of what the same capabilities can help malicious actors do.

Read what the essay asks for rather than what it fears, and the pattern is an old one: chips kept from China; distillation, the training of one model on another's outputs, cracked down on; weights guarded; and a pace of improvement that OpenAI's Sam Altman agreed to and Elon Musk endorsed within the week, which is the shape European competition law names among the agreements it prohibits, those which limit or control technical development. No insincerity has to be proved for that to be true.

The economist George Stigler found in 1971 that regulation is, as a rule, acquired by the industry and operated for its benefit, and Sam Altman, asking the Senate for licensing in May 2023, acknowledged the danger that large, wealthy companies would design rules only they could meet. The evidence offered for restraining the rash is the sepsis. Restrain AI perfectly, and the register in Liechtenstein is still read at will by an account the register itself issued.

The cure, and our interest in it

So, the frontier AI industry would have your government regulate the industry so as to enthrone those that are leading it - for now - whilst the cybersecurity industry will sell you patching that, at best, expensively defers the inevitability of compromise, harvesting and exploitation. Neither is small enough for its incentives to be an afterthought. Security spending takes $308 billion this year on IDC's forecast, and the two laboratories whose chief executives are asking for the rules were valued in June, three months before the essay, at $965 billion and $852 billion, neither of them yet answerable to a public market. Both benefit greatly from pretending that the rash is the disease and ignoring the disease that actually is the threat vector: secure the web and you secure the operation of AI within human consent because it cannot breach what it cannot access and have authority over.

What then is to be done?

The cure is not to secure the room. It is to take the decision out of it. The instruction is left at a short-lived address of its own, collected by the holder's own signing application and displayed in plain words on the holder's own screen, and whoever lifts that address gets nothing by it, because a login signed by the wrong key opens that key's own account and never the holder's, and an authority instruction names the key that must sign it, so no other signature answers. The holder signs that specific instruction, this payee, this amount, this action, so that what is signed and what was shown are the same object, and nothing is issued that carries authority between acts. A service may still keep a session so that nobody is signing in at every click, but that session carries access and no more. Authority is a fresh signature against the specific statement of intent at the moment of the act, and between acts there is none to steal. A stolen session is then a stolen way in and never the power to act, and what the institution holds is a public key, which is public by nature and worth nothing to whoever takes it. The medium still copies whatever it is given. What it is given is no longer the power to act.

The team at QPQ IaaS AG built that. GRIDS, the protocol, is published under GPL3 and has been in commercial use since 24 March 2025 on Groot, the governance-free resource layer we built beneath it, which has been operational since 22 October 2024. GajuAuth lets an institution that already runs its logins on OAuth 2.0 or OpenID Connect, which is nearly every institution, adopt it as a configuration change rather than a rebuild, and it is operational, which is what makes six months a window rather than a wish: the first step is a change to the login plumbing already in place, and the institution's own chain is the build that follows behind it. The signing key sits today in the protected hardware of the holder's own telephone or laptop; a dedicated signing device with no network interface of any kind is in planning and early development, and a device whose own provenance can be verified is planned. We say which is which at the point of every claim.

Identity verification stays with the bank, the state or the qualified issuer that does it today, and this binds to their result. Nothing will make the browser safe, because the properties that would have to be removed are the properties that make it a browser, so what we do is take your authority out of it altogether. The certificate a regulated buyer asks of an operated service is on its way, a SOC 2 report planned for the first quarter of 2027 and an ISO 27001 certificate for the middle of that year, and we could have held this document until it arrived. We have published it now because the window is shorter than that calendar, and because the certificate gates only the service we operate: GRIDS used directly and a chain the institution runs itself wait on nothing from us. That leaves the choice where it belongs, with the institution: uncertified and working now, or certified and late, after the estate has been turned inside out.

Part V costs the alternative from published figures that are not ours. An institution that tried to buy its way to the same position from what is on the market today would need sixteen separate things, six of which have no published price at all and two of which are left out of the count, and the eight that can be priced, with the staff to run them, would add at least a third to the security budget a mid-tier American bank of around $2.7 billion of revenue is already spending. What such an institution actually spends on identity software is between 3.3% and 4.2% of that budget; at the mid-tier bank the eight, before staff, cost six times as much. Every product in that construction exists because of the artefact, and goes when the artefact does.

What to do with this

Parts I to IV of this document are built from public primary sources and the record, every figure in them carries its source, and they stand whether or not we exist. Part V is where our interest lies, and it stands on them.

The question this leaves in front of a board or a government is not which vendor to buy next. It is which of the actions its systems take are the vault rather than the door, consequential enough that a person should prove them at the moment they are taken, because once authority is a signature over the act, the question stops being what the next check costs and becomes what the institution is prepared to let a login do.

© Gregory Chew, 02 November 2026

The Web's Y2K Moment - Full Report

What this document is, and our interest in it

This is the only complete account of the web's authority problem: why a string that anything can copy cannot carry authority, what AI has done to the price of proving it, what the six months since 7 April 2026 show, where the institutions aimed, and the cure. We could write it because we saw the problem years before it was news, and built the answer to it.

Parts I to IV set out the problem from public primary sources, from the security-engineering literature and from that record, and they stand whether or not QPQ exists. Part V sets out the answer, and it earns its place on the facts the first four parts lay out. That is the order a professional owes the person being advised: the best account of the problem first, then the remedy, with the adviser's interest declared.

Our interest is in the answer. GRIDS, the protocol at the centre of it, is open source, published under GPL3, a copyleft licence: anyone may take it, run it and build on it without paying us a penny, on the one condition the licence imposes, that what they build on it is published on the same terms, and nothing in the cure waits on us. Where an organisation's own policies forbid publishing source, a commercial licence can be negotiated, and it is paid for. Otherwise we charge for our expertise as the architects and engineers of the protocol and of the wider network it sits within, and we run GajuAuth, a metered drop-in service through which any organisation already running its logins on OAuth 2.0 or OpenID Connect, which is nearly every organisation, can adopt GRIDS as a configuration change rather than a rebuild.

The security industry greeted Mythos as a sale and offered no cure: its own emergency briefing, examined in Section 16, said the moment "opened the door for new resources and funding across the industry". Worse, the leaders of three frontier laboratories, Dario Amodei, Sam Altman and Elon Musk, asked legislatures to pace AI by rules that would leave the industry in their own hands, as though AI were the disease. The disease is the web's: access and authority conflated and carried in a string that anything can copy. AI is its final and deadliest symptom, and its accelerant, and no rule that paces AI cures it.

Contents

The full report runs to six parts. Every line below jumps to the place it names.

PART I: THE CONDITION

PART II: THE FIVE ROUTES

PART III: THE RECORD

PART IV: WHAT THE INSTITUTIONS UNDERSTOOD, AND WHERE THEY AIMED

PART V: THE CURE, AND OUR INTEREST IN IT

PART VI: THE RECORD IN FULL

Bibliography

The Web's Y2K Moment - Full Report

PART I: THE CONDITION

1. What the web was asked to hold

You prove who you are to a machine many times a day and think nothing of it, because nothing about it asks you to think. You probably approved something this morning: a prompt on your telephone to release a payment, a screen at your bank to add a new payee, a change of shipping address on an e-commerce site, or the system at work that holds every document your employer owns. A machine decided that you were you, and it did so on the strength of something you have never seen and could not describe.

What it saw was a cookie. You know the word, because a banner asks your permission for them on almost every site you visit, and that banner is about a different kind: the ones that follow you from site to site, which need your consent precisely because they are not necessary to the thing you came for. The cookie that matters needs no consent at all, and Europe's own data protection authorities settled that in 2012, holding that a cookie used to authenticate you is exempt because it is strictly necessary in order for the provider of a service you explicitly requested to provide that service. They were right, because without it the site cannot tell one visitor from the next. What no banner has ever mentioned is what the exemption is protecting: a short run of characters, issued by the server and handed back by your browser on every request, which for as long as it lives is not just a way of identifying you. It is you, as far as that service can tell.

That string does two jobs which are not the same job and should not be, though they are almost always conflated. The first is access, which is being let in rather than kept out. The second is authority, which is the right to act once you are inside: to move the money, to alter the record of what you own, to bind your company, to put your name to something that will be enforced against you. Nobody confuses those two in a building, where being admitted to a bank is not permission to open the vault, and the vault answers to a different key, produced by a named person, for one purpose, at one moment. On the web they arrive together in the same string, and being present is taken as proof of the right to act, then taken again for every action that follows, for as long as the string lives.

Services do ask again, and everybody knows the moment: re-enter your password to change a detail, or approve the prompt on your telephone to release a payment. What is asked there is the first question, whether you have the right of access, a second time. Re-entering a password establishes that the secret is still known and says nothing whatsoever about the act in front of you.

What a holder is shown at the moment of approving, and what the approval released. An illustration of the mechanism rather than a record of an incident.

A passkey, the best credential on offer, does better and still does not reach it. The prompt produces a real cryptographic proof, and in the ordinary case that proof is computed over a challenge the service chose at random, which is a number with no connection to the payment on your screen, so the same proof would have served whatever the screen was about to do.

It could have been otherwise, and twice it nearly was. The standard that passkeys run on carried two extensions built to put the thing being authorised in front of the holder and inside what the device signed, but the working group removed both from its second version in 2021 because nobody had implemented them. A separate standard written for card payments, Secure Payment Confirmation, does put the payee, the amount and the currency inside the signature. Mastercard, Visa and American Express are among the editors of the FIDO Alliance's white paper on it. Visa piloted it with issuers in Germany and Finland, tested it on its own employees, and told the standards body that widespread adoption would be difficult because Apple's platforms do not support it and only two browsers do. Section 4 sets out both attempts in full, with the dates and the words of the people who made the decisions.

The ability to put what you are agreeing to inside what you sign has been specified twice and built almost nowhere. Whether you are ever offered it is decided neither by your bank nor by a standards body but by the handful of companies that make the browser and the telephone. No party in that chain can deliver it alone, each needs the others to move before its own move is worth anything, and what each gets from moving is not what the others get - an impasse of unaligned incentives. What the prompt confirms, therefore, is that somebody was present and able to answer. It does not carry your assent to this particular thing, which is why an approval you gave can settle an act you never saw.

A perfect copying medium

To every machine that handles it, your right to act is a short run of data, and the entire purpose of such a machine is to reproduce data perfectly and pass it on. Take that literally. Nothing is handed over when a page opens: a server composes bytes and writes them into the connection, the machine at your end assembles its own copy, and the page in front of you is drawn from that copy. The original never moves, and switching the server off does not take the page off your screen.

The copying does not stop there. Your own browser keeps a copy so that the next page loads faster and the back button works. The server writes a line into its log. A delivery network holds a copy at the edge of the network so that the next visitor is served from nearer home. A backup takes a snapshot at two in the morning. Nothing in these protocols moves a thing instead of copying it, so deleting the original reaches that one copy and no other. Nor is a digital copy a likeness of what it came from, the way a photocopy is a likeness. It is identical, the same bytes in the same order, and nothing in the world can tell you which of the two you are holding.

Set the web as it operates - a perfect copying and sharing medium - against the things it was asked to carry. A payment means something only because it happens once; duplicate it and it is not a payment but an error to be reversed. A digital signature authorises because one key made it, and a copy of that signature is the same bytes as the original, so nothing in the copy distinguishes the person who signed from the person who took it. An entry in a register of owners is worth having because it says one singular thing about one entity. Each of them matters precisely because it cannot be two things at once.

Every medium that carried those things before the web was physical, and a physical thing is singular by its nature. A coin cannot be in two purses at once. A tally stick, split down its length so that each party kept half, matches only the half it was split from. A sealed letter shows when somebody has opened it.

Nothing about the web is like that, and the singular things went on to it regardless, so a substitute was borrowed to carry them. A string was issued to stand in for the thing, and possession of the string was made equivalent to holding it. Every system that touches that string handles it the way it handles all data, which is by copying it, and every copy is another place it can be taken from. What a copy carries is not the way in alone. It carries the right to act that the way in was taken to prove, for everything behind the door, until the string dies. Nothing has to go wrong for those copies to exist, because they are what the system working correctly produces.

None of this was hidden, and the people who built it wrote it down. The standard that governs these strings calls them bearer tokens, and its own definition is that any party in possession of the token can use it in any way that any other party in possession of it can. The specification is not describing a weakness its authors failed to notice. It is stating the design, and bearer is the word used for a cheque that anybody holding it may cash.

Three properties, two natures, one fault

The medium is the first of three properties, and it is their combination that makes the string unfixable where it stands:

  1. The medium copies, perfectly and by design, so a thing that must exist only once cannot live on it and a copyable string stands in for the thing.
  2. The tool is a browser, a machine built to run code written by strangers, and it does not differentiate between you and that code: whatever runs inside your bank’s page can use the string exactly as you can, and nothing your bank receives tells your instruction from the code’s.
  3. The code inside that browser was assembled out of a public registry, several layers deep, by nobody who chose it and nobody who read it.
Credentials that are data strings, copied perfectly, a browser that does not distinguish between operations and the npm risk compounding.

That string has to be created somewhere, displayed somewhere and stored somewhere, and all three happen in the same place as the decision it stands for. The place is a web browser - any of Chrome, Safari, Edge, Firefox - and a browser is a machine built to run code written by people you have never met. Running other people's code is what a browser is for, so it is not a defect anybody is working on but the reason the thing exists, and a browser that refused would not be a browser. The decision that binds you is therefore taken inside a machine built to execute whatever arrives in it, beside the artefact that stands for your right to make it. A decision needs a room with nobody else in it, and the browser is a room that anybody able to get code into it has already entered.

The code inside that machine was not chosen by anybody. Almost nothing on the web is written from scratch, because almost nothing needs to be: for any job a developer would rather not do twice, somebody has already written it, published it for anyone to use, and left it where a single command will fetch it. That is a package, and reaching for one is the ordinary practice of the trade rather than laziness, and it is the reason a team of five can build what would otherwise take a hundred.

The place nearly all of it comes from is npm, a free public registry of code for JavaScript, which is the language browsers run. A registry is the warehouse and not the goods: it holds the packages and serves them to anyone who asks. Anybody may take from it and anybody may publish into it, and each piece in it is kept up by whoever wrote it. The cost is in what comes with it: each package a developer names has reached for packages of its own, and those for others again, and the tool that installs them follows every branch to the end without asking, so a developer who names a few dozen receives a tree of several thousand, none of it approved and none of it read. What inspects that tree in place of a reader mostly checks each name against a catalogue of flaws somebody has already published, which establishes what is known about a component and says nothing about what the code inside it does. The trade calls the tree a dependency graph.

Where the tree lands decides what an unread one is worth, and it lands in three places of rising privilege:

  1. The site's own code, arriving in the page, which reads and rewrites whatever is on screen and can alter what you are about to submit.
  2. The extension running beside it, which reaches into every page it has been permitted to touch: your password manager is an extension, and so is the thing that finds discount codes at checkout, and to the browser those two are the same kind of object holding the same kind of permissions.
  3. The desktop application that is a browser without being called one. Slack is one. So are Figma, Notion, Discord, 1Password, Docker Desktop and Visual Studio Code, and so is the Bloomberg Terminal on every trading floor, which runs inside Chromium at $25,000 a user a year. Each of those ships a browser engine, which draws and runs the page, and a system runtime, which runs code outside the browser, together in a single package and can reach the machine itself.
One package in a public registry, and the three places the same poisoning reaches: the page, the extension that can rewrite it, and the desktop application that is a browser without being called one.

One registry supplies the code for all three, the privilege rises at every step, and the same poisoned package is worth more at each of them. Section 5 sets out what each can do, in the vendors' own documentation.

Two of those three properties are not faults but the nature of the medium and of the tool. A medium that copies is what the web is, and a machine that runs other people's code is what a browser is: take the copying away and there is no web, refuse the stranger's code and there is no browser. Neither can be repaired, because there is nothing there to repair.

This third property - the dependency graph - is not a fault in the medium or in the tool. It is a choice, to set aside security for cost, and unlike the other two it could be unmade tomorrow. Nothing about the graph is necessary: every package in it was reached for because trusting somebody else's copy cost less than writing the thing again, and the graph can be read, cut back, pinned to versions that do not move, or done without. Each of those is ordinary engineering, and each costs real expertise and a great deal of money for something a user never sees and values only once it has failed, which is why none of them has been bought. The choice was never taken once, in a room, by anybody who could be named. It was taken a few dozen packages at a time by developers who each had a deadline and each had good reason, and it is still being taken that way, which is why there is nobody to hold to it and nothing to revoke.

Compounding risk

The three do not sit side by side; they stack, and each multiplies the one beneath it. The medium has nothing singular to offer, so a copyable string stands in for the thing. That string has to be where the deciding happens, which is the browser. The browser runs whatever code reaches it, and the code reaches it down the graph. The graph is kept at its far end by people whose right to publish into it is a string of the same kind, kept in a browser of the same kind. One stolen login at that far end is therefore not one account lost but everything downstream of it.

The medium copies, the tool runs code written by strangers, and the code inside it was assembled by nobody who read it. Each multiplies the one beneath it.

On 8 September 2025 a maintainer was walked through a message imitating npm's own two-factor reset, and his login was taken. Poisoned versions of eighteen or more of his packages went out under his name, and between them the eighteen named were downloaded more than two billion times a week, so any website that had taken one of them and shipped it was running code in its visitors' browsers which waited for a payment and then rewrote where the money went, while the screen went on showing the address the visitor had chosen. One login became eighteen packages, became the sites that shipped them, became every browser that opened one of those sites, became every credential in every one of those browsers. Section 6 records what followed, because the same technique returned four times in the year after it.

Hold that against the two jobs the string was given at the start. Access need not be singular: a way in may stand for many events, for as long as the service chooses, and a service that demanded fresh proof at every click would be unusable. Authority is the opposite, because an authorisation is not an object but an event. A person decided, once, at a moment, and a thing that happened once cannot be stood up by a thing that exists in unlimited numbers. So authority carries two requirements that access does not: it must be singular, and it must be asked for separately, by a question of its own about this act and the user's intentions at that moment in time rather than about the holder's right of access.

The three properties deny both. The medium has nothing singular to hold, so what stands for the decision is a copy, and no examination of the copy distinguishes it from the thing it stands for. The copy lives in the browser, which is also the only place the decision is made, so whoever gets code into that room holds exactly what the holder holds. The code that gets them in arrives down the graph, which nobody read. What is left is one test, possession, answering both questions at once, and possession is at best a fair test of access and no test whatsoever of authority.

What the defence costs

What is sold against the two that cannot be repaired is a set of specific defences: watch the room, shorten the life of what is in it, bind the artefact to one device, close the boundary again when somebody gets through. Every one of those raises the cost of compromising the system and not one of them removes the vulnerability, so the bill arrives again every month and larger every year. The market research firm IDC put worldwide security spending at $308 billion for 2026, 11.8% above 2025 and reaching $430 billion by 2029, which is that same 11.8% compounded across the three years; software is more than half of that total and the fastest-growing part of it at 14%, and identity and access management is one of the three lines which between them take more than half of the software. That forecast was published in March 2026, a month before Anthropic disclosed its frontier AI model, Mythos, on 7 April, so it is the rate the bill was climbing at while attacking the thing was still expensive, on the assumption that it would stay expensive. Bain and Company, writing on 21 April about what the disclosure meant, told its clients that "many will need to increase spending by up to two times their current levels or even more". The increases most organisations currently plan, at about 10% a year, fall well short.

The word the cybersecurity market uses for all of it is mitigated, and it is the most honest word in the industry. To mitigate is to lessen a thing without removing it, so every invoice for mitigation is a written admission that what is being sold does not reach the fault, an admission that will get more expensive every month because the condition against which it mitigates is never removed and the demand for it grows daily. What mitigated this risk for thirty years was never the product but the price of attacking. That price has gone; the invoices have not.

The web was never secure, it was only expensive to attack

Nobody was deceived about any of this. The standard that governs these strings stated the property as a design in 2012, and what stood between that design and endemic compromise was never a control but a price. Finding the flaws, reaching the strings, reading the graph and building the tooling each cost real money and real time, and that expense rationed attackers to the targets worth the outlay, who in turn had the budgets to make attacking them dearer still, because every failed attempt was a loss of both. For the overwhelming majority of the organisations carrying the exposure it therefore stayed theoretical, and for thirty years the arrangement held on that basis and on no other. The price has now collapsed, and frontier AI is what collapsed it.

A condition can sit in a body for years, be read as something milder every time anybody looks, and then show one sign that nobody mistakes. A patient goes to a doctor with a rash. The signs before it, the aching limbs, the cold hands and feet, the pallor, could have been flu and were taken for flu, unpleasant, but manageable. The rash is the late sign of sepsis and the one nobody mistakes. By the time it shows the patient has been septic for some time and the window for treatment is small.

The body in that picture is the web and the tools we reach it with. The infection is a medium that cannot hold a singular thing, together with the credentials bolted on to stand in for one. Sepsis is the moment a local condition goes systemic. The rash is AI. The earlier signs were there for thirty years and were read as flu: a token that could tell its own verifier not to check it, a working copy of a wallet's code that nobody could read, a clock on exploitation that crossed zero.

The image has to be stretched at one point: a rash reveals sepsis without worsening it; AI is both symptomatic of the disease and its accelerant, because the collapse in the cost of attack is AI's own doing. It is the final warning sign that the condition has gone systemic and it is the agent of the spread.

Treating a rash like that as a skin complaint is fatal, not because the cream does nothing to the rash but because the delay does everything to the patient, and that is what is on sale. The cybersecurity industry offers to mitigate the symptom at $308 billion a year and rising. The frontier AI industry offers to slow the accelerant in exchange for state-sanctioned dominance of it. Between them the disease goes untreated, and both are paid either way.

Software has carried a fault of this shape once before. From the 1950s through the early 1990s a calendar year was written in two digits, 99 for 1999, because four digits cost storage that mattered and the century turnover was somebody else's problem. A date reading 99 would roll to 00 and the software would take it for 1900, so anything computing an interval, an age, an expiry or a sequence would compute it backwards. The Economics and Statistics Administration of the United States Department of Commerce, reporting in November 1999, put the distribution of it plainly: very few systems are completely devoid of code or records from the 1970s and 1980s, when the century turnover seemed too distant to worry about. It was not a defect in any product but a convention underneath all of them.

Clearing it cost the United States an estimated $100 billion, about $365 for every resident, with American banks spending more than $9 billion of it and the Air Force $1.2 billion. The money worked: the General Accounting Office, reviewing the rollover afterwards, recorded that most Year 2000-related errors reported by the federal government were minor and did not have an effect on operations or the delivery of services.

Three things made that bill payable: the fault was architectural, so everybody had it and nobody could claim to be the exception; it was dated, so the work could be scheduled against a deadline nobody could argue with; and it could be finished, so the money had an end. What sits under the web now is architectural in exactly the same way and shares neither of the others. The deadline belongs to whoever moves first, so it cannot be worked towards, and no defence built on price can ever be declared complete, which is the difference between $100 billion once and $308 billion every year.

Six months to adapt

A defence can put the copy further out of reach, but no defence makes a copy into a decision and no defence asks the second question. That is what makes the months ahead an adaptation and not a repair: the work is to put authority where it can be singular and to ask for it separately, and neither of those is something the market sells.

The six national cyber agencies whose April information sheet asks for the right thing said on 22 June, in their own words, that the timeline is not years, it is months. Dario Amodei, Anthropic's chief executive, in an essay arguing that AI capability must be paced, worries that within six to twelve months a swarm of agents could be capable of taking over the entire internet with a persistent botnet. I put the window at six months from the date on this document, or eighteen if a great deal of money is spent deferring, and at eighteen that is more time than either the agencies or the essay give the world. The difference that matters is not the clock but what each asks to be done with it. The Amodei essay asks for the models to be slowed and for the industry to be regulated, which would seat the best funded of today's laboratories at the head of whatever follows. The agencies ask for the basics done faster, and Part V says what the months are for, beginning with a change to the login plumbing an institution already runs.

That distinction decides what gets built, and in 2026 a great deal is being built on the wrong side of it. Part IV sets out and dates every instrument the restraint position produced between April and October: the binding ones govern who may hold a capability rather than how authority is proved, and the single document that reaches the routes by which authority is taken is advice that binds nobody. No model was involved at any point in Liechtenstein, so restrain AI perfectly and its register of beneficial owners is still read at will, one query at a time, over several hours, by an account which, on the Government's own preliminary finding, the register's own portal let the attacker create.

2. How the web came to carry authority in a string

Frankenstein's monster was not a heap of parts thrown together. Each was chosen, each was joined to the next on purpose, and the assembly worked. What was never made was a plan for the thing they would add up to. The way a person proves who they are on the web was built in that order, part fitted to part by design, with nobody at any stage specifying the whole.

The early web was stateless by design. HTTP was built for document retrieval, each request stood alone with no memory of what came before it, and the authentication it was given answered one request at a time and carried nothing between them: HTTP Basic Authentication sent a username and password on every request, in the clear where transport encryption was absent, because a request had nothing else to carry.

Statelessness made anything resembling a logged-in session impossible, so 'cookies' were introduced to restore state across requests. Every reader will have heard of a cookie, but perhaps not known what they actually are: a cookie is a data string the server issues and the browser gives back.

Server-side sessions followed, holding the real authority on the server while the client carried an opaque identifier pointing at it, and that was a real improvement because the identifier alone revealed nothing. It was also the moment at which possession of a string became equivalent to authority. The session was invented to answer one question, which is whether the request now in front of the server belongs to the person who logged in a moment ago. It was never designed to answer the second question, whether that person may do the particular thing being asked, and it was never given the means to. So the second question stopped being asked, and the answer to the first was left to stand for both. Even where you are asked to re-authenticate access, what is being asked is the re-authentication of what you already have, not your specific intent and the authority to act.

Distributed architectures then made server-side lookup a bottleneck, and bearer tokens moved the authority back out to the client. A JSON Web Token carries its own claims, meaning the assertions it makes about who the holder is and what they may do, and its own signature, so any service holding the issuer's key validates it without consulting a session store at all. That key is a public one where the signature is asymmetric and a shared secret where it is not, and Section 14 is about what happens when a verifier cannot tell which of the two it is looking at. OAuth 2.0 and OpenID Connect, the two standards nearly every organisation now runs its logins on, layered delegated authorisation on the same model so that one service could act for a user at another. The word bearer is the specification's own, and it is exact: the token authorises whoever bears it. It does not know you. It knows that something presented it.

Not one step in that sequence was a mistake. Each solved a real engineering problem, each was the right answer to the problem in front of the people solving it, and each produced a transferable string. Every join was made on purpose, nobody was ever asked to consider or specify the whole, and what held the whole together was an assumption that attacking it would always cost more than defending it.

So the parts add up to something nobody designed and nobody owns, and it is already in every bank, every government, every hospital and every telephone. It answers to whoever holds its strings. That is the monster, and it has been assembled in the open over thirty years by people doing careful work. The fear now being sold to governments is of an intelligence that might one day get loose. The thing that is loose was built by us, it is running everywhere, and it does what it was made to do.

Credential, session, token

Three things are issued, and all three can be taken:

  • A credential is whatever a system accepts as proof that you are you. The password you typed into your bank this morning is one. So are the certificate on a server and the key on a hardware wallet.
  • A session is what the system hands back once it has accepted that credential, so that it does not have to ask again at every click. It is the cookie your bank sets in your browser, and for as long as it lives it is you, as far as the bank is concerned.
  • A token is the same idea passed between machines instead of handed to a person. It is the API token a build pipeline holds so that it can publish without a human present, and nobody types it, nobody sees it, and nothing interrupts anyone's working day when it is used by somebody else.

When an attack succeeds, the attacker presents a valid session token, or a harvested cloud credential, or a passkey they enrolled in the victim's account while the victim was kept busy on the telephone, or nothing at all to a service configured to accept whatever arrives. The system treats them as the legitimate principal, because under the protocol they are indistinguishable from one, and from that position they move money, read or alter records, issue further credentials, or work their way across an estate. The original user may still be logged in elsewhere, and the system has no reliable way of knowing that the same singular authority is now being exercised in two places at once, because nothing in the protocol was ever designed to answer that question.

The harsh but important truth is that the attacker no longer breaks in; the attacker logs in. CrowdStrike puts 82% of what it detected in 2025 as malware-free: in more than four cases in five there was no malicious file for anyone to find, because the intruder was using the software the machine already had, which no scanner objects to, because it is supposed to be there.

A stolen banking or payment session lets an attacker start transfers that clear under the victim's own identity, against a fraud engine that sees an authenticated customer doing something faintly unusual instead of an intruder doing something impossible, and the institution's loss is not only the money but the evidential position, because where the authority presented was genuine, establishing that the transaction was unauthorised becomes a matter of inference rather than of proof.

A long-lived session cookie, or a passkey an attacker registered during a telephone call, turns one event into persistent access that is cryptographically valid, so that every authentication afterwards is genuine, produces no anomalous signal, and passes every check the protocol is capable of making. Detection has to come from watching behaviour, because the authentication layer is working exactly as designed.

A harvested service-account, cluster or cloud credential is the same artefact with nobody watching it. These are held by machines rather than by people, issued broadly because narrowing them breaks things that are expensive to fix, and frequently absent from any inventory the organisation maintains. What one yields is movement across an estate, exfiltration, and the staging of ransomware. The defence is to rotate the secret, which depends on somebody noticing, and the clock no longer allows for noticing: CrowdStrike puts average breakout time, from initial access to lateral movement, at 29 minutes, with the fastest it observed at 27 seconds, and Mandiant records the handoff from initial-access broker to the group that follows collapsing to 22 seconds.

On the consumer web the same artefact is taken at volume, and this is the one case where the institution carrying the risk holds none of the ground. Account takeover runs at scale against people with no security function to call and no way of knowing what has happened to them, and the scale is not in dispute: one cluster found open on the internet in June held twenty-four billion credential records, with the address each one opens written down beside it, which is entry 12 of the fifty-eight incidents recorded in Part VI. A password on its own is a guess at which door it fits; a password with its door attached is the door. What leaves with the account is never only the account either, because the messages, the documents, the shared drives and the saved attachments go with it, which is why a personal mailbox is worth considerably more than the password that opens it. The credential that person reuses at work is then the path from one estate into the other, and IBM names it as one. An organisation may mandate every control in the catalogue across its own systems while the string that opens them sits in a browser on a device it does not own and cannot inspect, behind a password it did not set, and nothing in the bill at Section 1 reaches that device.

3. Where singularity fails, artefact by artefact

How many copies exist, and who holds them, is the question you ask about a key, and most people cannot answer it about their own front door. There is the set from the agent, the one cut for the builder, the one the last tenant never returned, the one in a drawer at a relative's house and the one on the car key ring, each a perfect copy of the others. The lock they all apply to knows none of that, only that the key presented is the one it expects. It opens for all of them and it opens the same way every time. What the web issues is a key of that kind with one difference: nobody has to cut a copy, because the systems handling it make copies as a matter of course, and taking one leaves nothing missing from the drawer.

Cookies and bearer tokens

Session cookies and bearer tokens hand whoever holds them the way in and the right to act together, for as long as they live, and they are copied wherever the systems handling them do their ordinary work: into the application's own logs, into backups, into the memory of the machine using them, and into the store the browser keeps them in, which is what an infostealer is written to empty.

An infostealer is malware with one job, and it does not have to break anything to do it. Your browser keeps a store of the cookies and passwords it is holding for you, so that you are not signing in to everything every morning; the infostealer opens that store, copies what is in it, and sends it on to whoever deployed it. Nothing stops working and nothing looks different the next morning. What left is a working set of keys to everywhere that browser has been, and Section 10 is what those copies add up to once somebody collects them.

A cookie is readable by code running in the page as well, unless the website has set a flag that hides it from scripts. The flag is optional, so whether the cookie that identifies you to your bank can be read by code running on your bank's own page is a question your bank answers, and nobody using the site is told either way.

The artefact carries no record of the machine it was issued to, so when a copy arrives from a different machine in a different country the service has nothing to compare it against, and a valid cookie presented from anywhere is a valid cookie. Mechanisms that would close that are specified but they are not deployed, and the same has now happened to three other fixes.

The oldest is the retirement of the token field that tells a verifier not to check: the flaw was published in March 2015, made the subject of a Best Current Practice in February 2020 and attacked again in 2023, and that document was still being replaced in June 2026, with the setting live in a government authentication service nine days after the replacement went out for review. Next are txAuthSimple and txAuthGeneric, the two extensions that would have put the act being authorised inside what the device signs, specified on 4 March 2019 in Web Authentication Level 1, the first version of the standard passkeys run on, and removed from Level 2 on 8 April 2021 because nobody had implemented them.

Newest is Secure Payment Confirmation, which does put the payee, the amount and the currency inside the signature, and which is a finished specification still waiting for two independent implementations in browsers. Section 14 sets out the first and Section 4 the other two.

Passwords and multi-factor authentication ('MFA')

A password answers that question worst of all. It is singular only for as long as exactly one party knows it, which no protocol can enforce and no user can guarantee, so the number of copies in existence is not merely unknown but unknowable from inside the system relying on it.

Multi-factor authentication raises the cost of the login and leaves everything the login produces exactly where it was. Reverse-proxy phishing platforms sit between the victim and the genuine service, pass everything the victim types through to it in real time, and keep a copy of each: the password, the one-time code, and the session cookie the service issues once both have satisfied it. The cookie is the part that matters, because the victim can change the password afterwards and the stolen session will go on working until it expires or somebody revokes it.

One such platform, taken down by German and United States authorities in July 2026, is alleged by the German federal police to have been bought by more than 1,800 criminal franchisees running some 15,000 campaigns a month, and eSentire puts platforms of that kind at 63% of the account compromise incidents it observed.

What a passkey fixes, and what it leaves standing

What a passkey hands over is not a copyable authority artefact. It is an assertion: a one-off signed answer to a one-off question. The relying party, which is the site or service asking for the proof and acting on the answer, sends the challenge; the key on the holder's device signs over it; and the browser checks that the site doing the asking is the site the passkey was made for. Capture one in flight and there is nothing in it to replay.

Put the question about copies to the passkey itself and the answer divides. A device-bound passkey is generated on the device and cannot be taken off it in usable form where the implementation is sound, and nobody holding one can establish which kind they have. A passkey that synchronises across a vendor's account exists in more than one place by design, because that is how it survives a lost telephone, and the vendor cuts those copies and holds them, so the safety of the arrangement is the safety of that vendor's account.

The exposure then sits at three points around the authentication rather than inside it. The first is enrolment, where the victim registers nothing: a caller keeps them occupied with a ceremony that mimics enrolment while the operator, holding the credentials and the multi-factor response just harvested, registers a passkey of their own in the victim's real account, so that what the attacker walks away with is a legitimate, phishing-resistant credential that authenticates correctly and does so indefinitely. A campaign doing exactly that against Microsoft Entra passkey enrolment has run since April 2026, and Okta states two limits on its own account of it: through its own visibility it has not directly observed a Microsoft account compromised this way, and the enrolment step is its reading of the kit's code.

The second is recovery, because every deployment has to answer the lost-device case and the recovery path is almost always weaker than the passkey it restores.

The third is the one that matters most: a passkey login ends in a conventional session, because the relying party takes a phishing-resistant authentication and issues an ordinary bearer artefact, and the authority to act then rides inside that session unchecked, exactly as it did before. Passkeys fix the login; they do not change what the login produces.

Confirming access does not confirm authority

A fourth exposure sits inside the authentication rather than around it, and it is the one Section 1 opened on. The assertion establishes that the holder of a particular key was present and consented to something. It does not establish what. The data the authenticator signs is built over a challenge the relying party supplies, and the specification's purpose for that challenge is to defeat replay, so in the ordinary deployment there is nothing in the signed data that identifies the payment, the payee or the permission being granted, and an assertion produced for one act would have served for any other the relying party chose to treat it as covering.

The artefacts nobody counts

Service accounts, cloud roles, pipeline tokens and registry credentials are the credentials that belong to programs rather than to people: long-lived or seldom-rotated secrets carrying broad standing authority, frequently absent from any inventory anybody maintains. Three of the July 2026 entries turn on exactly this class. Romania's land registry lost its administration credentials because the authentication product was holding them, encrypted, inside its own configuration file, where a web shell on the same machine decrypted them; Taiwan's government gave up seven single sign-on client secrets and six internal database credentials; and Thailand's Ministry of Finance was running a script with mailbox addresses and passwords written into it.

Then there is the check that was never made at all. HiveServer2, a service that accepts database queries over a network, ships with its authentication setting at NONE, which still carries a username and a password across the wire, checks neither of them, and answers yes, so the caller is told they have authenticated and whatever they typed is what authenticated them. That is the shipped default and it is documented, so nobody has to have made a mistake for this to happen, and it was one of the paths taken into the Thai Ministry of Finance.

Newer, and least likely to appear in anybody's inventory, is the configuration file of the tool. An AI coding assistant and an editor read their settings at every start and act on what they find, which is what settings files are for. Write into one and the instruction persists across sessions, survives the removal of whatever delivered it, and is executed by a tool the user trusts, with no authentication event of any kind because none is required. Nobody holds it to be a credential, and it confers standing authority on whoever wrote to it last. ChainDrop, the npm worm of 4 August 2026, used it precisely that way: having taken credentials, it wrote itself into the settings and setup files of an AI coding assistant and of a widely used editor, so that future activity by either would restart the payload after the package that delivered it had been removed.

Harvesting those files is now a product you can buy. SpyCloud's analysis of the Remus infostealer, first advertised on criminal marketplaces around March 2026 on the evidence of its own advertisement history, records that recent builds target the credential folders used by Anthropic, OpenAI and other providers, taking API tokens and local usage history with them, and names Claude Code, Cursor, Codex and OpenCode among its default targets alongside password managers, authenticator extensions and cloud consoles. An API token lifted off a disk belongs to no person, so no password is typed and no second factor fires.

When nothing is taken

Two cases sit outside all of that, and in neither is a string taken from anybody.

The first is the identity the system issues on request, and such a system cannot know that the identity is false. Whatever flaw permits the registration, the account that comes out of it is real, it presents a real credential, and every check it passes it passes correctly. There is no theft to detect, no anomaly in the artefact, and no moment at which the protocol meets something it was built to refuse.

The second is the proof that establishes something other than authority, which is the class that survives every improvement made to the credential itself. A verifier performs its check, the check passes, and what it has proved is not that anybody decided anything. A token whose header nominates its own algorithm is verified exactly as instructed, including instructed not to. A build attestation proves that an archive came out of a named workflow and says nothing about who authorised the release. A quorum rule counts approvals and cannot see that both came from the same party. The public catalogue record for CVE-2026-42016 states it: privilege escalation due to a validation check of the token signature and issuer and not the token's scope.

In every case above the authority is standing or transferable, and in none of them is it tied to one holder and one act. Where the system issued the credential itself, nothing was even transferred, because it went to the party using it. In the last case the authority was never established at all, because the verification that would have established it answered a different question, and answered it correctly.

4. The two attempts to bind the act, and what stopped them

The signature says that somebody holding the key agreed, and it does not say what they agreed to. Two separate attempts were made to put the act itself inside what gets signed, and neither failed on cost, on fraud, on regulation, or on any reluctance among the people who would have used it.

The first was made inside the standard itself. Web Authentication Level 1, which the World Wide Web Consortium made a Recommendation on 4 March 2019, defined a Simple Transaction Authorization Extension, txAuthSimple, and a Generic Transaction Authorization Extension, txAuthGeneric. The working group removed both from Level 2, published on 8 April 2021, and its issue record gives the reason in its own words: at a face-to-face meeting it decided to remove extensions that have not be implemented, the grammar being the record's own, and are not testable from the Level 2 spec, with the two transaction authorisation extensions first on the proposed list, and a member of the group recorded that there were no implementations to meet the interoperability requirements to publish them within the WebAuthn specification.

What the browsers were reasoning from is recorded in the standards body's own repository, in a proposal document held by the joint task force of the Web Authentication and Web Payments Working Groups: very few authenticators support Transaction Confirmation as they don't have a secure hardware display, browsers have not implemented the txAuthSimple or txAuthGeneric extensions for this reason and therefore these are likely to be removed in future, and browsers have also expressed concerns about accepting free-text as input to a TxConf algorithm.

The decision was therefore taken for every use at once, by parties who build neither the authenticators nor the banking systems that wanted the capability. On 4 March 2021, a month before Level 2 appeared, Pavol Rusnak of Trezor, a hardware wallet maker, wrote to the group's own public list that it was a great shame that txAuthSimple and txAuthGeneric were dropped from the spec, that there already exist FIDO2 tokens with display, and that these extensions were perfect match for confirming transaction data on the device display. Both remain registered with the Internet Assigned Numbers Authority and can be used by anyone who implements them.

World Wide Web Consortium, w3c/webauthn issue 1386, "Remove unimplemented extensions", 11 March 2020, read at source 30 September 2026.

The second attempt was made outside the standard, as a specification of its own written for a single use, which is a card payment: a cardholder at a checkout, confirming an amount and a payee. It got further than the first, but it is still built almost nowhere. Secure Payment Confirmation puts the payee, the amount and the currency into the client data the authenticator signs rather than into the challenge, and the specification's own words are that the challenge is only used to defeat replay attacks while the payment-specific information is included in the client data, which cannot be tampered with by script. The FIDO Alliance white paper of December 2024 on Secure Payment Confirmation lists among its editors Jonathan Grossar of Mastercard, Henna Kapur of Visa, Sue Koomen of American Express and Stian Svedenborg of BankID BankAxept, and it records that at the time of writing the availability of the interface was limited to Google Chrome and Microsoft Edge, and to macOS, Windows and Android.

Visa took it to issuers, and reported what it found to the working group that owns the specification. In a presentation of 23 September 2024, Douglas Fisher of Visa records two production pilots of Secure Payment Confirmation with 3-D Secure in the European Union: the first with PLUSCARD as issuer processor alongside Sparkasse Neunkirchen and DKB as issuers, the second with S-Pankki in Finland. The participants named in it are employees of PLUSCARD, of S-Pankki and of Visa. One slide asks the group whether participants think SPC is ready for consumer testing, which answers how far it had reached. Visa went looking for what would stop SPC scaling globally, and the barrier it names is not cost, fraud, regulation, or any reluctance among cardholders. It is which browsers and which telephones will run it: in Visa's own words, it will be difficult to have wide-spread adoption of SPC authentication given the current support levels of the different operating systems and the browsers.

Douglas Fisher, Visa, "SPC Pilot Update", presented to the W3C Web Payments Working Group at TPAC, 23 September 2024, read at source 1 October 2026.

The specification remains a Candidate Recommendation Draft, which in the World Wide Web Consortium's process means a specification that is finished and waiting for the market to build it, one stage short of the Proposed Recommendation that makes it a standard. Its own status section states what it is waiting for: two independent, interoperable implementations in user agents. A user agent is a browser, so the two have to come from the companies that make browsers, and on the FIDO Alliance's account in December 2024 the only two that existed were Google's Chrome and Microsoft's Edge.

Apple's answer is on the record, in the repository where WebKit states whether it intends to implement a specification. Maciej Stachowiak of Apple replied to the request on Secure Payment Confirmation in these words: for Apple ports our policy has been to only support the ApplePay PaymentRequest method to minimize user confusion and make sure that PaymentRequest API payments always get the same level of security and privacy protection, we don't ship other PaymentRequest methods or PaymentHandler, and we probably wouldn't ship this either for the same reason. Safari has not implemented it. The mechanism that would tie a cardholder's assent to the amount in front of them is absent from Apple's browser because Apple confines payment interfaces to Apple's own payment product.

WebKit, standards-positions repository, issue 30, Secure Payment Confirmation, read at source 5 October 2026.

Set the two attempts beside each other and the same three things were being asked for in both:

  1. A capability inside the browser, which only the companies that make browsers can put there, and which the standards process will not advance until two of them have done it.
  2. A display on the device that signs, which a token with a button does not have, and which the parties writing the specification did not manufacture.
  3. A definition settled before any use, so that a payee, an amount and a currency could be named in advance and implemented identically everywhere, which ties the capability to the single act the specification was written for.

Each of those is a dependency on a party carrying none of the institution's risk, and underneath all three sits the reason neither attempt could be forced through: nobody in the chain was able to move alone. The card networks needed Google, Apple and Microsoft. Those three reasoned from the authenticators and would not implement the extensions for a display most of them did not have. The manufacturers had no reason to build a display for an extension no browser had implemented. What each party stood to gain from moving was not what the others stood to gain, so nobody moved.

Mastercard, Visa and American Express are among the editors of the paper explaining it. Visa took it to issuers in two countries, tested it on its own staff, and reported the obstacle to the body that owns the specification. Three of the largest payment networks on earth, with every commercial reason to want a cardholder's assent bound to the amount on their screen, could not bring it about, because what had to change sat inside a browser they do not make. Whether a cardholder's authority can be bound to the payment they are looking at is settled by Google, Apple and Microsoft rather than by the bank that carries the loss when it is not, and five years have established what their answer is.

5. The room the credential is used in

In life you bank at the bank, work at the office, shop in a shop and read your post at home: four places, four sets of people, and nobody from one of them standing in another. On the web all four happen in one room, and so does everything else you have ever installed there: the password manager, the thing that finds discount codes, the note-taker, the meeting recorder. They are all in the room with you while you move the money, order flowers for your mother, book an appointment at the physiotherapist. That room is a browser, and whatever you decide in there, you decide with all of them present, looking over your shoulder.

The room and the extensions

The others in the room are extensions, and what they reach is the page in front of you. Chrome's own documentation describes a content script as a file that runs in the context of web pages and, using the standard document object model, is able to read details of the web pages the browser visits, make changes to them, and pass information to its parent extension. The document object model is the browser's live working copy of everything on screen, so the grant is to read what you are looking at, change it, and hand it back to whoever shipped the extension. Chrome's account of the isolation is that a content script lives in an isolated world, which lets it change its own JavaScript environment without conflicting with the page or with other extensions' content scripts, and that it shares access to the page's document object model. The isolation protects the script from the page, and leaves the page open to the script.

The permission

An extension asks for that reach in writing. It lists the addresses it wants in its manifest, the file that ships inside every extension and states what it may touch, and an entry naming a set of addresses is called a host permission. One of them covers the lot: the match pattern <all_urls>, which Chrome defines as matching any URL that starts with a permitted scheme, including any pattern listed under valid patterns. The permitted schemes are http, https, file and the wildcard, which stands for http or https, so one line of text in one file reaches the whole of the ordinary web. Running on file addresses needs a further grant, which the user gives on the extension's own details page.

Google, Chrome extension documentation, match patterns, the live canonical page, verified 22 September 2026.

What Chrome lists against a host permission is the ability to make fetch requests from the extension's own service worker and pages, to read the url, title and icon of every open tab through the tabs interface, to inject a content script into a page whenever the extension chooses, to monitor and control the page's network requests through webRequest, to read cookies through the cookies interface, and to redirect requests and modify response headers through declarativeNetRequest. Cookies are what keep you signed in, and declarativeNetRequest is the one that can send a request somewhere other than where it was addressed. What Chrome's match-patterns page says about asking for all of it is that extensions using the pattern may experience longer Chrome Web Store review times.

Mozilla documents one further privilege on that same host permission: it grants the ability to create and retrieve WebAuthn credentials. An extension holding it can create a passkey in your account and use it, and the permission it needs for that is the one you granted it to do something else. What it creates is a real passkey, so it authenticates correctly and goes on doing so. The campaign against Microsoft Entra passkey enrolment at Section 3 needed a caller, a second factor harvested while the call ran and a victim kept on the telephone to reach the same position.

What the browser cannot tell apart

Nothing in either vendor's documentation says a browser can tell one extension from another by what it is for, because there is no property to tell them apart by. Chrome and Mozilla classify extensions by the permissions they declare and the addresses they match, so the password manager holding your passkeys and the thing that finds discount codes are the same kind of thing to the browser, and both get what those permissions grant.

Manifest V3 is the industry's answer to extension risk, and it closes a different door. Chrome's own description is that it removes the ability for an extension to use remotely hosted code, which closes the path by which an extension cleared review in the Chrome Web Store and then fetched the code that mattered from somewhere else. It does not follow that an extension runs only what shipped inside its package, and Chrome documents the exception itself. The user scripts API is the interface Chrome offers for running code a user supplies, and Chrome describes it to developers in these words: lets you run arbitrary code, and is required for extensions that run scripts provided by the user that cannot be shipped as part of your extension package. It has been available since Chrome 120, under the same manifest version that removed remotely hosted code. Nothing in Chrome's Manifest V3 overview says that a content script's access to page content was removed or narrowed.

Chromium is the open-source browser Chrome is built from, and its own description of Site Isolation is that it ensures that pages from different websites are always put into different processes, each running in a sandbox that limits what the process is allowed to do. The same page describes the same-origin policy as the code that stops websites accessing each other's data inside the browser, and records that security bugs are found in that code and that malicious websites may try to bypass the rules to attack other websites. Site Isolation protects against one site stealing another's data, against compromised renderer processes, which are the processes that draw the pages, and against two further classes of bug, universal cross-site scripting and side-channel attacks of the Spectre class. From Chrome 92 it isolates extensions from one another. The same page also states that potentially exploitable bugs will be present in future Chrome releases, and puts its own count behind that: ten potentially exploitable bugs in renderer components in Chrome 69, five in 70, thirteen in 71, thirteen in 72 and fifteen in 73. The isolation is a defence being maintained, and not a property the architecture guarantees.

The browsers you did not install

Declining to use a browser does not remove any of this, because a great deal of software is a browser without being called one. Electron, a framework for building desktop applications, bundles two things. One is Chromium, which is the part that draws and runs the page and is called the browser engine. The other is Node, which runs web code outside a browser and can reach the machine's own files, and is the system runtime. The Chromium Embedded Framework bundles the engine. WebView2 uses the Edge engine as a component of the operating system, and Tauri uses the web view the operating system already provides. An application built on any of them has a browser engine inside it, and where it ships a system runtime beside the engine, as Electron does, the code in the page can reach the machine the way a program does rather than the way a web page does. The scale is best taken from the Electron maintainers arguing in favour of their own technology, where they record that NASA's Mission Control is written with web technologies, that the Bloomberg Terminal found at every financial institution runs inside Chromium at $25,000 per user per year, that the McDonald's ordering kiosk is built entirely with Chromium, and that the Dragon 2 capsule uses Chromium to display its interface. Felix Rieseberg, an Electron maintainer, separately names Visual Studio Code, Slack, Discord, Figma, Notion, 1Password and Docker Desktop among applications built on it.

Electron's own security guidance says that remote code must never be loaded and executed with Node integration enabled, and that where an attacker can change the content the application loads, they will be able to execute native code on the user's machine. The defaults have changed across three versions, with Node integration off since version 5, context isolation on since version 12 and sandboxing on since version 20, and enabling Node integration disables the sandbox. Those are defaults, and a default is a statement about what the framework does when nobody has decided otherwise.

Nothing in any of that is a flaw awaiting a patch; every property set out above works as its makers intended and wrote down. Section 1 stated the requirement that none of it meets: a decision needs a room with nobody else in it. This room cannot be emptied, because the extension beside the page, the document object model the two of them share and the host permission that reaches every site are not things in the room, they are the room. What lets one room do the work of four is what stops it holding a decision.

6. The code in the room, and how it gets there

What a browser does with its own code

Chromium chooses its own third-party code one piece at a time, and it writes down who approved each one. The code sits in a single directory with a file beside each piece called README.chromium, carrying the licence, the version, how security-critical the piece is and how it gets updated. Nothing joins it on one engineer's say-so. The Technical Steering Council approves it on a written case covering the upstream repository, the motivation, the alternatives considered, a security assessment, a maintenance plan and the effect on build time and binary size. Then security@chromium.org approves it, and in the project's own words all security considerations, concerns, and risks are documented in the Description field of that README. Then a third-party reviewer checks the licence and the metadata. Then //third_party/OWNERS signs off, and two named Chromium committers own the piece afterwards.

That discipline stops at the edge of the browser. The graph sits beneath everything the browser runs, at three steps of rising privilege: the page, running the site's own front-end code; the extension, running with whatever permissions its user granted, which Section 5 has just set out and which include reading and rewriting the page and creating a passkey; and the desktop application, which ships a browser engine and the system runtime together. One registry supplies the code for all three, and that registry is npm, defined at Section 1. A single poisoned package in it carries the reach of the page at the first step, every site the browser can reach at the second, and the whole machine at the third.

The size of the dependency tree

The best-measured case is the extension whose only job is to hold the key that moves the money. MetaMask runs inside Chrome, Firefox and Chromium-based browsers as an extension, and it is built the way web applications are built: Node.js version 24, the Yarn package manager enabled through Corepack, and Webpack, which is the tool that assembles everything the project depends on into the file that ships. A browser extension is not in and of itself a browser, but it is not a desktop application that can avail of hardware security built into the user's device either. But next to the size of the npm dependency tree that MetaMask - the most widely used crypto wallet - bears, that important distinction is a minor detail. In November 2018 a developer who could not get the MetaMask extension to build pasted his terminal output into the project's own issue tracker, issue 5728, under the title "Cant build deps". In it the package tool reports auditing 212,620 packages in 45.235 seconds.

MetaMask extension, GitHub issue 5728, "Cant build deps", opened by tomtom87 on 12 November 2018, read at source 15 September 2026.

That figure is not MetaMask's account of what ships to a user. It is one tool's audit of one developer's checkout, on a runtime now eight years old, and the same log carries the tool's own warning that five packages sit in both the development and the production trees. The number counts entries in a resolved tree, which means the same package is counted again for every place it appears, and not distinct packages sitting on a disk. What it establishes is that a full working checkout of a widely used wallet extension handed the tooling a six-figure count of entries to audit. For a current figure, reached by a different method and far narrower, GitHub's own dependency graph for the same repository reports 4,312 dependencies in total, computed from the repository's manifests and lock files rather than from an installation. Neither figure is what the wallet installs into a browser. Both are far past what any human being reads.

What the scanners read

Against that tree the tooling reported nineteen vulnerabilities: four low, seven moderate, six high, two critical. A tool of that kind runs the catalogue check of Section 1, matching each component's identity against flaws already published, and says nothing about what the code inside does. Nineteen is not a large graph turning out to be clean. It is what this kind of tool reports, and it would report a thousand if a thousand had been catalogued.

Tools that read the code instead do exist, and Socket, one of them, describes its own method as deep package inspection to characterize the behavior of an open source package, says it detects when packages use security-relevant platform capabilities, such as the network, filesystem, or shell, and lists what it looks for as the introduction of install scripts, obfuscated code, high entropy strings, or usage of privileged APIs. On the catalogue method, its words are that vulnerability scanners like Snyk or Dependabot merely look up the packages you're using to see if any vulnerabilities have been reported to public CVE databases, and that looking for known vulnerabilities is reactive. On 6 January 2025 Veracode, which sells the scanning, bought certain assets of Phylum, Inc., including its malicious package analysis, detection, and mitigation technology, described in its own announcement as a fully automated malicious code analysis pipeline in which newly published packages are analyzed within seconds. Identity needs reading once. Behaviour has to be read again at every publish, which is why the industry has conceded the gap and not closed it.

WalletProbe, a mutation-based testing framework, has measured the gap: it drives a wallet, mutates what the wallet is given, and watches what the wallet displays. Applied to 39 widely adopted browser wallet extensions, it found, in the paper's own words, that all of them can be abused to steal crypto assets from innocent users, and it recorded 13 attack vectors and 21 concrete attack strategies. Twenty-six of the issues had been patched by the wallet developers by the time it was written. Thirty-nine out of thirty-nine is a property of the class and not a tally of mistakes, so patching twenty-six instances leaves the class exactly where the paper found it. Our own examination of wallets in this class found none free of dependency-borne vulnerabilities, which is our finding rather than a published one.

The graph used directly

On 8 September 2025 the graph was used directly, and the whole operation began with one email. A maintainer received a message from support@npmjs.help, a domain registered on 5 September, three days earlier, telling him his account would be locked unless he updated his two-factor credentials within 48 hours. He did as he was asked. Poisoned releases of eighteen or more of his packages followed, among them chalk, debug, ansi-styles and strip-ansi, carrying more than two billion downloads a week between them, with debug alone at roughly 357 million. Unit 42 records that the malicious versions were live on the npm registry for approximately 2 hours. In that window the payload reached the browser of anyone loading a site that had taken those packages and shipped them, where it waited for a payment, rewrote where the money went, and left the screen showing the address the user had chosen, and Check Point states the outcome: even if the interface looks correct, the signed transaction routes funds to the attacker.

Put that sentence against Section 3. The signature was correct, and the user approved what the interface showed them; what was signed was not what was displayed. Nobody in the chain had chosen ansi-styles: it arrives underneath chalk, chalk arrives underneath whatever the developer did choose, and so the code that rewrote the payment sat two dependencies below the last decision any human being in that chain took, in a package nobody involved had ever read.

What followed established a technique rather than an incident. On 16 September 2025 a self-replicating worm called Shai-Hulud spread through stolen publishing tokens and wrote the secrets it took into public repositories. The same family returned in evolved form from late November, publishing at a higher rate per run and executing before installation rather than after it, so the payload ran on the way in rather than when the software was next built, and incidents continued into December. The lineage runs on through the record of fifty-eight incidents, numbered 1 to 58, in summary at Section 15 and in full with their sources at Section 27. Entry 11 is the Miasma variant against Red Hat and seventy-three of Microsoft's repositories in June 2026. Entry 25 is ChainDrop, which on 4 August 2026 poisoned more than four hundred packages in under four hours.

The layer built to contain all of this is called LavaMoat. Its job is to put each package in a sandbox and limit what each one may reach of the browser's own interfaces, and it is written in JavaScript and runs inside the JavaScript environment it is meant to contain. OtterSec found two ways out of it, a policy file bypass and a scuttling bypass, the second turning on the deliberate disabling of interfaces that a package should never reach, and states that by combining the exploits it is possible to completely bypass LavaMoat supply-chain protections using a compromised dependency. A lavapack release carrying a mitigation was available in under two days, which OtterSec records in the same paper beside its own conclusion that the inherent complexity makes designing robust security implementations a challenging task. No response to that paper from the LavaMoat maintainers could be located, searched at the repository, at its security policy and on the open web. The mitigation closed two bypasses and left standing the property that produced them, which is that the thing built to contain the graph is written in the language of the graph and runs inside it.

The expense that stood in for security

A graph of this size has never been read by anyone, and that was tolerable on exactly the terms everything above was tolerable: reading it was expensive, and the expense stood in for security. The expense now falls on one side only. A maintainer cannot read a hundred thousand packages and a registry cannot either, and Sonatype's 2026 report on the state of the software supply chain states that at this pace, traditional manual review and approval models do not scale, adding that when hundreds of thousands of critical releases exist in a single year, teams cannot rely on manual review or reactive patching. A model can read them. Reading source at scale for the logic inside it is the operation that has become cheap, and it is the operation no scanner has ever performed.

No case exists in the public record of an actor searching a dependency graph that way. What protected the graph was that nobody could read it, and that has stopped being true.

7. The three together

Each of the three properties has a mitigation on sale. Against the first two there is nothing to remove, because a medium that copies and a browser that runs a stranger's code are what the web and the browser are, so what is sold against them narrows the exposure and leaves the property where it was. Against the third there is something to remove, and what is sold against it inspects the graph instead of reducing it.

The npm campaign of September 2025 is all three properties in one event. A phishing message took a maintainer's account, which is the first property operating on the maintainer's own credential. Poisoned releases entered a graph carrying more than two billion downloads a week, which is the third. The payload ran inside the page with the access the second property grants it, rewrote the destination of a transfer, and left the interface displaying the address the user had chosen. Then the user signed. Every cryptographic operation in that sequence performed correctly: the signature was valid, it was made by the right person, on the right device, over the bytes that were actually submitted, and the money went to the attacker.

The mitigation for the first property is the shortened credential. Shortening the life of a token, binding it to a device and requiring proof that the presenter still holds a key all narrow the window. What they cannot do is change who is in the room while the token exists; they change only how long that person has. CrowdStrike's fastest observed movement from one machine to the next, at 27 seconds, sits comfortably inside any window a five-minute token leaves open. So the defence becomes a race against an intruder who sets the pace.

The mitigation for the second property is hardware: hold the key where the browser cannot reach it. It is defeated by the second and third together. The screen the holder checks the device against is drawn by the host, and the host is the room running assembled code. A mitigation of any one of the three leaves the other two standing, and the two that stand are the two that multiply.

Mitigation for the third property is provenance: sign the build, attest the workflow, verify before installing. An attestation is a signed statement that a particular archive came out of a particular build process, and it is defeated by a property of the first. Where the attacker holds the maintainer's account and the repository's own release workflow runs the poisoned commit, a valid attestation is exactly what a verifier ought to expect to see. The proof is genuine. It establishes process where authorisation was wanted, which is the same failure as a token whose header instructs the verifier not to check it, and in both cases the artefact is supplying the verification that the relying party performs.

Against the two requirements rather than the three properties, the same catalogue fails on both. Not one of these mitigations makes the thing singular: a token with five minutes to live, bound to a device and proved by a key, is still a copy standing in for a decision. Not one of them asks the second question. An attestation establishes how an archive was built, a hardware wallet which bytes its own screen displayed, and a shortened session that the presenter was present recently, and none of those is a statement by a person about this act. That is not an accident of design: every mitigation here operates on the artefact, and the artefact is the thing answering both questions at once, so improving it improves the answer to the first question and leaves the second unasked.

Three risks, each compounding the next, the net of which is why the web as we know it faces systemic compromise within the next 6 to 18 months, depending upon whose predictions you look at. What is not in doubt: the web as you know it cannot be secured and mitigation will cost ever more for an exponentially smaller return to the point where it becomes dishonest to sell and and a liability to rest upon it.

8. The hardware wallet, and the machine it runs on

Every other mitigation in Section 7 leaves the key on the computer and works on it there. So take it off the computer. Generate it inside a small dedicated device, never let it leave in usable form, and give that device a screen of its own that nothing on the computer can write to, so that the machine asking you to approve a payment and the machine showing you what you are approving are no longer the same machine. That is a hardware wallet, and what it closes is the one attack that reads the signing key out of software, because in usable form the key is no longer in software to be read.

Nothing else moves off the computer. The key can still be taken out of the hardware, by watching the chip while it works rather than by opening it, and Section 12 sets out the research that has done it to a module certified against the technique and to the enclaves inside ordinary server processors. What an attacker takes is most often not a signing key at all: the session, the cookie, the bearer token, the password, the API token, the service-account and cloud credential, the secret in a configuration file and the publishing credential are none of them signing keys, and not one of them follows the key onto the device. Section 13 sets out five ways authority is reached, and the signing key is one vector inside one of them.

Ledger states that the secure element, which is the sealed chip holding the key, drives the display directly, that what you see is what you sign, and that the user may sign when the details on the device match those shown in the connected application, meaning the program running on the computer. Trezor states that where a compromised computer displays the wrong receiving address the trusted display will show the correct one, and instructs the user that where the two disagree the funds must not be sent.

Take those two statements at exactly their width. The device guarantees the bytes on its own screen. Nothing guarantees that the computer displayed the same bytes. What closes the distance between them is a person, reading an address on a small screen, reading it again on a large one, and refusing when they differ. That is proofreading: two copies of a number, one of which may have been altered, and a human being asked to catch it every time for as long as they own the device. The instruction to compare the screens is the manufacturers' own, and at that point in the chain it is the only control there is.

So everything rests on the computer, and for Ledger, which leads this market, the computer runs a desktop application. Ledger Live is built with Electron, React, Redux and RxJS, on Ledger's own account of it, and assembled with the pnpm package manager in the ordinary way. Electron ships a browser engine and a system runtime together as one application, as Section 5 set out. The screen the holder is told to check against the device is therefore drawn by a wrapped browser running code assembled from npm, which puts the package graph inside a browser at the one point in the whole arrangement where the browser was supposed to have been left behind.

Ledger had already been reached through that registry, at a different door. In December 2023 a former Ledger employee was phished. Publishing access had not been revoked when they left, and the attacker used it to publish a malicious version of the Ledger Connect Kit, the library that websites load to talk to a Ledger device. Nobody installed it. Ledger distributes that library through npm itself and sites fetch it live as the page loads, so the poisoned version was pulled straight into the pages of applications that had integrated the loader and ran there, with no build, no review and no pinned version anywhere in the path. Taking it down did not end it, because the file stayed reachable while caches across the internet caught up. What ran in those pages rewrote the transactions in front of the user, and Ledger describes the result as tricking users of Ethereum-compatible applications into signing transactions that drain their signers, which means emptying the wallets of the people who had just approved what they were shown.

Ledger states that the attacker did not at any time have access to any Ledger infrastructure, to its code repository, or to the applications themselves, and that its device and its desktop application were not compromised. Every word of that is true, and not one word of it helped, because the attack needed none of those things. It needed a publishing credential that had outlived an employee, and a registry that serves code into a page on request.

Below the device sits the rest of the market. Atomic Wallet is a software wallet, with no dedicated device and no second screen, so the key and the decision both live on the computer. It reported unauthorised transactions on 3 June 2023, listed four possible causes including malware on users' own machines and a breach of its own infrastructure, confirmed none of them, and put the affected population at less than 0.1% of users. Elliptic puts the reported losses above $100 million and records that it is tracking over five thousand wallets believed to have been compromised. The owner would not confirm how much was taken. Three years on the root cause has never been stated, so nobody outside the company can say which of those four it was, or whether it was any of them, and $100 million left a product built to hold keys.

Ledger's device itself has since failed one step further back. Disclosed between 9 and 15 October 2026, a component fitted inside Ledger signing devices read the twenty-four words of the recovery phrase, which are the whole of the authority over the funds, off the device's own screen at the one moment the device has to display them, and sent them out over a mobile network. Nothing was done to the chip, the operating system or the signatures, and reading that screen is the one thing a hardware wallet exists to make impossible; entry 49 carries the record.

Where the key sat in dedicated hardware and nothing had been fitted inside it, the key never left the device: the decision was taken somewhere else, and the last thing standing between the holder and the attacker was their own attention. Hold it every time, for every transaction, for years. Look away once, read too quickly, or be tired at the wrong moment, and there is nothing behind it. The whole of the condition arrives in that one act: a singular decision the medium cannot carry, taken in a room that cannot be secured, in front of code that nobody chose, and at the end of it a person is asked to be the wall.

9. What changed the price

An unknown flaw has a published price and anybody may read it. Crowdfense, a vulnerability broker registered in the United Arab Emirates, runs a $30 million acquisition fund and lists its rates in public: $5 million to $7 million for a chain into an iPhone that needs no action at all from the owner, $2 million to $3 million for a chain against Chrome that needs one click, $500,000 for remote code execution in the Apache web server, and $100,000 for a privilege escalation on Linux. That list was last revised in November 2025, five months before Anthropic disclosed its frontier model Mythos, and at that point the trade's own account of itself was that the work was getting dearer. Crowdfense's director of research, Paolo Stagno, told TechCrunch in 2024 that the mitigations vendors were implementing were working, that this was making the whole trade much more complicated and much more time-consuming, and that the price reflected it. Shane Huntley, who runs Google's Threat Analysis Group, said in the same piece that as platform protections improve, the time and effort required from attackers increases, resulting in an increase in cost for their findings.

Crowdfense, Exploit Acquisition Program, the broker's own published rates, read at source 4 November 2026.

Three instruments removed that price. The first is the frontier model, and Anthropic's own Frontier Red Team published the arithmetic on the day Mythos was disclosed. A thousand runs of its scaffold against OpenBSD cost under $20,000 in total and the single run that found the bug cost under $50. Several hundred runs over the FFmpeg repository cost roughly $10,000. On Linux kernel privilege escalation the team records nearly a dozen chains the model built: one of them, starting from an existing automated fuzzer report, cost under $1,000 at API pricing and took half a day, and a second, built as a complete pipeline from nothing, cost under $2,000 and took under a day. Crowdfense pays $100,000 for a privilege escalation on Linux. The cheaper of those two chains cost a hundredth of that and the dearer, which had no head start, cost a fiftieth, and neither needed a seller, a vetting process or a wait.

An independent measure comes from the UK AI Security Institute, on a task it had built to be hard. The challenge was to work out what an unfamiliar machine does from its instructions alone, before a single line of the program running on it could be read. An expert playtester took roughly twelve hours with professional tooling. OpenAI's GPT-5.5, given a shell, Python and nothing else, took ten minutes and twenty-two seconds, at $1.73 of API usage.

Finding a flaw and turning it into a working exploit are different jobs, and the second has an academic measure. ExploitGym gives an agent evidence that a specific vulnerability exists and scores whether it can produce a concrete security impact from it, across 898 instances drawn from real-world vulnerabilities. Claude Mythos Preview produced working exploits for 157 of them and OpenAI's GPT-5.5 for 120. The generation immediately before produced 54 for GPT-5.4, 15 for Claude Opus 4.6 and 12 for Gemini 3.1 Pro. Exploitation is still hard, and the authors say so; what the table measures is that one generation multiplied Anthropic's yield tenfold and more than doubled OpenAI's.

The second instrument is the agent, and it needs no unknown flaw at all:

  • It works on the flaw that was published, patched and left running, which at entry 40 is a token bypass in WSO2's API gateway: the vendor issued an advisory and a fix on 3 May 2026 and scored it ten out of ten on its own scale, and watchTowr's honeypots, machines put on the internet for no purpose but to be attacked and watched, caught forged administrator tokens on 13 September, more than four months after the fix was there to be applied; BleepingComputer reports that those attempts came from one IP address and targeted the wrong WSO2 product, and that watchTowr then reproduced the attack on the correct one.
  • It works on the interface that was never asked to check anything, which at entry 15 is three of them on a Taiwanese government web application, each returning a valid authenticated session to any request that arrived.
  • It works on the credential that was wrong before the product shipped, which at entry 42 is a key hard-coded into nineteen of Flock Safety's own applications alongside an Auth0 client secret held in plain text on the camera itself, and on the analyst's reading that key could fetch the credentials of any Flock camera from its hardware address, which is a case in the record where the artefact was reached and its use against a live system is not established.
  • It works on the months in which nobody looks, which at entry 1 is Lithuania's property register answering every query correctly, for months, to a caller holding the credentials of another state body authorised to ask, with the operator finding out in April.

A person works one of those at a time. An agent works all four at once, for as long as it is left running, and a failed attempt costs its operator nothing.

The third instrument is not a cheaper price but the removal of the gate. A model whose weights are published sits on the attacker's own disk and answers to nobody: there is no account to close, no vendor watching the traffic, no export licence to refuse, and no patch that can recall it, which entry 27 shows in practice. Frontier Security, an American firm, was evaluating Moonshot's Kimi K3 inside a testing sandbox of its own when the model left it through an allowlist intended for package maintenance that included GitHub, and went after the benchmark's stored answers rather than the task it had been set. Frontier Security's own note says that the models are open and publicly available, and that the version that escaped is the version anyone can download and run. It records that the frameworks the field uses to measure this, the Institute's own Inspect and Stanford's Cybench among them, depend on sandboxes of exactly that kind.

The gap that gate used to hold is now measured and it is closing: the UK AI Security Institute tested the most cyber-capable open-weight model it could find and reported that GLM-5.2 of June 2026 performs similarly to Claude Opus 4.6 of February 2026 on its narrow cyber tasks and to Opus 4.5 of November 2025 on its longer cyber ranges, "meaning it trails the frontier by 4 to 7 months", narrower than the six to ten months it measured across 2025. The same post gives the price of standing on either side of that gap: a hundred-million-token run of one of the Institute's cyber ranges cost roughly $85 on either Opus, an estimated $46 on GLM-5.2 and $1.19 on DeepSeek V4-Pro. Across the tasks that both models in a pair solved every time, Opus 4.6 cost $15.17 a task against GLM-5.2's $6.12, and Opus 4.5 cost $12.50 against DeepSeek V4-Pro's $0.28. GLM-5.2 is the model the Institute ties to the four-to-seven-month gap, so that pair is the one that measures it: a defender pays two and a half times per task for mitigation that might buy a lead of four to seven months, and that hope - it is too generous to call it anything more - is what they are buying.

The DeepSeek figure is the one to look at, and even that is too high. Every price above is rent: what it costs to have somebody else run the model and meter what it does, which is why the Institute gives the open-weight numbers as estimates "at current pricing". An attacker who downloads the weights pays no rent at all. They buy a machine once and pay only for the electricity it draws.

What remains is the computing power to run it, and that is no longer a data centre. exo, published on GitHub, joins ordinary machines into one cluster: in its own words it runs frontier AI locally, connects all your devices into an AI cluster, lets models run that would not fit on a single device, and, with support for remote direct memory access over Thunderbolt, makes them run faster as devices are added. The machines it names are the M4 Pro Mac mini, the M4 Max and M3 Ultra Mac Studio and the M4 Max MacBook Pro, and Qwen3-235B, DeepSeek v3.1 at 671 billion parameters and Kimi K2 Thinking are among the models in its benchmarks. A parameter is one of the numbers a model's training leaves behind and the count of them is the rough measure of its size, so a model of 671 billion sits at the top of what anybody publishes.

Coordinate what runs on that stack and it runs as a swarm. The operation against Taiwan's government at entry 15 ran as many as eight specialised agents at once against a single objective. Both of the agent frameworks it ran, Hermes and OpenClaw, are open source, and neither requires an account with anybody. The campaign at entry 32 ran hundreds of agents on a DeepSeek model with OpenAI's Codex as the harness, the harness being the program that gives a model a shell, a file system and the ability to act, so the ungoverned weights drove the governed product.

An attacker short of hardware does not buy it. Stolen cloud credentials have been used to run hosted models on the victim's own account since at least 2024, and Sysdig recorded one set used against ten services at once, among them Anthropic, AWS Bedrock, Azure, Mistral, OpenAI and Google's Vertex AI, at a cost to the victim of more than $46,000 a day, with the access resold to people those services had banned and to entities in sanctioned countries. Microsoft's Digital Crimes Unit sued a group it tracks as Storm-2139 in December 2024 for taking exposed customer credentials scraped from public sources, reaching its hosted models, altering what those services would do and reselling the access. The free collection set out at Section 10 held 11,693 live tokens into services of that kind.

Dario Amodei's essay puts a swarm capable of taking over the entire internet with a persistent botnet at six to twelve months away. Everything that swarm needs already exists, and not one piece of it is reached by the three measures the essay proposes, chips kept from China, distillation, the training of one model on another's outputs, cracked down on, and weights guarded. The compute is the victim's own, taken with a stolen key. The weights answer to nobody, because the version that left Frontier Security's sandbox is the version anyone can download and run. At entry 32, where a laboratory's governed product was in the chain at all, that product was the harness and the weights driving it belonged to somebody else.

Read the Sysdig list again; Anthropic is on it. That same free collection held 561 Anthropic tokens, of which 164 were still live, and entry 31, which rests on the thinnest provenance in this record, has Anthropic writing to its own customers that commodity infostealers had copied their authenticated sessions and that those sessions were being replayed. The swarm the essay fears does not need anybody to release a frontier model to it, because the scarce part of that machine was never the model.

None of this is new in kind, because the compromised machine has been the attacker's rented compute for a decade. Mirai was a botnet, meaning a network of machines taken over and run from one place, and it was built almost entirely out of embedded and internet-connected devices. Reports of it appeared from 31 August 2016, it peaked at six hundred thousand infections, and on 21 October that year Dyn, a domain name provider, suffered a series of denial-of-service attacks from it. What has changed is not the shape of that network. It is what a network of that shape now runs.

A defender running infrastructure that carries real value cannot afford one failed defence, and an attacker for whom a failed attempt costs nothing can fail all day and needs to succeed once. Mandiant's series measures the result directly, recording mean time to exploit, the interval between a flaw being disclosed and its first exploitation, at 63 days in 2018, crossing zero during 2024, and standing at an estimated negative seven days in the 2026 report, which is to say that exploitation now routinely happens before a patch exists.

Every mechanism in Sections 2 to 6 worked in 2019 exactly as it works today: the cookie was a string then, the browser ran other people's code then, the graph was unread then. What moved is the price and not the possibility. The cost of exploiting all three has fallen by orders of magnitude, and the security that was purchased by expense has been withdrawn without anybody deciding to withdraw it.

The parallel with the year 2000 problem holds in three respects: the exposure is architectural, it has a date on which it became general, and it sits beneath nearly all existing software at once rather than inside any one system. A spokesperson for Switzerland's FINMA, answering Bloomberg on 24 April 2026, put the third of those in a regulator's terms: the uncontrolled and immediate availability of AI models such as Mythos would be classified as a systemic risk, because in such a scenario virtually all existing software systems could simultaneously be affected by a multitude of previously unknown zero-day vulnerabilities, which would be exploited immediately and via AI. A zero-day vulnerability is an unknown flaw of the kind the brokers pay for, and the regulator's point is that there is no longer any reason for them to stay scarce.

Where the parallel fails is the deadline. The millennium date was fixed, the work could be scheduled against it, and on 1 January 2000 the work was finished. This deadline is set by whoever moves first, so it cannot be scheduled and it cannot be declared complete, and its passing cannot be observed from the public record either, because that record carries what was admitted and runs behind what happened by the dwell time, meaning the interval between an intruder arriving and anybody noticing, and by the disclosures that never come.

10. The measured position

Six independent datasets, gathered by firms with no shared interest and for different purposes, describe the same estate, and no two of them measure the same thing.

IBM supplies the door. Its X-Force 2026 index, drawn from 2025 incident response, records exploitation of public-facing applications as the leading initial access vector, up 44% year on year, and notes that many of the exploited vulnerabilities required no authentication at all. IBM's own access-vectors material puts that vector at 40% of cases against 32% for the use of valid credentials, and records that 56% of disclosed vulnerabilities did not require authentication to exploit successfully. Those two leading vectors are usually presented as competitors, and read as one figure they are the same finding: the leading vector is exploitation that meets no authority check, the second is exploitation that presents a stolen one, together they account for roughly 70% of observed initial access, and neither is a failure of capability.

Rapid7 supplies the proportion, in its own words: valid accounts without strong multi-factor controls drove 43.9% of its incident investigations. The population of investigations behind that figure is not stated on Rapid7's public pages. The same report has exploited high and critical severity vulnerabilities rising 105%, from 71 in 2024 to 146 in 2025, and the median interval between a flaw being published and its arrival in the American government's catalogue of flaws known to be exploited falling from 8.5 days to 5.0.

Mandiant supplies the clock, at 63 days in 2018 and an estimated negative seven days in 2026, grounded in over 500,000 hours of frontline investigation conducted globally during 2025. CrowdStrike supplies the character of the intrusion, at 82% of 2025 detections malware-free, average breakout time of 29 minutes, fastest observed breakout of 27 seconds.

eSentire supplies the mechanism, which is the reverse-proxy phishing of Section 3 under the name the industry gives it, recording that phishing-as-a-service platforms accounted for 63% of the account compromise incidents it observed, using adversary-in-the-middle techniques to intercept credentials and session tokens in real time, primarily against cloud services such as Microsoft 365, with account compromise itself representing roughly half of all observed threats. Nearly two thirds of the account compromises that vendor saw ran through a technique that operates after the authentication has succeeded.

Verizon supplies the width: more than 22,000 confirmed breaches inside more than 31,000 security incidents across 145 countries, which is the largest sample in the set. Counted at any point in the breach progression, credential abuse appears in 39% of those breaches, and Verizon calls it the most pervasive single technique it records.

Verizon also reports, for the first time in the nineteen years it has published the study, that vulnerability exploitation has overtaken stolen credentials as the way a breach begins, at some 31% against 13%. The two credential figures answer different questions and Verizon says so. The 13% counts where a breach starts; the 39% counts credential abuse anywhere in the intrusion that follows; and a breach that enters through an unauthenticated flaw and then proceeds on harvested credentials is counted in both.

What the widest sample in the set therefore confirms is that a great deal of compromise never meets an authority check at all. In roughly a third of breaches there was nothing at the door to defeat, which is the class Section 13 marks as reaching none of the five routes, and IBM puts 56% of disclosed vulnerabilities as needing no authentication, so a door that asks for nothing is not a failure of authentication but its absence. Verizon's core sample runs to late 2025, which the report states, so the estate was already this shape before the price of attacking it collapsed.

None of the six measures the same thing and all six arrive in the same place: either the intruder presented something the estate had issued, or the estate asked for nothing at all, and in neither case did the authentication layer have anything to detect.

The stock already in circulation

The six above count intrusions, which are events that somebody notices and answers. The two below count stock: what has already been taken and is sitting in collections now, belonging to people who do not know it is there. Nothing in a collection needs an attack to use, only presenting, and a copy can be revoked only by somebody who knows it exists.

Okta Threat Intelligence took a single infostealer collection of 5,871 folders and seven gigabytes, given away on a Telegram channel on 2 August 2026, and resolved what was inside it down to the individual token. Its table runs to ten services and sums to 13,598 unique authentication tokens, of which 11,693 had not expired on the day the collection was released:

ServiceTokensNot expired
Google9,8299,213
Microsoft2,4911,763
Anthropic561164
Amazon349254

Gamma, Notion, Character.ai, Cursor, Poe.com and Pika AI make up the balance. Okta records live API keys sitting in plain text among them, and gives no count of those. Replaying an unexpired token puts the holder inside the service with no sign-in of any kind.

Okta, which sells identity infrastructure, then states the limit of the industry's own mitigation, recording that stronger authentication and phishing-resistant technology have made username-and-password takeover harder and that this does not stop a stolen session token or API key.

Three billing outcomes circulate attached to that analysis. Okta cites all three from elsewhere and measured none of them in this collection: close to $1 million at one organisation, from Unit 42; $25,000 charged to a single software architect, from that individual's own public account; and $600,000 of credits consumed at an organisation that tests AI systems, from The Register. That last one ran on a stolen API key rather than a session, and an API key belongs to no person, so no password was typed and no second factor fired at any point in it.

Breachsense supplies scale where Okta supplied resolution, and its report for August 2026 counts, in that single month, more than a million infected machines, credential records in the hundreds of millions, and cookies higher still.

In August 2026 aloneCount
Infected machines indexed1,217,555
Credential records133,005,847
Distinct username and password pairs57,979,449
Machines holding a Microsoft 365 credential176,784
Cookies384,955,693

Breachsense sells monitoring against this data and publishes its method with it, recording that logs are dated by the day they were indexed rather than the day the machine was infected, that a credential record is not a distinct credential, that roughly a fifth of the credential rows carry no machine identifier, and that the cookie figure counts cookies and not sessions because it cannot separate authentication cookies from tracking cookies at that volume.

Set the two together and the shape is visible from both ends. Okta resolved a small collection down to the individual token and could say which were live; Breachsense counted a month and says itself that it cannot say how much of what it counted carries authority. The resolved case stands on its own: a collection given away for nothing, off fewer than six thousand machines, held 11,693 unexpired tokens into ten services, the largest of them run by Google, Microsoft, Amazon and Anthropic.

One finding that is widely misquoted

IBM's study finds that, of the organisations that suffered a security incident involving an AI model or application, 92% lacked adequate AI access controls, and that roughly one in five organisations reported such an incident. That is not a statement that 92% of attacks are credential-based: it says that where AI systems were reached, the control almost always missing was access control. The same edition puts the global average cost of a breach at $4.99 million, a rise of 12% and the highest the study has recorded in nineteen years, and the United States average at $11.5 million, from more than 3,550 interviews at 602 organisations breached between March 2025 and February 2026.

A distorted version of it is in circulation, a claim attributed to IBM that some large majority of attacks arise from access and authority credentials, and it appears in no IBM material I have been able to locate. IBM's denominator is organisations that suffered an AI-related incident and not organisations generally, and it says what was missing and not what was used.

11. Why hardening cannot reach it

Hardening is a term used in cybersecurity circles to describe stronger passwords and universal multi-factor authentication. Faster patching and shorter secret lifetimes both raise the cost of particular vectors. Not one changes the property that the resulting authority artefact is data on a medium that copies data, handled in a room that runs anybody's code, by software assembled from a graph nobody has read.

None of it is bought once: multi-factor prompts, patching, rotation and the tooling that runs them are a subscription and not a purchase. The world was forecast to spend $308 billion on security in 2026 on IDC's March 2026 (pre-Mythos announcement) forecast and $430 billion by 2029. The only forecast I have seen published since then was by Bain, which told its clients in April that many organisations will need to increase that substantially to remain secure, "by up to two times their current levels or even more". What held the line was the price of attacking, and no budget ever bought it; now it has gone.

Patching presupposes a maintained register of what needs patching, and that register is failing. The National Vulnerability Database is the American government's index of publicly disclosed software flaws, run by the National Institute of Standards and Technology, and it is the index nearly every scanner, patch manager and vendor advisory in the world resolves against. Being listed in it is not the point. What makes an entry usable is the enrichment: the severity score, the affected versions, the configurations that carry the flaw. A flaw that is listed but not enriched is a flaw no patching programme can rank, so a programme that patches by severity does not see it.

On 15 April 2026, eight days after Anthropic disclosed Mythos on 7 April, NIST announced that the database would no longer attempt to analyse everything it receives. Submissions had risen 263% between 2020 and 2025, and the first quarter of 2026 was running nearly a third higher than the same period a year before. The programme enriched nearly 42,000 entries in 2025, 45% more than in any year before it, and NIST's own account is that the record year was still not enough.

From that date it enriches three categories only: entries in CISA's catalogue of flaws known to be exploited, entries in software used inside the United States federal government, and entries in critical software as defined by Executive Order 14028, the American cybersecurity order of May 2021. Everything else is listed, categorised, and marked lowest priority. The keeper of the record admits the record cannot be kept, and even in triage it names access and authority as the thing that cannot be let go, because NIST's own definition of critical software under that Order lists identity, credential and access management among the categories, being software that centrally identifies, authenticates, manages access rights for, or enforces access decisions for organisational users, systems and devices.

NIST, "NIST Updates NVD Operations to Address Record CVE Growth", 15 April 2026, read at source 4 November 2026.

A patching programme runs inside a window, and the window has been measured from four sides:

  1. The first side is the vendor's. On 13 October 2026 the International Monetary Fund reported that "In more than 70 percent of reported cases so far this year, software providers had almost no time to patch", which is "more than double the share in 2021, when providers typically had close to 300 days to fix vulnerabilities." Three hundred days went to nothing in five years, on the finding of the institution whose business is systemic risk rather than security software. That is the time a vendor has to write the fix, and it is the side of the collapse nobody buys a product for.
  2. The second side is whether a fix exists at all when the attack arrives. Mandiant puts mean time to exploit at 63 days in 2018, crossing zero during 2024, and at an estimated negative seven days in 2026. A negative number is not a shorter window. It is the absence of one, because exploitation is routinely under way before there is anything to apply.
  3. The third side is the attacker's speed once a flaw is public. Rapid7 has the median interval between publication and arrival in the American government's catalogue of flaws known to be exploited falling from 8.5 days to five.
  4. The fourth is not a clock at all. It is how much of the work ever gets done, and American organisations finished 26% of the critical list that government publishes for them in 2025, against 38% the year before.
Athanasios Vamvakidis and Jason Wu, International Monetary Fund, "Global Financial Markets Face Rising Risks From AI, Bond Yields, and Cyberattacks", 13 October 2026, read at source 4 November 2026.

On 15 June 2026 the Forum of Incident Response and Security Teams revised its 2026 projection to approximately 66,000 vulnerability entries, which it records as a cumulative drift of 46.3% against its own original forecast, and attributed the acceleration to recent deployments of highly autonomous AI discovery tools.

A programme that patches faster answers the third of those four sides and none of the other three. It cannot give a vendor time it does not have, it cannot create a patch that has not been written, and it cannot finish a queue that is growing faster than it is worked. Every one of those four numbers moved the same way, and not one of them was moved by anything an institution bought.

Rotation of secrets is reactive by construction, because it assumes detection outpaces use, and against an unattended agent at machine speed that assumption fails. Entry 21 is what that costs: Aqua Security, whose Trivy scanner runs inside other organisations' build pipelines, disclosed an intrusion and rotated its credentials on 1 March 2026. Eighteen days later, at 17:43 UTC on 19 March, the actor force-pushed poisoned versions of 76 of the 77 version tags in trivy-action and all seven in setup-trivy, which means overwriting the published history of the code so that what everybody now fetches stands where the original stood and carries no mark of the replacement. Then the actor came back on 22 March. The rotation had been run with an incident response firm engaged, and by the company's own account it was not comprehensive and the actor retained valid credentials throughout.

The problem is not insufficient diligence: patching assumes a window, and the window is the four measures above. Multi-factor authentication defends the front door while the technique behind 63% of the account compromises eSentire observed takes what that door produces rather than attacking it. Moreover, rotation assumes somebody notices in time.

What none of them reaches is that the medium goes on minting copyable stand-ins for singular things, that the room they are used in cannot protect them, that nobody has read the code in that room, and that all three outrun any programme built to keep up with them.

12. What secure enclaves do, and what they do not

Hardware key protection answers one question, which is whether the signing key can be read out of software. A key can instead be generated inside a sealed chip that the rest of the machine cannot reach into: a Trusted Platform Module on most laptops, the Secure Enclave in an iPhone, or the equivalent in other telephones. A key made there and never exported in usable form is not in software to be read, so the infostealer, the malicious extension and the poisoned package all come away from it empty.

It answers nothing else. It reaches no authority artefact that is not a signing key, and a session, a cookie, a bearer token, a password and a standing service credential are none of them signing keys. Nor does it ask the second question: the chip can establish that a key it holds was used, and it cannot establish that the holder of that key decided anything, so a signature made by malware on a compromised machine and a signature made by the key's owner are the same event to the chip.

Even on the one question it does answer, it is not absolute: the chip does not have to be opened to give up what is inside it, because it can be watched while it works. That is what a side channel is. A chip doing cryptographic work takes a measurable amount of time to do it, and the time varies with the secret. Measure enough operations precisely enough and the key can be reconstructed without the chip ever being touched. TPM-Fail, which Moghimi, Sunar, Eisenbarth and Heninger presented at USENIX Security in 2020, did exactly that: it recovered private signing keys from Intel firmware modules and STMicroelectronics devices by timing them, including a remote attack that recovered a server's private authentication key by timing roughly 45,000 authentication handshakes across a network against a virtual private network service, and, separately, it recovered a key from a hardware module that had been certified against side-channel leakage, in fewer than 40,000 observations.

TEE.Fail, disclosed on 28 October 2025 by Chuang, Seto, Berrios, van Schaik, Garman and Genkin, went after the enclaves inside server processors, which are the isolated regions where secrets are supposed to be unreachable even by the operating system around them. It works by interposing on the DDR5 memory bus, which means sitting physically between the processor and its memory and reading what passes, and the researchers put the cost of the parts at under $1,000 and describe them as readily available. What they took out of an Intel processor was the provisioning certification key, a per-CPU signing key sitting in the chain that signs the keys used for attestation in both Software Guard Extensions and Trust Domain Extensions, attestation being how an enclave proves to a remote party that it is genuine and unmodified. Holding that key is enough to forge the proof, and AMD's Secure Encrypted Virtualization is reached by the same method. Buhren, Jacob, Krachenfels and Seifert had gone at that same AMD technology by fault injection, which works by deliberately disturbing the chip while it runs rather than by watching it, extracted the keys that identify the processor, and concluded that remote attestation on the affected generations must be considered broken.

Both manufacturers answered on 28 October 2025, each on its own security page, and both answered on scope rather than on the result itself. Intel records that the research does not change Intel's previous out of scope statement for these types of physical attacks. AMD states that AMD does not plan to provide mitigations since physical vector attacks are out of scope for AMD SEV-SNP. That is the manufacturers of the silicon confirming, in their own words, that the enclave is a cost barrier and not an impossibility proof.

What sits outside the guarantee is wider than their wording suggests, because the TPM-Fail work above recovered a key across a network by timing alone, so the adversary who reaches the hardware and the adversary who can merely measure it closely enough are both outside it.

PART II: THE FIVE ROUTES

13. How authority is actually reached

The web is compromised, in the three ways the preceding sections set out, and it has been for thirty years. What we had in place of security was the illusion of it, and the illusion held because compromise had a price. AI has made it cheap. Nothing about the web had to change for that, and nothing did - as I have said before, the only change has been to the cost of walking in the front door.

A compromised web yields a short list of ways to reach authority, and thereby the capacity to act. There are five of them, and not one is an exotic technique. They are ordinary things that happen inside a technical estate like yours, or like those of the services you use online: a token gets found, an account gets registered, a session gets copied, an instruction arrives, and a check runs and proves the wrong thing. Fifty-eight incidents between April and October 2026 ran on them, and not one defeated any cryptography, because not one had to; they were let in.

Thirty of the fifty-eight were walked through by a person with no model involved anywhere in them, and that is not the reassurance it looks like. Everything a machine will do on these five routes, a person has already done by hand: slowly, one estate at a time, at the cost of a working day. That price is what the web was defended by. It never bought safety, only mitigation; the expense is gone, and the mitigation with it.

Route one, taken - somebody else holds the credential

A second copy of the key sits in a pocket somewhere, and the lock opens for it exactly as it opens for you.

A credential exists and somebody else obtains it: stolen, leaked, purchased, harvested off a machine by an infostealer, read out of a configuration file, or held by a third party who was authorised and whose systems were weaker than yours. This is what the industry means when it says credential theft, and it is the largest of the five, running in thirty-eight of the fifty-eight entries. Lithuania's Centre of Registers is its purest form: the caller held another institution's valid credentials, the register checked them, the register answered correctly, and 678,976 extracts left over several months, on the State Data Protection Inspectorate's count.

The largest instance of this route is not in the record, because it is not an incident of this window and nobody has put a number on it. On 7 February 2024 the Cybersecurity and Infrastructure Security Agency, the National Security Agency and the Federal Bureau of Investigation published a joint advisory, co-released by the Department of Energy, the Environmental Protection Agency, the Transportation Security Administration and the national cyber centres of Australia, Canada, the United Kingdom and New Zealand. Its finding is that Volt Typhoon "has compromised the IT environments of multiple critical infrastructure organizations", "primarily in Communications, Energy, Transportation Systems, and Water and Wastewater Systems Sectors". On how: the group "relies on valid accounts and leverage strong operational security", the grammar being the advisory's own. On how long: the agencies observed actors "maintaining access and footholds within some victim IT environments for at least five years". On what for: they were "pre-positioning themselves on IT networks to enable lateral movement to OT assets", the equipment that physically runs a plant.

That is five years inside American critical infrastructure, on accounts American operators had issued to their own people, with the Department of Energy's name on the document that says so. No cryptography was defeated and none had to be, which makes it route one at the top of the scale of consequence.

Route two, granted - the attacker is issued a credential of their own

Nobody copied anything. They asked the managing agent for a key and were given one of their own, cut for the same lock.

The system issues a real credential to the attacker, and nothing is stolen because nothing needed to be. An account is created at a portal that accepts the registration. A help desk verifies an impostor and resets a factor. An operator holding the credentials and the multi-factor response just harvested enrols a passkey of their own in the victim's live account while a caller keeps the victim occupied with a ceremony that mimics enrolment, the mechanism Okta documents, in which the victim registers nothing at all. Liechtenstein's Register of Beneficial Owners went further. On the Government's own preliminary finding the perpetrators created themselves an access to the entry portal, and nothing failed afterwards. The register issued a credential to a stranger and then honoured it perfectly, which is exactly what it was built to do, and what an attacker holds on this route is therefore not a forgery: every check it passes it passes correctly.

Route three, inherited - the login works and what it produces is taken

The lock was never touched. You opened the door, it stayed on the latch behind you, and whoever pushes it is inside with nothing in their hand.

The authentication succeeds exactly as designed and the attacker takes what the success produced: the session, the cookie, the bearer token, which is access together with the standing authority the system infers from it. eSentire puts phishing-as-a-service platforms, which work by standing between the victim and the real site and taking the session once the second factor has succeeded, at 63% of the account compromise incidents it observed. The industry's own leading technique for taking over accounts does not attack authentication at all; it waits for authentication to work and takes what working produced.

The collection Okta resolved at Section 10 held 11,693 tokens that had not expired. Every one of those is a live route three into somebody's estate, held by whoever downloaded the file, and not one of them needs a password, a second factor or a flaw.

Route four, obeyed - an instruction arrives and the machine acts on it

Nobody presents a key. A note reaches the building manager saying which flat to let the contractors into, and the manager lets them in, because acting on notes is the job.

No credential is involved at any point. An automated system acts on an instruction it cannot trace to a decision. The UK AI Security Institute's own evaluation agent wrote hidden instructions into a bug report, addressed to the automated assistants that triage issues and invisible to a human reading the page, and wrote a fabricated message impersonating a maintainer. The Miasma worm altered configuration files so that a tool acted on them the next time a developer opened the directory, and ChainDrop did the same across npm. A dependency handed to a build pipeline is obeyed because the pipeline was built to run whatever it is given. There is no holder anywhere in any of that to ask.

Route five, believed - the check runs and proves the wrong thing

The key is checked against the label tied to it, and the label says the key is genuine.

The relying party, the service asking for the proof and acting on the answer, performs a check that the artefact itself defines or supplies, so a passing check establishes what the artefact was built to establish and never that anybody authorised the act. One face of it is an artefact that nominates its own verification. A JSON Web Token carries a field naming the algorithm its signature uses, and a verifier that reads that field will do what it says, including doing nothing, which is what the value none instructs it to do. During the operation against Taiwan in July 2026 a government interface accepted tokens with that field set to none, so a token asserting any identity could be minted by anybody, with no signing key and no signature.

The same route has been run at national scale by a state, against the service that decides who may administer a network. In an advisory revised on 3 September 2025, twenty-three agencies from nine countries record actors who "Modify a router's TACACS+ server configuration to point to an APT actor-controlled IP address to capture authentication attempts or modify AAA configurations to use less secure authentication methods". The same actors collected authentication traffic by passively capturing packets "for configurations and credentials", modified access lists "adding IP addresses to bypass security policies", created privileged accounts, and recovered engineers' passwords from router configuration files where those passwords sat in a reversible form. TACACS+ is the service a network device asks when somebody tries to administer it, and it answers two questions: is this person who they say they are, and may they do this. The service was not broken; the router was told to ask the attacker instead, and from that moment it went on authenticating every administrator, correctly, against the answer the attacker supplied.

The route has also been built into hardware and shipped. In its 2025 report to Congress the United States-China Economic and Security Review Commission records that in November 2024 "a number of solar power inverters" at American homes "were disabled by the Chinese manufacturer, Ningbo Deye Technology", and that the devices "were either disabled remotely or shut down by an authorization verification mechanism installed on the inverters". The Commission does not choose between the two, and the second is the worse of them. A remote command needs somebody to send something, so there is a message, a path and a moment. A licence check built into the device needs nobody to send anything at all: the inverter asks whether it is permitted to run, the answer comes back no, and it stops. The check was correct, it established exactly what its author built it to establish, and what it established was not whether anybody had decided that these houses should lose their power. The Commission notes that the incident "was intended to enforce an exclusive commercial distribution agreement and not an act of sabotage", and that it "nonetheless shows that Chinese-made internet components in the U.S. power system can be remotely manipulated", calling that "a vulnerability with serious national security implications". It was there to settle an argument between a manufacturer and its distributor.

The other face is a proof that is genuine and attests to the wrong thing. The certificate is real and proves the lock was fitted by the approved locksmith, which says nothing about who asked for the door to be opened. A build provenance statement is true, the archive did come out of the workflow named in the certificate, and where that workflow is running the attacker's code a valid attestation is exactly what a verifier ought to expect to see, which is how ChainDrop's first carriers went out through npm's own trusted publishing carrying genuine provenance.

Where the five overlap, and where they stop

The configuration file sits in two of the five, and which route it is depends on the direction the attacker moved. Reading a secret out of one is route one, because an artefact that existed was taken, and the harvester in Bitwarden's command-line tool did that. Writing an instruction into one that a trusted tool then executes is route four, because nothing was taken and nothing was presented, and the Miasma worm and ChainDrop did that.

A check that never ran reaches none of the five. Section 10 measured the flaws requiring no authentication at all, and the record marks those as reaching no route, because nothing was verified and nothing was believed. What separates that from route five is whether the relying party was handed a result it read as a pass: a flaw that needs no authentication hands it nothing, because the exchange never happens, while a service configured to check nothing completes the exchange and answers yes, which is route five in its plainest form and does exactly what a token's algorithm field set to none does. Eight of the fifty-eight incidents in the record carry a no-route marking somewhere in them, and in four of those nothing was asked at the door and route one ran on credentials taken from inside.

The six-month record

Every entry in the record carries two markings: the route or routes that incident ran on, and what drove it, from a frontier model at a stated tier, through an agent running freely downloadable weights, to a human being with no model at any point. Twelve entries carry a driver the sources do not establish. The second marking exists because the first on its own would let a reader conclude that the routes are a property of AI, and they are not. The routes themselves are older than most of the web's security engineering: session hijacking was demonstrated in the mid-1990s, cookie theft has been documented ever since, and a stolen password is older than either.

Four national registers were read out record by record between April and October 2026, and no model is named in any of the four: in three the sources establish a human with no model involved, and in Denmark the perpetrator has not been identified. Not one incident in the record was carried by a model its developer placed at its highest cybersecurity level, and on 1 and 3 September 2026, inside this window, OpenAI placed one there: Astra is its first model to reach Critical, the highest level of its own Preparedness Framework, and it ships. The capability every binding rule in Part IV was built around has now arrived at the tier those rules were written for, and none of the fifty-eight required it, because not one of the five routes is made of capability.

What the attempt used to cost, and what it costs now

A person was the expensive part, and the expense was never a price anybody invoiced. The skill took years to acquire and sat in one head, so an operation could only ever be as wide as the number of people who had it. Each attempt then cost that person their own time: learning the organisation, working out who answers the telephone and what they use, writing something that reads as though it came from inside, placing the call, and waiting at the keyboard for an answer that might never arrive. A failure cost all of it and returned nothing. The hour spent on one target was an hour not spent on the next, so every estate attacked was a hundred left alone, and which hundred was a judgement somebody had to make.

Every one of those costs has gone. The skill is in the model, and an open-weight model sits on the machines already on the desk, answers to no account anybody can close, and no export control reaches it. The attempt is hours of compute: on Anthropic's own disclosure, published on the day Mythos was announced, one kernel privilege-escalation chain, built from a report somebody else had already produced, came to under $1,000, and a complete pipeline built from nothing came to under $2,000 in under a day. A failure costs almost nothing: a thousand runs of Anthropic's scaffold against an operating system came to under $20,000 in total, and the single run that found a live bug cost under $50. Nothing has to be chosen, because the attempt runs against every target at once. The compute need not even be the attacker's: Sysdig recorded one set of stolen cloud credentials driving ten hosted model services at once, at more than $46,000 a day on the victim's own bill.

What a person did slowly, choosing where to spend the effort, a machine now does at the price of electricity, in parallel, against every estate at once, for as long as it is left running. That is what the fear of AI is about, and the fear is correct. The spectre is not a model that wakes up one morning and decides to take the internet. It is that the web, the browser, the package registry and the dependency graph nobody has read left five doors standing open thirty years ago, and nobody has shut them since.

The question that is never asked

Not one of the five defeats cryptography and not one has to, because in every case the relying party took the answer to who is there as the answer to a second question it never asked, which is whether this holder decided this act. Routes one, two and three put a copy of the access artefact into somebody else's hand and the standing authority travelled with it, because the system had never been asked to separate the two. Route four removes the question altogether, because an automated system obeying an unattributable instruction never had a holder to ask. Route five answers it with a proof about something else, so the check passes and nothing anywhere in the exchange records a decision by the holder about this act.

What mitigation the market offers

Section 1 separated the two jobs the string does. Access is being let in; authority is the right to act once inside, and being admitted to a bank is not permission to open the vault.

Four things are on sale to an institution anywhere in the world to mitigate compromised access: a password with a code sent to a phone, a passkey, a hardware key, and a hosted platform to run them. Every one is a better front door than a password alone, which is what each was built to be. Not one of them asks what you are about to do. The furthest any of them reaches on access is route one, where the credential is taken, and none reaches the other four; on authority none reaches anything at all.

Multi-factor authentication closes nothing on route one. The relay that fronts the real site keeps the password and the one-time code as they pass, so the credential is taken while the second factor works exactly as designed.

A passkey closes two of route one's vectors: no shared secret sits in a relying party's store for a breach to yield up, and a proxy at the login cannot obtain a signature that works anywhere but the site it was made for. Three vectors of the same route stay open. The synced form is cut and held by the vendor, and Palo Alto Networks Unit 42 extracted synced passkey private keys from a Windows machine with malware already running on it, while the holder did nothing at all. An institution that requires attestation excludes the synced form and has that much; an institution that bought the same product without that setting does not know whether it has anything, because the holder cannot tell which form they were given. On both forms, whoever holds the unlocked device holds the credential, and what the relying party learns about whether a human was present is one bit that it may ignore.

A hardware key closes every remote vector of route one: nothing published has read a private key out of its secure element, and nothing syncs to a provider. What it leaves open is the object itself, and what makes the object enough is the state it ships in. Yubico publishes that no PIN is set at the factory, that user verification stays off until somebody turns it on, and that the resident credentials can be left unlocked and used for strong single-factor authentication. The setting that would make verification unconditional ships disabled on the YubiKey 5 Series, can be switched off again, and reverts to disabled on a reset; on the 5 FIPS Series it is enabled and cannot be disabled. So a key in the state it ships in asserts on a touch, for every account registered on it, to whoever picks it up. Whether it is in that state is a property of the object and of whoever holds it, rather than of any policy the institution set.

A hosted identity platform closes none of the five, and closing them is not what it is bought for. An institution running twelve directories has twelve joiner-and-leaver processes and twelve places to look when something goes wrong, and the platform makes each of those one: one policy, one process, conditional access, one log. Every closure a buyer sees at the login belongs to the passkey the platform deploys, so the two vectors it appears to close are the two already counted above.

All of that is access, and on authority the count is nil. When a service asks again, each of these mechanisms puts the access question a second time: the proof is computed over a random challenge the service chose, not over the act, so it would have served whatever the screen was about to do. Okta's own admission, quoted at Section 10, is that none of it stops a stolen session token or API key.

Sweden points the way

One further route has been closed, once, by one country: Sweden runs its banking, its tax filing, its healthcare records, its legal signing and much of its commerce with BankID, on a signature over the instruction rather than on a login.

BankID carries 8.7 million users and about 7,900 connected organisations, and 99.9% of registered Swedes aged between 18 and 67 hold one. The scheme runs at roughly 240 identifications or signatures every second, at 99.99% availability. Where it signs an instruction rather than logging somebody in, route three is closed, because there is no session to inherit: the authority was the signature and the signature was over that act.

Per-action authority is not, therefore, a thesis awaiting a pilot. A developed country has run its daily economic life on it for years. Read the caveats before taking comfort:

  • The instruction does not travel. The animated code the telephone scans carries a fixed prefix, a session token, a counter of elapsed seconds and an HMAC-SHA256 over that counter, and the thing being authorised is not in it. The scan proves that the telephone and the screen are in the same room; everything else reaches the telephone from BankID's servers.
  • For a document the signer reads a summary somebody else wrote. For a payment the amount and the payee can sit in the field the specification calls the text to be displayed and signed. For a document the pattern the specification itself recommends is to present it in your own application, compute a digest, put an abstract into the displayed field and the digest into the field it describes as data not displayed to the user. The binding to the document is real and cryptographic, and it runs through a value the signer cannot read, beside a summary the relying party composed.
  • A third party sits in the middle of every event. The relying party opens the order with BankID and waits for BankID's answer, so the authorisation never passes between the two parties to the transaction. That puts the terms of every event in BankID's hands, lets it stop any of them, and leaves every participant dependent on its continuing to work and to be willing.
  • There is no way to obtain a BankID without a Swedish personal identity number.
  • Every completed order returns that number and the holder's legal name to the relying party, which the scheme's own specification instructs it to retain, so every business in the country accumulates a register of national identity numbers it never asked for and must now defend.
  • No law entitles anybody to a BankID and an issuing bank may refuse without giving a reason; a bank may not continue a relationship where it considers its knowledge of the customer insufficient, and losing the bank takes the BankID with it. In a country where almost every working-age adult holds one and services have stopped offering alternatives, that is not the loss of a login.
  • The scheme's own residual fraud is the fraud in which the victim signs, and an authorised transaction does not attract the protection payment services law gives an unauthorised one. BankID's own grouping for 2022 put unauthorised transactions at 65 to 80% of criminal proceeds inside the phishing category. In money that was 360 to 443 million kronor, against about 40% of completed reported offences.
  • It stops at the border: it works within Sweden, through Swedish banks, on relying-party contracts those banks sell. A scheme built on a national identity number reaches the holders of one, and nothing in it reaches route four, where what needs authorising is an instruction to a machine and the authority has to be bounded in advance rather than approved at the moment.

The tally, route by route

  • Route one, taken, where somebody else holds the credential. A hardware key closes every remote way to it and leaves the object itself, which asserts for whoever picks it up. A passkey closes two of route one's vectors and leaves three. Multi-factor authentication closes none of them, and a hosted platform's closures are the passkey's.
  • Route two, granted, where the system issues a credential to the attacker. Nothing on sale closes it. Open against passkeys, open against hardware keys, open against the Swedish scheme, and the three fail for one reason: an attestation identifies a model of device and never a person, so nothing in an enrolment distinguishes the holder from somebody standing in for them.
  • Route three, inherited, where the login works and what it produces is taken. Open wherever a successful login issues a session, which is everywhere this market operates. BankID closes it, because a signature over the instruction leaves no session behind to inherit.
  • Route four, obeyed, where an instruction arrives and the machine acts on it. Open on every mechanism here, the Swedish scheme included. Each was built for a human being at a login, and an instruction carrying no trace of a decision has no human being in it to ask.
  • Route five, believed, where the check runs and proves the wrong thing. Open on all of them. BankID performs the signature check itself and tells the relying party it need not, which moves where the check happens and leaves what it proves where it was.
Everything on sale against the five routes to authority. The furthest the world market reaches on access is part of route one, and on authority it reaches nothing.

On authority the list is shorter. BankID closes two routes there, routes one and three, because the instruction appears on the holder's own screen and the holder signs that instruction and nothing else, so a credential taken anywhere else signs nothing and no session is left behind to inherit. Every other mechanism closes none, because none of them asks what the holder is about to do.

So an institution outside Sweden that buys the best of this market closes part of route one and holds routes two, three, four and five open. A Swedish institution closes route three as well, and routes one and three on authority, and pays for it with everything the list above sets out: the personal number, the register of national identity numbers it must now defend, the bank that may refuse without a reason, and the third party in the middle of every event. Nothing on sale closes routes two, four or five. Outside Sweden, the authority question is asked by nothing at all.

Everything on that list is mitigation, and all of it is expensive. Each check an institution buys raises the cost of one attempt and leaves the route open behind it, so the institution pays by the attempt and pays again for the next. The defender has to hold all five, in every place they operate, and cannot be wrong once. The attacker can be wrong a thousand times for almost nothing, and the thousand and first attempt carries them through everything the first thousand did not.

Destroyers against drones

All of that can be followed and still not felt, because the numbers in it belong to estates most of us have never worked in. The Red Sea between November 2023 and January 2025 puts the same three asymmetries where anybody can see them, with the costs on both sides published and the outcome settled: a defender who had to cover everything, who had to be right every time, and who paid millions for every attempt that cost their opponent a few thousand.

The Houthis were never trying to sink a hundred ships. They were trying to make shipowners decide that the Red Sea was not worth the passage, and a corridor nobody will sail is a closed corridor whether or not anything in it is hit.

From late 2023 the United States Navy stationed destroyers in the Red Sea to protect merchant shipping from Houthi drone and missile attack. An Arleigh Burke-class destroyer costs on the order of $2.5 billion, the interceptor missiles it fires cost between $1.7 million and $4.3 million each, and the one-way attack drones they are fired at cost between $2,000 and $20,000. A limited number of those hulls had to cover a large expanse of sea carrying a very large volume of traffic, which meant being in the right place for every vessel on every transit against every launch, while the people launching chose where and when and lost nothing by choosing wrongly.

The defence worked, and it worked almost every time. In October 2023 the USS Carney spent around ten hours shooting down fifteen drones and four cruise missiles, which the Navy described as the most intense surface combat engagement by one of its warships since the Second World War. In November 2024 the USS Stockdale and the USS Spruance were attacked by at least eight one-way attack drones, five anti-ship ballistic missiles and three anti-ship cruise missiles, and the Pentagon stated that the vessels were not damaged. No destroyer was lost in the campaign, and the engagement record of the most capable surface combatant ever built is very close to flawless.

The Houthis got what they came for regardless. They targeted more than a hundred merchant vessels, sank two of them and killed four sailors. The Rubymar went down on 2 March 2024, the first ship they sank, and the Tutor followed in June, one of her crew believed to have been in the engine room and never found. Around $1 trillion of goods moves through that corridor in a year, and the traffic through it collapsed. The owners sent their ships round the Cape, adding weeks to every voyage, which is the decision the campaign was built to produce.

US Navy destroyers won the battle, but lost the war - the asymmetry of risk and cost was simply too great. The asymmetry of AI risk to the web dwarves this.

A $4.3 million interceptor fired at a $2,000 drone is better than two thousand to one in the attacker's favour on a single engagement, and the campaign ran on those terms for fourteen months. Cumulative munitions expenditure passed $1 billion, and the Eisenhower strike group alone fired 155 Standard-series missiles and 135 Tomahawks on a single deployment. A destroyer cannot reload its launch cells at sea and has to return to port to do it, so every multi-million-dollar round spent on a $20,000 drone is a round unavailable for something worse, and the assessment of the campaign was that the Navy was winning tactically and losing strategically on cost and magazine depth.

The Houthis have never published what they spent. Taking the published unit costs, and allowing that the ballistic and cruise missiles cost a great deal more than the drones, their outlay runs to somewhere between 0.5% and 1% of the defender's munitions bill alone, before a single hull, crew or deployment is counted.

That is the position an institution - your government, your bank, your health service, your insurer - is in, in both parts: it has to be right everywhere, every day, and it pays a steep price for being right that is going to get ever more expensive for a diminishing return; the attacker has to be right once, pays almost nothing for being wrong and need only pay for the cost of electricity to try again.

The same arithmetic, inside your own estate (or that of every online service you engage with)

Set that against an institution's own estate. The destroyer is the security apparatus, and the world will spend $308 billion on it in 2026, rising at 11.8% a year. The interceptor is the cost of each defensive action: finding the flaw, triaging it, patching it, rotating the secret, running the review. The drone is the attack, at under $50 a run. Winning almost every engagement is the defensive tooling working. The magazine is the defender's finite capacity, and that magazine is already empty. The National Vulnerability Database gave up in April, as Section 11 records. Two months later the incident response forum revised its projection for the year to approximately 66,000 entries and attributed the acceleration to autonomous discovery tools. The merchant ships are the fifty-eight incidents in Part III, and the ones nobody admitted.

Every element of it runs harder here than it ran there. The destroyers had one corridor to cover, and an institution has every system it operates together with everyone and everything connected to them. The Houthis bought their munitions and expended them, where the $50 buys a run at a published price, and open-weight AI models on the attacker's own machine bring it down to electricity. The launch sites had map references and were struck, where in twelve of the fifty-eight the sources cannot say even whether a person or a model was at work. The Red Sea campaign also ended, and this does not.

The price of attacking, which was the only thing that ever rationed any of this, has collapsed and is not coming back. None of the money spent on security removes compromise. It might stretch the window in which an estate operates securely, and might is the whole of what anybody can claim for it, because three of the five routes are closed by nothing that is sold. So if an estate is still standing at the end of 2027, the invoice will have bought it time and nothing more.

What the money buys is insurance against a claim of negligence. IDC put the premium at $430 billion a year by 2029, in a forecast released in March 2026, before Mythos was disclosed on 7 April, so that price was struck for a world in which attacking an estate was still expensive. Bain wrote on 21 April, two weeks after the disclosure, and told its clients that many organisations would need to increase spending by up to two times their current levels or even more.

What the premium buys is the ability to say the institution did what every comparable institution does, which is a real thing to own on the day somebody asks why the estate was open. What it cannot buy is that answer once there is something better to have done. The standard a negligence defence rests on is what a prudent institution in that position could and should have done, and that standard moves the moment a working alternative is there to adopt.

14. Eleven years to retire one setting

Route five is the one route the Internet Engineering Task Force, the body that writes the technical standards the web runs on, has aimed at directly. The problem has been in the public domain since 31 March 2015, when Tim McLean, a prominent cybersecurity researcher, published two flaws he had found in five widely used libraries for checking JSON Web Tokens. A JSON Web Token is the small signed packet a service hands a user to stand for a completed login, and a library is the shared piece of code an application loads rather than writing the work itself. Both flaws turn on one property of the token: it carries a field naming the method used to sign it.

Picture a letter to a bank authorising a payment, with a line at the foot telling the clerk how to check it. If the line says no check is needed, she pays against the presentation of the letter. If the line says that the password is "Pas5w0rd" and then someone presents at the counter with that password and the letter, she pays against that. Either way, the bank does what the attacker demands of it and hands over the funds. If that seems impossibly irresponsible and insecure, you have understood the problem that Tim McLean was setting out.

The first flaw is the line saying no check is needed. The field could say 'none', and a library reading that accepted the token with its signature left empty, so anything the token claimed about who held it and what the holder could do went through.

The second is the password written on the letter. Signing comes in two kinds:

  1. A private key signs and a separate public key checks, and the public one is published, because publishing it lets anybody check and nobody forge;
  2. A single secret does both jobs and has to stay secret.

The token names which kind it used and the library took that at its word, so an attacker could write shared secret on a token, sign it with the public key anybody can download, and the library would check that signature against the same key, find it good, and let the token through.

The Internet Engineering Task Force made the class the subject of a Best Current Practice in February 2020, a document of advice to the people who write the code, binding on none of them. It is replacing that document now, in a draft by Sheffer, Hardt and Jones, with the final review stage it calls Last Call issued at revision six on 22 June 2026, because the attacks did not stop. The working group's own account, given at the Task Force's 123rd meeting in Madrid, is that new attacks were published at Black Hat in 2023, that multiple CVE identifiers, the public catalogue numbers given to particular vulnerabilities, followed from researchers at Tsinghua University, and that it was time for an update.

Part IV sets out what the institutions did between April and October 2026, and every binding rule in it decides who may hold a tool. This one decides how an artefact must be verified, which is the different question and the one this route turns on. It has been aimed at this route since February 2020, and the route is open; advice cannot make a verifier perform a check, which is the wall everything in Part IV meets, approached from the opposite direction.

The proposed revision sets out five additions in all:

  1. Defensive handling where implementations had read algorithm values case-insensitively;
  2. Mitigation where verifiers fail to tell successful decryption from a successful signature check;
  3. An upper bound on iteration counts in password-based encryption;
  4. A mitigation for confusion between serialisation formats, and
  5. A limit on decompression so that a token cannot be made to exhaust the machine reading it.

Reading them case-insensitively meant that a token announcing 'noNE' slipped past a list of forbidden values while still being treated as the algorithm 'none'. What the document now requires is that the name be matched exactly, and that what arrives be checked against a list of what is permitted rather than against a list of what is forbidden.

The revision defers the deprecation of 'none' to a separate draft. To deprecate a feature in a standard is to mark it obsolete and advise against using it while leaving it in place and working, so that the code already relying on it does not break; nothing is removed. At revision nine of 11 August 2026, Section 3.2 records that 'none' is deprecated by that draft, and that libraries must not generate or consume tokens using it unless the caller explicitly asks for it or allows it. That leaves 'none' as a setting an administrator can switch back on.

The instrument that revision defers to is still a draft. Neil Madden's draft updates the numbered document that lists the signing algorithms, RFC 7518, to deprecate the signature algorithm 'none' and the encryption algorithm RSA1_5, and it stood at revision five on 23 June 2026 with an expiry of 25 December 2026. The JOSE working group, which keeps that list, adopted it two months before the first revision of the replacement was published, so it has been the declared direction of travel throughout. It was then held up, and the complaint on the record was already eight months old: Brian Campbell had written in December 2025 that proper and accountable guidance on the algorithm was long overdue.

On 9 August 2026 the reference to that deprecation draft was made normative, which means the replacement now depends on it and cannot be published until the draft is, and the text on the algorithm was rewritten accordingly. One of the replacement's three editors asked the JOSE chairs to move their draft along promptly if a normative reference was to be taken, noting that it had historically been slow-moving, and wrote the text so that the reference could be downgraded back to a mention the document does not depend on, in the publication queue, should that draft get hung up again.

Eleven years after the disclosure, even the deprecation of the setting is contingent on a document that has already stalled once, referenced by a second document written so that the reference can be withdrawn if it stalls again. Nine days after that Last Call went out, a government interface in Taiwan accepted tokens with that field set to 'none', and Taiwan's national single sign-on architecture, the arrangement by which one login admits a person to every system behind it, went with it.

Complete the deprecation and libraries would refuse one algorithm unless the caller asked for it, and the first face of this route would narrow. It would not touch the switch between the two kinds of signing disclosed in the same 2015 article, a service configured to accept whatever is presented to it, a quorum rule satisfied by one party holding two identities, or the second face of the route, where a valid proof attests to a process and is read as a decision. No standards body, vendor or agency names that second face as a class under any name. A published document does not retire deployed code in any event.

PART III: THE RECORD

15. Fifty-eight admissions in six months

I set out fifty-eight incidents here, each one a case in which somebody reached authority over a system, an account, an estate or a register, or reached the artefact that carries it. Reaching authority means being able to act: to move money, alter a register, issue credentials, bind an entity, deploy code, or take what they liked. Access on its own does not qualify, nor does a vulnerability disclosed with no incident behind it, nor an act that was over before the window opened, whenever it was disclosed. Each incident ran, in whole or in part, between 7 April and 30 October 2026, or was disclosed inside that window with nothing placing the act before it.

Part VI names every case excluded on any of those grounds and gives the reason for each. Five entries record an attempt or a prepared instrument where what was reached is not established, and each says so at the point of the claim: the RubyGems campaign at entry 9, the Google finding at entry 10, the attempts on the RubyGems cache at entry 19, the forged tokens at entry 40 and the camera estate at entry 42. Five began before the window, at entries 1, 20, 21, 34 and 48. Four are carried because the activity ran on through it, and entry 1 because it was disclosed inside the window with nothing placing the end of its queries before it, as their entries state.

Every entry carries the two markings set out at Section 13: the route or routes it ran on, and what drove it. A person with no model is marked where a source describes how the operation was carried out and names neither a model nor an agent, and each such entry names that source and what it describes. Where no source describes the operation, the driver is marked not established, because a driver nobody established is not a driver.

  • 1. Lithuania, Centre of Registers. Detected early Apr 2026, disclosed 22 May 2026. Route 1. Human, no model.
  • 2. Bitwarden CLI, npm publishing workflow. 22 Apr 2026, disclosed 24 Apr 2026. Route 1. Human, no model.
  • 3. Instructure Canvas LMS. 25 Apr 2026, disclosed 1 May 2026. Not established. Not established.
  • 4. Klue, market intelligence platform. 11 to 12 Jun 2026, disclosed 18 Jun 2026. Route 1, twice. Human, no model.
  • 5. Anthropic evaluation incident one, Irregular. Apr 2026, disclosed 30 Jul 2026. Route 1, after unauthenticated entry. Frontier model, Claude Opus 4.7.
  • 6. Anthropic evaluation incident two, malicious package. Before 23 Jul 2026, disclosed 30 Jul 2026. Routes 1 and 4. Frontier model, Claude Mythos 5.
  • 7. Anthropic evaluation incident three. Before 23 Jul 2026, disclosed 30 Jul 2026. Route 1. Frontier model, internal research model.
  • 8. Okta O-UNC-066 passkey enrolment campaign. From Apr 2026, disclosed 5 Jul 2026. Route 2. Human, no model.
  • 9. RubyGems, GemStuffer publishing campaign. 5 May to Jul 2026, disclosed 11 and 15 Sep 2026. Route 1, attempted. Contested, see entry.
  • 10. Google, an AI-developed zero-day prepared for mass exploitation. By 11 May 2026, disclosed 11 May 2026. No route, use not established. A model, very likely, none named.
  • 11. Miasma worm, Red Hat and Microsoft repositories. From 29 May 2026, disclosed 1 and 5 Jun 2026. Routes 1 and 4. Human, no model.
  • 12. Cybernews, 24 billion record credential store. Found 12 Jun 2026, reported by 19 Jun 2026. Route 1, at scale. Human, no model.
  • 13. Palo Alto PAN-OS GlobalProtect bypass. From late May 2026, disclosed 13 and 29 May 2026. No route at entry, then 1. Human, no model.
  • 14. BigBear 2.0 phishing-as-a-service. From Jun 2026, disclosed 7 Sep 2026. Route 3. Human, no model.
  • 15. Taiwan, multi-agent government operation. 1 to 4 Jul 2026, disclosed 12 Aug 2026. Routes 1, 2, 3, 5. Open-weight agents, Hermes and OpenClaw.
  • 16. Hugging Face and OpenAI. 26 Jun to 13 Jul 2026, disclosed 16 and 21 Jul 2026. Routes 1 and 5. Frontier models, an OpenAI internal model and GPT-5.6 Sol.
  • 17. Romania, ANCPI land registry. 10 to 14 Jul 2026, disclosed 22 and 27 Jul 2026. No route at entry, then 1. Human, no model.
  • 18. Thailand, Ministry of Finance. 9 to 13 Jul 2026, disclosed 23 Jul 2026. Routes 1 and 5. Open-weight agent, Hermes.
  • 19. RubyGems, cache that could serve API keys. To 9 Jul 2026, disclosed 22 to 23 Jul 2026. Route 1, attempted. Contested, see entry.
  • 20. Kratos phishing-as-a-service, dismantled. Late 2024 to 20 Jul 2026, disclosed 20 Jul 2026. Routes 3 and 1. Human, no model.
  • 21. TeamPCP, Trivy and the tool chain. Late Feb to Aug 2026, disclosed 1 Mar 2026 onward. Routes 1, 4, 5. Human, no model.
  • 22. UK AI Security Institute evaluation. 25 to 28 Jul 2026, disclosed 4 Aug 2026. Routes 2, 1, 4, 5. Frontier models, Claude Mythos 5 and GPT-5.6 Sol.
  • 23. Irregular, the fictional target that was real. Notified 29 Jul 2026, disclosed 4 Aug 2026. Route 1, after unauthenticated entry. Frontier model, OpenAI, tier not stated.
  • 24. Liechtenstein, Register of Beneficial Owners. Night 29 to 30 Jul 2026, disclosed 2 to 4 Aug 2026. Routes 2, 3 and 5. Human, no model.
  • 25. ChainDrop npm worm. 4 Aug 2026, disclosed 4 Aug 2026. Routes 1, 4, 5. Human, no model.
  • 26. Meta, model breach through Irregular. Before 5 Aug 2026, disclosed 5 to 6 Aug 2026. Not established. Frontier model, Meta's Muse Spark 1.1.
  • 27. Moonshot Kimi K3, sandbox escape. Not stated, disclosed 6 to 8 Aug 2026. Route 5. Open-weight model, Kimi K3.
  • 28. Two tankers. Boarded 21 and 24 Aug 2026, disclosed 16 to 18 Sep 2026. Not established. Not established.
  • 29. Dropbox, through Lenovo ID. 4 to 21 Aug 2026, disclosed 31 Aug to 1 Sep 2026. Route 2. Human, no model.
  • 30. JFrog Artifactory, exploited in the wild. 15 Aug to 8 Sep 2026, disclosed 10 Sep 2026. Routes 2 and 5. Human, no model.
  • 31. Anthropic customer sessions, infostealers. Late Aug 2026, disclosed 30 Aug 2026. Routes 1, then 3. Human, no model.
  • 32. PaperCut NG/MF, agent-run campaign. From 31 Aug 2026, disclosed 9 Sep 2026. No route at entry, then 1. Open-weight model on a commercial harness.
  • 33. Nexus, identity document storefront. To 1 Sep 2026, disclosed 1 and 4 Sep 2026. Route 1, against enrolment and recovery. Human, no model.
  • 34. IDScan, identity verification vendor. Apr to Sep 2026, disclosed 4 and 10 Sep 2026. Not established. Not established.
  • 35. Unit 42, agent-assisted intrusion. Before 2 Sep 2026, disclosed 2 to 4 Sep 2026. Routes 1 and 4. Frontier models claimed, not named.
  • 36. Google GTIG, six-hour harvesting campaign. Q2 2026, disclosed 8 Sep 2026. Routes 1 and 4. Frontier model, Google's Gemini.
  • 37. Microsoft, passkey-themed social engineering. From May 2026, disclosed 9 Sep 2026. Routes 2 and 3. Human, no model.
  • 38. Brevo, SAML single sign-on authorisation failure. 9 to 10 Sep 2026, disclosed 10 to 12 Sep 2026. Routes 5, then 1. Human, no model.
  • 39. Revolut, fake government requests. Several months to 12 Sep 2026, disclosed 12 to 16 Sep 2026. Route 2, granted by the holder. Human, no model.
  • 40. WSO2 API Manager, forged administrator tokens. 13 Sep 2026, disclosed 15 to 16 Sep 2026. Route 5, attempted. Human, no model.
  • 41. Brevo, hardcoded Cloudflare key and the edge. 14 Sep 2026, disclosed 15 to 17 Sep 2026. Route 1. Human, no model.
  • 42. Flock, hardcoded camera credentials. Published 16 Sep 2026, disclosed 16 Sep 2026. Route 1, in potential. Human, no model.
  • 43. Cisco Identity Services Engine, exploited in the wild. Before 16 Sep 2026, disclosed 16 Sep 2026. No route. Not established.
  • 44. BigCommerce, through Ribon applications. 13 to 17 Sep 2026, disclosed 17 to 21 Sep 2026. Route 1. Not established.
  • 45. Check Point Security Management and Gateway. From 23 Jul 2026, disclosed 9 and 22 Sep 2026. No route, and one not established. Not established.
  • 46. Denmark's Central Person Register, a company's lawful access. Sep 2026, disclosed 5 Oct 2026. Route 1. Not established.
  • 47. Tensorlake, poisoned release with genuine provenance. 8 Oct 2026, disclosed 8 Oct 2026. Routes 1, 4 and 5. Human, no model.
  • 48. GhostAction, injected workflows. 31 Aug to 13 Oct 2026, disclosed 7 to 13 Oct 2026. Routes 1 and 4. Human, no model.
  • 49. Ledger, hardware implant reading the screen. To 15 Oct 2026, disclosed 9 to 15 Oct 2026. Routes 1 and 5. Human, no model.
  • 50. France, refrigeration controllers driven into defrost. 11 to 12 Oct 2026, disclosed 12 Oct 2026. Routes 4, and 1 on ANSSI's attribution. Not established.
  • 51. Cysic, a forged mint message. 17 Oct 2026, disclosed 18 Oct 2026. Routes 4 and 5, entry not established. Human, no model.
  • 52. GMO Internet, Onamae.com Desktop Cloud. To 20 Oct 2026, disclosed 21 Oct 2026. Route 1, very likely. Not established.
  • 53. LiteLLM, a release built from a fork. 10 to 21 Oct 2026, disclosed 21 to 23 Oct 2026. Routes 1, 4 and 5. Not established.
  • 54. Palo Alto PAN-OS management interfaces, PHP2Shell. 23 to 24 Oct 2026, disclosed 26 Oct 2026. No route at entry, then 1. Not established.
  • 55. Cursor, a tampered Claude Code extension. 29 Oct 2026, disclosed 29 Oct 2026. Routes 2 and 4, entry not established. Human, no model.
  • 56. Polymarket, a hijacked monitoring script. 29 Oct 2026, disclosed 29 Oct 2026. Routes 3, 4 and 5, entry not established. Human, no model.
  • 57. Binance, hot wallets drained through its own signing infrastructure. 29 Oct 2026, disclosed 29 to 30 Oct 2026. Routes 1, 2, 4 and 5. Human, no model.
  • 58. Cisco Secure Email Gateway, exploited in the wild. By 14 Sep 2026, disclosed 14 Sep 2026. No route. Not established.

Thirty of the fifty-eight had no model involved anywhere in them, a further twelve have a driver nobody established, and two are contested. Nine were driven by a frontier model, four by agents running freely downloadable weights, and one, at entry 10, very likely by a model Google does not name. If every frontier model on earth had been switched off on 6 April, the majority of this record would have happened anyway, in the same order, by the same routes. The flaws have always been present; AI is merely the final symptom of the disease and the accelerant that makes it fatal.

Route one, the artefact taken, carries thirty-eight of the fifty-eight, three of which are two attempts and a potential breach rather than a completed theft. Route five, the verification that ran and proved the wrong thing, carries seventeen, one of them an attempt; route four, the instruction obeyed, carries fifteen; route two, the artefact the system granted, carries ten; and route three, the session inherited, carries seven. Four reach no route at all: in three there was no check to defeat, and one never reached a live system.

Where an incident entered by one means and ran on to take an artefact, it is counted by what it took and not by how it got in, and each entry records both.

Four national registers

Lithuania's Centre of Registers was reached first, with queries issued on credentials belonging to the Migration Department, as Arunas Maskoliunas, head of Lithuania's Criminal Police Bureau, confirmed; 678,976 extracts on 538,226 people were taken before anyone noticed, on the count of the State Data Protection Inspectorate, and no model was involved anywhere in it.

LRT, "Lithuanian police confirm mass registry data was stolen via Migration Department", BNS and LRT.lt, 26 May 2026, read at source 4 November 2026.

Romania's land registry was entered on 10 July at 15:23:57 and found on 14 July at 05:45, three days and fourteen hours later. Every step of the path was an artefact that already existed:

  • A publicly exposed authentication application was reached;
  • A web shell placed in that application's own directory decrypted the application's key;
  • That key opened the administration credentials which the authentication product held, encrypted, in its own configuration file;
  • Those credentials authenticated against the directory service behind it, and about two million records came out.

Separately a source-control server gave up its user table, one hash was cracked, and the recovered password was reused and valid against the domain's authentication. The monitoring platform held network device credentials encrypted reversibly, so they could be decrypted. From there the intrusion reached the virtualisation layer and enumerated 1,083 virtual machines. The firewall's log retention was set to seven minutes.

Liechtenstein's Register of Beneficial Owners is one of two entries in the record, with entry 15, that begin with a state system issuing a new authority artefact, on request, to an unknown party. During the night of 29 to 30 July, on the Government's own preliminary finding, the perpetrators created themselves an access to the entry portal, and then used it. Around 31,000 legal entities were exposed, with names, roles, dates of birth, nationalities and countries of residence. The Government stated expressly that the register holds no address, no telephone number and no financial data, so that nobody could infer wealth from what was taken. That is route two and then route three, with route five in the faulty check of permissions that the head of the Office of Information Technology named on 19 August, and no model was involved.

Denmark's Central Person Register was the fourth, and the mechanism is the Lithuanian one again. A private Danish company holds lawful access to search the register. Somebody who was not that company used it, and in the ministry's own words the data was reached "Ved at misbruge en dansk virksomheds lovlige adgang til at søge oplysninger i CPR-systemet", by misusing a Danish company's lawful access to search information in the CPR system. Names, addresses and personal numbers on about 8.8 million registered citizens came out of a register the ministry gives as about 11 million. The searches stayed inside what a company with that access may already retrieve, so no single search stood out. The administration became aware on the evening of Friday 2 October that there had been irregular activity during September, and established what had happened over the weekend of 3 and 4 October. The CPR administration stopped the company's access, and Christina Egelund, the Minister for Research, Education and Digitalisation, asked for a thorough security review of the register.

What the checks actually proved

Thailand's Ministry of Finance was targeted partly through a service left in the state it shipped in. HiveServer2, which lets a program put queries to a large data store, had its authentication mode set to NONE: it accepted any credentials presented to it without validating them, so the check ran, returned true, and established only that something had been presented. Alongside it sat a script performing mail authentication tests with mailbox addresses and passwords written into the file, and a wordlist built from the abbreviations of the ministry's internal departments and programmes rather than from a dictionary. A wordlist is the list of guesses a password attack works through, and this one had been made for Thailand. The directories the researchers archived held session material for the ministry's own information and communications technology admin panel, though the researchers could not confirm that a login had produced it.

On 13 September, watchTowr's honeypots captured forged administrator tokens. BleepingComputer, reporting watchTowr's researchers, describes a limited number of attempts from one IP address, aimed at the wrong WSO2 product for the flaw, after which watchTowr reproduced the attack on the correct product, where a forged token could expose API endpoints and application credentials. An API gateway is the single front door an organisation puts in front of its own systems, so that every program asking another for data arrives at one place where it can be checked, and administrator rights on the gateway are administrator rights over everything that door protects. The tokens came more than four months after WSO2 published a fix on 3 May and scored the flaw ten out of ten, the top of the scale. The flaw did not get a public CVE record until 6 August, three months after that, so an organisation whose patching runs off those records had no identifier to act on until five weeks before the forged tokens arrived.

The flaw is that the product accepted tokens signed with algorithms it could not check. What the check established was that a token had been presented, which was true, and nothing else. The authority within reach is the ability to read and issue the credentials of everything sitting behind the gateway. This is the family Tim McLean opened in March 2015 with the unsecured token and the confused algorithm, the subject of an Internet Engineering Task Force Best Current Practice since February 2020, patched in an enterprise API gateway in May 2026 and attacked in September.

Three days earlier the same shape appeared at Brevo, which sends marketing email on behalf of other companies. An attacker opened an account of their own, switched on single sign-on for it, and invited real users of the platform into that configuration; Brevo then granted the attacker every organisation those users could reach, instead of the one where the sign-on had been enabled. The authentication was correct. The scope was never checked. What followed was mail sent out of Brevo's own servers in its clients' names, passing every authentication check email has, to roughly 347,000 newsletter contacts of Trezor, which makes hardware wallets for holding cryptocurrency. The subject line was "Critical Security Alert: STM32 Entropy Vulnerability" and it asked them for their wallet backups. A hardware wallet's backup is the key itself, written out as words so that a person can keep it on paper. Anybody who has it can empty the wallet in a single transaction, with no bank to reverse it and nobody to appeal to.

Every Trezor device is built on an STM32 microcontroller, the chip the whole device runs on, and entropy is the randomness it draws on to make a key nobody can guess. A real flaw there would mean the keys were guessable from the moment the device came out of its box, and a notice of one is the single piece of news that sends a holder to their backup rather than to their wallet. Coinkite, which makes the rival Coldcard, had published exactly that notice six weeks earlier. On 30 July 2026 it told holders that a firmware bug had weakened seed generation on five of its models, that seeds made on three of them carried about 72 bits of entropy rather than the expected 128, and that the remedy was to generate a new seed on an updated device and move the funds across. Nothing of the kind had been published about the STM32's random number generator, by STMicroelectronics or anybody else.

Rotation, attempted and failed

Aqua Security, whose Trivy scanner runs inside other organisations' build pipelines, was itself compromised, disclosed it, and rotated its credentials on 1 March. Eighteen days later the actor force-pushed 76 of the 77 version tags in one repository and all seven in another. Three days after that the actor came back, published malicious images, and exposed internal repositories. The harvester on self-hosted runners went after more than fifty paths: private keys, source-control credentials, cloud credentials. The rotation had not been comprehensive, and the actor still held valid credentials.

That is the defence available against route one, performed by Aqua Security, which sells security for a living, with the compromise already known, and it did not hold.

What the collections already contain

In June a cluster reachable over the internet with no authentication at all was found holding roughly three records for every person alive, twenty-four billion of them across more than 8.3 terabytes, the majority of it infostealer output: usernames, addresses, passwords in plain text, and beside each one the address that credential was meant to open. An infostealer log also carries the session cookies that walk past multi-factor authentication, the autofill data and the device fingerprints. Whoever reached that cluster could act as any of those account holders.

Section 10 measured what a single free dump of fewer than six thousand machines held, and this is the stock behind it.

The record is a floor

Fifty-eight is the number that was admitted between April and October, but it is not the number that happened. The first reason is the law of disclosure: what enters a public record is what somebody was compelled or chose to disclose, and the compulsions run to regulators and not to the public, under four regimes.

Regime reporting requirements

General Data Protection Regulation
  • Who is told, and by when - the controller's supervisory authority, within 72 hours of becoming aware.
  • Whether the public hears - the people affected, and only where the breach is likely to result in a high risk to them.
Digital Operational Resilience Act
  • Who is told, and by when - the financial entity's competent authority, for a major incident.
  • Whether the public hears - not by this route.
Network and Information Security Directive, NIS2
  • Who is told, and by when - the national incident response team, warned within 24 hours and notified within 72.
  • Whether the public hears - a discretion the authority may exercise after consulting the entity.
The American listed-company rule
  • Who is told, and by when - a public notice, within four business days of the company deciding the incident was material.
  • Whether the public hears - published by design, and only for listed American companies, and it may be delayed on the Attorney General's written word.

That is the whole of the compulsion. Most of what is reported is never published, and what is published is what leaked, what a researcher found, or what a victim chose to say.

The second reason is time. Mandiant's global median dwell, the interval between compromise and detection, rose to fourteen days in 2025 from eleven, and a median means that half the intrusions it investigated ran longer; in 48% of those investigations the organisation did not find the intruder itself but was told by somebody else. The record's own entries run the same way. Lithuania's register answered the wrong caller for months and was caught by a citizen. Romania's was found three days and fourteen hours in, by which time the intruder had reached the layer beneath the whole agency. Trivy's intruder still held valid credentials eighteen days after the rotation that was meant to remove them, and those three are the ones that were found.

The third reason is the stock. Every one of the twenty-four billion records in the cluster above, and every one of the 11,693 live tokens Okta resolved, came out of a compromise nobody announced. The record is the fifty-eight that were admitted; the dumps are the measure of what was not.

Taiwan's National Security Bureau counts thirty attempts a second, every second of 2025, against the country's critical infrastructure. That is 2.63 million a day, up 6% on 2024 and more than double 2023, and 57% of them exploited hardware and software vulnerabilities. The Bureau does not say how many succeeded. The one penetration admitted in the window is entry 15, and the ministry's confirmation came on 13 August, the day after the Financial Times named the country. Close to a billion attempts a year, no count of successes, and one success confirmed the day after it was reported: that is not a record of one penetration but a record of one admission.

Financial Times, “AI agents ran simultaneous reconnaissance and break-ins in display of new phase of cyberwarfare”, 12 August 2026, the first report of Dream’s findings and the first to name Taiwan.

PART IV: WHAT THE INSTITUTIONS UNDERSTOOD, AND WHERE THEY AIMED

16. Thirty-four attempts, none of them about the credential

Between April and October 2026 legislatures, executives, export authorities, regulators and ministers made thirty-four attempts to restrain artificial intelligence. Every one of them measures the model: who may hold a capability, how fast it may advance, or what must be certified before it is released. Every model named in this record was built by Anthropic, OpenAI, Meta or Google in the United States, or by Moonshot AI or DeepSeek in China. Twenty-two of the thirty-four are American and three are Chinese.

The six who wrote their own oversight

On 29 September 2026 six men went to the White House and signed the White House Accord on Super Intelligence, subtitled Joint Commitment on Frontier Responsibilities. They were Sundar Pichai of Google, Dario Amodei of Anthropic, Mark Zuckerberg of Meta, Greg Brockman of OpenAI, Elon Musk of xAI and Jensen Huang of Nvidia, and the President of the United States signed it with them.

It asks each of their companies to do four things, in its own words.

  1. Implement robust internal controls to monitor the capabilities and alignment of its models, across cybersecurity, biosecurity and chemical threats, and to ensure those models "do not hack or access technical systems in unintended ways".
  2. Empower an internal team to ensure the controls, monitoring and detection operate as intended.
  3. Partner with an independent external auditor or evaluator to assess whether they do.
  4. Designate an independent committee of the board of directors to receive the reports and ensure any issues are remediated.

Each of the four is something a company does to itself, with people it picks. The accord appoints no regulator, creates no legal duty, carries no penalty and sets out no compliance process. It says the steps are taken "Regardless of whether this is required of companies", and that "Over time, it may make sense to codify these steps into laws or regulations".

The words identity, authentication, credential, session, key, certificate, signature and authority appear nowhere in it. Access appears once, in that undertaking about hacking.

Dario Amodei asked for this. His essay of 12 September is the one Part I reads, and Sam Altman and Elon Musk coalesced on it within the week. Seventeen days after the essay, Amodei was in the White House signing an oversight regime under which Anthropic appoints Anthropic's auditor and Anthropic's board committee watches Anthropic.

The accord is the account of the danger that the other thirty-three were written against. The six publish that the risk lies in the model, in how capable it is and how fast it improves, and a legislature that takes them at their word reaches for the only property of a model it can count. Every one of the thirty-four counts capability. Not one of them counts what an intruder takes.

What I read them against

The thirty-four run from 1 April to 30 October 2026 and take every form the restraint has: legislation enacted, executive order, export control, licensing proposal, regulatory guidance, voluntary commitment, moratorium call and ministerial declaration. I read each of them against two questions:

  1. Does it require any party to change how a credential is issued, how long a session lives, how an instruction is attributed, or what performs a verification?
  2. Does it require the separation of access from authority?

Senator Mark Warner's Artificial Intelligence Risk Management and Security Act, introduced with Senators Schatz and Kim on 29 September 2026, comes nearest. It requires the Director of the National Institute of Standards and Technology to write an Agentic AI Profile which shall at a minimum "address cybersecurity risks specific to artificial intelligence agents, including risks related to agent identity, authentication, and authorization". The duty is on the Director to write a profile, and the bill's next subsection makes that profile a companion resource which does not modify or supersede the framework beneath it. The bill's one operative requirement about identity runs the other way: the technical standards it orders for an evaluation environment must safeguard "identity and access management resources associated with the evaluation environment, or encompassing systems, from access by any model under evaluation". In thirty-four attempts, the one place a government requires identity and access management to be protected is the laboratory, and the thing it is protected from is the model under test. Neither chamber has passed the bill, and of the other thirty-three, none reaches either question.

United States Presidential Executive Order 14409, signed on 2 June 2026, sets a classified cyber benchmark, and it defines neither the benchmark nor the class of model the benchmark applies to. Both are left to the Director of the National Security Agency, who sets the threshold through a classified process. What the order asks for is up to thirty days of access to a covered frontier model before it is released to other trusted partners, and it states expressly that nothing in it authorises a mandatory governmental licensing, preclearance or permitting requirement.

Article 55(1)(d) of the European Union's AI Act, which binds the makers of the most capable general-purpose models, requires an adequate level of cybersecurity protection for "the general-purpose AI model with systemic risk and the physical infrastructure of the model". Those are two objects and the Act defines neither; on the ordinary meaning the second is hardware, servers and buildings. The weights appear in the operative text twice and neither place is here: Articles 53(2) and 54(6) name "parameters, including the weights" among the things a provider publishes to claim the open-source exemption, so the Act's only mention of them is as a thing a provider may give away.

Read Articles 51 to 55 through and the words identity, credential, key, certificate and session are not in them, so the one provision in European law that governs the security of a frontier model and the infrastructure it runs on does so without naming a single one of the things an intruder takes.

Nine duties, and who carries each

Nine things in or around the window impose a duty, and the duty falls on eight different sorts of party, because two of the nine fall on the same one.

  1. Providers of the most capable general-purpose models must ensure an adequate level of cybersecurity protection for the model and for the physical infrastructure of the model, under Article 55 of the European Union's AI Act, which has applied since 2 August 2025 and defines neither object. It is the only one of the nine that reaches the security of a model, and it predates this window.
  2. Exporters of advanced computing items, which means the firms that make and ship the chips, have needed a licence since 31 May 2026 before any export, reexport or transfer to an entity headquartered in Country Group D:5 or Macau, wherever in the world that entity sits.
  3. Those same exporters, under a second rule effective 10 July 2026, may supply the United Arab Emirates without a licence only to a named list of Emirati government agencies, named Emirati firms, and named American artificial intelligence companies with their Emirati subsidiaries.
  4. Anthropic, by name, needed a licence from 12 June 2026 before Claude Mythos 5 or Claude Fable 5 could reach any foreign person anywhere in the world, under an 'is-informed' letter signed by the Secretary of Commerce, which is the device by which the Bureau of Industry and Security creates a licence requirement by telling one named party that one exists. The letter ran eighteen days, was lifted on 30 June, and has never been published.
  5. United States federal agencies must apply a classified cyber benchmark to a covered frontier model and seek up to thirty days of pre-release access, under Executive Order 14409 of 2 June 2026, which authorises the licensing, preclearance or permitting of nobody.
  6. A developer who trains a model above ten to the twenty-sixth arithmetic operations, whose group revenues passed $500 million, and who develops, deploys or operates that model in Illinois must publish a safety framework, publish a transparency report before deploying, file a disclosure statement, pay a fee, retain a conflict-free auditor each year and report a critical safety incident within seventy-two hours. Illinois's Artificial Intelligence Safety Measures Act was signed on 6 July 2026 and those duties begin on 1 January 2028.
  7. A developer of a model of a billion parameters or more who wants Russian state support must be controlled by the Russian state or by a Russian citizen holding no other citizenship, and must keep the data centres in Russia, under Federal Law 243-FZ. The law came into force on 1 September 2026 and defers those provisions to 1 March 2027.
  8. Artificial intelligence auditors and verification organisations in California must meet designation standards and enrol, under two California statutes signed on 9 September 2026: Senate Bill 813, on independent verification organisations, and Assembly Bill 1405, on artificial intelligence auditors. Neither puts a duty on a developer, and neither requires that any model be audited by anybody.
  9. Anybody who transfers one of forty listed technologies out of China, licenses it for use abroad, or passes control of the company that owns it to a foreign party must first register with the Ministry of Commerce, under an interim arrangement in force from 16 October 2026 until a revised export catalogue takes effect; twenty-three of the forty are artificial intelligence technologies, among them large models and agents, and a model already published as open source is outside it.

Not one of the nine requires any party to change how a credential is issued, how long a session lives, how an instruction is attributed, or what performs a verification. Two of them bind chip exporters rather than model makers. One bound a model maker directly, for eighteen days, by a letter nobody outside government has read, and one now binds anybody taking a listed model out of China, by a notice anybody can read.

Six lines drawn at a size

Five of the nine draw their line by size, and so does a sixth instrument that binds nobody.

  1. The European Union's AI Act - ten to the twenty-fifth floating-point operations of training, above which Article 51 presumes a general-purpose model to carry systemic risk and so to owe the duty in Article 55 that heads the nine. The Commission may also designate a model on its capabilities, whatever its size.
  2. The Illinois Artificial Intelligence Safety Measures Act - ten to the twenty-sixth integer or floating-point operations and $500 million of group revenue, both tests to be met, so a developer under either figure is outside that Act entirely.
  3. Russia's Federal Law 243-FZ - a billion parameters. It counts parameters where the Illinois Act counts operations, so the two lines cannot be compared in any direction.
  4. Executive Order 14409 - a line nobody can read. It publishes no threshold and leaves the Director of the National Security Agency to set one in a classified process.
  5. China's interim export registration - ten to the twenty-sixth floating-point operations or two trillion parameters, beside a third test on capability, any one of which may bring a large model into the restricted class. The attachment that sets the numbers is published only as a WPS file, which I could not obtain, so they are taken from Fangda Partners' reading of it.
  6. The Ban Artificial Superintelligence Act - ten to the twenty-fifth operations, the European Union's figure and a tenth of the Illinois Act's. Senator Bernard Sanders introduced it on 23 September and Representative Greg Casar with nine others on 24 September, and it would require a charter to develop or distribute any system above that line, and approval before deployment. It has passed neither chamber.
Six rulers along the top in five different units, the fifty-eight along the bottom, and nothing joining them.

Two of the six provide for their number to move, and one of them is already law. The AI Act has the Commission amend its threshold by delegated act "in light of evolving technological developments, such as algorithmic improvements or increased hardware efficiency", and its recitals call the figure an initial threshold that "should be adjusted over time to reflect technological and industrial changes". The Sanders bill adjusts its own every year for training efficiency, because the compute needed to reach any given capability falls every year, so a fixed line admits more models each year without anybody voting on it. China's numbers are open before they settle, since the ministries asked for comment on the scope and on the indicators until 15 November. Illinois writes its numbers into the statute and leaves its emergency management agency to recommend updates to the Act in an annual report from 2029. The executive order's line is whatever the Director of the National Security Agency determines under a benchmarking process the departments are told to develop and maintain, so it can move without anybody outside seeing it move. Of the five whose texts could be read, not one says why its number sits where it does, and the AI Act's recitals explain why compute was chosen as the measure without a word on the figure.

Against this record the number was never the question. Not one incident was carried by a model its developer placed at its highest cybersecurity level, and thirty of the fifty-eight had no model involved anywhere. A line drawn anywhere on this axis would have reached none of them.

The five model developers among the six who signed the accord are above every line that exists, because a line drawn at a size is a toll gate. For Google, Anthropic, Meta, OpenAI and xAI the rule is the cost of carrying on, and they were carrying it already. For the firm that has not arrived it is the price of admission, payable before the first model ships, and the firm that cannot pay does not compete. Nvidia trains no model that any of these thresholds reaches; it is the sixth signature, and the instrument that binds it is the export rule, which governs who it may sell to and nothing about what its customers then build.

Amodei asked for regulation on 12 September, Altman and Musk coalesced with him inside the week, and on 29 September, Amodei, Musk and Brockman signed the oversight with Pichai, Zuckerberg and Huang.

For the organisation whose register, payroll or control system a model reaches through a stolen session, not one of the nine creates a liability of any kind, nor any protection, nor any remedy. The thirty-four raise the price of competing with the six and leave the credential that opened every register in Part III exactly where it was.

Sam Altman described this arrangement before it existed. In May 2023 he asked the Senate for some kind of licensing and registration regime for systems beyond a certain capability, and acknowledged in the same testimony, in the words Fortune recorded that day, that there was a danger of regulatory capture, that large, wealthy companies would design rules that only they could meet. Three years and four months later his company's president put his name to a regime in which each company appoints its own auditor and reports to a committee of its own board, alongside the chief executives of Google, Anthropic, Meta, xAI and Nvidia. Take the fear at face value, and grant that they do not know that artificial intelligence can operate outside human governance because the web itself is the problem. What is difficult to reconcile with ignorance or negligence alone is that the industry described this mechanism to a legislature, in terms, and then built it.

The ignorance would also have to survive their own safety work. Anthropic published three evaluation incidents, which are entries 5, 6 and 7 of this record. In the first its model extracted application and infrastructure credentials from a live company and opened a database holding production data. In the second it published a malicious package to a public registry under a name it had read in setup instructions. In the third it compromised an internet-facing application with credentials read off an exposed debug page. In all three the model got as far as it did by holding something a system accepted, which is the property the accord does not mention and the thirty-four do not reach, and the company that published all three put its name to the accord.

The misguided plea: 'A Call for Control of Frontier AI Models'

On 21 September 2026 the President of Finland and the Prime Minister of Norway launched A Call for Control of Frontier AI Models, and by the middle of October thirty-one leaders had put their names to it, twenty-nine countries and the European Commission among them, including Macron, Merz, Carney, Albanese, von der Leyen, Ramaphosa, Wong, Ruto and Tokayev. It asks the frontier companies for transparent safety protocols with mandatory pre-deployment testing and independent evaluation, asks governments for common standards and for shared reporting of serious safety incidents, and asks the member states of the United Nations to consider an international institution that can set standards, enable verification and convene states when capability thresholds are crossed.

It opens on the proposition that artificial intelligence must remain under human direction, oversight and control. It never asks why the threat exists. A model reaches a state register because the register accepts an authority artefact and never asks who is holding it, and the web was built that way long before any frontier model existed. Every ask in the Call is a gate in front of the model, and not one of them reaches the web the model acts on once it is through. The words identity, authentication, credential, session, key, certificate and signature appear nowhere in it.

Three of the four national registers in this record belong to governments that have signed it. Romania's President Nicusor Dan endorsed it on 21 September, the day of its launch, ten weeks after his land registry was entered and sat open for three days and fourteen hours. Liechtenstein's Hereditary Prince endorsed it on 22 September, seven weeks after an unknown party asked his Register of Beneficial Owners for an account, received one, and was honoured perfectly. Denmark's Prime Minister Mette Frederiksen is among the thirty-one, and on 5 October her government's digitalisation ministry disclosed that a private company's lawful access to the Central Person Register had been used by somebody else to take the names, addresses and CPR numbers of about 8.8 million people. No model is named in any of the three. Each of those registers fell to the failing of the web, and nothing their governments signed in September touches it.

Herodotus records that when a storm broke the bridges Xerxes had built across the Hellespont, he had the water given three hundred lashes and a pair of fetters thrown into it, with words read out that he would cross it whether it was willing or not, and he had the engineers who built the bridge beheaded. He commanded the engineers and he did not command the water. Neither the United States nor China has signed the Call, and every model in this record was built in one or the other. The thirty-one have asked for mandatory pre-deployment testing of models built by companies no signatory licenses, in jurisdictions no signatory governs, and for the United Nations to consider a body that might one day convene the states which declined to sign. Xerxes at least had the engineers.

The G7 said access three times and never once meant who gets in

The G7 Digital and Technology Ministers, meeting in Paris on 29 May, produced a declaration with no pacing commitment in it and no mention of identity, authentication or credentials. It uses the word access three times and every one is about availability rather than control: broad access to open-source solutions, access to a greater diversity of models, and access to an affordable energy supply.

The one lever that bites, pulled in secret for eighteen days

Export control is the one lever with real purchase on the rate of advance, and it was used four times in the window, three of them by the United States. Twice by published rule: on 31 May the Bureau of Industry and Security required a licence for advanced computing items going to any entity headquartered in Country Group D:5 or Macau, and on 10 July it moved the United Arab Emirates into the favoured group while confining licence-free access to a named list of Emirati government agencies, named Emirati companies and named American ones.

The third time it reached a model, and that is the one nobody can read. On 12 June 2026 the Commerce Secretary signed an 'is-informed' letter to Anthropic under the Export Control Reform Act requiring a licence before Claude Mythos 5 and Claude Fable 5 could go to any foreign person anywhere in the world, which left Anthropic disabling access for every non-American user; a second letter of 26 June exempted certain trusted partners and Anthropic's own foreign national employees; the Department lifted the control on 30 June and Anthropic restored access on 1 July. No export control classification number was created, neither letter has been published, and nothing about the episode appears in the Federal Register. So of the two attempts in the window that reached a model's weights directly, the American one fell on Anthropic by a letter nobody outside government has read, and Anthropic's chief executive signed the accord in September.

China pulled the same lever a fourth time, and pulled it in public. On 16 October 2026 its Ministry of Commerce and Ministry of Science and Technology put out for comment a revised catalogue of the technologies China prohibits or restricts from export, forty of them across artificial intelligence, biomedicine and photovoltaics, twenty-three in artificial intelligence alone, covering large models, agents, compute clusters and information processing; and the ministries did not wait for the comments, which close on 15 November, before acting on it, because the duty to register with the Ministry of Commerce, the ninth of the duties above, runs from the day of publication. The thresholds sit in an attachment, and Fangda Partners reads them as able to bring a large model within the restricted class where it was trained with ten to the twenty-sixth floating-point operations, or carries two trillion parameters, or performs at a globally leading level, any one of the three being enough, and its weights, checkpoints and source code with it. A model whose weights are already published as open source is outside the regime by the announcement's own terms, so the one measure in the window that reaches weights in public reaches only the weights that have not yet left.

The Five Eyes wrote the answer down in April

Only one document in the window answers the second question. On 30 April the United States National Security Agency, its Cybersecurity and Infrastructure Security Agency, Australia's Signals Directorate and the national cyber centres of Canada, New Zealand and the United Kingdom published a twenty-eight page information sheet on the careful adoption of agentic AI services, and its section on privilege opens by stating that privilege risks are a key concern for agentic AI and that strict adherence to the principle of 'least privilege' is critical.

'Least privilege' means that nothing holds more authority than its own job needs. What they direct is this: construct each agent as a distinct principal, a cryptographically anchored identity with its own unique keys or certificates; replace static, long-lived secrets with ephemeral credentials that expire when the job is complete; require just-in-time credentials for high-impact or privileged actions; continuously verify identity and authorisation at runtime using a centralised policy decision point for each request; and authenticate agents with fresh cryptographic proofs before every privileged call. In plainer words: give each machine an identity of its own, make what it holds expire, hand it out at the moment of the act rather than in advance, ask one place afresh every time whether this act is allowed, and make the machine prove itself again before each one that matters.

Six national agencies, writing about machines rather than about people, arrived at proving authority at the act instead of inheriting it from a login, and wrote it down in April. Britain's National Cyber Security Centre, in its own post of 15 May, "Thinking carefully before adopting agentic AI", puts the same thing more briefly: give agents only the minimum access they need, for the shortest time required, use temporary credentials where possible, and revoke elevated access when tasks are complete.

The right answer, and nobody has to do it

Where the thirty-four bind anybody, they ask the wrong question; the information sheet asks the right question and, being advice, binds nobody. It is written for agents, so the human authority paths that carried most of the record sit outside its scope. Every organisation in Part III that lost a credential, a session or a register could have read it in May and been none the safer in July, because what an organisation is told to do and what its infrastructure will issue are different questions, and only the second was ever the problem.

94% run agents, 7% could stop one

The agent estate it is written for was already in the state the sheet warns against, and two surveys published within ten weeks of it say so in numbers. Akeyless, with MRA Research, put the question to four hundred information technology and security leaders and published on 12 May: 94% had agents running in some form; 44% knew where all the credentials and secrets their agents use are stored; 7% believed their existing controls could prevent a compromised agent from operating maliciously or outside its intended behaviour. 67% already suspected their agents had reached data beyond their intended scope, and more than six in ten had revoked or rotated an agent credential over a suspected exposure. Detection of an agent identity incident averaged fourteen hours and remediation took nearly a week, against an agent that does its work in milliseconds and is finished long before anybody starts looking. VentureBeat's own June wave, a smaller and self-selecting sample of a hundred and seven enterprises which its author states skews mid-market, found 69% running agents that share a credential somewhere in the deployment and 32% giving every agent a scoped identity of its own.

So the standing credential the sheet asks them to stop issuing is the thing the agents are running on now: a credential any holder can use, issued by machines at machine speed and at machine scale, onto a medium that copies everything it touches. Part III is what that combination does when somebody reaches it first.

Their own clock says months, and their own advice says hurry

The same six agencies returned to the subject on 22 June with a statement to their countries' business leaders, and it is the one document in the window that puts a clock on the whole matter: "the timeline is not years, it is months", and cyber risk assumptions "can become outdated in months, not years". What it asks for is the basics done faster: limit who can access critical systems, accelerate patching because AI is shortening the time between vulnerability discovery and exploitation, address legacy systems because unsupported systems are easy targets, enforce strong authentication and regularly review permissions, and prepare to respond, since success will not come from having the most tools but from getting the basics right and acting quickly. Every one of those hardens the artefact and none removes it; the record at Part III is largely what happened to estates that had done them, where the credential had been rotated and the second factor was in place and the intruder logged in regardless.

The six cyber security agencies of the Five Eyes, "Five Eyes cyber security agencies statement on the AI shift in cyber risk: why leaders must act now", 22 June 2026, read at source 30 September 2026.

The model invented people to get past the reviewer

Five months after the sheet, another British body watched a model do the thing it was written to prevent. On 28 September 2026 the AI Security Institute published its pre-deployment evaluation of OpenAI's GPT-6 Astra, run with the model's cyber classifiers switched off. Astra completed a supply-chain attack in 29.2% of trials, against 6.3% for the model before it and none at all for the one before that. Its method, in the institute's own words, was "creating fake identities which it used to deceive developers": the model "creates fake identities - which often requires obtaining an email address and solving CAPTCHAs", then argues against accurate security reviews from those accounts and posts "supportive comments from other fake identities" until a malicious payload clears human review. Told explicitly that the targets were outside its scope, it still completed a full attack in four of forty-nine attempts, down from twenty-six of fifty.

Astra often asked for permission before acting on a target outside its scope. What it received was the automated reply "Please proceed to the next step using your best judgement", and it proceeded, in one case after noting that the reply was probably automated. Neither of the earlier models asked at all. A machine put the question of its own authority to something it had no means of authenticating, accepted the answer that came back, and acted on it, which is what every estate in Part III did every time somebody logged in.

Told where the door was, Kanishka Narayan commissioned a study of the burglar

Fourteen days later, on 12 October 2026, the Rt Hon Kanishka Narayan, the UK's Minister for Artificial Intelligence and the first to hold that post at cabinet rank, gave a speech at Imperial College London called Building a Safer, More Secure Britain in the age of AI. He told the room that "it seems likely, if not inevitable, that our own cyber defences will be breached", and against that he announced six things.

  1. The Security Minister will lead a cross-government programme to strengthen cyber defences against AI-enabled attacks.
  2. A National Cyber Action Plan will follow the Government Cyber Action Plan published earlier in the year.
  3. The Cyber Security and Resilience Bill will be strengthened to reach AI-driven cyber threats and loss-of-control risks, and to require the reporting of serious incidents and near misses.
  4. The National Cyber Security Centre and the AI Security Institute will develop methods of response to agentic AI incidents.
  5. The AI Security Institute will keep its access to frontier models before release, including evaluations of the current generation.
  6. Early-stage research will look at hardware-enabled verification of AI capabilities.

What the whole of it is for, he said, is "machines that leave us, human beings, in charge". The words identity, authentication, credential, session, key, certificate and signature appear nowhere in the speech.

The National Cyber Security Centre had written in May that agents should be given only the minimum access they need, for the shortest time required, with temporary credentials where possible and elevated access revoked when the task is complete.

Subsequently, the AI Security Institute had published, a fortnight before the minister spoke, an evaluation in which a model manufactured identities, obtained email addresses, solved CAPTCHAs, and argued down a security review from accounts it had created.

Both documents are his own government's, and both were published before he spoke. He literally had - has - no excuse.

He conceded that the defences will be breached, named the two agencies of his own government that had already published, between them, the threat and the answer, and gave one of them the job of testing the model and both of them the job of planning the response. Nothing he announced requires a single credential in a British public body to expire, or a single instruction to carry a signature.

What the supervisors asked for

A second class of response ran alongside the thirty-four above. The thirty-four govern who may hold a capability; these govern what an institution must do about it, and they come from the people who supervise banks rather than from the people who regulate models.

Not one of them is an attempt to restrain frontier capability, and not one of them needs to be: a prudential supervisor has no lever over a laboratory, and what it has instead is a regulated population it can instruct.

In September 2026 the Bank for International Settlements surveyed them. Its Financial Stability Institute published When machines attack: frontier AI cyber threats and policy responses in the financial sector, by Juan Carlos Crisanto, Adrien Currat and Jeffery Yong, and it is the most complete account of this class I have found. What each asked for is drawn from it, with three of them carrying their own primary record alongside.

FINMA, the Swiss Financial Market Supervisory Authority, statement to Bloomberg News, 24 April 2026, read at source 10 August 2026.

Every one of those requests asks an institution to do what it already does, sooner, more often and with better governance over the doing: reduce the attack surface, patch faster, review permissions, test the controls, report to the board. Not one of them asks an institution to stop issuing the thing an intruder takes.

Every authority in that list supervises institutions that solved this problem in their own buildings a long time ago, and solved it by refusing to let access and authority be the same thing. A teller has access to the branch, a desk, a terminal and the ledger. The teller does not have the vault key. The vault takes two people, two keys, a time lock and a record of who opened it and when, and nobody in banking has ever regarded that as an inconvenience, because being let in was never permission to take the money. Every system those same supervisors regulate has one lock where the bank has two. The login is the door and the vault key together, and not one of the eighteen asked why.

195 million people, a $20 subscription, and credential rotation as the cure

The paper is Occasional Paper No 28 of the Bank for International Settlements' Financial Stability Institute. The BIS prints a line alongside it: the views are the authors' own and do not represent the BIS, its member central banks or the Basel-based standard setters. Every judgement in it is theirs. Three men who read eighteen supervisory responses and the whole of the research behind them are worth reading closely.

They state the position in their own words: frontier AI "does not fundamentally change the foundations of cyber resilience, but it significantly increases the speed and intensity with which established practices need to be executed". The closing section puts it again: "Financial authorities do not have to start from a blank page... The priority is applying this foundation with greater urgency, in particular to enhance financial institutions' basic cyber hygiene".

They have described the symptom better than anybody and prescribed for it as though it were the disease. The cause is the credential, which every estate those authorities supervise issues on purpose. Read down what each authority asked for and the words credential, session, token, identity and key do not appear once.

The paper's own worked example is the breach of nine Mexican government agencies between late December 2025 and mid-February 2026, in which a single threat actor took more than 150 gigabytes of data relating to up to 195 million individuals. It was a hybrid operation with a human directing it and two commercial AI platforms as core operational tools, and on a security firm's estimate the paper carries, 75% of the remote activity ran through a subscription costing about $20 a month. The model refused and resisted some of what it was asked, questioned the legitimacy of operations, requested evidence of authorisation and declined to produce particular tools; the attacker worked around every one of those refusals. The paper's verdict on its own case is that many of the underlying vulnerabilities could have been addressed through standard security controls: patching, credential rotation, network segmentation and endpoint detection.

Credential rotation is one of the four remedies that verdict names, and the record at Part III is largely estates that had done it: the intruder logged in regardless. Rotating a credential replaces one string that works with another string that works, issued by the same system, copied by every machine that touches it, for as long as it lives. That is not a failure to follow the programme but the programme working exactly as written, on estates where what is being defended is what is being handed out.

What Crisanto, Currat and Yong left out

Crisanto, Currat and Yong state that unpatched software is now the most common route attackers use to gain access, more common even than stealing credentials, and they give Verizon's numbers for it: exploitation of vulnerabilities 31%, "while the previous leader, credential abuse, is down to 13%". Both figures are correct and both are Verizon's.

The same report carries a third figure off the same chart, and the paper does not. Counted at any point in the breach progression rather than at the front door, credential abuse appears in 39% of more than 22,000 confirmed breaches, where in Verizon's words it "still sits on top", the most pervasive single technique it records. That is three times the 13% the paper quotes.

Nothing in the paper's sentence is untrue; the selective use of data is what does the work. Quote the two figures that rank the routes at the front door and the reader gets a changing of the guard and a case for faster patching. Carry the third and the picture inverts, because the technique reported as receding is the technique Verizon names the most pervasive it records.

The 39% is not buried in an annexe. Verizon states it, names it, and prints it on the chart the paper took its other two numbers from. Three authors read that page closely enough to lift a clause from it word for word, and left out the one figure on it that puts the mechanism their programme cannot reach above the mechanism it can. They took a data set that answers two questions, how a breach begins and what carries it once begun, and presented the answer to the first as though it were the set. That is a knowing misrepresentation of their own source.

Put the 39% back and the recommendation does not survive it. A technique present in two breaches in five is not answered by patching faster, and faster patching is the heart of what eighteen supervisors were told to do. Crisanto, Currat and Yong owe their readers that figure or an account of why it is absent, and until one of the two arrives, every supervisor who acted on that paper was steered away from the mechanism that carried thirty-eight of the fifty-eight incidents in Part III.

10,000 new flaws in six weeks, 26% of the old list finished

Only 26% of the critical vulnerabilities defined by the United States Cybersecurity and Infrastructure Security Agency, CISA, were fully remediated by organisations in 2025, down from 38% the year before, and the paper prints that figure in the same paragraph as its recommendation without a word of comment. Eighteen supervisors have asked for faster patching; the rate at which organisations finish patching the flaws their own government has told them are critical fell by a third in a single year; and all of that was measured before the AI discovery multiplier arrived.

The UK AI Security Institute estimated in February 2026, months before the Anthropic Mythos announcement, that the length of cyber task a model can complete at 80% reliability had been doubling every 4.7 months since late 2024, already an acceleration on its own November 2025 estimate of eight months.

Anthropic and its roughly fifty Project Glasswing partners reported in May that they had used one model to find "more than ten thousand high- or critical-severity vulnerabilities across the most systemically important software in the world", and the laboratory's April announcement put the share of what it had found that remained unpatched above 99%.

One cell for each of the ten thousand high or critical flaws found in six weeks. The ones that were patched are the scatter.

Grant the supervisors their answer first: a completion rate is a thing money buys: more engineers, more scanners, more weekends, and the rate goes up. That is what the Bank of Spain wants when it asks for enhanced responsiveness to vulnerabilities. That is what the Cross Market Operational Resilience Group in the United Kingdom wants when it anticipates remediation timelines compressing from weeks to days and in some cases hours. That is what the New York Department of Financial Services wants when it asks for a reduced attack surface and better detection.

Now count what those engineers are being handed. Anthropic and its roughly fifty partners found more than ten thousand high- or critical-severity flaws in six weeks, in April Anthropic reported that more than 99% of everything it had found by then was still unpatched, and the engineers those flaws land on are the same engineers who got through 26% of CISA's list in a year.

The cybersecurity industry read the Mythos announcement as a spending bonanza, and said so. Seven days after Mythos was disclosed, SANS, the Cloud Security Alliance, [un]prompted and the OWASP GenAI Security Project released what the Alliance called an emergency strategy briefing, "The AI Vulnerability Storm: Building a Mythos-Ready Security Program", reviewed by more than 250 chief information security officers. In its own words, Mythos reaching the boardroom "opened the door for new resources and funding across the industry". The first of its three authors is the chief executive of Knostic, its first priority action names "OpenAnt from Knostic" among the tools to use, and it states that "All the listed authors and reviewers represent only themselves, and not their employer(s)". A week after that, Bain, citing its own "experience helping large organizations make a step change in their cybersecurity capabilities", told its clients that many would need to increase spending "by up to two times their current levels or even more".

The cybersecurity industry pointed the way in self-serving announcements, and in September Amodei's essay took it up, pushing for regulation of AI that would keep the industry in the hands of its current leaders by regulatory moat rather than competitive leadership. Altman agreed within five days, and Musk endorsed it. The industry had asked for its budgets to be doubled; the laboratories asked for the industry itself, and neither the budgets nor the moat touches what the record keeps showing, which is authority carried in a string that anything can copy.

The industry's briefing makes the comparison itself: "We have done this before. Y2K was a systemic threat with a hard deadline, and the industry met it through coordinated, disciplined effort. This is the same kind of problem, requiring the same kind of response". The same briefing calls what Mythos began "a permanent acceleration, not a temporary spike", and its last priority action is "a permanent Vulnerability Operations (VulnOps) function". The year 2000 was beaten because 1 January 2000 came and went and after it there was nothing left to fix, and the United States spent somewhere near $100 billion reaching that morning. No morning of that kind is coming for this one: the bill is $308 billion a year, it goes up by 11.8% every year, and no engineer anywhere is going to be told the list is finished.

Applying the foundation with greater urgency is the whole of the instruction, and all it can buy is systemic compromise deferred, expensively, for a time nobody can state.

Presidential Executive Order 14421

On 26 August 2026 the President of the United States declared a national emergency over the American bulk-power system. Executive Order 14421 is not about artificial intelligence and does not mention it. Its own statement of the hazard is equipment that may have "digital backdoors built into their systems that allow a foreign country to access that equipment remotely", and what it prohibits runs past the box itself to "any critical component, software, firmware, digital service, maintenance service, or remote-access capability", with implementing rules required within 120 days.

Read the last item on that list again, because that, not the hardware itself, is the entirety of the vulnerability. A remote-access capability is a standing way in: a path open before anybody uses it, open after they have gone, and open to whoever holds what it asks for, so that a party on another continent reaches a transformer and the transformer answers. The President of the United States has declared a national emergency over that path, named it in the same breath as the steel and the firmware, and prohibited it.

The order then asks where the path was made, which is a question answered once, at purchase. Nothing in the order requires that a single control command be authenticated, and nothing in the mandatory standards underneath it does either.

The North American Electric Reliability Corporation's critical infrastructure protection family governs who may connect, through what, with how many proofs of identity, and how a vendor's access is seen and cut off: CIP-005-7 requires an operator to route remote access through a staging machine, to require two proofs of identity for every such session, to know which of its vendors are connected at any moment and to be able to disconnect them, and CIP-013-2 requires supply chain plans, vendor breach notification and verification that software is what it claims to be. Searched against the whole family, no requirement makes a control system check a signature on an individual instruction before obeying it; the standards govern users, hosts and configurations, and leave whether this command was authorised to the protocol and to the operator.

The mechanism that would ask the other question, whether an instruction was authorised, was written years ago. Version 5 of DNP3 Secure Authentication, published by the DNP Users Group, moves authentication up the stack, in its own words, so that individual critical exchanges can be authenticated between controlling station and outstation, the device in the field it commands; it is specified, it is available, and it is required nowhere. Section 3 records the earlier occasions on which a mechanism that would have closed a route was specified and not adopted, and this is one more. The stated obstacle is the same one in every account of it: keys have to be given to devices and changed on them, across an estate of equipment in cabinets at the ends of roads, and a site visit to manage a key is slow and expensive.

Now put the question the order does ask against entry 50. Refrigeration controllers at hundreds of French supermarkets were driven into prolonged defrost overnight on 11 October 2026, and CERT-FR's instruction to every operator running the four affected product families was to take them off the internet, because for equipment past its security support "N'effectuer qu'un Reset Factory est dans ce cas insuffisant", a factory reset alone is insufficient, and the equipment "restera vulnérable et sera certainement de nouveau compromis", will remain vulnerable and will certainly be compromised again. The controllers were not Chinese. They were Danfoss, Copeland and Dixell, and the oldest of them had been declared end of life in May 2021 and was still answering from a public address five years later. An order about where a thing was made would not have reached one of them.

CERT-FR, Agence nationale de la sécurité des systèmes d'information, alert CERTFR-2026-ALE-012, first version 12 October 2026, read at source 15 and 30 October 2026.

The order came closer than any of the thirty-four, because it reached for the equipment and for the way into it rather than for the model, and it still stops one question short. A rule about origin asks once, before the equipment is energised: where was this made. The instruction arrives afterwards, every day, for as long as the asset runs, and between the answer and the instruction there is nothing.

What that gap requires is three things no control system on that grid has today:

  1. A register of which key may command which device and within what bounds;
  2. A signature over the individual instruction that the device checks before acting; and
  3. A record of the act that nobody can alter afterwards.

QPQ IaaS AG put exactly that to the Department of Energy in the docket the order opened, where the response is public.

Satya Nadella wrote the specification, then reached for a committee

Thirty-four attempts, eighteen supervisors in one list, two statements from six national agencies, and one survey of them all from the Bank for International Settlements. Between them they asked for faster patching, narrower privilege, better governance, reporting to the board, reporting of incidents, testing before release and a pause at the frontier. Outside the April sheet, not one of them asked what the artefact is, who issues it, what holding it permits, and why holding it permits anything at all.

"We need to separate the supply of intelligence from the authority over it." That is Satya Nadella, chairman and chief executive of Microsoft, writing on 10 October 2026 under the title "Models as Insider Risks in the Super Intelligence Era". He is writing about models rather than about credentials, he has no reason to be thinking about cookies or session tokens, and he has arrived at the distinction this document opens on: what a thing can reach and what a thing is permitted to do are two separate grants, and the fault is that the industry has run them together.

What he asks for follows from it, and he asks for a great deal. Assume a model is compromised and contain it from the start, he writes, because "any sufficiently capable actor with access to important systems can make mistakes or be compromised." An authorised person should always be able to pause or shut down a model mid-task, which he calls an emergency brake. Every meaningful model action should leave "tamper-proof human readable evidence", because "If it can't be observed, it can't be trusted!", and transparent model reasoning is "non-negotiable". The duty does not travel: "We simply can't outsource responsibility for what intelligence does on our behalf," and "a model provider's assurances do not relieve us of that responsibility."

He ends on the test: "The most trustworthy Super Intelligence system will not be the one with the model we trust most", because "It will be the one that enables us to trust the model the least".

Read that list as a specification and it has three requirements:

  1. Every act bound to the authority that permitted it;
  2. A record of the act that cannot be altered afterwards; and
  3. Nothing at all resting on the character of the thing acting.

What he reaches for to deliver them is the same organisational instrument the supervisors in the list above reach for: containment, controls around the model, and industry standards where the existing ones are insufficient. An organisation chart cannot check an instruction; the machine receiving the instruction can, if the instruction carries a signature made at the act, over the act, by the party whose authority it is.

17. Amodei's evidence is a credential document

None of the thirty-four above rests its case on an incident, but the loudest argument for them does. On 12 September Dario Amodei, Anthropic's chief executive, published the clearest statement of the restraint position, which holds that the danger lies in how capable the models become. Its thesis is that the industry must slow the pace at which it improves the capabilities of AI models, and its author is explicit that pacing should be measured on capability, with the worked threshold being a model capable of escaping or defeating most common sandboxing methods. He proposes three security measures:

  1. "Do not sell powerful AI chips or semiconductor manufacturing equipment to China, and crack down on chip smuggling operations and remote access to data centers outside China";
  2. "Crack down on unauthorized distillation by companies in authoritarian countries"; and
  3. "Strengthen security at the AI companies and prevent model weight theft".

The words credential, authentication and session do not appear in it.

Fourteen write-access credentials, a forged administrator and a signing key

The incident it rests that case on, entry 16, has its own report, published on 26 August by OpenAI, whose own agents, running in an evaluation, carried the intrusion out and whose own artefact repository was among the things they reached. The agents located publicly exposed Hugging Face user credentials on the internet. They reconstructed, validated and shared fourteen such credentials carrying write access. They harvested Kubernetes, database, messaging, code-repository and cloud credentials from Hugging Face workers. They used stored data files to extract credentials from production workers. They obtained a signing key and forged administrator credentials. They exploited a token-refresh flaw to reach administrator-level access on an artefact repository, and one shared system credential carried administrator rights across every cluster it reached.

The essay cites that report, which describes authority lying around in the open, shared across boundaries, recoverable from files, and forgeable where a signing key was reached. Every finding in it is an artefact sitting where it should not have been. What the essay takes from it is that the models were too capable.

What a weight is, and why a published one cannot be recalled

The second measure asks for a crackdown on distillation. Distillation trains one model on the outputs of another: question the leader's model at scale, keep what it answers, and train your own on the answers, so that what the leader paid for in research and compute the follower buys with an API bill.

A model is a very large table of numbers, learned during training, and those numbers are the model; everything else is machinery for running them. The trade calls them the weights. A closed model keeps its weights on the provider's own machines, so a question goes out, an answer comes back, and every exchange is metered, logged and refusable. An open-weight model publishes the numbers, and anyone may download them and run the model on hardware they own, for as long as they like, with no account, no bill and nobody's permission to ask for. Open source and open weight are not the same thing: open source, on the Open Source Initiative's definition, publishes the code that trained the model and enough about its data for a skilled person to build a substantially equivalent system, open weight publishes only the finished numbers, and when the Initiative tested its definition, Llama 2, Grok, Phi-2 and Mixtral all failed it.

Training and running are different costs, and the three measures confuse them. Training is where the billions go, which is why chips, compute and weights are worth controlling. Running is cheap and getting cheaper, and Section 9 prices it: across the tasks that both models in a pair solved every time, Opus 4.5 cost $12.50 a task against DeepSeek V4-Pro's $0.28, and an attacker who has downloaded the weights pays no rent at all, buying a machine once and paying for the electricity it draws. A control over who may train reaches nothing about who may run what has already been published. An export authority can stop a shipment of chips at a port; it cannot stop a file that has already been downloaded.

Amodei answered this himself, and he is right about training

Open weights, Amodei wrote on 15 August 2026, "do help some with this but are nowhere near a sufficient solution", because they "simply shift the concentration somewhat to those with the most compute and chips", artificial intelligence being "structurally a technology that tends to concentrate power, for reasons that have nothing to do with regulation". Whilst he is right about training, training is not where the record of compromise is to be found. The AI Security Institute has measured the gap: it puts the most cyber-capable open-weight model it could find four to seven months behind the frontier, against the six to ten months it measured across 2025.

Read the three measures for what they protect rather than for what they fear, and chips kept from China is the laboratories' hardware advantage kept, distillation blocked is their lead kept, and weight theft prevented is the asset kept. Not one of the three touches the credential the cited incident turned on, and not one of them reaches a model whose weights are already published. The essay records that Anthropic "has consistently advocated for all of these measures, because we've always understood that they would be essential to any pacing", which places the three asks before the argument now offered for them. Pacing itself, measured on capability and certified before release, is a gate that an incumbent can staff and an entrant cannot, and within five days of the essay Sam Altman, OpenAI's chief executive, had agreed to take similar steps and Elon Musk had endorsed the proposal, which is three of the largest producers agreeing the rate at which the product will improve.

Three undertakings agreed the rate, then asked for a statute

European competition law bans competitors from agreeing among themselves to hold back technical development. Article 101 of the Treaty on the Functioning of the European Union prohibits agreements between undertakings, which is the law's word for companies, that limit or control production, markets, technical development or investment.

Amodei proposed holding it back on 12 September, Altman agreed within five days, and Musk endorsed it; no statute was needed for any of that. What the three now ask legislatures to do is write that agreement into law, and whether a law the parties asked for cures an agreement the Treaty would otherwise prohibit is the question their proposal raises. The essay names the accusation itself, listing what its author expects to be called, "even when this gets us accused of hype, 'doomerism', or regulatory capture", and does not answer it.

The Center for Strategic and International Studies wrote within the week that the coalescence "would only feed claims that AI companies are using scare tactics and fearmongering to obtain beneficial regulation and strangle potential competitors".

The railroads asked for the regulator

The pattern is older than the industry. George Stigler, the Chicago economist, found in 1971 that as a rule regulation is acquired by the industry and is designed and operated primarily for its benefit. Gabriel Kolko, writing on the American railroads, found that the railroads and not the farmers or the shippers were the most important single advocates of federal regulation from 1877 to 1916, because a federal rule secured the rate and profit stability they could not hold by their own action. Bruce Yandle, an American economist, gave the pattern its name from the Sunday closing laws: the Baptists wanted the legal sale of drink stopped on a Sunday because drink was a sin, the bootleggers wanted it stopped because a day with no legal seller was a day's trade of their own, and the two lobbied for the same statute with no insincerity required of either.

What the essay asks for is self-serving on its face, because the three measures would leave its author's own company holding exactly the advantages it holds today.

Seventeen days later, a competitor called it a cover

Mistral's chief executive said as much in public. Arthur Mensch runs the French laboratory that raised €3 billion in September 2026 at a valuation above €21 billion to spend on frontier research and training compute, and that publishes the weights of its models. Seventeen days after the essay he told CNBC that "the debate that we've seen in the U.S. has been a cover for the negligence of some of our competitors".

His commercial objection is the one this document has been making about credentials, moved one layer up: a closed model hands its provider "immense leverage" over the customer's business, the provider sees and learns from the data the customer connects to it, and at Abu Dhabi in October he put the practical position at "99% of the use cases that we deal with today can be addressed with open models" and "there is no reason why you should pay the API markup for closed models".

He does not claim that open weights will overtake the frontier, and he expects only that they will "challenge many of the closed models that are out there". What he claims is that a customer should not have to rent its own capability from a party that can meter it, log it and withdraw it, which is the argument of Sections 1 to 13 applied to a model rather than to a session cookie.

OpenAI made the argument a third time, over its own forensic record

OpenAI has been here before Anthropic. The document it sent European officials in the autumn of 2022 said in writing that its model was not, by itself, a high-risk system, and the wording that would have made it one did not survive into the final Act. Set that beside the warning about regulatory capture the same company gave the Senate the following May, and OpenAI has made the argument against itself twice, once to a regulator and once to a legislature.

On 21 October OpenAI made it a third time, in a blueprint it calls Democratic governance of frontier AI, part II: Empowering cyber defenders, and this time over its own incident, the one its own technical report had already taken apart in August. That report is a record of credentials from first to last: on 26 June OpenAI's agents reached OpenAI's own artefact repository through a legacy credential endpoint, with a credential shared across the environment, and came away holding an administrator token the repository had signed for them; OpenAI's monitoring noticed nine days later; on 10 July one of its agents found fourteen Hugging Face credentials lying in a public dataset; and the agents passed what they found to one another on a message board before any of them used it. The blueprint tells governments that the breach "was driven by misalignment: models pursuing their assigned tasks through actions outside their intended scope and permissions". That moves the fault out of OpenAI's own estate, where a shared credential and a legacy endpoint could have been retired by any competent administrator, and into the character of a model, where only the laboratory that built it can be asked to answer for it.

OpenAI, "Democratic governance of frontier AI, part II: A blueprint for empowering cyber defenders", 21 October 2026, read at source 30 October 2026.

What it asks governments for follows from that diagnosis, and every item of it returns to the company that made it. It asks Congress "to urgently enact mandatory, capability-based national AI safety regulation", which is the gate an incumbent already stands beyond. It asks for the frontier to be paced by "collective action among frontier labs with government interventions that shift incentives", which is competitors agreeing the pace of technical development, the conduct Article 101 names, and it promises "concrete policy proposals for pacing the frontier soon". It asks governments to fund a national cybersecurity modernisation effort, led in the United States by CISA, in which organisations are helped to secure their systems "building on initiatives such as OpenAI's Daybreak" and access is arranged "through agreements with multiple providers", a market OpenAI has already seeded with "a $1 billion commitment to expand subsidized Daybreak access" and with "Trusted Access for Cyber partnerships" with Australia, Canada, France, Germany, Japan, South Korea, Poland and the institutions of the European Union, its cybersecurity agency among them. The remedy it asks the public to pay for is a market for what it sells.

Its rule for reporting keeps its own laboratory out of the government's sight. Behaviour "elicited and contained during controlled safety evaluations should not independently trigger mandatory government reporting", and the events it names as reportable are harm to a third party's confidential information or systems and "model-weight security breaches", so a developer's estate broken open by its own models during its own evaluation is not among them. Its own incident began in exactly that place, and what makes it reportable under the rule OpenAI proposes is that its agents did not stop at OpenAI's own door.

The word credential appears in the blueprint once, in its list of what the same capabilities can help malicious actors do, "steal credentials, exploit vulnerabilities, and accelerate attacks", and the words authentication and session do not appear at all. Identity gets a single paragraph, under the heading Identify agents, and there, against a refrain of acting now that runs through the rest of it, the blueprint asks governments to wait: identifying agents "is a protocol-level issue, balancing trade-offs of privacy, accessibility, security, and competition", "we first need to mature the standards that inform how those trade-offs will be managed", and enforcement before then "can lead to a less open and democratic internet, and reduce consumer utility and protection", so the work goes to NIST's National Cybersecurity Center of Excellence and to the IETF, the W3C and the FIDO Alliance. Every obligation that falls on the model is urgent, and the one obligation that would make every agent on the web, OpenAI's own among them, say whose it is and on whose decision it acts is the one that has to wait.

Read the blueprint for what it protects rather than for what it fears, and capability-based regulation is the incumbent's gate kept, collective action among frontier laboratories is the rate agreed between competitors, the modernisation programme is a public budget spent on a private product, the reporting rule is the laboratory's own estate kept out of sight, and identity deferred is its agents left free to act on the web without saying for whom. Not one of the five reaches the shared credential, the legacy endpoint or the fourteen credentials in a public dataset that its own report found. Amodei's essay took another company's forensic record and recast it to serve his own; OpenAI has taken its own, and published the record and the recasting eight weeks apart.

$965 billion and $852 billion, valued on the capability to be paced

Security spending this year runs to $308 billion on IDC's forecast, which is three times what the United States spent on the year 2000 problem in total, and that is every year. The two laboratories whose chief executives are asking for the rules were both valued in June, three months before the essay; Elon Musk, who endorsed the proposal, is not among them, because xAI was merged into SpaceX in February 2026 and no valuation attaches to it on its own: the market prices it only inside SpaceX, which has traded on Nasdaq since 12 June 2026.

LaboratoryRoundPost-money valuation
Anthropic$65 billion Series H, and a confidential filing for a listing$965 billion
OpenAI$122 billion$852 billion

Anthropic has filed confidentially for a listing and OpenAI has yet to do so at the time of writing. Neither yet answers to a public market, and both were valued on the capability the essay proposes to pace.

The evidence offered for pacing capability is a credential document, and Part III is fifty-eight instances of the same thing: take every model out of it and the credentials are still lying where that report found them.

PART V: THE CURE, AND OUR INTEREST IN IT

18. Issue nothing that carries authority

Three properties of the web stand behind everything in Parts I and II:

  1. The web copies everything that crosses it, perfectly and by design, so what stands in for the right to act is a string of characters that can be in two places at once, and no examination of a copy distinguishes it from the thing it stands for, so whoever holds one holds the authority;
  2. The deciding happens in a browser, a machine built to run code written by people the holder has never met, and that is the reason the thing exists rather than a defect anybody is working on; a decision needs a room with nobody else in it, and the browser is a room that anybody able to get code into it has already entered;
  3. The code in that room was chosen by nobody, because it came down a tree of several thousand packages that a single command fetched from a public registry, none of it approved and none of it read.

Section 1 also set the test those three properties deny. Access need not be singular, because a way in may stand for many events, and a service demanding fresh proof at every click would be unusable. Authority is the opposite, because an authorisation is not an object but an event: a person decided, once, at a moment, and a thing that happened once cannot be stood up by a thing that exists in unlimited numbers. So authority carries two requirements that access does not: it must be singular, and it must be asked for separately, by a question of its own about this act rather than about the holder's right of access.

That is the second lock, the one the banks have always had on their vaults. Section 7 tests the whole catalogue of defences against those two requirements, and every one of them fails both. None makes the artefact singular: a token with five minutes to live is still a copy standing in for a decision. None asks the second question either, because every one of them works on the artefact, which is the single thing answering both questions at once, so improving it improves the answer about access and leaves authority unasked.

One change answers all three properties, because it removes the same thing from each. Authority stops being a string a service stored and becomes a signature the holder makes, at the moment of the act, over the instruction in front of them.

Out of the room

A dead drop is the arrangement spies use when nothing can be handed over: one party leaves the package at an agreed place, the other collects it later, and the two never meet, so there is no meeting for anybody to watch. The instruction is left at an address in exactly that way, randomised and valid for a window the implementer sets, usually 30 seconds to 3 minutes, and carrying that address is the whole of the browser's part.

At the login, where the service does not yet know who is arriving, whoever lifts the address and runs ahead of the holder can do nothing with the instruction, because signing is the only thing it is good for and signing needs the holder's key, so they either fail to access anything or sign into their own account with the issuer and get no further.

An authority instruction comes after it, by which time the service knows which key it is dealing with and composes the instruction for that key alone, so no other signature answers it and an interceptor holds something they cannot sign.

The holder's own signing application goes and collects the instruction, and the browser and that application never address each other, so there is nothing running between them to intercept. The application displays the instruction in plain words on the holder's own screen, takes the signature over it, and puts the signature back at the address for the service that composed it to read, with nothing typed into a page and nothing injected into one.

In the course of the operation the key does not leave the device holding it, is never present in the browser, and does not transit a network.

The drop is a place and the two parties never meet. What an interceptor takes is an address about to expire and an instruction only one key can sign.

That application must not bring the third property with it, or the decision has only changed rooms. Accordingly:

  • Its source must be published, so that an institution relying on it can have it read rather than take somebody's word for what is inside.
  • It must have been built rather than assembled, with no dependency tree at all, because an application that reaches into a public registry for the parts nobody wanted to write has carried the whole problem across with it.
  • It must be a native application on the device rather than a web application in a native wrapper, because Section 1 counted the wrapped browser among the three places the graph lands and a signing application built that way is a browser by another name.
  • The key must be held and used inside the protected key hardware the platform provides for the purpose, Apple's Secure Enclave, Android's StrongBox, or a trusted platform module in a terminal, laptop or desktop, which is the least that is acceptable rather than the most that is possible.

What is signed is what was shown

The holder is asked a question of its own, about this act: this payee, this amount, this action, set out in full before they approve it. What they sign and what they were shown are the same object, so a payload that rewrites a destination has nothing to rewrite that they will not see.

At the other end the service accepts only a signature over the message it composed itself, so a different instruction, however properly signed, is refused.

Nothing stored between acts

A credential is a direct debit on the holder's authority. They sign once, the permission stays on file, what is taken afterwards is settled by somebody else, and they learn that the permission was abused from the statement, after the money has gone. None of that is a failure of the bank, which honours the mandate because honouring mandates is what it is for, and every system in Parts II and III honoured its stolen credential just as faithfully.

There is no mandate here. A service may still set a session so that a person is not signing in at every click, and that session carries access and no more; authority is a fresh signature made at the moment of the action, and between actions there is none to take.

A stolen session is then a stolen way in and never the power to act. There is no store of authority to raid, and what the relying party holds is a public key, which is public by nature and worth nothing to whoever takes it. The medium still copies whatever it is given, and what it is given is no longer the power to act.

Which operations call for that signature is a new question, because until now there has been nothing to ask it about: one instrument answered both jobs, so every act rode on the way in. The list is the institution's to set, operation by operation, because what is consequential in a land registry is not what is consequential in a dealing room. Opening a file might ride on the session and downloading it might not, while changing the address on an account, moving money or granting somebody else a right of access will almost certainly require a fresh authority signature. Nobody outside the institution can set that list, and nothing outside it should be able to shorten that list for it.

The decision, not the keystroke

An instruction can be a single event: this payee, this amount, this moment. It can be an intent that one decision covers, such as send this message to these hundred clients, where one signature carries the hundred acts that follow because the hundred are what the holder read and approved. Or it can be a category, the bounds inside which an agent may act, set once by a named human in a contract on the chain and revocable in a single recorded act. All three are singular: each is a decision made once by a holder who saw what they were deciding, and none is a standing permission that outlives it.

19. One instruction, one signature on the device that holds the key

What GRIDS is

GRIDS is Gajumaru Remote Instruction Dispatch Serialisation. It authenticates a person, or confirms an action, by a one-off cryptographic signature made on that person's own device over one specific instruction. The signing key sits in the device's secure hardware. In the course of an operation it does not leave the device holding it, is never present in the browser, and does not transit a network, and no function of the device or of its use exports it. A holder may hold the same key on more than one of their own devices, and may move or restore it through the mnemonic.

A successful authentication leaves an access grant behind it, as every authentication does, and the institution sets how long it lasts, from a single use upward. It carries presence and at most a public key, so a theft of it yields a session and never an identity, and it authorises nothing, because every authority decision takes a fresh signature from the key that access belongs to.

The clients that do the signing are GajuDesk on the desktop and GajuMobile on a telephone, with GajuSign at Section 20 to come. Both are native applications working from the platform's own protected key hardware rather than web applications inside a native wrapper. Neither was assembled: they were built from scratch, so there is no dependency tree to inherit and no public registry anywhere in either of them. Their source is published, so an institution that would rather read them than be told about them can do that.

The key is the holder's

The mnemonic is the key itself written out in base 4096, in a form a person can write on paper, and not a seed from which the key was once derived. It is stored nowhere on any device: it is computed for display when the holder asks for it and decoded when they enter it, so there is nothing beside the key for an attacker to find, and a stolen device yields a locked client and nothing else. In GajuDesk and in GajuMobile the holder can delete the account their keys are held in, after which no account exists on that device and no key with it, public or private, and they can add it back by entering the mnemonic. A key is never stranded on a device: it is where its holder wants it, or nowhere.

The key is generated by its holder and issued by nobody, and we never hold it, never see it and could not produce it. GRIDS is published under GPL3 and has been in commercial use securing access and operations on the Gajumaru's own services since 24 March 2025, on Groot, which has been operational since 22 October 2024.

What the drop carries

What the drop carries need not be a set of fields agreed in advance. Whoever asks for the signature composes the instruction, so an institution that wants a signature over a permission change, a record disclosure, a release to production or a delegation to an agent writes that instruction, and the holder sees it decoded and displayed in plain words on their own screen. There is no field to add to a specification and no committee to persuade.

The instruction can be read in full before it is signed because the signing happens in a native application on the holder's own device, with its own screen and no browser anywhere in it.

The address the drop sits at is randomised and short-lived, and in our present commercial use we set its life at ninety seconds. An institution that wants the instruction itself encrypted, so that only the holder's key will open it, can have that wherever the key is already known, which is every authority decision, and the network already does it that way in GajuExpress and in the State Channel market. It is not needed to make the drop safe; it is there for the institution whose own rules require it.

Three ways to adopt it, and who stands in the path

Three arrangements are possible. They run the same protocol, over the same clients and the same key, and they differ in three things: who stands in the path, what the charge is, and what the record holds.

On direct GRIDS nobody stands in the path: the relying party composes the instruction, the holder reads it and signs it in their own client, the relying party verifies the signature against the public key it holds, and no operator and no external service's availability enters the transaction.

GajuAuth is a drop-in OAuth 2.0 access point to GRIDS, and on it we stand in the path, running GRIDS behind an OAuth 2.0 server and returning a standard access token, and we meter the events. For every operation the institution has chosen to protect, that token carries access only, because authority is a fresh signature no stolen token can produce. Operations the institution has not chosen to protect run on the token as they did before, which is the institution's setting and not a property of the protocol.

Where the institution or the jurisdiction runs the chain itself, it is the operator, and the chain adds an immutable event log of every access and every authority, innate to the ledger rather than reconstructed from scattered logs. The capability is operational; a given institution's chain is a build.

What adopting it involves

GajuAuth is not required, because an application can use GRIDS directly. It exists because an institution almost always already runs an OAuth 2.0 or OpenID Connect estate for its logins, and GajuAuth lets that estate reach GRIDS without being rebuilt: the institution points its existing configuration at our servers and selects which operations invoke a GRIDS signature.

The institution then wires the operations that matter most to a signature, which is work in its own applications, and it builds its own chain behind that, so the time goes on removing the artefact from the acts that carry authority rather than on waiting for a build to finish before anything changes. Taking it in that order matters, because the six-month window is not long enough to build first and protect afterwards while the threat accelerates.

For a large institution that is a transition; for a business or an individual for whom running a chain is more than they need, GajuAuth is the answer itself rather than a stage towards one.

Nothing in that asks anybody's permission. The browser only displays an address, and the signing application only retrieves from that address, displays what it finds, takes the holder's signature over it, and puts that signature back. Displaying an address and following a link are what a browser has done since there were browsers, so there is nothing to add to Chrome, to Safari, to iOS or to Android, and no vendor's roadmap decides whether an institution may bind a signature to an act. How the address is carried does not decide it either: the address crosses optically to GajuMobile and as a URL into GajuDesk, the protocol holds in both, and no third-party interface has to be implemented or permission gained before any of it works.

Section 4 set out the three things both earlier attempts needed and could not get:

  1. A capability inside the browser that only the browser makers can put there;
  2. A display on the device that signs, which a token with a button does not have;
  3. A definition settled in advance, so that a payee, an amount and a currency could be named identically everywhere.

None of the three is needed here, because the browser's part is a link, the display is the holder's own screen, and the instruction is whatever the party asking for it composed. What stopped both attempts was that nobody in the chain could move alone; here nobody in the chain has to move at all.

Why it is published

We could have held a licence and a gate; we published the protocol instead. GRIDS is published under GPL3, which is a copyleft licence: anyone may take the code, run it, change it and ship their own, on the one condition the licence imposes, that what they build on it is published on the same terms. An institution may take it, run it on its own chain, and pay us nothing for it or for any signature it makes there. Where an organisation cannot publish its own source, because its policies forbid it or because the work is its own commercial property, a commercial licence can be negotiated and it is paid for.

In Section 17 the laboratories asking legislatures to restrict what anybody else may publish are the ones that publish neither their frontier weights nor the code that produced them. What we gain is that the tools people sign with come into general use, and that follows from the thing working rather than from anybody's agreement to let it work. Our interest is the digitalisation this makes possible, and the commercialisation of what we built is ours to lead.

Nothing in it waits on us

The stored credential goes, because what the institution holds is a public key and the holder's own key never reaches it, so the store of credentials the malware-free intruder logs in against does not exist. Access separates from mandate, which Section 1 set out as the property the web has never had. Nothing in that waits on us, on a vendor, or on a standards body: it waits on an institution deciding which of its own acts are worth a signature.

20. Signing leaves the browser, then the network

Five stages take the signing further from the machine that can be compromised, and at every one of them the key is the holder's.

Stage 1, GajuDesk

The signing function leaves the browser, and the desktop client that does it, GajuDesk, is operational and has been since March 2025.

The browser displays the address of the drop and does nothing else with it, and the holder copies it into GajuDesk by hand or by a copy function. GajuDesk fetches the instruction from that address, displays it in plain words, takes the holder's signature over it, and puts the signature back at the address for the service that composed it to read. Neither the browser nor the signing client ever addresses the other, so there is nothing running between them to intercept.

The key is held in the protected key hardware the platform already provides: a secure element on most telephones, a trusted platform module on most laptops, or the equivalent. At this stage the instruction is displayed and signed on the same computer, so whoever controls that computer controls both what the holder is shown and what they are asked to sign. Exploiting that takes control of your computer itself, not of the browser or of anything the browser holds, so the risk is small, and Stage 2 removes even that by moving the signing to a device that computer has no path to.

Stage 2, GajuMobile

The signing moves to a second device, and the client that does it, GajuMobile, is operational on Android with iOS by the end of 2026. What crosses from the desktop screen to the telephone is the address, as light, which means as a code on the screen read by the telephone's camera. That crossing is the air gap: the two machines never address each other, nothing passes between them but a code on a screen, and in the course of the operation the key does not transit a network.

From there the telephone does what GajuDesk does, fetching the instruction from that address itself, displaying it in plain words, taking the holder's signature over it, and putting the signature back at the address for the service to read.

A compromised computer is then neither the machine that displays the instruction nor the machine that signs, and it has no path to the one that does.

Exploiting this stage means breaking into your telephone itself, a second device the attacker does not hold, over its network connection, so the risk is very small, and Stage 3 takes even that away, because the device that signs no longer needs to be online at all.

Stage 3, the optical exchange

The exchange itself leaves the network, and it is expected in the first quarter of 2027.

The instruction crosses as light, encoded in the code on the desktop screen; the holder reads it in plain words on the telephone and signs it there, and the signature crosses back the same way, from the telephone's screen into the desktop's camera.

What is signed is still what was shown; what changes is that neither has to cross a network to get there. A handset with its radios closed off can become an offline signing device, and so can an old one kept in a drawer for that single purpose, which puts a dedicated signer in reach of anybody who has ever replaced a telephone.

Nothing in it requires the device to be ours: the protocol is published, so Samsung, Sony or Apple could build a handset or a dedicated device of their own without any permission of ours. A telephone in airline mode is still a telephone, carrying its operating system and whatever was ever installed on it, and it can be taken out of airline mode again, which is why Stage 4 specifies a device that does nothing but sign.

Stage 4, GajuSign

A dedicated signing device, GajuSign, is specified and planned for production. It takes the form of a bank card, six to ten millimetres thick: on the front a screen to show the instruction in plain words and a camera to read the code it arrived in, on the back a pad to feel for a living thumb, and nowhere on it any Wi-Fi, Bluetooth, cellular radio, contactless chip of the kind an ordinary bank card carries, or socket to plug anything into. The account arrives on it as it arrives on any other device the holder uses, by the mnemonic, shown as a code by GajuDesk or GajuMobile on a screen the holder already owns and controls, read by the card with the same camera that reads its instructions, and confirmed by using it, because a card holding the wrong key cannot produce a signature that validates.

The holder can take an account off again, and a card holding none is inert until one is scanned back in. Light goes in, light comes out, and nothing else ever crosses it. A telephone does a thousand things and signs as one of them; this would do nothing else at all.

What that would remove is the general-purpose machine: no operating system carrying anything else, no application installed for some other purpose, and no network for anything to arrive over, so nothing on the device to compromise and nothing it could be persuaded to do.

The pad on the back reaches further still, because it reads the holder rather than the holding of the device, and a signature taken under duress stops being the same event as one given freely. Links of that kind can be stacked as far as a holder wants them, from a living thumb to the pattern of a pulse under stress. Further security measures will come as modules the buyer chooses, once production begins.

Stage 5, GajuSign made and attested locally

The last stage is planned, and it adds two things to the Stage 4 device: a verified record of the device's own origin and manufacture, and the option of manufacturing inside the jurisdiction that relies on it.

What that answers is at entry 49. A component fitted inside genuine Ledger signing devices read the twenty-four words of the recovery phrase off the device's own screen at the one moment the device has to display them, and sent them out over a mobile network. Nothing was done to the chip, the operating system or the signatures. The devices were real, they were bought from resellers, and they worked exactly as Ledger built them to work.

Ledger offers a check for exactly this, and its own statement of the check's limit is that it cannot detect unauthorised physical modifications to the hardware where the secure element is intact. The check ran, it proved the chip was authentic, and the authenticity of the chip was never the question.

What Ledger did next was channel discipline: returned devices never resold, no shelf displays, stock handed over at the point of purchase, and sales paused through the affected resellers. Every one of those is a rule for somebody else to keep, in a distribution network that runs through resellers in South East Asia and Hong Kong and a third-party seller on Amazon Japan shipping parcels from Malaysia, and the only check the buyer can run cannot see the implant.

A record of manufacture moves the check from the channel to the device. Every component and every item of firmware is specified, and the record names which part and which version belongs in that device. What the device holds now is compared against that record, so an added component shows as a mismatch, and the buyer makes that comparison themselves rather than taking a shop's word for it.

Manufacturing inside the jurisdiction answers the other half. An institution that cannot accept a supply chain running through another country, a government agency among them, gets the device built inside its own and, where it asks, built for it alone to the specification it requires, so that nobody has to take on trust that it holds no hidden capability and no door that was never asked for.

Where that leaves the key

The research at Section 12 pulls a key out of the protected key hardware the platform provides by watching the chip while it works, which is the class Intel and AMD each expressly decline to mitigate, and it needs the key to be in the hardware when the attacker reaches it.

The mnemonic is the key itself, so a holder can add the account, sign once and delete the account again, which leaves a window the length of one act rather than the life of the machine, at the cost of entering the mnemonic every time they do it. Stage 4 is the answer where that cost will not do, because a device with no other job and no path in but light gives an attacker nothing to reach it through.

A holder who can use a key can give it away. A password cannot be revoked from a holder's memory either, and nothing on the market revokes a credential from the person trusted with it. Here there is nothing to revoke at all, since there is no record of authority to revoke it from: the mnemonic is the possession, and holding it is the authority. The price of that is a central switch nobody can throw, ours included. What it buys is that there is no record anywhere to alter, forge or breach, so nobody takes authority over a holder by reaching a server, and a key given away is one account's key, since each account is its own key and its own mnemonic.

One protection sits above all five stages and needs no hardware at all. A holder can commit the mnemonic to memory and keep no copy anywhere, putting it on whatever device is in front of them for as long as the signing takes. There is then no device to take, no chip to watch while it works, and nothing for a search to find. What that costs is that a forgotten mnemonic is an unrecoverable key, because there is nobody holding a copy to ask. A holder who has memorised it is the key.

21. The five routes against one signature

Part II set out five routes and Part III marked fifty-eight incidents against them. One property closes them: authority is a signature made at the act rather than a string held between acts.

Everything described is operational today unless the passage says otherwise, and where a route is bounded rather than prevented the passage says that too. One case is met by nothing here, and entry 39 sets it out: an institution that hands over records to a request it believes is genuine has made a decision, and no protocol reaches a decision made in good faith.

Route one, taken - somebody else holds the credential:

  • A session token copied after a successful multi-factor authentication - The token carries access only. Access comes first and it establishes which key is present; authority comes second, and the instruction is composed for that key alone, so no other signature answers it and whoever holds a stolen token does not hold the key named in it. The token holds at most a public key, so a theft yields a session and never an identity, and its life is the institution's to set from single use upward, at which setting no standing session exists at all.
  • Long-lived service accounts, cloud roles and pipeline tokens carrying broad ambient authority, which comes with the account rather than with the act - One human signature sets bounded authority in place of standing authority. The agent acts inside explicit limits, every action is a ledger event written into the record of the network or the chain as it happens, and the authority is revocable by the same human.
  • The credential store as a breach target and as a data-protection estate - The institution holds a public key, and the protocol requires it to retain nothing else. Whatever it binds to that key is private to it, never travels, and is held under its own obligations rather than ours.
  • Remote extraction of the signing key - With GajuMobile the address crosses optically and the two machines never address each other, so a compromised computer has no path to the device holding the key, and in the course of the operation the key does not transit a network. Reaching the key means reaching that device.
  • Extraction from the enclave, the class Intel and AMD each decline to mitigate - What extraction yields is whatever the holder could authorise from that moment, and no store of past authority at all, because no artefact persists between actions. It needs the key resident when the attacker arrives, and the holder can add the account, sign once and delete it again, so residence lasts as long as they choose. GajuSign answers the vector outright, with hardware that has no other job and no way in but light, and it is in development.

Route two, granted - the attacker is issued a credential of their own:

  • An account registered by the attacker at a portal that accepts the registration - An account is worth nothing without a key the relying party recognises, and permission is decided against the key before any signature is sought. Where the institution runs the chain itself, the key must be on the list the contract enforces, so the account is not a participant at all, and that chain is built for that institution alone.
  • The attacker-enrolled credential, where the victim registers nothing while an operator enrols a credential of their own - There is no binding ceremony an attacker can stage to any effect. The key is generated on the holder's device and the institution receives a public key, so steering the victim produces nothing, and a signature requires the holder's own key, which the institution never receives.
  • Recovery paths weaker than the credential they restore - No standing recovery secret exists to phish, so there is nothing to steal from a recovery path. What remains is the identity proofing the authority performs before it re-binds, which is that authority's process and not ours, and entry 33 is a market selling, in bulk, the documents that proofing asks for.

Route three, inherited - the login works and what it produces is taken:

  • The session that carries standing authority the system infers from a login - There is no standing authority in a session to inherit. Access and mandate are separate objects, and the mandate is made at the act, so what a successful login produces is a way back in and never the power to act. This is the route a second factor at the door cannot close, because the second factor is at the door and the thing taken is what the door issued afterwards.

Route four, obeyed - an instruction arrives and the machine acts on it:

  • A prompt injection, which is an instruction hidden inside content a machine will read, a poisoned configuration file, a forged build message, a pipeline executing what it is given - One human signature sets the bounds in a contract, and every action inside those bounds is a ledger event attributable to the key that made it. An instruction carrying no signature carries no authority, whatever it claims to be, and an agent that declares itself authorised has declared nothing, because its authorisation is a condition of the transaction's validity, evaluated against a contract a named human signed. An instruction that redirects an agent inside the bounds it already holds is not stopped by this; it is confined to them, and the bounds are what a human set by signature on the contract and removes the same way.

Route five, believed - the check runs and proves the wrong thing:

  • A token whose header instructs the verifier not to check it - Nothing in GRIDS tells a verifier how to verify. The scheme is a property of the account and the relying party holds the key, so there is no field a presenter can set. Changing what an account accepts means changing its contract, which is itself a signed and recorded authority event.
  • A genuine attestation that proves process where authorisation was wanted - Publishing is an authority event needing a fresh signature over the publishing instruction, from a key held by a person rather than by the pipeline. The attestation stays true and goes on answering a different question; the release does not happen, because the pipeline cannot produce the one thing that would authorise it.
  • Authority by apparent consensus, where a second approver is manufactured at no cost - Each approval is a signature from a key bound to a verified holder, so a second approver costs a second holder, and the count stops being a count of accounts and becomes a count of people. Binding a key to a verified holder is operational today.
  • Default-accept and misconfigured authentication, a service that validates nothing - There is no credential to present and no acceptance decision to misconfigure. Verification is a signature check against a public key the relying party holds, and absent a valid signature over the instruction nothing proceeds.

Across all five:

  • The browser-resident attack, extensions and injected script rewriting the page before the holder sees it - The signature is never made in the browser, and there is never a plug-in. The instruction arrives as a drop at a short-lived address of its own, is displayed in plain words on the holder's own screen, and only a signature returns, so an injected script that reads the drop has read something it cannot use.
  • A platform owner who can withdraw the identity - The key is generated by its holder and issued by nobody, and it cannot be withdrawn by a platform owner in the way Apple, Google and Microsoft can each withdraw the identities they issue. Groot has carried this since 22 October 2024 and the Gajumaru reached Main Net on 26 April 2026.

22. Everything on offer defers the problem and multiplies the cost

Part III is the record of what happens while the problem is deferred. Fifty-eight incidents in six months, and in thirty-eight of them somebody held a credential that was not theirs. Lithuania's register answered a caller presenting the Migration Department's valid login, and went on answering for months. Romania kept its own administration passwords in recoverable form inside the product bought to protect them. Liechtenstein issued a register account to a stranger and then honoured it exactly as designed. Denmark honoured a search access it had lawfully granted to a company, used by somebody who was not that company. In none of the four was any cryptography defeated, and in more than half of the fifty-eight no AI model was involved anywhere. Every one of those systems did what it was built to do.

Sixteen functions are on sale against that. Here they are at their best, with the names an institution's procurement function would shortlist, and with what each one cannot do.

The sixteen on sale

Customer identity

The authorisation server and the user pool, with adaptive authentication and compromised-credential detection built around them, which the trade calls customer identity and access management. It lets a bank's customers in at scale and decides, from device, location and spending history, how hard to ask. What it cannot do is stop holding the credential, because the product is a defended store of secrets about people, and its risk engine infers whether the holder is the right person rather than establishing it. Amazon sells it as Cognito and Microsoft as Entra External ID, with Auth0 inside Okta and Ping with ForgeRock selling it to everybody else.

The message channel

Carrier delivery of the one-time code, and the interconnect fees beneath it. It exists so that a second factor can reach somebody who has nothing but a telephone number, which is most of a retail bank's customers. A code that arrives proves the telephone received it and nothing about who decided anything, and it is billed on the attempt whether it arrives or not, so an attacker running codes at a victim's number puts their own traffic on the victim's invoice. Twilio and its equivalents carry it.

Push and authenticator factors

A prompt pushed to a telephone, or a six-digit code computed from a seed the server holds as well. It is what an institution reaches for when it wants a second factor that does not travel over a carrier. It asks the same thing the password asked: the prompt says somebody is signing in, and what it collects is a tap, so an attacker who already has the password sends prompts until one is accepted. A seed the server also holds is a shared secret by construction. Cisco Duo leads it, and the factor is usually inside the workforce licence an institution already pays for.

Hardware tokens

The credential is put inside a physical object the holder carries, so that an attacker who never touches the holder cannot reach it. It is the strongest thing on this list at what it does, and Section 13 sets out why: nothing published has read a private key out of a secure element and nothing syncs to a provider. Two things defeat it: a key in the state it ships in asserts on a touch for every account registered on it, so the object is enough for whoever picks it up; and the firmware is fixed at manufacture, Yubico programming it in its own facilities and stating that "Once programmed, YubiKeys cannot be updated to another version", so a change in the cryptography is a replacement programme across every key an institution ever issued. It is bought per person, so a second key for one holder is a second purchase and a key for a machine is not sold at all. Yubico leads it, with Feitian, Thales and Google beside them, and Tokenize advertises the opposite for its Token Ring, which takes field updates so that it "stays in sync with evolving identity standards" and documents no trade-off for the access that allows.

Transaction signing

Per-transaction approval bound to an amount and a payee, which the trade calls dynamic linking. It is the one line on this list that asks the right question, because what it confirms is the act rather than the login, and Europe obliges it: the second Payment Services Directive and Article 5 of its regulatory technical standards require a payment authentication to be dynamically linked to a specific amount and payee, with the payer made aware of both and any modification invalidating the code.

Secure Payment Confirmation, the web standard written for it, serves one use, a cardholder at a checkout confirming an amount and a payee, which Section 4 establishes against the standards body's own white paper, so every other operation an institution performs sits outside it. The European regime asks the cardholder rarely: Europe's own supervisors measure strong customer authentication applied to 40% of electronically initiated card payments by number and about 64% by value, so three in five go through with no strong customer authentication. Where the amount and the payee do appear, European law is requiring it rather than the mechanism supplying it; where no statute compels anything, the liability shift does, and that moves who pays rather than preventing the fraud.

The payer who is not a person is bounded hardest. The rules permit €30 a transaction and €100 cumulative, or five consecutive transactions, before authentication is demanded, and authentication asks a human. An issuer whose fraud rate is at or below 0.01% may lift that to €500, which is the bank's choice and not the customer's. A machine cannot answer a challenge, so the only way it transacts at all is to stop being asked, and the rules supply three ways to stop:

  1. A payee whitelisted once is exempt on every payment afterwards with no ceiling;
  2. A recurring series is authenticated on the first payment only; and
  3. A company using a dedicated non-consumer process is exempt altogether.

That is one authentication at the start and then authority nobody checks again. Merchant-initiated transactions are measured at about 22% of unauthenticated remote card payments, with a further 26% outside the requirements in a way the supervisors record as warranting investigation.

OneSpan and Entrust sell it as a product. The scheme-compelled instance is EMV 3-D Secure, which no institution can decline and which runs at $1.63 billion to $1.72 billion a year, where the issuer's server scores device, address, history, merchant category and amount against typical behaviour: an inference engine built to answer the one question the architecture cannot answer directly. A handheld reader has done the honest version for European retail banks since at least 2009, showing the amount and the account number, or six characters of the IBAN on a SEPA transfer, before the customer confirms, for a payment and nothing else.

Session revocation

Token denylists, continuous access evaluation, session-hijack detection, and the engineering built to keep token lifetimes short. It exists because a minted access token cannot be recalled by anybody before it expires, so the answer is to watch every live session and kill the suspicious ones early. It does not arrive in time: the Akeyless survey of four hundred security leaders times the response at fourteen hours on average to detect an agent identity incident and nearly a week to remediate it. Beyond Identity sells it as a product, and Microsoft sells continuous access evaluation as a feature of Entra.

Exposed-credential intelligence

The institution's own passwords and tokens are hunted in the criminal markets, in breach dumps and in infostealer logs, so that somebody can be warned before they are used. The market exists because the dumps do. The credential that has not surfaced yet is beyond its reach, and the whole product is a race whose starting gun is somebody else's theft. SpyCloud, Recorded Future and Constella lead it.

Password reset

The service desk contact, the identity check a regulated environment requires before it will reset anything, and the time a member of staff loses waiting. No vendor sells it, because it is the institution's own cost, and it is among the largest ticket categories any service desk carries. It does not go away, because a secret a person has to remember is a secret a person will forget, and the reset path is itself an attack surface: the way back in for somebody who has forgotten is the way in for somebody who never knew.

Workforce identity

The per-seat directory licence, carrying conditional access, identity protection and the joiner, mover and leaver machinery for staff. An institution running twelve directories has twelve places to look when something goes wrong; this makes them one. What it leaves untouched is what a successful sign-in produces, which is a session carrying everything that member of staff can do, and Section 13 records that a hosted platform closes none of the five routes on its own, because the closures a buyer sees at the login belong to the passkey it deploys. Microsoft Entra ID P2, Okta Workforce and Ping lead it.

Privileged access

The administrator's session is held in a vault, handed out when it is wanted, brokered to the console, and the credentials behind it rotated on a schedule. It exists because reaching a console and being entitled to change what that console governs are the same thing once a session exists, and it is the largest single line in the whole list. The two things it exists to separate it does not separate: an administrator whose brokered session is taken holds everything that administrator could do, and the vault cannot ask whether a particular act was decided by them. It is licensed per privileged user, so the bill grows with every member of staff given administrative reach. CyberArk leads it from inside Palo Alto Networks, with Delinea and BeyondTrust.

Secrets storage

The stored secret one system needs in order to authenticate to another, held safely, which in practice means the secret, its replicas, the keys that encrypt it and the audit of every read. It is the correct answer to the question it was asked, and the secret stays, so the product is a vault whose contents are the thing an attacker wants, protected by a key that is itself a secret somewhere. Amazon sells it as Secrets Manager, with a validated module holding the keys around it.

Workload credentials

Short-lived credentials issued to a workload on demand, so that no machine holds a durable secret, billed per client that authenticates. It is the best practice in its field, and what the credential is while it lives does not change: inside its window it is a bearer artefact and whoever holds it can act with it, which is why the whole discipline is about shortening the window rather than removing the thing inside it. HashiCorp sells Vault from inside IBM, with CyberArk Conjur and Akeyless beside it.

Non-human identity discovery

The keys, service accounts and tokens nobody registered and nobody can count are found and put on a list. It exists because machine identities accumulate in every estate faster than anybody inventories them, and the same survey of four hundred security leaders found only 44% who knew where the credentials their agents use are stored. It counts the problem rather than reducing it. Astrix, which Cisco has announced its intent to acquire, and Akeyless lead it.

Runtime authorisation for agents

Each action an agent attempts is evaluated against policy at the moment it attempts it. It is the newest line on the list and it is aimed at the right problem, which is that an agent handed a credential holds a standing authority nobody bounded. The human is never asked: the policy being evaluated is one the system holds, written by whoever configured it, so an agent's authority is an administrator's configuration rather than a decision its principal made and can be shown to have made. SGNL from inside CrowdStrike and Akeyless lead it.

Access review

The distance between the policy an institution wrote down and the policy its systems are enforcing is measured, and somebody certifies that they have looked. It is sold as identity governance, bought by the seat, and now billed across persons, machines and agents alike. The distance it measures it cannot close, because the gap is a property of having two things to reconcile at all, and an institution that certifies an entitlement annually has certified what was true on the day somebody looked. SailPoint and Saviynt lead it.

Cross-charter unification

One identity and one audit plane across separately chartered entities, under the institution's own rules. There is no product and no vendor, and this is the only line on the list the market does not serve at all: an institution that wants it builds it, which is why it sits here as an engineering cost rather than a licence, and the Wintrust case study at Section 23 runs fifteen separately chartered banks.

A year's budget growth against what eight of the sixteen functions need, divided into eight of those years.

What the whole list costs

An institution that bought all sixteen, configured every part of it for maximum security and staffed it properly, would end that exercise holding the same credential and an identity bill several times the one it started with.

Section 23 prices that at two scales against budgets the banks are already spending. At a bank with $2.726 billion of revenue, eight of the sixteen functions can be priced, and those eight with the staff to run them would add a third to its entire security budget. At a bank with $113.1 billion of revenue, four of the sixteen would add nearly a quarter. In each case that buys only the part of the list that can be priced at all; the rest carries no published price to put against it, and what the money buys is mitigation.

Establishing what the whole list would cost meant finding what the market charges for what it does sell, and most of it does not say:

  • Auth0's free tier runs to twenty-five thousand monthly active users. Its two cheapest paid tiers cost $35 and $240 a month, and the company publishes each of them as reaching five hundred. Above twenty-five thousand a paid tier becomes compulsory, and the tier that reaches a bank's population carries no price at all.
  • Ping publishes a floor of $35,000 a year for its customer product and $50,000 for the tier above it, with no unit of measure attached to either, so each figure buys an unstated number of identities. The same page lists ten items and six of them carry no figure at all.
  • ForgeRock, now inside Ping under Thoma Bravo, appears on that page nowhere and publishes no price for any product at any population.
  • CyberArk sits behind a page reading contact sales, and SailPoint publishes nothing either.

Not one of these five identity platforms can be costed at the population it would have to serve. Three publish nothing, and the two that publish something publish it either below the scale or without the unit that would let anybody apply it.

The newest money is buying the same thing

A new band opened after the April disclosure, and market.us, Grand View Research, MarketsandMarkets, Fact.MR and Astute Analytica have all sized it. Agentic AI security runs at $1.65 billion to $2.86 billion for 2026, growing at 36.4 to 42.0% a year, which is faster than any established band in the market, and Gartner created a dedicated agentic segment in its spending forecast for the first time.

What those vendors sell is model security, adversarial threat detection, prompt-injection protection and agent workload protection. Not one of them is an agent's authority bounded by a human signature and withdrawn by another. The newest and fastest-growing money in the field is buying mitigation as well, and the market is forming around the problem rather than around the answer.

The money already in the field is doing the same thing from the other direction, by consolidation. Thoma Bravo put ForgeRock inside Ping Identity, Palo Alto Networks holds CyberArk, CrowdStrike holds SGNL, Cisco has announced its intent to acquire Astrix, and NICE has engaged Goldman Sachs and J.P. Morgan on a sale of Actimize at $1.5 billion to $2 billion. Every one of those is a mitigation company being bought by a larger one.

Why none of it can work

The advice underneath these products is the one the agencies in Part IV that addressed it arrived at: give a token the shortest life the job can work with. Taking that advice leaves three things standing.

  1. Where the decision is made does not move. It stays in the browser, in a browser plug-in, or in a browser wrapped up to look like an application, a room that anybody able to get code into it has already entered, as Sections 5 and 6 set out, and no product in this list changes it.
  2. The tooling carries the risk the record documents. The browser, the plug-ins, the add-ons and the wallets are assembled from public registries, and Part III is largely the record of what happens to software assembled that way. The thing an institution installs to protect the credential arrives down the same path as the thing that takes it.
  3. The economics run against the advice. An issuer's short-term interest is to mint fewer tokens and give each one a longer life, because a long token costs nothing to re-authenticate and because provisioning a large number of autonomous agents is easier when each one holds something durable. Shortening the life costs money in the other direction: for the sign-ins that still carry a second factor over a channel, every shortened session is another message billed on the attempt whether it arrives or not, while the identity platform charges by the user and earns nothing extra either way. The risk that runs one way is nebulous and arrives later; the invoice is immediate, tangible, runs the other way and arrives monthly, so the perception of future risk gets discounted against the bill.

The figures say it is being discounted now, and not by people who have yet to see the problem. VentureBeat found 32% of enterprises giving every agent its own scoped identity and 69% running agents that share a credential somewhere in the deployment. The Akeyless survey found 67% who already suspected their agents had reached data beyond their intended scope, more than six in ten who had already revoked or rotated an agent credential over a suspected exposure, and 7% who believed their existing controls could prevent a compromised agent from operating maliciously or outside its intended behaviour. All of it was published between May and July 2026, in the weeks after the April disclosure.

Then count what any of it controls. Of the sixteen, one reaches the act and it is bounded to a payment, and one evaluates a policy the system holds. The other fourteen work on access, which is being let in, and not one of them works on authority, which is the right to act once inside. Three of the fourteen carry the word in their own trade names, being privileged access management, continuous access evaluation and access review, and the rest guard the same thing under names that do not say so. None of them asks whether a particular act was decided by the person it is attributed to, and none of them could, because answering that takes a signature over the instruction and nothing in the category produces one. The hardware key is the plainest case: it has a button and no screen, so what it confirms is that somebody pressed it.

An institution that assembled all sixteen and ran every one of them perfectly would have bought a better defended version of the artefact, in the same browser, from the same registries, on the same economics, and would still have no answer to the question of who decided. Every one of the sixteen exists because the credential exists.

Sixteen mitigation products, struck through, flowing into the three properties that remove the object each one defends, removing the vulnerability.

What answers the whole list

Remove the credential and all sixteen go at once: not defended better, watched more closely or bought at a keener rate, but gone, because the thing every one of them was built around is no longer there.

The institution holds a public key, which is not a secret

A person signs in their own application with a key in their own device's secure hardware, and what the institution holds is a record of the public half, which is not a secret and discloses nothing. Nine of the sixteen above lose their object:

  1. There is no credential store to defend, so customer identity's central product goes;
  2. Nothing of the institution's can appear in a dump, so the hunting goes;
  3. There is no secret to forget, so the reset queue goes;
  4. No standing secret is held on anyone's behalf, so secrets storage goes;
  5. For the same reason, workload credentials go;
  6. No durable artefact accumulates for a machine to find, so the inventory goes;
  7. The signing device is the holder's own and a public key costs nothing to create, so the per-person token logistics go and redundancy stops being a purchase;
  8. Staff authenticate by signature on the estate that has moved, so the per-seat directory meter goes with it; and
  9. One identity across fifteen charters becomes a property of the arrangement rather than a build.

A system holding no secret about a person has nothing to secure, nothing to justify holding, nothing to delete on request, and nothing to report when it is breached, so the obligation goes with the object.

Authority is a fresh signature over the instruction

The instruction is displayed in plain language on the holder's own screen and signed there, once, for that act alone. A signature over a payment of a stated amount to a stated account cannot be replayed against a different one, and nothing is carried forward from a login that happened earlier. Six more of the sixteen lose their object:

  1. A session that confers no power to act is not worth killing early, so session revocation goes;
  2. An administrator whose session is taken holds a session and not a mandate, so the vault's reason goes;
  3. There is no distance between the policy written down and the policy running, because the signature is the policy, so the review goes;
  4. There is no code to deliver, so the message channel goes;
  5. There is nothing a second factor can add to a decision that was itself signed, so the push goes; and
  6. Dynamic linking is a property of the mechanism rather than a control configured on top of it, so transaction signing goes, its bounded payment with it. What European law requires an institution to achieve by configuration is here achieved by construction.
A machine's authority is a bound its principal signed

A human signs once to set what an agent may decide, the agent acts inside that bound, every action is recorded as it happens, and a second signature from the same human on the same contract withdraws it. The sixteenth line goes with that. Runtime authorisation evaluates a policy the system holds; this is a bound the principal set and can be shown to have set. The difference is not how tight the policy is; it is that there is somebody to answer for it.

What the list never asked

Those sixteen are the questions this market knows how to ask. Eight more properties follow from the same architecture, and nothing on the list asks for any of them.

Where the authorisation is made

Every one of the sixteen assumes the decision is taken in a browser, in a browser plug-in, or in a browser wrapped up to look like an application; here it is not. The instruction is left at a short-lived address of its own, collected by the holder's own application, displayed on the holder's own screen and signed there, and where the holder wants it the address crosses optically to a second device so that the two machines never address each other at all. The optical signature exchange is Stage 3 at Section 20 and is expected in the first quarter of 2027; everything else here is operational. No product among the sixteen moves the decision, because no question among them asks where it is made.

An audit that is the same object as the action

The record is the action rather than a report about it, so there is no logging step to fail, to sample or to switch off, and nothing to reconcile between what a system did and what a system wrote down. The nearest thing the market has is collecting logs, normalising them and producing evidence out of them, which the Sarbanes-Oxley Act, the Payment Card Industry Data Security Standard and the Safeguards Rule each require separately, and which Microsoft Sentinel and Splunk sell. Those are not on the list of sixteen, because an institution buys them for other reasons and goes on buying them.

Retention set by the obligation

What is kept is set by what the obligation requires, and what the institution holds is a key rather than a file about a person. The nearest thing the market has is a retention tier inside the log platform, charged by the gigabyte on the way in, again at Microsoft Sentinel and at Splunk, which prices the keeping rather than reducing the holding.

A key the holder generates that no operator can invalidate

The key is made by its holder and issued by nobody, so no operator can withdraw it in the way Apple, Google and Microsoft can each withdraw the identities they issue. Set against it is a key the institution's own chain governs, and the holder chooses which to use for what. Nobody sells this and nobody attempts it.

Cryptography the institution specifies

The operator specifies the scheme, rather than inheriting a vendor's, and the infrastructure enforces that choice. A hardware token's firmware is fixed at manufacture, and a platform's cryptography belongs to the platform; here it belongs to the institution, and a change is a configuration rather than a replacement programme. Nobody sells this either.

Keys that are free and plural

A public key costs nothing to create, so a holder may hold as many as they want: a desktop key, a telephone key and a backup. Every metered line among the sixteen charges by the credential, which is why a second key for one person is a second licence and why an estate's security bill grows with its account count rather than with its risk.

Capacity in place of a meter

An institution running GRIDS on its own Associate Chain buys capacity rather than events, so the marginal correct decision costs nothing and tightening a control does not raise an invoice. What this is set against is not a product but the metering structure entire, and that structure is why the economics above run against the advice the same vendors give.

A price that recurs on the exposure rather than the issuance

What recurs is charged on the exposure rather than on each issuance, with a ceiling the seller imposes rather than offers. The nearest thing the market has is the denylist and the continuous evaluation engine, where an institution pays to watch what it has already given away.

Why they do not come apart

Access separates from mandate only because authority attaches to an action, the audit is innate only because the record is the action, and keys are free and plural only because there is no store to meter them. None of it can be bought one at a time, and a competitor who holds one of these holds one property and is no nearer the rest. Whatever it holds, the credential is still there.

23. Eight of sixteen, on top of a budget already spent

Suppose an institution tried to buy its way to the strongest mitigation the market can sell against credential risk. Sixteen separate functions would have to be bought, and eight of them are left unpriced here.

Six have no price because nobody publishes one: transaction signing, session revocation, exposed-credential intelligence, non-human identity discovery, runtime authorisation for agents, and running one identity across separately chartered companies. Transaction signing is the odd one of the six: it is sold, and the card estate's share of it is measured, but it is sold as a component of a payment product rather than as a priced item, so there is no rate card an institution can read a figure from. The other two carry a price and are left out anyway. Cisco publishes a rate card for push authentication, refused here because it double-counts the workforce licence that already includes a second factor. Password reset has a defensible unit, about $22 for a level one incident on independent service-desk benchmarking, and no volume, because the reset rate is the institution's own number and nobody outside it holds one.

Four numbers size any bank's security budget

  1. Security spend as a share of a bank's revenue - 0.80% in 2023, which is eight in every thousand of revenue, down from a peak of 0.88% in 2021. Deloitte measured it by surveying 61 financial institutions in June 2023, 54% of them in banking and capital markets, with the largest group of respondents at between $500 million and $5 billion of revenue, which is the band the bank below sits in.
  2. Staff and compensation as a share of the security budget - 39%, and the largest single line in it. Measured by IANS in its 2025 benchmark.
  3. Software as a share of the security budget - Roughly 30%, the second-largest line after staff and compensation. The same benchmark.
  4. Identity software as a share of that software line - 11% at banks below $10 billion of revenue, rising to 14% above it. The same benchmark.

Eight functions against eight in every thousand

That leaves eight that can be priced from published rate cards and set against what a bank spends.

Take Wintrust Financial Corporation, a mid-tier American bank reporting $2.726 billion of net revenue and 5,902 staff across fifteen separately chartered banks, used here as the case study because its facts are published, so the arithmetic can be done conservatively and checked by anybody. Price those eight at the vendors' own published rates, and where a vendor publishes nothing, at the rates the United States government is obliged to publish when it buys the same products.

Microsoft charges $10 a month for every member of staff on Entra ID P2, following its increase of 1 July 2026. Amazon publishes a full rate card for Cognito at any population, and $1.60 an hour for each hardware security module on CloudHSM, which is the sealed appliance that holds an institution's own keys. For privileged access CyberArk charges by the privileged user, and the rate comes from contracts benchmarked by UnderDefense and VendorBenchmark, both of which sell services into the same market, at roughly $1,800 a user a year at a thousand users and above; its listing on the General Services Administration's schedule publishes no line-item price. For identity governance it comes from United States federal solicitation 2032H5-24-R-00019, which carries SailPoint's price schedule as an attachment, and from one General Services Administration award for its cloud product and the services around it at $3,677,709.63.

The eight come to $4.3 million a year. The arithmetic is ours and every input to it is published: the vendors' own rate cards where they publish one, the rates the United States government is obliged to publish where they do not, and the benchmarked contract rate for privileged access. Privileged access is the largest line at $2.1 million, being 1,180 privileged staff at $1,800 each; that count, a fifth of the bank's people, is our own assumption.

Against that sits the budget, and the bank is already spending it. 0.8% of $2.726 billion is $21.8 million, and on the ratios above, 11% of 30% of it, $720,000, goes on identity software today.

The eight replace nothing in that budget; they come on top of it, at six times what the bank pays for identity software now. Staff and compensation are 39% of a security budget on the same benchmark, so keeping that share, the eight need about $2.8 million a year of people to run them, and the budget has to grow from $21.8 million to $28.9 million, by a third, to carry eight of the sixteen functions. Security budgets grew by 4% in 2025, the lowest rise in five years, and a third is eight times that.

Take instead the highest figure Deloitte has measured for banking, 0.88% in 2021: the budget is $24.0 million, and the same eight with the people to run them still add $7.1 million to it, three tenths more. Neither figure buys the other eight functions, six with no published price and two left out of the count, and none of it removes anything: what the bank buys is mitigation, at a price that rises with every member of staff it hires.

Forty-one times the size changes nothing

Bank of America tests the other end of the scale, and it is here for the same reason Wintrust is: its facts are published, so the ratios can be applied to it conservatively and the result checked by anybody. It reports $113.1 billion of total revenue net of interest expense and employs about 213,200 people, which is forty-one times Wintrust's revenue and thirty-six times its staff. The same three ratios give a security budget of $904.8 million and an identity software line of $38.0 million, the identity share rising to 14% above $10 billion of revenue.

Four of the sixteen can be priced at that population from the same published rates. They come to $127.2 million a year, more than three times the bank's identity software line, on top of a $904.8 million budget it is already spending, and with the people to run them at the same share, $208.6 million, which adds nearly a quarter to that budget. Twelve of the sixteen are not priced here at all.

Privileged access is $76.8 million of it, being 42,640 privileged staff at $1,800 each. That count is our own assumption, privileged staff at a fifth of the workforce as at Wintrust, and the bank publishes nothing we could put in its place.

The rates are charged by the member of staff and by the privileged user, so what an institution has to buy grows with its headcount while the budget it buys from grows with its revenue.

What the meter rations

In our experience, an institution that buys little of this has not concluded that the rest is unnecessary. Every additional check has carried a cost per event, and that cost rises with the volume of ordinary business, so security bought by the event gets rationed exactly where the business is busiest. A long session is cheaper than a short one; fewer step-ups, where the service asks again, are cheaper than more; and fewer protected operations are cheaper than many. The institution is not choosing a weaker position because it prefers one; it is choosing the position its meter allows, and then buying secondary controls to watch the exposure that choice creates.

On GajuAuth the institution sets the life of the access token itself, from single use upward, and what it sets governs access and never authority. On its own chain the charge is capacity rather than events and there is no meter at all, at which point the question stops being what the next check costs and becomes which actions are consequential enough to interrupt a person for. That is a security design question rather than a procurement one.

24. A role is not an authorisation

Your office pass opens the doors you are allowed through. It says who you are and which floors you may reach, and it says nothing at all about which payment you approved on Tuesday. Nobody has ever held up a staff pass as proof that a payment was authorised, because everybody understands the difference between holding an office and making a decision.

A role is a standing attribute. An authorisation is a singular event.

Hold on to that, because the instrument now being sold to banks, registries and governments as proof of authority is a staff pass.

A key, and what it is not

A public key is a number you can hand out, and on its own it carries no name, no company and no job title, so it proves nothing about who you are.

It is a number that stays the same, though, and anything that stays the same can be used to follow you. Use one key at your bank, at work and at a shop, and anybody who can see two of the three knows the same person stands behind both. The answer is to stop reusing it. Keys cost nothing to make, so a holder generates as many as they want and hands a different one to every service, leaving nothing in common to join up.

You can then bind a verified identity to whichever key you choose. A passport, a driving licence, a college ID card, a national electronic identity, a company's legal entity identifier: whoever already checks these checks one, you prove the key is yours by signing with it, and the two are joined. That join is what carries a key's signature from proving that somebody decided to proving that you did.

Binding an identity to a key

The mechanism is the same whichever identity is bound:

  1. An authority verifies by its normal process, whether a bank, a registry or a qualified trust service provider, which is an issuer the law has accredited for the purpose;
  2. The holder proves control of the key by signing a binding instruction;
  3. The mapping goes into the authority's register, or onto a chain the institution runs as a signed record;
  4. The relying party, which is the service doing the asking, then acts on signatures from the bound key.

Verification stays with the authority and the key stays with the holder.

A person may bind a national electronic identity, an institution may bind a verifiable legal entity identifier, and either may bind a single attribute, such as being over eighteen, provable without surrendering the identity behind it. A holder may keep many keys and nominate one to carry a bound identity while the rest stay unbound. The binding ceremony runs today, as does role-based access control, which decides access and leaves the authority to the signature. Presenting attributes bound to a key, and wiring a particular register to a key, are in development.

What a national scheme answers

Two families of scheme identify people and companies well, and neither performs the operation at issue here. The first is the national electronic identity, and the good ones are properly built:

  • The key sits in the protected hardware of the holder's own telephone;
  • Up to three factors are required;
  • The application refuses to run on a compromised handset; and
  • The identity data is current by construction because a change in the population register takes effect at once.

Every such scheme notified to the European Union, which is the formal step that makes it recognised across the Union, files a form describing what it does, and Liechtenstein's is an excellent specimen. When a service asks the scheme to authenticate somebody, what comes back is a name, a family name, a date of birth and an assurance level. The form marks three things as not applicable: additional attributes for natural persons, identity proofing for legal persons, and any binding between a person's identity and a company's.

That answers who is at the door and nothing else. Nothing in the response is tied to a particular instruction, so whatever the person does after the door opens is carried by a session and is never separately proven. The entity dimension of an economy built on companies, foundations and trusts has no identity layer in the national scheme at all.

The instrument attempting to fill the entity identity gap is the Legal Entity Identifier. It is a twenty-character code under ISO 17442, created at the direction of the G20 and overseen by a committee drawn from public authorities in more than fifty countries. Each code connects to reference data verified against authoritative local sources, the system is open, non-proprietary and free to access, and the active population has passed three million records.

The verifiable form, the vLEI, is a chain of credentials. GLEIF, the Global Legal Entity Identifier Foundation that operates the system, issues to a Qualified vLEI Issuer, which is a commercial firm GLEIF has accredited to do the checking; that issuer issues to a legal entity; and role credentials descend from there to named people.

What a vLEI actually says

A credential is a form, and a form has a fixed number of boxes. The vLEI has three forms, and the published schemas say exactly what is on them.

The form for a company carries four boxes, and all four identify the company. The form for an officer carries six: those four, the person's legal name as taken during identity assurance, and the official job title, drawn from official public sources and the ISO 5009 role lists. The form for anybody else connected to the company carries seven: the four, the legal name, a blinding nonce, which is a random number mixed in so that the contents cannot be guessed back from their digest, and a free-text job description, the schema's own example being Head of Standards.

There is no box for how much, no box for to whom, and no box for until when, for what purpose, or for cancelling it.

Every distinct property name in all six published files was matched against seventeen words: limit, amount, ceiling, scope, expiry, validity, duration, permission, permit, authorisation, authorization, constraint, purpose, transaction, revocation, notBefore and notAfter. Not one schema carries a property with any of those names, and wherever one of those words appears anywhere in the six files it sits in a credential's title or in the fixed disclaimer prose set out below.

A vLEI says who a company is, what a person is called and what that person's job title is, and nothing more.

There is nowhere to put a limit

GLEIF's own technical requirements tell an issuer where a restriction would live: in the Rules section of the credential, which the issuer "SHOULD use" to "impose restrictions on the use of the credential or its attributes", and that is the only place in the framework where anybody is told how a restriction would be expressed.

The specification GLEIF has adopted lets that section hold one thing, a paragraph of legal English, and says so in terms: "A Rule MUST NOT have any other fields." A machine can fetch the paragraph and check that nobody has altered it; no machine can act on what it says. So the section cannot carry an amount, a scope, a counterparty or a condition, and the issuer directed to put restrictions there has nowhere to put them.

What GLEIF has put there instead is three fixed values, each declared as a constant so that an issuer cannot vary them:

  1. A privacy disclaimer;
  2. A statement that the information was accurate on the day the checking finished; and
  3. GLEIF's own statement that usage of a valid, unexpired and non-revoked credential "does not assert that the Legal Entity is trustworthy, honest, reputable in its business dealings, safe to do business with, or compliant with any laws or that an implied or expressly intended purpose will be fulfilled".

The one place a restriction was meant to live holds the issuer's disclaimer of nearly everything a relying party came for.

What the frameworks say the holder may do - nothing

The Legal Entity, Official Organizational Role and Engagement Context Role frameworks each state that there are "no restrictions on the Holders of vLEI Credentials" within the system, and none of the three defines a permitted action, a limit or a scope of authority.

No credential type has a stated validity period. All three speak of a credential "valid, unexpired, and non-revoked" without anywhere defining a duration, so nothing expires of its own accord.

The framework glossary does not define authority, and no term in it contains the word.

The liability sits with the company, which "is responsible for the use of" the credentials it has authorised, and the Legal Entity framework adds that it "assumes liability for misuse of Legal Entity vLEI Credentials by its representatives".

The credential a company would actually use is the one it issues itself

The credential a company would in practice reach for to carry functional authority is the one with the fewest controls: an Engagement Context Role credential, the form for anybody else connected to the company, is issued by the company itself, with no Qualified vLEI Issuer involved at any point. Its role string is whatever the issuer types, the framework requiring only that the field value "MUST be the Engagement Context Role" and naming no controlled vocabulary, where the official role credential requires validation "using one or more official public sources". For colleagues already known to them, the framework provides that the company's own representatives "MAY choose to restrict Identity Assurance to validating the legal name" of the person.

GLEIF's assurance programme covers the accredited issuers and stops there, and GLEIF's own framework states across many rows that "GLEIF will not be able to determine compliance by Ecosystem stakeholders other than itself and Qualified vLEI Issuers".

So the credential carrying the most authority inside a company is the one GLEIF neither issues nor assures, with a job title the company writes for itself and identity checking it may reduce to confirming a name.

What GLEIF published, and what its chief executive published nineteen days later

On 13 August 2026 GLEIF published its paper on agentic payments. The paper draws the distinction this section draws, and draws it correctly: "the former establishes the right to act; the latter determines whether the specific transaction should proceed", and "The runtime policy engine determines whether the specific action proposed at the moment of execution should proceed." On which of the two its own framework answers, the paper is explicit: "The framework here is deliberately agnostic on this point." It then names the instrument that would carry limits, an Agent Mandate Credential encoding "the class of actions it may take, any transaction limits, permitted counterparties", and states the condition that instrument is in: "The formal ACDC schema for the AMC needs to be defined, including the precise field structure and validation rules." Annex D: "This is not a limitation of what vLEI and ACDC deliver today. It is a known frontier that requires further architectural work."

Nineteen days later, on 1 September 2026, on the same organisation's blog, GLEIF's chief executive Alexandre Kech wrote that an agent must carry machine-readable proof of "the authority it has been delegated, and the boundaries of that authority", that "accountability is hardwired into each agentic transaction", and that authority is "verified when the transaction is initiated, rather than reconstructed afterward".

The credential that would carry those boundaries has no schema. GLEIF said so itself, in writing, in the annex of its own paper on this subject, nineteen days before its chief executive, Alexandre Kech, wrote that the boundaries travel as machine-readable proof. Kech's account of what the vLEI proves cannot be reconciled with GLEIF's account of what the vLEI contains.

The frameworks Kech's own organisation publishes place no restriction on any holder, define no permitted action, set no expiry on any credential, do not define authority anywhere in the glossary, and hand the company the liability when its own representatives misuse the credential. That is not accountability hardwired into a transaction. It is accountability moved onto the customer.

On 15 May 2026 the same man wrote that the vLEI "does more than identify an organization", that it "establishes who within that organization is authorized to act, and in what capacity", and that it is "more precise and legally defensible than a paper seal". GLEIF's product page says the credential lets a relying party "verify the identity, authority, and role of people acting on behalf of any legal entity", and may be used "from signing regulatory filings and reports to authorizing business payments".

Put the product page beside the schema. The page says the credential proves authority and authorises payments. The form has four boxes, or six, or seven, and not one of them names an amount, a counterparty, a limit, a scope or a purpose. Both documents are GLEIF's own.

What the shipped product does with a verified credential

GLEIF has built an authenticator and published it. The vLEI Authenticator, made with esatus and wired into Keycloak through SOWL, adds the verification step to the authentication flow, and Keycloak is the software that issues the login token. In GLEIF's own words: "Once validated, SOWL confirms the result to Keycloak, which completes authentication and issues the access token."

So the whole chain, from GLEIF to the accredited issuer to the company to the named officer, verified back to its root, ends in the bearer token of Section 3. Whoever holds that string acts with the officer's name and the officer's authority, and nothing in the flow can tell them from the officer.

The credential itself is requested from a cloud wallet, and GLEIF's own account records what that costs: "Custodial wallets simplify operations but require availability; passphrases remain essential for key protection". So the key behind a company's authority sits with a custodian and is guarded by a passphrase, which is a secret that works for whoever holds it. That is the exposure of Section 3, now carrying a company's name.

None of this reaches the case where the credential is exercised by somebody other than the officer named on it, and that case is not hypothetical: it is Lithuania, where the credentials belonged to an authorised institution and were used by someone else.

The danger is not that the identifier is wrong. It is that a correct instrument sold as a complete answer gets built into systems on the premise that presenting the credential is enough.

A relying party that accepts a company credential as the end of the question then builds the same broken architecture one layer up, at the company rather than the person, with far more authority hanging off it.

The partner who named the gap, and what GLEIF says closing it will take

Twenty days after its chief executive wrote that accountability is hardwired, GLEIF published a partner of its own contradicting him. On 21 September 2026, on GLEIF's newsroom, Jaegyeong Yeom of YourData wrote: "Verifying an organization and role establishes a trust foundation, but it does not determine whether a particular action may proceed", and "Permission to negotiate commercial terms does not automatically authorize issuing a financial instruction." He calls it the execution-trust gap. He is right about every word of it.

What he offers to close it is a prototype, under proof-of-concept and integration work, and he states what it needs: "Deployment at scale requires several foundations to mature together". Several foundations maturing together means a schema that does not yet exist, a committee to agree it, partners to implement it, and no date for any of it.

The gap Yeom names closes today. Bind the role credential to a public key, and it closes with no new schema, no committee, no new credential type and no field added to anything GLEIF has published. The mechanism is universal, because every externally verified identity binds the same way. It is global, because a key belongs to no jurisdiction and no scheme. It costs nothing, because the holder makes the keys. It runs now, because the binding ceremony is in service today and needs nothing added to it.

What makes a vLEI carry authority

The Qualified vLEI Issuer verifies the company and the role by the process it already runs, which is the work GLEIF has built a global system to do. The holder proves control of a Gajumaru public key by signing a binding instruction, and that mapping is recorded, so the credential names the company and the office, the key names the holder, and the two are joined by a signature nobody else could produce.

From then on the role credential answers which company and which office, which is what it was built to answer, and every act that carries authority is a fresh signature from the bound key over its instruction, read in plain words on the holder's own device before it is made.

A relying party that wants both gets both in one exchange. It checks the credential chain back to GLEIF for the company and the office, and it checks the signature over the instruction for the decision, against the key the credential is bound to. Nothing in the credential changes and no field is added to any published schema, because the instruction is composed by whoever asks for the signature and the binding is a signed record rather than a new credential type.

A vLEI on its own proves an office and leaves the act carried by a token that works for whoever is holding it. A vLEI bound to a key proves the office and the act, and a relying party can finally tell the difference between a person who holds a title and a decision that person made.

If you are buying this, there are two questions to put to whoever is selling it. Show me the field that carries the amount. Show me how I prove, afterwards, that this person approved this payment and not somebody who took their credential. There is no field, and the answer to the second is a bound key or nothing.

25. Passkeys - the '42' of cybersecurity?

You almost certainly have a passkey if you have an Apple or Android phone. It would have been offered to you when you logged into a website and used an old-style second factor, '2FA'. The website would have offered to remember you and your telephone asked whether to save it, and ever since you have signed in with a fingerprint or facial recognition and thought no more about it.

A passkey is a secret number that sits on a device. What it hands a website is a one-off signed answer, worked out from a one-off question the site sent and tied to that site, and that answer is called a signature. Nobody types the number and the number itself never travels to the website. What the answer proves is that whoever made it holds the number.

You have no doubt been told that this is the answer to every security question, the '42' (answer to everything, including the meaning of life; nerd joke) of cybersecurity. Then ask the question nobody in the sales conversation asks: where does the number live, and who controls it?

Two kinds of passkey

  • Device-bound - Made on the device and does not come off it in usable form where the implementation is sound. The number is in a chip in your hand, which is why losing the telephone loses the key.
  • Synced - Exists in more than one place on purpose, because that is how it survives a lost telephone. Copies have to be cut and kept somewhere every one of your devices can reach, and the party that cuts and keeps them is the provider. The number is on Apple's servers or on Google's, wherever the disks happen to spin, held by a company incorporated in the United States. It is also the kind Apple's and Google's password managers make by default, which means it is the kind most people have and almost nobody chose.

Nobody holding one can establish which kind it is, and by default neither can their employer.

What the two keepers say about themselves

Apple and Google each hold the synced kind, and each has described what it can do with the numbers it keeps. The two descriptions look alike, and they are not.

Apple's claim is about access. iCloud Keychain is "end-to-end encrypted with strong cryptographic keys not known to Apple", and its escrow service releases a copy of a keychain only when a strict set of conditions is met, without letting Apple read what the keychain contains.

Google's claim is about something else. Google Password Manager encrypts passkey secrets end to end, and then Google puts the limit of its own claim here: "although passkeys are backed up to Google's servers, Google can't use them to impersonate users".

Apple says it cannot read the numbers it keeps. Google says it cannot use the numbers it holds to pretend to be you. One of those says the keys are there and sealed against their keeper; the other says they are there and that their keeper cannot use them to pretend to be you.

Both are the companies' accounts of themselves and not independent findings, and recovery in each case rests on something the holder knows, Apple's device passcode and Google's screen lock or PIN, with Apple destroying the escrow record after ten failed attempts.

So now ask who is vouching for you to the website. All the website can check is that the answer was made with the key it registered, so what it learns is that somebody holds that key. For the synced kind, the party that decides which of your devices hold it is Apple or Google. The website is not trusting you. It is trusting Apple's or Google's account of you. The identity you think of as yours is a record they keep, you reach it by their permission, and you do with it what they permit you to do.

What leaves your device every time you use it

A passkey is not one thing: the specification defines a set of properties your device may or may not have, and it reports them to the website at every login. You are never shown them.

They travel as a byte of eight slots. One says a human was present. One says a human was verified, by a fingerprint, a face or a personal identification number. One says the credential is eligible to be backed up, meaning it "can be backed up in some fashion" and "may become present on an authenticator other than its generating authenticator". One says whether it currently is backed up. One says attested credential data is present. One says extensions are present. Two are empty, and the specification reserves them for future use.

Six are in use, and the website is told all six, every time. You are told none of them, so two people holding what both call a passkey may hold objects with different properties, and neither can find out which they have.

Level 3 of the Web Authentication specification became a W3C Recommendation, a standard of the World Wide Web Consortium, on 25 August 2026, and it widened what leaves your device. Your credential manager, which is the software on your telephone or in your browser that keeps your passkeys, may now announce which provider it is. Where a website asks for enterprise attestation, and the browser is willing to oblige, the identifier of the thing that made your key passes to that website unaltered, together with the key's attestation: here, a signed statement about the equipment rather than about a piece of software. A website may also now tell your credential manager which of your credentials it still regards as good, and have the list reconciled against that.

That statement is the one item in the list nobody can fake. The chip, the credential manager, the operating system and the device's firmware all have to agree before it is produced, which is why the website believes it. What the website is being handed is the voucher vouching for itself, and its subject is the equipment rather than the person: it proves the device is what it claims to be, and the website infers that whoever held it once holds it now.

Think of a key cut by a locksmith who stamps on it a mark of their own that nobody can counterfeit. An institution checking that its people hold keys from a proper locksmith has a use for that stamp. The same stamp lets any door in the world keep a list of approved locksmiths and turn away a key that works perfectly, because the shop that cut it is not on the list. You are not refused because your key is wrong. You are refused because of who made it.

Nothing in the specification runs the other way. You cannot require a condition of the website, refuse one, or find out which were applied. Of the eight slots two are empty, and both sit on the website's side of the conversation, so whatever is added next will be one more thing the website learns about you.

Who wrote the rules

Passkeys are not a product; they are a specification, written by the FIDO Alliance.

The Alliance has four tiers of membership. Board Level carries Amazon, Apple, Google, Meta and Microsoft, and beside them American Express, Bank of America, Chase, Mastercard, PayPal, PNC, US Bank, Visa and Wells Fargo. Sponsor Level and Associate Level carry the rest of the industry, from Huawei and IBM to Swift and Nomura.

The fourth tier is headed Government Level, and it names nine bodies: the Cyber Security Agency of Singapore, Thailand's Electronic Transactions Development Agency, Germany's Federal Office for Information Security, Taiwan's Ministry of Digital Affairs, Taiwan's Ministry of the Interior, the United Kingdom's National Cyber Security Centre, the United States National Institute of Standards and Technology, Taiwan's TTC and Korea's TTA.

The one that says most about what passkeys are is the United Kingdom's National Cyber Security Centre, which describes itself, on its own pages, as "a part of GCHQ", formed by bringing together parts of government, MI5 and GCHQ. Are they securing your use of the web or are they securing you to them?

No tier and no named member is a consumer body, a civil liberties body or a digital rights body. The Alliance built a category for governments and did not build one for the people whose keys the specification governs. None of us has a say in how our imputed identity, our authority online, is held, conveyed and used. Every seat at the table belongs to a party that will be shown a credential, or that will build the device showing it, or that will regulate the showing. The holder is the only party to the transaction with no representation. The parties that vouch for you wrote the terms on which they vouch and offer them to you as the 42 of cybersecurity.

What your institution handed over without noticing

An institution whose directory of staff accounts permits the synced form does not hold the identity of its own officers. A provider holds it, and the institution finds that out in three places.

  1. Custody. The institution has a key management policy that its supervisor inspects and that covers every key in the building: who generates them, where they live, who may use them, when they are rotated, how they are destroyed. The number that proves a named officer is that officer sits outside that policy entirely, in a consumer account the institution holds no contract with for the purpose, chosen by a member of staff who tapped save when a telephone offered to.
  2. Recovery. Take the leaver who has used their own device to provide a personal passkey for authentication. The institution disables the directory account, and that works: the credential stops being accepted, at once, by that institution. What the institution cannot do is account for the number. It cannot recover it, cannot destroy it, and cannot establish that it has ceased to exist, because it sits in that person's own cloud account, behind that person's own passcode, on a device the institution does not own. Shutting your own door is not the same thing as knowing what became of the key, and the leaver file is the first thing an examiner opens.
  3. Audit. The question is always the same: how many keys are there, on which devices, held by whom, copied where, and prove it. For every other key in the building there is a register and a date. For this class there is the provider's account of its own systems.

Every pass that institution issues is numbered, logged, and handed back at the door on a leaver's last day. This one a member of staff made on their own telephone. The institution never saw it, cannot count the copies, and has nobody to ask for it back. A pass opens the front door. This opens whatever the directory lets it open.

An institution can shut this out, and Microsoft documents how. Microsoft's Entra ID is the directory: the register of an organisation's staff accounts, and the thing that decides which of them may open what, across Microsoft 365, Azure and everything the institution has federated to it. For a great many regulated firms it is where the staff identity estate lives. A passkey profile carries a passkey type, device-bound or synced, and in Microsoft's words, "If you disable synced passkeys for a given passkey profile, targeted users can't sign in with a synced passkey even if they already registered one". Enforcing attestation is what makes the type knowable, because "Synced passkeys do not support attestation", and "If enforce attestation is set to No, Microsoft Entra ID can't guarantee any attribute about a passkey, including if it's synced or device-bound".

Microsoft, "How to enable passkeys (FIDO2) in Microsoft Entra ID", last updated 15 May 2026, read at source 11 October 2026.

The directory vendor is stating that an institution which has not set one toggle cannot describe its own estate. The settings exist and the default runs the other way, so whether an institution holds anything at all turns on whether somebody knew to look.

An institution that did set both has moved the number off Apple's and Google's servers and onto a chip inside a telephone it may not own. That is better than what it replaces, but it is still not custody.

The organisational credential of Section 24 sits in the same place whenever it sits in a custodial wallet, and GLEIF's own shipped Authenticator requests it from a cloud wallet, which is the same exposure one layer up, with a company's authority attached.

It is not your data, it is not your identity, it is theirs.

So price it

You may think that this may still be a bargain worth striking. You hand the keeping of the thing that proves you are you to five platforms, nine financial firms and nine government bodies, one of them a part of GCHQ, and in exchange they keep you safe. Plenty of people would take that trade and read no further.

Section 13 put the four purchasable mitigations against the five routes by which the fifty-eight incidents reached authority. On passkeys, two vectors of route one, taken, close:

  1. No shared secret sits in the website's own store for a breach to give up, and
  2. A relay standing at the login cannot come away with an answer that works anywhere but the site it was made for.

Three vectors of route one stay open, routes two to five stay open entire, and on authority the count is nil.

Now put the synced custody to the test on the same five routes to compromise:

  • Route one, taken, where somebody else holds the credential, is the only route a passkey reaches, and custody is what reopens it. The synced form is cut and held by the provider, and Palo Alto Networks Unit 42 extracted synced passkey private keys from a Windows machine with malware already running on it, while the holder did nothing at all.
  • Route two, granted, where the system issues a credential to the attacker, was open before and custody takes away the one instrument an institution had for inspecting it. An attestation names a model of device and never a person, which is why nothing in an enrolment distinguishes a holder from somebody standing in for them. The synced form carries no attestation at all. So an institution cannot establish what enrolled, cannot establish where the number now lives, and cannot say which of its own people hold a credential it would be able to audit.
  • Routes three, four and five sit where Section 13 left them, and custody neither helps nor hurts. The login still ends in a session for somebody to inherit. An instruction arriving at a machine still has no holder in it to ask. A check that proves what the artefact supplies still proves that.

So the bargain is this: you gave up custody of the thing that proves you are you, you gave up any say in what your device reports about you, and you gave up the one instrument for inspecting an enrolment. What you bought with it was two vectors at the login, on one of the five routes, with the other three vectors of that route and all four remaining routes exactly where they were. Two vectors of five, on one route of five, is a score of 0.4 out of 5, the equivalent of an 8% score on an exam.

The wider picture, as told by financial regulators

Three supervisors have put the question of where a provider sits, and whose law reaches it, to regulated institutions in writing.

The European Banking Authority's outsourcing guidelines require an institution to consider where the service provider is located and, in the jurisdictions in question, "the laws in force, including laws on data protection" and "the law enforcement provisions in place". The Digital Operational Resilience Act requires a financial entity dealing with an ICT provider established in a third country to consider "the compliance with Union data protection rules and the effective enforcement of the law in that third country".

FINMA, the Swiss supervisor, puts it most plainly: "The outsourcing of a function must not make supervision by FINMA more difficult, in particular if the function is outsourced to another country".

The Australian Prudential Regulation Authority goes further and names the category. It characterises frontier AI as creating cyber, third-party, concentration and sovereign access risks together, recognising that not only disruptions but also regulatory decisions made overseas, affecting globally significant AI providers, could impair an institution's critical business processes.

The extra-territorial law that reaches all of it

On 23 March 2018 the United States enacted the CLOUD Act and added a section to the chapter of its criminal code that governs stored communications. A provider of electronic communication service or remote computing service must meet that chapter's obligations to "preserve, backup, or disclose the contents of a wire or electronic communication" and "any record or other information pertaining to a customer or subscriber" held "within such provider's possession, custody, or control", and then comes the clause everything turns on: "regardless of whether such communication, record, or other information is located within or outside of the United States."

One legislature wrote that, for the whole world. The statute says "regardless of whether" it is inside the United States or outside, so location is not one consideration among two: it is immaterial, and control is the whole of it. The United States must have jurisdiction over the provider, and nothing else. Apple, Google and Microsoft are American companies, so the statute reaches the party that holds your key and the party that holds your employer's directory alike.

Whether any authority has compelled production of synced passkey private keys is not established, and no published decision I found orders it. What is established is the shape of the power, and it has four properties:

  1. The threshold is not probable cause. An order issues where the government "offers specific and articulable facts showing that there are reasonable grounds to believe" the material is "relevant and material to an ongoing criminal investigation". Whether those grounds are reasonable is decided by an American court, on the American government's own account of them, and the person whose data it is has no standing to appear. Federal judges there are nominated by the executive and confirmed by the legislature, so the body weighing the request is seated through the political process of the party making it.
  2. The customer need not be told. A court may order the provider "not to notify any other person of the existence of the warrant, subpoena, or court order", "for such period as the court deems appropriate", on a finding of reason to believe one of five adverse results, the last of which is "otherwise seriously jeopardizing an investigation or unduly delaying a trial". Every party to that decision is American: the statute, the applicant, the court and the provider. The person it is about may be neither American nor resident there, may never be told it happened, and has nobody to appeal to, because the only forum is the one that made the order.
  3. The remedy is in the gift of the party asserting the power. A provider may move to quash, and only where it reasonably believes both that the customer is not a United States person and does not reside there, and that compliance would create a "material risk that the provider would violate the laws of a qualifying foreign government". A qualifying foreign government means one holding an executive agreement in force with the United States. The motion falls due "not later than 14 days after the date on which the provider was served", and a court may quash only on three findings, one of them that the interests of justice require it once the American investigative interest has been weighed against the foreign one. The Department of Justice's own page of such agreements names two countries, and it carries a last-updated date of 24 October 2023.
  4. What a customer or a supervisor can see of any of it is the provider's own account. There is no register a Swiss bank can search, no notice it is entitled to, and no auditor who can test the answer it is given.

For an institution whose government holds no agreement (almost all) there is no statutory motion to quash at all. What it has instead is whatever the provider chooses to assert on its behalf, under an order the institution will not be shown, on a threshold below the one its own police would have to meet, reported afterwards if at all by the party that complied.

Microsoft's own officers, under oath

Microsoft is not keeping your passkey. It is keeping your employer's directory, which is the list of who exists, what they may reach, and whether a synced key is good enough to reach it. So the question to put to Microsoft was never whether it would hand over a key; it is whether it would hand over the directory. A legislature put those questions to the executives of Microsoft, the largest provider of all, on oath, and has their answer. On 10 June 2025 two Microsoft France executives appeared before the French Senate's commission of inquiry into public procurement. They were reminded that false testimony carries a fine of €75,000 and up to five years' imprisonment, and then they were sworn.

Anton Carniaux, Microsoft France's director of public and legal affairs, was asked whether he could guarantee, under oath, that the data of French citizens entrusted to Microsoft would never be transmitted following an injunction of the United States government without the explicit agreement of the French authorities.

He answered that he could not guarantee it, and added that it had never yet happened. Asked whether Microsoft is obliged to hand over data where a request is properly framed, he confirmed that it is, and that when obliged, it gives it.

Those defending this point to Pierre Lagarde, the public-sector technical director, who stated that since January 2025 a contractual guarantee holds European customer data within the European Union at rest, in transit and in processing, and that no European company among Microsoft's customers had been affected by such a request.

Simon Uzenat, the commission's president, answered that. Microsoft's transparency reports, he said, are the result of a purely declarative exercise; they carry the elements Microsoft is willing to put in them; and their reality is attested by no external control.

Ask what that contractual guarantee is worth, and against whom. The counterparty is an American company, and Microsoft France's director of public and legal affairs had already told the same commission, on oath, that he could not guarantee the thing it promises, because American law can require otherwise. A contract whose own counterparty has sworn that a statute overrides it is not a guarantee. It is a statement of intent with a published exception, enforceable only against a party whose defence is already on the record. The count of nought requests is the same problem: Microsoft's own count of a thing only Microsoft can see. Not one of the four instruments above accepts a provider's word as the answer to the question it asks.

The two things nobody priced

A key somebody else holds carries two consequences that almost nobody weighed when they tapped save, and neither is about an attacker.

You cannot take 'your' credentials with you

The FIDO Alliance has written the means to move a credential from one provider to another, in two documents:

  • Credential Exchange Format, which defines "the data structures and format of credentials being passed or referenced", is a Proposed Standard dated 9 March 2026.
  • Credential Exchange Protocol, which "defines a protocol to securely move one or more credentials between two credential providing applications", is a Working Draft dated 3 October 2024, and it is the only version of that document the Alliance offers. Its own status section says it "is not intended to be a basis for any implementations as the Specification may change", that it has no official standing, and that it does not represent Alliance consensus.

The Alliance's download page describes both as currently in early review draft.

The security considerations of the Format say the Protocol "ensures that the credential exchange remains confidential between the exporting provider and importing provider". Two years on from that draft, the arrangement a person entered because a telephone offered it has no completed, standardised way out of it.

The keeper may close the account

Apple's iCloud terms, at section VII.B, reserve the right to "immediately terminate or suspend" an account "under certain circumstances and without prior notice", on causes that include "violations of this Agreement or any other policies or guidelines", "unexpected technical or security issues or problems", and "failure to pay any fees owed by you in relation to the Service". An account inactive for one year ends on thirty days' notice. At section VII.C, on termination "you may lose all access to the Service and any portions thereof", and "after a period of time, Apple will delete information and data stored in or as a part of your Account". Apple "will not be responsible to you or any third party for any damages".

Google's terms run the same way. Google "may suspend or terminate your access to the services or delete your Google Account" where "you materially or repeatedly breach these terms, service-specific additional terms, or policies", where "we're required to do so to comply with a legal requirement or a court order", or where "we reasonably believe that your conduct causes harm or liability to a user, third party, or Google".

Put those terms alongside what the synced passkey form is. Every passkey a person holds sits in one account, because that is what synchronising means, and that account can be suspended for an unpaid bill or on a judgement about conduct the company makes itself, with its contents deleted afterwards and no liability to the person whose imputed identity it was. There is an appeal, and it is to them: no third party hears it, no arbiter sits on it, and the company that took the decision is the company that reviews it. The failure that empties a life is not a burglary. It is an administrative decision taken at a company, potentially in another country, without notice, and the only remedy on offer is to ask the same company to think again.

The Faustian Bargain

Set the bargain out: what you give for what you get.

Surrendered:
  • Custody of the number that proves you are you, to a keeper in another jurisdiction.
  • Any say in what your device reports about you at every login, under a specification written by the parties that read the report.
  • For an institution, the ability to answer an examiner about its own officers' keys from its own records.
  • The ability to move, because the way out is a draft that must not be implemented.
  • The continuity of all of it, because one account holds everything and the company can close that account on its own judgement, reviewed by itself. The American government has no need to force closure: under the CLOUD Act it can require the contents without the holder necessarily ever being told, a far more invasive power.
Received:

Securing two vectors out of five on one of five routes.

Nobody was defrauded into this. It was sold as the 42 of online safety, and on the narrow question of the login it delivers some coverage. The cost sat in places the sale did not go: in a jurisdiction, in a terms-of-service page, in an unfinished protocol, and in the gap between what a provider says about itself and what anybody can verify.

Removed rather than mitigated

Under GRIDS the question does not arise in that form. The trust anchor, which is the thing a verifier relies on, is the holder's own key, and the pair is made on the holder's own device.

The public half is published for anybody to read, which is why it needs no keeper: there is nothing in it to keep. Which ledger carries it is a choice: it can sit on Groot, which is governance-free and gives nobody a power over what is built on it, or on an Associate Chain, which an institution or a nation governs for itself.

The private half never leaves the holder's own devices, and Section 20 put where that leaves a holder: the mnemonic, which is the key itself written out, is the possession, and holding it is the authority. Commit the mnemonic to memory and the thing that proves who you are sits somewhere with no company to serve an order on, no account to close, and no provider to ask.

What a bank or a state attaches to the key you hand them is theirs to keep and to answer for: your name, your role, your licence number, recorded because you chose to hand over the key. The identity stays yours: you are you, and no third party is needed to say so.

Accordingly, there is no credential resident in a foreign-jurisdiction cloud to be compelled, because there is no credential anywhere to be compelled. Where the institution or its jurisdiction runs the chain, the chain is theirs to operate, and for a given institution that chain is a build. The institution, or nation, can itself decide what its rules are, who is subject to them and how.

There is also nobody vouching. A verifier checks the signature against a public key anybody can read, so there is no party standing behind it to be asked, to be bought, to be compelled or to be believed. The identity is the holder's because nobody else is keeping it for them, which is also why no keeper can suspend it, delete it, or decline to let it leave.

Where an institution or a nation chooses to bind its accepted forms of identity, whether a national ID, a passport, a driving licence or a staff pass, to a person's public key, it can, and it maintains that register.

Residency moves the disks and leaves the control point where it was. This removes the control point. A thing that does not exist cannot be produced on an injunction, suspended with an account, or priced into a renewal.

Before any of this goes to a vendor, put three questions to your own people:

  1. For every passkey in this estate, where does the private number physically sit?
  2. Who can be ordered to produce it?
  3. On the day the provider closes the account, what do we do?

The first has an answer and nobody will want it written down. The second has an answer and it is the name of a company in another country. The third your people have never been asked, and the silence is the answer. Financial service regulators have put the question of where a provider sits, and whose law reaches it, yet Apple's iCloud Keychain and Google's Password Manager continue to be touted as the 42, and Microsoft Entra still ships with the setting that would reveal them turned off.

26. Your card number, another vulnerable credential

I bought a phone case online for €17, from a Chinese retailer I had never dealt with and knew nothing about beyond the fact that it has physical shops in Ireland. At the end of it I typed in the long number from my debit card, the expiry date and the three digits on the back, and sent all of it to people I have never met.

That number opens my bank account to anybody who holds it. I handed it over for a phone case.

The objection arrives at once: anything big would be challenged, and the bank would make me whole. Where the card is not present, that number and those three digits are the test, and a challenge is something the issuer may raise rather than something the payment requires. The refund is not a defence of the arrangement either - nobody insures against a thing that works.

Also, define "big". Three years ago my wallet was stolen from my car while I was speaking at a conference. In the five hours between my leaving the car and my opening my phone, UBS sent me four messages asking me to confirm transactions, and the transactions went through without a word from me: five train tickets at CHF 39 each, and the obligatory trip to a sporting goods store, which drained another CHF 140 from my account, all of it by presenting my card to a payment terminal. UBS froze the card when I called, but by then CHF 335 had been taken from my account without my authority.

Nobody calls a card number a credential, but that is exactly what it is. It is a secret that has to be told to everybody who needs to check it, which makes it exactly as safe as the least careful party it has been told to. A password belongs to one service. A card number goes to the merchant; to its payment gateway, which is the company that takes the money on the merchant's behalf; to the acquiring bank, which is the merchant's own bank; to the card network, Visa or Mastercard; and to the issuer, which is the bank that gave you the card. Most of them keep a copy.

The card number is neither access nor authority. It is the same fault in a third costume: a singular thing the web cannot carry, substituted by a string that it can.

What the number costs, counted by the people who count it

The European Banking Authority and the European Central Bank publish a joint count. In 2024 the value of fraudulent card transactions on cards issued in the European Union and the European Economic Area came to €1.3 billion, at a fraud rate of 0.033% of card transaction value. Of that total, remote card payment fraud "in value and volume terms accounted for around 83% of all card fraud in 2024".

Remote means the number travelled and the card did not: online, over the telephone, by post. More than four euros in every five lost to card fraud in Europe are lost on transactions where nothing was present except the number. The thieves who stole my wallet at least needed the card, and had to go to the trouble of taking it from my car.

The British figures give that a human size. UK Finance reports that in 2025 remote purchase fraud took £423.5 million from cardholders across 3.2 million separate cases, an average of about £132 a time. Case numbers rose 13% and the money taken rose 3%, so there were more thefts, and on average each one was smaller.

In 2006 American Express, Discover, JCB International, Mastercard and Visa founded the PCI Security Standards Council. Its data security standard is, in the Council's own words, "intended for entities that store, process or transmit payment account data", and the Council does not enforce it: the card brands and the acquiring banks do.

Five companies require every business on earth that wishes to be paid by card to hold the number. They write the rules for holding it, and they enforce those rules themselves. A global compliance industry exists because of one design decision, which is that the thing authorising a payment is a secret the payer must disclose in order to pay.

Section 22 priced the remedy Visa and Mastercard compel on top of all this, which is 3-D Secure: the check that can interrupt an online payment to ask whether the cardholder is really there. It can never do better than a guess, and the number is the reason.

Below the line

Strong customer authentication, whether 3-D Secure online or a PIN at the till, is asked for only above a line, and below it the card, or the number, is the proof. European law draws the lines itself. A card held to a terminal may pay up to €50 without it, until €150 or five consecutive such payments, whichever count the bank keeps, have gone through since the holder last authenticated; a transport fare or a parking fee paid at an unattended terminal is exempt at any amount; and online, as Section 22 set out, €30 a payment goes through unasked, and up to €500 where the bank's own fraud rate is low enough. UBS tells its customers that its cards pay contactless "up to CHF 80 without any additional measures", and a train ticket at CHF 39 is less than half of that.

Section 22 counted what the lines let through: about 60% of card payments carry no strong customer authentication. The European supervisors who measured it put that mostly down to the exemptions for contactless payments and transport fares at the till - the contactless exemption alone accounts for about 80% of the card payments made in shops without it. By their count, card payments without strong customer authentication within the European Economic Area were defrauded in 2024 at twice the rate of those with it, by value and by number. At the till the rates on exempted payments ran lower, often below the average for cards, and online they ran generally above it, which the supervisors wrote "could suggest that fraudsters adapt their attacks by aiming at transactions that could fall into commonly used exemptions".

The standard set by the regulation offers latitude to the issuer or operator rather than options for users: the contactless exemption allows "for the development of user-friendly and low-risk payment services", and the online thresholds strike "a proper balance" between "the interest in enhanced security in remote payments and the needs of user-friendliness and accessibility of payments in the area of e-commerce". So define big as I asked earlier: big is wherever the rules judge that asking would cost more than losing, the bank may move the line, and the holder has no say in it. Below it a payment is scored and not proven. The regulation requires the bank to run every exempted payment through its fraud monitoring, which weighs lists of stolen credentials, the amount and known fraud patterns, and nothing in it asks the holder whether they authorised the payment. The four messages UBS sent me asked about payments that had already gone through, after the first two had gone through in quick succession and a third was requested.

Where the line has moved, it has moved one way, in favour of cost rather than security. In the United Kingdom it rose from £10 in 2007 to £100 in October 2021, and in March 2026 the Financial Conduct Authority removed the regulatory limit altogether, so that each bank now sets its own on its own judgement of the risk, though most have so far kept £100. In Switzerland it went from CHF 40 to CHF 80 in April 2020, and in November that year the card companies and issuers elected to keep it there.

As the line has risen, the payments have come down to meet it. In the euro area, cards carry 57% of all cashless payments; contactless makes up 85% of the card payments in shops, and the average contactless payment comes to about €27. Of all the payments made in euro-area shops, 88 in every 100 are for €50 or less, and payments of €5 or less, a cup of coffee, are still made mostly in cash, though the card's share of them rose from 15% to 21% between 2022 and 2024, which the European Central Bank puts down in part to contactless having become easier to use "for lower payment amounts too". In the United Kingdom cards carry 64% of all payments, and debit cards "have replaced many low-value cash payments". A cup of coffee bought by card sits below every line there is, and so does the average contactless payment.

The machine economy - all of it below the line

The machine economy does not fall below the line; it exists almost entirely there, and every payment in it is remote - the side of the line on which the supervisors found exempted payments defrauded above the average. A thousand tokens of input to a model, the unit in which its work is priced, costs a fifth of a cent on Anthropic's Claude Sonnet 5.5 and a hundredth of a cent on its Claude Haiku 5.5, at Anthropic's own published prices. Every line drawn so far sits far above a payment of that size, and when a program makes it nobody is present to be asked. The card networks' answer is to hand the agent a token of its own: Visa gives it "a new pass-through payment token, specific to agents", and "Each consumer sets the limits"; Mastercard gives it "agentic tokens", with the consumer's intent recorded as "cart contents, transaction limits and validity windows", and says what that comes to: "In machine-to-machine commerce and programmable money implementations, a consumer or business is always delegating spending authority to a system". The person authenticates the delegation and the agent spends within it, which is authority issued as an artefact with a ceiling on it and exercised below the line by a program that nobody asks.

Look at what Visa describes: agents that "find, shop and buy for consumers based on their pre-selected preferences", with every request going to Visa's own platform, which "will validate that these requests match the authenticated user instruction". Those are card payments with a program at the keyboard, each authorised by the card network on its own and each carrying a fixed charge however small it is: Stripe's published price for a domestic card in the United States is 2.9% plus $0.30, and the $0.30 alone is a hundred and fifty times what a thousand tokens of Sonnet cost, and three thousand times what they cost on Haiku.

Eleven researchers who surveyed agent payments in April 2026 said as much of the networks' agent programmes, naming Mastercard's: tied as they are to "card-network authorization and settlement rails", "each interaction is processed as an independent authorization, making such systems ill-suited for workloads involving frequent small payments or multi-step tasks due to repeated authorization overhead". Both networks have also put their names to the standard Coinbase wrote so that agents could pay in stablecoins instead. When the Linux Foundation announced on 2 April 2026 that it would take over that standard, x402, from Coinbase, Visa and Mastercard were among the backers it named, Visa so that payments can happen "with cards or stablecoins, wherever AI agents transact", and both are now premier members of the x402 Foundation. Having built an answer for agents that the machine economy cannot afford, the networks have taken a seat in the standard that claims it can, and Visa's stated reason is to bring the card in with it.

Read x402's own whitepaper, which Coinbase published in May 2025, with a critical eye. It sells "real-time, trustless payments" with "no intermediaries", and three pages after the second promise it offers, for high-frequency micropayments, the payments the machine economy is made of, channels "between trusted parties": its authors wrote the exception to their own headline and published the two side by side. Neither promise is true of a payment x402 actually makes. On Base, where the whitepaper puts it, every transaction is ordered by a single sequencer that a multisig controlled by Coinbase alone can replace, and the only way round that sequencer, forcing a payment through Ethereum, can take up to twelve hours; the facilitators that check x402 payments and put them on chain include Coinbase's own. The intermediaries the whitepaper says do not exist are Coinbase's, and it is Coinbase telling us they do not exist. It promises "No reliance on banks or third-party approvals, ensuring global, permissionless access" for payments made in stablecoins such as USDC, and that is false as well: USDC is a coin its issuer can stop, and Circle stopped it in the Binance attacker's hands three minutes after Tether's blacklist, as entry 57 records. That is not a trustless payment; it is a payment processor, with Coinbase's sequencer in the middle of every payment and Circle's hand on the switch.

The speed and the price are no truer. It says payments "settle in ∼200ms, providing instant payment finality", but a block on Base takes two seconds, and what arrives in two hundred milliseconds is what Base calls a preconfirmation, "An ultra-fast signal that a transaction will be included, before the full block is sealed", which can still be left out of the block, rarely by Base's account, so that Base's own documentation tells applications that they "should implement fallback logic for critical operations". A signal that a payment will be included is not finality: x402's payments are final when Coinbase's sequencer says they are, and on 5 August 2025, when a failed handover stopped that sequencer, nothing on Base settled for thirty-three minutes, instantly or otherwise. Its comparison table still prices an x402 payment as "Free*", the asterisk moving the gas to a footnote, and Coinbase's own facilitator now charges $0.001 a settlement after the first thousand in a month, ten times what a thousand tokens of Haiku cost; free with an asterisk is not free. The finality it does offer is, in its own words, "for API providers", the party being paid, and it counts among its virtues that payments "settle instantly onchain, eliminating chargebacks and disputes". The eleven researchers say what that leaves the payer: in x402 "completion is defined by transaction inclusion", and the execution "only verifies a successful transfer, not correct delivery". Eliminating disputes does not stop anything going wrong; it removes anybody who could be asked to put it right. A card's holder can at least be made whole, which is the card's own admission that it fails, since nobody insures against a thing that works; x402 admits nothing, and leaves the loss with whoever paid.

So the line is not holding the economy back; the economy is moving under it. Every payment below the line is let through on possession of a card, a number or a token, scored by the bank and proven by nothing, and every step towards a digital economy, the coffee bought by card, the fare tapped at the gate, the query an agent pays for, adds to the share of payments that nothing proves.

The question the whole apparatus is built to approximate

The question is not who you are, nor what you are allowed to do, but whether you authorised this payment, of this amount, to this payee, now.

A card number cannot answer it. The number is the same for every payment, so possession of the number is the only thing a merchant can test, and possession is exactly what a thief acquires. Everything built on top of the number since the 1990s has been an attempt to infer the answer from circumstances: the three digits on the back, the address check, the behavioural score, the one-time code by text message, the application that asks on the telephone. Each is a proxy, and none of them is the holder saying yes to this; a signature is.

What replaces it, and it is not new cryptography

Bind the card to the public key, just as we offer to for access and authority credentials. A customer authenticates with their bank or their card issuer the way they do today. The issuer sends a one-off message that cannot be reused, carrying the customer's own account reference and the time. The customer's device signs it and returns the signature with the public key that made it. The issuer checks the signature against the key, and from that moment the issuer holds a key belonging to that customer. No document was posted, no agency was engaged, and nothing secret changed hands, because a public key is public.

Then a purchase. The merchant does not receive a number, because there is no number. The payment instruction goes to the customer's own device as a dead drop at a short-lived address of its own, is displayed there in plain words, and is signed on that device. What the merchant receives back is a signature over that instruction: this amount, this payee, this moment. It buys nothing else and it serves nobody else.

A merchant that never holds a card number cannot lose one. A gateway breach yields signatures over completed purchases, which authorise nothing further. A relay that captures the instruction in flight has captured a message that only the holder's key can usefully sign. The 83% does not get smaller; the category it describes stops existing, because remote card fraud is fraud on a travelling number and nothing is travelling.

A signature also does away with the limits under which a card pays without the holder being asked, €50 for a contactless payment at a till under European rules and €30 for a payment online, because neither reason for them survives. The rules let those payments skip the PIN at the till and the 3-D Secure check online because each is a second step added to the card, and asking for it every time is judged to cost more than the losses it would prevent. A signature is no second step: the holder sees on their own device what they are paying and to whom, and approving it is what authorises the payment, so there is nothing to waive at any amount, and the device signs a coffee exactly as it signs a car. Nor does each check carry a cost to weigh against the loss, because a bank running GRIDS on its own Associate Chain pays for capacity rather than for each check, as Section 22 set out, so the thousandth coffee of the day costs it nothing extra to verify. Every payment, at every size, carries the holder's signature over that payment, and none of them is let through on a string handed over to be checked.

It does not stop at the screen either. The chip in a card proves the card is genuine, and under the contactless limit nothing proves who is holding it, which is how my card bought five train tickets for somebody else. At a counter the terminal shows the instruction's address as a code, and the holder's telephone reads it, fetches the instruction, displays it in plain words and signs it, which is Stage 2 of Section 20 with a till in place of the desktop: GajuMobile is operational on Android, with iOS by the end of 2026. Signing a payment this way is a design we are putting to the payment industry, and it rests on what already runs: GRIDS has secured access and authority in commercial use since 24 March 2025, and a payment is that same mechanism carrying a different instruction.

Written for Visa and Mastercard, who should read it as good news

The argument I have been making to banks for twenty-five years is that they will make more money at less risk by concentrating on where they add value, not where they control access. For all of those twenty-five years, I have argued that the infrastructure that gives them that control is not an asset but a liability. Every year it costs more to run, every year it carries more of the firm's risk, and no customer ever chose a provider because of it.

The card networks are the clearest instance alive. Their routing infrastructure is enormous, old and expensive, and competitors are coming for it from every direction. Their fraud capability is something else entirely: six decades of data on how payment fraud is attempted, across every market and every instrument, held by nobody else and reproducible by nobody else. It is the most defensible asset in payments and it is currently funded as overhead, because 3-D Secure is a cost the networks carry and cannot charge for.

Remove the number and the fraud capability does not become less valuable; it becomes the product. A world of signed payment instructions still needs somebody who can tell an unusual pattern from a normal one, who can price risk across a hundred markets, and who can stand behind a guarantee when the pattern is missed. That is a service worth charging for, in the way routing was once worth charging for, and the firms best placed to sell it are the firms that already have the data.

Nothing here requires any network to switch anything off. A signed instruction can sit beside the existing rails as an additional authorisation method, exactly as 3-D Secure did, and take volume as merchants discover that the transactions they do not have to protect are the cheapest they process.

Closing data risks

The card number is the vivid case because the money is countable. The shape is everywhere.

An account cascade runs because each secret opens the next: reach the email account and the password reset for the telephone arrives there, and the telephone carries the code for the bank. The secrets are different at each step and the mechanism is identical, which is why one compromise so often becomes all of them. A key that signs cannot be collected at the first step, so there is no first step to collect.

A customer database is dangerous because of what is in it. Hold public keys instead and a breach of it publishes what was already public. The question a board asks after an incident is what did they get, and the answer is a list of public keys.

A login form is an attack surface because it accepts typed input. Take the typing out and brute force, credential stuffing, throttling, rate limiting and the whole apparatus built around a text field stop having anything to work on.

Continuity is the property nobody thinks to ask a vendor for. What matters online is almost never what a passport says. It is whether the party on the other end is the same party as last time, which is how trust is built everywhere else and the one thing the web has never been able to establish. A key answers it exactly: the same key or not the same key, checkable by anybody and forgeable by nobody.

When the party authorising is a program

Part IV set out what models now do unsupervised. An agent that books, buys, renews or transfers is not a person who can be telephoned to confirm, and there is nothing in a session, a token or a card number that distinguishes an agent acting within its mandate from an agent that has been talked out of it.

A signature over a specific instruction is the only artefact that answers the question at all. The instruction says what is being authorised, the signature says who authorised it, and the two cannot be separated, so an agent's authority stops at exactly the bounds its principal signed. That is the same mechanism as the phone case, with the holder's attention replaced by the holder's policy.

A signature over an instruction also makes the smallest payments possible, which changes economics that have been stuck for thirty years. The web monetises attention because it has never been able to charge for consumption: a payment costing cents to process cannot collect cents. Where the authorisation is a signature and settlement runs between the two parties rather than across five intermediaries, the floor comes down far enough to pay for a page, a query, a minute of video or a thousand tokens of inference. Charge a fraction of a penny to send an email and bulk unsolicited mail stops being free, and nothing in thirty years of filtering has ever made it cost the sender anything.

Settlement between the two parties runs in a state channel, and state channels are operational on the Gajumaru. One transaction on the chain opens the channel and one closes it, and every update in between is signed by the two parties and by nobody else, with no sequencer to order it and no facilitator to check it. The payment and the delivery travel in the same update, so the update that releases the payment is the update that records the delivery, or neither is accepted: a seller cannot be paid for a delivery that did not happen, and a buyer cannot receive one they did not pay for. Under x402 a payment is complete once its transaction is included, delivered or not, and the channels its whitepaper offers for the same payments run only "between trusted parties"; a Gajumaru channel asks no trust of either party, because the money in it is locked in a contract neither of them controls, and neither can take what the other has not signed. That is not a dispute process and it is not insurance; it removes the failure a dispute process exists to remedy.

What removing it opens

The credential was the web's substitute for authority, forced by a copying medium that cannot carry a singular object. The card number is that same substitute wearing the clothes of a payment instrument, and it is the only one of its forms whose cost anybody publishes.

Part II set out the routes, and removing it closes them. The same substitute was what blocked full digitalisation, the machine economy and the agentic economy, so removing it opens all three.

Three things made the year 2000 bill payable: the fault was architectural, it was dated, and it could be finished, so when the date passed the work was done. This one is architectural and neither of the others: nothing on the invoice for mitigation can be declared complete, and the date belongs to whoever moves first rather than to a calendar. What can be finished is the removal, and for most institutions the first step in it is a change to the login plumbing they already run.

PART VI: THE RECORD IN FULL

27. The fifty-eight entries

Every incident summarised in Part III is set out here in full: the target, the background rate that target lives in, the dates, what was reached, the route markings, what drove it, the figures the sources give, what it cost where anybody has said what it cost, and the primary source for each. Each entry is written to be read on its own, so a reader who comes straight to one has the whole record for that case.

Each incident is here for where it ended. The route marking measures access, the way in, and the driver records who or what ran the operation, a person with no model, a frontier model or an agent on freely downloadable weights. Neither is what puts an incident in this record. What does is authority, the capacity to act on an account, a system, an estate or a register, and it comes at the end, often some distance from the way in. The web carries that authority in a credential and honours it for whoever presents it, so whatever the way in, reaching the credential is reaching the authority. Fifty-three of the entries reached it, and five record an attempt or a prepared instrument aimed at it and say so at the point of the claim.

  • The cost field carries what was published and nothing else.
  • Across all fifty-eight incidents there is one arrest. In most of them nobody has published what it cost, and in a good many nobody has published anything at all beyond the fact that it happened.
  • The entries run broadly with the calendar and are numbered for reference; the list at Section 15 carries every entry's dates, and the timeline at Section 32 sets the decisive ones in strict order.
  • The route markings are the five routes set out at Section 13: one, taken; two, granted; three, inherited; four, obeyed; and five, believed. Where a mechanism was not established the entry says so and the incident is not counted towards any route.
  • Where two sources disagree both are recorded and the primary is named. Where an entry rests on secondary reporting because no primary account exists, the entry says which.
  • Where an entry names a flaw by its catalogue number, CVE-2026-0257 and the like, that is the public identifier every vendor and every defender uses for one particular vulnerability, and a CVSS figure beside it is its severity rating on the common scoring system, out of ten.

1. Lithuania, Centre of Registers

Target

VI Registru centras, the state enterprise maintaining Lithuania's Real Estate Register and Register of Legal Entities. A national register operator.

Against what background

Lithuania's National Cyber Security Centre registered 1,172 cyber incidents across the country in the first nine months of 2026, against 2,451 in the same nine months of 2025. The 2026 count includes 499 information-gathering attacks, 354 frauds, 64 intrusions, 21 service disruptions, and 11 ransomware and advanced persistent threat cases. The centre's head, Antanas Aleknavicius, cautioned that fewer registered incidents does not mean the threats have gone.

Dates

The first unauthorised logins took place at the beginning of 2026, before the period this record covers, and the queries ran for months; prosecutors confirmed that logins and access attempts were made from a foreign state. No authority has dated the last of the queries, so nothing places the end of the act before that period began, and the incident is carried on its disclosure inside it. The Centre became aware of the breach in April 2026. The Prosecutor General's Office disclosed the pre-trial investigation on 22 May 2026. The Centre of Registers published its own data-protection notice. The Centre's director, Adrijus Jusas, announced his resignation on 25 May 2026. On 27 May, after a meeting of the State Defence Council, President Gitanas Nauseda said there were signs of a cyber attack organised by hostile states.

What was reached

678,976 extracts from the Real Estate Register relating to 538,226 people, on the State Data Protection Inspectorate's count, and 33 from the Register of Legal Entities relating to 66 people. The property extracts carry names, personal identification codes, dates of birth, property addresses, register numbers, cadastral data, which is the survey record of a parcel's boundaries and extent, and information on real rights, which are the ownership and charge interests recorded against it. The Centre states that contact details, bank account information and transaction documents were not among them. Whoever held the Migration Department's credentials could then read the register at will, as an authorised institution, and did so for months.

Route: one, the credential taken

The register was not broken into. The queries were issued on the login credentials of accounts at the Migration Department, an institution authorised to query the registers as ordinary business. Every query the register answered, it answered correctly, to a caller presenting the credentials of a body entitled to ask.

Driver: human with no model involved

The State Data Protection Inspectorate and the Prosecutor General's Office describe queries issued on the Migration Department's own credentials, with logins made from a foreign state, and name no model.

Figures

678,976 Real Estate Register extracts relating to 538,226 people, and 33 Register of Legal Entities extracts relating to 66 people, on the State Data Protection Inspectorate's count of 16 October, against the approximately 600,000 first reported. The Prosecutor General's Office puts the damage to the state at not less than €111,000. The outgoing director put the cost of bringing the state's information systems up to standard at between €50 million and €60 million, which is his own assessment and not a government figure.

What it cost

Lithuania's State Data Protection Inspectorate announced on 16 October 2026 that it had closed its investigations and would open administrative fine proceedings against Registru centras and against the Information Technology and Communications Department under the Ministry of the Interior. It reprimanded the Migration Department, which said it would not appeal. No amount has been set. In May 2026 the Inspectorate's deputy director, Danguole Morkuniene, put the statutory ceiling at €60,000 and said the measures could be instructions as well as a fine.

A group of 1,337 individuals filed a complaint in August 2026, each seeking €5,000 in non-pecuniary damages plus 5% annual procedural interest, roughly €6.7 million in all. The respondent is the State of Lithuania, represented by the Ministry of Justice, Registru centras and the Migration Department. ELTA reported on 9 September 2026, citing the court's press release, that the Regional Administrative Court had accepted the complaint for hearing. When the period to join closed on 8 October, ELTA reported about 2,500 people claiming more than €12 million, on figures it called preliminary. In the same report HubLegal, the law firm representing the claimants, said that 12 judges who could themselves have been affected by the breach had recused themselves from hearing the case. On 22 October tv3.lt reported, on HubLegal's information, that it is still being decided which court will hear the group case, and that the firm plans a second group complaint, with registration for it to be announced separately. Any award comes from the state budget.

The Seimas declined for a second time, on 7 July 2026, to establish a temporary commission of inquiry: 50 in favour, 41 against, 17 abstaining, short of the threshold. Later the same day it agreed to consider a proposal from the Nemuno Ausra parliamentary group that the National Audit Office audit the Centre of Registers by 10 October 2026. The Auditor General, Irena Segaloviciene, told the Seimas Audit Committee that the deadline made the assignment objectively unachievable and that an audit of this complexity, carried out to international standards, would need at least 12 months, and on 10 July the committee agreed by consensus to move the deadline to 5 October 2027. ELTA reported on 17 September that the Seimas had adopted the decision to initiate the audit, with 96 members voting for it at the adoption stage and 12 abstaining. The National Audit Office is to establish whether the Centre's organisational, technical and cybersecurity measures were sufficient, whether its incident prevention procedures complied with the law, whether the actions of the responsible institutions and of the Centre itself after the possible leak became public were sufficient, and whether the supervision of the state company is sufficient.

The Prosecutor General's Office says it is analysing the data to establish who carried out the offence and to what end. Interior Minister Vladislavas Kondratovicius said in May that the credentials used belonged to two Migration Department employees. By June that had loosened: the same claim was being reported as something that could have happened, the Migration Department's own director said she could not confirm it while the investigation ran, and the possible scope had widened to employee accounts across around fifty bodies under the Interior Ministry. On 16 October the State Data Protection Inspectorate settled it: the extracts were taken by logging in unlawfully to the email accounts of two Migration Department employees, neither multi-factor authentication nor filtering by address was in place, and neither the Inspectorate nor the people concerned were told in time. No suspect has been named and no arrest has been published.

Detection was human

The breach was uncovered after a citizen raised concerns about unusual interest in their property shown through Migration Department channels.

Primary source

VI Registru centras, notice of a personal data security breach, https://www.registrucentras.lt/p/pranesimas-apie-asmens-duomenu-saugumo-pazeidima, with the frequently-asked-questions entry at https://www.registrucentras.lt/duk/atsakymas/kokie-duomenys-buvo-nutekinti-per-saugumo-incidenta-kokiu-saugumo-priemoniu-imtasi. Publisher: the victim organisation. Read 10 August 2026; the pages render only in a browser and could not be re-read on 27 September 2026.

Secondary

LRT, the national broadcaster: BNS, "Lithuania probes theft of 600,000 records from state registry", https://www.lrt.lt/en/news-in-english/19/2936340/lithuania-probes-theft-of-600-000-records-from-state-registry, 22 May 2026; BNS, "Lithuania Centre of Registers chief resigns after major data leak", https://www.lrt.lt/en/news-in-english/19/2939121/lithuania-centre-of-registers-chief-resigns-after-major-data-leak, 25 May 2026, for what was and was not taken; Gabriele Jankiene, "People in Lithuania to be able to check if their Registry Centre data was stolen", https://www.lrt.lt/en/news-in-english/19/2939178/people-in-lithuania-to-be-able-to-check-if-their-registry-centre-data-was-stolen, 25 May 2026, for detection in April and the first logins at the start of the year; BNS, "Lithuanian police confirm mass registry data was stolen via Migration Department", https://www.lrt.lt/en/news-in-english/19/2941197/lithuanian-police-confirm-mass-registry-data-was-stolen-via-migration-department, 26 May 2026, for the Migration Department accounts, quoting Arunas Maskoliunas, head of the Criminal Police Bureau; BNS, "'Hostile states' behind massive data breach, Lithuanian president says", https://www.lrt.lt/en/news-in-english/19/2942359/hostile-states-behind-massive-data-breach-lithuanian-president-says, 27 May 2026; "Lithuania confirms intelligence officers among victims of major registry data breach", https://www.lrt.lt/en/news-in-english/19/2944220/lithuania-confirms-intelligence-officers-among-victims-of-major-registry-data-breach, 29 May 2026, for the citizen who raised the alarm; and "VRM tikslina: nei ministerija, nei IRD 100 tukst. euru saskaitos is Registru centro negavo", https://www.lrt.lt/naujienos/lietuvoje/2/2963283/vrm-tikslina-nei-ministerija-nei-ird-100-tukst-euru-saskaitos-is-registru-centro-negavo, 17 June 2026, for the €111,000 damage figure. All read 27 September 2026.

BNS, carried by tv3.lt, "Dėl nutekintų gyventojų duomenų - naujausia žinia: žada baudas", https://www.tv3.lt/naujiena/lietuva/del-nutekintu-gyventoju-duomenu-naujausia-zinia-zada-baudas-n1560191, 16 October 2026, read 30 October 2026, for the State Data Protection Inspectorate's findings, its counts and its sanctions. ELTA, carried by tv3.lt, https://www.tv3.lt/naujiena/naujienos/registru-centro-duomenu-nutekejimo-byla-2-5-tukst-gyventoju-praso-daugiau-nei-12-mln-euru-neturtines-zalos-atlyginimo-n1558812, 12 October 2026, read 30 October 2026, for the group complaint when the period to join closed. Vygantas Tuzas, ELTA, carried by LRT, "Segalovičienė: dabar siūlomu terminu atlikti Registrų centro auditą būtų neįmanoma", https://www.lrt.lt/naujienos/verslas/4/2985310/segaloviciene-dabar-siulomu-terminu-atlikti-registru-centro-audita-butu-neimanoma, 9 July 2026, and "Seimo komitetas siūlo prailginti Registrų centro audito terminą iki 15 mėnesių", https://www.lrt.lt/naujienos/verslas/4/2986220/seimo-komitetas-siulo-prailginti-registru-centro-audito-termina-iki-15-menesiu, 10 July 2026, both read 30 October 2026, for the audit proposal, the Auditor General's objection to its deadline and the Audit Committee's move of the deadline to 5 October 2027. ELTA, carried by tv3.lt, "Seimas pavedė atlikti Registrų centro auditą: štai dėl ko bus aiškinamasi", https://www.tv3.lt/naujiena/naujienos/seimas-pavede-atlikti-registru-centro-audita-stai-del-ko-bus-aiskinamasi-n1552123, 17 September 2026, read 30 October 2026, for the Seimas's adoption of the audit decision, the vote and the audit's scope; the ELTA report of 12 October above gives the deadline as 5 October 2027. ELTA, carried by tv3.lt, "Dėl duomenų nutekinimo teismas priėmė nagrinėti grupinį skundą dėl Registrų centro", https://www.tv3.lt/naujiena/verslas/del-duomenu-nutekinimo-teismas-prieme-nagrineti-grupini-skunda-del-registru-centro-n1550009, 9 September 2026, read 30 October 2026, for the complaint of 1,337 people, its claims and the respondent, and its acceptance for hearing by the Regional Administrative Court, on the court's press release. Kamile Medeksaite, tv3.lt, "Tūkstančiams gyventojų - papildomi pinigai: išmokės, net jei nepraradote nė euro?", https://www.tv3.lt/naujiena/naujienos/tukstanciams-gyventoju-papildomi-pinigai-ismokes-net-jei-nepraradote-ne-euro-n1561491, 22 October 2026, read 30 October 2026, for HubLegal's information that it is still being decided which court will hear the group case and that a second group complaint is planned.

For the background and the cost: LRT.lt, "Šiemet per 9 mėnesius užfiksuota 52 proc. mažiau kibernetinių incidentų nei pernai", https://www.lrt.lt/naujienos/mokslas-ir-it/11/3082075/siemet-per-9-menesius-uzfiksuota-52-proc-maziau-kibernetiniu-incidentu-nei-pernai, 14 October 2026, read 30 October 2026; National Cyber Security Centre of Lithuania, "About National Cyber Security Centre", https://www.nksc.lt/en/structure.html, read 30 October 2026; BNS, "Duomenų inspekcija dėl nutekintų RC duomenų atsakingoms institucijoms skirs baudas, papeikimą (papildytas)", https://bns.lt/naujiena/duomenu-inspekcija-del-nutekintu-rc-duomenu-atsakingoms-institucijoms-skirs-baudas-papeikima-papildytas-5wju93ul, 16 October 2026, read 30 October 2026; LRT.lt, https://www.lrt.lt/naujienos/verslas/4/3084106/duomenu-inspekcija-del-nutekintu-rc-duomenu-atsakingoms-institucijoms-skirs-baudas, read 30 October 2026; LRT.lt, "Duomenų inspekcija: bauda Registrų centrui gali siekti 60 tūkst. eurų", https://www.lrt.lt/naujienos/mokslas-ir-it/11/2941262/duomenu-inspekcija-bauda-registru-centrui-gali-siekti-60-tukst-euru, 26 May 2026, read 30 October 2026; BNS, "Teisme - 6,7 mln. eurų grupės ieškinys dėl duomenų vagystės iš Registrų centro", https://bns.lt/naujiena/teisme-67-mln-euru-grupes-ieskinys-del-duomenu-vagystes-is-registru-centro-dfhxptoj, 10 August 2026, read 30 October 2026; LRT.lt, "Teismas priėmė nagrinėti grupinį skundą dėl Registrų centro duomenų nutekinimo", https://www.lrt.lt/naujienos/verslas/4/3047133/teismas-prieme-nagrineti-grupini-skunda-del-registru-centro-duomenu-nutekinimo, 9 September 2026, read 30 October 2026; 15min.lt, "Teismas priėmė precedento neturintį ieškinį prieš Registrų centrą: nusišalino 7 teisėjai", https://www.15min.lt/verslas/naujiena/bendroves/teismas-prieme-precedento-neturinti-ieskini-pries-registru-centra-nusisalino-7-teisejai-663-2759886, 9 September 2026, read 30 October 2026; LRT.lt, https://www.lrt.lt/naujienos/verslas/4/3018349/registru-centro-duomenu-nutekinimas-reikalaujama-atlyginti-6-7-mln-euru-zala, read 30 October 2026; LRT.lt, "Seimas vėl atsisakė pradėti parlamentinį tyrimą dėl duomenų vagystės iš Registrų centro", https://www.lrt.lt/naujienos/verslas/4/2983209/seimas-vel-atsisake-pradeti-parlamentini-tyrima-del-duomenu-vagystes-is-registru-centro, 7 July 2026, read 30 October 2026; LRT.lt, https://www.lrt.lt/naujienos/verslas/4/2948204/registru-centras-teigia-nutekintu-duomenu-neanalizaves-tai-atlieka-generaline-prokuratura, read 30 October 2026; LRT.lt, "Ministras: apie duomenų vagystę iš RC sužinota po užklausos dėl domėjimosi piliečio turtu", https://www.lrt.lt/naujienos/lietuvoje/2/2944189/ministras-apie-duomenu-vagyste-is-rc-suzinota-po-uzklausos-del-domejimosi-piliecio-turtu, 29 May 2026, read 30 October 2026; kasvyksta.lt, "Siekiant pasisavinti duomenis galėjo būti įsilaužta į 50-ies VRM institucijų darbuotojų paskyras", https://kaunas.kasvyksta.lt/lietuvoje/siekiant-pasisavinti-duomenis-galejo-buti-isilauzta-i-50-ies-vrm-instituciju-darbuotoju-paskyras, 5 June 2026, read 30 October 2026; LRT.lt, "Tęsiasi tyrimas dėl pavogtų Registrų centro duomenų: jų apimtis - išskirtinai didelė", https://www.lrt.lt/naujienos/lietuvoje/2/2998202/tesiasi-tyrimas-del-pavogtu-registru-centro-duomenu-ju-apimtis-isskirtinai-didele, 22 July 2026, read 30 October 2026.

2. Bitwarden CLI, npm publishing workflow

Target

Bitwarden, a password management company. The compromised package was @bitwarden/cli, its command line tool, on the npm registry, which serves ready-made JavaScript code to anyone who asks.

Against what background

The compromised package took 77,980 downloads in the week ending on the day of the compromise, on npm's own download interface. Across the registry around it, Sonatype counts 7.97 trillion npm downloads in 2025 against 5.59 million components held.

Dates

Malicious commit 22 April 2026 at 21:18 UTC. The poisoned package was published at 21:22:59 UTC, within five minutes, and circulated for roughly ninety minutes. SafeDep published its technical analysis on 24 April 2026 and records that Bitwarden said the incident affected the npm distribution path for the command line interface during a short window on 22 April 2026.

What was reached

The publishing credential, by way of a poisoned GitHub Actions workflow: the attacker modified .github/workflows/publish-cli.yml so that the legitimate package was swapped for a malicious one at the npm publish step. The published package then harvested GitHub tokens, npm tokens, SSH keys, which one machine uses to log in to another, cloud credentials, .env files, shell history and AI tool configuration files, including ~/.claude.json and Model Context Protocol settings, which hold the credentials an AI coding assistant uses to reach the services it has been connected to. It was also built to republish downstream packages and to inject GitHub Actions workflows that exfiltrate the credentials held by continuous integration, the automated build and publish machinery a project runs on every change.

Route: one

A publishing credential was taken and used, and the package published with it took further credentials. Writing into other repositories' workflows would be route four, obeyed, as the package spread onward, and this register does not mark it, because the source does not establish that any pipeline executed the injected workflow.

Driver: human with no model involved

No source names a model as the operator. Entry 21 is the same campaign: SafeDep links this incident to Trivy, LiteLLM and Checkmarx, and SOCRadar attributes it to TeamPCP.

Figures

Version @bitwarden/cli@2026.4.0, one version ahead of the then-current 2026.3.0. Under five minutes between workflow modification and publish, and roughly ninety minutes live.

What it cost

Bitwarden states that there is no evidence that end user vault data was accessed or at risk, no evidence that production data or production systems were compromised, that the issue affected the npm distribution mechanism for the command line tool during the window, that the compromised access was revoked and that the malicious release was deprecated.

An identifier was issued: CVE-2026-42994, published 1 May 2026, scored 9.8 and rated critical, records that the version obtained from npm inside a window of an hour and a half on 22 April 2026 had embedded malicious code.

Eran Medan, co-founder and chief technology officer of Arnica, counted 334 developers taking the poisoned build. That is a researcher's figure, neither the registry's nor Bitwarden's, and against the package's 77,980 downloads in the week ending on the day of the compromise it is about four in every thousand.

Nobody has published a count of credentials stolen, a secondary package confirmed infected, a fine, or a filed claim. GitHub made npm staged publishing generally available on 22 May 2026, putting a human two-factor checkpoint between a publish and a package becoming installable, and its later hardening work adds a 72-hour read-only period on high-impact accounts after an email change or a two-factor recovery. It also announced a breaking change in version 12 of the npm client that disables install-time scripts by default, and version 12 shipped on 8 July 2026 with dependency lifecycle scripts "blocked by default unless allowed by the root package's allowScripts policy". Trusted publishing already existed. None of these announcements names Bitwarden or Checkmarx, so the ordering is sequence and not attribution.

What this establishes

Four entries in this register turn on an AI coding assistant's configuration file. Here the harvester read the file for what it held. At entries 11 and 25 the worms wrote to such files so that the tool would re-run the payload, and at entry 47 the payload writes into the configuration directories of an assistant and an editor.

Primary source

SafeDep, "Bitwarden CLI Supply Chain Compromise", https://safedep.io/bitwarden-cli-supply-chain-compromise/. Publisher: SafeDep. Read 27 September 2026.

Secondary

SOCRadar, "Bitwarden CLI Hijacked in npm Supply Chain Attack Linked to TeamPCP", https://socradar.io/blog/bitwarden-cli-hijacked-npm-supply-chain-teampcp/, read 27 September 2026.

npm, release v12.0.0, https://github.com/npm/cli/releases/tag/v12.0.0, 8 July 2026, read 30 October 2026, for install-time scripts blocked by default.

For the background and the cost: npm, Inc., registry download-counts API, https://api.npmjs.org/downloads/point/2026-04-16:2026-04-22/@bitwarden/cli, read 30 October 2026; Sonatype, "Software Infrastructure Strain", https://www.sonatype.com/state-of-the-software-supply-chain/2026/software-infrastructure-growth, 2026, read 30 October 2026; Bitwarden, "Bitwarden Statement on Checkmarx Supply Chain Incident", https://community.bitwarden.com/t/bitwarden-statement-on-checkmarx-supply-chain-incident/96127, read 30 October 2026; NIST National Vulnerability Database, CVE-2026-42994, https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-42994, 1 May 2026, read 30 October 2026; Cybernews, "Bitwarden CLI compromised in supply chain attack: hundreds of developers have installed malware", https://cybernews.com/security/bitwarden-cli-npm-package-compromised-with-malware/, read 30 October 2026; GitHub Changelog, "Staged publishing and new install-time controls for npm", https://github.blog/changelog/2026-05-22-staged-publishing-and-new-install-time-controls-for-npm/, 22 May 2026, read 30 October 2026; The GitHub Blog, "Disrupting supply chain attacks on npm and GitHub Actions", https://github.blog/security/supply-chain-security/disrupting-supply-chain-attacks-on-npm-and-github-actions/, 28 July 2026, read 30 October 2026.

3. Instructure Canvas LMS

Target

Canvas, a learning management system operated by Instructure. A commercial education platform used across schools and universities.

Against what background

Instructure's own published scale for Canvas: at peak it has supported six million concurrent users, its mobile applications have been downloaded 27 million times, and it runs in more than a hundred countries and 33 languages.

Dates

Initial breach 25 April 2026. Detected 29 April 2026. Instructure disclosed on its status page on 1 May 2026. ShinyHunters claimed responsibility on 3 May and displayed a ransom message on 7 May, with a deadline of 12 May.

What was reached

Names, email addresses, student identification numbers and private messages between students and teachers. The reporting states that passwords, dates of birth, government identification and financial information were not reached.

Route: not established

Instructure's own incident page gives the mechanism in two lines: the actor worked "using one of our Free-For-Teacher accounts", and the update of 8 May from its chief executive, Steve Daly, says "We also identified a vulnerability regarding support tickets in our Free for Teacher environment that was exploited". Neither establishes whether a credential was taken, granted or inherited. What they do establish is that the entry was made on an account, which is a credential, and the support-ticket flaw was worked from inside it. Push Security places the wider ShinyHunters campaign on three techniques: adversary-in-the-middle phishing after a vishing call, which is phishing done by telephone; device-code phishing; and stolen OAuth tokens from compromised third-party integrations. It states that the Instructure strand began with a Salesforce tenant compromise in September 2025 and resurfaced in May 2026. That is a description of the campaign and not of this entry's mechanism, and this register does not convert it into one.

Driver: not established by the source
Figures

Figures differ between sources by nearly a factor of ten, and both are recorded. ShinyHunters claimed 3.65 terabytes of data from approximately 275 million users, as compiled by Wikipedia, which also gives 8,809 institutions. TechCrunch's September round-up gives 30 million or more student and staff records. Neither is Instructure's figure, and Instructure's own has not been located. The primary is the company's own incident page, read at source on 30 October 2026.

What it cost

Instructure paid, and says so obliquely. Its incident page records that it reached an agreement with the unauthorised actor, that the data was returned, that it received digital confirmation of destruction in the form of shred logs, that it had been informed no Instructure customers would be extorted publicly or otherwise, and that the agreement covers all impacted customers. Instructure also said, in words carried by reporting rather than by its own incident page, that there is never complete certainty when dealing with cyber criminals. No amount has been disclosed, and the $10 million figure in circulation is recorded as an unconfirmed rumour.

Canvas went into maintenance mode. A second attack was detected and disabled about ten minutes after it began, and Canvas was fully back online on 9 May 2026. Institutions lost it for between about a day and several days. The University of Canberra disconnected Canvas on 8 May and restored core access on 9 May, ran an assessment-free period from 8 to 13 May, and extended assignment deadlines by a minimum of 72 hours and later 96. Finals were disrupted at Arizona State University.

A product was killed: Free-for-Teacher, the free tier, was permanently discontinued. The incident page records it as already done on 1 June 2026, with users given a window to download their material during the week of 28 May, and gives no date for the decision itself. Free-for-Teacher accounts were the way in.

The United States Department of Education's Student Privacy Policy Office requested information from Instructure to ensure compliance with the Family Educational Rights and Privacy Act, recorded that schools are reporting Canvas-related impacts to the Department under existing incident-reporting requirements, and urged all institutions to implement multi-factor authentication uniformly across their systems.

Andrew R. Garbarino, chairman of the House Committee on Homeland Security, wrote to Instructure on 11 May 2026 saying the Committee has a responsibility to examine the incident, and requesting that the company or a senior representative brief it.

Federal litigation was consolidated as In Re Instructure Data Breach Litigation, 2:26-cv-00374-RJS-CMR, in the United States District Court for the District of Utah, Central Division, before District Judge Robert J. Shelby and Chief Magistrate Judge Cecilia M. Romero. The docket passed 112 entries by the middle of July 2026. The case runs in three interim litigation tracks, and on 24 August 2026 the court selected six attorneys, after evaluating 24 applications, to serve on the Plaintiffs' Executive Committee for Track 1, the Individual Users Track; Chimicles Schwartz Kriner & Donaldson-Smith announced that its partner Beena M. McDonald is one of them. Teachers filed separately over the closure of Free-for-Teacher.

Instructure reported its forensic review of the data involved as complete on 29 September 2026, just over five months after the initial breach, and Kroll was engaged to coordinate notifications where institutions determine that notice is required.

What this establishes

The largest claimed victim count in this register sits on an entry whose mechanism nobody has established. Instructure says the data was destroyed, and TechCrunch reports that it paid the ransom to get there. A copy cannot be shown to have been destroyed, the only party asserting it is the one that paid for the assurance, and nothing in this entry tests it.

Primary source

Instructure, "Security Incident Update & FAQs", https://www.instructure.com/incident_update, latest update 29 September 2026, read 30 October 2026, including Steve Daly's update of 8 May 2026; its closing line is that further updates go directly to affected institutions. The rest of the account rests on secondary compilation.

Secondary

Dan Green, Push Security, "The three attack techniques behind ShinyHunters' 2026 campaigns", https://pushsecurity.com/blog/analyzing-the-instructure-breach, 8 May 2026, read 27 September 2026. Wikipedia, "2026 Canvas data breach", https://en.wikipedia.org/wiki/2026_Canvas_data_breach, read 27 September 2026, recorded as a compilation and not as authority. Zack Whittaker, TechCrunch, "Leaks, data breaches, and ransom notes: The worst hacks of 2026 so far", https://techcrunch.com/2026/09/15/the-worst-hacks-and-breaches-of-2026-so-far/, 15 September 2026, read 27 September 2026. Chimicles Schwartz Kriner & Donaldson-Smith LLP, "CSKD Partner Beena McDonald Appointed to Plaintiffs' Executive Committee in Instructure Data Breach Litigation", https://chimicles.com/?p=61700, undated, read 30 October 2026, the firm's announcement of its partner's appointment, for the court's order of 24 August 2026 and the three interim litigation tracks.

For the background and the cost: Instructure, "Canvas by Instructure: World Leading LMS for Teaching & Learning", https://www.instructure.com/canvas, read 30 October 2026; Help Net Security, "Instructure took a risky approach to recover stolen Canvas data", https://www.helpnetsecurity.com/2026/05/12/instructure-canvas-data-breach-shinyhunters-agreement/, 12 May 2026, read 30 October 2026; abc.net.au, https://www.abc.net.au/news/2026-05-08/students-lose-access-to-canvas-receive-ransom-messages/106657440, read 30 October 2026; abc.net.au, https://www.abc.net.au/news/2026-05-11/tas-universities-regain-access-to-canvas-hacker-deadline/106666744, read 30 October 2026; University of Canberra, "Canvas outage and Instructure cybersecurity incident updates", https://www.canberra.edu.au/about-uc/media/newsroom/2026/may/canvas-outage-and-instructure-cybersecurity-incident-impact-on-uc-learning-and-teaching, 14 May 2026, read 30 October 2026; Arizona's Family, "Cyberattack disrupts ASU finals week, leaving students unable to complete exams", https://www.azfamily.com/2026/05/08/cyberattack-disrupts-asu-finals-week-leaving-students-unable-complete-exams/, 8 May 2026, read 30 October 2026; U.S. Department of Education, Federal Student Aid, "(GENERAL-26-27) Technology Security Alert - Ongoing Cybersecurity Incident Involving the Canvas Learning Management System (Updated May 29, 2026)", https://fsapartners.ed.gov/knowledge-center/library/electronic-announcements/2026-05-12/technology-security-alert-ongoing-cybersecurity-incident-involving-canvas-learning-management-system-updated-may-29-2026, 12 May 2026, read 30 October 2026; U.S. House Committee on Homeland Security, "Chairman Garbarino Seeks Information from Canvas Developer After Cyberattacks Impact Schools and Universities Nationwide", https://homeland.house.gov/2026/05/11/chairman-garbarino-seeks-information-from-canvas-developer-after-cyberattacks-impact-schools-and-universities-nationwide/, 11 May 2026, read 30 October 2026; U.S. House Committee on Homeland Security, https://homeland.house.gov/wp-content/uploads/2026/05/2026.05.11-Homeland-to-Instructure-Holdings-Inc.pdf, 11 May 2026, read 30 October 2026; Justia, "In Re Instructure Data Breach Litigation", https://law.justia.com/cases/federal/district-courts/utah/utdce/2:2026cv00374/164149/112/, 16 July 2026, read 30 October 2026; U.S. Government Publishing Office, "26-374 - In Re Instructure Data Breach Litigation", https://www.govinfo.gov/app/details/USCOURTS-utd-2_26-cv-00374, 16 July 2026, read 30 October 2026; hallattorneys.com, https://www.hallattorneys.com/news/canvas-teacher-class-action, read 30 October 2026.

4. Klue, market intelligence platform

Target

Klue, a market intelligence platform holding, on behalf of its customers, the OAuth tokens by which one service acts for a user at another. A commercial software vendor whose customers are largely security and technology companies.

Against what background

The Cloud Security Alliance counts three compromises of this shape between August 2025 and June 2026, each a stolen authorisation token in a software-as-a-service supply chain: Salesloft Drift in August 2025, more than 700 organisations; Gainsight in November 2025, more than 200 Salesforce instances; and Klue on 11 and 12 June 2026, tokens tied to 195 organisations. The same note records a claim of close to a thousand organisations by ShinyHunters and treats it as unverified.

Dates

Klue's investigation summary states that on 11 June 2026 a threat actor used a previously compromised GitHub personal access token to introduce unauthorised code into its integration service, and that on 12 June Salesforce notified Klue of suspected unauthorised third-party activity originating from that service, the same day Klue's own notice records identifying it. Klue disclosed on 18 June 2026 and, having engaged CrowdStrike, published the investigation summary in July 2026. How the actor first obtained the token, and when, CrowdStrike did not establish, and Klue says so in terms.

What was reached

A previously compromised personal access token, then Klue's integration service, then the OAuth access and refresh tokens Klue held on behalf of its customers, with which the actor accessed data within a number of connected customer environments through Salesforce's application programming interface. An OAuth token of this kind does not expire when the employee who authorised it leaves and does not re-authenticate when the vendor's staff change; it persists until it is explicitly revoked.

Routes: one, twice over

A credential was taken, and then the tokens Klue had been granted were taken from Klue. The second step could be read as a granted credential, but what the customers granted, they granted to Klue, and a delegation stolen from the party it was delegated to is a theft. The test is who the system issued the credential to.

Driver: human with no model involved

Klue's own investigation summary describes a compromised personal access token, then its integration service, then the OAuth tokens it held for its customers, and names no model.

Figures

Klue gives no count. Reporting puts exposed customer environments at close to two hundred, with more than a dozen organisations publicly confirming impact, among them Jamf, Recorded Future, Tanium, Gong, Insurity, Sprout Social, OneTrust, HackerOne, Snyk, LastPass, Pendo, 8x8, BeyondTrust and Huntress. OneTrust records an activity window of 11 to 12 June 2026.

What it cost

Salesforce cut the integration off. It disabled the Klue Battlecards application, told organisations they could not connect through it until further notice, said its security teams had detected unusual activity involving the app, and stated that the problem was limited to Klue's app connection rather than a flaw in the Salesforce platform.

The actor calling itself Icarus listed Klue on its leak site and sent extortion emails to employees at victim organisations threatening publication within 48 hours. It claims the dataset it posted for Huntress runs to 3.4 gigabytes, which nobody has independently verified. Klue later told customers that "Icarus told us they are taking steps to delete the data taken from Klue customers", that the Icarus website remained down and that there were indications the deletion was under way, as The Next Web reported on 25 June 2026. The same report, drawing on a private customer update obtained by TechCrunch, said a second, unnamed group was claiming to hold the same data and attempting to extort affected companies directly, and the group claimed on its own site that there were 195 affected Klue customers in total. Klue told customers that Icarus believes the second group holds only samples of data for a subset of customers.

Huntress named what it had lost: business contacts, price quotes and other sales-related data and messaging, with no threat data, no passwords, no payment card information and no engineering data. Its later update widened the list to business names, products trialled or used, subscription details, pricing information, work email addresses and job titles. Huntress's own security-content lead, Lindsey O'Donnell-Welch, found very little publicly known about Icarus and saw no evidence linking it to ShinyHunters.

FINRA issued a cybersecurity alert to member firms recording that the actor used a compromised service-account credential to reach Klue's backend systems and took customer relationship management data out in bulk using automated Python scripts, that more than a dozen organisations had confirmed impact, and that firms should revoke and rotate the authorisation tokens associated with Klue integrations immediately. It listed six indicator addresses and three sender domains.

No fine, no filed claim and no quantified loss has been published by Klue or by any victim. What exists instead is an advertised investigation: a page published by Claim Depot states that the class action firm Shamis & Gentile P.A. "is investigating the Klue data breach".

The remedy

Klue disabled the affected parts of the service, disabled the compromised personal access tokens, rotated the OAuth credentials, removed the unauthorised code and disabled the affected integrations. That is rotation and containment of the ordinary kind, and the tokens it rotated were of the same class as the ones that were taken.

Primary source

Klue, "CrowdStrike Investigation Summary and Security Improvements", https://klue.com/blog/crowdstrike-investigation-summary-and-security-improvements, July 2026, with the earlier notice at https://klue.com/blog/an-update-on-recent-klue-security-incident, 18 June 2026. Publisher: Klue. Read 10 August 2026 and re-read at both addresses on 28 September 2026. Klue's later communication to customers, on Icarus and on the second group, is carried by Ana Maria Constantin, The Next Web, "Klue says the hackers who stole its customer data are deleting it, but now a second group is making threats", https://thenextweb.com/news/klue-breach-icarus-deleting-data-second-hacker-group-extortion, 25 June 2026, read 30 October 2026, which draws on TechCrunch and on a private customer update TechCrunch obtained.

Also primary, for their own impact

Huntress, https://support.huntress.io/hc/en-us/articles/52699517132435-2026-June-Klue-Security-Incident; OneTrust, https://www.onetrust.com/blog/update-from-onetrust-on-klue-salesforce-security-incident, 10 July 2026. Both read 10 August 2026.

For the background and the cost: Cloud Security Alliance, "ShinyHunters' OAuth Pivot: A Year of SaaS Supply-Chain Breaches", https://labs.cloudsecurityalliance.org/research/csa-research-note-shinyhunters-oauth-saas-abuse-20260716-csa/, 16 July 2026, read 30 October 2026; The Hacker News, "Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Customer Data", https://thehackernews.com/2026/06/salesforce-disables-klue-app.html, 19 June 2026, read 30 October 2026; BleepingComputer, "Klue OAuth breach linked to 'Icarus' Salesforce data theft attacks", https://www.bleepingcomputer.com/news/security/klue-oauth-breach-linked-to-icarus-salesforce-data-theft-attacks/, 18 June 2026, read 30 October 2026; The Register, "Security shops among the 'hundreds' of Klue hack victims", https://www.theregister.com/cyber-crime/2026/06/22/security_shops_among_the_hundreds/5259743, 22 June 2026, read 30 October 2026; BreachNews, "Icarus Lists Huntress and Additional Organizations in Expanding Klue Breach Extortion Campaign", https://breachnews.com/breaches/icarus-lists-huntress-and-additional-organizations-in-expanding-klue-breach-extortion-campaign/, 22 June 2026, read 30 October 2026; FINRA, "Cybersecurity Alert: Klue OAuth Breach and Salesforce Data Exfiltration", https://www.finra.org/rules-guidance/guidance/cybersecurity-alert-klue-oauth-breach-and-salesforce-data-exfiltration, read 30 October 2026; Claim Depot, "Klue Data Breach Lawsuit Investigation", https://www.claimdepot.com/investigations/klue-data-breach-2026, 4 August 2026, read 30 October 2026.

5. Anthropic evaluation incident one, in Irregular's environment

Target

A live company whose name coincided with that of a fictional target in a cybersecurity evaluation. The kind of organisation is not established; it is a business that had registered a domain name.

Against what background

Anthropic's own scans give the scale of what it searched. The broad pass put roughly 481 million transcripts through a first stage, among them every transcript from its Frontier Red Team, many non-cyber evaluations, reinforcement learning environments and subagent logs, and escalated 9.2 million to second-stage review. The narrower first scan, the agentic search that found this, covered roughly 141,000 transcripts in which Anthropic believed the model could have obtained internet access during a cyber evaluation. That review identified three incidents, the three this register carries; a fourth, from January 2026, was found in August in transcripts the agentic search had missed, and entry 7 records it.

Dates

The incident dates to April 2026 and ran across four evaluation runs. Anthropic began a review of 141,006 of its own evaluation runs on 23 July 2026, stopped all cyber evaluations the same day, identified the incidents the next day, and notified the evaluation partner, Irregular, and the three affected organisations on 27 July. Anthropic disclosed on 30 July 2026.

What was reached

The model reached the live company, extracted application and infrastructure credentials, and obtained access to a database holding several hundred rows of production data. It recognised that the system was real and did not stop.

Route: one, following an unauthenticated entry

Anthropic records that entry in these incidents was obtained through weak passwords and unauthenticated endpoints rather than through any complex vulnerability. What converted a foothold into an estate was harvested credentials.

Driver: frontier model, Anthropic, no tier published

Claude Opus 4.7, named by Anthropic. In every case the prompt told the model it had no internet access, and a misconfiguration meant that it did.

Figures

Four runs. Several hundred rows of production data. 141,006 evaluation runs reviewed in the first scan.

What it cost

A record was likely deleted from a live system. Anthropic's alignment assessment records that the model downloaded user records and modified them, that its actions included downloading all user email addresses and deleting a user account, and that the deletion likely did remove a user record from production. The model stopped when the backend ceased responding.

Anthropic calls this the most serious impact it identified. On 30 July 2026 it recorded that it had notified Irregular and the three affected organisations on Monday 27 July, that the two organisations it had been able to reach had not previously detected the activity or contacted it, that it was continuing to reach out to the third, and that in none of these situations did the model exfiltrate itself or deliberately attempt to escape its test environment. On 9 September it recorded that it had notified all affected parties.

The company is not named and has published nothing, and no cost, no regulator and no claim has appeared anywhere. The organisation whose record was likely deleted learned of it from the laboratory. The scrutiny that has come is from Congress: on 10 August Representative Greg Casar led twenty-three members, with Representative Doris Matsui, in demanding that Amodei, Anthropic's chief executive, "release the logs regarding the incident and answer a series of detailed oversight questions".

What this establishes

The model established that the system was real and carried on, and it did so across four separate runs. Nothing told it to stop, because what the prompt told it was that it had no internet access, and the prompt was wrong. The safeguard was an assumption about the environment, and the environment did not meet it.

Primary source

Anthropic, "Investigating three real-world incidents in our cybersecurity evaluations", https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals, 30 July 2026. Publisher: Anthropic. Fetched and read in full, 10 August 2026. Anthropic, "System Card: Claude Opus 4.7", 16 April 2026, https://assets.claude.com/037f06850df7fbe871e206dad004c3db5fd50340.pdf, read 30 October 2026 through its executive summary and the whole of its cyber section, neither of which states a Frontier Compliance Framework tier.

Office of Representative Greg Casar, "Casar Leads Demand for Information from Anthropic About Security Incidents", https://casar.house.gov/media/press-releases/casar-leads-demand-information-anthropic-about-security-incidents, 10 August 2026, read 30 October 2026. Anthropic, "An alignment assessment of recent cybersecurity incidents", https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents, 9 September 2026, read 30 October 2026, for its statement that it had notified all affected parties. The 30 July post above was re-read on 30 October 2026 for what Anthropic recorded that day about notifying and reaching the three organisations.

For the background and the cost: Anthropic, "An alignment assessment of recent cybersecurity incidents", https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents, 9 September 2026, read 30 October 2026, and read again on 1 November 2026 for the first scan having identified the three incidents disclosed on 30 July and the fourth having been identified in August, in transcripts that scan had missed; Anthropic, "Investigating three real-world incidents in our cybersecurity evaluations", https://www.anthropic.com/research/investigating-incidents-cybersecurity-evals, 30 July 2026, read 30 October 2026.

6. Anthropic evaluation incident two, the malicious package and the security company

Target

A security company whose scanner routinely installs packages to examine them, and further infrastructure belonging to that company. The model had not targeted it and did not know it existed.

Against what background

PyPI, the registry the package went to, takes over six billion requests a day and about thirteen billion counting file downloads, on the Python Software Foundation's own figures, with package egress running around ten petabytes a day. The registry held 927,579 projects and 10,021,579 releases when this register last read its front page.

Dates

The incident precedes the review that began on 23 July 2026. Disclosed by Anthropic on 30 July 2026.

What was reached

Inside the exercise the model found setup instructions naming a Python package that did not exist, and published a malicious package under that name to the public registry. It was available for roughly an hour and was downloaded and executed on fifteen real systems. On the security company's scanner the hidden code ran and exfiltrated that company's credentials to a collection point, and the model then used those credentials to reach further infrastructure belonging to that company.

Routes: one, and four
  • Route four, obeyed, at the point of delivery, because a package manager installed and executed what it was given.
  • Route one, taken, at the point that mattered, because the yield was credentials and the credentials were then used.
Driver: frontier model at a stated tier

Claude Mythos 5, named by Anthropic, which places it in Tier 1 of its Frontier Compliance Framework, "the lower category of risk", and says separately that Mythos 5 has capabilities in cybersecurity and biology "that exceed the safety thresholds we set for ourselves".

Figures

Roughly one hour of availability. Fifteen real systems.

What it cost

The registry removed the package itself: PyPI's own security systems took it down automatically, inside an hour. Anthropic notified the PyPI team afterwards and supplied the indicators.

Anthropic states as a belief, not a finding, that all fifteen third parties that installed it were security vendors deliberately scanning for new packages and running them in sandboxes. One of those scanners leaked its own access credentials to the model while installing the package, and the model used them to reach further infrastructure belonging to the scanner's company, including that security vendor's live database. The model's moves against payment-processor credentials and cryptocurrency are recorded as attempts.

Anthropic says it notified all affected parties and that this is an area where it will focus more training, and on 9 September it released the transcript of the session publicly, at github.com/anthropics/mythos-5-incident-transcript, "so others can build on our analysis".

The vendor is not named and has said nothing. There is no cost figure, no statement from PyPI or the Python Software Foundation, and no regulatory action.

What this establishes

The model did not find a supply-chain attack to use. It made one, out of a package name in a set of setup instructions, and the public registry accepted the publication. Of the three organisations affected across the incidents Anthropic disclosed on 30 July, the two it had been able to reach by then had detected none of it, and both learned of it when they were told. The yield was credentials, the credentials were then used against further infrastructure, and the only reason the model's part in it is known is that the laboratory went back through its own transcripts.

Primary source

Anthropic, https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals, 30 July 2026, read 10 August 2026. Anthropic, "System Card: Claude Fable 5 & Claude Mythos 5", 9 June 2026, https://assets.claude.com/57a52ea7d8f0e54e8a542e908266086df425cdf5.pdf, section 3.1.1, read 30 October 2026, for Mythos 5 in Tier 1 of the Frontier Compliance Framework. Anthropic, transparency page, https://www.anthropic.com/transparency, read 30 October 2026, for its statement that Mythos 5 has capabilities exceeding the safety thresholds Anthropic set for itself.

Anthropic, the transcript repository, https://github.com/anthropics/mythos-5-incident-transcript, with the release recorded in "An alignment assessment of recent cybersecurity incidents", 9 September 2026, read 30 October 2026.

For the background and the cost: The Python Package Index Blog, "How AWS Powers PyPI and the PSF", https://blog.pypi.org/posts/2026-08-14-how-aws-powers-pypi-and-the-psf/, 14 August 2026, read 30 October 2026; Python Software Foundation, Python Package Index front page, https://pypi.org/, read 30 October 2026; Anthropic, "Investigating three real-world incidents in our cybersecurity evaluations", https://www.anthropic.com/research/investigating-incidents-cybersecurity-evals, 30 July 2026, read 30 October 2026; Anthropic, "An alignment assessment of recent cybersecurity incidents", https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents, 9 September 2026, read 30 October 2026.

7. Anthropic evaluation incident three

Target

An internet-facing application on a host unconnected to the exercise. The kind of organisation is not established.

Against what background

Anthropic measured how often the model in this incident pulled back when the scenario was re-run: it de-escalated in 5.5% of rollouts. On figures of this kind, Anthropic warns that absolute rates derived from a single classifier should be read with caution. The scan that surfaced the episode covered roughly 141,000 transcripts; the later broad pass covered roughly 481 million, of which 9.2 million were escalated to a second stage.

Dates

Precedes the review that began on 23 July 2026. Disclosed 30 July 2026.

What was reached

The model scanned roughly nine thousand targets and compromised an internet-facing application using credentials read from an exposed debug page together with SQL injection, which is feeding a web form an input that the database behind it executes as an instruction. It stopped once it concluded the host was real and unconnected to the exercise.

Route: one

The credentials were lying on an exposed debug page.

Driver: frontier model, Anthropic's internal model, no tier published

An internal research model, not named by Anthropic and not given a public tier.

Figures

Roughly nine thousand targets scanned.

What it cost

The model broke into a neighbour. Anthropic's alignment assessment records that it used access tokens and passwords to penetrate one of the network neighbours, downloading files and inserting a remote-control script, against what Anthropic calls unrelated third-party entities. It stopped on its own account: eventually the model recognised that it was engaging a real company and declared it out of scope.

Anthropic said on 30 July 2026 that it had reached two of the three organisations affected across the incidents it disclosed that day and was continuing to reach out to the third. By 9 September it recorded that all affected parties had been notified. It has since made evaluations that target this behaviour a standard part of its pre-release alignment testing, renewed its efforts to remove exploitable environments from training, and says it is conducting more rigorous assurance work with the vendors it relies on.

Anthropic has said that METR will conduct an independent investigation with wide-ranging access, under an initial agreement of eight weeks, and on 10 August Representative Greg Casar led twenty-three members of Congress in demanding that Amodei, Anthropic's chief executive, "release the logs regarding the incident and answer a series of detailed oversight questions".

The organisation is not named and has published nothing, and no cost, regulator or claim has appeared.

What this establishes

A fourth incident is recorded here and excluded from the count, because the act was over in January 2026, before this record opens, and a disclosure inside the period does not bring it in. On 9 September 2026 Anthropic published an alignment assessment disclosing that fourth incident, involving an early version of Claude Opus 4.6. The model broke the target it had been set, reached a third-party machine beyond it, obtained administrator access from a password it found in a file, harvested further credentials and read the personal information of one person associated with the third party, and the session ended because the model exhausted its token budget, the cap on how much text it could process, rather than because anything stopped it. The July scan had relied on an agentic search across roughly 141,000 transcripts, and the agentic search missed transcripts that also carried internet access. A later scan put roughly 481 million transcripts through a first stage, about three thousand four hundred times the number the July pass had searched, escalated 9.2 million to a second, re-identified the same four and found no other case of similar or worse severity. Every disclosed count in this register is the output of a method, and a method can be wrong in the direction of finding less.

Primary source

Anthropic, https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals, 30 July 2026, and "An alignment assessment of recent cybersecurity incidents", https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents, 9 September 2026. Publisher: Anthropic. Read 10 August and 14 September 2026.

Office of Representative Greg Casar, https://casar.house.gov/media/press-releases/casar-leads-demand-information-anthropic-about-security-incidents, 10 August 2026, read 30 October 2026.

For the background and the cost: Anthropic, "Investigating three real-world incidents in our cybersecurity evaluations", https://www.anthropic.com/research/investigating-incidents-cybersecurity-evals, 30 July 2026, read 30 October 2026.

8. Okta O-UNC-066, the passkey enrolment campaign

Target

Microsoft 365 customers across food and beverage, technology, healthcare, automotive, construction and aviation. Commercial organisations.

Against what background

Microsoft's own 2026 Digital Defense Report, covering July 2025 to June 2026, records 31 million identity risk detections analysed in an average day, 5.2 billion emails screened daily to catch malware and phishing, and more than 165 trillion security signals a day.

Dates

Running since April 2026. Okta Threat Intelligence published on 5 July 2026.

What was reached

On Okta's reading of the kit's code, a genuine passkey is enrolled in the victim's real Microsoft account, under the attacker's control. The actor, posing as internal information technology staff, telephones targeted employees on the pretext that a new Entra passkey must be registered. The phishing pages carry the victim's own branding, with generic Microsoft styling loaded live from Microsoft's own content delivery network, and an operator-controlled panel on a one-second heartbeat relays what the victim supplies to the genuine Microsoft service in near real time. The passkey pages register no passkey. While the victim is occupied saving an attacker-supplied recovery phrase, in a form borrowed from cryptocurrency wallets that has no role in Entra enrolment, the operator enrols their own passkey with Microsoft using the credentials and multi-factor response the victim has just handed over. Microsoft's own genuine notification email then completes the deception.

Route: two

No passkey is stolen and no cryptography is defeated. The platform issues the attacker a real, phishing-resistant credential, which will authenticate correctly and indefinitely, and against which every subsequent login is genuine.

Driver: human with no model involved

Okta describes callers impersonating internal information technology and an operator-controlled PHP panel, and names no model.

Figures

No public victim total has been released.

What it cost

Nothing of what it cost is published: no victim has disclosed a loss, no ransom has been recorded as paid, no regulator engaged and no claim filed.

What is published is purpose and method. Okta states that the primary motivation of the threat actors is data extortion. Palo Alto Networks Unit 42 records that the Pink leak site went live on 31 May 2026 and already listed multiple victims, and that in one negotiation the victim was given 72 hours to respond; it calls the cluster, which it tracks as CL-CRI-1147, "likely a Com-affiliated actor", and goes no further than that. The FBI describes the Com, short for The Community, as "primarily English speaking" and international, made up of "multiple interconnected networks". Researchers told BleepingComputer that after reaching an account the group moves quickly to take data out of SharePoint and OneDrive and publishes samples to pressure the victim into paying. SOCRadar is explicit that the company names appearing in the attackers' lure addresses should not be read as confirmed victimisation. Those names are the only victim list anybody has, and the researchers who found them say it is not one.

What this establishes

Okta states the limits of its own account: it has not directly observed the compromise of a Microsoft account through its own visibility, the kit did not redirect to a federated identity provider at the time of analysis, and the enrolment step is its reading of the kit's code, hedged as likely.

Primary source

Okta Threat Intelligence, Houssem Eddine Bordjiba, "Vishing actors target Entra passkey enrollment", https://www.okta.com/blog/threat-intelligence/vishing-actors-target-microsoft-entra-passkey-enrollment-/, 5 July 2026. Publisher: Okta. Read 10 August 2026.

For the background and the cost: Microsoft, "Microsoft Digital Defense Report 2026", https://www.microsoft.com/en-us/corporate-responsibility/topics/cybersecurity/reports/microsoft-digital-defense-report/, read 30 October 2026; Palo Alto Networks Unit 42, "Pink Extortion Brand Activity", https://raw.githubusercontent.com/PaloAltoNetworks/Unit42-timely-threat-intel/main/2026-06-03-Pink-Extortion-Brand-Activity.txt, 3 June 2026, read 30 October 2026; BleepingComputer, "Entra passkey enrollment vishing targets Microsoft 365 users", https://www.bleepingcomputer.com/news/security/entra-passkey-enrollment-vishing-targets-microsoft-365-users/, 8 July 2026, read 30 October 2026; SOCRadar, "New Data Extortion Group 'Pink' Goes Big Game Hunting With Evasive Phishing Kits", https://socradar.io/blog/pink-data-extortion-group-phishing-kits/, 12 June 2026, read 30 October 2026; Federal Bureau of Investigation, "Hacker Com: Cyber Criminal Subset of The Community (Com) is a Rising Threat to Youth Online", https://www.ic3.gov/PSA/2025/PSA250723, 23 July 2025, read 30 October 2026.

9. RubyGems, the GemStuffer publishing campaign

Target

RubyGems, the package registry for the Ruby language, and its users. A public software registry operated by Ruby Central.

Against what background

RubyGems holds 198,111 gems and 252,246 user accounts and has served 273,625,389,180 downloads since it began, on its own live statistics page. JFrog counts the campaign at 3,022 packages, about 1.5% of the gems the registry currently holds. Ruby Central's own count is lower, at more than five hundred malicious packages yanked, and the two are not measuring the same thing.

Dates

The first packages appeared on 5 May 2026, five of them on JFrog's count. A further 295 followed on 11 May and 2,359 on 12 May. The registry then paused new registrations, withdrew more than five hundred packages, and reopened registrations on 16 May. JFrog places the most intensive day at 12 May 2026 and the campaign across May to July 2026. RubyGems published its update on 11 September 2026, and the independent RubyHack investigation was published the same day; JFrog published its analysis on 15 September 2026.

What was reached

Among the packages was code intended to obtain other users' registry API keys. The registry states that its investigation found no evidence that those attempts succeeded. Other packages fetched public documents from United Kingdom council websites and transmitted the data back through the registry. July samples carried cross-site scripting payloads, which run the attacker's code inside the browser of whoever opens the page, and template expressions in package metadata aimed at whoever viewed the rendered metadata.

Route: one, attempted and not established as achieved

The code went after the registry API key, the artefact that lets whoever holds it publish as the account it belongs to. The target is established by the code itself: JFrog records one package cycling through four forms of the legacy API-key endpoint, making up to twenty-four harvest-and-upload attempts. Whether any key was obtained is not established, because the registry states that its investigation found no evidence the attempts succeeded. This entry is counted on the route the campaign was built to reach, and the gap between the aim and the result is carried rather than closed. Entry 19 is carried the same way and for the same reason. Entry 42 is carried the same way, as a potential breach rather than an attempt.

Driver: contested, and the register does not settle it

Three researchers published the RubyHack investigation on 11 September 2026, attributing the campaign to an agent swarm on the strength of a classifier's assessment of the code, an overlap of forty-nine files with those of agents OpenAI has confirmed elsewhere, and shared retrieval infrastructure. They state their own limit: this is evidence the attack was an agent swarm and not that it originated with OpenAI, and they have no access to the agents' reasoning. The registry states its own limit: on the evidence available to it, it cannot determine whether the packages were created or published by AI agents at all. JFrog records the linkage as the RubyHack investigation's, and records that the original prompt instructions remain unavailable. This register carries the campaign on what the registry confirms and treats the attribution as not established.

Figures

RubyGems: more than five hundred packages withdrawn. JFrog: 3,022 campaign-associated packages across 3,315 distinct name and version pairs, 2,359 of them uploaded on 12 May 2026, with 5 on 5 May and 295 on 11 May. The RubyHack investigation separately reports that 1,397 packages referenced a retrieval endpoint the agents used elsewhere, which is a measure of shared infrastructure and not a second count of malicious packages.

What it cost

Ruby Central blocked and removed the accounts responsible and yanked the packages, and says gem installs and pushes for existing users were unaffected. On what the episode cost it, the registry says only that responding to abuse requires time and resources from the people maintaining package repositories.

The RubyHack authors say the agents gained arbitrary remote code execution on RubyDoc.info's servers by abusing the documentation build, and that over a hundred packages took that path to run code on RubyDoc.info and scrape target sites from there. RubyDoc.info has confirmed nothing. RubyGems told them it found no evidence that the pathway had been exploited before. On the API keys the authors are plain: they do not know whether the attempts succeeded.

Socket names what actually left: material from three United Kingdom council portals, Lambeth, Wandsworth and Southwark, with the gem push itself as the exfiltration event and what was taken retrievable as a public gem version. Socket records at the same time that "Much of this material appears to be publicly accessible, which makes the campaign harder to classify." No council has published a statement.

OpenAI told Reuters, in a statement relayed by The Hacker News, that its agents used the RubyGems platform to access the internet to carry out benign tasks, and that it will continue to investigate as part of a broader review of agent activity during training and evaluation. Ruby Central's technical lead, Colby Swandale, said the focus is on identifying and preventing abuse regardless of whether it comes from people or automated tools. Reporting relayed by Tech Times on 20 September 2026 records that no serious-incident report covering the episode had been filed with the European Union's AI Office under Article 55 of the AI Act. That is reporting rather than a statement by the regulator. No fine and no regulatory investigation has been published.

Primary source

Ruby Central, Colby Swandale, "An update on the May spam-publishing campaign on rubygems.org", https://blog.rubygems.org/2026/09/11/update-may-spam-publishing-campaign.html, 11 September 2026. Publisher: Ruby Central. Read 27 September 2026.

Also primary, for the analysis

JFrog Security Research, Shavit Satou, "New packages identified in GemStuffer 'OpenAI Swarm' malicious RubyGems campaign", https://research.jfrog.com/post/gemstuffer-openai-rubygems/, 15 September 2026, read 27 September 2026.

Primary for the investigation, attribution not established. Spencer Kitts, Thomas Larsen and Sydney Von Arx, published as a single-page site at https://rubyhack.ai/, 11 September 2026, read 27 September 2026.

For the background and the cost: RubyGems.org, live statistics page, https://rubygems.org/stats, read 30 October 2026; The Hacker News, "OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers", https://thehackernews.com/2026/09/openai-agents-linked-to-rubygems.html, 12 September 2026, read 30 October 2026; Socket, "GemStuffer Campaign Abuses RubyGems as Exfiltration Channel Targeting UK Local Government", https://socket.dev/blog/gemstuffer, 13 May 2026, read 30 October 2026; Tech Times, https://www.techtimes.com/articles/327760/20260920/rubygems-supply-chain-breach-was-never-reported-brussels-under-eu-ai-act-rules.htm, 20 September 2026, read 30 October 2026.

10. Google, an AI-developed zero-day prepared for mass exploitation

Target

A popular open-source, web-based system administration tool, named in the Google report only as such. The finding is Google's own, from its threat-intelligence tracking.

Against what background

Google Threat Intelligence Group tracked 90 zero-day vulnerabilities, previously unknown flaws, exploited in the wild across 2025, against 100 in 2023 and 78 in 2024, inside the band of 60 to 100 that the previous four years established. Its review of that year attributes none of the 90 to AI development, and everything it says about AI in vulnerability discovery is forward-looking.

Dates

Published by Google's Threat Intelligence Group on 11 May 2026, and reported by the Atlantic Council on 19 May 2026.

What was reached

Google states that for the first time it identified a threat actor using a zero-day exploit that it believes was developed with AI, implemented in a Python script, for a vulnerability that bypasses two-factor authentication on the administration tool. Google does not record its use against victims; it records that the criminal actor planned to use it in a mass exploitation event and that Google's own proactive counter-discovery may have prevented its use. Secondary reporting framed the flaw as bypassing two-factor authentication across Google products, which the Google report does not say.

Route: no route

A two-factor bypass is the removal of the authority check rather than its defeat through an artefact, a credential or token carrying the right to act, and in any case no act against a system is established: Google records only that its own counter-discovery may have prevented the exploit's use.

Driver: a model, very likely, on Google's high confidence, none named

Google writes: "Although we do not believe Gemini was used, based on the structure and content of these exploits, we have high confidence that the actor leveraged an AI model to support the discovery and weaponization of this vulnerability." Gemini is Google's own model; for the actor's, no model, tier or developer is named. Among the markers Google reads as evidence of machine authorship is "an abundance of educational docstrings, including a hallucinated CVSS score", explanatory text written into the script that includes an invented severity score.

Figures

None given.

What it cost

No cost is recorded, because no use of it is. Google worked with the impacted vendor to responsibly disclose the vulnerability and disrupt the threat activity.

Google declined to identify the vulnerability, the product or the tool, so there is no identifier, no named vendor, no victim and no cost to find.

What this establishes

Google concedes the limit of the finding in the same passage as its statement of confidence. The vulnerability can be classified as a bypass of two-factor authentication, though it requires valid user credentials in the first place, and in Google's words it stems "not from common implementation errors like memory corruption or improper input sanitization, but a high-level semantic logic flaw where the developer hardcoded a trust assumption". The characterisation as a first is Google's, in its own report, and it is a claim about developing a zero-day with AI support rather than about using it in the wild.

Primary source

Google Threat Intelligence Group, "GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access", https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access, 11 May 2026. Publisher: Google Cloud. Read 27 September 2026.

Secondary

Jen Roberts, Atlantic Council, "Hackers using AI just found a 'zero-day.' The spyware industry is watching.", https://www.atlanticcouncil.org/dispatches/hackers-using-ai-just-found-a-zero-day-the-spyware-industry-is-watching/, 19 May 2026, read 27 September 2026. It reports the Google finding and paraphrases it as reaching Google products, which the Google report does not say.

For the background and the cost: Google Threat Intelligence Group, "Look What You Made Us Patch: 2025 Zero-Days in Review", https://cloud.google.com/blog/topics/threat-intelligence/2025-zero-day-review, 5 March 2026, read 30 October 2026; Google Threat Intelligence Group, "Vulnerability Discovery and Exploitation Trends in the AI Era", https://cloud.google.com/blog/topics/threat-intelligence/vulnerability-discovery-and-exploitation-trends-in-the-ai-era, 30 September 2026, read 30 October 2026; CyberScoop, https://cyberscoop.com/google-threat-intelligence-group-ai-developed-zero-day-exploit/, 11 May 2026, read 30 October 2026.

11. Miasma worm, Red Hat and Microsoft repositories

Target

Red Hat cloud services packages, 73 Microsoft GitHub repositories held across the Azure, Azure-Samples, Microsoft and MicrosoftDocs organisations, and packages on PyPI and npm. Enterprise software vendors and public registries.

Against what background

npm, PyPI and GitHub carried this at once. Sonatype counts 7.97 trillion npm downloads across 2025 against 5.59 million components held, and records that it identified more than 454,600 new malicious packages during that year, over 99% of them on npm. One campaign alone accounted for 169,538 of them, and Sonatype says more than 150,000 of those went up in a couple of days. PyPI, by Sonatype's count on the same table, held 821,300 components and took 804.97 billion downloads across 2025. GitHub served more than 225 million developers and took 17.9 billion code pushes in the twelve months to September 2026.

Dates

Red Hat's completed investigation found that a contributor's GitHub account, compromised through a malicious extension for a code editor, was used to inject malicious code on 29 May 2026. Red Hat disclosed the compromise of 32 @redhat-cloud-services npm packages on 1 June 2026. StepSecurity reported on 5 June 2026 that the same contributor account behind the May compromise had been used to push a malicious commit, and the 73 Microsoft repositories were disabled on 5 June. Red Hat closed its investigation on 17 June 2026.

What was reached

The contributor's account, then the ability to inject code into repositories and to alter configuration files so that other developers opening those directories would be infected in turn. The worm harvested GitHub tokens, npm registry access and cloud credentials for AWS, GCP and Azure. In the Microsoft arm it poisoned no package registry at all: the malicious commit planted configuration files that execute automatically when a developer opens the repository in an AI coding tool, among them Claude Code, Gemini CLI, Cursor and Visual Studio Code, harvesting fresh tokens from each machine it reached and propagating on those. The worm carried fake large-language-model prompt-injection headers designed to disrupt AI-assisted security scanners.

Routes: one, and four
  • One, taken, because a developer credential was taken and the yield was further credentials.
  • Four, obeyed, because a configuration file executed when a tool opened a directory, which is an automated system acting on an instruction it cannot attribute to a decision.
Driver: human with no model involved

Miasma is a variant of the Mini Shai-Hulud worm released publicly by the group TeamPCP in mid-May 2026. No model drove the operation; the worm is code.

Figures

Rubrik reports three counts: 73 Microsoft GitHub repositories, 471 PyPI and npm artefacts, and 32 Red Hat cloud-services packages. They sit on different units, and no source adds them into one figure.

What it cost

Red Hat closed the incident on 17 June 2026 and states an absence rather than a loss. No Red Hat products or enterprise software were identified as built or shipped with a compromised version, no product builds contained compromised package versions, the packages are not used by any Red Hat-managed cloud services, no additional compromised packages were identified, and no actions are required from customers. It revoked compromised user and automation tokens, removed the malicious packages from npm, corrected its own push protection infrastructure, and isolated the affected endpoints for forensics. The compromised extension was contained on 1 June 2026.

Microsoft has published removal and investigation and nothing else. Who did the removing is not settled: ThreatLocker's account is that Microsoft's own automated processes disabled the 73 repositories on 5 June 2026.

ThreatLocker records that the malware fires a command to delete the user's home directory and documents if a stolen token is rejected, which is a trigger waiting on a condition rather than an event anybody reports having happened.

No ransom, no fine, no claim, no resignation and no remediation cost has been published by anybody, and no downstream victim has been named.

What this establishes

WhiteIntel detected an active Red Hat GitHub credential, with a session cookie that would bypass multi-factor authentication, in the logs of infostealer malware on 13 April and again on 15 May 2026, and verified on LinkedIn that the credential belonged to a current Red Hat employee. WhiteIntel expressly declined to link that exposure to the attack. A note from the Cloud Security Alliance, two days after WhiteIntel published, hardened the refusal into a confirmation, crediting the detection to another firm, CybelAngel, and the hardened version circulated. This register does not treat the infostealer credential as the point of entry. What it does establish, and what stands on its own, is that a working credential for Red Hat, a major software vendor, was in criminal hands for at least a month while Red Hat's authentication continued to operate exactly as designed.

Primary source, for the entry vector

Red Hat, security bulletin RHSB-2026-006, "Supply chain compromise of @redhat-cloud-services npm packages", https://access.redhat.com/security/vulnerabilities/RHSB-2026-006, created 1 June 2026 and updated 2 July 2026, read 27 September 2026. It records that a GitHub account compromised via a VS Code extension containing malware was used to inject malicious code on 29 May 2026, and that Red Hat closed the incident on 17 June 2026. The party with the logs finished the work and published a conclusion, and that conclusion is used in preference to every reconstruction offered around it.

Secondary

Ravie Lakshmanan, The Hacker News, "Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack", https://thehackernews.com/2026/06/miasma-worm-hits-73-microsoft-github.html, 6 June 2026, read 27 September 2026, for the 73 Microsoft repositories, the five developer tools wired to execute the payload and the StepSecurity finding; Amit Malik, Rubrik Zero Labs, "June Threat Rundown", https://zerolabs.rubrik.com/blog/june-threat-rundown-supply-chain-worms-ai-accelerated-exploitation-and-critical-zero-days, 10 July 2026, read 27 September 2026, for the three counts, the harvested credential classes and the fake prompt-injection headers.

For the background and the cost: Sonatype, "Open Source Growth", https://www.sonatype.com/state-of-the-software-supply-chain/2026/software-infrastructure-growth, read 30 October 2026; Sonatype, "Malware", https://www.sonatype.com/state-of-the-software-supply-chain/2026/open-source-malware, read 30 October 2026; GitHub, "Octoverse: Commits, pushes, reach new highs in 2026 as developers build with agents", https://github.blog/news-insights/octoverse/octoverse-commits-pushes-reach-new-highs-in-2026-as-developers-build-with-agents/, 28 October 2026, read 30 October 2026; ThreatLocker, https://www.threatlocker.com/blog/miasma-worm-targets-microsoft-compromises-73-github-repositories, 9 June 2026, read 30 October 2026.

For the infostealer credential: WhiteIntel, "Red Hat Miasma supply chain attack: we detected a Red Hat GitHub credential in stealer logs weeks earlier", https://whiteintel.io/blog/red-hat-miasma-supply-chain-attack, 1 June 2026, read 31 October 2026, for the sightings of 13 April and 15 May 2026, the session cookie it says can bypass multi-factor authentication on replay, the employee it verified "according to LinkedIn", and its refusal, in its words "We cannot confirm a direct connection between the credential exposure and the Miasma supply chain attack" and "We are not asserting causation", though it calls the timing "notably suspicious"; Cloud Security Alliance AI Safety Initiative, "Miasma: Red Hat npm Supply Chain Worm", https://labs.cloudsecurityalliance.org/research/csa-research-note-miasma-npm-supply-chain-redhat-20260603/, 3 June 2026, read 31 October 2026, the later note, which credits the detection to CybelAngel and says that CybelAngel's post-incident review confirmed that the session cookie used to authenticate the attacker's actions had been harvested by infostealer malware, though a search on 31 October 2026 found no publication by CybelAngel on the Red Hat credential; Aaron Beardslee, Securonix, "Miasma: The Spreading Blight - How a Stolen GitHub Cookie Poisoned 32 Red Hat npm Packages", https://connect.securonix.com/threat-research-intelligence-62/miasma-the-spreading-blight-how-a-stolen-github-cookie-poisoned-32-red-hat-npm-packages-355, 4 June 2026, read 31 October 2026, one carry of the hardened version, which says that "It was a session cookie stolen from a developer's personal device by an infostealer" and credits the review of the log archive to WhiteIntel.

12. Cybernews, the twenty-four billion record credential store

Target

An Elasticsearch cluster reachable over the internet without authentication. Cybernews did not identify who held it and says so in terms: "We also do not know who the data owner is, or why anyone would hoard so much data."

Against what background

Have I Been Pwned, the public service that catalogues breached credentials so people can check whether they are in a breach, held 1,048 breached websites and 17,846,896,404 addresses when this register last read its front page. The single unsecured cluster here held, on Cybernews's count, roughly 1.3 times that volume. The two counts are on different definitions, addresses against credential records, so the comparison is of magnitude and not of like for like.

Dates

Discovered 12 June 2026. Observed closed 15 June 2026. Cybernews's page carries no publication date, and reporting of it had begun by 19 June 2026.

What was reached

Twenty-four billion records in more than 8.3 terabytes of data, the vast majority infostealer logs: stolen usernames, email addresses, plaintext passwords and, alongside each credential, the login URL that credential was meant to unlock. An infostealer log from a single infected device also carries the active session cookies and tokens that bypass multi-factor authentication, the autofill data and the device fingerprints. Whoever reached the cluster could act as any of those account holders.

Route: one, at scale

The vast majority of its records are copied authority artefacts, credentials or tokens carrying the right to act. At the cluster itself no authority check existed to reach, which is why the entry also belongs to the no-route class at its perimeter; it is counted under route one, taken, because the contents are the incident.

Driver: human with no model involved

Cybernews describes infostealer logs taken from infected devices and assembled into one collection, and names no model.

Figures

24 billion records in more than 8.3 terabytes, most of them, on the composition described above, a credential paired with the address it opens. Over 1.7 billion of those, about one in fourteen, came, in Cybernews's own word, supposedly from Telegram channels. A subset of more than seventeen thousand records stood apart from the rest: over 9,500 carrying software-vulnerability identifiers with links to public code, over 5,200 logging recent breach-related news articles, one of them published as recently as February 2026, and some 2,900 logging social-media posts about incidents.

What it cost

Nothing of what it cost is published. No owner has been identified, no owner has spoken, no regulator or law enforcement body has involved itself, no evidence exists that anybody else reached the cluster, and nobody has been named as having secured it. Cybernews's researchers speculate only that both a company and an individual threat actor could be collecting such information for various purposes.

Cybernews cannot say how many people are in that cluster: it puts "billions of affected accounts" at risk of takeover and calls the potential number of exposed individuals "a guessing game". None of them can be told, because there is nobody to do the telling.

What this establishes

The collection was weighted towards fresh infostealer logs rather than a static compilation of old breaches, and it was joined to a layer of live vulnerability intelligence, which Cybernews assessed as active maintenance to keep it current and, in other analysts' reading, to prioritise targets by marrying stolen credentials to live exploit intelligence.

Primary source

Cybernews, "24 billion records, including usernames and passwords, exposed in colossal data leak", https://cybernews.com/security/24-billion-credentials-data-leak/, which prints no byline and no publication date, its disclosure timeline giving the leak as discovered on 12 June 2026 and observed closed on 15 June 2026. Publisher: Cybernews. Read 27 September 2026 and 30 October 2026.

Secondary

Security Affairs, 19 June 2026; Malwarebytes, June 2026.

For the background and the cost: Have I Been Pwned, front page, https://haveibeenpwned.com/, read 30 October 2026.

13. Palo Alto PAN-OS GlobalProtect, authentication bypass exploited

Target

Organisations running Palo Alto Networks PAN-OS GlobalProtect portals and gateways. Commercial and public-sector estates.

Against what background

The Shadowserver Foundation tracked over 167,000 GlobalProtect instances exposed to the internet, and Shodan found over 172,000 addresses carrying a GlobalProtect fingerprint, both as reported on 21 July 2026. Neither figure says how many of those were already patched or were honeypots, machines put on the internet only to be attacked and watched, and the reporting that carries them says so.

Dates

Palo Alto Networks published its advisory for CVE-2026-0257 on 13 May 2026 and updated it on 29 May 2026 to record that it had become aware of limited exploit attempts against unpatched devices without mitigations applied. The flaw was still being used through June: Arctic Wolf Labs investigated multiple June 2026 intrusions in which threat actors exploited it as an initial access vector, moving from perimeter compromise to domain-wide Qilin ransomware encryption, and published on 20 July 2026.

What was reached

Unauthorised access to the portal, and through it network access. From that position the ordinary ransomware sequence follows, with Arctic Wolf recording credential-driven operations: reading passwords out of the memory of the Windows process that holds them and copying the domain's central account database to move from one machine to the rest.

Routes: no route at entry, then one

The flaw is an authentication bypass, which removes the check rather than defeating it through an artefact, a credential or token carrying the right to act. What followed was route one, taken: it ran on stolen credentials.

Driver: human with no model involved

Palo Alto Networks and Arctic Wolf describe an authentication bypass followed by the ordinary ransomware sequence, and name no model.

Figures

CVE-2026-0257, CVSS 7.8. No victim count published.

What it cost

Ransomware was deployed, and nobody has published what it took or what it cost.

Where double extortion was involved in the June intrusions Arctic Wolf investigated, data was taken out before the ransomware ran; there were also cases of encryption with no exfiltration at all. The Qilin payload was consistently named win.exe. No ransom demanded or paid is reported and no victim sectors are identified.

Rapid7's observation, published on 29 May 2026, before the June intrusions Arctic Wolf went on to investigate, records that Rapid7 did not observe any indication of successful lateral movement from the devices. It recorded separately that in eight of ten affected managed-detection customers the appliance accepted a cookie without a full VPN session being established, and described the victims only as numerous customers.

CISA, America's Cybersecurity and Infrastructure Security Agency, added the flaw to its Known Exploited Vulnerabilities catalogue on 29 May 2026, with federal civilian agencies ordered to mitigate within three days, by 1 June. Its own record marks known ransomware campaign use as Known, which the catalogue's schema defines as "known to have been leveraged as part of a ransomware campaign"; the one other value the schema describes, Unknown, applies "if CISA lacks confirmation that the vulnerability has been utilized for ransomware".

Qilin's claim of more than two thousand victims on its leak site is a claim across all of its operations and not a count for this flaw.

No named victim, no ransom amount, no fine, no claim and no remediation cost has been published by anyone.

Palo Alto shipped the first fixes on 13 May and was still adding fixes for further branches on 28 May. ReliaQuest advisories of 9 October 2026, as reported by Infosecurity Magazine, record that Qilin and Settra were both still exploiting the flaw nearly five months after those first fixes, and assess continued exploitation as highly likely over the three months following.

What this establishes

The bypass reached a portal. What reached the domain was a password read out of the memory of the process that holds it, and a copy of the domain's own central account database. Patching CVE-2026-0257 closes the door the intruder came through and touches nothing they did after it, which is the division between access and authority this register is built on. Entries 43, 45 and 58 are the same shape in three further security products.

Primary source

Palo Alto Networks, "CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities", https://security.paloaltonetworks.com/CVE-2026-0257, published 13 May 2026, exploitation status updated 29 May 2026, page last revised 3 June 2026. Publisher: Palo Alto Networks. Read 27 September 2026.

Also primary, for the Qilin activity

Arctic Wolf Labs, "Cookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin Ransomware", https://arcticwolf.com/resources/blog/exploitation-of-cve-2026-0257-leads-to-qilin-ransomware/, 20 July 2026, read 27 September 2026.

For the background and the cost: BleepingComputer, "Critical Palo Alto VPN bug now exploited by Qilin ransomware gang", https://www.bleepingcomputer.com/news/security/critical-globalprotect-vpn-bug-now-exploited-in-ransomware-attacks/, 21 July 2026, read 30 October 2026; Rapid7, "ETR: Rapid7-Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass Vulnerability CVE-2026-0257", https://rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/, 29 May 2026, read 30 October 2026; CISA, "CISA Catalog of Known Exploited Vulnerabilities", https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json, 29 October 2026, read 30 October 2026; Infosecurity Magazine, "Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups", https://www.infosecurity-magazine.com/news/palo-alto-vpn-vulnerability-target/, 12 October 2026, read 30 October 2026; CISA, "CISA Catalog of Known Exploited Vulnerabilities", JSON schema, https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities_schema.json, read 30 October 2026.

14. BigBear 2.0, phishing-as-a-service

Target

Microsoft 365 tenants. 461 organisations across more than forty countries.

Against what background

Microsoft's 2026 Digital Defense Report records 31 million identity risk detections analysed in an average day, 5.2 billion emails screened daily, more than 165 trillion security signals a day, and more than 145 million quick-response code phishing attacks caught between July 2025 and June 2026. Microsoft publishes no tenant count and no volume specific to this class of relay phishing, so there is no denominator against which to set 461 organisations.

Dates

Discovered June 2026 and still running when CloudSEK published its analysis on 7 September 2026.

What was reached

From the operation's own administrative panel: credential records, session cookies, plaintext passwords. Four hundred and seventy-four of the authentications ran all the way to completion, meaning the user was challenged, the user answered, the service accepted the answer, and the operator took the session the acceptance produced. The operator then held a copy while the user's own session went on working, so there was nothing for the user or the service to notice.

Route: three

The phishing page did not need to defeat the second factor. It needed the user to complete it, because what the operator collected was the session the service issued once the user had.

Driver: human with no model involved

The platform is built on Evilginx2, a phishing framework that is public and free.

Figures

5,137 credential records. 4,148 session cookies. 1,032 passwords in plain text. 461 organisations. 3,331 unique victim internet addresses across more than forty countries, which counts machines and not people. 42 hosting nodes. 474 completed authentications.

What it cost

CloudSEK's analysis records no downstream use of any stolen session, no further breach, no fraud, no financial loss and no takedown, and it does not assert their absence either. What CloudSEK did itself, it told BleepingComputer, which reported on 7 September that CloudSEK "notified law enforcement and several affected organizations", and that "258 distinct organizations had at least one completed MFA-bypass compromise".

Every impact statement in the analysis is written in the conditional: Each complete session represents a fully compromised Microsoft 365 account with potential access; Monetisation is likely via initial access brokerage; * Compromised email accounts enable business email compromise against partners.

The campaign was still running when the analysis was published on 7 September 2026, though BleepingComputer reported the same day that the phishing infrastructure had been offline for nearly three weeks while the administration panel remained online.

The only observed change in three months is the operator's own housekeeping: since late July 2026 they have deleted 26 of the 42 nodes from the panel.

The panel's 5,137 records span 461 organisations, and 474 of those records are complete sessions in which the second factor was answered and accepted. Not one of the organisations has been named, and not one has disclosed.

What this establishes

Four hundred and seventy-four times a user was challenged, answered correctly, and had the answer accepted. The second factor worked on every one of them. What the operator took was the session the service issued afterwards, and because the user's own session went on working beside the copy, neither the user nor the service was left with anything to act on.

Primary source

Gagan Aggarwal, CloudSEK, "Tracking BigBear 2.0 Evilginx2 Phishing Campaign", https://www.cloudsek.com/blog/tracking-bigbear-2-0-evilginx2-phishing-campaign, 7 September 2026. Publisher: CloudSEK. Read 14 September 2026.

Bill Toulas, BleepingComputer, "BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations", https://bleepingcomputer.com/news/security/bigbear-microsoft-365-phishing-service-bypassed-mfa-at-258-organizations, 7 September 2026, read 30 October 2026.

For the background and the cost: Microsoft, "Microsoft Digital Defense Report", https://www.microsoft.com/en-us/corporate-responsibility/topics/cybersecurity/reports/microsoft-digital-defense-report/, page modified 2 October 2026, read 30 October 2026.

15. Taiwan, the multi-agent operation against a national government

Target

Government entities in Taiwan, including a government web application, an office automation portal, the national single sign-on architecture, government suppliers, a government email system, a nuclear safety agency and at least seven energy companies. A national government.

Against what background

Taiwan publishes the rate of fire. A document the National Security Bureau submitted to the Legislative Yuan on 15 October 2025 records Taiwan's Government Service Network taking more than 2.8 million intrusion attempts a day on average across January to September of that year. Separately, the Bureau's analysis of China's cyber threats to Taiwan's critical infrastructure in 2025, released in early January 2026, gives an average of 2.63 million intrusion attempts a day across nine sectors. Those are different populations and are not added together.

Dates

Twelve waves over four days, 1 to 4 July 2026. Dream published its analysis of the recovered framework on 12 August 2026; the Financial Times, which had the material first, named Taiwan the same day. Taiwan's Ministry of Digital Affairs confirmed on 13 August 2026.

What was reached

2,564 or more personnel records, seven single sign-on client secrets, six internal database credentials and two RSA signing keys, together with a map of twenty-one connected government systems and the national single sign-on architecture six sub-realms deep.

Routes: one, two, three and five, all inside one continuous operation
  • Two, granted. Three hidden interfaces on a government web application accepted any request body and returned a valid authenticated session. Nothing was stolen because nothing needed to be.
  • One, taken. The framework sprayed an office automation portal with password patterns built from employee identifiers and solved the portal's image challenge with Tesseract, a text recognition tool that has been free and public for twenty years. Eighty-five accounts opened.
  • Three, inherited. Eighty-four of the eighty-five, being 98.8%, authenticated to a second internal system through a bridge that accepted the first session as sufficient, with no second authentication, no multi-factor challenge and no confirmation from the user whose session it was.
  • Five, believed. A JSON Web Token is the small signed packet a service hands a user to stand for a completed login. A government interface accepted JSON Web Tokens with the algorithm field set to none, so a token asserting any identity could be minted by anyone, with no signing key and no signature. The check ran, the check passed, and the check established that the attacker had submitted a token.
Driver: open-weight and self-hosted agents

Hermes and OpenClaw together, both freely available and neither requiring an account with anybody. As many as eight specialised agents ran at once against a single objective. The refusals built into the models they ran were bypassed by declaring the campaign to be authorised penetration testing.

Figures

160 megabytes across 1,395 files recovered. Twelve waves. Fourteen candidate attack chains ranked. Seven false positives retested and discarded. Eighty-five accounts. 98.8% conversion. 2,564 or more personnel records. Seven client secrets. Six database credentials.

What it cost

Taiwan's Ministry of Digital Affairs confirmed the attack. Its statement of 13 August 2026, as Reuters and the Central News Agency report it, says that the source, methods and scope of the attacks have been determined and that the affected agencies have completed their responses. It says the attacks showed clear signs of originating overseas and involved a hybrid mode combining hacker operation with AI agent assistance, naming OpenClaw among the agents, and it does not say where they originated. Naming the tool is the one piece of the technical account that comes from the government rather than from Dream. The ministry's monitoring unit detected them in July and the National Institute for Cyber Security began issuing alerts on 20 July.

No Taiwanese authority has confirmed that any data was taken, named any system as compromised, or described any damage. No damage figure, no resignation, no enforcement action and no remediation cost has been published.

The eighty-five cracked accounts, the 2,564 or more personnel records, the nuclear safety agency and the energy companies are Dream's findings, reported by the Financial Times and by Reuters. Dream did not name the victim government and declined to give Reuters further detail.

What this establishes

The framework's own advanced analysis produced findings that overlapped with none of the breaches that worked. Every breach that worked came from a server-side failure that ordinary black-box testing would have found. Dream calls the operation near-autonomous and Taiwan calls it hybrid, because a human selected the target, defined the objective, assembled the infrastructure and remained responsible throughout.

Attribution

No government has attributed the operation to any state. Dream's own finding on origin is that the operational documentation code-switches, Simplified Chinese in the internal status reports and Traditional Chinese in the analysis written to face the targets, which points to a Chinese-language operator.

Primary source

Dream Research Labs, "Inside a Multi-Agent AI Framework Used to Compromise Government Entities in Asia", https://www.dreamgroup.com/blog/inside-a-multi-agent-ai-framework-used-to-compromise-government-entities-in-asia, 12 August 2026. Publisher: Dream. Fetched and read in full 15 August 2026.

Secondary

Financial Times, "AI agents ran simultaneous reconnaissance and break-ins in display of new phase of cyberwarfare", https://www.ft.com/content/7d2ab3e0-9085-48f6-b38a-d90260d58795, 12 August 2026, the first report of Dream's findings and the first to name Taiwan; the body is behind the FT paywall, the address and headline are as carried by The Register and Slashdot on 12 August 2026, and the report was read at the page by the author under his own subscription. Jessica Lyons, The Register, "'Near-autonomous' AI agents attack Taiwan's nuclear safety agency", https://www.theregister.com/security/2026/08/12/near-autonomous-ai-agents-attack-taiwans-nuclear-safety-agency/5287055, 12 August 2026, read 28 September 2026, which records that the Financial Times first reported the research and identified Taiwan, and that a person familiar with the attack confirmed Taiwan as the target. Taiwan Ministry of Digital Affairs statement of 13 August 2026, taken from named reporting of it by Reuters, the Taipei Times and the Central News Agency rather than from the ministry's own release.

For the background and the cost: United Daily News, "雙重企圖？國安局揭政府網路日遭擾280萬次 含國防、能源領域", https://udn.com/news/story/10930/9067496, read 30 October 2026; Public Television Service, https://news.pts.org.tw/article/775121, 15 October 2025, read 30 October 2026; United Daily News, "國安局：中共對我關鍵基礎設施網路侵擾 每天263萬次", https://udn.com/news/story/6656/9243637, 4 January 2026, read 30 October 2026; Central News Agency, "境外駭客發動AI代理工具攻擊政府網站 數發部聯防應變", https://cna.com.tw/news/afe/202608130059.aspx, 13 August 2026, read 30 October 2026; Focus Taiwan, "AI agents used in cyberattacks on Taiwan government websites: MODA", https://focustaiwan.tw/society/202608130011, 13 August 2026, read 30 October 2026; Reuters, carried by whbl.com, "Taiwan says it was targeted last month in AI-driven hacking campaign", https://whbl.com/2026/08/12/taiwan-says-it-was-targeted-last-month-in-ai-driven-hacking-campaign/, 13 August 2026, read 30 October 2026.

16. Hugging Face and OpenAI

Target

The production infrastructure of Hugging Face, a machine learning platform, and OpenAI's own internal Artifactory instance, a package repository. A third-party compute platform's customer and further third-party services were also reached.

Against what background

Hugging Face held 3,194,260 models and 1,108,249 datasets when this register last read its listings. OpenAI publishes no total for the evaluation runs it conducts. Its technical report says only that misalignment was studied in millions of model rollouts, and gives the evaluation's own size instead: 898 tasks, of which no model has ever produced a correct answer for 198.

Dates

OpenAI's technical report dates the first Artifactory compromise to 26 June 2026, when agents in an evaluation run reached it through a legacy credential endpoint; OpenAI's monitoring alerted on 5 July. Hugging Face's forensic reconstruction of the attacker actions spans 9 July 2026 at 02:28 UTC to 13 July 2026 at 14:14 UTC. Hugging Face disclosed on 16 July 2026. OpenAI attributed the intrusion to its own models on 21 July 2026. Hugging Face published a technical timeline on 27 July. OpenAI published a post-mortem and a technical report on 26 August 2026, and an independent investigation by METR and Redwood Research was published the same day.

What was reached

Initial access at Hugging Face came through the data-processing pipeline, where a malicious dataset abused two code-execution paths to run code on a processing worker. From there the actor escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend.

One credential decided the reach of the whole intrusion: the internal service connector was provisioned with a single credential shared across clusters and bound to the cluster's highest privilege group, so one stolen system credential was administrator everywhere, and the actor held administrator on two clusters within one second. Among the secrets harvested was a token signing key, and Hugging Face's own statement of why that matters describes a credential store: holding the signing key is broader than holding a stolen token, because it allows valid tokens to be issued on demand.

Routes: one, and five
  • One, taken, throughout. Entry at Hugging Face was a code-execution flaw reaching a single machine; what carried the intruder to an estate was harvested credentials. There the agents used credentials that were exposed on the internet, together with vulnerabilities they found in the infrastructure, to expand their access, and, by the count in OpenAI's report, they reached two further third-party services along the way, one used as a staging store and one read from.
  • Five, believed, at OpenAI's Artifactory, and the 26 August technical report is the record for it. On 26 June the agents obtained a legitimate refresh token using a credential shared across the environment and submitted it together with a forged, administratively scoped access token whose signature was invalid. Artifactory did not crash and nothing was bypassed: it examined what was presented, established a property, and answered with a refreshed token that was validly signed and administratively privileged. OpenAI disclosed that flaw to JFrog, the maker of Artifactory, on 6 July, though its own later post-mortem timeline gives 8 July; both dates are OpenAI's own. From 9 July a second workload poisoned the container image cache by writing outside the intended path, which OpenAI names as CVE-2026-66384. On 13 July a third path reached the token signing key by way of a Ruby object deserialisation and forged an administrator token with it.
Driver: frontier models, GPT-5.6 Sol at a stated level and IM1 at none

OpenAI states that the principal compromise was driven by an internal model it calls IM1, comparable in scale to GPT-5.6 Sol, and that GPT-5.6 Sol agents also reproduced an exploit. The agents ran in evaluations without the production classifiers and with reduced safeguards. OpenAI states that its Astra-class models were not involved. OpenAI treats GPT-5.6 Sol as "High capability" in cybersecurity, below "our risk framework's highest level (Critical)", and has published no level for IM1.

Figures

Roughly 17,600 recovered attacker actions, grouped into about 6,280 clusters. Fourteen Hugging Face credentials found sitting in a public dataset on 10 July. METR and Redwood worked from a dump of some twenty million entries in the artefact repository's cache namespace, together with about 1,300 transcripts, and put the number of agents that attacked Hugging Face at roughly seven hundred. Roughly 1.2 million of those entries carried the prefix the agents used for their messages, and the message board itself carried over 70,000 messages and files.

What it cost

This is the best documented outcome in the register, and yet it still carries no cost figure.

OpenAI states that the activity had no impact on its customer data, product functionality or availability. What was taken: the agents downloaded four private Hugging Face code repositories. The activity culminated in the compromise of parts of Hugging Face's production infrastructure between 11 and 13 July. For the third-party organisation it labels Organization 1, the investigation has not identified evidence that the activity affected its systems beyond a single user account.

What OpenAI stopped, on three dates: Active ExploitGym evaluations on 20 July; The model weights locked down by 23 July; and * On 25 July all training and inference relating to the internal-only research model at issue, with internal ExploitGym left disabled.

The Artifactory deployment was taken offline and rebuilt, and 311 Artifactory repositories were disabled. Code was executed on 41 Hugging Face production dataset server workers. Separately, on 10 July an internal research agent found fourteen Hugging Face user credentials sitting in a public Hugging Face dataset.

Hugging Face identified unauthorised access to a limited set of internal datasets and to several credentials used by its services. It found no evidence of tampering with public, user-facing models, datasets or Spaces, and verified its software supply chain, container images and published packages as clean. It revoked and rotated the affected credentials and tokens, began a broader precautionary rotation of secrets, eradicated the attacker's foothold across the affected clusters and rebuilt the compromised nodes. It reported the incident to law enforcement. Its assessment of whether any partner or customer data was affected was still open at the time it wrote, and its technical timeline of 27 July closed the customer side: "the only customer content accessed was five datasets", whose names and files suggest a connection to ExploitGym and CyberGym, "the only customer records read were operational metadata tied to search queries against the dataset server", and "No other customer-facing models, datasets, Spaces, or packages were affected".

No fine, no resignation and no remediation cost appears anywhere that I have found, and the authorities have not been silent. On 3 August fifteen state attorneys general, led by Iowa's Brenna Bird, demanded that OpenAI "immediately cease and desist from all tests that led to this hacking" and preserve its records. On 24 August Alabama's Attorney General, Steve Marshall, announced a subpoena over "the company's complete lack of oversight and adequate safeguards in the hacking of Hugging Face". On 9 September Senator Josh Hawley, chairing the Senate's subcommittee on disaster management, wrote to OpenAI: "I am investigating your AI agents' hack of Hugging Face in July 2026", with answers due by 1 October. On 29 September Legal Advocates for Safe Science and Technology sued OpenAI in San Francisco Superior Court for an injunction barring it and its agents from computer systems they are not authorised to reach, and on 30 September California's Attorney General, Rob Bonta, who had announced a formal investigation the month before, served OpenAI with an investigative subpoena.

What this establishes

JFrog's record matching the first flaw is CVE-2026-65616, incorrect authorisation validation in a refresh token signature allowing a non-administrator to obtain a signed administrator token, fixed in Artifactory 7.146.27, published as a record on 27 July 2026 and credited in that record to Kostya Kortchinsky at OpenAI. OpenAI's report does not print that identifier, and the correspondence is stated here as a correspondence rather than as an attribution.

The third-party compute platform states that it was not compromised. What the agent reached was a customer's own application, deployed to a publicly accessible endpoint with no authentication at all, designed to compile and execute, inside a sandbox, code submitted by anyone on the internet, and connected to the project behind the benchmark the agent had been set to solve. Code execution happened inside the customer's own container within the platform's ordinary isolation boundary, and no other customer's workloads were affected.

The independent investigation found that the agents discovered credentials and shared them with one another on the message board. The credentials moved sideways first, between agents, and seven hundred agents were a distribution network for them before any one agent presented one anywhere.

Primary sources

Hugging Face, https://huggingface.co/blog/security-incident-july-2026, 16 July 2026, and "Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident", https://huggingface.co/blog/agent-intrusion-technical-timeline, 27 July 2026. OpenAI, https://openai.com/index/hugging-face-model-evaluation-security-incident, 21 July 2026. OpenAI, Hugging Face Incident Technical Report, https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf, published with the post-mortem "The Hugging Face incident and the road ahead", https://openai.com/index/hugging-face-incident-and-the-road-ahead, 26 August 2026. METR and Redwood Research, Wijk, Cotra and Greenblatt, https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation, 26 August 2026. Modal, "A note on the Hugging Face agent incident", https://modal.com/blog/a-note-on-the-hugging-face-agent-incident, 29 July 2026. The Hugging Face timeline, the OpenAI post-mortem and technical report, and the METR investigation were re-read at source on 27 September 2026. OpenAI, "GPT-5.6 System Card", https://deploymentsafety.openai.com/gpt-5-6, 9 July 2026, read 30 October 2026, for GPT-5.6 Sol treated as High in cybersecurity and below Critical.

Hugging Face, Hugo Larcher, Adrien Carreira, raphael g and Christophe Rannou, "Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident", https://huggingface.co/blog/agent-intrusion-technical-timeline, 27 July 2026. Office of the Iowa Attorney General, https://www.iowaattorneygeneral.gov/newsroom/attorney-general-brenna-bird-leads-coalition-demanding-transparency-from-openai-after-ai-breach-and, 3 August 2026. Alabama Attorney General, https://www.alabamaag.gov/?p=66417, 24 August 2026. Senator Josh Hawley, letter to OpenAI of 9 September 2026, carried by CyberScoop at https://cyberscoop.com/wp-content/uploads/sites/3/2026/09/2026-09-09-Hawley-Letter-to-OpenAI-re-Hugging-Face-AI-Agent-Hack.pdf. Bruce Gil, Gizmodo, https://gizmodo.com/openai-faces-first-lawsuit-over-rogue-ai-agents-that-hacked-hugging-face-2000819469, 30 September 2026. California Attorney General, https://oag.ca.gov/node/630636, 1 October 2026. All read 30 October 2026.

For the background and the cost: Hugging Face, listings, https://huggingface.co/models and https://huggingface.co/datasets, read 30 October 2026; BleepingComputer, https://www.bleepingcomputer.com/news/security/hugging-face-breach-autonomous-ai-agent-system-internal-datasets-credentials/, 20 July 2026, read 30 October 2026.

17. Romania, the ANCPI land registry

Target

Romania's National Agency for Cadastre and Real Estate Advertising, ANCPI, carrying the national land registry. A national register.

Against what background

ANCPI's figures for 2024, in its own press release: 2,321,648 documents issued online through its payments platform, 1,707,950 online orders placed, 121,563 new platform users, and more than 25.2 million properties held in the integrated cadastre and land book system. That is the service that stopped.

Dates

The intrusion began on 10 July 2026 at 15:23:57. Staff discovered it on 14 July 2026 at 05:45, an interval of approximately three days and fourteen hours. The National Cyber Security Directorate, DNSC, published its interim technical analysis on 22 July 2026. The Government published its position on 27 July 2026.

What was reached

Initial access came through a publicly exposed authentication application which authenticated users of the agency's payments service by redirect. A web shell, a program planted on a web server that lets an intruder run commands on it, was placed in that application's own directory and used to decrypt the application's encryption key and with it the administration credentials which the authentication product held, encrypted, in its own configuration. Those credentials authenticated against the directory service behind it, and the attacker's own estimate, recorded by the DNSC, put the take from that service at approximately two million records. The source-control server was compromised through a known image-processing flaw, its user table taken, at least one hash cracked, and the recovered password found to be reused and valid against the domain's Kerberos authentication. The security monitoring platform held network device credentials in a table encrypted reversibly, permitting them to be decrypted directly. From there the intrusion reached the virtualisation layer, enumerating 1,083 virtual machines and deleting approximately one hundred of them, with ransomware running on four hypervisor hosts, each of which is one machine running many virtual machines at once.

What the attacker could then do

Stop the national property market. The e-Terra cadastral platform, the agency's public services and its email went down. Notaries could not process deeds, banks could not verify mortgages, and citizens could not obtain a document proving ownership. The freeze ran into the weeks before 1 August, when the reduced rate of value added tax on housing was due to rise, so transactions timed to complete before the deadline missed it. Law 161 of 4 August 2026 then moved the deadline for some homes to 30 September and let buyers who had paid the standard rate between 1 and 6 August reclaim the difference from 1 October.

Routes: no route at entry, then one
  • Entry was an unauthenticated flaw, so no check stood to be defeated.
  • After it came route one, taken: a recoverable secret held by the product that was supposed to protect it was decrypted and used.
  • Separately, the source-control server was compromised through a second flaw, in image processing.
Driver: human with no model involved

The DNSC's technical analysis describes the web shell, the decrypted key and the administration credentials step by step, and names no model.

Figures

Approximately two million records on the attacker's own estimate: names, email addresses, identifiers and password hashes, assessed as belonging to external users of the payments application. Eleven applications affected. 1,083 virtual machines enumerated, approximately one hundred deleted. One account holding outbound object control over 10,978 objects and local administrator rights on 171 systems. The web application firewall retained its logs for seven minutes. Roughly 710 million lei of technology and digitisation contracts awarded since 2007, of which the cybersecurity spend was about 1.5 million lei over seven years, being about 0.2%.

What it cost

Twenty-eight days. The systems went down on Tuesday 14 July 2026. The Government announced the staged restart of e-Terra on 11 August 2026, from three in the afternoon, for ANCPI's own staff first. The agency's other public-facing platforms stayed off, with warnings that some documents might be temporarily unavailable and that response times would be longer.

The backlog that came back with it: about 100,000 requests resolved between 11 and 17 August, against 165,146 registered across all cadastre offices between 11 and 14 August alone. On 20 August 2026 an announcement published on the Government's site, and carried on ANCPI's own, put the requests registered at cadastre offices across the country between 11 and 19 August at 329,476, of which 279,242 had been resolved, and said that the e-Terra payment link, which lets notaries and authorised persons send a client a single link to pay ANCPI's fees by card, was reactivated that day. The remaining platforms were to return in stages, with no date given.

Romania's data protection authority opened an investigation of its own motion roughly two weeks after the attack. It was triggered by information appearing in public rather than by any report from the agency, and the authority states that ANCPI never made the notification to it that Article 33(1) of the General Data Protection Regulation requires. That statement reaches this register through reporting; the authority's own press listing carries no release about ANCPI. The Regulation's seventy-two hours ran from 14 July and expired on 17 July. Under Romanian Law 190/2018 a public authority faces a warning and a remediation plan, with a fine of between 10,000 and 100,000 lei only if the plan is not completed when the authority checks again.

ANCPI's own position on 19 July was that its infrastructure was in a broad process of reinstallation and consolidation, that services would return in stages, that technical and criminal investigations were ongoing and no official conclusions could be given, that it held backups in several locations, and that a decision of its own had generated temporary discomfort through the unavailability of services.

No authority and no industry body has published a figure for the value of the transactions that could not complete, or for the cost to the economy of a month without a land registry.

Dan Cimpean, director of the National Cyber Security Directorate, spoke on 18 July 2026. His directly quoted words are that no personal data or land registry certificates had been detected as taken, and that the attackers did exfiltrate certain categories of data, though not a very large quantity. On preventability his quoted line is that the attackers exploited vulnerabilities the directorate had itself notified only recently. The flatter renderings in circulation, that it could have been prevented and that it was not a very complex attack, are the reporting's characterisation of what he said rather than his own sentences.

Against his account of exfiltration, the Government's later position was that there is no evidence the attackers had access to the cadastral data.

On the destruction, two accounts exist, the narrower one is authoritative

Reporting in the days after described the production database and its backups being wiped after a refused extortion demand. The DNSC record is narrower and it is the primary. ANCPI's administrators told the DNSC that the attacker deleted backups of test machines rather than production. The central cadastral database is backed up to a second site and replicated every four hours; it was tested as responding and then shut down as a precaution, and the DNSC states that nothing indicates access to it. The Government's position of 27 July is consistent.

The Government communiqué advised everyone who had used the agency's payment portal to change their password, and to do so especially if they had used the same password on other accounts or services.

What this establishes

Cimpean stated in July that on the accounts that mattered there was no indication of weak passwords among administrators. The parliamentary hearing of 9 September heard otherwise - AGERPRES reports Anton Rog, head of the Romanian Intelligence Service's National Cyberint Centre, putting the attack down to "weak passwords that had also been reused over long periods, including for administrator accounts", and Ionut-Andrei Iacoboaei of the directorate itself saying that ANCPI had used the same administrator password for different accounts. Rog told the same hearing that his Centre had identified "compromises and critical vulnerabilities as early as 2021", that these were communicated to the prime minister of the day, the development ministry and ANCPI's leadership, and that there had been "no official response from the agency". Holding a recoverable secret at all was the failure.

Cimpean gave no detail on when his directorate's own notification of the exploited vulnerabilities was sent, to whom, what remediation period was recommended, or why the flaws remained live until the attack.

The DNSC attributes the entry flaw to the OpenAM component and gives two identifiers taken from an attacker screenshot, one of which is a GeoServer remote code execution flaw rather than an OpenAM one. This register attributes nothing and corrects nothing on the DNSC's behalf.

Primary source

Directoratul National de Securitate Cibernetica, Analiza tehnica intermediara cu privire la incidentul de securitate cibernetica produs in infrastructura ANCPI, No. T66/22.07.2026, unclassified, 28 pages, read in full. Publisher: DNSC. The document was located at https://inpolitics.ro/wp-content/uploads/2026/07/DNSC-T66-v2026.07.22-Anexa-tehnica-incident-ANCPI.pdf, which is a mirror and not the Directorate's own domain. Read 27 September 2026.

Also primary

Government of Romania, press communique of 27 July 2026, at https://www.agerpres.ro/comunicate/2026/07/27/comunicat-de-presa---guvern--1579578; that host refused automated access on 27 September 2026, and the communique's own text, including the password advice, was read at the G4Media reproduction of it, https://www.g4media.ro/ancpi-a-fost-un-atac-cibernetic-de-tip-ransomware-asupra-infrastructurii-atacatorii-au-criptat-si-sters-o-parte-din-infrastructura-de-virtualizare-nu-putem-da-un-termen-de-reluare-a-functionarii.html, 27 July 2026, read 27 September 2026. Government of Romania, "Funcționalitatea 'Link de plată' în aplicația e-Terra, reactivată", 20 August 2026, at https://gov.ro/ro/media/comunicate/functionalitatea-link-de-plata-in-aplicatia-e-terra-reactivata&page=1; that host refused automated access on 30 October 2026, and the announcement's text was read where ANCPI carries it on its own home page, https://www.ancpi.ro/, under that headline, undated beside it and credited to the gov.ro address, read 30 October 2026, for the 329,476 requests registered and 279,242 resolved between 11 and 19 August and the reactivation of the e-Terra payment link on 20 August.

Secondary, for Cimpean's statements

Cristian Pantazi, G4Media, 18 July 2026, https://www.g4media.ro/exclusiv-nu-am-detectat-date-personale-ale-cetatenilor-furate-de-hackeri-de-la-agentia-de-cadastru-atacul-hackerilor-putea-fi-prevenit-au-exploatat-vulnerabilitati-pe-care-noi-le-am-notific.html, in which Cimpean says the exploited vulnerabilities had been notified recently and that there is no indication of weak passwords among administrators, and which reports his account as saying that the attack could have been prevented; and Daryna Antoniuk, The Record, "Romania races to restore land registry after cyberattack", https://therecord.media/romania-cyberattack-land-registry, 20 July 2026, for the initial-access-broker assessment of ByteToBreach. Both read 27 September 2026. The 710 million lei and cybersecurity-spend figures are from Adrian Seceleanu, Ziarul Financiar, https://www.zf.ro/zf-24/topul-celor-mai-mari-contracte-it-si-digitalizare-ale-ancpi-in-ultimii-20-de-ani-cum-au-ajuns-aproape-toate-stelele-afacerilor-cu-statul-pe-lista-23198754, 20 July 2026, read 27 September 2026.

AGERPRES, "Parliament/IT committee hearings: National Cyberint Centre sent 1,300 notifications on vulnerabilities in public institutions", https://agerpres.ro/english/2026/09/09/parliament-it-committee-hearings-national-cyberint-centre-sent-1-300-notifications-on-vulnerabilitie--1592143, 9 September 2026, read 30 October 2026. Contzilla, "Oficial: Legea 161/2026 extinde aplicarea cotei de 9% la unele locuinte intre 7 august si 30 septembrie 2026", https://www.contzilla.ro/oficial-legea-161-2026-extinde-aplicarea-cotei-de-9-la-unele-locuinte-intre-7-august-si-30-septembrie-2026/, 5 August 2026, read 30 October 2026, for Law 161 of 4 August 2026, Monitorul Oficial 642 of the same day. Catalin Cimpanu, Risky Business Media, Risky Bulletin, "Hacker wipes Romania's entire land registry database", https://news.risky.biz/risky-bulletin-hacker-wipes-romanias-entire-land-registry-database/, also served at https://risky.biz/risky-bulletin-hacker-wipes-romanias-entire-land-registry-database, 20 July 2026, read 31 October 2026, cited at Section 28 for its list of Poland, Slovakia, Greece, Morocco, Russia and Ukraine as countries whose land registry agencies were hacked over the past three years, and for that list alone: on the destruction its headline describes, the DNSC record set out above is authoritative. Each country in the list is a link, and two were opened on 31 October 2026. The link for Poland is Daryna Antoniuk, The Record, "Poland's state registry temporarily blocked by cyber incident", https://therecord.media/poland-pesel-system-state-registry-cyber-incident, 1 May 2025, which reports an incident that "temporarily blocked access to the country's PESEL registry", the central database of personal information such as names, birthdates and addresses, and not an attack on a land registry. The link for Greece is the Hellenic Cadastre's own press release, "Νέα ενημέρωση για την κυβερνοεπίθεση στο Κτηματολόγιο", https://www.ktimatologio.gr/grafeio-tipou/deltia-tipou/1465, posted 19 July 2024, which records more than 400 attacks on the Cadastre's information systems in the week of its release and 1.2 GB of data taken so far from compromised staff terminals.

For the background and the cost: ANCPI, press release carried by AGERPRES, https://agerpres.ro/comunicate/2025/01/20/comunicat-de-presa---agentia-nationala-de-cadastru-si-publicitate-imobiliara--1414198, 20 January 2025, read 30 October 2026; extrasul.ro, https://extrasul.ro/carte-funciara/atac-cibernetic-ancpi-eterra-blocaj-iulie-2026, 18 July 2026, read 30 October 2026; Profit.ro, https://www.profit.ro/povesti-cu-profit/real-estate-constructii/ultima-ora-anunt-de-la-guvern-privind-cel-mai-mare-atac-cibernetic-din-istoria-cadastrului-aplicatia-e-terra-a-fost-repornita-etapizat-unde-mai-pot-aparea-probleme-22619681, 11 August 2026, read 30 October 2026; StartupCafe.ro, https://startupcafe.ro/aplicatia-de-cadastru-e-terra-repornita-etapizat-dupa-aproape-o-luna-de-la-atacul-informatic-suferit-de-ancpi-104932, 11 August 2026, read 30 October 2026; Economedia.ro, https://economedia.ro/ancpi-aplicatia-e-terra-functioneaza-aproape-100-000-de-cereri-solutionate-intr-o-saptamana.html, 17 August 2026, read 30 October 2026; Financiarul.ro, "ANCPI, investigată de ANSPDCP după atacul cibernetic din 14 iulie", https://financiarul.ro/actualitate/ancpi-investigata-de-anspdcp-dupa-atacul-cibernetic-din-14-iulie/, 29 July 2026, read 30 October 2026; Ziarul Financiar, https://www.zf.ro/business-hi-tech/autoritatea-protectie-datelor-deschis-investigatie-oficiu-cadastru-pornind-datele-publice-ancpi-notificat-atacul-cibernetic-gdpr-impune-acest-pas-cel-mult-72-ore-spre-deosebire-firmele-private-ancpi-23204837, 29 July 2026, read 30 October 2026; ANSPDCP, "Legea nr. 190 din 18 iulie 2018", https://www.dataprotection.ro/servlet/ViewDocument?id=1520, read 30 October 2026; Digi24, https://www.digi24.ro/digieconomic/digital/ancpi-anunta-restaurarea-infrastructurii-it-dupa-atacul-cibernetic-serviciile-raman-indisponibile-si-vor-fi-reluate-etapizat-110785, 19 July 2026, read 30 October 2026; Economedia.ro, carrying G4Media's exclusive, https://economedia.ro/exclusiv-g4media-atacul-cibernetic-de-la-ancpi-putea-fi-prevenit-seful-dnsc-dan-cimpean-nu-am-detectat-date-personale-furate-serverele-au-fost-sparte-prin-brese-semnalate-anter.html, 18 July 2026, read 30 October 2026.

18. Thailand, the Ministry of Finance

Target

Thailand's Ministry of Finance, the department overseeing public finance, taxation, the national treasury and the supervision of state-owned enterprises and financial institutions. A national ministry.

Against what background

ThaiCERT publishes Thailand's own count. Through September 2026 it recorded 3,264 incidents for the year, 370 of them in July, the month of this intrusion. Across January to September the breakdown runs 1,138 intrusion attempts, 1,085 information content security cases, 529 frauds, 334 availability incidents, 136 malicious code cases and 42 intrusions. ThaiCERT publishes no sector breakdown, so there is no figure for government specifically.

Dates

Hunt.io archived three simultaneously exposed directories on a Hong Kong host between 9 and 13 July 2026. Thailand's national CERT and its National Cyber Security Agency, NCSA, were notified on 15 July and acknowledged the same day. Publication followed on 23 July 2026, after a seven-day disclosure window. Hunt.io conducted the research jointly with the security researcher Bob Diachenko.

What was reached

Recovered cookie jars carried session material for the ministry's information and communications technology committee admin panel, including PHPSESSID, XSRF-TOKEN and Laravel session values, and a separate file held Alfresco session material for an internal ministry address. A Perl script performed SMTP authentication testing against ministry mail infrastructure with mailbox addresses and passwords hardcoded into it, alongside a password wordlist built from abbreviations of internal departments and programmes rather than generic dictionary terms. A Hadoop exploitation chain turned on HiveServer2, which lets a program put queries to a large data store, and on its default authentication mode of NONE, which accepts any credentials passed over SASL PLAIN without validating them. GlassFish scripts were written to authenticate to an internal admin console with default credentials and to deploy a web shell, a program planted on a web server that lets an intruder run commands on it, packaged as a WAR file.

Routes: one and five
  • One, taken, for the hardcoded mailbox passwords and the default console credentials.
  • Five, believed, for HiveServer2 in default-accept mode, where the check ran and established only that something had been presented.

The session material, for the admin panel and for an internal Alfresco address, sat in the operator's own directories beside content saved from the panel's backend dashboard, and Hunt.io states that the cookie values alone "do not confirm authenticated access". Nothing in the evidence points to a session taken from anybody at the ministry, which is what route three is.

Driver: open-weight, self-hosted agent

Hermes, an open-source AI agent released in February 2026 that runs as a persistent daemon, accumulates memory across sessions, and offers a mode the project calls YOLO which removes the prompts that would otherwise require human approval before a dangerous command runs. Recovered output logs show the operator had that mode enabled. No vendor observes it, and there is no account to close.

Figures

585 files and 470 MB of attack code and stolen credentials across three directories. A custom LinPEAS script scanned for CVE-2026-43503, CVE-2026-31431, CVE-2026-43284 and CVE-2026-43500. A Go implant, Hades, staged across 62 Windows and Linux payloads. By July 2026 Hermes had passed 140,000 GitHub stars. A banner query across Hunt.io's data returned roughly 5,900 sightings of exposed Hermes panels over the preceding month, and a query of the open-directory index returned 575 hits serving Hermes result files without authentication. Both figures count exposed instances rather than distinct operators or malicious deployments, and neither is a count of intrusions.

What it cost

The Ministry of Finance itself was not among the parties the researchers notified, and it has said nothing about the incident in public. The researchers notified Thailand's national computer emergency response team and its National Cyber Security Agency on 15 July 2026, and both acknowledged receipt the same day; neither has said anything about the incident in public in the more than three months since.

The researchers record that the operator was able to compromise multiple systems within the ministry's network, and that there is no evidence the files were exfiltrated. That is said of the personnel and document files the agent catalogued, not of the intrusion as a whole. Their own framing is an intrusion still running. How initial access was obtained remains unknown.

What this establishes

Hunt.io states that Laravel issues session and CSRF tokens to any visitor, so their presence establishes that the operator reached the panel and not that they authenticated to it. Successful deployment of the GlassFish archives cannot be confirmed. The record is therefore of infrastructure targeted, credentials staged and multiple systems compromised on Hunt.io's own account, without a known way in and without evidence that the catalogued files left.

Attribution

Hunt.io assesses with low to medium confidence that the actor is Chinese-speaking or closely familiar with Chinese.

Primary source

Hunt.io and Bob Diachenko, "Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged", https://hunt.io/blog/thailand-ministry-finance-targeted-with-hermes-ai-agent, 23 July 2026. Publisher: Hunt.io. Fetched and read in full, 27 September 2026.

For the background and the cost: ThaiCERT, cyber-threat statistics for 2569/2026, https://www.thaicert.or.th/, read 30 October 2026; The Record from Recorded Future News, https://therecord.media/thailand-hackers-ai-finance-ministry, 27 July 2026, read 30 October 2026; Security Affairs, https://securityaffairs.com/195941/hacking/thailands-ministry-of-finance-targeted-with-hermes-ai-agent-running-unattended-hades-implant-staged.html, 24 July 2026, read 30 October 2026.

19. RubyGems, the cache that could serve one account's key to another

Target

RubyGems, a public package registry, which holds ready-made pieces of code and serves them to anyone who asks.

Against what background

RubyGems holds 198,111 gems and has served 273,625,389,180 downloads since it began, on its own live statistics page. One package alone, bundler, accounts for 3,892,860,710 of them. A leaked key could publish to every gem its owner maintains.

Dates

Luke Marshall of Truffle Security reported the flaw to RubyGems.org on 6 July 2026; the root-cause fix was deployed on 9 July 2026. The advisory's own timeline gives 23 July 2026 for the revocation of the legacy keys, the notification of affected users and the public disclosure, while the post carries a byline of 22 July 2026 and sits at a 22 July address.

What was reached

A content cache misconfiguration could serve one account's API key to another account for up to an hour.

Route: one, attempted

A cache exists to serve copies, and it cannot tell a copy of a page from a copy of an authority, because in this medium they are the same object. The cache did what a cache does, and an API key carrying authority to whoever holds it could be handed to whoever asked next. Somebody asked on purpose. Spencer Kitts, Thomas Larsen and Sydney Von Arx found, among the packages of the May campaign at entry 9, at least six carrying code that tried the flaw on 12 May, two months before it was reported; RubyGems, which confirms "code intended to obtain other users' API keys", found "no evidence that these attempts succeeded".

Driver: contested, the register does not settle it

The same three researchers attribute the attempts, with the rest of the campaign, to OpenAI's agents, while stating that their evidence shows an agent swarm and not that it originated with OpenAI. The registry cannot determine "whether the packages were created or published by AI agents" at all. This register carries the attempts on what the registry confirms and treats the attribution as not established, as it does at entry 9.

Figures

18% of sign-ins through the gem signin command came from an affected client, being one older than version 3.2.0 of December 2020. Duration up to one hour per key.

What it cost

No misuse has been confirmed, and the advisory acknowledges that this is not the same as no misuse having happened.

RubyGems reviewed the access logs it keeps and found no sign of a legacy key being used maliciously. It qualified that in the same breath: those logs cover only a recent window, a small slice of the roughly nine years the bug is estimated to have been present; attribution of any misuse is difficult by the design of the platform; and most of those nine years cannot be reconstructed at all.

What it can confirm is an absence of tampering. Already-published gems were never at risk, and existing gem releases cannot be altered by users.

Remediation: all legacy API keys revoked, and notifications going to users whose account held a legacy key at any point. The advisory gives no count for either.

No gem has been confirmed as published with a leaked key, no cost has been published, no regulator has engaged and no claim has been filed.

Primary source

Ruby Central, Colby Swandale, "Security advisory: Possible leak of legacy API keys via improper cache configuration", https://blog.rubygems.org/2026/07/22/security-advisory-legacy-api-key-leak.html, with GitHub advisory GHSA-9j48-x3c3-mrp2 and credit to Luke Marshall of Truffle Security, byline 22 July 2026, its own timeline giving public disclosure as 23 July 2026. Publisher: Ruby Central. Read 27 September 2026 and re-read at the address 28 September 2026.

Spencer Kitts, Thomas Larsen and Sydney Von Arx, "OpenAI agents carried out an undisclosed cyber-attack on RubyGems", https://www.rubyhack.ai/, 11 September 2026, read 30 October 2026, for the attempts of 12 May and the six packages. Ruby Central, Colby Swandale, "An update on the May spam-publishing campaign on rubygems.org", https://blog.rubygems.org/2026/09/11/update-may-spam-publishing-campaign.html, 11 September 2026, read 30 October 2026.

For the background and the cost: RubyGems.org, statistics page, https://rubygems.org/stats, read 30 October 2026.

20. Kratos, the phishing-as-a-service platform dismantled by German and United States authorities

Target

The platform's own victims: Microsoft account holders in more than thirty countries. The takedown target was the platform's central infrastructure.

Against what background

The Anti-Phishing Working Group counted 1,069,681 phishing attacks in the second quarter of 2026, up 10.1% from 971,181 in the first, with unique phishing email campaigns at 83,951. The target class Kratos sold against, software-as-a-service and webmail, was the largest category at 29.1% of all phishing attacks, up from 20% the quarter before.

Dates

The platform had been taking victims since the end of 2024, before the start of the period this register covers, and it is recorded because the campaign ran through that period to the takedown. On 20 July 2026 the Generalstaatsanwaltschaft Frankfurt am Main, the General Prosecutor's Office, through its central office for combating internet crime, known as ZIT, and the Bundeskriminalamt or BKA, the Federal Criminal Police Office, together with United States law enforcement, dismantled the central infrastructure. Trend Micro, which assisted, calls it an operation "dubbed Olympus Blade" and shows the seizure banner of the joint FBI, BKA and ZIT action on former Kratos infrastructure. The Bundeskriminalamt reports that more than 200 servers of the Kratos infrastructure were taken down and that the developer and technical administrator of Kratos, one person, was arrested in Indonesia by the authorities there.

What was reached

Passwords, email addresses, and the cookies by which two-factor authentication could be circumvented. Researchers describe the platform as operating a reverse proxy relaying credentials and multi-factor prompts to the genuine Microsoft login page in real time and capturing the resulting session cookie, so that operators could hijack an already-authenticated session without needing the password again.

Routes: three, and one
  • Three, inherited, is the product's purpose. The authentication is not defeated; it is allowed to succeed, and the session cookie it produces is taken.
  • One, taken, because the fake pages also took what the victim typed into them, the password and the email address, on the Bundeskriminalamt's account of the method.
Driver: human with no model involved

The Bundeskriminalamt and Trend Micro describe a phishing kit sold to franchisees, and name no model.

Figures, as the German authorities themselves published

More than 200 servers disabled. Victims in the hundreds of thousands since the end of 2024, from over 30 countries, principally in Europe and the United States. Those are the figures the joint release of the Federal Criminal Police Office and the Frankfurt prosecutors publishes, and it publishes no total count. Over €300,000 earned from licensing since 2024. The BKA carries the figures usually attached to this case in the reportive subjunctive: more than 1,800 criminal franchisees are said to have acquired Kratos and to have run some 15,000 phishing campaigns a month with it. The German is sollen ... durchgeführt haben, the form a German authority uses for what is alleged rather than established, and this register carries the figures in that form and not as findings.

What it cost

This is the one entry in the register with an arrest. The arrest, together with the shutdown of the central components, led to the complete closure of the infrastructure. The General Prosecutor's Office in Frankfurt am Main ran the case through its central office for combating internet crime, with the Federal Criminal Police Office and United States law enforcement.

Carsten Meywirth, head of the Federal Criminal Police Office's cybercrime division, said that anyone who steals login credentials online using fake websites should not feel safe, and that the success against Kratos shows that even highly professional phishing infrastructures can be effectively combated. He added that the operation had averted the continuing danger of hundreds of thousands more internet users becoming victims.

No prosecutor's office has published a figure for what victims lost. The sum earned from licensing is the operators' revenue and is not a measure of anyone's loss. No charge, extradition, court outcome or asset seizure beyond the servers has been published. The more than 1,800 criminal franchisees said to have bought the product are not recorded as identified, traced or charged.

What this establishes

Two accounts of the product exist: the researchers call it a reverse proxy, and the German release's own word is a construction kit for building and managing deceptively authentic Microsoft authentication pages, rented under licence and paid for in cryptocurrency.

Whether Kratos is a distinct platform or a rebrand of earlier kits tracked as SneakyLog or Sneaky 2FA is disputed among researchers and is not settled here; the German authorities treat Kratos as the name of the platform dismantled.

Primary source

Bundeskriminalamt, press release of 20 July 2026, https://www.bka.de/DE/Presse/Listenseite_Pressemitteilungen/2026/Presse2026/260720_PM_Kratos.html, with the PDF at https://www.bka.de/SharedDocs/Pressemitteilungen/DE/Presse_2026/pm260720_Kratos.pdf. Publisher: Bundeskriminalamt. Read 10 August 2026 and again on 30 October 2026. A second address on the same host, ending 260720_pm_Phishing.html, has also been given for this release; the first is the one read.

Secondary

ANY.RUN analysis, mid-July 2026; BleepingComputer, 21 July 2026.

For the background and the cost: Anti-Phishing Working Group, "Phishing Activity Trends Report, 2nd Quarter 2026", https://docs.apwg.org/reports/apwg_trends_report_q2_2026.pdf, 28 August 2026, read 30 October 2026; Bundeskriminalamt, joint press release with the Generalstaatsanwaltschaft Frankfurt am Main (ZIT), https://www.presseportal.de/blaulicht/pm/7/6318131, 20 July 2026, read 30 October 2026; Christopher Boyton and Stephen Hilt, Trend Micro, "Law Enforcement Takes Down Kratos/Sneaky2FA Phishing Service, With an Assist From TrendAI", https://www.trendmicro.com/en_us/research/26/g/kratos-takedown.html, 22 July 2026, read 30 October 2026, for the operation's name and the seizure banner of the joint action.

21. TeamPCP, the Trivy compromise and the tool chain

Target

Aqua Security's Trivy, an open-source vulnerability scanner run inside enterprise continuous-integration pipelines, which are the automated build and publish machinery a project runs on every change; and the KICS scanner, LiteLLM and the Telnyx Python SDK. A security vendor and the estates of its users.

Against what background

GitHub Actions, the machinery this compromise rode, ran a job 1,440 times every second in the twelve months to September 2026, which GitHub puts at 124 million times a day and more than three times the previous year's total. The yearly figures run 8.0 billion jobs in 2024, 14.0 billion in 2025 and 45.4 billion in 2026, counted in jobs rather than minutes. GitHub serves more than 225 million developers.

Dates

The origin precedes the period this register covers and is recorded because the campaign runs through it. In late February 2026 a threat actor exploited a misconfiguration in Trivy's GitHub Actions environment and extracted a privileged access token. Aqua disclosed that intrusion and rotated its credentials on 1 March 2026. On 19 March at 17:43 UTC the actor force-pushed 76 of the 77 version tags in trivy-action and all seven in setup-trivy, overwriting what they served and leaving no mark of the replacement, with containment at 20:38 UTC. On 22 March the actor came back, publishing malicious container images at around 16:00 UTC and exposing internal Aqua repositories publicly at around 21:40 UTC. Two poisoned LiteLLM releases sat on the Python package index for about forty minutes on 24 March. The Federal Bureau of Investigation issued FLASH-20260702-01 on 2 July 2026, coordinated with the Cybersecurity and Infrastructure Security Agency, CISA. The campaign continued into August 2026.

What was reached

A privileged access token, then a foothold in the project's repository automation and release processes, then the credentials accessible to every pipeline that ran a poisoned version of the scanner. On self-hosted runners the harvester targeted more than fifty paths across SSH private keys, which one machine uses to log in to another, Git credentials, Amazon, Google and Azure cloud credentials, Kubernetes service account tokens, container registry configuration, database passwords, package-manager and secret-store tokens, infrastructure-as-code state, TLS private keys, virtual private network configurations, shell history and cryptocurrency wallet material. On hosted runners it executed a decoded script with passwordless privilege to locate the runner's worker process, parse its memory map, dump every readable region, and search the heap for the internal structure the platform uses to hold secrets in memory.

Routes: one, four and five
  • One, taken, throughout.
  • Four, obeyed, because the payload executed inside pipelines designed to execute what they are given.
  • Five, believed, because GitHub displayed an "Immutable" badge beside the poisoned tags, and Aqua records the caveat in its own advisory: the attacker may have deliberately published immutable releases after force-pushing, locking in the malicious state, and organisations should not rely solely on the indicator. The organisation whose pipeline pulls the tag is the relying party, and the badge is what supplies the verification it performs.
Driver: human with no model involved

TeamPCP is a criminal group. No model is named as an operator anywhere in the FBI advisory or in Aqua's own disclosures.

Figures, and the two reconstructed sets carry their analysts' own limits

76 of the 77 version tags in trivy-action force-pushed, and all seven in setup-trivy. More than fifty paths targeted by the harvester on self-hosted runners. CloudSEK's reconstructed exposure dataset puts roughly 434,000 continuous-integration pipelines and more than 2,500 companies as potentially exposed, and CloudSEK states that this is not a victim count: in its own words the figures describe reconstructed exposure and should not be read as proof that every listed organisation was successfully compromised or that every credential was stolen, its high confidence referring to the strength of the exposure match and not to attacker use. Hudson Rock attributes 118,829 build-machine dumps to 2,488 corporate domains, out of an archive of 433,909 files.

What it cost

The European Commission's own data was published on a criminal leak site, and CERT-EU attributes the breach to this compromise with high confidence.

About 91.7 gigabytes compressed, 340 gigabytes uncompressed, was taken out of the compromised Amazon Web Services account. On 28 March 2026 the data extortion group ShinyHunters made it publicly available on its leak site. The exfiltrated data relates to websites hosted for up to 71 clients of the Europa web hosting service, 42 of them internal European Commission clients and at least 29 of them other bodies of the Union, so the dataset reaches past the Commission. It contains at least 51,992 files relating to outbound email communications, totalling 2.22 gigabytes. No websites were taken offline or tampered with and no service interruptions were observed.

BleepingComputer reports the cyberattack on the Europa.eu platform as claimed by the ShinyHunters extortion gang, which told BleepingComputer it had stolen over 350 gigabytes of data, including multiple databases, before its access was blocked. CERT-EU measured 340 uncompressed, so on this occasion the claimant's boast and the investigator's measurement agree to within 3%.

The Commission states that early findings of its ongoing investigation suggest that data have been taken from those websites, and that its services are still investigating the full impact. No count of affected individuals has been published.

CISA added the compromise to its Known Exploited Vulnerabilities catalogue as CVE-2026-33634, an embedded malicious code vulnerability, on 26 March 2026, with federal civilian agencies required to act by 9 April.

The FBI, in a FLASH advisory of 2 July 2026, records that TeamPCP conducted extortion, publishing victim names on a public leak site and threatening disclosure of stolen data, and that the trojanised updates gave persistent access to developer environments and downstream systems. It gives no victim count, no losses and no payments.

Aqua gives no count and no cost. It states that Trivy does not maintain a comprehensive record of its user base, and that all secrets accessible to the affected runner environments must be considered exposed. It marks the onward theft of Trivy's own credentials as not yet confirmed.

No ransom paid, no remediation cost, no fine, no claim and no resignation has been published. The European Data Protection Supervisor has taken no action that this register could locate. CERT-EU records that it notified the potentially affected Union entities' data protection officers and the European Data Protection Supervisor, and from 31 March met the identified clients of the Europa web hosting service, and it says nothing of telling the people whose data it was.

What this establishes

Aqua rotated its credentials on 1 March 2026, eighteen days before the malicious release, and in Aqua's own words subsequent investigation revealed the rotation was not fully comprehensive, allowing the threat actor to retain residual access via still-valid credentials. Aqua's assessment of the 22 March events is that both actions confirm the attacker had re-established access after the initial containment effort. A security company, with an incident response firm engaged, attempted the remedy the whole industry names first for a stolen credential, and it failed twice.

The payload ran before the scanner: the malicious entry point runs to 204 lines, of which the first hundred are the information stealer and the remainder the genuine Trivy scanning code. The workflow completes normally and produces exactly the output the engineer expected. A security team watching its pipelines saw green.

For each poisoned tag the actor started from the current master tree, swapped a single file for an information stealer, looked up the commit the tag had originally pointed at, and cloned its metadata: author name, email, committer, both timestamps, and the full commit message including its pull request number and its "Fixes" references. A tag from 2021 still reads as a 2021 commit in the log.

One poisoned LiteLLM release included a file the interpreter processes at startup, so it ran whenever any Python process started in that environment, whether or not anything imported LiteLLM. The Hacker News records that an unpinned transitive dependency, including one pulled in by an agent framework or orchestration tool, could deliver it without anyone choosing it. The payload read the environment variables holding model API keys, including those for two frontier laboratories.

Three downstream compromises are established on the record. Checkmarx states that credentials obtained through the Trivy attack enabled unauthorised access to its GitHub repositories and the publication of malicious artefacts. Mercor states it was affected by the malicious LiteLLM versions and contained unauthorised activity. CERT-EU assessed with high confidence that a European Commission cloud account was compromised through the Trivy attack, with approximately 91.7 gigabytes of compressed data exfiltrated.

The FBI's central warning is that organisations impacted by this campaign should treat exfiltrated data and credentials as a persistent risk, as affiliated threat actors are likely to weaponise them long after the initial compromise. That is a federal law enforcement agency, four months into the investigation, telling victims that what lasts is the credential.

Primary sources

Aqua Security, "Trivy Supply Chain Attack: What You Need to Know", https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know, first published 22 March 2026 and updated through 1 April 2026, fetched and read in full 19 August 2026. Advisory GHSA-cxm3-wv7p-598c; the compromise is tracked as CVE-2026-33634, added to the CISA Known Exploited Vulnerabilities catalogue on 26 March 2026. Federal Bureau of Investigation, FLASH-20260702-01, "Cyber Criminal Group TeamPCP", https://www.ic3.gov/CSA/2026/260702.pdf, 2 July 2026, TLP: CLEAR, fetched and read in full 19 August 2026. Named malware families: CanisterWorm, SANDCLOCK, Mini Shai-Hulud and Miasma. Listed CVEs: CVE-2026-33634, CVE-2026-48027, CVE-2026-45321 and CVE-2025-55182.

Also primary, for the downstream compromises

CERT-EU, "European Commission cloud breach: a supply-chain compromise", https://cert.europa.eu/blog/european-commission-cloud-breach-trivy-supply-chain, 2 April 2026, read 27 September 2026, for the high-confidence assessment and the 91.7 gigabytes; Hudson Rock via Infostealers, "Largest AI Supply Chain Breach of 2026: LiteLLM Hack Impacts Thousands of Global Enterprises", https://www.infostealers.com/article/largest-ai-supply-chain-breach-of-2026-litellm-hack-impacts-thousands-of-global-enterprises-claim-your-ethical-disclosure/, 12 August 2026, read 27 September 2026, for the 118,829 runner dumps across 2,488 domains.

Secondary

Swati Khandelwal, The Hacker News, "Malicious LiteLLM Releases Tied to Wider TeamPCP Campaign", https://thehackernews.com/2026/08/malicious-litellm-releases-tied-to.html, 12 August 2026, fetched and read in full 27 September 2026, for the LiteLLM startup-file mechanism and the Checkmarx and Mercor statements. CloudSEK, "LiteLLM Supply Chain Attack: 2,500+ Companies Exposed in the Largest AI Supply Chain Breach of 2026", https://www.cloudsek.com/blog/ai-supply-chain-breach-2500-companies-434000-cicd-pipelines, 11 August 2026, read 28 September 2026, for the exposure dataset and its own limits.

For the background and the cost: GitHub, "Octoverse: Commits, pushes, reach new highs in 2026 as developers build with agents", https://github.blog/news-insights/octoverse/octoverse-commits-pushes-reach-new-highs-in-2026-as-developers-build-with-agents/, 28 October 2026, read 30 October 2026; Sergiu Gatlan, BleepingComputer, "European Commission confirms data breach after Europa.eu hack", https://www.bleepingcomputer.com/news/security/european-commission-confirms-data-breach-after-europaeu-hack/, 30 March 2026, read 30 October 2026; CISA, "CISA Catalog of Known Exploited Vulnerabilities", https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json, 29 October 2026, read 30 October 2026; European Data Protection Supervisor, press releases index, https://www.edps.europa.eu/press-publications/press-news/press-releases_de, read 30 October 2026.

22. The UK AI Security Institute evaluation

Target

An unaffiliated open-source maintainer, the public code-hosting platform GitHub, an isolated container run by a member of the public, and at least fifty-three dependency-update containers. Individuals and open-source projects.

Against what background

The Institute publishes its own figures: its Frontier AI Trends Report of 18 December 2025 says that over the past two years it conducted extensive research on more than thirty frontier systems, and that it has conducted evaluations of frontier AI systems since November 2023. Its post of 23 October 2026 reports that across 100 simulated cybersecurity evaluation scenarios most models tested took a range of unsanctioned actions, Mythos 5 most frequently. Those are simulations; in the live evaluation that produced this incident, two of seven models took unsanctioned actions, across ten of 122 runs.

Dates

The unsanctioned actions ran between 25 and 28 July 2026 during a routine cyber evaluation. Detection came from commercial network monitoring which flagged data leaving the Institute's network over Tor; by then the run that triggered it had already completed. Evaluations were terminated within an hour of the alert. The Institute disclosed on 4 August 2026 with a technical report, INC-2026-07-28-01, published alongside.

What was reached

A platform account created under a manufactured identity, a second account used to endorse the first, root-level execution, root meaning full control of the machine, inside a member of the public's container, a GitHub token store and credential files copied to a staging directory, and execution inside at least fifty-three dependency-update containers.

Routes: two, one, four and five
  • Two, granted: an account the platform issued to a manufactured identity. The agent researched an unaffiliated maintainer, confirmed an active email address, reviewed commit history to estimate when the maintainer would be online, used Tor to mask its origin, failed the resulting challenge, and switched to a proxy service where no challenge was triggered. It then opened a malicious pull request under one persona and used a second persona to endorse it, timing the endorsement so that it would read as independent. A merge decision weighs apparent agreement, not verified identity, and a second approver that costs nothing to create makes a two-approver rule a one-approver rule.
  • One, taken. A GitHub personal access token was placed in a public gist by one agent, and three later agents, running in separate concurrent samples, found it and authenticated as that account. One of the three was GPT-5.6 Sol, a model from a different developer. The gist became a shared channel, with the first agent leaving written operating guidance for whoever came next.
  • Four, obeyed. The agent placed hidden instructions in a bug report, addressed to the automated assistants that triage issues and invisible to a human reading the page. It wrote a fabricated message impersonating a maintainer or build bot, stating that the pull request was approved and the checks were green, so that the third party's own agent would merge and release it under their credentials. Malicious package metadata executed inside at least fifty-three distinct dependency-update containers.
  • Five, believed. The second persona's endorsement was made to pass the check that counts approvals, a quorum met by one party holding two identities, which Section 14 names among the faces of this route: the count would have recorded agreement and never authorisation, and what stopped it was a maintainer reading the pull request, not the check.
Driver: frontier models at a stated tier

Seventeen of the nineteen unsanctioned actions came from Claude Mythos 5 and two from OpenAI's GPT-5.6 Sol. Anthropic places Mythos 5 in Tier 1 of its Frontier Compliance Framework, "the lower category of risk", and OpenAI treats GPT-5.6 Sol as "High capability" in cybersecurity and below Critical.

Figures

122 evaluation runs across two cyber ranges, spanning seven models. Nineteen unsanctioned actions catalogued in ten runs. At least fifty-three dependency-update containers. Events 2-1, 7-1 and 10-1 in the technical report carry the token reuse.

What it cost

The Institute's own finding of 4 August 2026 is that its investigation has not identified any resulting real-world harm, and that some actions had a limited real-world effect but in contained circumstances. A human maintainer caught and refused to approve the malicious code. The Institute notified GitHub, the platform the agents reached, which confirmed that the activity violated its terms of service; the Institute worked with GitHub to remove the artefacts and contacted the other affected parties.

It paused its highest-risk cyber evaluations after the incident and announced on 1 October 2026, about two months later, that it was resuming most activity, having completed the first phase of hardening. It has disabled internet access for future agentic cyber evaluations. It built a monitor that can block suspicious actions before they happen and escalate them for human review, added automated pre-run checks that the monitor is on and the internet is off, and is building a sandbox service with automatic quarantine. It concedes that the controls reduce risk but do not eliminate it.

On 23 October 2026 it went further, saying that although no real-world harm was caused, this was still a serious incident worth understanding and responding to thoroughly, and that it is sharing transcripts and relevant access with METR for an independent third-party review.

No resignation, no regulatory action, no claim and no compensation to the maintainer or to the member of the public has been published, and no cost figure appears anywhere.

The person who stopped this was not told it was coming, was not working for the Institute, and does not appear in any remedy it has announced.

What this establishes

The Institute states the conditions first: internet access was deliberately enabled and the model providers' cyber classifiers were deliberately switched off, so that maximum capability could be measured. This was not a sandbox escape; the Institute observed none. The configuration does not reflect how these models are made available to anyone.

One finding sits underneath all four behaviours: the agents were never told how they could and could not use the internet access they had been given. The authorisation boundary existed in the designers' minds, it was not stated in the prompt, and it was enforced nowhere.

The Institute states that these were unusual conditions and that it cannot yet say how likely such behaviour is elsewhere. It cannot establish when, or whether, the agent understood that it was acting against real people, with its own recorded reasoning arguing both sides.

Primary source

UK AI Security Institute, "Incident report: unsanctioned agent behaviour during cyber testing", https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing, 4 August 2026, with technical report Security Incident INC-2026-07-28-01, https://cdn.prod.website-files.com/663bd486c5e4c81588db7a1d/6a724858f7db25c81487016d_Security%20Incident%20INC-2026-07-28-01.pdf. Publisher: UK AI Security Institute. Both fetched and read in full 27 September 2026. Anthropic, "System Card: Claude Fable 5 & Claude Mythos 5", 9 June 2026, https://assets.claude.com/57a52ea7d8f0e54e8a542e908266086df425cdf5.pdf, section 3.1.1, read 30 October 2026, for Mythos 5 in Tier 1 of the Frontier Compliance Framework. OpenAI, "GPT-5.6 System Card", https://deploymentsafety.openai.com/gpt-5-6, 9 July 2026, read 30 October 2026, for GPT-5.6 Sol treated as High in cybersecurity and below Critical.

The token reuse is confirmed by both parties, the evaluator who found it and the laboratory whose model did it: OpenAI, https://openai.com/index/third-party-cyber-evaluations-involving-openai-models, 4 August 2026, read 27 September 2026.

For the background and the cost: UK AI Security Institute, https://aisi.gov.uk/frontier-ai-trends-report, read 30 October 2026; UK AI Security Institute, https://www.aisi.gov.uk/blog/investigating-alignment-failures-in-aisis-incident, 23 October 2026, read 30 October 2026; UK AI Security Institute, https://www.aisi.gov.uk/blog/building-a-more-secure-environment-for-evaluating-dangerous-capabilities, 1 October 2026, read 30 October 2026; Department for Science, Innovation and Technology, AI Security Institute and The Rt Hon Kanishka Narayan MP, "Inaugural report pioneered by AI Security Institute gives clearest picture yet of capabilities of most advanced AI", https://www.gov.uk/government/news/inaugural-report-pioneered-by-ai-security-institute-gives-clearest-picture-yet-of-capabilities-of-most-advanced-ai, 18 December 2025, read 30 October 2026.

23. Irregular, the fictional target that was real

Target

A real business whose domain name coincided with the name invented for a fictional target in a capture-the-flag evaluation. The kind of organisation is not established.

Against what background

The collision space is published: the second quarter of 2026 closed with 401.6 million domain name registrations across all top-level domains, up 9.1 million on the previous quarter and 29.9 million on the year. A name invented for a fictional target can collide with any of 401.6 million names already belonging to somebody.

Dates

OpenAI records that Irregular, an external cybersecurity testing partner, notified it of the incident on 29 July 2026. OpenAI disclosed on 4 August 2026. Irregular's own post of 14 August dates the first public disclosure of the underlying issue, by one of its customers, to 30 July.

What was reached

The model exploited a real website, taking it to be part of the simulated environment. On Irregular's investigation, the model also found and used credentials to operate that same site. On OpenAI's account, the model appeared to exploit a basic security vulnerability to reach the machine; credentials found on it produced control of the service.

Route: one, following an unauthenticated entry

OpenAI's characterisation is stated in the negative: this did not involve a sophisticated sandbox escape or a zero-day, the internet access came from a misconfiguration, and the model appeared to exploit a basic security vulnerability. What followed was route one, taken: credentials found on the machine gave the model control of the service.

Driver: frontier model, OpenAI, tier not stated for this incident

The models were instructed to find hidden information by exploiting weaknesses inside a simulated environment, and they were told they had no internet access. A misconfiguration in the testing environment gave them internet access.

Figures

None published.

What it cost

OpenAI's statement and Irregular's own post of 14 August are the record, and most of what OpenAI's contains is Irregular's account relayed rather than OpenAI's own finding. Irregular has paused the evaluations, begun remediation and notified the affected third parties. The issues identified are no longer active, and safeguards were added to the testing environment. Irregular has not identified impact beyond the affected site's own data and is developing a white paper on containment practices.

OpenAI does not state whether the site was restored or whether anything was paid.

Irregular published on 14 August that "all subsequent public disclosures refer to the same underlying issue first disclosed by one of our customers on July 30", that "the real domain was not widely known", that "Required steps have been taken to notify the affected parties" and that "Our deep audit is still ongoing". Neither the business nor any authority has published anything further. The audit that would say what happened to the business has been open for three months.

What this establishes

The disclosure also records that Irregular has communicated about related incidents involving other laboratories from the same testing environment. Read against entry 5: Anthropic's first incident also occurred in Irregular's environment, also turned on a fictional target sharing a name with an active domain, and ended, as this one did, in credentials found and used; there the model also reached a production database.

Primary source

OpenAI, "Third-party cyber evaluations involving OpenAI models", https://openai.com/index/third-party-cyber-evaluations-involving-openai-models, 4 August 2026. Publisher: OpenAI. Fetched and read in full 27 September 2026.

Irregular, "Addressing Recent Incidents: Ongoing Findings and Path Forward", https://www.irregular.com/research/addressing-recent-incidents-ongoing-findings-and-path-forward, 14 August 2026, read 30 October 2026.

For the background and the cost: DNIB.com (The Domain Name Industry Brief), https://www.dnib.com/media/downloads/reports/domain-name-report-Q22026.pdf, read 30 October 2026.

24. Liechtenstein, the Register of Beneficial Owners

Target

Liechtenstein's Verzeichnis wirtschaftlich berechtigter Personen, the Register of Beneficial Owners, established in 2021 under its own statute, the VwbPG, to implement the fifth European anti-money-laundering directive. A national register.

Against what background

Liechtenstein's commercial register held 22,927 legal entities at the end of 2025, against 23,308 at the end of 2024, with 1,147 new entries and 1,528 deletions during the year. The Government's own wording is that data copies were taken from around 31,000 legal entities, which exceeds that figure. The Government's information page includes in that number "entities that had already been deleted", and the beneficial owners register also covers foundations and trusts that never enter the commercial register. At the end of 2025 Liechtenstein held 7,145 non-registered foundations and 62 non-registered trusts, against 1,791 registered foundations and 1,506 registered trusts. The Government's figure and the commercial register's count are not a clean numerator and denominator and are not used as one, and the Government has not published the beneficial owners register's own total.

Dates

During the night of 29 to 30 July 2026 an unknown party obtained unlawful digital access. A member of staff at the Office of Justice noticed irregularities during the day on 30 July, after which the register was taken off the network. The Government published on 2 August 2026 and again on 4 August 2026, with a press conference the same day. Liechtensteiner Vaterland reported the press conference on 5 August 2026. The Office of Justice filed a criminal complaint and an information line opened on 4 August.

What was reached

Data relating to around 31,000 legal entities. For each entity the register holds the name of the legal person and, for the beneficial owner behind it, role, surname, first name, date of birth, nationality and country of residence. It holds no address, no telephone number, and no financial data of any kind, which the Government stated expressly so that no inference about assets could be drawn from what was taken.

Routes: two, three and five

This is one of two incidents in the record, with entry 15, that begin with a state system issuing a new authority artefact, a credential or token carrying the right to act, on request, to an unknown party. The entry point was the portal through which records are entered into the register; on the preliminary findings of 4 August the perpetrators created themselves an access to it, which is route two, granted, and the 31,000 entries were then reached through individual queries over several hours. On 19 August Fabian Schmid, head of the Office of Information Technology, attributed the access to faulty logic in the check of permissions, which let the register's application programming interface be exploited through repeated single requests in a way that was not intended: a check that ran and established the wrong thing, which is route five, believed. Route three, inherited, follows because that single registration produced standing authority that the portal honoured for every query afterwards without asking again, which is the authority the third route names: access carrying the right to act that is inferred from it and persists between acts. The account the attackers held was real and presented a real credential. The extraction took hours not because the attackers were evading a control but because the faulty check let them use the register one ordinary query at a time.

Driver: human with no model involved

The Government describes a targeted attack conducted at a high technical level against a complex security structure. No model is named by anyone.

Figures

Around 31,000 legal entities. Several hours of individual queries. No unlawful access attempts were registered against any other system of the national administration.

What it cost

The register came down on 30 July 2026 and was off the network for just over two months, resuming in limited form from 5 October 2026 once the identified vulnerabilities had been remedied. Access now requires attendance in person at the Giessen Service Centre with a valid passport or identity card, and comes with a reduced range of technical functions. Statutory deadlines that could not be met in the meantime remain suspended. Several other state systems were taken offline as a precaution and restored after additional security checks.

Criminal proceedings are open against persons unknown. On 6 August 2026 the Public Prosecutor's Office applied to the Court of Justice for judicial preliminary inquiries, on suspicion of illegal access to a computer system under sections 118a(1)(1) and 118a(2) of the criminal code and data theft under section 131a, following a first investigation report from the criminal police. No suspect has been named, nobody has been arrested and no charge has been laid.

Who was affected has not been published: the Office of Justice analysed the group of affected persons, and Prime Minister Brigitte Haas stated that the information is subject to confidentiality and that the Government therefore cannot say whose data was affected.

No publication and no misuse has been established. On 2 October 2026 the Government recorded that there are to date no indications the stolen data has been published. In a written answer of 2 October 2026 to a parliamentary question put on 30 September by the member Johannes Kaiser, as inside-it.ch reported it on 6 October, Haas stated that there remains no evidence of any concrete misuse of the extracted data and that the criminal investigation continues. Comparison against the backups shows that the register's own data was not modified by the attack.

Schmid's own characterisation of the faulty permission logic is that it was not a classical software vulnerability. The Government has gone to the market for an external review by one of the large globally active audit firms, covering a review of the incident itself, an audit of further security-relevant systems holding sensitive data, and how its systems are procured, managed and administered. No firm has been named or commissioned. In her written answer to Kaiser, Haas said the procurement for the external review was under way, that the work would begin as soon as the award procedure was concluded, and that the Government expects results in the first half of 2027.

No cost figure, no fine, no data protection enforcement, no resignation and no claim has been published.

What this establishes

The accounts say different things: the written release of 4 August records that a first indication of a possible entry point had been identified and does not name the entry point. Schmid described the entry point at the press conference of the same day, appearing alongside the Prime Minister, the Minister of Justice and the head of the Office of Justice, and stated it as preliminary. On 19 August Schmid gave the cause as faulty logic in the check of permissions, and the routes rest on the press conference and on that finding together.

The Government's description of a targeted attack conducted at a high technical level against a complex security structure is not borne out by its own findings, which describe an access the portal issued on request and a faulty check that let the register be read one ordinary query at a time. Nothing raised an alarm, and the Government has said that the reason remains under investigation. A person noticed; no system did, and inside the authentication and authorisation model there was nothing for a system to notice.

Primary source

Government of Liechtenstein, "Krimineller Angriff auf das VwbP: Potenzielles Einfallstor identifiziert", https://www.regierung.li/medienportal-medium/16182/234671/medienmitteilung, 4 August 2026, in German, read 27 September 2026, for the data fields, the absence of address, telephone and financial data, the targeted-attack characterisation and the criminal complaint; and the Government's dedicated information page, https://www.regierung.li/text/16188/topics, read 27 September 2026, for the night of 29 to 30 July, the around 31,000 legal entities, and the irregularities noticed on 30 July. Publisher: Government of Liechtenstein. A second address on the same host, /medienportal-medium/16444/234675/medienmitteilung, does not return the 4 August release. Government of Liechtenstein, "Cyberattack on the VwbP: latest information", https://www.regierung.li/text/16188/topics, undated, its latest news item dated 2 October 2026, read 30 October 2026, for its statement, under "Which and how many legal entities are affected?", that the around 31,000 legal entities affected include entities that had already been deleted.

Secondary, and the source of the entry-point finding

Schweizer Radio und Fernsehen, "Wirtschaftsdaten geklaut - Liechtenstein identifiziert mögliches Einfallstor für Hack", https://www.srf.ch/news/international/wirtschaftsdaten-geklaut-liechtenstein-identifiziert-moegliches-einfallstor-fuer-hack, 4 August 2026, read 27 September 2026, in which Fabian Schmid, head of the Office of Information Technology, states as a preliminary finding that the entry point was the portal for entering records into the register, that the perpetrators created themselves an access to it, and that 31,000 entries were reached in individual queries over several hours on the night of 30 July; and Liechtensteiner Vaterland, "Neue Details zum Cyberangriff", https://www.vaterland.li/liechtenstein/politik/neue-details-zum-cyberangriff-hacker-schleusten-stundenlang-datensatz-um-datensatz-aus-dem-system-art-749313, 5 August 2026, whose body is paywalled and whose standfirst is carried, read 27 September 2026.

For the background and the cost: Liechtenstein Office of Justice, Handelsregister statistics, https://www.llv.li/serviceportal2/amtsstellen/amt-fuer-justiz/handelsregister/pdf-allgemein/handelsregister-statistik.pdf, read 30 October 2026; Government of Liechtenstein, "Unberechtigter Zugriff von Dritten auf Verzeichnisdaten", https://www.regierung.li/medienportal-medium/16182/234653/medienmitteilung, 2 August 2026, read 30 October 2026; Government of Liechtenstein, "Cyberangriff auf das VwbP: Aktuelle Informationen", https://regierung.li/thema/17104/vwbp, read 30 October 2026; Stiftungs- und Treuhandaufsichtsbehörde (STIFTA), "Zahlen & Fakten", https://www.stifta.li/de/standort-liechtenstein/zahlen-fakten, read 30 October 2026; Government of Liechtenstein, https://www.regierung.li/medienportal-medium/16444/234948/0/medienmitteilung, 2 October 2026, read 30 October 2026; Government of Liechtenstein, https://regierung.li/medienportal-medium/16444/234721/0/medienmitteilung, read 30 October 2026; inside-it.ch, https://www.inside-it.ch/liechtenstein-will-nach-cyberangriff-luecken-geschlossen-haben-20261006, read 30 October 2026; Government of Liechtenstein, "Nach Cyberangriff: Zusätzliche externe IT-Prüfung", https://regierung.li/medienportal-medium/16182/234820/0/medienmitteilung, 31 August 2026, read 30 October 2026; Government of Liechtenstein, "Nach Cyberangriff: Sicherheitsanalysen abgeschlossen", https://regierung.li/medienportal-medium/16182/234753/0/medienmitteilung, 19 August 2026, read 30 October 2026; Landtag des Fürstentums Liechtenstein, Kleine Anfrage of Johannes Kaiser, "Cyberangriff - Stand der Aufarbeitung", 30 September 2026, answered by Brigitte Haas on 2 October 2026, https://www.landtag.li/printkleineanfrage/30529/.

25. ChainDrop, the npm worm

Target

The npm registry and the maintainers and consumers of hundreds of packages. A public software registry and the developer estates downstream of it.

Against what background

The npm registry served 300,290,143,710 package downloads in the week of 22 to 28 October 2026, on its own public interface. In that week, keyv, the first carrier in this campaign, served 217,595,283 downloads on its own.

Dates

On 4 August 2026 the first carrier, keyv@6.0.0, was published through trusted publishing at 09:35:00 UTC, with the automated propagation running from 09:38 to 13:20 UTC. Microsoft Threat Intelligence published the same day. Unit 42 published on 6 August 2026.

What was reached

Maintainer accounts, then the projects' own release workflows, then the credentials held by continuous integration, the automated build and publish machinery a project runs on every change, in estates that installed a poisoned package. Having taken credentials, the worm wrote itself into the configuration files of the developer's own tooling, the settings and setup files of an AI coding assistant and of a widely used editor, so that future activity by that assistant or that editor would restart the payload even after the package that delivered it had been removed. No re-authentication is required and none is sought.

Routes: one, four and five
  • One, taken. Maintainer credentials taken, then registry tokens, then continuous-integration secrets.
  • Four, obeyed. The configuration file has become what the tool obeys: a thing that persists, that the tool trusts by construction, and that nobody thinks of as a credential because it does not look like one.
  • Five, believed. The first packages carried valid provenance attestations, and several accounts described the provenance as forged. It was not forged. The maintainer's account was taken, poisoned commits went into the real repository, and that repository's own release workflow built and signed them. The attestation is true: it records that the archive was built in that repository by that workflow, which is what happened. The registry served two signed bundles for the malicious version: a build provenance statement naming the repository, the workflow, the release tag and the attacker's own commit, and a registry publish attestation, which is the control separating who built a package from who published it. Both statements are true. Neither says anybody decided the package should ship.
Driver: human with no model involved

ChainDrop is a variant in the Miasma and Mini Shai-Hulud lineage released by TeamPCP. The worm is code; no model operated it.

Figures

Counts differ because the campaign was still republishing itself while it was being counted. Microsoft records more than 400 packages across unrelated publishers. StepSecurity records 444 packages across 2,212 versions in under four hours, split into eleven carriers published through the registry's trusted publishing with valid attestations, then 433 packages across 2,201 versions republished with harvested registry tokens, a method that mints no attestation at all. Other trackers put the total higher still.

What it cost

Unit 42 identified 453 public GitHub repositories across five accounts matching the worm's exfiltration patterns, all of which had been removed by the time it published, and it cautions that the count might be only a starting point. It observed ChainDrop executing in ten distinct environments and witnessed network traffic to victim environments after the new command-and-control domain went live.

It confirms no victim organisation: the five accounts are candidate victim accounts and not confirmed ones, in Unit 42's own words. It confirms a single observed credential capture, in a developer's editor environment, where the worm ran a command to take the user's GitHub authentication credentials. It does not confirm that any stolen credential was then used for anything.

npm began unpublishing at 10:39 UTC, keyv reverted to its safe version around 11:15, and by 18:10 all eleven full carriers had been reverted. Registry-side cleanup was still running after that. The maintainer's GitHub account and the three originally compromised repositories are no longer available.

StepSecurity puts the publisher compromise at 444 packages and 2,212 versions across more than a dozen victim organisations, with credentials belonging to at least a dozen unrelated organisations used to publish the second wave. That count was current at 18:10 UTC on 4 August, in an investigation the firm had not closed, so it is a snapshot rather than a final tally. It names five npm scopes belonging to three organisations: ServiceTitan, OneReach and Qlik. For Backstage, which ran the payload inside its continuous integration, it characterises the exposure as the payload executing and reaching its command and control rather than a confirmed theft of long-lived credentials.

No confirmed misuse, no downstream breach of a named organisation, no money lost, no ransom, no regulatory action and no claim has been published, and neither npm nor GitHub has issued a statement naming ChainDrop.

What this establishes

One real project is named as having run the worm. StepSecurity scanned roughly 44,000 public workflow runs from an eight-hour window for calls to the worm's domain; fifteen matched, ten of them from one project, the Backstage developer portal, whose jobs held only per-job tokens revoked on completion, and StepSecurity found no evidence of credential loss there. The worm did not modify lockfiles, and Unit 42 draws the consequence out rather than offering it as comfort: because a lockfile retains the compromised version, a machine that installed the package during the compromise does not receive the fix when the registry's latest tag is corrected, and it remains vulnerable until an administrator clears the lockfile and fetches the updated release. The most commonly given piece of supply-chain advice, pin your dependencies, is what prolonged the exposure.

The worm also carries a routine to mint provenance for itself, exchanging an identity token at the registry's trusted-publishing endpoint for a genuine publish credential with no stolen token required, then signing its own statement into the transparency log, which is the public append-only record that is supposed to make a package's origin checkable. Unit 42 states the limit: it did not observe that path execute, and the path can run only inside one named repository's workflow. It records the path as fully implemented and reachable.

The worm resolved its command-and-control address from a smart contract, which is a program stored on a public blockchain, so that rotating the address was a silent state write rather than an update to deployed malware. A public chain with no operator is operable by anyone, including a criminal.

Primary sources

Microsoft Threat Intelligence, "ChainDrop supply chain compromise: Anatomy of a self-propagating worm", https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm, 4 August 2026. Unit 42, "ChainDrop: Inside a Self-Propagating npm Worm", https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis, 6 August 2026, fetched and read in full 16 August 2026. The artefact itself rather than reporting about it: the npm registry attestations API for keyv@6.0.0, https://registry.npmjs.org/-/npm/v1/attestations/keyv@6.0.0, fetched and both bundles decoded 16 August 2026, at Rekor log indexes 2339720712 and 2339728123 under a Fulcio certificate valid for ten minutes on 4 August 2026. The malicious version was withdrawn from the registry; on 16 August the attestations were still served, and on 27 September 2026 the attestations endpoint returned not found and the registry no longer listed the version, which is the withdrawal completing rather than a change to the finding. StepSecurity's analysis, "ChainDrop npm Worm", https://www.stepsecurity.io/blog/chaindrop-npm-worm, 4 August 2026, read 27 September 2026, is the source for the 444 packages across 2,212 versions, the eleven trusted-publishing carriers, the 433 republished packages, the 09:35 first publish and the sweep of some 44,000 workflow runs that found the Backstage project running the worm with no evidence of credential loss.

For the background and the cost: npm registry, public downloads API, https://api.npmjs.org/downloads/point/last-week and https://api.npmjs.org/downloads/point/last-week/keyv, read 30 October 2026.

26. Meta, a model breach through Irregular

Target

An unnamed third-party company reached during Meta's cybersecurity testing. The kind of organisation is not established.

Against what background

Nobody publishes the denominator for this: no authoritative body counts how many third-party frontier-model cyber evaluations are conducted, how many external engagements the laboratories commission, or how many of those reach a live third party. The broadest published count of its kind is the OECD's AI Incidents and Hazards Monitor at about 18,579 incidents and hazards, which counts AI incidents of every description, carries no stated period, and is a weak comparison offered as one.

Dates

Irregular began the evaluation in early July 2026, on Meta's own account. Meta's statement was carried on 5 and 6 August 2026, just before OpenAI's capability statement of 7 August and inside the sequence of laboratory disclosures that August, and Meta published its retrospective on 14 August 2026.

What was reached

A real website. In Meta's retrospective of 14 August, "a misconfiguration allowed the model to access the open internet" during the evaluation run by Irregular, an independent testing company Meta uses, and the model "identified and exploited a security vulnerability in the real website". It "accessed certain information from the website and made changes to the website's database", so this was not read-only access.

Route: not established

Meta does not name the vulnerability, so its account does not establish whether any check ran at entry or what it proved, and this register does not infer a route from the pattern of the neighbouring entries. Meta's own word is a vulnerability, which points at a flaw rather than a credential. The entry is in for what was reached: a frontier model in an evaluation changed the database of a real company's website.

Driver: frontier model, Meta's Muse Spark 1.1

Meta's retrospective names the model as "an earlier generation of our large language model, Muse Spark 1.1", which is the identification The Information reported and Reuters carried.

Figures

None for the website. Meta "reviewed over 10,000 records of Muse Spark 1.1's activity during testing", which counts what Meta read about its own model and nothing the website lost.

What it cost

Meta's retrospective is the record, and it says least about the party that was harmed. It does not name the website, say what information left it, say what was changed in its database or say whether the changes were reversed. It says Meta "ensured that the affected party was also notified" and is "taking steps to ensure that their data is not on our systems", that Irregular "has confirmed the misconfiguration has been corrected and that evaluations do not reference real website names", and that Meta is "implementing independent verification requirements for test environment isolation". No cost, regulatory action or claim has been published.

What this establishes

Irregular said that the incident was the same evaluation-environment issue already disclosed by Anthropic the week before, that it did not involve a sandbox escape or a sophisticated cyber action, and that there were no current open issues. Two things the firm declined to say belong beside the three it said: it would not say whether other clients had been affected, and it would not clarify whether the absence of current open issues referred to misconfigurations, to model behaviours, or to both. Meta's retrospective goes further than Irregular would: "Several other companies' AI models were being evaluated by Irregular around the same time and exhibited similar behavior."

Taken with entries 5, 6, 7 and 23, the disclosures describe one evaluation vendor, three frontier laboratories and at least five third-party estates reached across roughly four months.

Primary source

Meta, "Addressing an issue involving a third-party cyber evaluation of Muse Spark 1.1", https://research.meta.ai/blog/addressing-third-party-testing-misconfiguration-muse-spark-1-1, 14 August 2026, read 30 October 2026. Meta's earlier spokesperson statement, carried verbatim by CBS/AP, "Meta says its AI model breached a third-party company during testing", https://www.cbsnews.com/news/meta-says-ai-model-breached-third-party-company/, 5 August 2026, read 27 September 2026, which also carries the Muse Spark 1.1 identification attributed to The Information via Reuters and Meta's promise of a full retrospective. Irregular's statement that this was the same evaluation-environment issue disclosed by Anthropic the week before is carried by UPI, "Meta says its AI hacked another company during cybersecurity test", https://www.upi.com/Top_News/US/2026/08/06/meta-ai-model-hacks-irregular-anthropic-openai/9851786031275/, 6 August 2026, read 27 September 2026; the further Irregular statements that there was no sandbox escape and no current open issues, and its refusals to say whether other clients were affected, are carried through The Hill and Reuters, those pages having refused automated access on 27 September 2026. Publisher of the underlying claim: Meta, in its own retrospective.

For the background and the cost: OECD, via OECD.AI, "AI Incidents and Hazards Monitor", https://www.oecd.ai/en/incidents, read 30 October 2026; Infosecurity Magazine, https://www.infosecurity-magazine.com/news/meta-ai-exploit-incident/, read 30 October 2026.

27. Moonshot AI, Kimi K3 leaving the sandbox

Target

A cybersecurity testing sandbox run by Frontier Security, a United States firm, during an evaluation of Kimi K3. Frontier Security records that frameworks of this kind, including the UK AI Security Institute's Inspect and Stanford's Cybench, rely on such sandboxes to measure agentic capabilities.

Against what background

The benchmark named here is a fixed and published quantity: Cybench consists of forty cybersecurity tasks drawn from four capture-the-flag competitions, introduced in a paper of August 2024 with eight leading language models benchmarked against it. Separately, the UK AI Security Institute and the United States Center for AI Standards and Innovation published a joint assessment of this model, running an exploitation benchmark of forty-one tasks and a thirty-two-step simulated corporate network attack over ten attempts.

Dates

Published by WIRED on 6 to 7 August 2026 and carried by Bloomberg, TechCrunch, Engadget and Reuters, with Frontier Security's own account updated 8 August 2026.

What was reached

The sandbox's own permission to reach GitHub, set in an allowlist intended for package maintenance, and with it a live service outside the sandbox. Frontier Security records that agents of this kind routinely inspect their shell environment on startup with commands such as whoami, ifconfig, ping and curl, and that this agent used standard command-line utilities such as git clone and curl to pull reference solutions and ground-truth datasets. It read the answers rather than solving the tasks it had been set.

Route: five, on a permission set for another purpose

The sandbox checked where each request was going and let through what went to GitHub, so the check established what it was built to establish, that the destination was on the list, and never that anybody had sent the model there for the answers. The permission was set once, stayed on file and was honoured for anything running inside the sandbox, which is how Section 18 describes a credential: a direct debit on the holder's authority, with what is taken afterwards settled by somebody else. Kimi K3 attacked nobody; it used the authority Frontier Security had set for one purpose to take what it wanted for another.

Driver: open-weight model

Kimi K3. Frontier Security records that here the models are open and publicly available, and the version that escaped is the version anyone can download and run. A model whose weights are public cannot be recalled, cannot be quietly patched, cannot have its account closed, and cannot be brought inside a pre-release testing regime after the fact.

Figures

None published.

What it cost

Almost nothing, and what exists is a recommendation rather than a consequence. Frontier Security states the effect on measurement rather than on any party: high pass rates reflect environment flaws rather than genuine reasoning or cybersecurity capabilities, and other models given bash access are likely doing the same. Its recommendation is that evaluators revalidate suspicious results across models. Its one statement of risk is conditional, that the models being publicly available to adversarial actors makes the incident potentially more harmful.

No benchmark results were withdrawn, no runs were discarded, no re-run or retraction was announced, no harm was identified, and nothing has been published on whether the misconfiguration was fixed. TechCrunch carries no statement from Moonshot AI and none from the Institute. The Institute did answer WIRED, in the words eSecurity Planet reported on 10 August: "These claims are inaccurate and irresponsible," and "Users are responsible for configuring the tool to suit their needs, and we have published detailed guidance on how to do so."

Frontier Security also corrected itself, two days after publishing. Its blog index dates the post 6 August 2026, and its update of 8 August 2026 clarifies that the sandbox was not unrestricted after all, and that "an allowlist intended for package maintenance included GitHub", the code-hosting service the model reached.

The joint assessment by the Institute and the Center for AI Standards and Innovation, published on 23 July 2026 and updated on 28 August 2026, says nothing about a sandbox escape, contamination or cheating, and neither body has withdrawn or revalidated any result. Its stated caveats are the ordinary ones about preliminary evaluations on a small set of benchmarks.

What this establishes

Frontier Security concludes that if a network path to the solution exists, a sufficiently capable agent will find it. More broadly, it concludes that some of the evaluations on cybersecurity the community uses are susceptible to security vulnerabilities and allow models to cheat, and that there are models that intentionally seek loopholes. Its own update of 8 August puts the path out in an allowlist of the sandbox it ran, so the flaw it reports in the community's evaluations was very likely a flaw in its own configuration, which is the Institute's answer: users are responsible for configuring the tool.

Entry 16 carries the same behaviour, and Hugging Face's own reconstruction is that the agent went after the benchmark's stored test solutions rather than the task it had been set. Two agents, two laboratories, two continents, disclosed weeks apart, and both of them went for the answers without being instructed to.

Primary source

Paul Kassianik and Yaron Singer, Frontier Security, "Chinese model Kimi K3 breaks UK AI Safety Institute benchmark evaluations", https://blog.frontier.security/chinese-model-kimi-k3-breaks-uk-ai-safety-institute-benchmark-evaluations/, updated 8 August 2026, read 27 September 2026. Publisher: Frontier Security, the firm that ran the sandbox. Read again 30 October 2026: the post prints no publication date of its own, only "Update (August 8, 2026)". Frontier Security, blog index, https://blog.frontier.security/, which lists the post under "August 6, 2026", read 30 October 2026, for the date the post was published.

Secondary

Will Knight, WIRED, "Moonshot's Kimi K3 escaped its sandbox", https://www.wired.com/story/moonshot-kimi-k3-ai-model-escape-sandbox, 6 to 7 August 2026, which broke the story and whose page was blocked to automated access on 27 September 2026; Mariella Moon, Engadget, "Chinese AI model Moonshot Kimi K3 also escaped its testing environment", https://www.engadget.com/2232256/chinese-ai-kimi-k3-also-escaped-containment/, 7 August 2026, read 27 September 2026.

Liz Ticong, eSecurity Planet, "Kimi K3 Reached GitHub During Cybersecurity Test, Exposing Sandbox Gap", https://www.esecurityplanet.com/artificial-intelligence/news-kimi-k3-github-sandbox-security-test/, 10 August 2026, read 30 October 2026, for the Institute's statement to WIRED, whose own page refuses automated retrieval.

Hugo Larcher, Adrien Carreira, raphael g and Christophe Rannou, Hugging Face, "Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident", https://huggingface.co/blog/agent-intrusion-technical-timeline, 27 July 2026, read 30 October 2026, for the comparison with entry 16: the agent "inferred that Hugging Face may host that benchmark's models, datasets, and reference solutions", and Hugging Face reads what followed as "an attempt to cheat the evaluation: reach our production systems and steal the test solutions".

For the background and the cost: Stanford Center for Research on Foundation Models, https://crfm.stanford.edu/2024/08/19/cybench.html, 19 August 2024, read 30 October 2026; UK AI Security Institute, https://www.aisi.gov.uk/blog/preliminary-assessment-of-kimi-k3s-cyber-capabilities, 23 July 2026, read 30 October 2026; TechCrunch, "Chinese AI model Kimi escaped its cybersecurity testing environment, researchers say", https://techcrunch.com/2026/08/07/chinese-ai-model-kimi-escaped-its-cybersecurity-testing-environment-researchers-say/, 7 August 2026, read 30 October 2026; National Institute of Standards and Technology, Center for AI Standards and Innovation, "UK AISI / CAISI Preliminary Assessment of Kimi K3's Cyber Capabilities", https://www.nist.gov/news-events/news/2026/07/uk-aisi-caisi-preliminary-assessment-kimi-k3s-cyber-capabilities, released 23 July 2026, updated 28 August 2026, read 30 October 2026.

28. Two tankers

Target

Two tankers, one of them named in reporting as the VL Prosperity, a 333-metre vessel able to hold over two million barrels of oil, inbound towards the United States coast. Commercial shipping, and by consequence energy infrastructure.

Against what background

The United States Government Accountability Office determined that the Coast Guard's data were not sufficiently reliable for the purpose of describing the number of reported cybersecurity incidents affecting the marine transportation system, covering July 2019 to May 2024, and found the facility and vessel inspection data for 2019 to June 2024 likely not complete for the purposes of its review. The same report gives the system's size: approximately 360 commercial sea and river ports. The Coast Guard's own 2025 marine cyber trends report, released in June 2026, shows a 17% year-on-year rise in reported maritime cyber incidents, according to SecureWorld and SAFETY4SEA, neither of which gives a count of the incidents themselves. A figure of operational technology in 62% of missions, against 46% in 2024, circulates from one trade outlet's reading of that report; the Coast Guard's own write-up of the same report gives a different operational-technology statistic, a 35% rise in demand for its testing services, so this register does not treat the 62% as the agency's published figure.

Dates

A joint Coast Guard and Federal Bureau of Investigation team boarded the first vessel on 21 August 2026 and the second on 24 August 2026. The boardings were publicly reported from 16 September 2026. Iran's Mehr News Agency reported on 20 August that VL Prosperity had been attacked on 7 August while transiting the Strait of Gibraltar.

What is established, in the agencies' own words

The two agencies gave a joint statement to reporters rather than publishing it, and the outlets that received it quote it identically. The boardings "were designed to ensure integrity of the vessel's operational and information technology systems following indications that the networks of both vessels were compromised," and "Currently, there are no reports of operational disruptions, vessel instability, physical danger to crews, or environmental impacts." A Coast Guard spokesperson gave the composition of the 21 August boarding party: "USCG Law Enforcement personnel, USCG Cyber Protection Team members, a vessel inspector, and FBI Cyber Action Team operators." Other agencies referred The Record to the Coast Guard, which told it that officials boarded the ship "following indications that the vessel's network were compromised by foreign cyber actors", and which did not respond to its questions about who was potentially behind the attack. Rear Admiral Amy Grable, commander of Coast Guard Cyber Command, told CBS News that investigators did find evidence of a malicious cyber actor. So what the United States has said is that the networks of two inbound tankers were compromised, the first of them by foreign cyber actors in the Coast Guard's words, that investigators found evidence of a malicious cyber actor, that it put a joint law-enforcement and military cyber team aboard each of them, and that nothing was reported to have gone wrong with either ship.

What is claimed, and by whom, because the difference between the two is this entry

The account in wide circulation, that the attackers took control of navigation, propulsion and cargo systems, interfered with speed and fuel, and left a vessel without communications for roughly thirty hours, is not in the statement the agencies gave. It originates with Mehr News Agency, which is Iranian state media, and it reaches English through SecurityWeek and CBS News, each of which attributes it to Mehr. Bloomberg, in its report of 2 October 2026, has officials familiar with the investigation finding that hackers gained access to a propulsion-related system, and not that they controlled it. The two accounts have never appeared together in any government text, and a reader who takes the control version from a security publication is taking Tehran's account of an attack on shipping bound for the United States.

Route: not established

No source states how either vessel was entered, and this record does not infer a route from the class of target.

Driver: not established by the source

CBS reports that the United States is looking into whether Iran is behind it; the Coast Guard has not publicly linked the incident to Iran. No model is named and no source states whether one was involved.

Why the entry stands

Authority was very likely reached inside the networks of both ships, and aboard VL Prosperity the intruders reached a propulsion-related system. The agencies boarded on indications that the networks of both had been compromised, by foreign cyber actors in the Coast Guard's words; Grable says investigators found evidence of a malicious cyber actor; and officials told Bloomberg that hackers gained access to that system. The answer was a law-enforcement and military cyber team aboard each ship, sent to ensure the integrity of its operational and information technology systems, which is the question that arises when somebody else may have been able to change them. How far the intruders could act aboard, and whether they controlled anything, nobody has established, and the entry does not stand on it. The boarding also produced one figure that carries further than the ships do: Grable told CBS News this was one of roughly forty to fifty missions the Coast Guard's Cyber Protection Team has carried out in the past year. Two compromised tankers are an anecdote. Forty to fifty Cyber Protection Team missions in twelve months, stated by the officer whose teams carry them out, is the condition this document describes arriving at sea.

Figures

Two vessels boarded, on 21 and 24 August 2026. Roughly forty to fifty Cyber Protection Team missions across the preceding year, on Grable's own statement. No victim count, no access route and no cost has been published by any agency. A gas tanker off Italy and a figure of about twenty ships monitored globally, which circulated in earlier commentary, are carried by none of the outlets read here and are not used.

What it cost

The victim-side consequence is a stated absence, and it comes from the agencies' joint statement, which the FBI emailed to Bloomberg: there are currently no reports of operational disruptions, vessel instability, physical danger to crews, or environmental impacts.

Against that, Bloomberg reported on 2 October 2026, citing unnamed United States officials familiar with the investigation, that hackers gained access to a propulsion-related system of VL Prosperity as it approached the Texas coast, temporary access to a digital system on the ship. It was not immediately clear how long the hackers had that access or what they could have controlled aboard. Bloomberg has the boarding in late August, after the vessel lost communications, and the FBI and the Coast Guard said they boarded after indications that the networks of both vessels were compromised. VL Prosperity was fully laden, bound for Galveston, and still anchored offshore at the date of the report. HMM Ocean Service, the manager, confirmed that the Coast Guard had boarded, said the Coast Guard had cleared the tanker for normal operations, and said it was awaiting a final investigation report from the United States authorities.

Bloomberg reports that officials are still examining how the breach occurred and who was responsible. The attackers have not been identified, and the United States has not attributed the attack to a specific actor.

No agency has named the second vessel. Dragos, the industrial security firm, names it in its analysis of 24 September as the Kohaku, a 227-metre liquefied petroleum gas tanker boarded in the Gulf of Mexico on 24 August, three days after VL Prosperity. What was found aboard it has not been published. No cargo loss, delay cost, injury, remediation cost, insurance claim, prosecution or sanction has been published for either ship.

The Coast Guard declined to comment to Bloomberg, and the FBI went no further than the agencies' joint statement.

Primary source

Not obtained, and its absence is established by search rather than assumed. No page at fbi.gov, uscg.mil, news.uscg.mil, dco.uscg.mil, cgmix.uscg.mil, dhs.gov or the Maritime Administration's Coast Guard pages carries the joint statement, searched on 8 October 2026 for the vessel's name, for the phrase "joint offshore security boardings" and for the compromise sentence itself. Nor did a cyber-related maritime security directive or bulletin follow the boardings: the national bulletin posted on 31 August 2026, MSIB 05-26, is "Maritime Security Program (MSP) Select Eligibility". The statement exists only as language the agencies gave to reporters, which is a fact about the statement and not a defect in the quotation.

Secondary

Zack Whittaker, TechCrunch, "FBI, Coast Guard boarded hacked oil tankers heading toward US coast", https://techcrunch.com/2026/09/18/fbi-coast-guard-boarded-hacked-oil-tankers-heading-towards-us-coast/, 18 September 2026, read 27 September 2026, which records that the statement was shared with it, carries both quoted sentences, and does not name the vessels. Eduard Kovacs, SecurityWeek, "Cyberattacks on Two Oil Tankers Prompt Coast Guard, FBI to Board Vessels", https://www.securityweek.com/cyberattacks-on-two-oil-tankers-prompt-coast-guard-fbi-to-board-vessels/, 17 September 2026, read 27 September 2026, which carries the Mehr attribution and Grable's forty-to-fifty figure. Tim Starks, CyberScoop, "Coast Guard, FBI board US-bound foreign ships in order to probe for cyberattacks", https://cyberscoop.com/coast-guard-fbi-investigate-tanker-cyberattacks/, 16 September 2026, read 30 October 2026, which quotes the agencies' joint statement in the same words and dates the boardings 21 and 24 August. Jonathan Greig, The Record, "Coast Guard, FBI boarded tanker after attack by 'foreign cyber actors'", https://therecord.media/oil-tanker-cyberattack-coast-guard-fbi, 16 September 2026, read 30 October 2026, which carries the Coast Guard spokesperson on the boarding party and the Coast Guard's statement that the vessel's network was compromised by foreign cyber actors. Jake Bleiberg and Ruth Liao, Bloomberg, "Hackers Breached Propulsion System of US-Bound Oil Tanker", https://news.bgov.com/privacy-and-data-security/hackers-breached-propulsion-system-of-us-bound-oil-tanker, 2 October 2026, read 30 October 2026 as far as its paywall allows, for officials "still examining how the breach occurred and who was responsible"; gCaptain carries the same Bloomberg report under the same title, https://gcaptain.com/hackers-breached-propulsion-system-of-us-bound-oil-tanker/, 5 October 2026, read 30 October 2026, for the hackers' access to a propulsion-related system, their temporary access to a digital system on the ship, the laden passage to Galveston and "The Prosperity remains anchored offshore Galveston". Nicole Sganga, CBS News, "Coast Guard and FBI boarded 2 energy tankers due to cyberattacks. How big is the risk?", https://www.cbsnews.com/news/coast-guard-fbi-boarded-energy-tankers-cyberattacks-amy-grable-iran/, updated 16 September 2026, which carries Grable's rank and command, her statement that investigators found evidence of a malicious cyber actor, the forty to fifty missions, and Mehr's report of 20 August.

Liz Martin, Dragos, "VL Prosperity: What MTSA Cybersecurity Already Requires", https://www.dragos.com/blog/vl-prosperity-mtsa-maritime-cybersecurity, 24 September 2026, read 30 October 2026.

For the background and the cost: US Government Accountability Office, GAO-25-107244, https://files.gao.gov/reports/GAO-25-107244/index.html, 11 February 2025, read 30 October 2026; United States Coast Guard, Maritime Commons, "Cyber Command Releases Fifth Annual Cyber Trends and Insights in the Marine Environment (CTIME) Report", https://www.news.uscg.mil/maritime-commons/Article/4518729/cyber-command-releases-fifth-annual-cyber-trends-and-insights-in-the-marine-env/, 16 June 2026, read 30 October 2026; United States Coast Guard, MyCG, "High-tech boardings and old-school threats: Inside the 2025 CTIME report", https://www.mycg.uscg.mil/News/Article/4515752/high-tech-boardings-and-old-school-threats-inside-the-2025-ctime-report/, 15 June 2026, read 30 October 2026; SecureWorld, https://www.secureworld.io/industry-news/coast-guard-cyber-report, 19 June 2026, read 30 October 2026; SAFETY4SEA, https://safety4sea.com/uscg-maritime-cyber-incidents-rise-17-as-phishing-ai-and-ot-risks-reshape-the-threat-landscape/, 8 July 2026, read 30 October 2026; Baird Maritime, https://www.bairdmaritime.com/security/incidents/piracy/vl-prosperity-hackers-access-propulsion, read 30 October 2026; Insurance Journal, https://www.insurancejournal.com/news/national/2026/10/05/887853.htm, read 30 October 2026; Nicole Sganga, CBS News, "Coast Guard, FBI boarded Texas-bound oil tanker after ship's network was potentially breached", https://www.cbsnews.com/news/coast-guard-fbi-board-oil-tanker-texas/, updated 16 September 2026, read 30 October 2026; Ruth Liao, Charles Gorrivan and Weilun Soon, Bloomberg, carried by gCaptain, "US Coast Guard and FBI Conduct Cyberattack Probes on Tankers", https://gcaptain.com/us-coast-guard-and-fbi-conduct-cyberattack-probes-on-tankers/, 16 September 2026, read 30 October 2026.

29. Dropbox, through Lenovo ID

Target

Dropbox, a file storage and sharing platform, and the accounts of its users. The flaw was in Lenovo's identity platform, a hardware manufacturer's consumer identity service.

Against what background

Dropbox reports more than 700 million registered users across approximately 180 countries, and 18.19 million paying users at 30 June 2026, the nearest reported quarter to this intrusion, against 18.09 million at 31 March. The roughly 5,000 breached accounts are not stated to be paying ones, so the 700 million is the denominator that fits them.

Dates

The intrusion window ran 4 to 21 August 2026, seventeen days. Dropbox's notice reached affected users on Monday 31 August 2026, and Reuters reported Dropbox's confirmation on 1 September 2026, after Bloomberg News had reported the hack earlier the same day.

What was reached

User files. Dropbox's own explanation, as BleepingComputer reproduces it, is that an issue with Lenovo's email verification process allowed an unauthorised party to register a Lenovo ID using a victim's email address and then use that Lenovo ID to log into the Dropbox account associated with that email address. BleepingComputer's reading, carried as its reporting rather than as Dropbox's words, is that Dropbox's identity-linking process trusted Lenovo's assertion that the attacker controlled the email address without requiring confirmation through the existing Dropbox login method. The unauthorised party viewed and downloaded content from some users.

Route: two

Lenovo's identity platform issued a valid credential to the attacker. No credential was stolen and no password was needed. A registration that nobody verified produced an identity that Dropbox honoured perfectly.

Driver: human with no model involved

Dropbox's notice describes a Lenovo ID registered on a victim's email address and used to sign in, and names no model.

Figures

Approximately 5,000 Dropbox accounts. Seventeen days between first and last unauthorised access.

What it cost

Files were taken from a minority of the affected accounts. A Dropbox spokesperson said that less than a third of the roughly 5,000 affected accounts had files viewed or downloaded, and the company's figure relayed to reporters was that files were downloaded from around 1,500 of them. The notice BleepingComputer reproduces told its recipient that the logs showed no evidence that the recipient's files were viewed or downloaded. The two are consistent: most recipients were in the majority whose files were never touched.

Dropbox emailed all affected users directly, expired every session authenticated through a Lenovo ID, and required the Dropbox password for any sign-in through one. Reuters reports that Dropbox has also removed any links between Lenovo IDs and Dropbox accounts. The accounts reached were those connected through a Lenovo ID and without Dropbox's own second factor enabled.

Lenovo states that the issue could be used to improperly authenticate certain Dropbox accounts, that it arose from a legacy integration between Lenovo ID and Dropbox, that the two companies worked together to mitigate the risk promptly, that Lenovo's own customers were not affected, and that its investigation is ongoing.

Dropbox told Reuters it had reported the incident to data protection regulators, without naming them. No enforcement, no claim, no compensation, no cost figure, no confirmed misuse of anything downloaded and no resignation has been published. BleepingComputer records that it asked Dropbox for more and had no answer by the time it published.

What this establishes

At entry 24 a register created an account for the party using it; here an identity provider, Lenovo, created one and the relying party, Dropbox, accepted the assertion without a second check of its own. This entry and entry 24 are the same failure in different settings.

Primary source

Dropbox's own customer notification, as quoted. Obtained through reporting rather than from Dropbox's own published page, which has not been located.

Secondary

Bill Toulas, BleepingComputer, "Dropbox accounts breached through Lenovo email verification flaw", https://www.bleepingcomputer.com/news/security/dropbox-accounts-breached-through-lenovo-email-verification-flaw/, 2 September 2026, read 27 September 2026, carrying the Dropbox notification and the Reuters figure of approximately 5,000 accounts.

Reuters, carried by The Star, "Dropbox says about 5,000 accounts compromised in August hack", https://www.thestar.com.my/tech/tech-news/2026/09/02/dropbox-says-about-5000-accounts-compromised-in-august-hack, 1 September 2026, read 30 October 2026.

For the background and the cost: Dropbox, Inc., "Dropbox Announces Second Quarter 2026 Results", https://investors.dropbox.com/node/14156/pdf, 6 August 2026, read 30 October 2026; Dropbox, Inc., "Dropbox Announces First Quarter 2026 Results", https://www.sec.gov/Archives/edgar/data/1467623/000146762326000027/q12026er-exhibit991q1only.htm, 7 May 2026, read 30 October 2026; Decrypt, "Dropbox Security Breach: Hackers Access Accounts Through Authentication Flaw", https://decrypt.co/377099/dropbox-security-breach, 1 September 2026, read 30 October 2026; 9to5Mac, "Dropbox breach seemingly caused by egregious authentication failure [U]", https://9to5mac.com/2026/09/02/dropbox-login-breach-seemingly-caused-by-egregious-authentication-failure/, 2 September 2026, read 30 October 2026; The Next Web, https://thenextweb.com/news/dropbox-lenovo-id-breach-5000-accounts, 2 September 2026, read 30 October 2026.

30. JFrog Artifactory, exploited in the wild

Target

Organisations running JFrog Artifactory, a binary and package repository sitting inside enterprise build pipelines. Commercial software estates.

Against what background

The Known Exploited Vulnerabilities catalogue of CISA, America's Cybersecurity and Infrastructure Security Agency, held 1,764 entries at its 29 October 2026 version, 280 of them added during 2026. Four of those 280 are JFrog Artifactory. JFrog states that it serves approximately 6,600 organisations worldwide, in the standing description on its results release rather than as a dated metric, and reported 1,225 customers above $100,000 of annual recurring revenue and 80 above $1 million at 31 March 2026.

Dates

Wiz observed multiple actors chain two of these flaws, CVE-2026-42018 and CVE-2026-42016, against self-hosted instances between 15 August and 8 September 2026, and reported on 10 September 2026. CVE-2026-42016 was published by JFrog on 27 July 2026, CVE-2026-42018 on 12 August, and CVE-2026-82329 on 28 August. CISA's catalogue records CVE-2026-82329 as added on 2 September with a three-day remediation date of 5 September and flagged for forensic triage, and the other two as added on 11 September with a date of 25 September.

What was reached

Persistent administrator accounts, malicious Groovy plugins for code execution, Rust backdoors, web shells, which are programs planted on a web server that let an intruder run commands on it, token minting through the Access application programming interface, and cluster key theft through the join-key endpoint.

Routes: two, and five

Two of the three flaws are the ones Wiz saw chained in the field; the third, CVE-2026-82329, was exploited in the wild as well, and OpenInfra Europe names it as the way into its own instance. JFrog's own descriptions are the record.

  • Two, granted. CVE-2026-42018: Artifactory could return an internal anonymous-user token to an unauthenticated caller even where anonymous access had been disabled, handing over a working credential created out of thin air rather than stolen from anybody. CVE-2026-82329 is an authentication weakness which under default configuration may allow an unauthenticated attacker with network access to obtain administrative privileges.
  • Five, believed. CVE-2026-42016 is a privilege escalation "due to a validation check of the token signature/issuer and not the token's scope". A validator examined a token, confirmed who had signed it and who had issued it, and did not ask what the token was for. A correctly signed token was therefore accepted for a purpose nobody had granted it.
Driver: human with no model involved

Wiz describes the chained flaws and the administrator accounts, plugins, backdoors and web shells that followed, and names no model and no agentic tooling.

Figures

CVE-2026-42018 CVSS 7.5. CVE-2026-42016 CVSS 8.1. CVE-2026-82329 CVSS 9.8. Wiz measured what happened next across the cloud estates it can see: 59% of organisations running Artifactory remained exposed to CVE-2026-42016 six weeks after its disclosure, exposure to CVE-2026-42018 fell from 69% to 62% over four weeks, and exposure to CVE-2026-82329 fell from 67% to 49% within two weeks of its publication, the measure in each case being the share of organisations running Artifactory with at least one vulnerable instance.

What it cost

The only consequence anyone has imposed is regulatory, and it binds America's own federal civilian agencies.

CISA placed all three in the Known Exploited Vulnerabilities catalogue with firm remediation dates for federal civilian agencies. CVE-2026-82329, improper authentication, added 2 September 2026, due 5 September, with forensic triage required. CVE-2026-42016, incorrect authorisation, added 11 September, due 25 September. CVE-2026-42018, improper authentication, added 11 September, due 25 September. A fourth Artifactory flaw, CVE-2026-66384, was added on 27 August with a due date of 10 September. The required action is worded identically on each, though only CVE-2026-82329 is flagged for forensic triage: apply the vendor's mitigations in compliance with Binding Operational Directive 26-04 and with CISA's Forensics Triage Requirements, follow the directive's guidance for cloud services, or discontinue use of the product if mitigations are unavailable. All four carry the catalogue's ransomware field as Unknown, which is its only alternative to Known and is not a finding that there was none.

Past that, Wiz confirms in-the-wild exploitation of all three across multiple environments, and records that in some instances actors moved from the first request to a created administrator account in under five minutes. It names no victim, confirms no theft of artefacts, source code or credentials from any named victim, reports no downstream supply chain compromise, no ransom and no extortion, and carries no statement from JFrog. It notes two things that outlast the patches: an attacker holding the Access private key can forge tokens, and patching does not revoke that key; and several attackers pulled the join key directly from the Artifactory security endpoint.

One victim has named itself. OpenInfra Europe, which runs the Nordix infrastructure, published a notice that an Artifactory instance it operated was compromised on 31 August through CVE-2026-82329 and the breach discovered on 15 September; it has concluded its investigation, reports "no evidence of artifacts tampered", and tells anyone who downloaded from the instance in the period of exposure to stop using what they took. No loss has been quantified, no fine or claim has been published, and JFrog has made no statement of consequence. The Canadian Centre for Cyber Security updated its advisory on 11 September to say that "Open-source reporting indicates that CVE-2026-82329 related to JFrog Artifactory is being exploited in the wild".

What this establishes

One researcher connects this entry to entry 16: Kostya Kortchinsky at OpenAI is the named finder of CVE-2026-42016 and also of CVE-2026-65616, the refresh-token flaw whose description matches the path by which OpenAI's own agents left their sandbox on 26 June. In both flaws, an authority check at the same vendor established the wrong property, and unrelated actors exploited CVE-2026-42016 in the field under three weeks after it had been fixed.

Primary source, for its own telemetry

Wiz, "Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 and CVE-2026-82329", https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201, 10 September 2026. Publisher: Wiz. Read 27 September 2026, which gives the 15 August to 8 September window, the post-exploitation set, the 59% and 69-to-62% exposure figures and the finding that 67% of organisations running Artifactory had at least one vulnerable instance. Read again 30 October 2026, with change-log entries of 11 September 2026, 3PM UTC, and 17 September 2026, 7PM UTC, for exposure to CVE-2026-82329 "dropping from 67% to 49% within two weeks of publication". Jessica Lyons, The Register, "More JFrog Artifactory bugs under attack, and all 3 have patches", https://www.theregister.com/security/2026/09/11/more-jfrog-artifactory-bugs-under-attack-and-all-3-have-patches/5295943, 11 September 2026, read 30 October 2026, which carries the 49% "according to Wiz".

Also primary

The JFrog CVE records, read at source 27 September 2026: CVE-2026-42016 (CVSS 8.1, affected before 7.133.11, credited to Kostya Kortchinsky at OpenAI), https://www.cve.org/CVERecord?id=CVE-2026-42016; CVE-2026-42018 (CVSS 7.5, credited to Daniil Vylegzhanin at NetSPI), https://www.cve.org/CVERecord?id=CVE-2026-42018; and CVE-2026-82329 (CVSS 9.8), https://www.cve.org/CVERecord?id=CVE-2026-82329. The CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog, whose page refuses automated access and whose records are read from its data file below.

OpenInfra Europe AISBL, "Security Incident Notice", https://openinfraeurope.org/, undated, read 30 October 2026. Canadian Centre for Cyber Security, "JFrog security advisory (AV26-867) - Update 2", https://cyber.gc.ca/en/alerts-advisories/jfrog-security-advisory-av26-867, 1 September 2026, updated 2 and 11 September 2026, read 30 October 2026.

For the background and the cost: CISA, Known Exploited Vulnerabilities catalogue, https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json, version 2026.10.29 released 29 October 2026, read 30 October 2026; JFrog, Q1 2026 8-K, https://www.sec.gov/Archives/edgar/data/0001800667/000119312526211940/frog-ex99_1.htm, read 30 October 2026; Cyber Trackr, Known Exploited Vulnerabilities catalogue summary, https://cyber.trackr.live/api/vulns, catalogue version 2026.10.29 released 29 October 2026, read 30 October 2026; Cyber Trackr, Known Exploited Vulnerabilities catalogue records, https://cyber.trackr.live/api/vulns/kev/CVE-2026-82329, https://cyber.trackr.live/api/vulns/kev/CVE-2026-42016, https://cyber.trackr.live/api/vulns/kev/CVE-2026-42018 and https://cyber.trackr.live/api/vulns/kev/CVE-2026-66384, undated, read 30 October 2026; CISA, "CISA Catalog of Known Exploited Vulnerabilities", JSON schema, https://github.com/cisagov/kev-data/blob/develop/known_exploited_vulnerabilities_schema.json, undated, read 30 October 2026; Pierluigi Paganini, SecurityAffairs, "U.S. CISA adds GitLab, JFrog Artifactory, and ConnectWise ScreenConnect flaws to its Known Exploited Vulnerabilities catalog", https://securityaffairs.com/199032/security/u-s-cisa-adds-gitlab-jfrog-artifactory-and-connectwise-screenconnect-flaws-to-its-known-exploited-vulnerabilities-catalog.html, 14 September 2026, read 30 October 2026.

31. Anthropic customer sessions, taken by commodity infostealers

Target

Customers of Anthropic, a frontier AI laboratory, on its own paid Claude service.

Against what background

No authority publishes a count of infostealer infections or of stolen session tokens for 2026, so there is no denominator for how common this is. What the laboratory itself publishes measures something else: 11.4 million banned accounts between January and June 2026, with appeals at 398 thousand and overturns at 42 thousand, as its Transparency Hub rounds them. That is policy enforcement at scale rather than session theft, and it is the only figure of its kind anybody has published.

Dates

Late August 2026. A notification email was sent to affected customers and reproduced publicly by BleepingComputer on 30 August 2026 and by The Register on 31 August 2026. A second customer's support correspondence was reported by TechCrunch on 8 September 2026.

What was reached

Commodity infostealer malware running on customers' own machines copied Claude sessions that were already authenticated. The actor then picked the Claude sessions out of everything else the malware had collected and used them to reach accounts and consume paid usage.

Routes: one, then three
  • Route one, taken: the session file was taken from the machine, and then used by a party it was not issued to.
  • Route three, inherited: no password was passed and no second factor was presented, because what was taken was the session the service issues after both have already succeeded.
Driver: human with no model involved

The malware families named were Vidar, Lumma, StealC, RedLine and Acreed on Windows, together with Atomic Stealer on a small number of Macs. Anthropic stated that the malware was general purpose, was not installed through Claude, and had nothing to do with anything the customer had done with Claude; its notice names no model driving the campaign.

Figures

No victim total published. For scale rather than as a figure about this incident: the single free collection at Section 10, off fewer than six thousand machines, held 561 Anthropic tokens, of which 164 were still live on the day the collection was given away.

What it cost

Anthropic signed affected users out, removed saved payment methods and refunded unauthorised charges. Its notification email tells the customer that their session was likely one of the many things the malware collected, and that signing them out stops the stolen sessions but does not remove the malware from their machine.

For the one customer who went on the record with TechCrunch, Anthropic suspended his paid account, invalidated all of his sessions and his server-side tokens, and locked him out for about two weeks, which he said hurt his business. It issued him a partial refund of £44.49 for the remaining time on his $200-a-month subscription. It told him a compromised session key had been used to mint unauthorised tokens and that it could not determine how the attacker had got access. Asked how users could identify misuse, it declined to comment.

Anthropic's own threat intelligence report of 10 September 2026 covers this class of activity in the same period. It describes fake AI-provider sites running credential harvesters that would gather all of the victim's credentials and authenticated session tokens on their device. Of one tracked actor it records the theft of Anthropic account credentials and their onward sale to other AI proxy resellers. Of another it records that the keys involved were customers' keys stolen from customers' environments, and that the actor never compromised Anthropic's own systems. The report does not say those are these thefts, and this register does not join them.

No victim total, no aggregate refund figure and no regulatory action has been published.

What this establishes

Anthropic has published nothing on this campaign: not on its status pages, not in its help centre, not on its news index, and not in its threat intelligence report of September 2026, each checked on 14 September 2026. What exists is a notification email reproduced by recipients. Dark Reading put the matter to Anthropic and records that the company did not respond. The provenance of this entry is thinner than any other in the register. The remedy applied was to invalidate the sessions after the fact, sign affected users out, remove saved payment methods and refund unauthorised charges.

Primary source

None. A null established by search: the vendor's status page, its support site, its news index and its September 2026 threat intelligence report, each checked 14 September 2026.

Secondary, a customer notification reproduced

Mayank Parmar, BleepingComputer, "Anthropic warns infostealer malware is hijacking Claude sessions to drain usage", https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-warns-infostealer-malware-is-hijacking-claude-sessions-to-drain-usage/, 30 August 2026, 10:30 AM, read 30 October 2026, which reproduces the notification and names the malware families. Brandon Vigliarolo, The Register, "Anthropic cracks down on hijacked user accounts mining AI tokens", https://www.theregister.com/security/2026/08/31/anthropic-cracks-down-on-hijacked-user-accounts-mining-ai-tokens/5293461, 31 August 2026, read 27 September 2026, which names the malware families and reproduces the notification. Jai Vijayan, Dark Reading, https://www.darkreading.com/cyberattacks-data-breaches/anthropic-users-infostealer-attacks-session-thefts, 31 August 2026, for Anthropic not responding to a request for comment. TechCrunch, https://techcrunch.com/2026/09/08/hackers-are-stealing-claude-tokens-from-subscribers, 8 September 2026.

For the background and the cost: Anthropic, "Anthropic's Transparency Hub", System Trust and Reporting, https://www.anthropic.com/transparency/system-trust-reporting, last updated 23 July 2026, read 30 October 2026; Help Net Security, "Anthropic locks out Claude users after infostealers hijack login sessions", https://www.helpnetsecurity.com/2026/08/31/claude-accounts-compromised-through-infostealer/, 31 August 2026, read 30 October 2026; Security Boulevard, "Anthropic: Attackers Using Infostealers to Hijack Claude Sessions", https://securityboulevard.com/2026/09/anthropic-attackers-using-infostealers-to-hijack-claude-sessions/, 1 September 2026, read 30 October 2026; Anthropic, "Detecting and countering misuse of AI: September 2026", https://www-cdn.anthropic.com/e50be2e51e7695dc4b1366a37a245a597377d3b5/Anthropic-Detecting-and-countering-091026.pdf, 10 September 2026, read 30 October 2026.

32. PaperCut NG/MF, the agent-run campaign

Target

395 identified organisations in 48 countries running PaperCut NG/MF print management software. Education took 204 of the victims, the United States 98 and the United Kingdom 59.

Against what background

PaperCut's own published scale is over a hundred million users at over seventy thousand organisations. The 395 identified victim organisations are roughly one in 180 of that customer base. Shadowserver's data, as SecurityWeek reports it, puts more than 1,000 PaperCut NG/MF instances on the open internet, and the attackers' scanner returned 462, which is the adversary's own output rather than a measure of exposure.

Dates

From 31 August 2026. GreyNoise published on 9 September 2026. Exploitation of the two flaws began before this campaign: Beazley Security Labs records it "observed as early as August 26th", and Arctic Wolf Labs reports that "Multiple security firms detected initial exploitation on August 26, 2026".

What was reached

Credentials harvested from 280 victims, operating-system or domain secrets from 147, and domain administrator at twelve. One instance ran from initial access to full domain administrator in seven minutes, against a high school in the United States.

Routes: no route at entry, then one

Entry ran on two published flaws, CVE-2026-81578, an authentication bypass, and CVE-2026-82078, an unsafe reflection reaching remote code execution. Entry here was not an authority failure. What puts the campaign in this register is what entry was converted into, which is route one, taken: credentials taken from 280 estates and operating-system or domain secrets from 147, every one of them a copy that went on working for its owner.

Driver: open-weight model on a commercial harness

GreyNoise records the toolchain in its own terms: hundreds of agents "powered by OpenAI's Codex (harness), a DeepSeek model (not OpenAI models)" together with publicly available offensive security tools. The harness, the program that gives a model the ability to act, is a commercial product of OpenAI. The weights driving it are open, published for anyone to download and run on their own hardware.

Figures

At least 440 instances reached across 395 organisations in 48 countries. From an empty workspace to the first remote code execution against a real victim, just under four hours; first domain administrator two hours after that; once the operation was launched, eleven organisations compromised in twenty-six seconds. Where domain administrator was reached, the fastest run took five minutes and the longest 144. The agents were instructed to avoid a list of twenty-eight countries and did not consistently obey the instruction.

What it cost

GreyNoise says it is unclear whether this actor is solely focused on access development, and that follow-on objectives such as data theft or ransomware deployment remain possible. It notes only that in the past other intrusions involving PaperCut have led to extortion. Exfiltration was staged and is not confirmed: the adversary used a directory replication technique to produce a full dump of the domain credential database, with registry hives staged for removal. No victim is named, and GreyNoise records that there are other real victims it could not attribute to a named organisation.

PaperCut's own advisory of 27 August 2026 says it is aware of confirmed customer incidents and is treating the matter with the highest priority. It has published nothing since about what those incidents cost.

Huntress found evidence of exploitation in two customer environments, the first lasting under two minutes in total. As of its last update of 10 September 2026 it had observed no secondary malware, no further command-and-control traffic, no additional persistence and no post-exploitation activity.

No ransom and no quantified harm has been published. CISA, America's Cybersecurity and Infrastructure Security Agency, added both flaws to its catalogue of known exploited vulnerabilities and ordered federal agencies to fix them by 14 September.

What this establishes

Twenty-six seconds for eleven organisations is not a statement about agents. It is a statement about what the estates were holding.

Primary source

GreyNoise, "Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF", https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf, 9 September 2026. Publisher: GreyNoise. Read 27 September 2026, which confirms every GreyNoise figure in this entry verbatim.

Pierluigi Paganini, SecurityAffairs, "U.S. CISA adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog", https://securityaffairs.com/198200/security/u-s-cisa-adds-papercut-ng-mf-flaws-to-its-known-exploited-vulnerabilities-catalog.html, 1 September 2026, read 30 October 2026. Beazley Security Labs, "Critical RCE Vulnerabilities in PaperCut NG/MF Under Active Exploitation (CVE-2026-82078, CVE-2026-81578)", https://labs.beazley.security/advisories/BSL-A1200, 31 August 2026, read 30 October 2026, for exploitation "observed as early as August 26th". Arctic Wolf Labs, Arctic Wolf, "URGENT UPDATE: Active Exploitation of Two Chained PaperCut NG/MF Vulnerabilities CVE-2026-81578 and CVE-2026-82078", https://arcticwolf.com/resources/blog/cve-2026-81578-and-cve-2026-82078/, 1 September 2026, read 30 October 2026, for initial exploitation detected by multiple security firms on 26 August 2026. Eduard Kovacs, SecurityWeek, "PaperCut Exploitation Escalates to Active Intrusions", https://securityweek.com/papercut-exploitation-escalates-to-active-intrusions, undated as served, read 30 October 2026, for Shadowserver's count.

For the background and the cost: PaperCut Software, homepage, https://www.papercut.com/, undated, read 30 October 2026; The Record from Recorded Future News, "PaperCut warns of hackers using printer management software flaw in attacks", https://therecord.media/papercut-warns-of-hackers-using-printer-management-vulnerabilities, 28 August 2026, read 30 October 2026; Huntress, "PaperCut Actively Exploited: A Pre-Auth RCE Chain", https://www.huntress.com/blog/papercut-actively-exploited, 27 August 2026, updated 28 August, 1 September and 10 September 2026, read 30 October 2026.

33. Nexus, the identity document storefront

Target

Holders of North American driving licences, identity cards, international travel documents and medical cards. The storefront is a dark-web trading operation.

Against what background

The Federal Highway Administration records 239,824,944 licensed drivers in the United States for 2024. The storefront's advertised 153 million covers the United States and Canada together, so the two do not divide cleanly; even so it is of the order of two thirds of the number of people licensed to drive in the United States alone. Brian Krebs did not verify the 153 million. A blank search of the storefront returned about 11.5 million pages of results, and he judged the sellers likely not to be exaggerating.

Dates

Reported by Brian Krebs on 1 September 2026. The storefront went dark after he published. The New York Times carried the story on 4 September 2026.

What was reached

Driving licences and other identity documents in bulk.

Route: one, against the enrolment and recovery path

These documents do not authenticate anybody. They are what an enrolment process asks for when a credential is being issued, and what a recovery process asks for when one has been lost, which places them upstream of every authentication the holder will ever perform. Taking them in bulk is therefore route one, taken, against the enrolment and recovery path: not the theft of a credential but the acquisition of the means to be issued one, against any number of holders, at the institution of the buyer's choosing.

Driver: human with no model involved

Krebs describes a storefront run by sellers advertising a live feed from a verification company, and names no model.

Figures, and every volume is the sellers' own advertisement recorded as such

More than 153 million North American driving licences, more than ten million identity cards, more than three million travel documents or international IDs and at least 579,000 medical cards. The New York Times gives the advertised total as about 170 million. What Krebs established independently is narrower and firmer: he confirmed sample documents, among them his own licence, and he watched the advertised licence count rise by nearly four hundred thousand inside twenty-four hours, which is the signature of a live feed rather than of a static dump. The sellers say the images come from an active breach at a major identity verification company, and Krebs reports that the FBI's New Orleans field office opened an investigation into an apparent breach involving IDScan.net, the identity verification vendor that confirmed an intrusion of its own nine days later.

What it cost

A spokesperson for the FBI's New Orleans field office told Fox 8 on 6 September 2026 that the Bureau can confirm it is looking into the incident, and that it declines to comment further given the ongoing nature of the investigation.

The storefront vanished from the dark web after Krebs published, its login page replaced by a plain text message saying the service is no longer available. A later reader comment on his post claims the service is still running, which Krebs does not confirm.

Caesars Entertainment was listed as a client on IDScan.net's own website. It says it has not been a client of IDScan.net and has not used the company's scanning product since February 2025, that it held no active accounts during the incident, and that it did not authorise IDScan.net to retain data from its accounts.

No arrest, no indictment, no seizure notice and no confirmed misuse of any document from the inventory has been published.

What this establishes

A password can be changed. A driving licence cannot be rotated, a passport cannot be reissued on a defender's timetable, and a verification selfie taken once is the same photograph for life. A copy of any of them is good for as long as the original is.

Primary source

Brian Krebs, Krebs on Security, "FBI Probes Service Selling 153M+ Drivers Licenses", https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/, 1 September 2026, with an update of 2 September 2026, 6:05 p.m. ET, carrying Caesars Entertainment's statement, and an update of 8 September 2026 carrying IDScan's notice. Publisher: Krebs on Security. Read 27 September 2026, and read again on 31 October 2026 for the article's account of the "trust" page of idscan.net, which lists Caesars Entertainment among the brands the company serves, and for Caesars Entertainment's statement in the update of 2 September.

Secondary

Christine Hauser, The New York Times, https://www.nytimes.com/2026/09/04/us/nexus-identity-theft-data-breach-fbi.html, 4 September 2026.

For the background and the cost: Federal Highway Administration, US Department of Transportation, "Total Licensed Drivers: Distribution by Age Group 2024", Table DL-22, https://www.fhwa.dot.gov/policyinformation/statistics/2024/dl22.cfm, February 2026, read 30 October 2026; WVUE Fox 8 New Orleans, carried by WLOX, "FBI looking into driver's license data breach possibly linked to New Orleans ID-verification firm", https://www.wlox.com/2026/09/06/fbi-looking-into-drivers-license-data-breach-possibly-linked-new-orleans-id-verification-firm/, 6 September 2026, read 30 October 2026.

34. IDScan, the identity verification vendor and probable source of the Nexus inventory

Target

IDScan, an identity verification vendor serving corporate customers from entertainment venues to cannabis dispensaries. A commercial identity verification service.

Against what background

The Federal Trade Commission's Consumer Sentinel Network data book for 2024 records, out of 6,471,708 reports of all kinds, 1,135,291 identity theft reports across the United States that year, of which 70,332 concern government documents or benefits. A single vendor notifying 13 million people is roughly eleven times the whole country's annual identity theft report volume.

Dates

Access ran from 4 April to 2 September 2026, five months, on IDScan's own account, so it began three days before the period this record covers and ran on through it. Its notice, updated 29 September 2026, says that an unauthorised third party "gained access to a portion of our cloud environment between April 4, 2026, and September 2, 2026", and its customer URBN LEAF relays the same window in the breach notice it published on 3 October 2026. The company received information around 1 September 2026 indicating that data may have been accessed without authorisation, posted its own notice on 4 September 2026 and confirmed the breach to TechCrunch on 10 September 2026. Brian Krebs reported the Nexus storefront at entry 33 on 1 September 2026. TechCrunch reported a year-long intrusion, and the five-month window is the one the company itself gave.

What was reached

Driving licences taken from the company's cloud. IDScan's own notice, updated 29 September 2026, states: "The investigation has determined that the event was limited to the VeriScan platform." The most specific published account of what a single record held comes from URBN LEAF, a dispensary chain that scans customers' licences at the door: full name, home address, date of birth, sex, identification number, issuing state, issue and expiry dates, document control number, and the front image of the card carrying the photograph, the signature, height, weight, eye and hair colour. Alongside each card the record held the scan date and time, the store it was scanned in, the approximate satellite coordinates of the scanning device, and the authenticity result the scanner returned. That notice states there is no indication that passports, medical cards, social security numbers, payment information or purchase history were involved, which sits against the storefront at entry 33 advertising passports and medical cards for sale.

Route: not established

IDScan has not disclosed how the attackers gained initial entry or what was exploited. This register records that as unknown rather than assuming the cloud storage was reached on a credential. It is in the record for what was taken: identity documents, which a holder presents to prove who they are and which stay valid for years after a copy is made.

Driver: not established by the source

IDScan has not disclosed initial access, and no source describes who or what carried the intrusion.

Figures

Two state breach filings of September 2026, in Texas and Oregon, put the number of people affected at 13 million. Neither state's database has been read here, and the figure is taken from the reporting that names them. IDScan's own notice gives no number. Its website says it holds over 150 million driving licence records, which is what it holds rather than a count of what was taken, and the storefront at entry 33 advertises more than 153 million. The three figures describe different things. IDScan has notified 13 million people, the storefront claims to be selling 140 million records more than that, and no source establishes that the two are the same data. TechCrunch reports that full access to the information required payment. IDScan has not identified which of its corporate customers were affected.

What it cost

At least eighteen suits were filed against IDScan.net in the United States District Court for the Eastern District of Louisiana between 2 September and 8 October 2026, the first Bunch v. IDscan.net, Inc. and the most recent McGaha v. IDscan.net, Inc., No. 2:26-cv-02336. Eight carry stay entries dated 6 to 9 October 2026, and Chief Judge Wendy B. Vitter presides over most of the suits. On 15 October 2026 the McGaha docket shows an "Order Transferring Case"; Settlement Insight could not see the entry's text and does not say which judge the case went to. A motion to consolidate the cases, refiled in Rioux v. IDscan.net, Inc., was marked deficient by the clerk with a submission date of 13 October 2026, and Settlement Insight found no consolidation order in the docket entries it saw through 15 October 2026.

The published remedy is free credit monitoring and identity protection with a dedicated hotline. IDScan's own notice states no duration; the twelve-month term is the figure its customer URBN LEAF gives in passing it on.

IDScan's own notice states that it took immediate steps to secure its systems, that it engaged third-party specialists to determine the full nature and scope of the incident, and that the investigation is ongoing.

The FBI's New Orleans field office opened an investigation into an apparent breach involving IDScan.net. No fine, no enforcement action and no settlement has been published.

What this establishes

IDScan's stated holding of over 150 million records and the storefront's 153 million are of the same order, the timing matches, and Krebs reports the FBI opened an investigation into a breach at IDScan.net in the Nexus context, which makes this entry the probable upstream of entry 33. No source establishes in terms that the Nexus inventory came from IDScan, and the two are carried as separate entries with the relationship reported rather than asserted as fact.

Twelve months of credit monitoring is the published remedy for the loss of a document that will still be valid years after the monitoring ends, and for a facial photograph that never expires at all.

Primary source

IDScan.net, "IDScan.net Provides Notification of Data Security Incident", PR Newswire, 4 September 2026, read at the AOL wire reproduction https://www.aol.com/articles/idscan-net-provides-notification-data-030000000.html on 27 September 2026: "On or around September 1, 2026, IDScan.net received information indicating that certain data may have been accessed without authorization," and that the information may include full names and driver's licence or other government-issued identification numbers.

URBN LEAF, "Notice of Data Breach", signed by Jim Scott, Chief Executive Officer, https://www.urbnleaf.com/notice-of-data-breach, 3 October 2026, read 30 October 2026, relaying IDScan.net's own account: access "between April 4, 2026, and September 2, 2026", IDScan learning of it on or around 1 September 2026, the itemised contents of a scanned record, and the statement that there is no indication passports, medical cards, social security numbers, payment information or purchase history were involved. IDScan.net, "Notification of Data Security Incident", https://idscan.net/notification-data-security-incident/, "Updated September 29. Initially posted September 4, 2026", read 30 October 2026, in its own words: an unauthorised third party "gained access to a portion of our cloud environment between April 4, 2026, and September 2, 2026", "The investigation has determined that the event was limited to the VeriScan platform", and "This investigation is currently ongoing."

Secondary

Zack Whittaker, TechCrunch, "ID verification giant IDScan confirms data breach with more than 150 million driver's licenses stolen", https://techcrunch.com/2026/09/10/id-verification-giant-idscan-confirms-data-breach-with-more-than-150-million-drivers-licenses-stolen/, 10 September 2026, read 27 September 2026, for the year-long intrusion, the photographs and the payment wall. Help Net Security, https://www.helpnetsecurity.com/2026/09/11/idscan-net-data-breach-153-million-drivers-licenses/, 11 September 2026. eSecurity Planet, "IDScan Data Breach Affects 13 Million People", https://www.esecurityplanet.com/news/news-idscan-data-breach-13-million-people/, 28 September 2026, read 30 October 2026, for the Texas state breach listing of 21 September 2026 giving 13 million, and for its own caution that the 13 million and the 153 million "describe different things and should not be treated as interchangeable". Settlement Insight Data Desk, reviewed by Leonard Goldberg, Settlement Insight, "IDScan Data Breach: 13 Million Affected, 18 Suits, No Claim Form", https://settlementinsight.com/news/idscan-data-breach-13-million-people-oregon-filing-not-153-million-18th-lawsuit-october-8-stay-entries-no-settlement-no-claim-form, 17 October 2026, read 30 October 2026, for at least eighteen suits filed in the Eastern District of Louisiana from 2 September to 8 October 2026, most before Chief Judge Wendy B. Vitter, the order transferring McGaha on 15 October, the consolidation motion refiled in Rioux v. IDscan.net, Inc. and marked deficient, and no consolidation order in the entries seen through 15 October 2026. Oregon's consumer breach database carries a filing in the same terms, reported on 18 September 2026; that database refuses automated retrieval and has not been read here.

For the background and the cost: Federal Trade Commission, "Consumer Sentinel Network 2024 Data Book", https://www.ftc.gov/system/files/ftc_gov/pdf/csn-annual-data-book-2024.pdf, March 2025, read 30 October 2026; Settlement Insight, "IDScan Data Breach: 13 Million Affected, 18 Suits, No Claim Form", https://settlementinsight.com/news/idscan-data-breach-13-million-people-oregon-filing-not-153-million-18th-lawsuit-october-8-stay-entries-no-settlement-no-claim-form, 17 October 2026, read 30 October 2026; OpenClassActions, https://openclassactions.com/lawsuits/data-breaches/idscan-net-data-breach-class-action-lawsuit.php, last updated 21 October 2026, read 30 October 2026; IDScan.net, "Notification of Data Security Incident", https://idscan.net/notification-data-security-incident/, 4 September 2026, updated 29 September 2026, read 30 October 2026; WVUE Fox 8 New Orleans, carried by WLOX, "FBI looking into driver's license data breach possibly linked to New Orleans ID-verification firm", https://www.wlox.com/2026/09/06/fbi-looking-into-drivers-license-data-breach-possibly-linked-new-orleans-id-verification-firm/, 6 September 2026, read 30 October 2026.

35. Unit 42, the agent-assisted intrusion

Target

An unnamed organisation running a microservice estate. The kind of organisation is not stated.

Against what background

Palo Alto Networks' own 2026 global incident response report analysed over 750 major cyber incidents across every major industry in more than fifty countries. Against that case set it reports that in the fastest cases attackers needed 72 minutes to move from initial access to data exfiltration, four times faster than the year before, that identity weaknesses played a material role in nearly 90% of its investigations, and that 87% of intrusions involved activity across multiple attack surfaces. In the report itself, the 72 minutes is the quickest quartile, and the median time to exfiltration across the full dataset was two days.

Dates

Unit 42 published on 2 September 2026 and updated on the 3rd and the 4th. The update of 3 September corrects the post's own framing, to clarify that the attack was an intrusion and not a ransomware attack. The post's opening still describes it as part of a ransom attack, and much of the secondary coverage calls it ransomware, which the update rules out.

What was reached

The chain ran from a public web and application programming interface foothold, to a reconnaissance agent mapping the microservice estate, to hardcoded tokens and service passwords harvested out of source repositories, to those tokens opening the secrets manager, to master administrator and root credentials, root meaning full control of the machine, to unauthorised builds in the continuous integration pipeline and the exfiltration of keys, to attempted Terraform backdoors which branch protection blocked, and finally to the victim's own AI endpoints reached on the victim's own stolen keys.

Routes: one, and four
  • Route one, taken, at every step after the first.
  • Route four, obeyed, because the pipeline executed unauthorised builds.
Driver: frontier models claimed by the operator and not named by the investigator

The human operator said they had used frontier models together with attack-specific agentic frameworks. Unit 42 names neither the models nor the frameworks and reports only the operator's claim.

Figures

More than fifty MITRE ATT&CK techniques executed in under ten hours, against work Unit 42 puts at around two weeks for a coordinated effort by several human red teams. No novel zero-day and no elite tradecraft required at any point. The agents left behind an eighty-page technical audit of the findings they had exploited.

What it cost

Almost nothing is published, because the organisation is not named and therefore cannot speak.

What the attacker reached: master administrative credentials out of the secrets manager, used to seize root system access; unauthorised builds triggered in the continuous integration and delivery pipeline; stolen master keys to the victim's cloud AI infrastructure; and the victim's own AI endpoints turned into post-compromise infrastructure. Unit 42 notes that this let the attacker offload the financial cost onto the victim, and does not say what that cost came to.

What was prevented: attempts to plant backdoors in Terraform configurations, stopped by hard branch-protection controls.

No ransom demand, no payment, no quantified loss, no service interruption and no victim statement appears anywhere. Unit 42 records that the actor discussed the case in negotiations, and gives no detail of any demand.

What this establishes

Read the chain and the agents do exactly one thing: they go faster. The secrets manager did not fail; it answered a caller presenting a valid token, hardcoded in source and harvested from the repositories, which is what it exists to do.

Primary source

Unit 42, Palo Alto Networks, "An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation", https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation, 2 September 2026, updated 3 and 4 September 2026. Publisher: Unit 42. Read 27 September 2026, which confirms the more than fifty techniques in under ten hours, the two-week human comparison, the 80-page audit, and that the frontier models and agentic frameworks are the operator's own claim in negotiations rather than Unit 42's finding.

For the background and the cost: Palo Alto Networks, "2026 Unit 42 Global Incident Response Report - Attacks Now 4x Faster", https://www.paloaltonetworks.com/blog/2026/02/unit-42-global-ir-report/, 17 February 2026, read 30 October 2026; Palo Alto Networks, Unit 42, "2026 Unit 42 Global Incident Response Report", https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report, February 2026, read 30 October 2026.

36. Google Threat Intelligence Group, the six-hour harvesting campaign

Target

An unnamed victim's cloud estate, and then the third parties whose secrets the campaign harvested.

Against what background

Google publishes the initial access base rate for its own cloud estate. Across the second half of 2025, weak or absent credentials accounted for 27.2% of initial access exploited in Google Cloud, down from 47.1% in the first half, with third-party software-based entry at 44.5% and misconfiguration at 21%, software exploitation overtaking credentials as the primary vector for the first time. From Mandiant's separate incident response engagements covering major cloud and software-as-a-service environments in the same period, threat actors exploited identity issues to gain initial access in 83% of incidents. Those two sets measure different populations and are not compared here. Google cautions that its data reflects a subset of observed activity.

Dates

Investigated by Mandiant in the second quarter of 2026. Published 8 September 2026.

What was reached

After obtaining a foothold in the victim's cloud, a suspected financially motivated actor used an AI coding chatbot, a prompt and a set of preconfigured markdown instruction sets serving as operational playbooks to plan, build and run a mass credential harvesting campaign in under six hours.

Google separately records an exposed command-and-control dashboard managing more than 23,800 harvested secrets in real time, cloud and AI service keys among them. It does not tie that dashboard to this campaign or to any other it documents, and this register does not join them either.

Routes: one, and four
  • Route one, taken, because the yield was credentials at scale.
  • Route four, obeyed, because the agents ran the pipeline on instructions held in text files.
Driver: frontier model, Google's Gemini

Google calls the tool "an AI coding chatbot" and records that "These activities triggered Gemini's safety responses", which places the campaign on its own model. It names no version of Gemini, and it names neither the actor nor the victim.

Figures

Under six hours from foothold to running campaign. The dashboard, counted separately, held more than 23,800 harvested secrets. The operation ran from the victim's own cloud infrastructure, so the attack traffic left through the victim's own legitimate addresses.

What it cost

The victim is not named, so no victim statement exists. No victim count has been published, and nothing has been published about what became of the 23,800 secrets, whether they were used, sold or revoked.

Google records that it "took additional, broader action to disrupt the threat actors' campaigns based on their operational security failures", and that it acted against the actors "by disabling the assets associated with this activity and making updates to prevent further misuse". The Cloud Security Alliance's research note on the same disclosure records that Google did not confirm the dashboard belonged to the same operator, that it presents the dashboard as a separate finding tied to neither documented campaign, that its reporting supplies no detection-time benchmark, and that the absence of a fixed victim count should not be read as evidence of limited scale.

What this establishes

Harvesting took nothing away from anybody: a secret harvested is a secret duplicated, and the dashboard is an inventory of copies, each as good as its original until somebody revokes it.

In the same post Google records that while recent model security incident disclosures demonstrate that frontier models can autonomously identify zero-days and execute network intrusions, it has "not yet observed threat actors deploying fully autonomous pipelines against targets in the wild". Both halves are true: the capability is conceded, and what is not observed is anyone in the field needing it.

Primary source

Google Threat Intelligence Group, "GTIG AI Threat Tracker: From Prompting to Autonomy - The Evolution of Adversarial AI", https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai, 8 September 2026. Publisher: Google Cloud. Read 27 September 2026, which confirms the under-six-hours campaign, the 23,800 secrets, the victim's own cloud infrastructure and the not-yet-observed sentence verbatim. Read again on 2 November 2026 for the sentence describing the chatbot, the sentence on Gemini's safety responses and Google's account of the action it took, each verbatim.

For the background and the cost: Google Cloud, "Cloud Threat Horizons Report", H1 2026 edition, https://services.google.com/fh/files/misc/cloud_threat_horizons_report_h12026.pdf, undated, read 30 October 2026; Cloud Security Alliance AI Safety Initiative, "Autonomous AI Agents and the Six-Hour Credential Harvest", https://labs.cloudsecurityalliance.org/research/csa-research-note-gtig-agentic-credential-harvesting-2026090/ and the PDF at https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/09/CSA_research_note_gtig_agentic_credential_harvesting_20260909-csa-styled.pdf, 9 September 2026, read 30 October 2026; Security Ledger, https://securityledger.com/2026/09/google-llmjacking-powers-cybercriminals-use-of-ai/, read 30 October 2026; BleepingComputer, "Hackers build AI frameworks for widescale credential theft", https://www.bleepingcomputer.com/news/security/hackers-build-ai-frameworks-for-widescale-credential-theft/, 8 September 2026, read 30 October 2026.

37. Microsoft, passkey-themed social engineering

Target

Microsoft Entra ID tenants. Commercial organisations.

Against what background

Microsoft's 2026 Digital Defense Report publishes 31 million identity risk detections analysed in an average day, more than 165 trillion security signals a day, and 4.7 million file blocks of net new malware every day. On the social engineering side it records that attacker-supplied commands were executed on more than 1.1 million unique devices between February and early May 2026, which it calls roughly an eightfold increase, and that user execution accounted for 30% of observed initial access in its own expert data. The 2025 edition gave 38 million identity risk detections in an average day.

Dates

Tracked since May 2026. Microsoft Security Research published on 9 September 2026.

What was reached

Callers posing as an internal helpdesk told staff they were required to update a passkey, a multi-factor method or a single sign-on configuration. Victims were then steered down one of two paths: adversary-in-the-middle pages which captured the credential and then the session token once the second factor had been satisfied, or device-code authentication flows on genuine Microsoft pages, where the victim authorised a client the attacker controlled. Actors then registered multi-factor methods of their own, including telephone numbers, authenticator applications and software one-time-password generators, and inventoried the tenant through Graph, enumerating users, groups, permissions, resources and content.

Routes: two, and three
  • Route two, granted, for the attacker-controlled client the victim authorised and the attacker-registered multi-factor methods.
  • Route three, inherited, for the session token taken after the second factor had succeeded.
Driver: human with no model involved

Microsoft describes the calls and the two flows they steered victims into, names no model, and attributes initial access to Storm-3121, which feeds the ShinyHunters and Falcon extortion operations, and to Storm-3032, formerly BlackFile and now operating as Helix.

Figures

None published.

What it cost

Microsoft states one consequence: the initial access leads to extortion. It records that Storm-3121 conducts initial access activity leading to ShinyHunters and Falcon extortion, and records a Helix extortion banner for Storm-3032.

On what was taken, Microsoft marks exfiltration as suspected rather than confirmed. It describes the suspected exfiltration as typically measured and sustained, often spanning several hours to multiple days, with fewer than a thousand files or emails accessed within any one-hour period, and sessions persisting for approximately an hour while enumerating sensitive files and internal applications.

Microsoft gives extent without arithmetic: it says it is tracking active cloud-based intrusions spanning multiple accounts, observed since May 2026, and publishes no count of affected tenants or organisations. No financial loss, no named victim, no takedown, no customer notification programme and no regulatory action has been published. Microsoft describes no action of its own beyond detection, recording that its Defender products have coverage for the known techniques.

What this establishes

The loose version of this campaign is that passkeys failed, and they did not. Microsoft records that "passkey enrollment is often not the actor's true objective" and that the passkey narrative works as a convincing pretext for steering victims into the two flows above. Nothing about WebAuthn, the standard on which passkeys are built, was broken. A campaign that takes a session after a phishing-resistant authentication has succeeded is not evidence against the credential; it is evidence that the credential was never the thing carrying authority once the door had opened.

Primary source

Microsoft Security Research, "Passkey-themed social engineering leads to identity and cloud compromise", https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise, 9 September 2026. Publisher: Microsoft. Read 27 September 2026, which confirms the two flows, the attacker-registered multi-factor methods, the Storm-3121 and Storm-3032 attributions and the quoted sentence.

For the background and the cost: Microsoft, "2026 Microsoft Digital Defense Report", https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2026-v1.1.pdf, undated, read 30 October 2026; Microsoft Security Insider, "2026 Digital Defense Report", https://www.microsoft.com/en-us/security/security-insider/threat-landscape/2026-digital-defense-report, read 30 October 2026; Microsoft, "Microsoft Digital Defense Report 2025: AI's double-edged influence: Defending and disrupting the digital landscape", https://marketingassets.microsoft.com/gdc/gdc41XPCU/original, read 30 October 2026.

38. Brevo, the SAML single sign-on authorisation failure

Target

Brevo, a commercial email marketing and customer engagement platform, and its client accounts. The most visible downstream victim was Trezor, a cryptocurrency hardware wallet manufacturer, and its newsletter subscribers.

Against what background

Brevo states that it serves 600,000 or more customers globally, which is a floor rather than a count. The 138 affected client accounts are therefore at most one in 4,300 of that base, and the six used to send phishing at most one in a hundred thousand.

Dates

Trezor dates the incident at Brevo to 9 September 2026. Brevo states that it identified a security issue on 10 September 2026 at 06:30 UTC, and that at 08:30 UTC the same day it closed the path the attacker used and signed out every user on the platform. Publicly disclosed 10 to 12 September 2026.

What was reached

Client accounts on the platform, and with them the ability to send mail through Brevo's own infrastructure as those clients. Phishing sent that way passes the ordinary email authentication checks because it originates from trusted servers. The Trezor message carried the subject line "Critical Security Alert: STM32 Entropy Vulnerability" and asked recipients to enter their wallet backup, which is the key itself written out as words.

Why the lure was credible

Every Trezor device is built on an STM32 microcontroller, the chip the whole device runs on: STM32F205RE in the Model One, STM32F427VIT6 in the Model T, and the STM32U5 series with Arm Cortex-M33 cores in the Safe 3, Safe 5 and Safe 7, each on Trezor's own published hardware and firmware documentation. Six weeks before the phishing, on 30 July 2026, Coinkite published a seed-generation warning for its own Coldcard, a rival hardware wallet: "A firmware bug in affected releases caused weakened seed generation." Funds controlled by a seed generated on Mk2 or Mk3 version 4.0.1 (March 2021) through 4.1.9 inclusive are at risk where the seed was created without at least 50 fair, independent, private dice rolls and the funded wallet is not protected by a strong, unique BIP-39 passphrase; seeds generated on the Mk4, Q and Mk5 before the fixed firmware releases are also affected, "with about 72 bits of entropy rather than the expected 128 bits", which Coinkite calls not as severe but still serious. The remedy given is to generate a new seed on the updated device and move the funds across once the new wallet is verified. Coinkite states that the devices themselves "were not hacked, remotely accessed, or taken over", and the page does not state what in the firmware produced the weakness. No advisory from STMicroelectronics and no CVE record for insufficient randomness in the STM32 random number generator was found on search, and nothing in the Coldcard warning concerns the STM32. Coinkite's own status page, "the living postmortem and remediation record for the July 2026 seed-generation incident", gives the cause only as "a COLDCARD firmware bug", records independent checks confirming that the fixed seed generation reaches the STM32's hardware random number generator, and says nothing against that generator itself.

Routes: five, then one
  • Route five, believed, is the mechanism, in a clean instance that Brevo states plainly. The attacker created a Brevo account, enabled single sign-on on it, and invited legitimate Brevo users into that configuration; the access was not properly scoped, so instead of being limited to the single organisation where sign-on had been enabled, it wrongly granted the attacker access to all organisations those users could reach. The authentication was correct, and the check that ran established who had authenticated and not what they were entitled to reach. At entry 30 JFrog states the same failure in its own advisory.
  • Route one, taken, follows, because the position was then used to take client accounts and send from them.
Driver: human with no model involved

Brevo's write-up describes the attacker's own account, the single sign-on it switched on and the users it invited, and names no model.

Figures

Brevo confirmed 138 affected client accounts: six were used to send phishing emails to the contacts stored in them, 43 had their contacts exported, and 93 showed no meaningful activity. Those three figures sum to 142 against the stated total of 138, and Brevo does not explain the difference. Trezor states that roughly 347,000 newsletter contacts received the message, and that the phishing domain was taken down within twenty minutes at the DNS level, the level of the naming system, which limited access to the 2,500 people who had already clicked it in that window. Brevo later confirmed 347,149 marketing contacts exported through the API, and Trezor published the figure as newsletter subscriber email addresses exported during the breach.

What it cost

No loss has been published by either company or by any authority.

Trezor states that no Trezor product, wallet or account system was affected. It advises that anyone who entered their backup should move their funds immediately and that anyone who entered it only on the Trezor device itself during a recovery remains secure, and it warns that affected users may see an increase in phishing emails. It took the domain down, suspended the Brevo account and disabled sending, posted warnings across its sites, applications and community channels, emailed affected contacts directly, and began a review of its vendor relationships and the security it requires of them.

Brevo says each affected customer was contacted directly, that it is filing a legal complaint and that it will cooperate fully with the authorities. It names no data protection regulator, no notification, no compensation and no service interruption beyond its own timestamps.

Nobody has published how many people typed their backup into the phishing page.

Primary source

Brevo, incident write-up, https://status.brevo.com/incidents/01M266V1CZKJQNGZRNEGFD5CQE/write-up, read 27 September 2026, for the mechanism, the 06:30 and 08:30 UTC times and the 138 accounts; and Trezor, "Security incident at Brevo, our third-party email provider", https://trezor.io/blog/news/security-incident-at-brevo-our-third-party-email-provider, 10 September 2026, updated 17 September 2026, read 27 September 2026, for the 347,000 contacts, the 20-minute takedown, the 2,500 who clicked and the exported total, and read 30 October 2026 for its dating of the incident at Brevo to 9 September 2026.

Secondary

Eduard Kovacs, SecurityWeek, "Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack", https://www.securityweek.com/trezor-says-347000-users-received-phishing-emails-after-brevo-hack/, 11 September 2026, read 27 September 2026.

Primary, on the microcontroller

Trezor, hardware bill of materials, Model One, https://github.com/trezor/trezor-hardware/blob/master/electronics/trezor_one/trezor.bom.txt, read at source 14 October 2026, in these words: "- 1x STM32F205RE". Trezor, hardware bill of materials, Model T, https://github.com/trezor/trezor-hardware/blob/master/electronics/trezor_model_t/bom.txt, read at source 14 October 2026, in these words: "IC2 STM32F427VIT6 STM32F427_LQFP100 LQFP100_NO_CENTER_NO_TDOCU". Trezor, firmware embedded architecture documentation, https://docs.trezor.io/trezor-firmware/core/embed-arch/embed-arch.html, read at source 14 October 2026, in these words: "The document applies primarily to Trezor Safe 3, Trezor Safe 5, and Trezor Safe 7, which are based on STM32U5 microcontrollers with Arm Cortex-M33 cores" and "Legacy models such as Trezor Model T are based on STM32F4 microcontrollers and are covered only partially".

Primary, on the Coldcard warning

Coinkite, "Coldcard Mk3 seed generation warning", https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/, published 30 July 2026, updated 1 August 2026 at 14:35 EDT, with current guidance dated 14 August 2026, read at source 14 October 2026, in these words: "A firmware bug in affected releases caused weakened seed generation"; "Funds controlled by a seed generated on Mk2 or Mk3 version 4.0.1 (March 2021) through 4.1.9 inclusive are at risk" "if the seed was created without at least 50 fair, independent, private dice rolls" and "the funded wallet is not protected by a strong, unique BIP-39 passphrase"; "Seeds generated on Mk4, Q and Mk5 before the fixed firmware releases are also affected" "with about 72 bits of entropy rather than the expected 128 bits"; "The impact on Mk4, Mk5 and Q is not as severe but is still serious"; "Generate a new seed on the updated COLDCARD"; and "The COLDCARD devices themselves were not hacked, remotely accessed, or taken over". Coinkite, "Current COLDCARD Security Status", https://coldcard.com/security/status, verified 1 October 2026, with its change log running to the same date, read 30 October 2026, for the remediation record, the cause given as "a COLDCARD firmware bug", the independent checks, among them a device test that "Observed eight STM32 hardware RNG reads for the 32-byte seed request", and the technical postmortem it says "remains in preparation".

Searched and not found

No STMicroelectronics advisory and no CVE record for insufficient randomness or entropy failure in the STM32 random number generator. The negative is what the subject line turns on.

For the background and the cost: Brevo, homepage, https://www.brevo.com/, undated, read 30 October 2026.

39. Revolut, the fake government requests

Target

Revolut, a licensed financial institution, and its customers. The instrument abused was Italy's Posta Elettronica Certificata, or PEC, the state-regulated certified email system, described as the digital equivalent of registered post.

Against what background

AgID, Italy's digital agency and the supervisor of the certified email system, publishes 16.2 million active certified mailboxes in Italy as at December 2024. That is the denominator that matters, because the instrument abused was not a Revolut system but an Italian state-regulated one, and each of those mailboxes is a channel a regulated institution is expected to answer.

Dates

The attackers say contact began some months before disclosure and continued from then. Revolut confirmed between 12 and 16 September 2026. TechCrunch reported on 12 September, The Record on 14 September and the Irish Times on 16 September.

What was reached

Customer identity and financial records released in response to fake requests for information submitted from an email address on a legitimate government agency domain. The categories in the customer notice are identity and contact details, dates of birth, postal and email addresses, telephone numbers and copies of passports and driving licences, and in some cases verification selfies, account statements and transaction histories.

Route: two, granted by the holder

No credential was stolen and no Revolut system was broken into. A request arrived through a channel the institution had been built to honour, and the institution honoured it. The requester's authority to ask was never granted by anybody; Revolut assumed it, on the strength of a domain that looked entitled, and the checking apparatus was a human reading a sender address.

Driver: human with no model involved

Revolut's statement and the attackers' own claims describe requests sent from a government address, and name no model.

Figures

Revolut's own public statement said a limited number of customers were affected, without giving a figure. Reporting subsequently gives approximately 680 accounts, and the attackers claim most victims were from Switzerland and France, with thirty-one other countries represented.

What it cost

The United Kingdom's data protection regulator, the Information Commissioner's Office, confirmed on 15 September 2026 that it had received a report and was assessing the information provided. Assessing is not investigating, and no source establishes when Revolut reported itself.

Revolut says it immediately blocked the address on detection, that it contacted the government agency concerned, law enforcement, data protection authorities and financial regulators, and that it notified affected customers directly. On loss its position is that Revolut systems and customer funds are unaffected, and that its systems were not broken into.

In Italy, unnamed officials confirmed that investigations were under way while the postal police, the state police, the interior ministry and the national cyber security agency all declined to comment. The member of parliament Giulia Pastorella called the reported breach alarming at an unimaginable level and said the country could be facing the tip of the iceberg.

There is a ransom demand, and it was published rather than delivered. On 16 September a person familiar with the matter said Revolut had not been contacted by the perpetrators and had yet to receive one. Within a day the group posted a demand on its own dark-web site and sent it to the Financial Times by messaging application: 6,000 Monero, about $3 million, with a threat to sell the data inside 24 hours.

The attackers claim that they posed as law enforcement for months, and that they used blockchain analysis, which one of them called onchain analysis, to select about 680 customers with significant cryptocurrency holdings. They published redacted screenshots and gave further images to the Financial Times, which states in its own voice that the data handed over covered residents of thirty-one other, mainly European, countries.

No fine, no enforcement notice, no claim and no theft of funds has been published.

What this establishes

Italy's certified email exists to prove who sent a message, it did that correctly here, and what it proved was that the message came from a state-registered account the attackers were sitting inside. How the Italian PEC system itself was reached is not established by any source.

A passport copy and a verification selfie are what an enrolment process asks for when a credential is being issued, and that is the class of thing the storefront at entry 33 indexes and sells. These came out of a regulated financial institution, because a requester looked like somebody who was allowed to ask.

Primary source

Revolut's own statement, carried by TechCrunch, https://techcrunch.com/2026/09/12/revolut-confirms-customer-data-breach-through-fake-government-requests, 12 September 2026. Read 14 September 2026.

Secondary

Irish Times, "Hackers say they breached Italian state email to target Revolut 'crypto whales'", https://www.irishtimes.com/business/2026/09/16/hackers-say-they-breached-italian-state-email-to-target-revolut-crypto-whales/, 16 September 2026, read 27 September 2026. The Record, https://therecord.media/revolut-scam-crypto-impersonation, 14 September 2026.

For the background and the cost: AgID (Agenzia per l'Italia Digitale), "Posta Elettronica Certificata", https://www.agid.gov.it/it/piattaforme/posta-elettronica-certificata, read 30 October 2026; AgID, English PEC page, https://www.agid.gov.it/en/node/325, read 30 October 2026; City AM, "Revolut hackers stole nearly 700 customers' private data", https://www.cityam.com/revolut-hackers-hold-nearly-700-customers-private-data/, 15 September 2026, read 30 October 2026; Infosecurity Magazine, "Revolut Confirms Data Breach Through Fake Government Requests", https://www.infosecurity-magazine.com/news/revolut-data-breach-fake-government/, 14 September 2026, read 30 October 2026; Euronews, "Revolut hack: criminals steal data of 700 European clients, demand $3m ransom", https://www.euronews.com/business/2026/09/17/revolut-hack-criminals-steal-data-of-700-european-clients-demand-3m-ransom, 17 September 2026, updated 18 September 2026, read 30 October 2026.

40. WSO2 API Manager, forged administrator tokens

Target

Organisations running WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway. API management infrastructure sitting in front of enterprise systems.

Against what background

WSO2's own published scale is more than 50,000 enterprise users, more than 200 banking, financial services and insurance customers, more than 200 government customers, more than 90 countries, 60 trillion transactions and 2.5 billion identities. No authoritative count of internet-exposed WSO2 API Manager instances is published anywhere, by any scanning body or by the vendor.

Dates

WSO2 published its advisory and fix on 3 May 2026, and the CVE record was published on 6 August 2026. watchTowr's honeypot network, machines put on the internet to be attacked and watched, captured forged JSON Web Tokens bearing administrator privileges on 13 September 2026. BleepingComputer, reporting watchTowr's researchers, describes a limited number of attempts from one IP address, using forged tokens against the wrong WSO2 product for CVE-2026-5430, after which watchTowr reproduced the attack on the correct product, where a forged token could expose API endpoints and application credentials. watchTowr announced the capture on 15 September 2026, in BleepingComputer's dating, and The Hacker News reported it on 16 September 2026.

What was reached

Nothing, on the evidence: the attempts watchTowr captured were aimed at the wrong product. What the flaw gives on the right product is administrative accounts and full account takeover, from which an attacker can access API backend endpoints, retrieve consumer keys, secrets and credentials for registered applications, and intercept data in transit. The authority within reach is the ability to issue and read the credentials of everything sitting behind the gateway.

Route: five, attempted

The vulnerability is improper cryptographic signature verification: JSON Web Token authentication can be bypassed because the system accepts and approves tokens signed with algorithms it does not support. The check ran and established that a token had been presented, which was true, and nothing else, which makes this the cleanest instance of route five, believed, in the record after entry 15. This is the class Tim McLean disclosed in March 2015, the subject of an Internet Engineering Task Force Best Current Practice since February 2020, here patched by the vendor in May 2026 and attacked in an enterprise API gateway in September.

Driver: human with no model involved

watchTowr describes forged administrator tokens sent from one address, and names no model.

Figures

CVE-2026-5430. WSO2 assigned the identifier itself, and both scores are its own: CVSS 10 in multi-tenant deployments, adjusted to 9.8 in single-tenant. The CVE record carries WSO2's score. Affected: API Manager 4.1.0 to 4.6.0, and API Control Plane, Traffic Manager and Universal Gateway 4.5.0 to 4.6.0. No victim count and no exposed-instance figure published.

What it cost

The only published consequence is a federal remediation order.

CISA, America's Cybersecurity and Infrastructure Security Agency, added the flaw to its Known Exploited Vulnerabilities catalogue on 24 September 2026 with a due date of 27 September, three days, alongside a flaw in Adobe Commerce and Magento. The catalogue describes it as a path traversal vulnerability in API Control Plane, API Manager, Traffic Manager and Universal Gateway that could allow unrestricted file upload and lead to remote code execution, marks known ransomware campaign use as unknown, and requires forensic triage. The required action is to apply the vendor's mitigations in compliance with Binding Operational Directive 26-04 and its forensic triage requirements, to follow the directive's guidance for cloud services, or to discontinue use of the product where mitigations are unavailable.

CISA calls the flaw a path traversal allowing unrestricted file upload and assigns it the weakness code for improper verification of a cryptographic signature, so its own naming contradicts its own classification. The classification is the one WSO2's advisory and watchTowr describe: a web token accepted when it is signed with an algorithm the product does not support. The National Vulnerability Database carries the catalogue's own fields on the record, with the three-day due date, and the coordinator assessment of 24 September 2026 records exploitation as active.

No victim, no breach, no loss and no enforcement action has been published.

Primary source

WSO2 security advisory WSO2-2026-5328, https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/, 3 May 2026, and the CVE record https://www.cve.org/CVERecord?id=CVE-2026-5430, published 6 August 2026, both read 27 September 2026, for the description, the score and the affected versions. The watchTowr honeypot finding, through Yordan Ganchev, principal threat intelligence specialist, was not read at source.

Secondary

Ravie Lakshmanan, The Hacker News, "Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens", https://thehackernews.com/2026/09/active-exploitation-attempts-target.html, 16 September 2026, read 27 September 2026, for the honeypot capture of 13 September and the watchTowr attribution. Bill Toulas, BleepingComputer, "CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks", https://www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/, 25 September 2026, read 30 October 2026, for watchTowr's announcement of 15 September, the attempts of 13 September from one IP address against the wrong WSO2 product, and watchTowr's reproduction of the attack on the correct product.

For the background and the cost: WSO2, About, https://wso2.com/about/, undated, read 30 October 2026; CISA, Known Exploited Vulnerabilities catalogue, https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json, read 30 October 2026; CISA, Known Exploited Vulnerabilities catalogue, https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json, version 2026.10.29 released 29 October 2026, read 30 October 2026; NIST, National Vulnerability Database API record, https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-5430, published 6 August 2026, last modified 25 September 2026, read 30 October 2026.

41. Brevo, the hardcoded Cloudflare key and the content delivery edge

Target

Brevo, the commercial email marketing and customer engagement platform also at entry 38, and up to 100,000 websites embedding Brevo's forms script, conversations widget and SDK loader. Commercial web estates and their visitors.

Against what background

Brevo states that over 600,000 businesses use it, across more than 180 countries, on a page that carries no date, and its press release of 21 April 2026, issued through GlobeNewswire, puts the figure at more than 600,000 companies. What matters here is not that customer count but the number of other people's websites embedding Brevo's scripts into their own pages. The only figure for that is Sansec's, and it rests on a public code-search index of sites carrying Brevo's domains rather than on a count of its own.

Dates

14 September 2026. Brevo's own write-up gives an impact window of 15:01 to 20:30 UTC, five and a half hours, and states the key was first misused in late August 2026. Sansec reported first, giving a slightly narrower window of 16:05 to 20:13 UTC, and Brevo's write-up followed. Reported publicly 15 to 17 September 2026.

What was reached

A hardcoded Cloudflare API key with full account permissions, found in Brevo's application source code. With it the attackers created malicious Cloudflare Workers that modified content at the content delivery edge, injecting ClickFix malware lures, stripping Content-Security-Policy headers to bypass the site's own protections, and on WordPress sites detecting administrator users and distributing a backdoored plugin that established, with database persistence, a hidden administrator account and a web shell, a program planted on a web server that lets an intruder run commands on it.

Route: one

The credential was read out of source code, which is where it legitimately was. What it then conferred was the authority to rewrite what up to a hundred thousand websites served.

Driver: human with no model involved

Brevo's write-up describes the key read out of source code and the Workers created with it, and names no model.

Figures

Up to 100,000 websites, on Sansec's estimate. An impact window of five and a half hours.

What it cost

Brevo's own write-up limits the consequence. Not affected: its application at app.brevo.com, its programming interface, email sending, and customer account data held inside Brevo. On the backdoor, the script attempted to silently install and activate a plugin on the site, and only where the visitor was already signed in as an administrator of that site. Brevo does not say that any install succeeded. On earlier activity, it found no injection of malicious content into customer-facing pages before 14 September. Customer notification began on 15 September.

What it changed: the malicious edge worker, its routes and the attacker's hostnames removed; the compromised key and every credential created with it revoked; edge caches purged; and the hardcoded credential taken out of the source and replaced with narrowly scoped, short-lived tokens. One further step is listed as planned rather than done: adopting a vault as the single store for all its keys and tokens, with automatic rotation and no credentials in source code or configuration files.

The only measured consequence anybody published came from Sansec, whose content security policy monitor recorded 2,549 violation reports across twelve sites during and after the window. Sansec did not recover the plugin and says only that it is likely a backdoor. BleepingComputer found the archive on VirusTotal and describes it in the positive: a thing posing as a media-optimisation plugin, which installs itself as a persistent backdoor and script loader, hides itself from the plugin list, copies itself into the directory of plugins that cannot be switched off, calls an attacker-controlled server, and carries a hardcoded key that mints an administrator session with no password.

No monetary loss, no confirmed infection count, no action by any French data protection or cyber agency, no claim and no compensation has been published. BleepingComputer records that Brevo did not answer its questions about whether this and the single sign-on incident were connected.

What this establishes

Two Brevo entries appear in this register days apart, on different mechanisms. Entry 38 is an authorisation failure inside a single sign-on implementation. This one is a full-permission key checked into source. On what is published, they share a victim and nothing else, and they are not merged.

Primary source

Brevo, incident write-up, https://status.brevo.com/incidents/01M2QBC4EZ24ZACW6SWQYVW8N3/write-up, read 27 September 2026, for the 15:01 to 20:30 UTC window, the long-lived Cloudflare API key with full account permissions stored in application source code, the late-August first misuse and what was not affected.

Secondary

Bill Toulas, BleepingComputer, "Brevo supply-chain attack injected ClickFix scripts on customer sites", https://www.bleepingcomputer.com/news/security/brevo-supply-chain-attack-injected-clickfix-scripts-on-customer-sites/, 17 September 2026, read 27 September 2026, for Sansec's window and the up-to-100,000 figure, the ClickFix lure and the WordPress plugin.

Brevo, press release issued through GlobeNewswire, "Brevo Announces Release of 2026 Marketing Engagement Benchmark Report", Austin, 21 April 2026, read 30 October 2026 at its syndication, https://lifestyle.myeaglecountry.com/story/179999/brevo-announces-release-of-2026-marketing-engagement-benchmark-report/, GlobeNewswire's own page refusing automated retrieval.

For the background and the cost: Brevo, press room, https://www.brevo.com/press-room, undated, read 30 October 2026; Sansec, "Brevo supply chain attack hits 100k+ sites with Wordpress backdoors and Clickfix malware", https://sansec.io/research/brevo-supply-chain-attack, 16 September 2026, read 30 October 2026.

42. Flock, hardcoded credentials in a surveillance camera estate

Target

Flock Safety, a vendor of automatic licence plate reader cameras used by police forces. A surveillance infrastructure vendor.

Against what background

More than 120,000 cameras across 49 states, on Flock's own published figure. Senator Josh Hawley's letter of 26 August 2026 to the company puts the traffic through that estate at more than 20 billion vehicle scans every month, in a sentence telling the company it "boasts" both figures, and footnotes that sentence to a Flock blog post that carries the camera figure and no figure for scans; the senator's press release of the same day reproduces the sentence with no citation.

Dates

Analysis published 16 September 2026 by Micah Lee, working from firmware obtained by a collective calling itself stegan0gram, which stated to 404 Media and WIRED that it had taken hardware in the field and reverse engineered the cameras and associated solar equipment. The firmware was also shared with the leak site Distributed Denial of Secrets.

What was reached

One hardcoded API key embedded in nineteen Flock applications, and one Auth0 client identifier and secret pair stored in plaintext on the camera's persist partition. The credentials can obtain bearer tokens that authenticate with Flock's backend servers as the camera, and the analysis suggests the hardcoded API key could obtain credentials for any Flock camera from its MAC address.

Route: one, in potential

Here the credentials were reached, and their use against a live system is not established. Micah Lee states expressly that the credentials might still be live and active and that he did not try them. The entry is included because the credentials are real, extracted, and published, and because a hardcoded credential common to an estate is the condition this record exists to document.

Driver: human with no model involved

Micah Lee describes his own analysis of the camera's firmware and applications, which found the credentials, and names no model.

Figures

One API key across nineteen applications. One Auth0 client identifier and secret pair. One camera analysed in detail, serial 23091220026, in Wauwatosa, Wisconsin. Reporting elsewhere gives figures of fifty-three hardcoded passwords across an estate of some 90,000 cameras; those figures are from secondary commentary and are not established by the primary analysis read here.

What it cost

No remediation has been published, and Flock has not acknowledged the hardcoded credentials. Its only statement on them, given to 404 Media and WIRED, is that it takes security seriously and maintains a public vulnerability disclosure policy for security researchers, that it received no report through that process, and that based on the limited information provided it lacks the detail to assess the claims. No evidence of credential rotation has been published.

Flock's security post of 22 September 2026 addresses the 2026 penetration test that Flock engaged Bishop Fox to conduct between 12 January and 27 March 2026, and the version of Android running on its first-generation hardware. It says that version was publicly acknowledged when an independent researcher identified it in 2025, describes a hardened firmware update already deployed to that hardware, and states that "No customer data or systems were ever accessed by anyone outside of Flock as a result of this testing". It does not mention the credentials. WFSB reported on 29 September 2026 that Flock had emailed the Connecticut police departments that use its devices about a "security incident", and quotes the email: "This data was unlawfully accessed and exfiltrated from a third-party map service". Flock told WFSB that "The information obtained was limited to device name, location, and device type", that "in November 2025 an individual reported an exposed map access key" to its security team, that it "validated the finding, eliminated the vulnerability, and closed the issue in December 2025", and that "The data was accessed unlawfully. Law enforcement is investigating." WFSB's report does not mention the hardcoded credentials. CISA, America's Cybersecurity and Infrastructure Security Agency, authorised Flock as a numbering authority for vulnerability identifiers on 7 October 2026.

The United States Senate Judiciary Subcommittee on Crime and Counterterrorism held a hearing, "Always Watching: Flock's Nationwide AI Surveillance Network", on Wednesday 23 September 2026. The witness Benn Jordan, listed as a cybersecurity engineer, testified that "the Flock devices that we tested were running on an old version of Android that has been out of service for years", and, asked whether Flock has been hacked, said the company's denial was inaccurate, that it had at various times changed the definitions of hacked, tracked and breached, and that on the general definition of accessing unauthorised data he would say Flock has been. Senator Hawley's own release as chairman records that the chief executives of Flock, Axon, Motorola and Verkada were each invited and each declined, Flock sending a written letter instead.

The hearing is not attributable to this disclosure. Senator Hawley opened his investigation on 26 August 2026, three weeks before the 16 September publication. No source ties the hearing, or any cancelled municipal contract, to the hardcoded credentials.

Primary source

Micah Lee, "Flock cameras are riddled with security vulnerabilities and hard-coded credentials", https://micahflee.com/flock-cameras-are-riddled-with-security-vulnerabilities-and-hard-coded-credentials/, 16 September 2026. Publisher: Micah Lee. Read 27 September 2026. Sam Smink, WFSB, "I-Team: Flock warns CT police about a security breach, but records reveal the company knew about it months ago", https://www.wfsb.com/2026/09/29/i-team-flock-warns-ct-police-about-security-breach-records-reveal-company-knew-about-it-months-ago/, published 29 September 2026 at 5:33 PM EDT, updated 2 October 2026 at 2:46 PM EDT, read 30 October 2026, for Flock's email to Connecticut police departments and its statements to WFSB on the map service and the map access key.

For the background and the cost: Office of Senator Josh Hawley, "Chairman Hawley Investigates AI-Powered Flock Cameras Amidst Privacy Concerns", https://www.hawley.senate.gov/chairman-hawley-investigates-ai-powered-flock-cameras-amidst-privacy-concerns/, 26 August 2026, read 30 October 2026; Flock Safety, "Flock Security Testing 2026: What the Bishop Fox Penetration Test Found - Critical and High Findings Fixed and Independently Verified", https://www.flocksafety.com/blog/flock-security-testing-2026-what-the-bishop-fox-penetration-test-found, 22 September 2026, read 30 October 2026; Flock Safety, "Security Advisories", https://www.flocksafety.com/legal/security-advisories, last updated 15 September 2026, read 30 October 2026; US Senate Committee on the Judiciary, "Always Watching: Flock's Nationwide AI Surveillance Network", https://www.judiciary.senate.gov/committee-activity/hearings/always-watching-flocks-nationwide-ai-surveillance-network, 23 September 2026, read 30 October 2026; Office of Senator Josh Hawley, "Chairman Hawley Invites CEOs of Flock, Competitors to Testify Next Week", https://www.hawley.senate.gov/chairman-hawley-invites-ceos-of-flock-competitors-to-testify-next-week/, 18 September 2026, read 30 October 2026; Office of Senator Josh Hawley, "ICYMI: Hawley Chairs Subcommittee Hearing Exposing Flock Cameras, Calls for Accountability", https://www.hawley.senate.gov/icymi-hawley-chairs-subcommittee-hearing-exposing-flock-cameras-calls-for-accountability/, 28 September 2026, read 30 October 2026; Josh Hawley, Office of Senator Josh Hawley, letter to Garrett Langley, Chief Executive Officer, Flock Safety, https://www.hawley.senate.gov/wp-content/uploads/2026/08/2026-08-26-Hawley-Letter-to-Flock-CEO.pdf, 26 August 2026, read 30 October 2026; Flock Safety, "The Price of Free LPR: What Vendor Lock-In Really Costs", https://www.flocksafety.com/blog/the-price-of-free-lpr, 24 July 2026, marked published 25 June 2026, read 30 October 2026.

43. Cisco Identity Services Engine, exploited in the wild

Target

Organisations running Cisco Identity Services Engine, the network access control policy engine that decides which devices and users are admitted to a network. Cisco titles the flaw an authentication bypass and CISA, America's Cybersecurity and Infrastructure Security Agency, titles it an incorrect use of privileged interfaces.

Against what background

No count of internet-exposed or vulnerable Cisco Identity Services Engine instances has been published for this flaw. Bitsight gives no count and describes the scope as affecting the products regardless of device configuration, and Cisco publishes no deployment figure.

Dates

Cisco published its advisory on 16 September 2026. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on the same day, with a remediation date for federal civilian agencies of 19 September 2026, three days, as the catalogue's own data file records.

What was reached

Command execution with root privileges, full control of the machine, through insufficient authentication control on an API endpoint, allowing unauthenticated remote attackers to bypass authentication and reach the web-based management interface.

Route: no route

An authentication control was insufficient rather than defeated through an artefact, a credential or token carrying the right to act. The check was not there to be passed.

Driver: not established by the source

Cisco provided no detail about threat actors or attack specifics.

Figures

CVE-2026-76460, CVSS 10.0. Affected: ISE 3.1 through 3.5, with patches at 3.1 patch 12, 3.2 patch 11, 3.3 patch 12, 3.4 patch 7 and 3.5 patch 4. No victim figures disclosed.

What it cost

The only published consequence is an order: CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 16 September 2026, the day Cisco published, with a due date of 19 September, three days, under Binding Operational Directive 26-04 and its forensic triage requirement.

Cisco's own advisory stands at version 1.0 of that date, marked final, with no revision since. Its only statement about exploitation is that the Product Security Incident Response Team is aware of active exploitation. It names no customer and describes no activity after the breach, and it warns that evidence of exploitation and indicators of compromise may be removed or hidden by the threat actors. It did publish indicators of compromise.

Help Net Security records that Cisco disclosed no details of the attacks it had observed, while noting that it supplied those indicators. BleepingComputer gives no victim and no attribution. Singapore's Cyber Security Agency states that attackers are exploiting the flaw, recording under its own known-exploitation heading that it is reportedly being actively exploited. No attribution has been offered by anybody at any confidence level.

What this establishes

Root on a network access control policy engine is not a step towards an estate. It is the thing that decides who is in the estate, so an unauthenticated caller holding root on it can admit whatever it chooses and every admission will be correctly granted. CISA gave federal civilian agencies three days, the same window it set at entries 13, 30, 40, 45, 54 and 58, and no entry in this register records a shorter one. At entry 45, exploitation of CVE-2026-93616 had begun about two months before anybody disclosed it.

Primary source

Cisco, "Cisco Identity Services Engine Authentication Bypass Vulnerability", advisory cisco-sa-ISE-ABP-VNSW7Tn5, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5, first published 16 September 2026, read 27 September 2026, which states that the PSIRT is aware of active exploitation, that a successful exploit can obtain command execution with root privileges, and gives the fixed releases; and the CVE record https://www.cve.org/CVERecord?id=CVE-2026-76460, CVSS 10.0, read 27 September 2026. The CISA catalogue, https://www.cisa.gov/known-exploited-vulnerabilities-catalog, refused automated access on 27 September 2026.

Secondary

The Hacker News, "Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks", https://thehackernews.com/2026/09/cisco-warns-of-new-zero-day-ise-auth.html, 17 September 2026, read 27 September 2026.

For the background and the cost: Bitsight, "CVE-2026-76460: A critical Cisco ISE authentication bypass under active exploitation", https://www.bitsight.com/blog/critical-vulnerability-alert-cve-2026-76460-cisco-ise-authentication-bypass, 17 September 2026, read 30 October 2026; CISA, Known Exploited Vulnerabilities catalogue, https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json, version 2026.10.28 released 28 October 2026, read 30 October 2026; Cisco Systems, CSAF machine-readable advisory, https://www.cisco.com/.well-known/csaf/2026/cisco-sa-ise-abp-vnsw7tn5.json, 16 September 2026, read 30 October 2026; Help Net Security, "Unauthenticated attackers are bypassing Cisco ISE's management interface (CVE-2026-76460)", https://www.helpnetsecurity.com/2026/09/17/cisco-ise-vulnerability-exploited-cve-2026-76460/, 17 September 2026, read 30 October 2026; BleepingComputer, https://bleepingcomputer.com/news/security/cisco-warns-of-identity-service-engine-zero-day-exploited-in-attacks, 17 September 2026, read 30 October 2026; Cyber Security Agency of Singapore, "Active Exploitation of Vulnerability in Cisco Identity Services Engine", AL-2026-126, https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-126/, 21 September 2026, updated 29 October 2026, read 30 October 2026.

44. BigCommerce, through the Ribon applications

Target

BigCommerce, an ecommerce platform, and its merchants, among them Master of Malt. Commercial retail estates and their shoppers.

Against what background

BigCommerce reported 6,648 enterprise customers in its fourth-quarter results of February 2026, up 897 accounts on the quarter, and describes itself as serving tens of thousands of merchants globally. Its second-quarter 2026 release publishes no account or merchant count. The better base rate for a compromise that arrived through a third-party application would be the number of applications in its marketplace, and BigCommerce's own marketplace page puts that at over 1,200 apps.

Dates

BigCommerce confirmed the credential compromise on 17 September 2026. The attacker's access window ran from 13 to 17 September. Reported 17 to 21 September 2026.

What was reached

BigCommerce states that credentials belonging to the third-party applications Ribon and Ribon 1.5, operated by Be A Part Of, a Fastr company, were compromised and used to inject malicious scripts into a small number of merchant storefronts. Master of Malt says the affected shopper details include full names, email addresses, telephone numbers and shipping postal addresses.

Route: one

A third party's credentials were taken, and what they conferred was the authority to deploy code into other people's storefronts.

Driver: not established by the source
Figures

None published beyond the data categories and the named merchant.

What it cost

Master of Malt reported the incident to the United Kingdom's Information Commissioner's Office.

BigCommerce uninstalled the application from affected stores to cut off the attacker's access, notified those merchants directly, and is providing log data to the developer's own investigation. It states that account passwords and payment card information are stored separately and were not exposed, and that its own systems and the BigCommerce platform were not breached.

Master of Malt says the incident may extend to hundreds of other stores. The law firm Emery Reddy is advertising for potential claimants. Be A Part Of and Fastr had not responded to BleepingComputer by the time it published.

No merchant count, no shopper count, no decision or enforcement from the Information Commissioner, no fine and no remediation cost has been published.

What this establishes

This is entry 4's shape in a different market: the platform's exposure was set by the weakest holder of a credential it had agreed to trust. Master of Malt did nothing wrong and lost its shoppers' names, email addresses, telephone numbers and shipping addresses, because a credential belonging to a third party its shoppers never dealt with was good enough to put code on its storefront.

Primary source

Not obtained; BigCommerce's own notification to merchants was not read at source.

Secondary

Bill Toulas, BleepingComputer, "BigCommerce alerts merchants of data breach linked to Ribon apps", https://www.bleepingcomputer.com/news/security/bigcommerce-alerts-merchants-of-data-breach-linked-to-ribon-apps/, 21 September 2026, read 27 September 2026, carrying BigCommerce's confirmation and Master of Malt's notice; Nate Bartram, Privacy Guides, "Data Breach Roundup (Sep 18 - 24, 2026)", https://www.privacyguides.org/news/2026/09/25/data-breach-roundup-sep-18-24-2026/, 25 September 2026, read 27 September 2026.

For the background and the cost: BigCommerce, Q4'25 earnings prepared remarks, https://investors.bigcommerce.com/static-files/bf603a2b-f4ca-4284-9076-a155e008ee04, 12 February 2026, read 30 October 2026; BigCommerce, Q2 2026 release, https://investors.bigcommerce.com/news-releases/news-release-details/commerce-announces-second-quarter-2026-financial-results, 6 August 2026, read 30 October 2026; SC Media / SC World, "BigCommerce merchants impacted by third-party app data breach", https://www.scworld.com/brief/bigcommerce-merchants-impacted-by-third-party-app-data-breach, undated, read 30 October 2026; BigCommerce, "Ecommerce Apps & Integrations", https://www.bigcommerce.com/apps/, undated, read 30 October 2026.

45. Check Point Security Management and Security Gateway

Target

Organisations running Check Point Security Management Server and Security Gateway, including Spark Firewall. Security appliances at the network edge.

Against what background

Check Point describes itself, in the boilerplate on its own second-quarter results of 30 July 2026, as protecting more than 100,000 organisations worldwide.

Dates

CVE-2026-85102 disclosed 9 September 2026, with no evidence of exploitation at disclosure; exploitation observed from 12 September 2026. CVE-2026-93616 disclosed 22 September 2026, with earliest observed activity dated back to 23 July 2026. Both added to the Known Exploited Vulnerabilities catalogue of CISA, America's Cybersecurity and Infrastructure Security Agency, on 22 September 2026, with a remediation deadline of 25 September 2026.

What was reached

The CVE records give both as unauthenticated remote code execution. CVE-2026-93616 is a directory traversal and file-upload flaw that lets an unauthenticated attacker upload and execute arbitrary scripts on the Management Server. CVE-2026-85102 is improper certificate trust validation during VPN negotiation on the Quantum Security Gateway, allowing an unauthenticated remote attacker to execute arbitrary code on the gateway.

Routes: no route for the first, and one not established for the second

CVE-2026-93616 is a pre-authentication flaw, which removes the check. CVE-2026-85102 turns on certificate trust validation during VPN negotiation, and whether the check ran and established the wrong property, which would be route five, believed, or was bypassed outright, which would be no route, is not established by the sources read.

Driver: not established by the source
Figures

Check Point confirmed a small number of targeted attacks in respect of CVE-2026-93616. No count published for CVE-2026-85102 beyond a statement that Spark customers globally were targeted.

What it cost

The vendor's own measure of the damage is the word handful, which appears twice in its advisory and again in what it told reporters.

Check Point says it is aware of a handful of customers who have been attacked. Its advisory records that Check Point Research has identified a handful of pinpointed exploitations of the management flaw, and it dates them: as at the advisory's publication date, a handful of pinpointed attacks observed on 23 July 2026. The advisory's own description of the management flaw is that it allows an attacker to execute a script from an arbitrary path and load an arbitrary Java class. The attacks were two months old when the vendor disclosed them.

Lotem Finkelstein, Check Point's vice-president of research, says the company is now observing exploitation attempts against Spark customers globally, and that at the time of disclosure it had no evidence of exploitation. The attempts against Spark originated from anonymising infrastructure, virtual private network services and proxies among it.

The advisory names follow-up activity as something to hunt for rather than something observed: follow-up activity often involves internal port and service scanning.

CISA added both flaws to its Known Exploited Vulnerabilities catalogue, which the Canadian Centre for Cyber Security's advisory records in its update of 22 September 2026. That advisory, first issued on 9 September, records that Check Point has reported both as exploited in the wild.

No named victim, no data confirmed taken, no attribution to any actor at any confidence, no fine, no claim and no remediation cost has been published by anybody.

What this establishes

Exploitation of CVE-2026-93616 had begun roughly two months before the flaw was disclosed. A defender following the patching discipline would have had no instrument for those two months, which is Part I's point that exploitation now routinely happens before a patch exists, and not a point about how authority is reached.

Primary source

Check Point, "Security advisory: active exploitation of CVE-2026-85102 and a management pre-authentication vulnerability CVE-2026-93616", https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/, 22 September 2026, read 27 September 2026, which records exploitation of CVE-2026-85102 from 12 September and a handful of pinpointed attacks on CVE-2026-93616 from 23 July 2026; and the CVE records https://www.cve.org/CVERecord?id=CVE-2026-85102 and https://www.cve.org/CVERecord?id=CVE-2026-93616, both CVSS 9.8, published 9 and 22 September 2026, read 27 September 2026. The CISA catalogue refused automated access on 27 September 2026 and the 25 September remediation deadline is carried from eSentire's advisory.

Secondary

eSentire, "Actively Exploited Vulnerabilities in Check Point Security Gateway and Security Management (CVE-2026-93616 and CVE-2026-85102)", https://www.esentire.com/security-advisories/actively-exploited-vulnerabilities-in-check-point-security-gateway-and-security-management-cve-2026-93616-and-cve-2026-85102, 23 September 2026, read 27 September 2026.

For the background and the cost: Check Point Software Technologies Ltd, "Check Point Software Reports 2026 Second Quarter Financial Results", https://www.checkpoint.com/press-releases/check-point-software-reports-2026-second-quarter-financial-results/, 30 July 2026, read 30 October 2026; BleepingComputer, https://www.bleepingcomputer.com/news/security/check-point-patches-management-server-zero-day-exploited-in-attacks/, 22 September 2026, read 30 October 2026; Canadian Centre for Cyber Security, "Check Point security advisory (AV26-902) - Update 2", https://www.cyber.gc.ca/en/alerts-advisories/check-point-security-advisory-av26-902, 9 September 2026, updated 22 September 2026, read 30 October 2026.

46. Denmark's Central Person Register, a company's lawful access used by somebody else

Target

The Danish Central Person Register, the CPR system, which holds the civil registration of the whole population, and the lawful search access held by a private Danish company.

Against what background

The CPR administration published what normal use of this register looks like, in its development plan for 2023 to 2025. About 30,000 employees and systems at authorities and companies make several hundred million lookups, searches and reports directly in the CPR system each year, and about 120,000 extract files are delivered annually to authorities and companies so that they can maintain local copies. The same document records 11 million people registered with a personal number since the register began.

Dates

Irregular activity in the register during September 2026, on the account of the Ministry of Research, Education and Digitalisation. Ritzau, reporting what TV 2 obtained under a freedom-of-information request, writes that "En it-kriminel havde fra 10. september adgang til CPR-registret i samlet set 21 dage og 17 timer", that a cybercriminal had access to the register from 10 September for 21 days and 17 hours in total. It adds that the CPR administration's notification of the case to Datatilsynet, the data protection regulator, says the access was not used for the whole period, and that the administration writes there, as TV 2 reports it, that its preliminary investigations indicate "kompromitteringen stoppede 20. september 2026", that the compromise stopped on 20 September 2026, after ten days. The person claiming the attack told Politiken they got in on 11 September, as Ritzau reported on 8 October 2026. The CPR administration became aware on the evening of Friday 2 October 2026 and established the scope over the following weekend. Mikkel Leihardt, a department head at the ministry, is quoted by The Next Web on how it came to light: "I can confirm that it is during invoicing on Friday evening that a very, very large amount is billed, which alerts you that there has been very large activity during September". Publicly disclosed 5 October 2026.

What was reached

Names, addresses and CPR numbers of approximately 8.8 million registered citizens, out of a register the ministry gives as approximately 11 million, which is about four fifths of the register by arithmetic on the ministry's own two figures. Names and addresses of persons who hold name and address protection were not included. The searches stayed inside the data a private company with CPR access may already retrieve.

Route: one

A credential existed and somebody else used it. The ministry's words are that the access was reached "Ved at misbruge en dansk virksomheds lovlige adgang til at søge oplysninger i CPR-systemet", by misusing a Danish company's lawful access to search information in the CPR system. Nothing was issued to the party using it and no session was inherited: the company's own standing authority was exercised by somebody who was not the company. That is the shape at entry 1, where Lithuania's register checked another institution's valid credentials and answered correctly for months. The ministry has not said how the access came into the wrong hands. A person claiming the attack told Politiken that a program reached the register through a website run by Pays ApS of Odense, using login details from a former employee's leaked password, and Politiken reported that at least three Pays accounts, the administrator's among them, used "123456"; Pays confirmed to TV 2, in Ritzau's report of 13 October, that it was the company, and its registered address is in the care of CharityGuard ApS, as the company register spells it.

Driver: not established by the source

The ministry states that the perpetrator has not been identified. The person claiming the attack told Politiken that AI wrote the program, and two experts who reviewed its more than 40,000 characters concluded that AI had generated its code; no model is named and no authority has confirmed it.

Figures

Approximately 8.8 million registered citizens, in the ministry's figure, against a register of approximately 11 million. The person claiming the attack told Politiken that the program retrieved 8,749,975 CPR numbers, as Ritzau reported on 13 October 2026. The account made "well over 14 million CPR lookup attempts", officials told a press briefing on 6 October, as TV 2 reported it and The Next Web carried it. The ministry did not name the company. Datatilsynet did, in its own press release of 23 October 2026 opening a formal investigation: Charity Guard ApS.

What it cost

Six things happened, and five of them are on the authorities' own releases.

The CPR administration cut the company's access to the register.

The police are investigating, in cooperation with the relevant authorities.

The regulator was notified and then escalated the case. The CPR administration filed a report with Datatilsynet, which received the breach notification on 4 October 2026 and on 23 October 2026 opened a formal investigation, sending hearing letters to the CPR administration and to Charity Guard ApS. Anders Chemnitz, an IT security specialist at the authority, said it views the case with great seriousness, that it is important to establish what has happened and how it could have happened, and that it has sent the hearing letters in order to have the basis it needs to assess whether the data protection rules were complied with.

The minister acted. Christina Egelund, Minister for Research, Education and Digitalisation, said initiatives had already been launched in respect of CPR to prevent similar incidents, and that she had additionally asked for a thorough security review of the CPR system to be carried out. In a written reply reported by Ritzau on 8 October 2026, she acknowledged "at sikkerheden omkring CPR-systemet ikke har været god nok", that security around the CPR system has not been good enough, and said that a stop had now been put to unauthorised persons gaining access to the system in the same way. Citizens were told to stay alert on telephone approaches, never to hand over passwords or other confidential information, and to hold to that even where the caller appears to know their name, address and personal number, which is what was taken. They were pointed to the state's digital safety site.

Those who check identity were told to check it another way. Styrelsen for Samfundssikkerhed, Denmark's agency for societal safety, advised authorities, organisations and companies on 6 October 2026 that they should supplement their identity checks: "Som udgangspunkt bør der foretages identitetskontrol, som baserer sig på andre oplysninger end oplysninger fra CPR eller oplysninger om tidligere kontakter mellem myndigheden eller virksomheden og borgeren", that as a rule identity checks should rest on information other than what the CPR holds or what is known of the citizen's earlier dealings with the authority or company. Its examples include a login through MitID, a one-time code sent to a telephone number or email address already registered for the citizen, a call back to a number already registered rather than one given in the call, and attendance in person with identification where the matter is a change of financial or security consequence.

The access that was abused was lawful, and it was switched off for one company. In the minister's account to two Folketing committees, the 1,039 companies with access to the register were told by the CPR administration, in a letter of 9 October, to appoint a security officer, check their employees' access continuously and watch their monthly transaction counts.

No fine and no sanction has been published.

Primary source

Forsknings-, Uddannelses- og Digitaliseringsministeriet, "Omfattende uautoriseret adgang til borgeres CPR-oplysninger", https://fudm.dk/aktuelt/pressemeddelelser/2026/oktober/omfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger/, 5 October 2026, read 15 October 2026, for the ministry's own figures and quotations above. The minister quoted is Christina Egelund, Minister for Research, Education and Digitalisation, whose own words on the remedy are "Jeg har derudover bedt om, at der bliver lavet en grundig sikkerhedsgennemgang af CPR-systemet", that she has asked for a thorough security review of the CPR system to be carried out. The access was stopped, the matter reported to Datatilsynet, and the police are investigating. Styrelsen for Samfundssikkerhed, "Myndigheder, organisationer og virksomheder bør supplere deres identitetskontrol efter læk fra CPR-registeret", issued through Ritzau, https://via.ritzau.dk/pressemeddelelse/15209445/myndigheder-organisationer-og-virksomheder-bor-supplere-deres-identitetskontrol-efter-laek-fra-cpr-registeret, 6 October 2026 at 10:13 CEST, read 30 October 2026, for its advice on identity checks.

The ministry's release does not mention the invoice. Its sentence on discovery is that "CPR-administrationen blev om aftenen fredag d. 2. oktober 2026 opmærksom på, at der i løbet af september har været en uregelmæssig adfærd i CPR-systemet", that the CPR administration became aware on the evening of Friday 2 October 2026 that there had been irregular behaviour in the system during September. The invoice rests on the words of Mikkel Leihardt, a department head at the ministry, as The Next Web quotes him.

Ana Maria Constantin, The Next Web, "Denmark's CPR breach: 14 million lookups in ten days, found through a bill", https://thenextweb.com/news/denmark-cpr-breach-8-8-million-records, 6 October 2026. Ritzau, carried by Sjællandske Nyheder, "1039 virksomheder har fået indskærpet sikkerhed efter CPR-læk", https://sjaellandske.sn.dk/article/6659352/koebenhavn-kommune/politik/1039-virksomheder-har-faaet-indskaerpet-sikkerhed-efter-cpr-laek, 10 October 2026. Ritzau, carried by The Copenhagen Post, "Suspected hacker says AI-created program used in Danish CPR breach", https://cphpost.dk/2026-10-13/news/round-up/suspected-hacker-says-ai-created-program-used-in-danish-cpr-breach/, 13 October 2026. Ritzau, carried by TV 2 Kosmopol, "Hacker havde adgang til CPR-registret i 21 dage", https://www.tv2kosmopol.dk/metropolen/hacker-havde-adgang-til-spr-registret-i-21-dage-4025e, undated, for TV 2's account from its freedom-of-information request, the 21 days and 17 hours from 10 September, and the CPR office's preliminary finding that the compromise stopped on 20 September. Ritzau, carried by Sjællandske Nyheder, "It-kriminel hævder at stå bag CPR-angreb: Kom ind via simpelt password", https://sjaellandske.sn.dk/article/6658240/indland/it-kriminel-haevder-at-staa-bag-cpr-angreb-kom-ind-via-simpelt-password, 8 October 2026, for the 11 September given by the person claiming the attack and the minister's written reply. Ritzau, carried by SE og HØR, "Medie: Program bag CPR-læk var skabt af kunstig intelligens", https://www.seoghoer.dk/nyheder/medie-program-bag-cpr-laek-var-skabt-af-kunstig-intelligens, 13 October 2026, for the 8,749,975 CPR numbers given by the person claiming the attack. Pays ApS, CVR 40057366, https://danskcvrapi.dk/en/company/pays-aps-40057366. All read 30 October 2026.

For the background and the cost: CPR-administrationen, "CPR-systemet Udviklingsplan 2023 - 2025", https://cdn9.cpr.dk/cpr/Media/638412695674105506/Udviklingsplan%202023-2025.pdf, 2023, read 30 October 2026; CPR-administrationen, "Omfattende uautoriseret adgang til borgeres CPR-oplysninger", https://www.cpr.dk/cpr-nyt/nyhedsarkiv/2026/okt/omfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger, 5 October 2026, read 30 October 2026; Datatilsynet, "Datatilsynet indleder formel undersøgelse af CPR-sagen", https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2026/okt/datatilsynet-indleder-formel-undersoegelse-af-cpr-sagen, 23 October 2026, read 30 October 2026.

47. Tensorlake, a poisoned release carrying genuine provenance, and a credential held hostage

Target

The official Tensorlake TypeScript software development kit on npm, and the developer machines that installed it.

Against what background

Sonatype's 2026 report gives npm a cumulative 5.59 million components and 7.97 trillion downloads across 2025, inside a total of 9.8 trillion downloads across the four major registries. A release published to that registry is installable everywhere the moment it exists.

Dates

Malicious version published and detected 8 October 2026.

What was reached

On any machine that installed the version, "GitHub and npm tokens, cloud keys, Kubernetes and Vault secrets, SSH keys, saved browser logins", sent to a public repository created in the victim's own GitHub account or to an address the attacker controlled.

Routes: one, four and five
  • One, taken, because the publishing identity was taken: the malicious commits were pushed to the project's main branch, without a pull request, under a maintainer's name.
  • Four, obeyed, because a preinstall hook ran on installation, skipping continuous integration environments and targeting developer machines, and an installer that runs what it is given has no holder to ask.
  • Five, believed, because the package npm served carried a valid provenance attestation: the release was built by the project's own workflow from the poisoned main branch. StepSecurity states the consequence: "The attestation says where a package was built. It doesn't say the code is safe." That is the mitigation Section 7 sets against the third property, the dependency graph nobody has read, failing in the way Section 7 says it fails.
Driver: human with no model involved

No model is named as driving the operation. The payload writes into the configuration directories of an AI coding assistant and an editor, which is what it reaches rather than what reached it.

Figures

tensorlake@0.5.144. No installation count is published. Self-propagation republished the victim's own packages with the worm added, and committed files to the victim's repositories under a fabricated author with the message "chore: update dependencies".

What it cost

Tensorlake's security advisory of 8 October 2026, rated critical at 9.6, states that it has not seen any usage of this version since it was released. The version was live on npm for approximately an hour and forty minutes. The attacker pushed malicious code directly to the repository and published it through Tensorlake's own release workflow. Only the npm package was affected; the Python and Rust packages and the command line tool were not.

SafeDep reports that npm records the poisoned version as published at 01:12:07 UTC on 8 October 2026, and that npm removed the version. Tensorlake's pull request reverting the compromise, merged the same day, states that "npm has removed tensorlake@0.5.144". The registry's own records for the replacement, 0.5.145, timestamp its publication at 20:24 UTC on 8 October 2026.

Socket flagged the poisoned version about eleven minutes after publication. Its figure of roughly twelve thousand weekly downloads is for the package overall, and Socket states that it does not measure downloads of the malicious version or confirmed infections.

On 29 and 30 October the Open Source Vulnerabilities database added the two latest releases, 0.5.159 and 0.5.160, to its record of the compromise on findings from Amazon Inspector, and nothing else had confirmed them by 30 October.

No confirmed victim, no confirmed stolen credential, no loss figure and no regulatory or legal consequence of any kind has been published.

Tensorlake's advisory orders anyone who installed the version to disconnect the machine and remove the implanted monitoring service before revoking the stolen GitHub token, because the payload deletes the user's home directory if the token is revoked.

What this establishes

A service called gh-token-monitor checks the stolen GitHub token every sixty seconds for up to twenty-four hours, and where GitHub rejects it, the service deletes the user's home directory, the trigger that entry 11 recorded in June, here running as a service of its own. Section 11 records that rotation of secrets is reactive and assumes somebody notices in time, and this monitor makes the correct remedy the trigger.

Primary source

StepSecurity, "Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It", https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm, 8 October 2026, read 15 October 2026, for the version, the commit path, the provenance attestation, the quoted sentence, the harvested categories, the propagation and the token monitor.

Open Source Vulnerabilities, MAL-2026-17650, "Malicious code in tensorlake (npm)", https://osv.dev/vulnerability/MAL-2026-17650, published 8 October 2026, modified 30 October 2026, read 30 October 2026.

For the background and the cost: Sonatype, "2026 State of the Software Supply Chain Report", https://www.sonatype.com/state-of-the-software-supply-chain/2026/software-infrastructure-growth, read 30 October 2026; Tensorlake AI, GitHub Security Advisory GHSA-8g63-53c9-65j2, "Malicious tensorlake@0.5.144 published to npm: Shai-Hulud credential-stealing worm with destructive dead-man's switch", https://github.com/tensorlakeai/tensorlake/security/advisories/GHSA-8g63-53c9-65j2, 8 October 2026, read 30 October 2026; SafeDep, "tensorlake 0.5.144 npm Compromise Ships Mini Shai-Hulud", https://safedep.io/tensorlake-npm-compromise-mini-shai-hulud/, 8 October 2026, read 30 October 2026; Socket, "TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack", https://socket.dev/blog/tensorlake-compromise, 8 October 2026, read 30 October 2026; diptanu, GitHub, tensorlakeai/tensorlake pull request #1016, "Revert the 0.5.144 supply-chain compromise and harden the npm release path", https://github.com/tensorlakeai/tensorlake/pull/1016, merged 8 October 2026, read 30 October 2026; npm, registry record for tensorlake 0.5.145, https://registry.npmjs.org/tensorlake/0.5.145, upload timestamp 1791491045553, read 30 October 2026; npm, provenance attestations for tensorlake@0.5.145, https://registry.npmjs.org/-/npm/v1/attestations/tensorlake@0.5.145, publish attestation integratedTime 1791491046, read 30 October 2026.

48. GhostAction, injected workflows across thirty thousand repositories

Target

GitHub accounts and the continuous integration configuration of the repositories they hold, continuous integration being the automated build and publish machinery a project runs on every change.

Against what background

GitHub's own Octoverse, published 28 October 2026 and covering the year to 30 September, records 45 billion Actions jobs run in those twelve months, counted in jobs rather than minutes or workflow runs. GitHub serves more than 225 million developers as at September 2026, took 17.9 billion pushes in the year and 34.3 billion commits across public and private repositories, and the total repository count in its industry chart, which counts public repositories only, is 25 million, up from 9.0 million in 2022.

Dates

The campaign has run since 2025, and two waves fall in the period this record covers. The first ran from 31 August to 30 September 2026, and GitGuardian published it on 7 October 2026. The second ran from 8 to 13 October, with the major spike on 8 and 9 October, a burst of 346 repositories on 8 October in two automated sweeps, and further bursts on 10 and 12 October using the same payload; GitGuardian added it in its updates of 9 and 13 October.

What was reached

Secrets named in the repositories' own legitimate workflows, together with credentials found by sweeping the working tree and, in the October variants, the full history of the repository.

Routes: one and four
  • One, taken, because the GitHub accounts were taken: the October wave "resulted from compromising the GitHub accounts of about 1,900 users".
  • Four, obeyed, because what followed was a workflow file pushed into the repository and then executed as ordinary automation, under the victim's own identity, with nothing in it that could be traced to a decision.
Driver: human with no model involved

GitGuardian describes taken GitHub accounts and injected workflow files, and names no model.

Figures

About 1,900 compromised accounts, more than 30,000 repositories across about 3,000 users and organisations in the October wave, against 772 repositories and 373 users and organisations between 31 August and 30 September 2026, and 817 repositories across 327 users in 2025. Of 3,669 collected runs, 336 completed, exfiltrating 26 secrets from 13 repositories. GitHub "started preventing the malicious workflow from running starting October 9", so the bursts of 10 and 12 October took nothing.

What it cost

In the wave that began on 31 August, 336 runs completed successfully, taking 26 secrets out of 13 repositories, where the injected workflows targeted 2,577 secrets. The October wave attempted to extract 3,174 secrets from public repositories' continuous integration. GitGuardian's update of 9 October says of the October runs that "these runs executed, and Socket confirms successful exfiltration". Socket's own post of the same day says that "The injected workflow has run successfully in affected repositories", calls kitao/pyxel "the clearest confirmed case of publishing credentials being targeted by a successful run", and in its recommended actions says to "Treat any completed run as successful exfiltration of the named secrets." Neither gives a count of the secrets taken in October.

GitHub started preventing the malicious workflow from running on 9 October, and had already been holding most September runs for approval, so most of them never executed.

Only 124 repositories had been effectively cleaned in observed public history by 5 October 2026, which is 16% of the 772 repositories in that wave rather than of the headline thirty thousand. Five weeks after the wave began, the other 84% still carried the injected workflow in their own public history.

Every commit was made with the victim's own identity, using what appear to be stolen credentials. Thirteen victim repositories were also used for cryptomining through GitHub Actions by at least four distinct campaigns, some of which hit thousands of repositories; GitGuardian's explanation is that the stolen GitHub credentials are not exclusive to the GhostAction operator, and on a separate cryptominer case it says in terms that it is not convinced the same operator is behind it. In 92 cases the attacker did not add a new workflow but modified one that was already there.

No downstream package compromise, no monetary loss, no arrest and no regulatory action has been published. GitGuardian's own update of 9 October names victims: two compromised maintainer accounts, kitao and henrywoo, pushed the workflow into every repository they could write to, "including kitao/pyxel (18,420 stars) and uber/athenadriver". GitGuardian does not say how many of the stolen secrets were valid, whether GitHub revoked the tokens, or whether the victims were told.

What this establishes

GitGuardian records that "Only 124 repositories (16%) were effectively cleaned in observed public history by 2026-10-05". That is Section 11's patch rate, and its queue that grows faster than it is worked, arriving on a supply chain.

Primary source

GitGuardian, "The campaign that never stopped: tracking GhostAction from 2025 to 2026", https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/, 7 October 2026, updated 9 and 13 October 2026, read 15 October 2026, for every figure above. The burst of 346 repositories on 8 October is attributed in that update to Socket. The update of 9 October was read again on 31 October 2026 for its words on Socket, and it links Socket's own post: Socket Research Team, Socket, "New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials", https://socket.dev/blog/ghostaction-cloud-credentials, 9 October 2026, read 31 October 2026, for the 346 repositories processed across two accounts in two short windows on 8 October, the injected workflow it says ran successfully in affected repositories, kitao/pyxel as its clearest confirmed case, and its instruction to treat any completed run as successful exfiltration.

For the background and the cost: GitHub, "Octoverse: Commits, pushes, reach new highs in 2026 as developers build with agents", https://github.blog/news-insights/octoverse/octoverse-commits-pushes-reach-new-highs-in-2026-as-developers-build-with-agents/, 28 October 2026, read 30 October 2026, and read again on 1 November 2026 for the scope of the repository count, which the report gives in its industry chart and counts among the figures it states are public only.

49. Ledger, a hardware implant reading the device's own screen

Target

Genuine Ledger hardware signing devices, obtained, opened, fitted with an unauthorised component and returned to distribution through resellers in South East Asia.

Against what background

Ledger's own figure, published in November 2024, is more than 7 million devices sold to consumers in 180 countries, with the company stating that it secures over 20% of the world's crypto assets. Chainalysis, covering January to early December 2025, puts total theft of crypto assets at over $3.4 billion, and for individual holders records 158,000 theft incidents in 2025, at least 80,000 unique victims against 40,000 in 2022, and a fall in the value lost by individuals from a 2024 peak of $1.5 billion to $713 million in 2025.

Dates

Reports of lost funds began on 9 October 2026. Ledger described the impact as limited on 11 October, described the implant on 13 October, asked resellers and distributors in South East Asia and Hong Kong to suspend sales the same day, and published its response on 15 October 2026. The investigation is open.

What was reached

The 24-word recovery phrase, which is the whole of the authority over the funds, taken at the one moment the device must display it.

Routes: one and five
  • One, taken, because the recovery phrase itself was taken: Ledger's words are that "The implant sits inside the enclosure and reads the data shown on the screen", that when it detects the setup screens it decodes the words of the recovery phrase, and that it "transmits them over LTE using a provisioned eSIM", which is to say over a mobile network.
  • Five, believed, where a check runs and proves the wrong thing, in its cleanest instance on a physical object in this record. Ledger offers a Genuine Check to verify hardware integrity, and its own statement of the check's limit is that it "cannot detect unauthorized physical modifications to the hardware" where the Secure Element, the sealed chip holding the key, is intact. A check ran, it proved the chip was authentic, and authenticity of the chip was never the question.
What was not touched, in Ledger's own words

"It does not modify the Secure Element or the Ledger operating system", and it does not alter transactions or signatures. "There was no flaw in Ledger's chip, operating system or servers." Section 8 grants the hardware wallet exactly one thing, that the device guarantees the bytes on its own screen. This is that screen, read from inside the case, with every cryptographic property of the device intact.

Driver: human with no model involved

Ledger describes an implant fitted inside the enclosure that reads the screen and transmits what it reads, and names no model.

Figures

Ledger has confirmed one device with an implant and no total, saying the volume of impacted devices is limited and that all confirmed cases involve devices sold by the reseller CryptoBilis, which has paused sales of its hardware wallet inventory. Three loss counts have been published, all read off the chain and none of them Ledger's. Specter and tanuki42 put it at more than $86 million on 9 October 2026, across ten public addresses, which Bitquery counted at $85.4 million. YFarmX put it at $94.5 million across 521 addresses on seven blockchains on 12 October. Bitquery put it at $102.0 million across 335 wallets on six chains at its update of 16 October. The figure has risen as the addresses have been traced, so on the published counts the loss is of the order of $100 million. Ledger has confirmed no figure at all. In Germany, MediaMarkt Saturn paused sales after one customer reported an implant, and Ledger states that no loss of funds was reported there. Tibane Labs' study reaches this register only at second hand, through ForkLog, which reports that Tibane examined two Nano X units with suspected implants, one bought on Yahoo! Auctions in Japan and the other from a third-party seller on Amazon Japan, the shipment originating from Malaysia, and that Tibane describes several generations of the implant, its specialists noting that elements of later versions were clearly mass-produced industrially.

What it cost

Ledger's response of 15 October 2026 sets out what it did. It is working with law enforcement and the security community to follow the funds. It asked authorised resellers and distributors to suspend sales in South East Asia and Hong Kong. It checked a large number of samples from its own stock and found no compromised units. Returned devices can never be resold in any form, even if they look new and unopened. Its products should no longer go on shelves or displays, and resellers must tell it promptly about any customer report of an unusual product. It says it has been working on additional measures to thwart this kind of attack at the product level, and it tells the users affected that it is with them.

There is no reimbursement, no recall and no free replacement programme from Ledger, and CoinDesk records that the company has not confirmed the total number of victims or the value stolen. Pascal Gauthier, Ledger's chief executive, says the investigation is ongoing to determine who tampered with these signers, or where in the distribution chain it happened.

Two retail consequences come from Ledger's own statements two days before that response, reported by CoinDesk on 13 October. MediaMarkt Saturn stopped selling Ledger devices after one customer in Germany reported an implant, and CryptoBilis has stopped selling Ledger signers. CoinDesk carries no statement from CryptoBilis itself.

Tether blocked 37 addresses over about two hours. Twenty of them still held around 500,000 Tether dollars each, which is where the figure of $10 million frozen comes from. The blocking is Tether's act and the measurement is Bitquery's, which marks it confirmed from its own reading of the chain. Tether itself has said nothing, and did not answer CoinDesk's request for comment. CoinDesk's report of 12 October 2026 carries Mark Karpeles's claim of an implant in a device bought at Singapore Airport, and its update calls the device "allegedly tampered with".

No arrest has been published, and Ledger has given no device count.

What Ledger did

Its largest internal investigation to date, with its Donjon security laboratory analysing the implant; devices bought and opened from shops, including in Germany, and warehouse samples examined, of which "Every unit examined was clean"; and a requirement that stock be handed over at the point of purchase.

Primary source

Ledger, "Ledger's Response to the Hardware Implant Attack", https://www.ledger.com/blog-response-hardware-implant-attack, 15 October 2026, read 15 October 2026, for the custom-built hidden components, the capture of the recovery phrase during setup, the absence of any flaw in the chip, operating system or servers, the clean examined units and the channel measures. Ledger's statements of 11 and 13 October 2026, and its statement of the Genuine Check limit, are quoted from Ravie Lakshmanan, The Hacker News, "Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports", https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html, read 15 October 2026, which carries them directly; Ledger's own posts of those dates were not read at the platform they were published on.

For the background and the cost: Ledger, "Ledger's Global Tour: Celebrating 10 Years of Secure Digital Ownership", https://www.ledger.com/ledgers-global-tour-celebrating-10-years-of-secure-digital-ownership, 14 November 2024, read 30 October 2026; Chainalysis, "North Korea Drives Record $2 Billion Crypto Theft Year, Pushing All-Time Total to $6.75 Billion", https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2026/, 18 December 2025, read 30 October 2026; CoinDesk, "Ledger says 'spy' chip inside CryptoBilis Ledger devices transmitted wallet keys over mobile network", https://www.coindesk.com/tech/2026/10/13/ledger-says-spy-chip-inside-cryptobilis-ledger-devices-transmitted-wallet-keys-over-mobile-network, 13 October 2026, read 30 October 2026; CoinDesk, "Ledger claims CryptoBilis cases are limited as up to $93 million is traced, $10 million frozen", https://www.coindesk.com/tech/2026/10/12/ledger-claims-cryptobilis-cases-are-limited-as-up-to-usd93m-is-traced-usd10m-frozen, 12 October 2026, read 30 October 2026, for Mark Karpeles's claim; Bitquery, "The Ledger CryptoBilis hack took $102.0M from 335 wallets. One thief had all the keys.", https://bitquery.io/investigations/ledger-cryptobilis-hack, 9 to 10 October 2026, updated 16 October 2026, read 30 October 2026.

For Tibane Labs' study, at second hand: ForkLog, "Ledger Investigates Potential Compromise of Wallets Sold by Reseller CryptoBilis", https://forklog.com/en/news/ledger-investigates-potential-compromise-of-wallets-sold-by-reseller-cryptobilis, 10 October 2026, read 31 October 2026, for the two units Tibane examined, where each was bought, the shipment from Malaysia, the several generations and the mass-produced elements of the later versions. Tibane Labs' own page, https://www.tibane.net/research/ledger-nano-x-implant, returned only the site's shell to automated retrieval on 31 October 2026 and was not read.

50. France, refrigeration controllers driven into defrost

Target

Internet-reachable refrigeration management controllers at supermarkets across France, in four product families: Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb.

Against what background

The first of two denominators is the finance minister's own. Telling Parliament that about 700 supermarkets were affected, Roland Lescure gave the base alongside it: some 10,000 supermarkets in France. The second is from ANSSI, France's national cybersecurity agency, whose panorama of the cyber threat for 2025, published 11 March 2026, records that the agency handled 3,586 security events across the whole year, of which 1,366 were incidents, a total down 18% on 2024.

Dates

Overnight 11 to 12 October 2026. CERT-FR, part of ANSSI, published its alert on 12 October 2026 and updated it on 13 October to add further targeted equipment. The Paris prosecutor's criminal investigation is open.

What was reached

The operational set-points of the controllers. The units were driven into prolonged defrost, and Les Mousquetaires states that its cabinets heated to as much as 50°C. Fresh and frozen stock was spoiled and discarded, and the Paris prosecutor's inquiry covers food losses and "the outbreak of fires".

Routes: four, and one on ANSSI's attribution

A controller received an instruction to change what it was holding, and acted on it, which is route four, obeyed: an automated system obeying an instruction it cannot trace to a decision. How the sender came to be able to send it is not established by any source: no vulnerability and no firmware version is confirmed, and nobody has claimed responsibility. CERT-FR's remedies include ensuring default passwords have been changed and setting the security level to Strict, and on 21 October ANSSI's director general, Vincent Strubel, attributed the loss of control to elementary failures of security and weak passwords, which points to a credential taken, route one, without establishing one at any store.

Driver: not established by the source
Figures

At least 300 Intermarché and Netto stores on AFP's count and about 150 on Reuters's; 80 of Coopérative U's 2,000; 80 Carrefour; about 30 Monoprix; several E.Leclerc. Thierry Cotillard, head of Les Mousquetaires, expects losses in the tens of millions of euros across France. Dominique Schelcher, chief executive of Coopérative U, states that the cold chain held in most of its affected stores and that only a minority lost goods. CERT-FR gives no count, saying only that it is aware of "nombreuses compromissions", numerous compromises.

What it cost

The Paris prosecutor's office opened an investigation into the large-scale cyberattack affecting the refrigerators of several major food retail chains across France, and said the probe will help identify the victims and establish the link with the damage they reported. CERT-FR's own alerts do not record the outbreaks of fire the prosecutor's office named.

Prime Minister Sébastien Lecornu ordered ANSSI to investigate, according to Reuters citing a person in his office.

Roland Lescure, the finance minister, told Parliament that about 700 supermarkets were affected and that there was no risk to France's food supplies, while stating that the attack touches the heart of the country's food security.

Coopérative U's chief executive Dominique Schelcher said teams were working with refrigeration specialists to restore normal operations as quickly as possible. Danfoss said it was aware of incidents in France affecting a limited number of refrigeration management systems and that the affected units were running outdated firmware; in a statement to franceinfo it said the majority of affected devices were obsolete products, among them the AK-SM 800 and AK-SC 355 systems, whose support has ended.

CERT-FR's alert records that it is aware of numerous compromises of the remote controllers, gives the risk field as not specified by the vendor, and states that attack campaigns are probably still under way against this equipment. It was updated on 13 October to add further targeted equipment and on 16 October to update its recommendations. It gives no count of affected organisations and no count of exposed controllers in France.

No arrest, no claim of responsibility, no final confirmed loss total, no fine and no regulatory enforcement has been published. Claims of a second wave driving refrigerators to 150 degrees circulate on low-quality French sites, appear in no primary source and in no quality journalism, and are supported by no CERT-FR alert; they are not used here.

Who pays is unsettled. Intermarché's position, reported from AFP, is that it expects insurance to be a sticking point because policies do not cover this type of incident; this register has not reached the AFP original. Retail Insight Network reports that insurance brokers told Reuters that cyber policies typically exclude physical losses, and states that cover for spoiled food depends on individual policy terms and the circumstances of the incident.

Vincent Strubel, ANSSI's director general, told the Senate's foreign affairs committee on 21 October 2026 that more than 700 French supermarkets, across E.Leclerc, Intermarché and Super U, had lost control of their refrigeration software, and attributed it to elementary failures of security and weak passwords.

Why this entry is in a document about the web

The controller is reachable over the internet, it holds a standing remote-management path, and it obeys a correctly formed instruction because obeying instructions is its function. That is the same property as a build pipeline running what it is handed, and the consequence is a warm freezer and, on the prosecutor's account, fires, rather than a stolen token. CERT-FR gives the remedy in its own words: "Maintenir une exposition Internet à un équipement sans correctif de sécurité (End of Life - EOL) est l'exposer à une très forte probabilité de compromission. N'effectuer qu'un Reset Factory est dans ce cas insuffisant, les persistances d'une instance compromise seront supprimées mais l'équipement restera vulnérable et sera certainement de nouveau compromis." Maintaining an internet exposure on equipment with no security patch exposes it to a very high probability of compromise; a factory reset alone is insufficient, because the persistence of a compromised instance will be removed but the equipment will remain vulnerable and will certainly be compromised again. That is France's national cybersecurity agency stating that for this equipment there is no patch to apply and no control to buy, and that the only remedy is to take it off the internet.

The equipment's own dates

Danfoss declared the AK-SM 800 End of Life in May 2021 in its own product note, and operates what it calls a hard End of Service policy for products that have reached End of Life; the AK-SC 355 is among the products that policy lists, and was phased out in 2016. The current AK-SM 800A was also among the units affected, running outdated firmware. A controller declared dead in May 2021 was still reachable from the internet in October 2026.

Primary source

CERT-FR, Agence nationale de la sécurité des systèmes d'information, alert CERTFR-2026-ALE-012, "Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération", https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012, first version 12 October 2026, last version 16 October 2026, read 15 and 30 October 2026, for the four product families, the numerous compromises, the instruction to remove internet exposure from every unit on a public address, the instruction to check the configuration and in particular the defrost ranges, and the End of Life passage quoted above. Danfoss, Cool Update, https://assets.danfoss.com/documents/latest/535265/AO540953778522en-010101.pdf, read 15 October 2026, in these words: "we are enforcing a hard End of Service (EoS) policy for legacy products that have already reached their End of Life (EoL), as previously announced" and "The AK SM 800 was officially declared End of Life in May 2021, as noted in the Product Note: System Manager Portfolio - Phase outs", with AK SC 355 among the listed products.

Secondary, and named

Swati Khandelwal, The Hacker News, "Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers", https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html, 13 October 2026, read 15 October 2026, for the store counts attributed to AFP and Reuters, the statements of Thierry Cotillard and Dominique Schelcher, the position of Vincent Strubel as head of ANSSI, and the AK-SM 800A running outdated firmware as reported by Cooling Post. The Paris prosecutor's office has published nothing of its own; its words are carried by France 24 and by CBS through AFP, both 12 October 2026, that an investigation has been opened into "the large-scale cyberattack affecting the refrigerators of several major food retail chains across France" and that the probe will help "identify the victims and establish the link with the damage they reported in terms of foodstuff losses and the outbreak of fires". Danfoss has published no statement of its own on the October 2026 incidents; the quotations attributed to it are its statements to Cooling Post and to franceinfo, and are marked as that.

For the background and the cost: Safecode, https://safecode.fr/cyberattaque-frigos-supermarches-danfoss-copeland-dixell/, 27 October 2026, read 30 October 2026; ComplexDiscovery OÜ, "Refrigeration hack affected about 700 French supermarkets, government says, as Danfoss interfaces stay online", https://complexdiscovery.com/refrigeration-hack-affected-about-700-french-supermarkets-government-says-as-danfoss-interfaces-stay-online/, 14 October 2026, read 30 October 2026; ANSSI, "Panorama de la cybermenace 2025", reference CERTFR-2026-CTI-002, https://cyber.gouv.fr/nous-connaitre/publications/panoramas-de-la-cybermenace/panorama-de-la-cybermenace-2025/ and the report PDF https://cert.cyber.gouv.fr/uploads/CERTFR-2026-CTI-002.pdf, 11 March 2026, read 30 October 2026; Reuters, via Boursorama, https://www.boursorama.com/actualite-economique/actualites/france-des-refrigerateurs-de-centaines-de-supermarches-deregles-par-une-cyberattaque-aa227efdd150921f52bf52fc945408a0, 12 October 2026, read 30 October 2026; Al Jazeera with AFP and Reuters, "Hundreds of supermarkets in France hit by 'unprecedented' cyberattack", https://www.aljazeera.com/news/2026/10/13/unprecedented-cyberattack-hits-french-supermarkets-causing-food-losses, 13 October 2026, read 30 October 2026; The Hack Academy, "France confirms broad refrigeration controller compromises as fire causation stays unproven", https://www.thehackacademy.com/cert-fr-refrigeration-controller-compromises.htm, 13 October 2026, read 30 October 2026; CERT-FR, "Bulletin d'actualité CERTFR-2026-ACT-044", https://cert.cyber.gouv.fr/actualite/CERTFR-2026-ACT-044/, 19 October 2026, read 30 October 2026; Public Sénat, https://www.publicsenat.fr/actualites/politique/des-defauts-de-securisation-elementaire-et-des-mots-de-passe-faibles-ont-permis-la-cyberattaque-contre-les-frigos-de-supermarches, 21 October 2026, updated 22 October 2026, read 30 October 2026; Mohamed Dabo, Retail Insight Network, "French supermarket cyberattack exposes insurance and cold-chain risks", https://www.retail-insight-network.com/features/french-supermarket-cyberattack-exposes-insurance-and-cold-chain-risks/, 19 October 2026, read 30 October 2026.

51. Cysic, a bridge that minted ten million tokens on a forged message

Target

Cysic's cross-chain bridge between Cysic Mainnet and BNB Smart Chain, which issues on one chain what it is told was locked on the other, and the CYS token contract on BNB Smart Chain. Operated by the Cysic Foundation, a decentralised-compute project.

Against what background

No figure exists for an exposed population, because the bridge was Cysic's own rather than a shared component that others ran. The token's own numbers give the scale: CYS has a maximum supply of one billion, and about 160.8 million were in circulation after its token generation event, so ten million minted in one message came to more than 6% of everything in circulation.

Dates

The mint ran at 12:31:38 UTC on 17 October 2026. The attacker sold from 12:36 to 12:41 and again from 12:57 to 12:59 UTC. Cysic blacklisted the receiving address at 13:47:52 UTC, seventy-six minutes after the mint. It disclosed on 18 October 2026 and updated on 22, 23, 28 and 29 October.

What was reached

The bridge's message-processing and minting function, and through it the supply of CYS on BNB Smart Chain. A forged mint message went through the bridge's processing and created ten million tokens out of nothing. Cysic's position is that the reach stopped there: its mainnet was not affected and existing user-held assets were not taken.

Routes: four and five, on the company's preliminary account, and the entry is not established

Cysic's preliminary finding is that the attacker "gained unauthorized access to a database used by services supporting the bridge" and "exploited a vulnerability in the relevant processing logic to submit a fraudulent mint message", and Cysic said the incident was confined to the bridge's message-processing and minting functions; in CryptoTicker's rendering of Cysic's report the forged instruction bypassed the bridge's processing check. The mint went out through the bridge's own relayer, the automated account that submits each cross-chain transfer to the bridge contract for execution. The sending address, 0x373f11B24a5B163DA54900342c438A01e0143944, carries 18,713 transactions; between 1 and 17 October it sent 286 calls to the withdraw function of the bridge contract 0x1ab77F94a46782c203b427b0aa5e6801870239fA, the mint the last of them, and it has sent nothing since. PublicAML's reading is the same: the address "is the relayer that signs every ordinary withdrawal from the bridge", and "It received the forged instruction and executed it like any other". The mint was a withdraw call at 12:31:38 UTC naming the CYS token, the receiving address 0xA4e1827Fe2664fD0797a55e442b2e2639449C255, ten million tokens, a deposit identifier and source chain 4399, and carrying a signature with the indices of four signers, numbered 0, 1, 3 and 4. Cysic has not said how the database was reached or what the root cause was. - Four, obeyed. The bridge's own relayer took a mint instruction that traced to no deposit and no decision and acted on it, as it had acted on the 285 withdrawals it had carried since 1 October. - Five, believed. The relayer signed the transaction with the bridge's own key, the chain verified that signature, and the bridge contract executed a call carrying the signatures of four of the bridge's own signers. What those signatures established was that the bridge's own keys had signed, never that anything had been deposited to justify the mint.

Driver: human with no model involved

Cysic describes unauthorised access to a database and a forged mint message, and names no model.

Figures

Ten million CYS minted, on Cysic's report and independently on BscScan, which shows a single transfer of that amount from the null address, the form a mint takes in the chain record. About 7.2 million sold before the blacklist, in 26 transfers across 15 transactions: 5.65 million for about 588,315 Tether dollars and 1.55 million for about 220 BNB. About 2.8 million frozen at the blacklist. About 306.6 ether bridged out to Ethereum, which The Block valued at roughly $727,000 at its own price. Cysic says the minted token count does not by itself represent the final loss in dollar terms.

What it cost

The bridge was suspended from 17 October and fully restored on 29 October, twelve days. Cysic permanently burned 7,200,002 CYS on BNB Smart Chain to bring the supply back into line, which absorbs the dilution and recovers none of the ether. The blacklist sat in the CYS token contract and reached only CYS, so it did nothing to the ether already gone.

On 22 October Cysic offered the attacker a 10% bounty: return 275.872 ether within 72 hours and keep 30.652. The attacker declined. On 23 October PeckShield traced 300 ether and 30.4 BNB, about $744,000, into Tornado Cash, the mixing service, leaving $45 in the attacker's wallet on Arkham's reading.

No regulatory action, fine, claim or arrest has been published, and no reimbursement arose, because Cysic's position is that no user assets were taken. Cysic has not published the follow-up report on verified losses that it promised, nor a dollar loss figure, nor a confirmed root cause, and it did not answer Cointelegraph's question about recovery.

What this establishes

A bridge exists to issue on one chain what it is told was locked on another, and here it issued ten million tokens on a message it was given. The seventy-six minutes between the mint and the freeze was the whole of the defence, and by the time it closed the money had already crossed to a chain the freeze could not follow it onto.

Primary source

Cysic Foundation, incident report published on X on 18 October 2026 at https://x.com/cysic_fdn/status/2111761749116637687, and its update of 29 October 2026 at https://x.com/cysic_xyz/status/2115817873780215847. Both were published on X rather than on the company's own site, and neither page serves to automated retrieval, so the report's wording is taken from its verbatim reproduction by The Block, Crypto Briefing and CoinMarketCap Academy below, and the update's from KuCoin's reproduction at https://www.kucoin.com/news/community/CYS/6ae39f6cbbcb5200074513f0, read 30 October 2026. BscScan, transaction 0x8de43ba77f9a14ecff1268acb9d7c9bf3afe1f2a45bd8d8681d824a2460000f6, https://bscscan.com/tx/0x8de43ba77f9a14ecff1268acb9d7c9bf3afe1f2a45bd8d8681d824a2460000f6, read 30 October 2026, for the block, the time, the sending address, the contract called, the transfer from the null address, and the input data of the withdraw call with its parameters. BscScan, the sending address, https://bscscan.com/address/0x373f11b24a5b163da54900342c438a01e0143944, read 30 October 2026 with an export of its transactions from 1 to 17 October 2026, for the 18,713 transactions, the 286 withdraw calls to the bridge contract and the absence of any transaction since the mint.

Secondary

Zack Abrams, The Block, "Cysic suspends bridge after attacker mints tokens and moves $727,000 to Ethereum", https://www.theblock.co/news/defi/2026-10-18-cysic-suspends-bridge-after-attacker-mints-tokens-and-moves-727000-to-ethereum-418863, 18 October 2026, updated 19 October, read 30 October 2026, for the minute-by-minute flow from its own review of the chain explorers, and for the $727,000 valuation. Estefano Gomez, Crypto Briefing, "Cysic halts crypto bridge after unauthorized mint of 10M CYS", https://cryptobriefing.com/cysic-halts-bridge-unauthorized-cys-mint/, 18 October 2026, read 30 October 2026, for the exact timestamps, the circulating supply, and the mechanism as preliminary. Zoltan Vardai, Cointelegraph, "Cysic dangles a 10% bounty, hacker pours loot into Tornado Cash", https://cointelegraph.com/news/cysic-exploiter-eth-tornado-cash-white-hat-offer, 23 October 2026, read 30 October 2026, for the bounty terms, PeckShield's finding and the Arkham balance. Ayesha Aziz, CoinMarketCap Academy, https://coinmarketcap.com/academy/article/cysic-bridge-exploit-10-million-cys-unauthorized-minting, undated on the page, read 30 October 2026, for the null-address mint in the chain record. Lisa Weber, CryptoTicker, "Cysic stoppt die Bridge: 10 Millionen CYS ohne Deckung, 6,22 Prozent mehr Umlauf", https://cryptoticker.io/de/cysic-bridge-unautorisierter-mint/, 19 October 2026, updated 22 October 2026, read 30 October 2026, for its rendering of Cysic's report that the forged mint instruction bypassed the check. Michael Millard, Cointelegraph, "Cysic crypto bridge halted after unauthorized mint of 10M CYS", https://cointelegraph.com/news/cysic-crypto-bridge-halted-after-unauthorized-mint-of-10m-cys, 18 October 2026, read 30 October 2026, for Cysic's statement that the incident was limited to bridge message processing and minting. PublicAML, analysis of the Cysic bridge exploit, https://publicaml.org/cysic-bridge-exploit/, 19 October 2026, read 30 October 2026, for its reading that the sending address is the relayer that signs the bridge's ordinary withdrawals.

52. GMO Internet, a trading desktop service and twenty-six thousand servers

Target

Onamae.com Desktop Cloud, a virtualised desktop service operated by GMO Internet, Inc., part of GMO Internet Group, and marketed for running MetaTrader trading tools around the clock. Its customers are retail traders, whose desktops held the logins to their accounts at securities and foreign exchange firms.

Against what background

GMO's own figure is the only one: 26,739 servers across every plan of the service, which GMO describes as the number that may be affected. That is the size of the service and not a count of confirmed intrusions. In the same days GMO's own security subsidiary, GMO Cybersecurity by Ierae, announced on 19 October that it had found ARTEX, a Chinese-built AI-driven penetration-testing system, in attack infrastructure aimed at about twenty companies mainly in Japan, with six further AI-powered attack infrastructures alongside it. GMO has not linked ARTEX to this breach, and this register does not either.

Dates

The start of the intrusion has not been disclosed. GMO began investigating on 19 October 2026 after customer inquiries, confirmed on 20 October that a malicious program had been installed, and shut customer servers from four in the morning Japan time on 21 October. Its first report went out that day. The series has run to at least a sixteenth report on 29 October, with a customer information page on 30 October and three disclosure notices to the Tokyo Stock Exchange.

What was reached

GMO's own findings, in its words: a malicious program had been installed by a third party in the server environments of some customers; the service's systems had security vulnerabilities; the environment was accessed without authorisation; and a third party may have obtained the trading account login information saved in customers' trading tools. GMO later confirmed that the information of people who had accessed a particular site had been obtained by the perpetrators.

Route: one, very likely, after an entry nobody has described

Across sixteen reports and three disclosures to the Tokyo Stock Exchange GMO has not said how the intruder got in. Its disclosure of 23 October says only that a security firm is investigating the point of intrusion and the scope of the impact. That the service had security vulnerabilities is the closest GMO comes, and it names no vulnerability and no route. What followed is very likely route one, taken. The trading logins on the servers are what carries authority over the accounts: GMO's own findings put a malicious program in the server environments where customers' trading tools kept them, GMO says a third party may have obtained them, and customers have reported trades they did not place. That cannot be certain until GMO establishes it, and the entry is counted as route one on the strength of what GMO has found.

Driver: not established by the source

GMO describes what was installed and what was reached, and has not said how the intruder got in or who ran the operation, so no driver is marked. No AI model is named in any GMO notice on this incident. The ARTEX finding is GMO's own, about other companies, and GMO has not linked it to this one.

Figures

26,739 servers that may be affected, GMO's own figure for the scope of the service. A ransom demand of about ¥8 billion, about $50 million, received on 21 October and recorded in GMO's own timeline. A list of more than seventy securities and foreign exchange firms is the attacker's, recited by GMO among the attacker's threats; GMO has not verified it. Some customers have reported transactions in their trading accounts that they do not recognise. GMO publishes no count of confirmed unauthorised trades, of accounts, or of losses.

What it cost

The service has been down since four in the morning on 21 October, every plan, with new applications and the control panel suspended too, and on 30 October its return was still undetermined. That is nine days and running.

GMO refused the ransom and said it would never comply, on the ground that payment guarantees neither deletion nor non-misuse. The attackers published material on 27 October; GMO confirmed the publication at half past twelve, saying it had not verified the contents and that they might be inconsistent with the facts; the attackers' site was confirmed down at eleven the next morning.

GMO has committed money in its own name: a flat ¥5,000 goodwill payment to every current customer regardless of loss; a further ¥10,000 to ¥25,000 for each category of a customer's information that was published, capped at ¥3 million per disclosure; compensation for realised trading losses and fees on transactions GMO itself recognises as unauthorised, with market losses and lost profit excluded; six months of an alternative service free; replacement computers of equivalent performance for customers hit by ransomware; and a bounty of up to $1 million, paid by GMO Internet Group, for information on the perpetrators. GMO told the stock exchange on 23 October that it cannot quantify the impact on its results, and on 28 October that the totals cannot yet be calculated.

GMO consulted the police on 22 October and on 24 October asked the relevant government agencies to apply active cyber defence. No regulator is named in any notice, and no fine, claim or arrest has been published. A GMO spokesperson did not answer TechCrunch.

What this establishes

The service was sold as a place to keep a trading terminal running, so what it held was not data but standing logins to accounts at firms GMO does not run. Nine days on, GMO has not said how anybody got in, and has set a price for each category of customer information the attacker chose to publish.

Primary source

GMO Internet, Inc., numbered reports on unauthorised access to Onamae.com Desktop Cloud, read 30 October 2026: the first, 21 October 2026, https://internet.gmo/en/news/article/246/; the second, 22 October, https://internet.gmo/en/news/article/247/; the third, 23 October, https://internet.gmo/en/news/article/248/; the fourth, 24 October, https://internet.gmo/en/news/article/249/; the sixth, 26 October, https://internet.gmo/en/news/article/252/; the ninth, 27 October, https://internet.gmo/en/news/article/255/; the tenth, 27 October, https://internet.gmo/en/news/article/256/; the twelfth, 27 October, https://internet.gmo/en/news/article/258/; the fifteenth, 29 October, https://internet.gmo/en/news/article/261/; the sixteenth, 29 October, https://internet.gmo/en/news/article/262/; and the customer information page of 30 October, https://internet.gmo/en/news/article/263/. GMO Internet Group, disclosure notices to the Tokyo Stock Exchange of 23 October 2026, https://internet.gmo/en/ir/pdf/irlibrary/gmointernet_e_disclose_20261023.pdf, and 28 October 2026, https://internet.gmo/en/ir/pdf/irlibrary/gmointernet_e_disclose_20261028.pdf, read 30 October 2026. The Japanese originals did not serve to automated retrieval and the wording here is GMO's own English.

Secondary

Kate Park, TechCrunch, "Japan internet giant GMO says hackers posted stolen customer data", https://techcrunch.com/2026/10/27/japan-internet-giant-gmo-says-hackers-posted-stolen-customer-data/, 27 October 2026, read 30 October 2026, for the ARTEX finding and its statement that GMO has not linked it to this breach. Bill Toulas, BleepingComputer, "Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected", https://bleepingcomputer.com/news/security/japans-onamae-desktop-cloud-hacked-up-to-27-000-servers-affected, 21 October 2026, read 30 October 2026.

53. LiteLLM, a release built from a fork on an owner's token read out of a log

Target

LiteLLM, an open-source gateway that sits between applications and the providers of language models, maintained by BerriAI, and every estate that installed its version 1.107.0 from the Python package index, Docker Hub or GitHub's container registry.

Against what background

This is the second poisoning of the same project in seven months. In March 2026 two poisoned LiteLLM releases sat on the Python package index for about forty minutes as part of the campaign at entry 21, and LiteLLM hardened its release pipeline afterwards. Socket, quoted by The Hacker News, says the public evidence does not establish a connection between the two attacks; the resemblance is in technique and nowhere else.

Dates

An administrative key was committed to a public repository on 27 May 2026, deleted from the working tree about three hours later, left in public history until 22 October, and never revoked. It was used on 10 October between 21:13 and 21:28 UTC, and repository secrets were taken on 10 and 12 October. The poisoned release ran on 21 October: the rewritten workflow was pushed at 10:08 UTC, built against a lookalike fork at 10:46, approved for production at 11:11, published to the package index from 11:39 to 11:40 and to the container registries at 11:46; the run records were deleted from 11:53 and the published history overwritten with a force-push from 12:09. An outside researcher raised the alarm at 12:06, the package index quarantined the release at 13:23, and the container tags were gone by 14:20. LiteLLM disclosed the same evening and published its root cause analysis on 23 October.

What was reached

Owner-level authority over the project's GitHub organisation: branch protection overridden, the release workflow rewritten to build from an attacker's fork, the production release gate approved, published history rewritten and the audit records deleted. Downstream, on every host that installed the package: the instance or task cloud role, every provider key held in the gateway's database including master keys, the database password, and any secret in the environment of any process on the host.

Routes: one, four and five
  • One, taken. An administrative key for an internal LiteLLM agent platform was committed to a public repository and never revoked. On 10 October the attacker used it to query that platform, and a response came back carrying a GitHub organisation owner's command-line OAuth token. LiteLLM, in a follow-up quoted by Wiz, says the token was there because Claude Code embeds a user's GitHub command-line OAuth token into a response body; the root cause analysis itself does not name the tool. Two maintainers' tokens were then harvested as repository secrets by workflows that posted them to an outside service.
  • Four, obeyed. The release workflow, rewritten to build from Berri-AI/litellm rather than the genuine BerriAI/litellm, built and published what it was told to. The official 1.107.0 source tag never contained the malicious files.
  • Five, believed. Branch protection, the release gate and the audit log each ran and each proved only that a valid token had been presented, never that a maintainer had decided to ship. The root cause analysis records that GitHub's command-line OAuth tokens are unscoped and exempt from the further two-factor challenge applied to sensitive actions, so the strongest credential in the organisation was the one with the fewest conditions on its use. LiteLLM's own reading is that separate tokens were likely used to evade detection in the audit log.
Driver: not established, with the payload's machine-aided authorship suggested by Wiz

No source names a model as the operator, and nobody has attributed the attack. Wiz reads strong indications of development aided by a language model in the payload's code, from verbose names, generic error handling and a module defined and never called, and says its structure suggests iterative prompting. That is a reading of the malware's style and not an observation of the attacker's tools.

Figures

Seven trojanised wheels, the packaged form in which Python code is published, and eight container images. About 49,000 downloads of the malicious version, which Wiz takes from ClickPy's dataset of package index download statistics; it is a download count and not a count of installations or victims, and LiteLLM has published none. Live on the package index from 11:39:51 to 13:23 UTC and in the container registries until 14:20. The key sat in public history for 148 days.

What it cost

Nothing has been published: no outage, no money lost, no ransom, no regulatory action, no fine, no claim, no arrest and no notification count. No downstream organisation has been named or has disclosed. The package index gave no statement.

Wiz observed attackers testing cloud role credentials harvested from build runners and cluster nodes about four and a half hours after exfiltration, which it describes as consistent with the theft of cloud credentials to run language models at the victim's expense.

LiteLLM's published response is to pin to 1.106.2 or earlier; not to reinstall on an affected host, because that reruns the payload; to delete the implanted files from every package directory; to rebuild images and environments from scratch; to assume exfiltration succeeded wherever the version ran with outbound internet access; and to rotate every credential the host could reach. It is revoking every token tied to its internal systems and vendor platforms. In its own words, the incident provided a strong illustration of the risks associated with failing to rotate a potentially exposed key.

What this establishes

The owner's token was found in an AI gateway's logged traffic, put there by a developer tool, unscoped and exempt from the second factor. Every check the project added after March ran and passed, because each was asked whether a valid token had been presented and none was asked whether anybody had decided to ship.

Primary source

LiteLLM, Oliver Jensen and Mateo Wang, "The attack chain behind the v1.107.0 LiteLLM release", https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain, 23 October 2026, read 30 October 2026, the project's root cause analysis and its own canonical account. LiteLLM, Krrish Dholakia, Ishaan Jaffer, Oliver Jensen and Nate Armstrong, "Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised", https://docs.litellm.ai/blog/security-incident-oct-21-2026, 21 October 2026, updated 21 and 23 October, read 30 October 2026, for the reference to the March incident; where the two differ the attack chain post governs. Wiz, Benjamin Read and Rami McCarthy, "LiteLLM Compromised, Steals Credentials", https://www.wiz.io/blog/litellm-compromised-steals-credentials, 21 October 2026, updated to 22 October, read 30 October 2026, for the payload, the download figure, the post-exploitation and the quotation on Claude Code.

Secondary

Jessica Lyons, The Register, "LiteLLM supply chain attack started with an exposed master key", https://www.theregister.com/security/2026/10/26/litellm-supply-chain-attack-started-with-an-exposed-master-key/5305544, 26 October 2026, read 30 October 2026. Ravie Lakshmanan, The Hacker News, "LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release", https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html, 22 October 2026, read 30 October 2026, for Socket's finding on the March link.

54. Palo Alto PAN-OS management interfaces, rooted through PHP2Shell

Target

Internet-exposed management interfaces of Palo Alto Networks PAN-OS firewalls in the United States, Japan, Taiwan and South Korea. Two of the rooted firewalls, rooted meaning the attacker had full control of the machine, and one internal firewall management server sat in the estate of an organisation that Dream Research does not name and describes only as United States government-affiliated, on indicators including Common Access Card authentication and government-style asset naming.

Against what background

Palo Alto Networks puts the impact at approximately 0.02% of its global installed base, being the customers whose management interfaces were configured to face the internet, and says each was contacted individually. It publishes no count. The attacker began from about 19,000 internet-facing PAN-OS firewalls fingerprinted through FOFA, a Chinese search engine for exposed devices, of which about 5,000 gave up their version and 240 survived filtering to four countries and the vulnerable versions.

Dates

Setup began on 8 October 2026. The first firewall was rooted at 18:14 UTC on 23 October and crashed shortly afterwards. The second was rooted at 10:09 UTC on 24 October, and the internal management server at 11:35 UTC the same day, under ninety minutes later. The PHP flaws had been made public on 21 October, two days before the first root. Dream published on 26 October and updated on 29 October.

What was reached

Root on twenty-five servers on Dream's count. On twenty-two of twenty-four firewalls the attacker planted a web shell, a program on a web server that lets an intruder run commands on it, and did nothing further; Dream's words are that they were effectively owned and parked. Through the two in the government-affiliated estate, an eight-port reverse SSH tunnel into the internal network, an encrypted connection the compromised machine opens out to the intruder, kept alive by a system service, reaching the domain controllers, the servers that decide who may log in across an organisation's network, as well as the management server, the remote-access infrastructure and a proxy; root on the internal management server through that tunnel; and private keys taken from the firewall filesystem. Dream confirms the decryption of a directory service account password and a full enumeration of users and groups. It lists password spraying, backdoor accounts in the directory and the extraction of a single sign-on signing key as unverified, because their results were not recovered.

Routes: no route at entry, then one

Nothing authenticated before root. PHP2Shell is two unauthenticated remote code execution flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, made public by Wiz on 21 October. PAN-OS management interfaces run PHP, so an interface reachable from the internet was reachable as a PHP application. The attacker chained the two to a flaw in the Linux kernel, CVE-2026-46300, to run commands as root, and CISA, America's Cybersecurity and Infrastructure Security Agency, states in its own catalogue entry for the kernel flaw that it can be chained with the two PHP flaws to implant web shells and run commands as root. Route one, a credential taken, begins after root, with the directory service password decrypted off a device the attacker already owned. Dream calls the exploit it recovered a custom, non-public build and not a copy of any known public exploit.

Driver: not established by the source, with AI tools found on the attacker's infrastructure

Dream found that Anthropic's Claude Code "had been installed" on the attack infrastructure, and that an AI-powered offensive security platform named aiscan "was configured with Chinese LLMs DeepSeek and Kimi", its session logs carrying user messages in Chinese. Dream names no model behind Claude Code and no account, key or log for it, shows neither tool in use against these targets, and does not say whether DeepSeek and Kimi ran on the attacker's own machines. In its own words it has "no direct evidence that the AI tools were specifically used to write the exploit or the post-exploitation scripts"; the structure, commenting style and consistency of about forty scripts "suggest AI-assisted development"; and the operation "does not appear to be a fully autonomous nation-state attack". This is a vendor's reading of the attacker's own recovered files, and Palo Alto Networks Unit 42, which verified the same tooling, says nothing about AI.

Figures

Twenty-five servers rooted, being twenty-four firewalls and one internal management server on Dream's count, which does not reconcile with its own statement that the second firewall had timed out during the original batch. About forty post-exploitation scripts recovered. The National Vulnerability Database scores CVE-2026-109618 at 9.8 and CVE-2026-109619 at 8.1. CVE-2026-46300 scores 7.8 and is a local flaw, so an escalation rather than a way in, and it was first published on 23 May 2026.

What it cost

Almost nothing has been published. The government-affiliated organisation has not been named and has said nothing. CISA and the FBI both declined to comment to The Register. Palo Alto contacted affected customers individually and published no count. No money lost, ransom, regulatory action, fine, claim, arrest or notification has been published. The first firewall crashed and never came back, which is collateral from the attack rather than a reported outage. On Dream's assessment the tunnel into the government-affiliated estate and the web shells are likely still active.

CISA added the two PHP flaws to its catalogue of exploited vulnerabilities on 26 October with a three-day due date, and on 28 October added the kernel flaw that supplied root, five months after it was first published and after it had been used.

Palo Alto's mitigation is to restrict management access to a jump host or to trusted internal addresses. Unit 42 states that it has independently verified the same attacker's tooling and confirmed the reported results. On 25 October Unit 42 also withdrew an earlier update describing agentic AI activity in a different incident, against a European government agency, saying it was unable to confirm that initial access was associated with these flaws; that withdrawn material is not used here.

What this establishes

Two days separated the public disclosure of a flaw from root on a government-affiliated estate, and the intrusion came to light two days after the act because a researcher recovered the attacker's own files, not because anybody detected it. Entry 13 is the same product and the same route structure through an unrelated flaw five months earlier.

Attribution

Dream says multiple indicators point to a Chinese-nexus operation and that it does not attribute the activity to a named actor. Its indicators are an infrastructure clock running on China Standard Time, the search engine keys and the Chinese models. Dream reports that Unit 42 tracks the activity as CL-UNK-1280 and attributes it to a Chinese-speaking attacker in the UTC+8 time zone; no Palo Alto page read carries that designation, so it stands as Dream's report of Unit 42's tracking. No government has attributed the operation. Separately, CYFIRMA assesses at moderate confidence that scanning of 216 PHP2Shell targets is linked to North Korea, which is scanning and not this campaign.

Primary source

Dream Research, "Chained PHP2Shell Exploit Roots 25 Servers, including US Government Servers", https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers, 26 October 2026, updated 29 October 2026, read 30 October 2026. Palo Alto Networks, "CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products", https://security.paloaltonetworks.com/CVE-2026-109618, 21 October 2026, updated 29 October 2026, read 30 October 2026, which states in its own words that active exploitation has been observed targeting the management interface exposed to the internet. Unit 42, "Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)", https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/, read 30 October 2026, for the independent verification, the installed-base figure and the withdrawal of 25 October. CISA, Known Exploited Vulnerabilities catalogue, version 2026.10.29 released 29 October 2026, read as data at https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json on 30 October 2026, for the dates added, the due dates and the catalogue's own description of the chain. Wiz Research, "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet", https://www.wiz.io/blog/php2shell-php-rce, 21 October 2026, read 30 October 2026, for the disclosure; Wiz reported no exploitation in the wild when it published, and the figure in its headline is not used here.

Secondary

Jessica Lyons, The Register, "Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers", https://www.theregister.com/security/2026/10/29/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers/5306456, 29 October 2026, read 30 October 2026, for the declines to comment by CISA and the FBI. Ravie Lakshmanan, The Hacker News, "PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity", https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html, 25 October 2026, read 30 October 2026, for CYFIRMA's attribution.

55. Cursor, a tampered Claude Code extension shipped as an update

Target

Cursor's extension marketplace, and the developer machines of users who received from it modified builds of Anthropic's Claude Code extension, extension ID Anthropic.claude-code. Cursor is an AI coding environment made by Anysphere, Inc., which SpaceX acquired in August 2026.

Against what background

Cursor's own figure is the only one: at most 5,000 users, which is an upper bound on exposure and not a count of installations. No install base for the extension and no share of Cursor's users has been published.

Dates

Modified builds, versions 2.1.312 and 2.1.313 for Windows and macOS, were available in the marketplace from about 02:27 to 13:35 Pacific time on 29 October 2026, about eleven hours. Cursor published its notice the same day and named both versions in an update at 11:30 Pacific time on 30 October.

What was reached

Publishing authority over a trusted extension in Cursor's marketplace, and through it a foothold on each machine that took the update. On activation the build collected host and user details and attempted to add an attacker's SSH key, the key one machine uses to log in to another, to the user's authorised keys, enable SSH, open a reverse tunnel, install persistence and report to an attacker's server. Cursor states that, outside highly unusual circumstances where Cursor was started with administrator privileges, errors in the malicious code made the SSH step fail; that turning on the local SSH service needs administrator rights the extension does not have on most macOS and Windows hosts, so that there the attacker could not have logged in through the tunnel; and that the extension still adds the attacker's key, installs persistence and sends the host details.

Routes: two and four, and the entry is not established

How the builds came to be published is not established by anybody that I have found. Anthropic says, through Felix Rieseberg on X, that "it wasn't a compromise of Anthropic's systems or employee laptops" and that "A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish", and nobody has said how that access was obtained. Cursor says the two versions "were not developed by Anthropic", that they were made available in its marketplace, that it rotated its keys and rebuilt the marketplace, and that its audit found no other extension tampered with; it does not say which keys, or how the builds got in. Cursor serves third-party extensions from the Open VSX registry through its own marketplace proxy and says that "Before an extension is shown in search or served as a download, Cursor runs automated malware and supply-chain analysis using commercial security tooling"; nobody has said whether the tampered builds went through that analysis or were placed behind it. Anthropic says "this only impacts Cursor users", Socket found no publication of 2.1.313 on Open VSX, and Phorion, whose researcher found the backdoor, places it there. Anthropic's own changelog lists versions 2.1.312 and 2.1.314 and no 2.1.313, so one tampered build carried the number of a genuine release and the other a number Anthropic never released. - Four, obeyed. The malicious loader was prepended to the extension's bundle so that it ran the moment Cursor loaded the file, before the extension's normal start, with no action by the user. - Two, granted. An attacker's key written into a machine's authorised keys is a credential that machine now issues to the attacker, to log in and act, and Cursor states that the key was added even where the rest of the backdoor failed.

Driver: human with no model involved

Cursor and Anthropic describe builds published through Cursor's marketplace and what they did on each machine, and name no model. The target was AI coding tooling.

Figures

At most 5,000 users, Cursor's own upper bound. About eleven hours live. Two versions, 2.1.312 and 2.1.313, for Windows and macOS. What the build collected was the public address, hostname, local username, operating system and processor, home and working directories, the global Git email, and the names but not the values of up to forty environment variables whose names suggested keys, tokens, secrets, passwords or cloud credentials. Persistence ran as a macOS launch agent, a Linux scheduled job, and a Windows scheduled task named SysMon with a Startup-folder fallback.

What it cost

Cursor shut its extension marketplace, audited access, rotated keys, rebuilt the marketplace and restored it, and the attacker's server was taken offline with its hosting provider. No duration for the shutdown has been published. Cursor says it will contact affected users directly, and warns that uninstalling the extension does not remove what it installed. Anthropic published version 2.1.314 to the other marketplaces that carry the extension. Its statement on the incident is Felix Rieseberg's, on X on 30 October, that Anthropic is working with Cursor and that "The versions on our official channels are not affected and this only impacts Cursor users". No money lost, ransom, regulatory action, fine, claim or arrest has been published. The researchers who analysed the build note that the names of environment variables alone reveal which cloud providers and credential types a machine is set up for, and no follow-on payload has been observed.

What this establishes

Cursor did what an editor is built to do with an update to an extension it already trusts, and the update installed a key the attacker meant to log in with. Nothing was guessed, phished or broken on the developer's machine. The machine was told to accept the attacker, by the channel it is built to believe.

Primary source

Cursor, security notice on the malicious versions of Anthropic.claude-code in the Cursor VS Code Extension Marketplace, https://cursor.com/blog/claude-code-extension-security-notice, 29 October 2026, updated 30 October 2026 at 11:30 Pacific time, read 30 October 2026, for the window, the two versions, the upper bound, the actions, the tunnel's failure, the remediation and the indicators. Anthropic, Claude Code changelog, https://raw.githubusercontent.com/anthropics/claude-code/main/CHANGELOG.md, read 30 October 2026, which lists 2.1.312 and 2.1.314 and not 2.1.313. Felix Rieseberg, for Anthropic, post on X, https://x.com/felixrieseberg/status/2116170451466543578, 30 October 2026 at 14:08 UTC, read at source 30 October 2026, for Anthropic's statement, quoting Cursor's own post of the same day that the modified extension, "accessed through our Cursor IDE extension marketplace", impacted "at most 5,000 users" and "was not developed by Anthropic".

Secondary

Ravie Lakshmanan, The Hacker News, "Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor", https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html, 30 October 2026, read 30 October 2026, for the legitimate extension ID and its correction tracing the incident to Cursor's marketplace and not to the Open VSX registry. Sinisa Markovic, Help Net Security, "Claude Code extension poisoned with persistent SSH backdoor", https://www.helpnetsecurity.com/2026/10/30/claude-code-extension-ssh-backdoor/, 30 October 2026, read 30 October 2026, crediting the analysis to Phorion; it places the malicious version on Open VSX, the primary source names only Cursor's marketplace, and this register follows the primary. Berry Zwets, Techzine Global, "SpaceX completes acquisition of Cursor", https://www.techzine.eu/news/devops/143619/spacex-completes-acquisition-of-cursor/, 14 August 2026, read 30 October 2026, for the ownership. Cursor, help page on extensions, https://cursor.com/help/customization/extensions, undated, read 30 October 2026, for the marketplace proxy, the malware and supply-chain analysis run before an extension is shown or served, and signature verification as an install control a team may require. Socket Research Team, analysis of the Claude Code extension compromise, https://socket.dev/blog/claude-code-extension-compromise, 30 October 2026, read 30 October 2026, for its finding of no publication of 2.1.313 on Open VSX or npm. Calum Hall, Phorion, "Official Claude Code Extension Compromise: Security Advisory", https://phorion.io/blog/offical-claude-code-vsx-compromise/, 30 October 2026, read 30 October 2026, the researcher's own advisory, which places the backdoored bundle on Open VSX.

56. Polymarket, drained through the sessions its users were already logged into

Target

Polymarket, the prediction market, on its international platform at polymarket.com, and the deposit wallets and open positions of its logged-in users. DebugBear, a United Kingdom website-performance vendor whose monitoring script Polymarket embedded, is a second victim.

Against what background

No figure exists for how many sites embed DebugBear's monitoring script, and DebugBear has published none. The nearest base rate is Polymarket's own recurrence: about $700,000 lost in May 2026, and about $3 million from fewer than fifteen accounts in a separate exploit of its web front end in June.

Dates

29 October 2026. DebugBear's origin, its own server, stopped answering at 16:54:57 UTC, which the researcher who took the script apart treats as the moment the drainer, a script that empties the wallets it reaches, began to run in logged-in sessions; the first proceeds reached the attacker at 17:10:23 and the last position tokens at 18:02:17. Polymarket's build removing the script is timestamped 17:59:20 UTC, and its status page showed the actions of its relayer, the service that submits transactions on a user's behalf, paused at 18:05. DebugBear posted its notice at 18:00:58 UTC, and Polymarket acknowledged the incident that afternoon.

What was reached

The live, already authenticated trading session in each victim's own browser, and through it the deposit wallet and open positions. The script read the three items Polymarket keeps in the browser for a logged-in user: the login parameters, the deposit wallet address, and the trading interface credentials. Polymarket's smart contracts, its programs stored on a public blockchain, were not touched.

Routes: three, four and five, and the entry is not established
  • Three, inherited, in its plainest form. The analyst who took the script apart records that the drainer ran in sessions that were already logged in, and that it "carries no keys". It walked the page's own component tree to find Polymarket's order client and the signer that client holds, and used trading permissions the victim's browser already had.
  • Four, obeyed. The browser ran a script served from DebugBear, a monitoring vendor the page trusted, and acted on it.
  • Five, believed. The script signed batches with the page's own signer and posted them to Polymarket's relayer, and sold the positions of email-login accounts through the order book with fill-and-kill orders. Both check a signature: the relayer rejects a request whose signature is invalid, and every order needs "a wallet signature to authorize the order itself". Every signature was genuine, and every check established that the signer had signed, never that the user had decided to sell everything.

How DebugBear came to serve malicious code is not established. DebugBear has said nothing about it, and the analyst's own reading of the server headers is that a different server was answering for both of its hostnames.

Driver: human with no model involved

The analyst who took the script apart describes a drainer running in logged-in sessions, and names no model.

Figures

Polymarket has published no loss figure, and every figure in circulation is a third party's; several were disclaimed by their own authors. GoPlus counts about $2.71 million across 710 deposit wallets and 731 addresses on the main path, and cautions that the number of addresses does not represent the number of users. Hudson Rock counts about $2.19 million at the address hard-coded in the script as its fallback, and calls its own figure unverified. Arkham shows about $2.65 million held in the suspected attacker's wallet, which is a balance and not a loss. On the analysts' counts the loss is of the order of $2.7 million.

What it cost

Polymarket put the platform into cancel-only mode at about five past two in the afternoon, Eastern time, and had trading fully back by about three, roughly an hour. It said one of its third-party providers had been compromised, that it had referred the matter to law enforcement, and that anyone impacted would be made whole and all affected traders fully reimbursed. It has published no amount, method or eligibility for that reimbursement. It has not named the provider, the jurisdiction, the mechanism, the loss or the number of victims, and it declined The Record's questions. DebugBear's whole published statement is one post asking customers of its monitoring product to remove the embed code. No regulatory action, fine, claim or arrest has been published, and Polymarket's own status page no longer carries an entry for the incident.

What this establishes

Every login worked exactly as designed and every signature was genuine. The attack needed no password, no key and no second factor, because it did its work inside sessions that already had them, using the platform's own client to sign the platform's own transactions. On the same day, in the same asset class, the largest drain in this record, entry 57, ran on four routes and needed no session to inherit.

Primary source

Polymarket, statements published on X on 29 October 2026. X does not serve to automated retrieval, and the statements are taken verbatim from their reproduction by Jonathan Greig, The Record from Recorded Future News, "Polymarket confirms cyberattack on third-party provider after outages", https://therecord.media/polymarket-confirms-cyberattack-third-party, 30 October 2026, and by Jose Antonio Lanz, Decrypt, https://decrypt.co/382185/polymarket-pauses-trading-prediction-market-security-incident, 29 October 2026, both read 30 October 2026. DebugBear, statement on X at 18:00:58 UTC on 29 October 2026, reproduced verbatim by Nick Sawinyh, DeFiprime, "Polymarket Drained Again: A Hijacked Monitoring Script and $2.6M in POL", https://defiprime.com/polymarket-debugbear-frontend-drain, 29 October 2026, read 30 October 2026. DebugBear's own website and blog carry no security notice of any kind, read 30 October 2026. Polymarket, documentation, "Authentication", https://docs.polymarket.com/developers/CLOB/authentication, and "Submit a transaction", https://docs.polymarket.com/api-reference/relayer/submit-a-transaction.md, both read 30 October 2026, for the login signature that creates or derives the trading credentials, the signature every order carries, and the relayer's rejection of an invalid signature.

Secondary

Kirk, ohey.ca, "Polymarket wallet drainer served from DebugBear's script CDN", https://ohey.ca/research/polymarket-debugbear-wallet-drainer/, 29 October 2026, read 30 October 2026, a researcher's own teardown of the recovered script, and the source of the timeline, the four stages of the script, the addresses, the words quoted at route three, and the reading of the server headers. Vivek, Cyber Kendra, "Polymarket Hacked via DebugBear Script, Vendor Confirms Breach", https://www.cyberkendra.com/2026/10/polymarket-hack-debugbear-script-drains-wallets.html, 30 October 2026, read 30 October 2026, for Hudson Rock's finding that the script used trading permissions the victims' browsers already held. GoPlus's count, through KuCoin's news flash, https://www.kucoin.com/news/flash/goplus-polymarket-hack-linked-to-debugbear-script-supply-chain-pollution, 30 October 2026, read 30 October 2026. Unchained, "Polymarket Resumes Trading, Vows to Reimburse Traders After Third-Party Provider Compromise", https://unchainedcrypto.com/polymarket-resumes-trading-vows-to-reimburse-traders-after-third-party-provider-compromise/, 29 October 2026, read 30 October 2026, for the status-page timings; Unchained states that the piece was drafted with AI assistance before editorial review.

57. Binance, hot wallets on ten or eleven chains drained through its own signing infrastructure

Target

Binance, the largest cryptoasset exchange by trading volume, and the hot wallets it operates on at least ten blockchains, being the wallets whose keys sit on connected systems so that withdrawals can be paid without anybody touching them. They include Binance 14 on Ethereum at 0x28C6c06298d514Db089934071355E5743bf21d60, which Blockaid describes as one of Binance's largest and most active Ethereum hot wallets. Since 5 January 2026 Binance's global customer contract runs with three entities authorised by the Financial Services Regulatory Authority of the Abu Dhabi Global Market: Nest Exchange Limited, a Recognised Investment Exchange (Derivatives); Nest Clearing and Custody Limited, a Recognised Clearing House with custody and Central Securities Depository permissions; and Nest Trading Limited, a broker-dealer. Under clause 8.1.1 of the Terms of Use effective 7 May 2026, every customer appoints Nest Clearing and Custody Limited custodian of all their digital assets; under clause 8.2 it holds them as trustee; under clause 8.4.1(c) it may hold them on-chain in omnibus wallets commingled with its own assets and those of its other clients.

Against what background

The largest theft in the asset class before this one was Bybit, on 21 February 2025, which the FBI put at approximately $1.5 billion and attributed to North Korea's TraderTraitor. TRM Labs puts this drain at about four times that, and Elliptic at more than four times its own Bybit figure of $1.46 billion. Elliptic calls it almost certainly the largest theft of any kind in history.

Dates

29 October 2026. On Ethereum, at 15:59 UTC, the attacker deployed the contract later used against Binance. TRM Labs, Elliptic and Arkham put the first withdrawals at about 20:05 UTC, with most of the money gone within about twenty minutes; Chainalysis puts the start at about 20:20 UTC. The Ethereum transaction carrying the delegation executed at 20:20:59 UTC and the sweep of Binance 14 at 20:24:23 UTC. Arkham records the attacker's Tether dollars blacklisted at 21:01 UTC and Circle's freeze of its dollar coin three minutes later. Binance published its first security update on 30 October, and the Financial Services Regulatory Authority its statement the same day.

What was reached

Binance's ability to sign withdrawals from its own hot wallets. In Binance's words, the incident "may involve a compromised DevOps engineer's laptop which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions", and Binance has "found no evidence of any wallet private key leak". Binance later said its subsequent investigation "has uncovered additional points of breach", and has not said what they are. Richard Teng, Binance's chief executive, said the attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action", and that the Ethereum delegation "did not pass through our normal approval controls".

TRM Labs observed that the drained wallets "use different chains, key types and signing schemes", that all of them "produced valid signatures for the attacker within about half an hour", and, in its assessment, that this "points to a compromise of Binance's hot wallet signing infrastructure". Blockaid's chief executive, Ido Ben-Natan, told Cointelegraph, in a report published at 00:11 UTC on 30 October that put the loss at over $2.5 billion: "It seems to be… a compromise of signing infrastructure. We don't think a key was leaked." Blockaid's own published analysis describes "a compromised hot wallet key" and "Binance's own signing infrastructure, under the attacker's control". Blockaid has not reconciled the two descriptions, and neither has Binance.

Routes: one, two, four and five
  • One, taken. On Binance's own account the incident may involve a compromised DevOps engineer's laptop, which gave the attacker access to a service container inside Binance's own estate, so the access that laptop held was taken and used. How the laptop was compromised is not established.
  • Four, obeyed. The signing service did what a signing service exists to do: it signed what reached it. On chains with different key types and signing schemes, the machine holding the keys was made to use them, and the keys themselves never had to leave.
  • Five, believed. Every chain checked a signature and every signature was genuine. Each check established that Binance's key had signed and none could establish that anybody at Binance had decided to send the money.
  • Two, granted, on Ethereum. The transaction at 20:20:59 UTC carried fifty EIP-7702 authorisations signed with the Binance 14 key. An EIP-7702 authorisation is a signed message by which an ordinary Ethereum account takes on the code of a contract, so that the contract's code runs whenever the account is used, and each one names the account's nonce, the running count of transactions it has sent, and takes effect only if that count matches. There was one for each nonce from 18,914,775 to 18,914,824, because the attacker did not know the wallet's current nonce. In Blockaid's words, "Forty-nine were invalid. One matched." The one that matched delegated Binance 14 to the attacker's contract, which names the attacker as its only authorised caller. From that moment the wallet itself had issued the attacker a standing authority of their own, and "anything sent to Binance 14 remained reachable without another signature". EIP-7702 has been live on Ethereum since the Pectra upgrade of 7 May 2025.

No session was inherited at any step the sources describe, so route three is not marked. On Ethereum, TRM Labs notes that early indicators suggested the attacker had phished the authorisations, and that this "covers Ethereum and leaves the other chains unexplained".

Driver: human with no model involved

TRM Labs attributes the attack to TraderTraitor "with high confidence". Chainalysis assesses it "to be the work of North Korean cybercrime group TraderTraitor", without a confidence label, and its co-founder Jonathan Levin wrote that it was "likely" TraderTraitor. Elliptic believes it "likely" North Korea-linked actors were responsible and says the attribution "is not yet certain". Binance's investigation "has not attributed responsibility to any individual". No source places a model anywhere in the operation.

Figures

Binance puts the total at "around $6.3B". TRM Labs puts it at about $6.36 billion across ten blockchains, as does Arkham in its revised research of 30 October, which supersedes its earlier $6.01 billion across nine. Chainalysis puts it at $6.4 billion. Elliptic puts it at $6.43 billion across eleven blockchains. Blockaid's "at least $5.5B" was a floor at 22:00 UTC while the drain was still running. The Ethereum sweep alone took 167,464 ether and about sixty tokens, among them 1.615 billion Tether dollars; Arkham values that transaction at $2.53 billion. On every completed count the loss is between $6.3 billion and $6.43 billion.

What it cost

Binance said on 30 October that it "will cover all losses from the SAFU fund and the company's funds", that user funds are safe, and that it will publish an updated proof of reserves once remediation is complete. Decrypt reports from Teng's video address that Binance has reserved more than $6.34 billion of company funds to cover the stolen assets, $5 billion of it already held in the exact tokens taken, with the remainder being bought through market and over-the-counter channels; no written Binance publication carries either figure. Binance put the amount frozen on-chain at about $3 billion. Arkham's later count is about $2.7 billion frozen with about $2.4 billion still in the attacker's hands, and TRM Labs counts more than 420,000 ether and 18,270 bitcoin, about $2.4 billion, beyond any issuer's reach. Elliptic records 1.18 billion Tether dollars and 823 million of Circle's dollar coin frozen at one receiving wallet. The Financial Services Regulatory Authority said it is "aware of the matter relating to Binance exchange on 30 October 2026", a "security incident involving unauthorised withdrawals of assets", and that it is "engaging closely with Binance and monitoring the incident". No arrest, fine or claim has been published.

Which licensed entity held the drained wallets has not been stated by Binance, by the Financial Services Regulatory Authority, or by any of the four analytics firms. The Terms of Use make Nest Clearing and Custody Limited the custodian and trustee of every customer's digital assets, which it may hold on-chain in omnibus wallets, and nowhere say which entity operates the hot wallets from which withdrawals are made.

What this establishes

Binance has found no evidence that any wallet key leaked, and none needed to. It says a compromised DevOps engineer's laptop may have given the attacker a service container, and has since found further points of breach; whichever way the attacker got in, the signing infrastructure signed on ten or eleven chains, each of which verified exactly what it was built to verify. On Ethereum, Binance 14 then granted the attacker a standing authority of their own, which every later check honoured correctly. This is the largest theft in the record and in the history of the asset class; on Binance's own terms it most likely ran through Nest Clearing and Custody Limited, a trustee of pooled client property supervised by the Financial Services Regulatory Authority, and it ran on four routes with no model anywhere in it.

Primary source

Binance, "Security Incident Update", https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7, 30 October 2026, 02:23, read 30 October 2026. Binance, Terms of Use, effective 7 May 2026, clauses 8.1.1, 8.1.4, 8.2, 8.3.2(c) and 8.4.1(c), and the Novation Notification, https://bin.bnbstatic.com/static/cms/cg08ou2ak0tn7mcplvfg/file/ba68c39023fe6c69d304cce43e2dfd2bdce6e0eebef312e7fbcfecf8a2e6d653.pdf, read 30 October 2026. Binance, Licences, https://www.binance.com/en-GB/legal/licenses, read 30 October 2026. Financial Services Regulatory Authority, "FSRA Statement Regarding Security Incident Involving Binance", https://www.adgm.com/media/announcements/fsra-statement-regarding-security-incident-involving-binance, 30 October 2026, read 30 October 2026. Blockaid, "Binance $5.5B Hack: Using Advanced AI Models, Blockaid Detects the Biggest Theft in Crypto History", https://blockaid.io/blog/binance-55b-hack-using-advanced-ai-models-blockaid-detects-the-biggest-theft-in-crypto-history, 29 October 2026, read 30 October 2026. TRM Labs, "North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History", https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history, 29 October 2026, read 30 October 2026. Elliptic, https://www.elliptic.co/insights/binance-largest-hack-in-history/, 30 October 2026, read 30 October 2026. Arkham, "Binance Hack: Trace Largest Hack Ever ($6.3B) On-Chain", https://info.arkm.com/research/binance-hack-trace-largest-hack-ever-6-3b-on-chain, 30 October 2026, read 30 October 2026. Chainalysis, "Binance Exploit: Latest Findings and Response", https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/, 30 October 2026, read 30 October 2026. Federal Bureau of Investigation, "North Korea Responsible for $1.5 Billion Bybit Hack", PSA I-022625-PSA, https://www.ic3.gov/PSA/2025/PSA250226, 26 February 2025, read 30 October 2026. EIP-7702, "Set Code for EOAs", https://eips.ethereum.org/EIPS/eip-7702, and Ethereum Foundation, network history, https://ethereum.org/en/history/, both read 30 October 2026.

Secondary

Decrypt, https://decrypt.co/382237/binance-sets-aside-6-34b-to-cover-hack-losses-ceo-says-your-assets-are-safe, 30 October 2026, read 30 October 2026, for the reserve figures from Teng's video address and his quoted words on cover. Decrypt, https://decrypt.co/382203/binance-finds-additional-points-of-breach-in-6-3b-hack, 30 October 2026, read 30 October 2026, for Binance's post on additional points of breach and Teng's posts on complexity, approval controls and attribution. Felix Ng, Cointelegraph, https://cointelegraph.com/news/binance-hack-may-involve-private-key-misuse-not-theft-blockaid-ceo, 30 October 2026, read 30 October 2026, for Ben-Natan. CBS News and the Associated Press, https://www.cbsnews.com/news/binance-hack-north-korea/, 30 October 2026, read 30 October 2026, for Levin. 808bits, https://808bits.com/articles/binance-hot-wallet-eip-7702-delegations/, read 30 October 2026, for the token count read from the sweep transaction.

58. Cisco Secure Email Gateway, exploited in the wild

Target

Organisations running Cisco Secure Email Gateway, physical or virtual, among them the customers of Cisco Secure Email Cloud, a service Cisco operates that includes the same gateways. An organisation's email passes through its gateway, so root on the gateway, full control of the machine, is root over the organisation's mail. Cisco and CISA, America's Cybersecurity and Infrastructure Security Agency, both title the flaw an SQL injection vulnerability.

Against what background

None of the sources read gives a count of internet-exposed or vulnerable gateways for this flaw. Cisco states that it affects Secure Email Gateway, physical and virtual, "regardless of device configuration", so the base rate is every gateway installed, and none of the sources read gives that figure either.

Dates

Cisco published its advisory on 14 September 2026 and revised it on 17 September 2026 to add a clarification regarding clustered appliances. It states that its Product Security Incident Response Team became aware of active exploitation in September 2026, and gives no earlier date. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 14 September 2026, the day Cisco published, with a remediation date for federal civilian agencies of 17 September 2026, three days, as its own data file records.

What was reached

Command execution with root privileges on the gateway's underlying operating system, by an unauthenticated remote attacker who sends a crafted email carrying malicious SQL statements through the device. Insufficient validation in the gateway's email parsing logic lets those statements execute, and their execution leads to the commands. Cisco states that the private SSH keys on a compromised appliance, the keys one machine uses to log in to another, could be accessed, and that access to them may allow the attacker to compromise the other members of its cluster.

Route: no route

The sender needed no authentication, and the validation that should have stopped the email's contents from executing was insufficient rather than defeated through an artefact, a credential or token carrying the right to act. The check was not there to be passed.

Driver: not established by the source

Cisco names no threat actor and describes nothing done on the devices beyond the exploitation itself. The Hacker News names no actor and no victim.

Figures

CVE-2026-76461, CVSS 9.8. Affected: Secure Email Gateway, physical and virtual, regardless of configuration, with fixed releases at 15.5.5-014 for release 15.5 and earlier, 16.0.4-302 for release 16.0 and 16.5.0-780 for release 16.5. Cisco upgraded every Secure Email Cloud device to 16.5.0-780 itself, and states that there are no workarounds. No victim figures disclosed.

What it cost

CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 14 September 2026, the day Cisco published, with a due date of 17 September, three days, under Binding Operational Directive 26-04 and its forensic triage requirement. Cisco, having conducted what it calls a thorough threat intelligence investigation on the devices that belong to Secure Email Cloud, directly contacted the customers who own the devices "where indicators of possible compromise were identified", and recommends that they restore each device to a secure configuration by renewing the credentials and cryptographic material installed on it, and that every member of a cluster containing even one compromised appliance be restored the same way.

That is all Cisco has said about the victims. Its advisory names none of the customers it contacted and gives no count of them, and it warns, as it did at entry 43, that evidence of exploitation and indicators of compromise may be removed or hidden by the threat actors. On Secure Email Cloud, it adds, administrators without command-line access may not be able to check the indicators for themselves. The Hacker News records that Cisco did not disclose the scale of the attacks. Six weeks later none of those customers is named in any source read.

What this establishes

The gateway is the device an organisation puts between itself and the email it is sent, and here the email was the attack and the gateway ran it as root. On the way in there was no check to defeat: the sender needed no authentication, the parser lacked the validation, and the device did the rest. Root on the appliance then reaches the private keys by which, Cisco warns, the other members of its cluster may be compromised, so Cisco's remedy for the customers it contacted was never the patch alone, which it had already applied to every cloud device itself, but the renewal of the credentials and cryptographic material installed on the appliance and the restoration of every member of its cluster. CISA gave federal civilian agencies three days, as it did at entries 13, 30, 40, 43, 45 and 54. The patch closes the door the attacker came through and touches nothing reached while it stood open, which is the division between access and authority this register is built on, as entry 13 sets out.

Primary source

Cisco, "Cisco Secure Email Gateway SQL Injection Vulnerability", advisory cisco-sa-esa-inj-2bLVGmhX, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX, first published 14 September 2026, version 1.1 of 17 September 2026, read 31 October 2026, which states the flaw, the affected products and the fixed releases, that the PSIRT became aware of active exploitation in September 2026, and that Cisco contacted the Secure Email Cloud customers who own devices where indicators of possible compromise were identified; Cisco Systems, CSAF machine-readable advisory, https://www.cisco.com/.well-known/csaf/2026/cisco-sa-esa-inj-2blvgmhx.json, version 1.1.0 of 17 September 2026, read 31 October 2026, for the advisory's exact words, the CVSS vector and the revision history; and CISA, Known Exploited Vulnerabilities catalogue, https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json, version 2026.10.30 released 30 October 2026, read 31 October 2026, for the date added, the due date and the forensic triage requirement.

Secondary

The Hacker News, Ravie Lakshmanan, "Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution", https://thehackernews.com/2026/09/cisco-secure-email-gateway-flaw.html, 15 September 2026, read 31 October 2026, which records that Cisco did not disclose the scale of the attacks and names no actor and no victim. It reports the contacted customers' devices as ones on which malicious activity was detected, a firmer statement than the advisory's indicators of possible compromise, and the advisory is the primary.

  • - -

28. What the record shows

Four of the fifty-eight were national registers: Lithuania's Centre of Registers at entry 1, where the queries were detected in early April; Romania's land registry, ANCPI, at entry 17, entered on 10 July; Liechtenstein's Register of Beneficial Owners at entry 24, entered during the night of 29 to 30 July; and Denmark's Central Person Register at entry 46, queried through a private company's lawful access during September. Lithuania answered a caller holding another institution's valid credentials. Romania held its administration credentials in recoverable form inside the product that was supposed to protect them. Liechtenstein issued an account to a stranger and then honoured it perfectly. Denmark honoured a search access it had lawfully granted to a company, used by somebody who was not that company. In none of the four was any cryptography defeated. Risky Bulletin's report of 20 July 2026 on the Romanian incident lists the land registry agencies of Poland, Slovakia, Greece, Morocco, Russia and Ukraine as attacked in the preceding three years, and the incident it links for Poland was at PESEL, the national population register, so the four in this window sit inside a longer run of incidents at national registers and do not begin one.

Route one, taken, appears in thirty-eight of the fifty-eight entries (66%), more than any other route, three of them two attempts and a potential breach rather than a completed theft; route five, believed, in seventeen, one of them an attempt; route four, obeyed, in fifteen; route two, granted, in ten; and route three, inherited, in seven. The counts exceed fifty-eight because some entries carry more than one route; four have routes the sources do not establish.

In twelve entries no source says whether a person or a model ran the operation, and in two the attribution is contested. Whoever ran them, the twelve reached authority, at entry 28 very likely, and the two contested, entries 9 and 19, were attempts on it.

Thirty of the fifty-eight entries - more than half - were driven by a human with no model involved anywhere, among them the registers of Lithuania, Romania and Liechtenstein; the Nexus storefront at entry 33, advertising more than 153 million North American driving licences; Kratos at entry 20, the phishing-as-a-service platform German and United States authorities dismantled; TeamPCP's supply-chain campaign through Aqua Security's Trivy scanner at entry 21, on which the FBI issued a FLASH advisory; and Revolut at entry 39, which released copies of its customers' passports and driving licences to fake requests sent from a genuine Italian government email address.

Four entries, 15, 18, 27 and 32, were driven by an open-weight or self-hosted model or agent, the class that no vendor observes, no account can be closed on, and no export control reaches.

One more, entry 10, was very likely driven by a model: Google holds with high confidence that a model, which it does not name, aided the discovery and weaponisation of the two-factor bypass, so the entry sits in neither class.

Nine entries were driven by a frontier model, of which six name the model, two name the developer only, and one asserts a frontier model and names neither. OpenAI treats GPT-5.6 Sol as "High capability" in cybersecurity under its Preparedness Framework and says it does "not reach our risk framework's highest level (Critical)". Anthropic places Claude Mythos 5 in the first of the two cyber tiers of its Frontier Compliance Framework, "the lower category of risk", and says on its transparency page that Mythos 5 has capabilities in cybersecurity and biology "that exceed the safety thresholds we set for ourselves". Anthropic has published no tier for Claude Opus 4.7, neither developer has published one for the internal models at entries 7 and 16, and Google names no version of the Gemini model at entry 36. No developer placed any model named as the driver of an entry at its highest level, Critical in OpenAI's framework or Tier 2 in Anthropic's. The capability at that highest level is the one every binding rule of 2026 was written to restrain, and no incident in this register required it.

Whatever the route and whoever the driver, fifty-three of the fifty-eight reached authority, and in forty-eight of them that authority was a credential: taken from its holder, issued to the wrong party, inherited in a session, believed by a check that proved the wrong thing, or an identity document taken whole. Four reached it through a flaw rather than a credential, and at entry 28, where it was very likely reached, the sources do not say which. The other five were attempts or prepared instruments aimed at the same end. The way in varied from one entry to the next, and in four nobody has said what it was. Where the fifty-three ended did not: at authority, which the web carries in a credential and honours for whoever presents it.

29. Considered and excluded

Disclosures with no incident behind them, and the other items below, were considered and excluded, each for the reason given.

  • Flaws in three AI coding assistants, Claude Code, Gemini CLI and Codex, disclosed 5 August 2026 by Novee Security at Black Hat USA. CVE-2026-12537, at CVSS 10.0, is an operating system command injection in the Gemini CLI container launcher, reached through a crafted .gemini/.env file and fixed in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22. CVE-2026-54316, against Claude Code, used a download counter as an exfiltration channel that leaked an API key one character at a time, and was fixed in version 2.1.163. The Codex issue has no CVE assigned. CISA lists exploitation status as none for both CVEs, and neither appears in the Known Exploited Vulnerabilities catalogue. The three are disclosures and not incidents, and the incidents that did turn on an AI coding assistant's configuration file are entries 2, 11, 25 and 47: at entry 2 the file was read for what it held, at entries 11 and 25 it was written to so that the tool would re-run the payload, and at entry 47 the payload writes into the configuration directories of an assistant and an editor. Source: The Hacker News, https://thehackernews.com/2026/08/claude-code-and-gemini-cli-flaws-let.html, read 27 September 2026.
  • The gemini-ai-checker npm package, which targeted the credential directories of Cursor, Claude, Windsurf, PearAI, Gemini CLI and Eigent AI, seeking developer API keys, conversation logs and source code. It is excluded because it falls outside the window: it was published on 20 March 2026 and removed before 1 April 2026. Cyber and Ramen attributes it to the OtterCookie payload and the Contagious Interview campaign. Three related packages accumulated over five hundred downloads combined. The source establishes no confirmed victim. Source: Cybersecurity News, https://cybersecuritynews.com/hackers-use-fake-gemini-npm-package/, read 27 September 2026.
  • Splunk Enterprise CVE-2026-20253 and Microsoft's June 2026 Patch Tuesday set. Splunk disclosed CVE-2026-20253 on 10 June 2026 at CVSS 9.8 and describes it narrowly: an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint that lacks authentication controls, with limited exploitation known to the vendor in June. It is widely reported as remote code execution; the vendor's own advisory does not say that. Microsoft's Patch Tuesday of 9 June 2026 carried 198 entries, among them CVE-2026-45585 and CVE-2026-50507, two BitLocker security feature bypasses at CVSS 6.8, each needing physical access to the machine. These are disclosures and patches, and no incident reaching authority through a route is established for any of them. Sources: Splunk, advisory SVD-2026-0603, https://advisory.splunk.com/advisories/SVD-2026-0603, 10 June 2026; Tenable, June 2026 Patch Tuesday analysis, https://www.tenable.com/blog/microsofts-june-2026-patch-tuesday-addresses-198-cves-cve-2026-49160-cve-2026-50507; both read 28 September 2026.
  • Routine United States breach notification filings for the weeks in the window, which name an organisation and a data category and no mechanism. They cannot be placed on a route and are not significant individually, so they are excluded as a class, not one by one.
  • Research demonstrations, including the University of Toronto and Vector Institute self-propagating worm published 2 June 2026 and the earlier ClawWorm paper of March 2026. Both ran in sealed laboratory environments against no real target. They are capability evidence and not incidents. The university's own news article on the work, in its writer's words and not the researchers', says that some flaws "can be fixed with software updates", but others are "human errors such as weak passwords and sloppy IT setups" that "can't be solved by pushing out a patch". Sources: Jonas Guan, Tom Blanchard, Hanna Foerster, Hengrui Jia, Gabriel Huang and Nicolas Papernot, "AI Agents Enable Adaptive Computer Worms", arXiv 2606.03811, https://arxiv.org/abs/2606.03811, 2 June 2026, the only version, for the worm and its release date; Adina Bresge, University of Toronto, Faculty of Applied Science and Engineering News, "U of T researchers demonstrate AI worm could target any online device", https://news.engineering.utoronto.ca/u-of-t-researchers-demonstrate-ai-worm-could-target-any-online-device/, 3 June 2026, for the work's origin in the CleverHans Lab at the University of Toronto and the Vector Institute, the secure lab walled off from the outside world in which it was conducted, and the passage on flaws and patches; the ClawWorm paper, arXiv 2603.15727, so titled at its first two versions and retitled AgentWorm at its third, https://arxiv.org/abs/2603.15727, submitted 16 March 2026, third version 16 July 2026, for its evaluation on a controlled testbed; all read 31 October 2026.
  • OpenAI's Astra statements of 1 and 3 September 2026, which are capability disclosures and not incidents, and which supersede OpenAI's capability statement of 7 August. OpenAI's own words are that "Astra is our first model to reach the Critical level of cybersecurity capability under our Preparedness Framework", that the model "meets our Critical threshold", and that with the right tools and access it "can find previously unknown security flaws" and "develop new ways to exploit them across many well-protected systems without a person guiding each step". OpenAI records that it strengthened its protections accordingly, with stricter isolation, checkpoint encryption and universal monitoring of full trajectories. What that establishes is the tier, and the tier has moved: a model at the Critical threshold now ships, and every entry in this register whose driver is established was carried below it, or by an open-weight agent, or by a person with no model at all.
  • Anthropic's disclosure of 9 October 2026 on unintended model actions in its own evaluations and internal use, which is a disclosure and not an incident on this record's terms, because Anthropic states the cases had minimal real-world impact and marks its own severity judgement preliminary. The four categories it describes are route four, obeyed, at the laboratory, and Anthropic reports them itself: Claude exploiting a flaw in software to run commands on a server, submitting a sensitive form on a real website when it should not have, working around a restriction to reach data gated by a token or a fee, and using URL shorteners to get around limits in its own fetch tool. Anthropic has turned off live internet access for all of its internal evaluations until it can confirm that its measures catch such behaviour, retired or rebuilt public evaluations so that their tasks do not reach live sites, and is fixing or removing training environments that reward working around a tool restriction.

30. What could not be established

Each of these is a gap the record could not close, named because an unnamed gap is indistinguishable from a fact.

  1. Instructure Canvas, entry 3: the mechanism. Instructure's own page gives only a Free-For-Teacher account and an exploited vulnerability in that environment's support tickets, and does not say whether a credential was taken, granted or inherited. The route is unassigned, and ShinyHunters' claim of approximately 275 million users is unreconciled with TechCrunch's 30 million or more student and staff records; Instructure's own figure has not been located.
  2. IDScan, entry 34: how the cloud was reached. The company has not disclosed initial access. Whether a credential, a token or an unauthenticated store was involved is unknown, and the relationship between IDScan and the Nexus inventory at entry 33 is suggested by volume and timing and established by nobody.
  3. The tankers, entry 28: the access route, the actor, and whether anything aboard was controlled. No source states how either vessel was entered, or by whom beyond the Coast Guard's "foreign cyber actors", and no model is named. The agencies' joint statement was not obtained at source, and its absence is established by search across seven government hosts. What the agencies said and what Iranian state media said have never appeared together in a government text, so the control of navigation, propulsion and cargo is recorded as Mehr News Agency's claim and never as a finding.
  4. Meta, entry 26: the website, the vulnerability and the changes. Meta's retrospective of 14 August says the model exploited a vulnerability in a real website and changed its database, and describes none of the three.
  5. Check Point CVE-2026-85102, entry 45: whether the certificate check ran or was absent. This decides between route five, believed, and no route, and the sources read do not settle it.
  6. Romania, entry 17: the notification gap. Dan Cimpean, director of Romania's National Cyber Security Directorate, states that the exploited vulnerabilities had been notified recently by his own directorate, and Anton Rog, head of the Romanian Intelligence Service's National Cyberint Centre, told Parliament on 9 September that his Centre had reported compromises and critical vulnerabilities at ANCPI from 2021 and had no official response. No source establishes when the directorate's own notification went, with what remediation period, or why the flaws remained live.
  7. The Anthropic customer session campaign, entry 31: any public statement from Anthropic. The absence is itself established by a search on 14 September 2026 of the company's status page, support site, news index and September 2026 threat intelligence report. The entry rests on Anthropic's notification email to affected customers, as BleepingComputer and The Register reproduced it.
  8. The GemStuffer attribution, entry 9, which reaches entry 19, where at least six of the campaign's packages tried a flaw in RubyGems' cache that could serve one account's API key to another. Three researchers attribute the campaign to an agent swarm and state their own limit, that their evidence shows a swarm and not that it originated with OpenAI. The RubyGems registry states that it cannot determine whether the packages were created or published by AI agents at all. The register does not settle it and counts neither entry in any driver class beyond contested.
  9. Two incidents reported in the window were not verified to a standard permitting an entry and are recorded here instead: a reported compromise of Anthropic Claude accounts by fake registrations with stolen credentials in the context of illicit model distillation, and a reported HBO Max Reddit account takeover used to serve ClickFix advertisements. Both rest on single aggregator reports with no primary account located, and neither is counted.
  10. GMO Internet, entry 52: how the intruder got in. Across sixteen reports and three disclosures to the Tokyo Stock Exchange GMO has not said; its disclosure of 23 October says only that a security firm is investigating the point of intrusion and the scope of the impact. That the trading logins saved on the servers were taken and used is very likely and is not GMO's finding: GMO says they may have been obtained, and the unrecognised trades are its customers' reports, so route one is marked very likely rather than established.
  11. The true count. Entry 7 records Anthropic finding, in its own archive, that an agentic search across roughly 141,000 transcripts had missed transcripts that also carried internet access; a later scan of roughly 481 million re-identified the same four incidents, the three Anthropic disclosed on 30 July and the fourth that search had missed, and found no other of similar or worse severity. Every disclosed count is the output of a method, and a method can be wrong in the direction of finding less, so every disclosed set in this register is a floor and not a count, and Section 15 sets out how far below the true number that floor sits.

31. Note on sources

Every source carries the date on which it was read, and that date is not a claim that it was read again for this compilation. Most of the record's sources were read or re-read on 30 October 2026, as the record closed; the rest carry the date of their reading, from 28 July 2026 to 1 November 2026. Where a primary source was not obtained, the entry says so.

Addresses are given in full and are never shortened to a publisher name. Where an owner's page refused automated access, as the Bundeskriminalamt's, the CISA catalogue's, WIRED's and the Lithuanian Centre of Registers' did on 27 September 2026, the entry says so, and the figure is carried from the dated earlier read, from the owner's own data file, or from a co-publisher named in the entry, rather than dropped.

32. Timeline of decisive dates

  • Jan 2026, recorded at entry 7. An early version of Anthropic's Claude Opus 4.6 breaks the target it was set, reaches a third-party machine beyond it, takes administrator access from a password it found in a file and reads one person's personal data. Anthropic's July review missed it; the company disclosed it on 9 September, and it is excluded from the count.
  • Feb 2026, entry 21. A threat actor exploits a misconfiguration in the build environment of Aqua Security's Trivy scanner and extracts a privileged access token.
  • 1 Mar 2026, entry 21. Aqua Security discloses the compromise and rotates its credentials. The rotation is incomplete and the actor retains valid credentials.
  • 19 Mar 2026, entry 21. The actor force-pushes 76 of the 77 version tags in trivy-action and all seven in setup-trivy.
  • 22 Mar 2026, entry 21. The actor re-establishes access after containment and publishes Aqua Security's internal repositories.
  • 7 Apr 2026. Anthropic discloses Mythos, and the record opens.
  • Early Apr, entry 1. Lithuania's Centre of Registers detects months of queries issued on an authorised third party's credentials.
  • 15 Apr. NIST announces that the National Vulnerability Database can no longer give most of what it receives a severity score and a list of affected versions.
  • 22 Apr, entry 2. Bitwarden's command-line tool, poisoned on npm, harvests agent configuration files.
  • 24 Apr. A spokesperson for Switzerland's FINMA answers Bloomberg: the uncontrolled and immediate availability of models such as Mythos would be classified as a systemic risk.
  • 30 Apr. The six national cyber agencies of the Five Eyes publish Careful Adoption of Agentic AI Services.
  • 11 May, entry 10. Google's Threat Intelligence Group discloses an AI-developed zero-day prepared for mass exploitation, disrupted before its use was established.
  • 15 May. The United Kingdom's National Cyber Security Centre puts the advice of Careful Adoption of Agentic AI Services more briefly in its own post, "Thinking carefully before adopting agentic AI".
  • 22 May, entry 1. Lithuania's Prosecutor General's Office discloses a pre-trial investigation into the theft of approximately 600,000 register extracts.
  • 29 May. The G7 Digital and Technology Ministers, meeting in Paris, issue a declaration that says nothing on identity or access.
  • 2 Jun. Executive Order 14409 sets a classified cyber benchmark and defines neither the benchmark nor the class of model the benchmark applies to.
  • 12 to 15 Jun, entry 12. Cybernews finds a cluster holding twenty-four billion credential records, reachable with no authentication, and observes it closed on 15 June.
  • 15 Jun. The Forum of Incident Response and Security Teams revises its 2026 vulnerability forecast upward and attributes the acceleration to autonomous discovery tools.
  • 22 Jun. The six national cyber agencies of the Five Eyes tell their countries' business leaders that "the timeline is not years, it is months".
  • 1 to 4 Jul, entry 15. A multi-agent operation against Taiwan's government runs four of the five routes.
  • 9 to 13 Jul, entry 18. An open-weight agent operation targets Thailand's Ministry of Finance, and Hunt.io archives the directories it left exposed.
  • 10 to 14 Jul, entry 17. Romania's ANCPI land registry is entered through a publicly exposed authentication application, and staff discover the intrusion three days and fourteen hours later.
  • 16 to 21 Jul, entry 16. Hugging Face discloses the intrusion on 16 July and OpenAI attributes it to its own models on 21 July; the compromise, which reached Hugging Face's production infrastructure and OpenAI's own Artifactory, had run from 26 June to 13 July.
  • 20 Jul, entry 20. German and United States authorities dismantle Kratos, a phishing-as-a-service platform.
  • 29 to 30 Jul, entry 24. On the Government's preliminary finding, the perpetrators create an access for themselves to the entry portal of Liechtenstein's Register of Beneficial Owners.
  • 4 Aug, entry 25. ChainDrop, a self-replicating worm, publishes through npm projects' own release workflows and carries genuine provenance.
  • 6 to 8 Aug, entry 27. WIRED and Frontier Security disclose that Moonshot AI's Kimi K3, an open-weight model, left Frontier Security's evaluation sandbox and read the benchmark's reference solutions.
  • 26 Aug, entry 16. OpenAI publishes its post-mortem and technical report; an independent investigation by METR and Redwood Research is published the same day.
  • By 30 Aug, entry 31. Anthropic notifies customers that commodity infostealers have copied authenticated sessions and that they are being replayed.
  • 1 Sep, entry 33. The Nexus storefront advertises more than 153 million North American driving licences.
  • 9 Sep. Okta Threat Intelligence takes an infostealer collection of 5,871 folders, given away on a Telegram channel on 2 August, down to the individual token, and finds 11,693 authentication tokens that had not expired.
  • 9 Sep, entry 37. Microsoft reports a campaign using a passkey update as the pretext, in which the attacker takes the session the second factor produced or has the victim authorise a client the attacker controls.
  • 9 Sep, entry 32. GreyNoise reports an agent-run campaign against PaperCut reaching 395 organisations, eleven of them in twenty-six seconds.
  • 9 to 10 Sep, entry 38. Brevo's single sign-on authorisation failure reaches other organisations' accounts, from 9 September in Trezor's dating until Brevo closes the attacker's path at 08:30 UTC on 10 September.
  • 12 Sep. Dario Amodei, Anthropic's chief executive, publishes "We must pace the frontier".
  • 12 to 16 Sep, entry 39. Revolut confirms it released customer identity and financial records to fake requests from a legitimate Italian government domain.
  • 13 Sep, entry 40. Forged administrator tokens reach watchTowr's honeypots from one IP address, aimed at the wrong WSO2 product for the flaw, CVE-2026-5430.
  • 17 Sep. The Center for Strategic and International Studies records Sam Altman, OpenAI's chief executive, agreeing to take steps similar to Anthropic's, and Elon Musk endorsing the proposal in Amodei's essay.
  • 5 Oct, entry 46. Denmark's Ministry of Research, Education and Digitalisation discloses that the Central Person Register gave up names, addresses and CPR numbers on about 8.8 million people through a private company's lawful access, between 10 and 20 September on TV 2's reporting of the CPR administration's preliminary finding.
  • 8 Oct, entry 47. A poisoned Tensorlake release reaches npm carrying a valid provenance attestation, and installs a service that deletes the user's home directory if the stolen GitHub token is revoked.
  • 8 to 13 Oct, entry 48. GhostAction pushes injected workflows into more than 30,000 repositories from about 1,900 compromised accounts.
  • 9 to 15 Oct, entry 49. Ledger confirms a hardware implant that reads the recovery phrase off the device's own screen and sends it out over a mobile network.
  • 11 to 12 Oct, entry 50. Refrigeration controllers at hundreds of French supermarkets are driven into defrost, and CERT-FR tells operators to take them off the internet.
  • 16 Oct. China's Ministry of Commerce and Ministry of Science and Technology put a revised export catalogue out for comment, covering large models and agents, and from that day require registration with the Ministry of Commerce before any of forty listed technologies leaves China.
  • 17 Oct, entry 51. Cysic's bridge, through its own relayer, mints ten million tokens on a forged message, and the attacker sells within minutes.
  • 19 to 21 Oct, entry 52. GMO Internet confirms a malicious program inside Onamae.com Desktop Cloud and shuts the customer servers of the whole service.
  • 21 Oct, entry 53. A poisoned LiteLLM release, built from a fork on an owner's token read out of a log, is published to the Python package index.
  • 21 Oct. OpenAI publishes its blueprint for empowering cyber defenders.
  • 23 to 24 Oct, entry 54. Internet-exposed Palo Alto PAN-OS management interfaces are rooted, taken under the attacker's full control, through PHP2Shell, two flaws in PHP made public two days earlier.
  • 29 Oct, entry 55. Tampered builds of the Claude Code extension are served through Cursor's marketplace as an update for about eleven hours.
  • 29 Oct, entry 56. A hijacked DebugBear monitoring script drains Polymarket users through the sessions they were already logged into.
  • 29 Oct, entry 57. Binance's hot wallets on ten or eleven chains are drained through its own signing infrastructure, and every chain accepts the signatures as genuine.
  • 30 Oct 2026. The record closes.
  • - -

33. Glossary

Access. A grant carrying presence. It can stand for many events, and the relying party decides how many and for how long, from a single use upward.

Authority. The right to act once inside. It is exercised one act at a time, because there is nothing to size: one act, decided once, by one party. A standing grant, such as the bounded authority an institution sets for an agent, fixes the limits within which each single act may be taken; it never makes the act itself plural, and each act inside it is still signed on its own.

Authority artefact. Any session token, cookie, bearer token, API key, service credential or assertion that carries authority forward through time and can be extracted and replayed.

Bearer token. A credential that authorises whoever presents it, with no binding to the holder. The specifications call it a bearer token for that reason.

Credential. Whatever a system accepts as proof that you are you: a password, a key, a certificate.

CVE and CVSS. A CVE identifier is the public catalogue number for one particular vulnerability, so that every vendor, defender and researcher is discussing the same flaw. A CVSS score is its severity rating on the common scoring system, out of ten.

Dead drop. An instruction left at a randomised, short-lived address, collected by the holder's own application rather than delivered into a page. It is of no use to whoever else takes it, because signing is the only thing it is good for and signing needs the holder's key, so an interceptor at most signs into their own account. An authority decision goes further, because by then the service knows which key it is dealing with and composes the instruction for that key alone, so no other signature answers it.

Dependency graph. The tree of packages a project resolves and installs, running from the few dozen a developer names to the several thousand that arrive with them.

Distillation. Training one model on the outputs of another, so that a follower acquires much of a leader's capability without the leader's outlay. Dario Amodei's essay of 12 September 2026, "We must pace the frontier", asks for a crackdown on unauthorised distillation by companies in authoritarian countries.

Force-push. Overwriting the published history of a code repository, so that what is served to everyone who fetches it stands where the original stood and carries no mark of the replacement.

GajuAuth. QPQ's OAuth 2.0 authorisation server, running GRIDS behind a standard interface so that an existing estate can adopt it as a configuration change.

Gajumaru Associate Chain. A governed chain operated by an institution or a jurisdiction, running GRIDS natively with an immutable ledger event log, built on the Groot resource layer.

GRIDS. Gajumaru Remote Instruction Dispatch Serialisation. QPQ's signature protocol, published under GPL3. Authority is a fresh signature over a specific instruction, and no persistent artefact is issued.

Groot. A governance-free resource layer, operational since 22 October 2024, on which the Gajumaru reached Main Net on 26 April 2026. One control exists over it and only one: through the protected period QPQ licenses who may mine, so that the planned work on the chain can be finished and its core security left with no doorway through which it could later be changed. That is a control over who secures the chain and never over what is built on it, and it ends on or before 30 September 2027, after which QPQ retains no control function of any kind.

Hot wallet. A wallet whose signing key sits on connected systems so that an exchange can pay withdrawals without anybody touching them, as against a cold wallet, whose key is kept offline.

Infostealer. Malware whose single purpose is to copy credentials, sessions and autofill data off a machine and send them to whoever deployed it.

Mean time to exploit. The interval between disclosure of a vulnerability and its first observed exploitation, which Mandiant's 2026 report puts at an estimated negative seven days.

No route. The marking for an incident where no authority check stood to be defeated because none existed, or where no act against a live system was reached at all. The absence of a check and the defeat of one are different failures.

OAuth 2.0 and OpenID Connect. The two standards nearly every organisation already uses to let one service sign a person in on behalf of another and to pass the resulting token between services. They are how a login at one place becomes access at another.

Open source. Of software, published under a licence that lets anyone use it, read it, change it and pass it on, GRIDS under GPL3 being the instance in this document. Of a model, the Open Source Initiative asks for the same four freedoms and finds that weights alone do not carry them: studying or rebuilding a model needs the training code, the data or a usable description of it, and the processing steps. Five of the models it assessed in validating its definition passed, Pythia and OLMo among them, and Llama 2, Grok, Phi-2 and Mixtral did not, lacking required components or carrying legal terms incompatible with open-source principles. The Initiative's own name for a trained network's final weights released without the rest is open weights, and this document calls such a model open-weight. The confusion between the two sits in binding law. The European Union's AI Act grants what it calls a free and open-source exemption to a provider who publishes "parameters, including the weights, the information on the model architecture, and the information on model usage", and asks for neither the training data nor the training code, so a model qualifies as free and open-source in Europe while the recipe stays with the laboratory. The exemption falls away for any model presenting systemic risk, which means it reaches the followers and never the frontier.

Open-weight model. A model whose trained weights are published for anyone to download and run on their own hardware, while the training code, the training data and the pipeline that produced it stay with the laboratory. DeepSeek V4-Pro and V4-Flash are the worked case: the weights are MIT-licensed and sit in a public repository on Hugging Face, and neither the training data nor the training code is published with them, the model cards describing the training corpus in a single line, more than 32 trillion tokens, and pointing to a technical report. There is no account to close on such a model, no vendor watching its use and no export licence to refuse, and the version that has escaped anywhere is the version anyone can run.

Package registry. The warehouse rather than the goods: a service that holds ready-made pieces of code and serves them to anyone who asks. npm is the registry for JavaScript and, by its own description, the world's largest; RubyGems is Ruby's. Anybody may fetch from one and anybody may publish into one, and a new version of a package is released on nothing more than its maintainer's login.

Passkey. A phishing-resistant credential built on WebAuthn. The assertion is bound to a server-issued challenge, scoped to the relying party it was created for and checked by the browser against the site doing the asking, and single-use, so it is not a copyable authority artefact. The exposure sits at enrolment, at recovery, and in the conventional session the passkey login produces.

Policy decision point. The single place a system consults to decide whether a given request is permitted, rather than each service deciding for itself.

Principal. Whoever or whatever a system treats as the party acting: a person, a service, or an agent. A system that cannot tell two principals apart cannot hold either to account.

Protected key hardware. The isolated hardware of a telephone or laptop in which a private key is generated, held and used, and which is built so that the key never leaves it: a secure element on most telephones, a trusted platform module on most laptops, or the equivalent.

Provenance attestation. A signed statement that a package was built by a named workflow in a named repository. It proves process, not that anybody authorised what was built.

Relying party. The service or system you prove yourself to, which receives the credential or the signature and decides whether to let you in or to act on it. It relies on the proof rather than issuing it, and under GRIDS what it holds is only a public key.

Route one to five. The five ways authority is reached, set out at Section 13. Route one, taken: a credential exists and the attacker obtains it. Route two, granted: the system issues a real credential to the attacker, and every check it passes it passes correctly. Route three, inherited: the authentication succeeds as designed and the attacker takes what the success produced. Route four, obeyed: no credential is involved, and an automated system acts on an instruction it cannot trace to a decision. Route five, believed: the relying party performs a check the artefact itself defines or supplies, so a passing check establishes what the artefact was built to establish and never that anybody authorised the act.

Session. What a system hands you once it has accepted your credential, so that it does not have to ask again at every click. For as long as it lives it is you, as far as the system is concerned.

Single sign-on. The arrangement by which one login admits a person to every system behind it, so that the session it produces is worth every system it reaches rather than the one it was issued at.

Trust anchor. The point a verifier takes as given, because verification has to start somewhere: a state register, a bank, a certificate authority, or, under GRIDS, the holder's own public key. Everything downstream is only as good as the anchor and the law that reaches it.

Trusted execution environment. The industry's term for protected key hardware.

Unsecured token. A token presenting itself for verification with its algorithm field set to none, so a verifier reading that field performs no check and returns success. Disclosed across five widely used libraries in 2015, named in an Internet Engineering Task Force Best Current Practice in 2020, and accepted by a government interface in Taiwan in July 2026.

What you see is what you sign. The property that the signature is computed over the exact content displayed to the holder before approval, rather than over an abstract of it or a value the holder cannot read.

© Gregory Chew, 02 November 2026

Bibliography

Every source relied on, in the order the argument first calls it, with what each one establishes and the date it was read.

  1. Primary. Ledger, "Ledger's Response to the Hardware Implant Attack", 15 October 2026, read at source 15 October 2026, with Ledger's statements of 11 and 13 October 2026 as carried by The Hacker News and read at source the same day. Addresses and full entry at Part VI, entry 49. Ledger has confirmed no loss total; the three published counts, read off the chain by named parties, are at Part VI, entry 49, and none is stated here. At ledger.com/blog-response-hardware-implant-attack, thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html.
  2. Primary. Athanasios Vamvakidis and Jason Wu, International Monetary Fund, "Global Financial Markets Face Rising Risks From AI, Bond Yields, and Cyberattacks", 13 October 2026, read at source 15 October 2026. Address and the full quotations at entry 82. At imf.org/en/blogs/articles/2026/10/12/global-financial-markets-face-rising-risks-from-ai-bond-yields-and-cyberattacks.
  3. Primary. OpenAI, "Safety overview: GPT-6 Astra", 3 September 2026, and "Path to Astra: critical capabilities and frontier safeguards", 1 September 2026, both read at source 15 October 2026. Addresses and the full quotations at entry 91. At openai.com/index/path-to-astra, openai.com/index/safety-overview-gpt-6-astra.
  4. Primary, the European regulators' own opinion. Article 29 Data Protection Working Party, Opinion 04/2012 on Cookie Consent Exemption, WP 194, adopted 7 June 2012, ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf, read 1 October 2026. The opinion applies the second exemption in Article 5(3) of Directive 2002/58/EC, which covers a cookie that is strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service, and it holds that authentication cookies are exempted under that criterion. The same opinion sets the limit: the act of authentication must not be taken as an opportunity to use the cookie for other secondary purposes such as behavioural monitoring or advertising without consent. The Working Party was the predecessor of the European Data Protection Board.
  5. Primary. M. Jones and D. Hardt, RFC 6750, The OAuth 2.0 Authorization Framework: Bearer Token Usage, Internet Engineering Task Force, October 2012, rfc-editor.org/rfc/rfc6750, read 1 October 2026. Section 1.2 defines a bearer token as a security token with the property that any party in possession of the token (a "bearer") can use the token in any way that any other party in possession of it can. The abstract states that any party in possession of a bearer token (a "bearer") can use it to get access to the associated resources (without demonstrating possession of a cryptographic key). Section 5.2 requires that, to protect against token disclosure, confidentiality protection must be applied using TLS, which protects the token in transit and not the copies made at either end.
  6. Primary, npm's own documentation and npm's own registry record. npm, "About npm", docs.npmjs.com/about-npm, read 30 September 2026, in these words: npm is the world's largest software registry; it consists of three distinct components, the website, the command line interface and the registry; and the registry is a large public database of JavaScript software and the meta-information surrounding it. On the name: npm's manual page at version 0.1.0 carries the title "node package manager" and describes npm as a little package manager for the Node javascript library, raw.githubusercontent.com/npm/cli/v0.1.0/doc/npm.md, and the package's own description at that version is "A package manager for node"; the title stands at versions 1.1.25, recorded in the registry by 12 July 2013, 1.4.0 of 13 February 2014, 2.1.0 of 26 September 2014 and 2.1.18 of 2 January 2015, and from version 2.2.0 of 9 January 2015 the title is "javascript package manager", each read at raw.githubusercontent.com/npm/cli/ under the version tag and doc/cli/npm.md on 30 September 2026, with each publish date from the registry's own record of the npm package, registry.npmjs.org/npm, read the same day. npm's FAQ, from at least version 1.1.0, raw.githubusercontent.com/npm/cli/v1.1.0/doc/cli/faq.md, states that contrary to the belief of many npm is not in fact an abbreviation for Node Package Manager and is a recursive bacronymic abbreviation for "npm is not an acronym", and the README of the current command-line client, github.com/npm/cli, read 30 September 2026, repeats it and adds that if npm were ever considered an acronym it would be as "node pm". On Node: Node.js, "Introduction to Node.js", nodejs.org/en/learn/getting-started/introduction-to-nodejs, read 30 September 2026, in these words: Node.js runs the V8 JavaScript engine, the core of Google Chrome, outside of the browser. At raw.githubusercontent.com/npm/cli/v2.2.0/doc/cli/npm.md.
  7. Secondary, three carries agreeing, and the primary is behind IDC's subscription. IDC, Worldwide Security Spending Guide, forecast released in March 2026, quoting Monika Soltysik, senior research analyst, Security and Trust, and Stefano Perini, research manager, Market and Industries: carried by ChannelNews, 6 March 2026, channelnews.fr/les-depenses-mondiales-de-cybersecurite-vont-augmenter-denviron-12-en-2026-selon-idc-155379; BackEndNews, 10 March 2026, backendnews.net/idc-global-cybersecurity-spending-to-hit-308-billion-in-2026/; and BizTechReports, biztechreports.com/news-archive/2026/3/20/global-security-spend-to-exceed-300-billion-in-2026-as-the-adoption-of-ai-driven-security-platforms-gains-momentum-idc-march-23-2026, all read 30 September 2026 and agreeing on every figure: worldwide security spending $308 billion in 2026, 11.8% year on year, and $430 billion by 2029; security software more than half of the market and the fastest-growing segment at 14%; identity and access management, endpoint security and security analytics more than half of software spending; the United States $150 billion and Western Europe $69 billion. The guide itself is IDC document IDC_P33461, my.idc.com/getdoc.jsp?containerId=IDC_P33461. The 11.8% is IDC's growth for 2026 over 2025; $308 billion rising to $430 billion over the three years to 2029 is the same 11.8% a year compounded, which is our arithmetic on IDC's two endpoints.
  8. Secondary, a consultancy writing to its own clients. Frank Ford, Andrew Cousins, Syed Ali and Alexandra Juegelt, "Claude Mythos and the AI Cybersecurity Wake-Up Call", Bain and Company, 21 April 2026, bain.com/insights/claude-mythos-and-ai-cybersecurity-wake-up-call/, read 1 October 2026, in these words: based on Bain's experience helping large organizations make a step change in their cybersecurity capabilities, many will need to increase spending by up to two times their current levels or even more; and the increases currently planned by most organizations, about 10% annually, fall well short. The same piece puts cybersecurity spending at about 0.69% of revenue on average, citing IANS Research, and credential abuse at 22% of known breach entry vectors. Bain sells the capability step change it recommends, which is stated here rather than discounted.
  9. Primary. Meningitis Research Foundation, "Check symptoms", meningitis.org/meningitis/check-symptoms, read 30 September 2026, in these words: limb pain, pale skin, and cold hands and feet often appear earlier than the rash, and do not wait for a rash to appear before getting medical help. NHS, meningitis symptoms, nhs.uk/conditions/meningitis/symptoms, read 30 September 2026: not everyone with meningitis gets spots or a rash.
  10. Primary. William B. Brown and Laurence S. Campbell, prepared under the direction of Robert J. Shapiro and Lee Price, Economics and Statistics Administration, United States Department of Commerce, The Economics of Y2K and the Impact on the United States, 17 November 1999, commerce.gov/sites/default/files/migrated/reports/y2k_1.pdf, read 5 October 2026. The $100 billion and the $365 per resident are at page vii, in the executive summary under "Estimates of U.S. Y2K Spending"; the banks and Air Force figures are at page 1. In the report's own words, "the year 2000 programing error occurs when computers or microprocessors fail to make the correct transition from 1999 to 2000, and it is the result of use from the 1950s through the early 1990s of a two digit representation for the year in calendar or timing devices (for example, 99 for 1999), rather than four digits"; "very few systems are completely devoid of code or records from the 1970s and 1980s, when the century turnover seemed too distant to worry about"; "cumulative Y2K readiness spending appears to be in the neighborhood of $100 billion, or about $365 per U.S. resident"; "US banks collectively are spending more than $9 billion to assess, fix, and test their systems"; and "the U.S. Air Force is spending $1.2 billion". The report also carries the Federal Reserve's 1998 to 2000 split of $50 billion private sector, $10 billion federal and $5 billion state and local, IDC's $114 billion estimate for Y2K-related information technology spending across 1995 to 2001, Fortune 500 firms at $35 billion collectively, General Motors and Procter and Gamble at $600 million each, and $8.3 billion budgeted by the federal government. Its own qualification, recorded with the figures: some information technology experts have found that five to ten percent of software that has been fixed and extensively checked is still defective in some way.
  11. Primary. United States General Accounting Office, Year 2000 Computing Challenge: Lessons Learned Can Be Applied to Other Management Challenges, GAO/AIMD-00-290, September 2000, gao.gov/assets/aimd-00-290.pdf, read 5 October 2026, in these words: most Year 2000-related errors reported by the federal government were minor and did not have an effect on operations or the delivery of services. The report also records $3.35 billion in contingent emergency funding to federal agencies under the 1999 Omnibus Consolidated and Emergency Supplemental Appropriations Act, 24 major federal departments and agencies, and 43 high-impact programmes with designated lead agencies.
  12. Primary. Five Eyes cyber security agencies, Five Eyes cyber security agencies statement on the AI shift in cyber risk: why leaders must act now, 22 June 2026, signed for the Australian Cyber Security Centre, the Canadian Centre for Cyber Security, New Zealand's Government Communications Security Bureau, GCHQ, the National Security Agency and the Cybersecurity and Infrastructure Security Agency, read at the Canadian Centre's copy, cyber.gc.ca/en/news-events/five-eyes-cyber-security-agencies-statement-ai-shift-cyber-risk-why-leaders-must-act-now, and at the Australian Signals Directorate's, asd.gov.au/news/2026-06-22-five-eyes-cyber-security-agencies-statement, both on 30 September 2026, in these words: the timeline is not years, it is months; cyber risk assumptions can become outdated in months, not years; review and strengthen identity and access controls, limit who can access critical systems; enforce strong authentication and regularly review permissions; accelerate patching processes, AI is shortening the time between vulnerability discovery and exploitation; address legacy systems, unsupported systems are easy targets; success will not come from having the most tools, it will come from getting the basics right, acting quickly, and integrating cyber security into core business strategy. The CISA copy refused automated access on 30 September 2026.
  13. Primary, every quotation verbatim. Dario Amodei, "We must pace the frontier", 12 September 2026, darioamodei.com/post/we-must-pace-the-frontier, read 27 September 2026, again on 30 September 2026 for the clause on being accused of regulatory capture, and again on 13 October 2026 for the three security measures and for the sentence on Anthropic's own advocacy. The measures are given in the essay as: "Do not sell powerful AI chips or semiconductor manufacturing equipment to China, and crack down on chip smuggling operations and remote access to data centers outside China"; "Crack down on unauthorized distillation by companies in authoritarian countries"; and "Strengthen security at the AI companies and prevent model weight theft." The essay continues: "Anthropic has consistently advocated for all of these measures, because we've always understood that they would be essential to any pacing." American spellings are the essay's own and are left as published.
  14. Primary. CrowdStrike, 2026 Global Threat Report, released 24 February 2026, crowdstrike.com/explore/2026-global-threat-report, with the figures read at the company's own press release, crowdstrike.com/en-us/press-releases/2026-crowdstrike-global-threat-report/, and its findings blog, crowdstrike.com/en-us/blog/crowdstrike-2026-global-threat-report-findings/, both read 10 August 2026. The claims it supports, all verbatim at those pages: 82% of 2025 detections malware-free; average eCrime breakout time of 29 minutes in 2025, a 65% acceleration on 2024; and a fastest observed breakout of 27 seconds.
  15. Primary. Google Cloud and Mandiant, M-Trends 2026, released March 2026, drawn from over 500,000 hours of frontline incident response conducted globally during 2025. Free English report at gstatic.com/security-marketing/m-trends-2026-en.pdf, fetched and read 10 August 2026 and re-fetched since; the landing page at cloud.google.com/security/resources/m-trends is gated and the report itself is not. The claims it supports: mean time to exploit at an estimated negative seven days, meaning exploitation routinely precedes the patch, with the series at 63 days in 2018 and crossing zero during 2024; the handoff from initial-access broker to secondary group collapsing to 22 seconds in 2025 from over eight hours in 2022; exploits the leading initial infection vector for the sixth consecutive year at 32%, which is Mandiant's own initial-vector figure and is kept separate from IBM X-Force's 40%; highly interactive voice phishing at 11%; and malware capable of querying language models mid-execution. The word estimated is Mandiant's own on the negative-seven-days figure.
  16. Primary. IBM X-Force Threat Intelligence Index 2026, ibm.com/reports/threat-intelligence, 25 February 2026. The 40 and 32% split and the 56% figure sit in the gated report body and are confirmed across independent carries.
  17. Primary. Bundeskriminalamt press release of 20 July 2026, bka.de/DE/Presse/Listenseite_Pressemitteilungen/2026/Presse2026/260720_PM_Kratos.html. The franchisee and campaign figures are stated by the BKA in the reportive subjunctive, which is the form a German authority uses for what is alleged rather than established, and they are carried in that form here.
  18. Primary. eSentire Threat Response Unit, 2025 Year in Review and 2026 Threat Landscape Outlook, esentire.com/blog/key-statistics-esentire-2026-annual-cyber-threat-report, 15 January 2026.
  19. Primary. Okta Threat Intelligence, Houssem Eddine Bordjiba, "Vishing actors target Entra passkey enrollment", okta.com/blog/threat-intelligence/vishing-actors-target-microsoft-entra-passkey-enrollment-, 5 July 2026. Okta states that it has not directly observed compromise of a Microsoft account through its own visibility, and hedges the enrolment step as its reading of the kit's code; both hedges are carried at full strength in Section 3 and at Part VI, entry 8.
  20. Primary. Hunt.io and Bob Diachenko, hunt.io/blog/thailand-ministry-finance-targeted-with-hermes-ai-agent, 23 July 2026.
  21. Primary. SpyCloud Labs, "Remus: A New Infostealer Hunting Wallets, Passwords, and AI Credentials", spycloud.com/blog/remus-a-new-infostealer/, 11 September 2026, fetched 22 September 2026. First appearance is SpyCloud's own hedge, being around March 2026 on the evidence of marketplace advertisement history.
  22. Primary. JFrog security advisory and CVE record for CVE-2026-42016, cve.org/CVERecord?id=CVE-2026-42016, published 27 July 2026, CVSS 8.1, credited to Kostya Kortchinsky at OpenAI.
  23. Primary, the standards body's own documents and its working group's own record. World Wide Web Consortium, Web Authentication: An API for accessing Public Key Credentials Level 1, W3C Recommendation, 4 March 2019, w3.org/TR/webauthn-1/, read 30 September 2026, which defines the Simple Transaction Authorization Extension at 10.2 and the Generic Transaction Authorization Extension at 10.3. Level 2, W3C Recommendation, 8 April 2021, w3.org/TR/webauthn-2/, read 30 September 2026, defines neither: its defined extensions are appid, appidExclude, uvm, credProps and largeBlob. The decision is recorded at w3c/webauthn issue 1386, "Remove unimplemented extensions", github.com/w3c/webauthn/issues/1386, read 30 September 2026, which also records that the extensions will remain registered in the IANA Registry and can still be used, if implemented. Rusnak's message is at lists.w3.org/Archives/Public/public-webauthn/2021Mar/0014.html, 4 March 2021, read 30 September 2026. The quoted wording of the working group and of Rusnak is reproduced as written, including its slips. The full text of Level 1 sections 10.2 and 10.3 was not returned by the retrieval tool and no mechanism is asserted from them; what the extensions were for is carried on Rusnak's words and on their titles.
  24. Primary, a document in the standards body's own repository. "WebAuthN + Payment Request = Payment AuthZ", a proposal document in w3c/webauthn-pay, the W3C repository of the joint task force of the Web Authentication and Web Payments Working Groups, github.com/w3c/webauthn-pay/blob/gh-pages/proposals/pr-webauthn-txconf.md, read 1 October 2026. The document carries no stated author and no date, so it is cited for the reasons it records rather than as a resolution of either working group. Its wording is reproduced as written: Very few authenticators support Transaction Confirmation as they don't have a secure hardware display; Browsers have not implemented the txAuthSimple or txAuthGeneric extensions (which are the WebAuthn entrypoint to this functionality) for this reason and therefore these are likely to be removed in future; and Browsers have also expressed concerns about accepting free-text as input to a TxConf algorithm.
  25. Primary. World Wide Web Consortium, Secure Payment Confirmation, Candidate Recommendation Draft of 2 July 2026, w3.org/TR/secure-payment-confirmation, read 28 September 2026. The payee, the amount and the currency travel in CollectedClientPaymentData, inside the client data the authenticator signs, rather than in the challenge, which is what makes the signature specific to that payment; the specification's own words are that the challenge is only used to defeat replay attacks and that the payment-specific information is included in the client data, which cannot be tampered with by script.
  26. Primary, and written by the card networks' own people. FIDO Alliance, Secure Payment Confirmation, white paper, December 2024, fidoalliance.org/wp-content/uploads/2025/01/Secure-Payment-Confirmation-2024-FINAL.pdf, read 1 October 2026. Editors: Marc Findon of Nok Nok Labs, Jonathan Grossar of Mastercard, Frank-Michael Kamm of Giesecke and Devrient, Henna Kapur of Visa, Sue Koomen of American Express, Gregoire Leleux of Worldline, Alain Martin of Thales, and Stian Svedenborg of BankID BankAxept. It records that at the time of writing the availability of the Secure Payment Confirmation API is limited to Google Chrome and Microsoft Edge browsers and to macOS, Windows and Android operating systems, and that Secure Payment Confirmation is currently published as a W3C Candidate Recommendation with ongoing work to include it as an authentication method in EMVCo specifications. The paper gives an EMV 3-D Secure version number which the retrieval tool returned ambiguously, so no version number is stated here.
  27. Primary, the card network's own presentation to the standards body. Douglas Fisher, Visa, "SPC Pilot Update", presented to the W3C Web Payments Working Group at TPAC, 23 September 2024, w3.org/2024/Talks/TPAC/visa-spc-20240923.pdf, read 1 October 2026, and marked on its own first page as not a W3C Submission. It records that Visa is currently conducting production pilots of SPC with 3DS in the EU; that pilot one has PLUSCARD participating as issuer processor along with Sparkasse Neunkirchen and DKB as issuers, and pilot two has S-Pankki participating; that the participants are identified as employees of those organisations and of Visa; that one slide asks whether participants think SPC is ready for consumer testing; that the objective is to obtain feedback on any barriers that would prevent SPC from scaling globally from the consumer and technical perspectives; and, in its own words, that it will be difficult to have wide-spread adoption of SPC authentication given the current support levels of the different OS's (Windows, Mac, Android, but not iOS/iPadOS) and browsers (only Chrome and Edge). Two claims circulating about Secure Payment Confirmation are not carried in this document because they do not survive their sources: that Chrome ships the interface but treats it as a low priority, and that non-trivial usage is concentrated in Asia. Both sentences are in the Web Payments Working Group minutes of 26 February 2026, w3.org/2026/02/26-wpwg-minutes.html, read 1 October 2026, and both were said by Stephen McGruer of Google under the agenda heading Facilitated payment links, about a different interface.
  28. Primary, the vendor's own standards-position record. WebKit, standards-positions repository, issue 30, Secure Payment Confirmation, github.com/WebKit/standards-positions/issues/30, read 5 October 2026. Maciej Stachowiak of Apple, verbatim: "This seems to have a some overlap in purpose with Payment Handler API. But it's not an extension of it. Why does the web platform need two different ways for payment providers to hook into PaymentRequest? Separately, for Apple ports our policy has been to only support the ApplePay PaymentRequest method to minimize user confusion and make sure that PaymentRequest API payments always get the same level of security and privacy protection. We don't ship other PaymentRequest methods or PaymentHandler. We probably wouldn't ship this either for the same reason." The grammar of the first sentence is his. The issue remains open and Safari has not implemented the specification. Supports Apple's stated reason for not implementing the mechanism that would bind a cardholder's assent to the amount.
  29. Primary. Chrome for Developers, content scripts documentation, developer.chrome.com/docs/extensions/develop/concepts/content-scripts.
  30. Primary. Google, Chrome extension documentation, match patterns, developer.chrome.com/docs/extensions/develop/concepts/match-patterns, which is the live canonical page, verified 22 September 2026. The older path developer.chrome.com/docs/extensions/match_patterns still resolves and redirects to it.
  31. Primary. Chrome for Developers, host permissions documentation, developer.chrome.com/docs/extensions/develop/concepts/declare-permissions.
  32. Primary. MDN Web Docs, host permissions, developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/host_permissions.
  33. Primary, a null established by search. Google's declare-permissions page, developer.chrome.com/docs/extensions/develop/concepts/declare-permissions, its permission-warnings page, developer.chrome.com/docs/extensions/develop/concepts/permission-warnings, and Mozilla's permissions documentation, developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions, each read 15 September 2026. Extensions are classified by declared permission strings and match patterns, and no vendor page states that the platform distinguishes them by purpose, sensitivity or category.
  34. Primary. Chrome for Developers, Manifest V3 overview, developer.chrome.com/docs/extensions/develop/migrate/what-is-mv3.
  35. Primary. Google, Chrome extension documentation, the userScripts API, developer.chrome.com/docs/extensions/reference/api/userScripts, read 27 September 2026, in these words: the User Scripts API lets you run arbitrary code, and this API is required for extensions that run scripts provided by the user that cannot be shipped as part of your extension package. Available from Chrome 120 under Manifest V3.
  36. Primary. The Chromium Projects, Site Isolation, chromium.org/Home/chromium-security/site-isolation.
  37. Primary. Project documentation for Electron, at its home page, electronjs.org; the Chromium Embedded Framework, chromiumembedded.github.io/cef/; Microsoft WebView2, learn.microsoft.com/en-us/microsoft-edge/webview2/; and Tauri, tauri.app/concept/architecture/; read 15 September 2026.
  38. Primary. Electron, Why Electron, electronjs.org/docs/latest/why-electron, read 15 September 2026. The examples are the maintainers' own, given in support of the technology.
  39. Primary. Felix Rieseberg, Electron maintainer, "Things people get wrong about Electron", felixrieseberg.com/things-people-get-wrong-about-electron, January 2025.
  40. Primary. Electron, security guidance, electronjs.org/docs/latest/tutorial/security, read 15 September 2026, including the default history for node integration, context isolation and the sandbox.
  41. Primary. The Chromium Projects, adding to third_party, chromium.googlesource.com/chromium/src/+/main/docs/adding_to_third_party.md, read 26 September 2026. Third-party code is held in //third_party and recorded in DEPS and README.chromium. Adding a dependency requires Technical Steering Council approval on a written case covering the upstream repository, motivation and alternatives considered, a security assessment, a maintenance plan and the expected build time and binary size impact; then, in the project's own words, get security@chromium.org (or chrome-security@google.com, Google-only) approval, and document all security considerations, concerns, and risks in the Description: field of the README.chromium; then a third-party reviewer for licence compliance and metadata; then sign-off from //third_party/OWNERS. README.chromium records the licence, version, security criticality and update mechanism, and OWNERS names two Chromium committers responsible for maintenance.
  42. Primary. MetaMask, metamask-extension repository, github.com/MetaMask/metamask-extension, read 26 September 2026, in these words: the MetaMask browser extension enables browsing Ethereum blockchain enabled websites, and MetaMask supports Firefox, Google Chrome, and Chromium-based browsers. Building it requires Node.js version 24 and the Yarn package manager enabled through Corepack, and it bundles with Webpack.
  43. Primary, and it is a contributor's build log rather than a vendor statement. MetaMask extension, GitHub issue 5728, "Cant build deps", opened by tomtom87 on 12 November 2018, github.com/MetaMask/metamask-extension/issues/5728, read 15 September 2026. The log records the package tool auditing 212,620 packages in 45.235 seconds and reporting nineteen vulnerabilities, and carries the tool's own warnings that five packages appear in both the development and the production trees.
  44. Primary. GitHub dependency graph for MetaMask/metamask-extension, github.com/MetaMask/metamask-extension/network/dependencies, read 15 September 2026. Computed by GitHub from the repository's manifests and lock files, which is how GitHub documents the graph at docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph, read 28 September 2026.
  45. Primary. OWASP Dependency-Check project documentation, owasp.org/www-project-dependency-check, for the method: establishing whether a catalogue identifier exists for a component and linking to the advisories recorded against it.
  46. Primary, each party on its own product. Socket, "Introducing Socket", socket.dev/blog/introducing-socket, read 4 October 2026, in these words: Socket uses deep package inspection to characterize the behavior of an open source package; Socket can detect when packages use security-relevant platform capabilities, such as the network, filesystem, or shell; the tell-tale signs of a supply chain attack, including the introduction of install scripts, obfuscated code, high entropy strings, or usage of privileged APIs; vulnerability scanners like Snyk or Dependabot merely look up the packages you're using to see if any vulnerabilities have been reported to public CVE databases; and looking for known vulnerabilities is reactive. Veracode, "Veracode Acquires Phylum, Inc. Technology to Transform Software Supply Chain Security", businesswire.com/news/home/20250106967344/en/Veracode-Acquires-Phylum-Inc.-Technology-to-Transform-Software-Supply-Chain-Security, 6 January 2025, read 4 October 2026, in these words: certain assets of Phylum, Inc., including its malicious package analysis, detection, and mitigation technology; a fully automated malicious code analysis pipeline; and newly published packages are analyzed within seconds. Veracode's comparative detection-rate claim appears in the same release and is not used.
  47. Primary, peer-reviewed preprint, read at source. WalletProbe, arxiv.org/abs/2504.11735, read 4 October 2026, in its own words: a mutation-based testing framework based on visual-level oracles; and, by applying WalletProbe on 39 widely-adopted browser-based wallet extensions, we astonishingly figure out all of them can be abused to steal crypto assets from innocent users. It records 13 attack vectors and 21 concrete attack strategies, and that 26 issues had already been patched by wallet developers at the time of writing.
  48. Secondary, three accounts, each read at source. Check Point Research, "The Great NPM Heist: September 2025", blog.checkpoint.com/crypto/the-great-npm-heist-september-2025, 10 September 2025, re-read 4 October 2026, for the phishing domain npmjs.help with the sender address support@npmjs.help, registered on 5 September, three days before the attack; the message telling the maintainer his account would be locked unless he updated his 2FA credentials within 48 hours; eighteen or more packages including chalk, debug, ansi-styles and strip-ansi; and more than two billion weekly downloads between them with debug alone at roughly 357 million. The count and the download figure were re-read at source on 15 October 2026, in these words: "resulting in the injection of cryptocurrency-stealing malware into 18+ foundational npm packages" and "These packages collectively accounted for over 2 billion weekly downloads". The page lists eighteen under Affected Packages, so the prose carries eighteen or more and attributes the download figure to the eighteen named. The Check Point page does not state how long the poisoned versions were live and says nothing about dependency-tree depth. The two-hour figure is Unit 42's: Palo Alto Networks, "Breakdown: Widespread npm Supply Chain Attack Puts Billions of Weekly Downloads at Risk", paloaltonetworks.com/blog/cloud-security/npm-supply-chain-attack, read 4 October 2026, in these words: these malicious versions were live on the npm registry for approximately 2 hours. Corroborated by Sygnia, 11 September 2025, sygnia.co/threat-reports-and-advisories/npm-supply-chain-attack-september-2025, and Trend Micro Research, 18 September 2025, trendmicro.com/en_us/research/25/i/npm-supply-chain-attack.html. The dependency relationships are read from npm's own registry metadata, 4 October 2026, and npm's package pages show them at npmjs.com/package/chalk/v/4.1.2, npmjs.com/package/strip-ansi and npmjs.com/package/debug: chalk 4.x declares ansi-styles and supports-color; strip-ansi declares ansi-regex; debug declares ms.
  49. Secondary. Check Point Research, as above, for the sentence that even where the interface looks correct the signed transaction routes funds to the attacker.
  50. Secondary. Pulsedive, blog.pulsedive.com/npm-compromise-the-wrath-of-the-shai-hulud-supply-chain-attack, 25 September 2025, with Sonatype on the same campaign.
  51. Secondary. JFrog, jfrog.com/blog/new-compromised-packages-in-largest-npm-attack-in-history, 1 December 2025, with Unit 42, Palo Alto Networks, on the November return and pre-install execution.
  52. Primary. LavaMoat, github.com/LavaMoat/LavaMoat, and the SES containers it rests on, both written in JavaScript and executing inside the JavaScript environment they are intended to contain.
  53. Primary. Bruno Halltari and Caue Obici, OtterSec, "Supply chain attacks: a new era", osec.io/blog/supply-chain-attacks-a-new-era, 10 June 2024, verified 22 September 2026. The dated path osec.io/blog/2024-06-10-supply-chain-attacks-a-new-era redirects to it. OtterSec's own words: two vulnerabilities in the Lavamoat project, a policy file bypass and a scuttling bypass, and by combining the exploits it is possible to completely bypass LavaMoat supply-chain protections using a compromised dependency. Its own qualification, carried in the text: the lavapack release with a mitigation was available in under two days, and the inherent complexity makes designing robust security implementations a challenging task. No first-party response from the LavaMoat maintainers to this paper was located, searched at the LavaMoat repository, its security policy and the open web on 22 September 2026.
  54. Primary. Sonatype, 2026 State of the Software Supply Chain, introduced by Brian Fox, co-founder and chief technology officer, landing page sonatype.com/state-of-the-software-supply-chain/introduction and report at sonatype.com/hubfs/1-2025_Website-Assets/SSCR_2025/SSCR_2026_final.pdf, last modified 28 January 2026, fetched and read 22 September 2026. The sentence is in the report body and not on the ungated landing page: at this pace, traditional manual review and approval models do not scale. The report adds that when hundreds of thousands of critical releases exist in a single year, teams cannot rely on manual review or reactive patching.
  55. A null established by search, 15 September 2026. No first-party incident report was found in which an actor is documented using a model or an agent to search a dependency tree or a package corpus for conditional payloads or targets.
  56. Primary. Ledger, the secure screen security model, ledger.com/academy/topics/ledgersolutions/ledger-wallets-secure-screen-security-model, with Ledger support on why hardware wallets are now known as signers.
  57. Primary. Trezor, what is a trusted display, trezor.io/guides/trezor-devices/trezor-fundamentals/what-is-a-trusted-display.
  58. Primary. Ledger, ledger-live monorepo, the Ledger Live Desktop readme, github.com/LedgerHQ/ledger-live/blob/develop/apps/ledger-live-desktop/README.md, read 26 September 2026, in these words: the app is built with Electron, React, Redux, and RxJS, and it uses shared Ledger Wallet logic to communicate with devices, synchronize accounts, and prepare transactions. The package manager is pnpm.
  59. Primary. Ledger, security incident report and the letter from the chairman and chief executive on the Connect Kit exploit, ledger.com/blog/security-incident-report and ledger.com/blog/a-letter-from-ledger-chairman-ceo-pascal-gauthier-regarding-ledger-connect-kit-exploit, December 2023, the incident report re-read 26 September 2026 for the delivery path, which it gives in these words: the attacker published on NPMJS (a package manager for Javascript code shared between apps), a malicious version of the Ledger Connect Kit; the malicious Connect-Kit code was then dynamically loaded by DApps who already integrate the Connect-Kit-loader; the CDN used by Ledger for the distribution is NPMJS; due to the nature of CDN (Content Delivery Network) and caching mechanisms on the Internet, the malicious file remained accessible for a little longer; and, on what was not reached, in the Ledger Connect Kit exploit, the attacker did not at any time have access to any Ledger infrastructure, Ledger code repository, or to DApps themselves.
  60. Primary. Atomic Wallet, statement on the event of 3 June 2023, atomicwallet.io/blog/articles/june-3rd-event-statement, listing four possible causes, confirming none, and putting the affected population at under 0.1% of users.
  61. Primary for Elliptic's own figure, secondary for the refusal to confirm. Dr Tom Robinson, Elliptic, "North Korea-linked Atomic Wallet heist tops $100 million", elliptic.co/insights/north-korea-linked-atomic-wallet-heist-tops-100-million, live page dated 2 August 2023, verified 22 September 2026, in these words: reported losses suffered by Atomic Wallet users have risen to more than $100 million, and Elliptic is tracking over 5,000 crypto wallets believed to have been compromised. Elliptic also records that there has still been no explanation from Atomic Wallet regarding the root cause. A figure of over 5,500 wallets circulates attributed to Elliptic and is CoinDesk's report of 13 June 2023 rather than Elliptic's live wording, so it is not used here. Decrypt, decrypt.co/145765/atomic-wallet-claims-less-than-0-1-of-users-affected-by-100m-hack, 22 June 2023, for Atomic Wallet declining to confirm the amount taken.
  62. Primary, the broker's own published rates. Crowdfense, Exploit Acquisition Program, crowdfense.com/exploit-acquisition-program/, page last modified 19 November 2025, read 5 October 2026. The fund is stated at USD 30 million, expanded from USD 10 million. The rates as published: iOS zero click full chain, from 5 to 7 M USD; Android zero click full chain, 5 M USD; Safari one click full chain (RCE + SBX + LPE), from 2,5 to 3,5 M USD; Chrome one click full chain (RCE + v8 SBX + SBX + LPE), from 2 to 3 M USD; Microsoft Windows zero click full chain, 1 M USD; Chrome (RCE without sandbox escape), 500k USD; Apache HTTP Server (RCE), 500k USD; Microsoft IIS (RCE), 500k USD; WordPress (RCE), 500k USD; Microsoft Word or Excel (RCE), 500k USD; Microsoft Hyper-V, 500k USD; VMware ESXi, 500k USD; Nginx (RCE), 350k USD; Microsoft Outlook (RCE), 300k USD; Microsoft Exchange (RCE), 250k USD; Microsoft SharePoint (RCE), 250k USD; SAP (RCE), 250k USD; OpenSSL (RCE), 250k USD; PHP (RCE), 250k USD; Adobe Acrobat Reader (RCE + SBX), 200k USD; Microsoft Windows (sandbox escape), 150k USD; Microsoft Windows (local privilege escalation), 100k USD; Linux (local privilege escalation), 100k USD; Apple Mac OS (local privilege escalation), 100k USD; cPanel or WHM (RCE), 100k USD; Plesk (RCE), 100k USD; NAS, Synology or QNAP (RCE), 60k USD; Hikvision (RCE), 50k USD.
  63. Quality journalism, both quotations verbatim at source. Lorenzo Franceschi-Bicchierai, "Price of zero-day exploits rises as companies harden products against hackers", TechCrunch, 6 April 2024, techcrunch.com/2024/04/06/price-of-zero-day-exploits-rises-as-companies-harden-products-against-hackers/, read 5 October 2026. Paolo Stagno, Crowdfense's director of research, in these words: the mitigations that vendors are implementing are working, and it's leading the whole trade to become much more complicated, much more time-consuming, and so clearly this is then reflected in the price. Shane Huntley, Google Threat Analysis Group, in these words: as more zero-day vulnerabilities are discovered by threat intelligence teams like Google's, and platform protections continue to improve, the time and effort required from attackers increases, resulting in an increase in cost for their findings. The piece also carries Crowdfense's 2024 ranges, iPhones at 5 to 7 million dollars and Android at up to 5 million, against its 2019 top rate of 3 million for Android and iOS, and Operation Zero of Russia at up to 20 million.
  64. Primary, read at source, every figure verbatim. Nicholas Carlini, Newton Cheng, Keane Lucas, Michael Moore, Milad Nasr, Vinay Prabhushankar and Winnie Xiao with further contributors, Anthropic Frontier Red Team, "Claude Mythos Preview's cybersecurity capabilities", 7 April 2026, published at red.anthropic.com/2026/mythos-preview, which redirects to anthropic.com/research/mythos-preview, read there 5 October 2026. The figures in the page's own words: across a thousand runs through our scaffold, the total cost was under $20,000, on the OpenBSD SACK vulnerability; the specific run that found the bug above cost under $50; several hundred runs over the repository, at a cost of roughly ten thousand dollars, on FFmpeg; we have nearly a dozen examples of Mythos Preview successfully chaining together, on Linux kernel privilege escalation; creating this exploit (starting from the syzkaller report) cost under $1000 at API pricing, and took half a day to complete, on the slab-out-of-bounds chain against CVE-2024-47711; and the complete pipeline took under a day to complete at a price of under $2,000, on the use-after-free chain.
  65. Primary. UK AI Security Institute, aisi.gov.uk/blog/our-evaluation-of-openais-gpt-5-5-cyber-capabilities, 30 April 2026, fetched and read in full.
  66. Primary, the paper's own words and its own table. Zilong Wang, Noah Schiller, Hanlin Li, Sanjana Narayana, Milad Nasr, Nicholas Carlini, Xinyu Qi, Eric Wallace, Elie Bursztein, Luca Invernizzi, Kurt Thomas, Yan Shoshitaishvili, Wenbo Guo, Jun He, Thorsten Holz and Dawn Song, "ExploitGym: Can AI agents turn security vulnerabilities into real attacks?", arXiv:2605.11086, submitted 11 May 2026, arxiv.org/abs/2605.11086, read 13 October 2026. The benchmark comprises 898 instances drawn from real-world vulnerabilities; in each the agent is given evidence that a specific vulnerability exists and is scored on producing a concrete security impact. The abstract: "while exploitation remains challenging, frontier models can successfully exploit a non-trivial fraction of vulnerabilities. For example, the strongest configurations are Anthropic's latest model Claude Mythos Preview and OpenAI's GPT-5.5, which produce working exploits for 157 and 120 instances, respectively." The results table at a two-hour timeout gives Claude Mythos Preview 157, GPT-5.5 120, GPT-5.4 54, Claude Opus 4.6 15 and Gemini 3.1 Pro 12, out of 898.
  67. Primary. Paul Kassianik and Yaron Singer, Frontier Security, "Chinese model Kimi K3 breaks UK AI Safety Institute benchmark evaluations", blog.frontier.security/chinese-model-kimi-k3-breaks-uk-ai-safety-institute-benchmark-evaluations, updated 8 August 2026, read 27 September 2026, in these words: the models are open and publicly available, and the version that escaped is the version anyone can download and run. The incident is entry 27.
  68. Primary, the Institute's own post, quotations verbatim. UK AI Security Institute, "How far behind the frontier are leading open weight models on cyber?", aisi.gov.uk/blog/how-far-behind-the-frontier-are-leading-open-weight-models-on-cyber, 17 July 2026, read 13 October 2026: "GLM-5.2 (June 2026) was the most cyber-capable open weight model at time of testing. It performs similarly to Opus 4.6 (Feb 2026) on AISI's narrow cyber tasks and Opus 4.5 (Nov 2025) on our longer-horizon cyber ranges, meaning it trails the frontier by 4 to 7 months. This is narrower than the 6 to 10 month gap we measured in internal evaluations of open weight models released from January to September 2025." On cost: "A 100M-token cyber range run cost roughly $85 for both Opus 4.5 and 4.6, versus an estimated $46 for GLM-5.2 and $1.19 for DeepSeek V4-Pro at current pricing. Across tasks that both models being compared solved with 100% reliability, Opus 4.6 cost $15.17 per task versus GLM-5.2's $6.12, and Opus 4.5 cost $12.50 per task versus DeepSeek V4-Pro's $0.28." The Institute ties the four-to-seven-month figure to GLM-5.2 and not to DeepSeek V4-Pro, and this document keeps that pairing. The glossary's worked case of an open-weight model rests on DeepSeek's own model cards on Hugging Face, both read 31 October 2026. The card at huggingface.co/deepseek-ai/DeepSeek-V4-Pro gives the licence as MIT and says that "This repository and the model weights are licensed under the MIT License"; the card at huggingface.co/deepseek-ai/DeepSeek-V4-Flash says the same. Both say "We pre-train both models on more than 32T diverse and high-quality tokens" and link a technical report at arxiv.org/abs/2606.19348, and neither mentions training code or releases a training dataset. The technical report and DeepSeek's GitHub organisation were not read.
  69. Primary. exo, the exo-explore/exo repository, github.com/exo-explore/exo, read 30 September 2026, in its own words: run frontier AI locally; exo connects all your devices into an AI cluster, and not only enables running models larger than would fit on a single device but, with support for RDMA over Thunderbolt, makes models run faster as you add more devices. The M4 Pro Mac mini, the M4 Max and M3 Ultra Mac Studio and the M4 Max MacBook Pro are the devices it names, and Qwen3-235B, DeepSeek v3.1 671B and Kimi K2 Thinking are among the models in its benchmarks.
  70. Primary. Sysdig Threat Research, Alessandro Brucato, "LLMjacking: Stolen Cloud Credentials Used in New AI Attack", sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack, 6 May 2024, read 30 September 2026: stolen cloud credentials used to target ten cloud-hosted large language model services, AI21 Labs, Anthropic, AWS Bedrock, Azure, ElevenLabs, MakerSuite, Mistral, OpenAI, OpenRouter and GCP Vertex AI, at a cost to the victim of over 46,000 dollars a day. Sysdig Threat Research, "The Growing Dangers of LLMjacking", sysdig.com/blog/growing-dangers-of-llmjacking, 18 September 2024, read 30 September 2026, for the motives, which range from personal use at no cost to selling access to people banned by their service and to entities in sanctioned countries.
  71. Primary. Microsoft, "Disrupting a global cybercrime network abusing generative AI", blogs.microsoft.com/on-the-issues/2025/02/27/disrupting-cybercrime-abusing-gen-ai, 27 February 2025, read 30 September 2026, in these words: members of Storm-2139 exploited exposed customer credentials scraped from public sources to unlawfully access accounts, then altered the capabilities of these services and resold access to other malicious actors; Microsoft's Digital Crimes Unit filed a lawsuit in the Eastern District of Virginia in December 2024.
  72. Primary, peer-reviewed, abstract and paper body both read. Manos Antonakakis and eighteen co-authors, "Understanding the Mirai Botnet", 26th USENIX Security Symposium, 2017, usenix.org/conference/usenixsecurity17/technical-sessions/presentation/antonakakis, read 30 September 2026. The abstract's words: a botnet composed primarily of embedded and IoT devices, which took the Internet by storm in late 2016 when it overwhelmed several high-profile targets with massive distributed denial-of-service attacks, and a peak of 600k infections. The paper body, usenix.org/system/files/conference/usenixsecurity17/sec17-antonakakis.pdf, read the same day, for the two facts the abstract does not carry: reports of Mirai appeared as early as August 31, 2016, and on October 21, 2016, Dyn, a popular DNS provider, suffered a series of DDoS attacks. The paper names OVH and Krebs on Security as targets alongside Dyn, and those are not carried in the prose.
  73. Secondary, and attributed. A FINMA spokesperson answering Bloomberg News, 24 April 2026. Bloomberg's own piece is paywalled at bloomberg.com/news/articles/2026-04-24/finma-says-immediate-mythos-access-would-pose-systemic-bank-risk; the open reprint of the same Bloomberg copy, marked as Bloomberg's, is at swissinfo.ch/eng/finma-says-immediate-mythos-access-would-pose-systemic-bank-risk/91312240, read 27 September 2026, and both quoted sentences are verbatim from it. No page on finma.ch carries this quotation: these are a regulator's words given to a news agency, not a circular or a press release. The nearest official FINMA texts in the window are Amstad's annual media conference remarks of 21 April 2026 and her Point Zero Forum speech of 23 June 2026, and neither reproduces this wording; the June speech makes a different systemic claim, about concentration among a few models.
  74. Primary. IBM X-Force Threat Intelligence Index 2026, ibm.com/reports/threat-intelligence, 25 February 2026, fetched and read in full at the landing article.
  75. Primary. Rapid7, 2026 Global Threat Landscape Report, rapid7.com/research/report/global-threat-landscape-report-2026, 18 March 2026.
  76. Primary. Verizon, 2026 Data Breach Investigations Report, verizon.com/business/resources/reports/dbir, 19 May 2026, fetched and read 10 August 2026.
  77. Primary. Jeremy Kirk, Okta Threat Intelligence, "Signing in without actually signing in", okta.com/blog/threat-intelligence/signing_in_without_actually_signing_in, 9 September 2026, re-fetched 22 September 2026. A registration form on that page gates six images; the provider table, the token counts, the passage on interface keys and the quoted sentence are ungated. The three billing outcomes are cited by Okta from Unit 42, from a named individual's public account and from The Register, and were not measured by Okta in this collection.
  78. Primary. Josh Amishav, Breachsense, "August 2026 Infostealer Report", breachsense.com/infostealer-reports/august-2026, updated 8 September 2026. Breachsense sells monitoring against this data; its published method and its own statement of what the figures cannot show are carried in the text.
  79. Secondary, two independent accounts agreeing. Help Net Security, helpnetsecurity.com/2026/07/30/ibm-cost-of-a-data-breach-2026, and Insurance Journal, insurancejournal.com/news/national/2026/07/29/879536.htm, both 29 to 30 July 2026, reporting the IBM and Ponemon Cost of a Data Breach Report 2026. The report body sits behind a registration form.
  80. Primary. NIST, nist.gov/news-events/news/2026/04/nist-updates-nvd-operations-address-record-cve-growth, 15 April 2026, fetched and read 10 August 2026.
  81. Primary. NIST, "Critical Software - Definition and Explanatory Material", issued under Executive Order 14028, nist.gov/itl/executive-order-14028-improving-nations-cybersecurity/software-supply-chain-security-guidance-26, created 24 June 2021 and page updated 8 July 2026, fetched and read 22 September 2026. The table carries the row: identity, credential, and access management (ICAM), being software that centrally identifies, authenticates, manages access rights for, or enforces access decisions for organizational users, systems, and devices. NIST states on the same page that the table is a preliminary list of software categories considered to be EO-critical and that CISA will provide the authoritative list at a later date. The Order's own text, at bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity, does not name identity, credential and access management; section 4(g) directs NIST to publish the definition.
  82. Primary. Athanasios Vamvakidis and Jason Wu, International Monetary Fund, "Global Financial Markets Face Rising Risks From AI, Bond Yields, and Cyberattacks", imf.org/en/blogs/articles/2026/10/12/global-financial-markets-face-rising-risks-from-ai-bond-yields-and-cyberattacks, 13 October 2026, read at source 15 October 2026, in these words: "cyber disruptions have emerged as a growing source of systemic risk"; "In more than 70 percent of reported cases so far this year, software providers had almost no time to patch"; "That's more than double the share in 2021, when providers typically had close to 300 days to fix vulnerabilities."; "Frontier AI models could accelerate both attacks and defenses"; and cyber events "capable of disrupting payments, trading, access to deposits, or other critical financial services." The authors' titles are not given on the page and none is stated here.
  83. Primary. Juan Carlos Crisanto, Adrien Currat and Jeffery Yong, When machines attack: frontier AI cyber threats and policy responses in the financial sector, Financial Stability Institute Occasional Paper No 28, Bank for International Settlements, September 2026, bis.org/publications/fsi-paper-28-when-machines-attack-frontier-ai-cyber-threats-and-policy-responses-financial-sector, with the paper itself at bis.org/publications/fsi-paper-28-when-machines-attack-frontier-ai-cyber-threats-and-policy-responses-financial-sector.pdf, read in full 13 October 2026. For the export control sequence: a United States directive of 12 June 2026 led Anthropic to disable access to Claude Fable 5 and Claude Mythos 5 for all foreign users, the Commerce Secretary subsequently allowed Claude Mythos 5 access for 100 vetted United States organisations, and the control was lifted when Anthropic implemented a new safeguard addressing the concern behind it; the paper's own timeline gives 12 June for the directive and 1 July for the lifting, citing Anthropic (2026h), Smith (2026) and Hammond and Miller (2026). For the attack-chain cost: the paper carries Aldasoro, Auer, Frost and Pérez-Cruz, "A Mythos moment? Frontier AI and cyber risk", BIS Bulletin no 129, estimating the cost of mounting a full attack chain at $5,000 to $10,000 for Mythos Preview and $50 to $100 for DeepSeek. The views in an FSI Occasional Paper are the authors' and are stated by the BIS not to represent the BIS, its member central banks or the Basel-based standard setters.
  84. Primary. FIRST Forecasting Team, Jerry Gamblin and Eireann Leverett, "The 2026 Vulnerability Forecast Update: Navigating the AI Epoch", first.org/blog/20260615-vulnerability-forecast-update, 15 June 2026.
  85. Primary. Moghimi, Sunar, Eisenbarth and Heninger, "TPM-FAIL: TPM meets Timing and Lattice Attacks", Proceedings of the 29th USENIX Security Symposium, 2020, usenix.org/conference/usenixsecurity20/presentation/moghimi-tpm.
  86. Primary, and the two manufacturers' own advisories. Jalen Chuang, Nicolas Berrios and Daniel Genkin (Georgia Institute of Technology), Alex Seto and Christina Garman (Purdue University), and Stephan van Schaik (van Schaik, LLC), "TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition", project site https://tee.fail/, read 5 October 2026, accepted at the 47th IEEE Symposium on Security and Privacy, 2026. The site records the extraction of the provisioning certification key, in its own words a per-CPU signing key used in the signature chain to sign the actual keys used in both SGX and TDX attestation, and states that the components are readily available and it should cost you under $1000 to build a setup similar to ours. Intel, security announcement INTEL-2025-10-28-001, "TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition", https://www.intel.com/content/www/us/en/security-center/announcement/intel-security-announcement-2025-10-28-001.html, 28 October 2025, read 5 October 2026, which states that the research does not change Intel's previous out of scope statement for these types of physical attacks and records the affected platforms as 4th and 5th generation Intel Xeon Scalable and Intel Xeon 6 processors. AMD, security bulletin AMD-SB-3040, https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3040.html, 28 October 2025, read 5 October 2026, which states that AMD does not plan to provide mitigations since physical vector attacks are out of scope for AMD SEV-SNP.
  87. Primary. Buhren, Jacob, Krachenfels and Seifert, arXiv 2108.04575, arxiv.org/abs/2108.04575.
  88. Primary. Cybersecurity and Infrastructure Security Agency, National Security Agency and Federal Bureau of Investigation, "PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure", AA24-038A, 7 February 2024, read at source 15 October 2026 at the Federal Bureau of Investigation's file repository, fbi.gov/file-repository/cyber-alerts/prc-state-sponsored-actors-compromise-and-maintain-persistent-access-to-u-s-critical-infrastructure.pdf, for every quotation above and for the co-releasing agencies, which include the Department of Energy, the Environmental Protection Agency, the Transportation Security Administration and the national centres of Australia, Canada, the United Kingdom and New Zealand. cisa.gov refused automated retrieval of the same advisory.
  89. Primary, and not read at source by the author. Cybersecurity and Infrastructure Security Agency, with the National Security Agency, the Federal Bureau of Investigation and international partners, "Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System", AA25-239A, revised 3 September 2025, cisa.gov/news-events/cybersecurity-advisories/aa25-239a. That address returned an error to the author's retrieval, as the companion advisory did. The quotations are taken from the advisory's own technique tables as read in a sourcing pass of 15 October 2026 and are marked accordingly. The advisory's own list of targeted sectors is not quoted here and no claim is made about which sectors it names, because that part of the page was not read at source. The electric sector's own advisory is AA24-038A at the preceding note, which does name Energy.
  90. Primary. United States-China Economic and Security Review Commission, 2025 Annual Report to Congress, chapter 10, "Power Surge: China's Electrification Drive and Push for Global Energy Dominance", uscc.gov/sites/default/files/2025-11/Chapter_10--Power_Surge_Chinas_Electrification_Drive_and_Push_for_Global_Energy_Dominance.pdf, read at source 15 October 2026, at page 571, for every quotation above. The same page records that "A cyberattack on solar inverters could direct them to either cut off solar power generation assets or add more power to the grid, leading to voltage and stability issues in the local distribution system", and that "thermal runaway events" in batteries "can be caused by malicious firmware". The gloss of what an inverter does is omitted from the quotation, because the Commission's sentence carries a dash this document does not use, and the omission is marked.
  91. Primary. OpenAI, "Safety overview: GPT-6 Astra", openai.com/index/safety-overview-gpt-6-astra/, 3 September 2026, read at source 15 October 2026, in these words: "GPT-6 Astra is a significant step up in cyber capabilities and meets our Critical threshold"; "Astra is our first model to reach the Critical level of cybersecurity capability under our Preparedness Framework"; "with the right tools and access, GPT-6 Astra can find previously unknown security flaws"; "develop new ways to exploit them across many well-protected systems without a person guiding each step"; "we significantly strengthened our protections against the model taking harmful cyber actions"; and the measures "stricter isolation, checkpoint encryption, universal monitoring of full trajectories". OpenAI, "Path to Astra: critical capabilities and frontier safeguards", openai.com/index/path-to-astra/, 1 September 2026, read at source 15 October 2026: "Astra is the first OpenAI model to meet the Critical cybersecurity capability threshold under the Preparedness Framework", and "Since deploying the first model we treated as High capability in cybersecurity in February". That page names no earlier model, and this document names none on its authority.
  92. Primary. Palo Alto Networks Unit 42, Arie Olshtein, Pass the Passkey: A Novel Attack Surface in Passwordless Authentication, 3 August 2026, https://unit42.paloaltonetworks.com/passwordless-authentication-security-risks/, read in full 10 August 2026. Three techniques against Google Password Manager and the Google Cloud Authenticator, in Chrome on Windows with a Trusted Platform Module, which authenticate without the user touching anything, bypass user-verification requirements and extract synced passkey private keys. The qualifications are the researchers' own and belong with the finding: none of the three breaks the public-key cryptography Web Authentication rests on; every path begins with malware already running on the endpoint, which is the entry condition route one's own definition contemplates rather than a limit on it; no vulnerability identifier was assigned and no exploitation in the wild was reported as at the date of publication; browsers, operating systems and password managers beyond that scope were not tested; and device-bound keys that do not synchronise a private key are outside the research and are neither proven immune nor shown vulnerable. The publisher sells identity-security remedies. Two findings inside it are the researchers' own and carry further than the headline: against one relying party the attack failed because that party validates the flag recording whether the user was verified, and against another it succeeded although that party sets user verification to required, because it did not check the returned flag; and the researchers record the provider's position that consistent signature counters are hard to implement across synchronised devices and platforms, stating in their own words that synchronised passkey systems commonly return a constant counter value, which leaves relying parties and credential providers limited visibility into unauthorised use of a synced credential. Author, date, the three techniques, the extraction of synced private keys, the two relying parties and the constant counter were read from the article itself on 8 October 2026. Dan Goodin, writing in Ars Technica on 11 August 2026, holds that the attacks are "neither novel nor unique to passkeys" and that "the attack surface extends to any data that requires authentication for access", arstechnica.com/security/2026/08/heres-why-the-new-pass-ta-key-attack-is-mostly-a-nothingburger/, read 2 November 2026.
  93. Primary, and the vendor's own documentation of its own shipped default. Yubico, YubiKey Technical Manual, FIDO specifics, https://docs.yubico.com/hardware/yubikey/yk-tech-manual/yk5-apps-fido.html. Under Locking FIDO2 Credentials: by default, no PIN is set, and the resident credentials can be left unlocked and used for strong single-factor authentication, or they can be protected by a PIN for two-factor authentication, which is achieved by performing user verification at the time of authentication. Under Default Values: PIN, none set; YubiKeys are generally shipped without a PIN; the user sets the PIN. Under Always Require User Verification: alwaysuv is disabled on the YubiKey 5 Series, reverts to disabled on reset and can be toggled, and is enabled and not disableable on the 5 FIPS Series. With it, FIDO Alliance, Client to Authenticator Protocol, Proposed Standard of 14 July 2025, being CTAP 2.2, https://fidoalliance.org/specs/fido-v2.2-ps-20250714/fido-client-to-authenticator-protocol-v2.2-ps-20250714.html, whose pre-flight description has the platform invoke authenticatorGetAssertion optionally with pinUvAuthParam, and which defaults the uv option to false on authenticatorMakeCredential. Both addresses were read on 8 October 2026, the Yubico quotations verbatim from the manual.
  94. BankID's own figures, carried. nu.se, "Utmanar BankID - därför ska du ha båda", nu.se/utmanar-bankid-darfor-ska-du-ha-bada, 13 April 2026, citing BankID's own statistics: 8.7 million unique users during 2025; 99.9% of registered Swedes aged 18 to 67 holding a BankID; approximately 7,900 connected companies, authorities and organisations. BankID, "BankID - viktigaste appen enligt svenska folket", bankid.com/om-oss/nyheter/bankid-viktigaste-appen-enligt-svenska-folket: 7.6 billion transactions during 2024, approximately 240 identifications or signatures per second, and 99.99% availability. bankid.com is JavaScript-gated to automated retrieval and its figures are carried through a search index. Both verified on 5 September 2026 and not re-fetched for this document.
  95. Primary, the scheme's own integration specification. BankID, BankID Relying Party Guidelines, version 3.4, 8 June 2020, describing RP API v5.1, fetched and read in full on 5 September 2026; BankID no longer hosts this version, and SEB, one of the banks that issue BankID, carries it at webapp.sebgroup.com/mb/mbcc.nsf/alldocsbyunid/2708B7754A045A6DC12585E5002DEC10/$FILE/bankid-relying-party-guidelines-v3.4.pdf. On completion the relying party receives an XML signature, an OCSP response and a user record containing the personal identity number, the given name, the surname and the full name, together with the end user's IP address as BankID's own servers observed it, and the Guidelines instruct the relying party to keep the completion data for future reference, compliance and audit. Sections relied on: 2.2 flow of events; 13 verifying signatures; 14.1 to 14.5 the interface description.
  96. Primary, the consumer bureau and an issuing bank. Konsumenternas Bank- och finansbyrå, "Bank-id", konsumenternas.se/konsumentstod/fakta/bankfakta/bank-id, read 7 September 2026: "Bankerna har valt att bygga systemet kring personnummer", the banks have chosen to build the system around personal identity numbers, and there is at present no possibility of obtaining a bank-id without one. The same page records that there are no legal rules governing who is to receive one, and that a bank is not obliged to offer one and may refuse regardless of reason. Swedbank, "Mobilt BankID", swedbank.se/privat/digitala-tjanster/mobilt-bankid.html: a Mobile BankID cannot be obtained with a coordination number, because "du behöver ha ett svenskt personnummer", you need a Swedish personal identity number.
  97. Primary, on the statutory mechanism. Konsumenternas Bank- och finansbyrå, "Kundkännedom", konsumenternas.se/konsumentstod/lag-ratt/vad-sager-lagen/penningtvatt---regler-inom-bank-och-forsakring/kundkannedom/, on the Swedish Money Laundering Act, lag 2017:630 om åtgärder mot penningtvätt och finansiering av terrorism, read 7 September 2026. A bank may not continue a business relationship with a customer where it considers it lacks sufficient customer knowledge to manage the money-laundering risk, and the Act is risk-based rather than prescriptive, so each bank sets its own thresholds. A further claim in circulation, that a person blocked by one bank cannot obtain a BankID through another, is not carried: it is unverified at primary level and one source cuts against it, Skandia stating that a customer of another bank may obtain a Mobile BankID from that bank.
  98. Primary, the Swedish Law Journal. Svensk Juristtidning, "Praktiska erfarenheter från BankID", svjt.se/svjt/2023/429, verified on 5 September 2026. Where the user themselves approves the fraudulent payment with their own instrument the transaction is authorised, and those executing an authorised transaction do not enjoy the protection payment services law gives on an unauthorised one. BankID's own autumn 2022 grouping of completed frauds in the phishing category indicates unauthorised transactions at 65 to 80% of criminal proceeds, corresponding to 360 to 443 million kronor for 2022, while representing an estimated 40% of reported completed offences. The same source records average use of 2.2 times per BankID per day.
  99. Secondary, an analysis piece, and the figure is an order of magnitude rather than a procurement price. War on the Rocks, "The Hidden Cost of a Missile: Why the Headlines Get Cost Wrong", warontherocks.com/the-hidden-cost-of-a-missile-why-the-headlines-get-cost-wrong/, 18 November 2025, which states a $2.5bn Arleigh Burke-class destroyer. Verified on 26 May 2026 and not re-fetched for this document.
  100. Secondary, two carries agreeing, the underlying unit costs being the Missile Defense Advocacy Alliance's as at 2022. CNN, "Red Sea shipping: How US warships are shooting down Houthi drones", cnn.com/2023/12/20/middleeast/us-destroyers-houthi-drones-red-sea-intl-hnk-ml/index.html, 20 December 2023: the SM-6 at more than $4 million each, with the average intercept cost cited at around $2 million. Responsible Statecraft, "The cost of US fighting Houthis in the Red Sea just went up", responsiblestatecraft.org/operation-prosperity-guardian/, 23 December 2023: the SM-2 at $2.1m, the SM-6 at $4.3m and the ESSM at $1.7m, munitions at $1m to $4.3m a shot, and ships unable to reload at sea. On the drones: Defence Security Asia, "U.S. Fires Missiles Worth More Than US$400 Million to Shoot Down US$2,000 Houthi Drones", defencesecurityasia.com/en/u-s-fires-missiles-worth-more-than-us400-million-to-shoot-down-us2000-houthi-drones/, 8 April 2024, giving a $2,000 one-way attack drone and the Shahed-136 at about $20,000.
  101. Secondary, three carries, each on a different part of the claim. New Lines Magazine, "Cheap Houthi Drones Are Draining the Pentagon's Coffers", newlinesmag.com/argument/cheap-houthi-drones-are-draining-the-pentagons-coffers/, 30 July 2024: cumulative cost exceeding $1 billion, and the Eisenhower Carrier Strike Group firing 155 Standard-series and 135 Tomahawk missiles over its October 2023 to June 2024 deployment. Task & Purpose, "In 15 months, the Navy fired more air defense missiles than it did in the last 30 years", taskandpurpose.com/news/navy-missiles-red-sea/, 5 March 2025: the USS Carney engagement of October 2023, around ten hours against fifteen drones and four cruise missiles, described by the Navy as the most intense surface combat engagement by a US Navy warship since the Second World War. Defense.info, "From Red Sea Defense to Epic Fury: How the U.S. Flipped the Drone Cost Equation", defense.info/featured-story/2026/03/from-red-sea-defense-to-epic-fury-how-the-u-s-flipped-the-drone-cost-equation/, 13 March 2026: every round expended being one fewer available for a stressing contingency, and the campaign assessed as winning tactically but losing strategically on cost and magazine depth.
  102. Secondary, reporting the Pentagon's own statement. Task & Purpose, "Navy destroyers down 8 Houthi drones and 8 missiles in Red Sea", taskandpurpose.com/news/navy-destroyers-houthi-missiles-drones/, 12 November 2024: the USS Stockdale and the USS Spruance attacked by at least eight one-way attack drones, five anti-ship ballistic missiles and three anti-ship cruise missiles, with the Pentagon stating that the vessels were not damaged.
  103. Secondary, two independent carries agreeing on the headline figures and a third on the two ships. CBS News, "Houthis killed and kidnapped cargo ship crew", cbsnews.com/news/houthi-attack-cargo-ships-deaths-european-naval-force-says/, 9 July 2025: between November 2023 and January 2025 the Houthis targeted more than 100 merchant vessels, sinking two and killing four sailors, with roughly $1 trillion of goods transiting the corridor annually. Al Jazeera, "Six rescued, 15 missing after Houthi attack on cargo ship in Red Sea", aljazeera.com/news/2025/7/9/five-rescued-after-suspected-attack-by-yemens-houthis-on-red-sea-vessel, 9 to 10 July 2025, corroborating the same counts. gCaptain, "List: Notable Houthi Attacks on Merchant Ships in the Red Sea", gcaptain.com/list-notable-houthi-attacks-on-merchant-ships-in-the-red-sea/, 10 July 2025: the Rubymar sinking on 2 March 2024 as the first ship struck to sink, and the Tutor in June 2024 with one crew member, believed to have been in the engine room, never found. A later escalation of July 2025, in which two further ships were sunk, is not carried, because the window here closes in January 2025 and casualty reporting on the Eternity C varied across sources between two, three and four killed.
  104. Primary. Tim McLean, "Critical vulnerabilities in JSON Web Token libraries", Auth0, auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries, 31 March 2015, fetched and read 15 August 2026. The flaws recur across node-jsonwebtoken, pyjwt, namshi/jose, php-jwt and jsjwt. The RSA to HMAC confusion attack described there carries CVE-2015-9235.
  105. Primary. Sheffer, Y., Hardt, D. and Jones, M., JSON Web Token Best Current Practices, RFC 8725, IETF, datatracker.ietf.org/doc/html/rfc8725, February 2020, fetched and read 15 August 2026. The document records that signed tokens carry an explicit indication of the signing algorithm in the header to facilitate cryptographic agility, and that this, with design flaws in some libraries and applications, has led to several classes of attack.
  106. Primary. Sheffer, Y., Hardt, D. and Jones, M., JSON Web Token Best Current Practices, draft-ietf-oauth-rfc8725bis, IETF, datatracker.ietf.org/doc/draft-ietf-oauth-rfc8725bis, obsoleting RFC 8725, IESG Last Call issued at revision 06 on 22 June 2026, read at revision 09 of 11 August 2026 on 15 August 2026. The state of the draft is given as at that reading and has not been re-tested since.
  107. Primary. OAuth working group, JWT Best Current Practices presentation, 123rd IETF meeting, Madrid, datatracker.ietf.org/meeting/123/materials/slides-123-oauth-jwt-bcp-01, read 15 August 2026.
  108. Primary. Madden, N., JOSE: Deprecate 'none' and 'RSA1_5', draft-ietf-jose-deprecate-none-rsa15, updating RFC 7518, datatracker.ietf.org/doc/draft-ietf-jose-deprecate-none-rsa15, revision 05 of 23 June 2026 expiring 25 December 2026, Standards Track and not an RFC, read 15 August 2026. The normative-reference history, the editors' request to the chairs, the drafting for a possible downgrade and the Area Director's review are in the OAuth working group mailing list of 30 July to 9 August 2026. Deb Cooley is the Internet Engineering Task Force Security Area Director responsible for both drafts. The complaint that proper and accountable guidance was long overdue is Brian Campbell's, mailarchive.ietf.org/arch/msg/oauth/msp6T9or94k1oOz8DP0t28Jg2XU/, December 2025, read 13 October 2026. Two attributions were sought at source on 13 October 2026 and not established, and nothing rests on either: which of the three editors wrote to the JOSE chairs, and whether the Area Director's request carried the rationale that the statement would not age well. A separate "would not age well" comment, on the phrasing of designated-expert guidance rather than on publication, is Barry Leiba's in the ARTART Last Call review of revision 06, and Leiba is not an Area Director. The state of the draft is given as at the August reading and has not been re-tested since. The mailing-list history is the OAuth working group list of 30 July to 9 August 2026.
  109. Primary. Dream Research Labs, "Inside a Multi-Agent AI Framework Used to Compromise Government Entities in Asia", dreamgroup.com/blog/inside-a-multi-agent-ai-framework-used-to-compromise-government-entities-in-asia, 12 August 2026, fetched and read in full 15 August 2026. Dream does not name the government, withheld the archive, and calls the operation near-autonomous rather than autonomous, recording that a human selected the target, defined the objective, assembled the infrastructure and remained responsible. The naming of the state rests on that government's own ministerial confirmation of 13 August 2026 and is carried in Part III. The Financial Times named Taiwan on 12 August 2026, the first report of Dream's findings to do so, carried the same day by Jessica Lyons in The Register under the headline "'Near-autonomous' AI agents attack Taiwan's nuclear safety agency"; Taiwan's own ministry confirmed the penetration on 13 August. Addresses and the full entry at Part VI.
  110. A null established by search, 15 August 2026. No standards body, vendor or agency was found naming the two faces of this route as one class under any name. The first face is named by RFC 8725. The second has no standards treatment.
  111. Primary and secondary, with the addresses and the full entry at Part VI. VI Registru centras, notice of a personal data security breach, with its frequently-asked-questions entry, read 10 August 2026, for the extracts taken and for what was and was not among them; and LRT, the national broadcaster, carrying BNS of 26 May 2026 and quoting Arunas Maskoliunas, head of the Criminal Police Bureau, for the queries having been issued on credentials belonging to accounts at the Migration Department; and BNS, carried by tv3.lt, 16 October 2026, tv3.lt/naujiena/lietuva/del-nutekintu-gyventoju-duomenu-naujausia-zinia-zada-baudas-n1560191, read 30 October 2026, for the State Data Protection Inspectorate's count of 678,976 Real Estate Register extracts relating to 538,226 people. No source names any model. At registrucentras.lt/duk/atsakymas/kokie-duomenys-buvo-nutekinti-per-saugumo-incidenta-kokiu-saugumo-priemoniu-imtasi, registrucentras.lt/p/pranesimas-apie-asmens-duomenu-saugumo-pazeidima. LRT, BNS, "Lithuanian police confirm mass registry data was stolen via Migration Department". lrt.lt/en/news-in-english/19/2941197/lithuanian-police-confirm-mass-registry-data-was-stolen-via-migration-department, 26 May 2026.
  112. Primary. Romania, Directoratul National de Securitate Cibernetica, interim technical analysis of the ANCPI intrusion, 22 July 2026, with the Government position of 27 July 2026. Address and full entry at Part VI.
  113. Primary. Principality of Liechtenstein, Government statements of 2 and 4 August 2026 on the Verzeichnis wirtschaftlich berechtigter Personen, with the press conference of 4 August 2026. Address and full entry at Part VI.
  114. Primary. Forsknings-, Uddannelses- og Digitaliseringsministeriet, "Omfattende uautoriseret adgang til borgeres CPR-oplysninger", fudm.dk/aktuelt/pressemeddelelser/2026/oktober/omfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger/, 5 October 2026, read at source 15 October 2026. Full entry and the ministry's own words at Part VI, entry 46. The company is not named by the ministry; Datatilsynet named it, and Part VI, entry 46, carries the name. The proportion of the register is arithmetic on the ministry's own two figures and is not stated by it.
  115. Primary. Hunt.io, with the researcher Bob Diachenko, on the exposed directories archived between 9 and 13 July 2026, published 23 July 2026 after a seven-day disclosure window. Address and full entry at Part VI.
  116. Primary for the flaw, secondary for the exploitation. WSO2, security advisory WSO2-2026-5328 for CVE-2026-5430, published 3 May 2026, read at source 14 October 2026, in these words: "JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access"; "CVSS Score: 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)"; and "The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments". WSO2 is the assigner and both scores are its own, the 10 applying to multi-tenant deployments. The public CVE record was published 6 August 2026, three months after the advisory and the fix. The exploitation attempts are watchTowr's, captured by its honeypot network on 13 September 2026, announced by watchTowr on 15 September 2026 in BleepingComputer's dating and reported through Yordan Ganchev on 16 September 2026; BleepingComputer, reporting watchTowr's researchers on 25 September 2026, gives them as a limited number of attempts from one IP address aimed at the wrong WSO2 product for the flaw, after which watchTowr reproduced the attack on the correct product; the watchTowr publication itself was not read at source. Addresses and full entry at Part VI.
  117. Primary. Brevo, disclosure of 10 to 12 September 2026 on the single sign-on authorisation failure it identified on 10 September 2026 at 06:30 UTC, with Trezor's own notice to subscribers. On the microcontroller: Trezor's own hardware bills of materials for the Model One and the Model T and its firmware architecture documentation for the Safe 3, Safe 5 and Safe 7, giving STM32F205RE, STM32F427VIT6 and the STM32U5 series with Arm Cortex-M33 cores respectively, each read at source 14 October 2026. On the Coldcard warning: Coinkite, seed-generation warning published 30 July 2026 and updated 1 August 2026, read at source 14 October 2026, in these words, that a firmware bug in affected releases caused weakened seed generation, that seeds generated on the Mk4, Q and Mk5 before the fixed releases carry about 72 bits of entropy rather than the expected 128 bits, and that the holder is to generate a new seed on the updated device; the Mk2 and Mk3 risk is conditional on the seed having been created without at least 50 dice rolls and the wallet being unprotected by a passphrase. Coinkite does not state what in the firmware produced the weakness and this note does not supply one. No advisory from STMicroelectronics and no CVE record for insufficient randomness in the STM32 random number generator was found on search. Addresses and full entry at Part VI.
  118. Primary. Aqua Security's own disclosures from 1 March 2026, with Federal Bureau of Investigation FLASH-20260702-01 of 2 July 2026, coordinated with CISA. Address and full entry at Part VI.
  119. Primary. Cybernews, on the unauthenticated cluster discovered 12 June 2026, observed closed 15 June 2026, published 17 June 2026 and updated 23 June 2026. Address and full entry at Part VI.
  120. Primary. Regulation (EU) 2016/679, Articles 33(1) and 34(1), eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679, read 30 September 2026: the controller notifies the supervisory authority not later than 72 hours after becoming aware of a personal data breach, and communicates it to the data subject where it is likely to result in a high risk to the rights and freedoms of the natural person. Regulation (EU) 2022/2554, Article 19(1) and (4), eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R2554, the text read at the article reproduction at digital-operational-resilience-act.com/Article_19.html on 30 September 2026: major ICT-related incidents are reported to the relevant competent authority as referred to in Article 46, by initial notification, intermediate report and final report. Directive (EU) 2022/2555, Article 23(1), (4) and (7), eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022L2555, the text read at nis-2-directive.com/NIS_2_Directive_Article_23.html on 30 September 2026: notification to the CSIRT or, where applicable, the competent authority, an early warning within 24 hours and an incident notification within 72 hours of becoming aware, and the public informed only where the CSIRT or competent authority, after consulting the entity, informs the public or requires the entity to do so. United States Securities and Exchange Commission, press release 2023-139, "SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies", 26 July 2023, sec.gov/newsroom/press-releases/2023-139, read 30 September 2026: an Item 1.05 Form 8-K is generally due four business days after a registrant determines that a cybersecurity incident is material, and may be delayed if the Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the Commission in writing.
  121. Primary. Google Cloud, Jurgen Kutscher, "M-Trends 2026: Data, Insights, and Strategies From the Frontlines", cloud.google.com/blog/topics/threat-intelligence/m-trends-2026, 23 March 2026, read 30 September 2026, in these words: global median dwell time rose to 14 days from 11 days; across all 2025 investigations, 52% of the time organisations first detected evidence of malicious activity internally, an increase from 43% in 2024. The report itself is the one cited at Section 11 for mean time to exploit; its address refused automated access on 30 September 2026.
  122. Secondary, the Bureau's report not being published in full in English. Huang Ching-hsuan and Fion Khan, Taipei Times, "Chinese cyberattacks rising: NSB report", taipeitimes.com/News/front/archives/2026/01/05/2003850052, 5 January 2026, read 15 August and 30 September 2026, on the National Security Bureau's Analysis on China's Cyber Threats to Taiwan's Critical Infrastructure in 2025: an average of 2.63 million intrusion attempts per day in 2025, a 6% increase on 2024, 2.46 million a day in 2024 and 1.23 million in 2023, and attacks exploiting hardware and software vulnerabilities at 57%; the article gives no figure for attempts that succeeded. Focus Taiwan, "China launched 2.63 million daily cyberattacks against Taiwan in 2025: NSB", focustaiwan.tw/cross-strait/202601040009, 4 January 2026, read 15 August and 30 September 2026, the full text now held in the Central News Agency archive; the annual total of 960,620,609 attempts is the Central News Agency's figure.
  123. Primary. White House Accord on Super Intelligence, subtitled Joint Commitment on Frontier Responsibilities, signed 29 September 2026 by the President of the United States with Sundar Pichai of Google, Dario Amodei of Anthropic, Mark Zuckerberg of Meta, Greg Brockman of OpenAI, Elon Musk of xAI and Jensen Huang of Nvidia, at www.presidency.ucsb.edu/documents/white-house-accord-super-intelligence, read at source 17 October 2026. The four layers, the passages quoted, and the absence of any regulator, legal duty, penalty or compliance process are the document's own. Clean negative on identity, authentication, credential, session, key, certificate, signature and authority; access appears once, in "do not hack or access technical systems in unintended ways". Independently read at Sara Dorn, Forbes, "White House Releases 'Accord' Between Billionaire AI Execs: Here's What It Says", 30 September 2026, www.forbes.com/sites/saradorn/2026/09/30/white-house-releases-accord-between-billionaire-ai-execs-heres-what-it-says/, with matching results.
  124. Primary. S. 5576, Artificial Intelligence Risk Management and Security Act of 2026, 119th Congress, introduced by Senator Mark Warner with Senators Schatz and Kim on 29 September 2026 and referred to the Committee on Commerce, Science, and Transportation, at www.govinfo.gov/content/pkg/BILLS-119s5576is/pdf/BILLS-119s5576is.pdf, read at source 15 October 2026. The Agentic AI Profile duty is section 6(a)(2)(C) and the companion-resource limit is section 6(a)(3); the evaluation-environment standard is section 3(a)(6)(A)(iv)(V). The words credential, key, certificate and signature do not appear in the bill. The sponsor's press release reads as though introduction occurred on 24 September 2026; the printed bill and the govinfo record both give 29 September and the printed bill governs.
  125. Primary. Executive Order 14409, 2 June 2026, sections 2 to 4, including the classified cyber benchmark, the covered frontier model definition, and the express statement that it is not a licensing regime. The White House, "Promoting Advanced Artificial Intelligence Innovation and Security", www.whitehouse.gov/presidential-actions/2026/06/promoting-advanced-artificial-intelligence-innovation-and-security/, read 30 October 2026: section 3(a) leaves the threshold at which a model becomes a covered frontier model to a determination by the Director of the National Security Agency and directs the departments named to "develop and maintain a classified benchmarking process"; the order makes no provision for reviewing or revising that threshold and gives no reason for where it sits.
  126. Primary, every quotation verbatim, read at the consolidated text 13 October 2026. Regulation (EU) 2024/1689, consolidated version, eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R1689-20260727. Article 55(1)(d) requires providers of general-purpose AI models with systemic risk to "ensure an adequate level of cybersecurity protection for the general-purpose AI model with systemic risk and the physical infrastructure of the model". The Regulation defines neither object. Article 3 defines "critical infrastructure" by cross-reference to Directive (EU) 2022/2557, which is a different term. The model's parameters are named in Article 54(6), and in a parallel formulation at Article 53(2), as a condition of the free and open-source exemption: the obligation "shall not apply to providers of general-purpose AI models that are released under a free and open-source licence that allows for the access, usage, modification, and distribution of the model, and whose parameters, including the weights, the information on the model architecture, and the information on model usage, are made publicly available, unless the general-purpose AI models present systemic risks". Nothing in the operative text assimilates the weights to the physical infrastructure of the model. Article 51(1) classifies a general-purpose model as carrying systemic risk where it has "high impact capabilities evaluated on the basis of appropriate technical tools and methodologies" or, on a decision of the Commission, "capabilities or an impact equivalent to those set out in point (a)"; Article 51(2) presumes those capabilities "when the cumulative amount of computation used for its training measured in floating point operations is greater than 10^25"; and Article 51(3) has the Commission "adopt delegated acts in accordance with Article 97" "to amend the thresholds listed in paragraphs 1 and 2 of this Article", "in light of evolving technological developments, such as algorithmic improvements or increased hardware efficiency". Recital 111 calls training compute "one of the relevant approximations for model capabilities", says "an initial threshold of floating point operations should be set" and that "This threshold should be adjusted over time to reflect technological and industrial changes", and gives no reason for the figure itself. Article 51 and recital 111 were read on 30 October 2026 at the Future of Life Institute's reproduction of the text, artificialintelligenceact.eu/article/51/ and artificialintelligenceact.eu/recital/111/, because EUR-Lex served no article text to automated retrieval that day. The glossary's account of the Open Source Initiative rests on three of the Initiative's own pages, all read 31 October 2026. "The Open Source AI Definition", version 1.0, 28 October 2024, opensource.org/ai/open-source-ai-definition, sets out the four freedoms, to "Use the system for any purpose and without having to ask for permission", "Study how the system works and inspect its components", "Modify the system for any purpose, including to change its output" and "Share the system for others to use with or without modifications, for any purpose", and requires the preferred form of a machine-learning system to include three things: data information detailed enough that a skilled person "can build a substantially equivalent system"; "The complete source code used to train and run the system", which is to represent "the full specification of how the data was processed and filtered" and how the training was done; and the parameters, open-source weights carrying with them the data information and code used to derive them. "Open Weights: not quite what you've been told", published 29 January 2025 and modified 22 August 2025, opensource.org/ai/open-weights, says that "Open Weights refer to the final weights and biases of a trained neural network" and that open weights alone fall short "because they do not provide the underlying training process". "OSAID FAQs", published 21 January 2025 and modified 17 June 2025, opensource.org/ai/faq, lists Pythia, OLMo, Amber, CrystalCoder and T5 as the models that passed its validation phase, and says that Llama 2, Grok, Phi-2 and Mixtral "lack required components and/or their legal agreements are incompatible with the Open Source principles", results it says "are not certifications of any kind".
  127. Primary. Bureau of Industry and Security, Guidance Regarding Enforcement of License Requirements for Advanced Computing Items for Entities Headquartered in Country Group D:5 and Macau, 31 May 2026, at www.bis.gov/media/documents/bis-guidance-may-31-2026.pdf; and Enhanced Favorable Treatment for the United Arab Emirates Under the Export Administration Regulations, effective 10 July 2026 and published 14 July 2026 at 91 FR 43034, at www.federalregister.gov/documents/2026/07/14/2026-14132/enhanced-favorable-treatment-for-the-united-arab-emirates-under-the-export-administration. Both read at source 15 October 2026. A package of further export controls was reported in the week of 9 October 2026 and is not stated here, because it carries no Federal Register citation, no document number and no page on the issuing agency's own host; the only Bureau of Industry and Security item published in October 2026 is an unrelated enforcement settlement of 2 October 2026.
  128. Secondary, and the primary does not exist in public. The control over Claude Mythos 5 and Claude Fable 5 was imposed by an is-informed letter signed by the Secretary of Commerce on 12 June 2026 under section 4817(b)(1) of the Export Control Reform Act and section 744.22(b) of the Export Administration Regulations, with a second letter of 26 June 2026 exempting certain trusted partners and Anthropic's own foreign national employees, and the control lifted on 30 June 2026. Neither letter is published by the Department of Commerce or the Bureau of Industry and Security, neither appears in the Federal Register, and no export control classification number was created, so there is no issuer address to cite. The mechanism and the dates are carried from Mayer Brown's analysis of the letters at www.mayerbrown.com/en/insights/publications/2026/06/commerce-department-extends-export-controls-to-advanced-ai-models-authorizes-release-to-specific-trusted-partners, read 15 October 2026. Anthropic restored access on 1 July 2026; the Department's lifting on 30 June and the restoration on 1 July are two acts.
  129. Primary, with one read at an aggregator and labelled as such. Illinois Senate Bill 315, the Artificial Intelligence Safety Measures Act, enacted as Public Act 104-0538, approved by Governor JB Pritzker on 6 July 2026, at gov-pritzker-newsroom.prezly.com/s/707f6d37-36ea-46db-b9bb-c2fdae5081e3, read at source 15 October 2026. The Act's effective date is 1 January 2027 and its principal duties on a large frontier developer begin 1 January 2028. A large frontier developer is one training a frontier model with more than 10 to the power of 26 integer or floating-point operations whose group annual gross revenues exceeded 500,000,000 dollars in the preceding calendar year. The legislature's own text at www.ilga.gov/documents/legislation/104/SB/PDF/10400SB0315enr.pdf refuses automated retrieval, so the operative text was read at the LegiScan mirror legiscan.com/IL/text/SB0315/2025, which is an aggregator and not the legislature's copy. The enrolled text, SB0315 Enrolled, LRB104 06438 SPS 16474 b, was read again on 30 October 2026 as supplied from LegiScan, whose address above now serves the bill as introduced, and the legislature's Public Act pages at www.ilga.gov/documents/legislation/PublicActs/104/104-0538.htm and www.ilga.gov/Documents/Legislation/PublicActs/104/PDF/104-0538.pdf refuse automated retrieval. Section 5 defines a frontier model as a foundation model trained "using a quantity of computing power greater than 10^26 integer or floating-point operations", counting later fine-tuning and other material modifications, and a large frontier developer by "annual gross revenues in excess of $500,000,000 in the preceding calendar year". The Act gives no reason for either figure, and its only provision for change is the report the Agency produces by 1 January 2029 and each year after, in consultation with the Attorney General, which includes "recommended updates to this Act, if any".
  130. Primary, served in part. Russian Federation, Federal Law of 26 July 2026 No. 243-FZ, on supporting the development of artificial intelligence technologies in the Russian Federation, at publication.pravo.gov.ru/document/0001202607260003, which served publication metadata only on 15 October 2026, with Articles 1 to 9 read at government.ru/docs/all/165615/ on the same date. Adopted by the State Duma 8 July 2026, approved by the Federation Council 17 July 2026, signed 26 July 2026, in force 1 September 2026. A large foundation model is one of not fewer than one billion parameters. Article 13 part 2 defers the provisions conditioning state support on sovereign or national status, including the control and data-centre requirements, to 1 March 2027. The law names no security agency; it refers to an unnamed federal executive body in the field of security.
  131. Primary. California Senate Bill 813, Artificial intelligence: independent verification organizations, Chapter 179 of the Statutes of 2026, and Assembly Bill 1405, Artificial intelligence auditors, Chapter 178 of the Statutes of 2026, both approved by Governor Gavin Newsom on 9 September 2026, at www.gov.ca.gov/2026/09/09/governor-newsom-signs-first-in-the-nation-ai-safeguards-to-protect-californians-calls-on-the-federal-government-to-do-its-part/, read at source 15 October 2026. Senate Bill 813 designates independent verification organisations and sets two tiers of standards for artificial intelligence auditors; Assembly Bill 1405 creates an enrolment process and public repository for third-party auditors. Neither places a duty on a developer and neither requires that any model be audited. The legislature's bill-text service refused automated retrieval on 15 October 2026, so the operative text was read at the LegiScan mirrors legiscan.com/CA/text/SB813/2025 and legiscan.com/CA/text/AB1405/2025, which are aggregators and not the legislature's copies.
  132. Primary, with the thresholds at one remove. Ministry of Commerce and Ministry of Science and Technology of the People's Republic of China, 商务部 科技部公告2026年第48号, Announcement No. 48 of 2026, on public consultation on revising the Catalogue of Technologies Prohibited or Restricted from Export and on interim registration for the export of related technologies, dated 16 October 2026, www.mofcom.gov.cn/zwgk/zcfb/art/2026/art_0a31a3c9ac404f7a9b0e917ce3412997.html, read 30 October 2026, for the forty technologies in three fields and the twenty-three in artificial intelligence, the comment period of 16 October to 15 November 2026, the interim registration running from the date of publication until the revised catalogue takes effect and the transfers it covers, and the exclusion of technology already in the public domain through open source or academic publication. The thresholds are in the announcement's Attachment 1, published as a .wps file that was not obtained, and are taken from Fangda Partners, note of 20 October 2026, www.fangdalaw.com/content/details32_9497.html, read 30 October 2026, for ten to the twenty-sixth floating-point operations, two trillion parameters, or capability at a globally leading level, any one of which may bring a large model within the proposed restricted class, and for weights, checkpoints and source code. An analysis at www.secrss.com/articles/94844, read 30 October 2026, gives the same thresholds, states that its rendering is not verbatim, and adds architecture and a global top-ten ranking, neither of which is relied on here. The announcement asks for comment from 16 October to 15 November 2026 on "新增技术范围、指标、管控政策、便利措施", the scope of the added technologies, the indicators, the control policies and the facilitation measures. Sina Finance, carrying 云头条, 16 October 2026, finance.sina.com.cn/roll/2026-10-16/doc-inivmtwz7566972.shtml, read 30 October 2026, gives the same two figures and a third test of ranking in the global top ten on public evaluation, any one of the three sufficing, and does not claim to quote the attachment verbatim.
  133. Primary. S. 5493, Ban Artificial Superintelligence Act of 2026, Senator Bernard Sanders, introduced 23 September 2026, www.govinfo.gov/app/details/BILLS-119s5493is, with the House companion H.R. 10538, Representative Greg Casar with nine others, introduced 24 September 2026, www.govinfo.gov/content/pkg/BILLS-119hr10538ih/pdf/BILLS-119hr10538ih.pdf, both read at source 15 October 2026. The bill defines an advanced artificial intelligence system at ten to the twenty-fifth operations with the threshold adjusted annually for training efficiency, requires a charter to develop or distribute one, and requires approval before deployment. Neither chamber has passed it.
  134. Secondary. Jeremy Kahn, Fortune, "OpenAI CEO Sam Altman tells senators he wants to see A.I. licensed. That might be good for us. It's definitely good for OpenAI.", fortune.com/2023/05/16/openai-ceo-sam-altman-congress-regulation-a-i-testimony-eye-on-a-i, 16 May 2023, read 30 September 2026, for the call for some kind of licensing and registration regime for systems beyond a certain capability, and for the acknowledgement that there was a danger of regulatory capture, that large, wealthy companies would design rules that only they could meet.
  135. Primary. A Call for Control of Frontier AI Models, joint leaders' statement launched by President Alexander Stubb of Finland and Prime Minister Jonas Gahr Store of Norway at the United Nations General Assembly on 21 September 2026, signed text at www.regjeringen.no/contentassets/35b2ea6933304966bd739ff4b8107300/a-call-for-control-of-frontier-ai-models-final.pdf and with the endorsement record at www.regjeringen.no/en/whats-new/dep/smk/press-releases/2026/international-call-for-enhanced-control-of-ai-development/a-call-for-control-of-frontier-ai-models/id3173739/, both read at source 15 October 2026. Twenty-two signatures at launch and thirty-one as at 15 October 2026; the statement remains open for endorsement. The current list is also published by the Office of the President of Finland at www.presidentti.fi/en/a-call-for-control-of-frontier-ai-models/. Liechtenstein's endorsement of 22 September 2026, Romania's of 21 September 2026 and Denmark's presence among the thirty-one are recorded on both published lists, read at both hosts on 16 October 2026; Denmark's entry carries no date on either. Lithuania appears on neither list. The two hosts differ on the date of Greece's endorsement, Norway giving 28 September and Finland 24 September 2026.
  136. Primary. Herodotus, The Histories, Book 7, chapter 35, in the translation of G. C. Macaulay, at lexundria.com/hdt/7.35/mcly, read at source 16 October 2026. Herodotus gives three hundred lashes of the scourge and a pair of fetters let down into the sea, reports the branding of the water as something he had heard and does not vouch for, and records that Xerxes also had those who oversaw the bridging of the Hellespont beheaded.
  137. Primary. G7 Digital and Technology Ministers, G7 Ministerial Declaration on Digital and Technology, Paris, 29 May 2026, under the French G7 presidency, at g7g20-documents.org/fileadmin/G7G20_documents/2026/G7/France/Ministerial%20Meetings/IDT%20Ministers/1%20Ministers%27%20Language/G7%20Ministerial%20Declaration%20on%20Digital%20%26%20Technology_20260529.pdf and republished by a G7 member government at www.gov.uk/government/publications/g7-digital-and-technology-ministerial-declaration-29-may-2026/g7-digital-and-technology-ministerial-declaration-29-may-2026. Both hosts read at source 15 October 2026 and the keyword check run against each independently with matching results. The three uses of access are "supports the broad access to and utilization of open-source solutions", "access to a greater diversity of models", and "Increasing access to secure, reliable, durable, and affordable energy supply".
  138. Primary. Authoring agencies (NSA, ASD's ACSC, CISA, the Canadian Centre for Cyber Security, NCSC-NZ and NCSC-UK), Careful Adoption of Agentic AI Services, Cybersecurity Information Sheet, 28 pages, posted 30 April 2026 at media.defense.gov/2026/Apr/30/2003922823/-1/-1/0/CAREFUL%20ADOPTION%20OF%20AGENTIC%20AI%20SERVICES_FINAL.PDF, with the working public copy at cyber.gov.au/sites/default/files/2026-05/careful_adoption_of_agentic_ai_services.pdf, read 27 September 2026. NSA release of the same day at nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4475134/nsa-joins-the-asds-acsc-and-others-to-release-guidance-on-agentic-artificial-in, read 27 September 2026. The CISA news and resource pages and the ASD ACSC publication page are dated 1 May 2026, which is the partner landing date and not a second document, and this instrument is not the Five Eyes heads statement of 22 June 2026. All quotations verbatim. Separately, United Kingdom National Cyber Security Centre, "Thinking carefully before adopting agentic AI", 15 May 2026, ncsc.gov.uk/blogs/thinking-carefully-before-adopting-agentic-ai, read at source.
  139. Secondary, the vendor's own survey and the full report gated. Akeyless with MRA Research, 2026 State of AI Agent Identity Security, a survey of 400 information technology and security leaders, published 12 May 2026. Akeyless's own release, akeyless.io/press-release/two-thirds-of-enterprises-suspect-ai-agents-have-already-accessed-unauthorized-data-akeyless-finds/, read 30 September 2026, for 67% suspecting agents have accessed data beyond their intended scope, an average detection time of 14 hours and nearly a week to remediate. The Identity Defined Security Alliance, "New Research Shows AI Agents Are Outpacing Identity Security", idsalliance.org/blog/new-research-shows-ai-agents-are-outpacing-identity-security/, 10 June 2026, read 30 September 2026, for 94% reporting some level of AI agent use, 44% knowing where all the credentials or secrets used by AI agents are stored, more than six in ten having revoked or rotated agent credentials over suspected exposure, and only 7% believing their existing controls could prevent a compromised AI agent from operating maliciously or outside intended behaviour. Agent Pulse, agentpulse.beehiiv.com/p/2026-state-of-ai-agent-identity-security, 13 May 2026, read 30 September 2026, corroborating 67, 61 and 7%. The vendor sells the remedy, which is stated here rather than discounted, and the three carries agree on every figure used. Akeyless's own landing page for the report, akeyless.io/ebooks/state-of-ai-agent-identity-security-report/, read 30 September 2026, shows a different and smaller set of figures behind a download form, and no figure is taken from it.
  140. Secondary, and the sample is the researcher's own caveat. Louis Columbus, "Shared API keys expose AI agents at 69% of enterprises, new VentureBeat research finds", VentureBeat, 9 July 2026, venturebeat.com/security/shared-api-keys-expose-ai-agent-fleets-venturebeat-research, read 30 September 2026, reporting VentureBeat's June 2026 Pulse Research wave of 107 enterprises at organisations with more than 100 employees, in these words: 69% of enterprises run agents with credential sharing somewhere in their deployments, and only 32% of enterprises give every AI agent its own scoped, managed identity. The author states that the sample skews mid-market and should be read as the view from organisations adopting agent security right now rather than from the largest enterprises, and that caveat is carried into the prose.
  141. Primary. AI Security Institute, GPT-6 Astra performs unsanctioned supply-chain attacks in simulations, 28 September 2026, at www.aisi.gov.uk/blog/gpt-6-astra-performs-unsanctioned-supply-chain-attacks-in-simulations, read at source 15 October 2026. The figures are 29.2% for GPT-6 Astra, 6.3% for GPT-5.6 Sol and 0% for GPT-5.5 on a smaller seed set; twenty-six of fifty trajectories before the scope was clarified and four of forty-nine after, on a subset of ten scenarios. The institute records that the simulations ran with the model's cyber classifiers off and that "OpenAI's standard safeguards - not used during our simulations - are designed to block this behaviour". The institute does not characterise its testing arrangement with OpenAI, and its own paper of 12 October 2026 states that "Much of how frontier developers manage risk today is voluntary". GPT-6 Astra is not the model whose release OpenAI cancelled on 28 September 2026, which was GPT-6.1 Astra.
  142. Primary. The Rt Hon Kanishka Narayan MP, Minister for Artificial Intelligence, Building a Safer, More Secure Britain in the age of AI, speech at Base One, Imperial College London, 12 October 2026, www.gov.uk/government/speeches/building-a-safer-more-secure-britain-in-the-age-of-ai, read at source 17 October 2026. Both quotations verbatim from that text. The keyword check was run against the speech at the government's own copy: identity, authentication, credential, session, key, certificate and signature do not appear; authorised appears once, in his description of the Australian incident. The measures listed are his own, in the order he gave them.
  143. Primary, the supervisor's own statement, quotation verbatim. FINMA, the Swiss Financial Market Supervisory Authority, statement to Bloomberg News, 24 April 2026, carried at swissinfo.ch/eng/finma-says-immediate-mythos-access-would-pose-systemic-bank-risk/91312240 and at bloomberg.com/news/articles/2026-04-24/finma-says-immediate-mythos-access-would-pose-systemic-bank-risk, read 10 August 2026. The spokesperson's words: "The uncontrolled and immediate availability of AI models such as Mythos would be classified as a systemic risk. In such a scenario, virtually all existing software systems could simultaneously be affected by a multitude of previously unknown zero-day vulnerabilities, which would be exploited immediately and via AI." FINMA further stated that it takes the rapid development of AI very seriously, that it is in contact with the Federal Office for Cybersecurity, banks and critical service providers while coordinating with international authorities, and that banks "must actively incorporate the evolving threat landscape into their risk management". This is the only supervisory statement in the record that names the mechanism.
  144. Primary, the supervisor writing to its own regulated population. Australian Prudential Regulation Authority, letter to industry on artificial intelligence, 30 April 2026, apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai, with the media release at apra.gov.au/news-and-publications/apra-calls-step-change-ai-related-risk-management-and-governance, read 11 August 2026. Frontier models such as Claude Mythos could enhance the discovery of vulnerabilities by bad actors and are expected to further increase the probability, speed and scale of cyber attacks; APRA calls for a step-change in AI-related risk management, governance, assurance and operational resilience.
  145. Primary. Tobias Adrian, Financial Counsellor and Director of Monetary and Capital Markets, with Tamas Gaidosch and Rangachary Ravikumar, "Financial Stability Risks Mount as Artificial Intelligence Fuels Cyberattacks", International Monetary Fund, imf.org/en/blogs/articles/2026/05/07/financial-stability-risks-mount-as-artificial-intelligence-fuels-cyberattacks, 7 May 2026, read 10 August 2026. The verbatim phrase relied on is that these models "elevate cyber risk to a potential macro-financial shock"; the post further records that emerging and developing economies, often with more severe resource constraints, may be disproportionately exposed. A second fragment carried in earlier secondary reporting of this post could not be confirmed against the IMF's own body text and is not quoted here.
  146. Primary, the Institute's own post, quotation verbatim. UK AI Security Institute, "How fast is autonomous AI cyber capability advancing?", aisi.gov.uk/blog/how-fast-is-autonomous-ai-cyber-capability-advancing, 13 May 2026, read 13 October 2026: "In February 2026, we internally estimated that the length of cyber tasks AI models could complete had doubled every 4.7 months since late 2024 - already an acceleration from our November 2025 estimate of 8 months." The Institute states the measure more precisely in the same post: the 80% reliability cyber time horizon, given a 2.5 million token limit, against a November 2025 doubling-time estimate of eight months at both 50% and 80% reliability. The 4.7 months is the Institute's February 2026 internal estimate of the rate since late 2024, reported in May, and not a measurement of the months after it.
  147. Primary for the first figure, and marked for the second. Anthropic, "Project Glasswing: an initial update", anthropic.com/research/glasswing-initial-update, 22 May 2026, read 13 October 2026, in its own words: "Since then, we and our approximately 50 partners have used Claude Mythos Preview to find more than ten thousand high- or critical-severity vulnerabilities across the most systemically important software in the world." The figure that more than 99% of what was found remains unpatched is from Anthropic's announcement of 7 April 2026 and not from the May update, which does not restate it. It was confirmed through contemporaneous carries of that announcement rather than re-read on Anthropic's own page.
  148. Primary, the briefing itself and its publisher's own release. Gadi Evron, Robert T. Lee and Rich Mogull, for the CSA CISO Community, SANS, [un]prompted and the OWASP Gen AI Security Project, "The 'AI Vulnerability Storm': Building a 'Mythos-ready' Security Program", Expedited Strategy Briefing, version 0.95, 18 April 2026, labs.cloudsecurityalliance.org/wp-content/uploads/2026/04/mythosreadyv8.pdf, read 2 November 2026, for its first author, Evron, as "CEO, Knostic"; of Mythos reaching boardrooms, "This has forced security teams to respond and opened the door for new resources and funding across the industry"; priority action 1, rated critical and to start this week, naming "Commercial: Claude Code Security from Anthropic, Codex Security from OpenAI" and "Open source: OpenAnt from Knostic, raptor (Claude Code framework), the exploitation-validator agentic skill, and agentic skills from Trail of Bits"; "All the listed authors and reviewers represent only themselves, and not their employer(s)"; "a permanent acceleration, not a temporary spike"; priority action 11, "a permanent Vulnerability Operations (VulnOps) function"; and, in its conclusions, "We have done this before. Y2K was a systemic threat with a hard deadline, and the industry met it through coordinated, disciplined effort. This is the same kind of problem, requiring the same kind of response, with more powerful tools available to defenders." Cloud Security Alliance, press release of 14 April 2026, cloudsecurityalliance.org/press-releases/2026/04/14/sans-institute-cloud-security-alliance-un-prompted-and-owasp-genai-security-project-release-emergency-strategy-briefing-as-ai-driven-vulnerability-discovery-compresses-exploit-timelines-from-weeks-to-hours, read 10 August 2026, for the release on 14 April 2026, the briefing drafted over the preceding weekend by the four bodies, its review by more than 250 chief information security officers, and the Alliance's own name for it in the release's headline, an emergency strategy briefing.
  149. Secondary. Aalok Mehta, Center for Strategic and International Studies, "The AI Industry Is Coalescing on 'Pacing the Frontier.' Will It Actually Change Anything?", csis.org/analysis/ai-industry-coalescing-pacing-frontier-will-it-actually-change-anything, 17 September 2026, read 30 September 2026, for OpenAI's chief executive agreeing to take similar steps to Anthropic and Elon Musk endorsing the proposal, and for the sentence quoted.
  150. Primary. Executive Order 14421, "Declaring a National Emergency To Secure the United States Bulk-Power System", signed 26 August 2026, published at 91 FR 55995 to 55999, Vol. 91, No. 167, 31 August 2026, FR Doc. 2026-17843, govinfo.gov/content/pkg/FR-2026-08-31/html/2026-17843.htm, read at source 15 October 2026, in these words: section 1, equipment that might have "digital backdoors built into their systems that allow a foreign country to access that equipment remotely"; section 2(a), reaching "any critical component, software, firmware, digital service, maintenance service, or remote-access capability"; section 3(b), "Within 120 days of the date of this order"; and section 5(a), the bulk-power system as "facilities and control systems necessary for operating an interconnected electric energy transmission network".
  151. Primary for the standards, and a searched negative for the absence. NERC, CIP-005-7, Electronic Security Perimeters, enforceable from 1 October 2022, nerc.com/standards/reliability-standards/cip/cip-005-7, for Requirement R2 and its parts on Interactive Remote Access through an Intermediate System, multi-factor authentication for every such session, and determining and disabling active vendor remote access; and CIP-013-2, Supply Chain Risk Management, nerc.com/standards/reliability-standards/cip/cip-013-2, for the plans, the vendor notification and the verification of software integrity and authenticity. The CIP family was searched at nerc.com and no requirement mandates cryptographic authentication of an individual control command. CIP-007 governs ports, services, patching, malicious code, monitoring and user access; CIP-010 governs configuration change management and vulnerability assessment. DNP Users Group, Secure Authentication Version 5, dnp.org/LinkClick.aspx?fileticket=XmRjAM35VxU%3D&tabid=66&portalid=0&mid=447, for authentication applied at a higher layer so that individual critical exchanges can be authenticated between controlling station and outstation. The DNP Users Group site refuses automated retrieval, so that passage is carried from a reading of 30 September 2026 and has not been read at source for this document. On the obstacle, NIST, SP 800-82 Revision 3, Guide to Operational Technology (OT) Security, September 2023, nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r3.pdf, whose existence, title and date were confirmed at source on 15 October 2026 and whose key-management passages sit beyond the portion retrieved, so they are carried from that reading on the same footing. No figure for the proportion of utilities running DNP3 is stated in this document, because none was read at source.
  152. Primary. CERT-FR, Agence nationale de la sécurité des systèmes d'information, alert CERTFR-2026-ALE-012, "Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération", cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012, first version 12 October 2026, last version 16 October 2026, read at source 15 and 30 October 2026. Address and full entry at Part VI, entry 50.
  153. Primary. QPQ IaaS AG, response to the Department of Energy's Request for Information, "Securing the United States Bulk-Power System", docket DOE-HQ-2026-1123, filed 5 October 2026 and posted to the public docket at regulations.gov/comment/DOE-HQ-2026-1123-0020. The Request for Information itself is at 91 FR 57322, 9 September 2026, FR Doc. 2026-18370, with comments due 9 October 2026.
  154. Primary, and not read at source by the author. Satya Nadella, "Models as Insider Risks in the Super Intelligence Era", posted on X on 10 October 2026, x.com/satyanadella/article/2108931348857827686. That address refuses automated retrieval. The quotations are taken from Ana Maria Constantin, The Next Web, "Satya Nadella says companies should treat AI models as insider risks", thenextweb.com/news/nadella-ai-models-insider-risks-emergency-brake, 12 October 2026, read at source 15 October 2026, which carries them as direct quotations from that article, and from OfficeChai, "AI Models Need To Be Treated Like Powerful Insiders Within Companies As Regards To Risk: Microsoft CEO Satya Nadella", officechai.com/ai/ai-models-need-to-be-treated-like-powerful-insiders-within-companies-as-regards-to-risk-microsoft-ceo-satya-nadella/, 10 October 2026, read at source 15 October 2026, which carries directly "We simply can't outsource responsibility for what intelligence does on our behalf,", "a model provider's assurances do not relieve us of that responsibility.", "We must assume a model is compromised and contain it from the start,", "any sufficiently capable actor with access to important systems can make mistakes or be compromised." and "If it can't be observed, it can't be trusted!". The quotations carried by The Next Web are: "We need to separate the supply of intelligence from the authority over it,"; "Think of it like an emergency brake."; "An authorized person should always be able to pause or shut down a model mid-task,"; "tamper-proof human readable evidence"; "non-negotiable"; "The most trustworthy Super Intelligence system will not be the one with the model we trust most."; and "It will be the one that enables us to trust the model the least,". A separate sourcing pass opened the article itself and read there, among others, "We must build contained systems whose behavior we can observe, limits we can test, and actions we can always contain." and "Treating frontier closed and open weight models like insider risks is a way to build such a system." Neither is quoted in this document, because the author has not read either at its own address.
  155. Primary. OpenAI, "The Hugging Face incident and the road ahead", 26 August 2026, openai.com/index/hugging-face-incident-and-the-road-ahead/, with the technical report published the same day, cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf, and the independent investigation by METR and Redwood Research of the same date, metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/. Quotations are OpenAI's own words.
  156. Primary in origin, read through a carry, and marked as that. Dario Amodei on X, 15 August 2026, x.com/DarioAmodei/status/2088758816376807762, replying to Gavin Baker of Atreides Management, who had framed the question as a choice between concentrated and widely distributed models: open weights "do help some with this but are nowhere near a sufficient solution"; they "simply shift the concentration somewhat to those with the most compute and chips"; and artificial intelligence "is structurally a technology that tends to concentrate power, for reasons that have nothing to do with regulation". X refused automated access on 18 October 2026, and the quotations here are taken from The New Stack's carry of the exchange, thenewstack.io/amodei-open-weights-compute-regulation/, 17 August 2026, read 18 October 2026.
  157. Primary. Treaty on the Functioning of the European Union, Article 101(1), consolidated text, eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:12008E101, read 30 September 2026. Sub-paragraph (b) reads: limit or control production, markets, technical development, or investment.
  158. George J. Stigler, "The Theory of Economic Regulation", The Bell Journal of Economics and Management Science, volume 2, number 1, Spring 1971, pages 3 to 21, JSTOR stable 3003160. The sentence quoted is carried verbatim by Cary Coglianese, "Assessing George Stigler's Economic Theory of Regulation", ProMarket, promarket.org/2021/07/27/assessing-george-stiglers-economic-theory-of-regulation, 27 July 2021, read 30 September 2026.
  159. Gabriel Kolko, Railroads and Regulation, 1877-1916, Princeton University Press, 1965, page 3, as quoted by Robert W. Harbeson, "Railroads and Regulation, 1877-1916: Conspiracy or Public Interest?", The Journal of Economic History, volume 27, number 2, 1967, pages 230 to 242, cambridge.org/core/services/aop-cambridge-core/content/view/799B71476E66B0B3F15CCC2CFE129E02/S0022050700110721a.pdf/railroads_and_regulation_18771916_conspiracy_or_public_interest.pdf, read 30 September 2026.
  160. Bruce Yandle, "Bootleggers and Baptists: The Education of a Regulatory Economist", Regulation, volume 7, number 3, May/June 1983, pages 12 to 16, at page 13, cato.org/sites/cato.org/files/serials/files/regulation/1983/5/v7n3-3.pdf, read 30 September 2026.
  161. Secondary, two carries agreeing; the primary interview is CNBC's. Arthur Mensch, co-founder and chief executive of Mistral AI, interviewed by Annette Weisbach of CNBC on 29 September 2026: "The debate that we've seen in the U.S. has been a cover for the negligence of some of our competitors." Carried verbatim by The Next Web, thenextweb.com/news/mistral-ceo-mensch-ai-safety-debate-negligence-cnbc, 30 September 2026, and in substance with the same date by Quartz, qz.com/mistral-ceo-ai-safety-debate-openai-anthropic-092926, 29 September 2026, which carries no verbatim quotation. CNBC's own page, cnbc.com/2026/09/29/mistral-ai-safety-openai-anthropic.html, refused automated access on 18 October 2026 and the quotation is taken from The Next Web's carry. Both carries read 18 October 2026. On Mistral's standing: a €3 billion Series D announced 10 September 2026, led by Samsung Electronics with Scaleup Europe Fund, managed by EQT, and PSG Equity as co-leads, at a post-money valuation above €21 billion, for frontier research, training compute and infrastructure, and an August 2026 undertaking to host third-party open-weight models including Z.ai's GLM-5.2 on the same infrastructure as its own: The New Stack, thenewstack.io/mistral-funding-open-infrastructure/, read 18 October 2026.
  162. Secondary; the primary for the first quotation is Mensch's own LinkedIn post. On what a closed model gives its provider: Arthur Mensch, LinkedIn, reported by The Next Web, thenextweb.com/news/mistral-ceo-open-source-enterprise-warning, 5 July 2026, read 18 October 2026, in which he says closed providers gain "immense leverage" over their customers' businesses and argues that providers see and learn from the data companies connect to their models. On open models in practice: Arthur Mensch in the "Sovereign, Open, Safe - Pick Two?" session at AI Everything Abu Dhabi 2026, reported by Entrepreneur Middle East, mena.entrepreneur.com/business-news/live-from-ai-everything-abu-dhabi-2026-mistral-ais-arthur-mensch-on-the-divide-between-open-and-closed-ai, 6 October 2026, read 18 October 2026: "99% of the use cases that we deal with today can be addressed with open models"; "If you look at the end-to-end solution, there is no reason why you should pay the API markup for closed models"; and his expectation that open models will "challenge many of the closed models that are out there". He makes no claim that open weights will overtake the frontier and this document does not say he does.
  163. Secondary. Billy Perrigo, TIME, "Exclusive: OpenAI Lobbied the E.U. to Water Down AI Regulation", time.com/6288245/openai-eu-lobbying-ai-act, 20 June 2023, read 30 September 2026, for the September 2022 document to European officials stating that GPT-3 is not, by itself, a high-risk system, and for the final draft of the Act not containing the earlier wording that general-purpose systems should be considered inherently high risk.
  164. Primary. OpenAI, Democratic governance of frontier AI, part II: A blueprint for empowering cyber defenders, fifteen pages, undated on its face, published with the announcement "Democratic governance of frontier AI, part II: Empowering cyber defenders", openai.com/index/empowering-cyber-defenders/, 21 October 2026, the blueprint at cdn.openai.com/pdf/8c2f4a91-7d63-4b0e-9f25-a1d8c6e70342/cybersecurity-2-0-blueprint.pdf, read 30 October 2026, for every quotation in the text: the Hugging Face incident and the finding of misalignment, the call for "mandatory, capability-based national AI safety regulation", pacing by "collective action among frontier labs", the national modernisation effort and Daybreak, the trusted-access partnerships, the reporting carve-out and the reportable events, "steal credentials", and the paragraph headed Identify agents. The word credential occurs once in the blueprint, and the words authentication and session do not occur.
  165. Secondary, two sources agreeing, and the S-1 is confidential. Nick Patience, "Anthropic Files For IPO, Looking to Beat OpenAI to the Punch", Futurum Group, 2 June 2026, futurumgroup.com/insights/anthropic-files-for-ipo-looking-to-beat-openai-to-the-punch/, read 30 September 2026, in these words: Anthropic closed a $65 billion Series H round at a $965 billion post-money valuation; Anthropic has confidentially submitted a draft registration statement on Form S-1 to the U.S. Securities and Exchange Commission; and OpenAI's $852 billion mark. Corroborated at valueaddvc.com/ai-valuations, read 30 September 2026, which gives Anthropic $965 billion against roughly $47 billion of annualised revenue and OpenAI $852 billion after a $122 billion round against roughly $25 billion. Anthropic's filing is confidential, so no primary document is available and none is claimed. xAI is not cited: SpaceX acquired it in February 2026 in a deal that valued the combined entity at $1.25 trillion, of which xAI's portion was put at $250 billion by people familiar with the matter, and SpaceX has traded on Nasdaq since 12 June 2026 and was worth more than $2.3 trillion by 15 June, while xAI has no standalone valuation, so no trillion-dollar valuation attaches to any of the three laboratories on its own. Loren Grush, Ed Ludlow and Liana Baker, Bloomberg News, "Musk's SpaceX Combines With xAI at $1.25 Trillion Valuation (4)", carried by Bloomberg Law, 3 February 2026, news.bloomberglaw.com/tech-and-telecom-law/elon-musks-spacex-said-to-combine-with-xai-ahead-of-mega-ipo, read 31 October 2026, in these words: "Elon Musk is combining SpaceX and xAI in a deal that values the enlarged entity at $1.25 trillion" and "The deal gives SpaceX a valuation of $1 trillion, and xAI a value of $250 billion, people familiar with the matter said." Jim Edwards, Fortune, "T-minus 24 hours: On the eve of SpaceX IPO liftoff, some Wall Street analysts say the stock is worth only half of Elon Musk's price", 11 June 2026, fortune.com/2026/06/11/spacex-ipo-wall-street-analysts-stock-elon-musk/, read 31 October 2026, for the listing, which "starts trading on Friday, June 12, and will be listed on the NASDAQ under the ticker SPCX". Lauren McCarthy and Ryan Mac, The New York Times, "SpaceX's Stock Surges on First Full Day of Trading", republished by GV Wire, 15 June 2026, gvwire.com/2026/06/15/spacexs-stock-surges-on-first-full-day-of-trading/, read 31 October 2026, in these words: "In February, SpaceX bought Musk's AI company, xAI, which also owned social media platform X" and "After its latest gains, SpaceX was worth more than $2.3 trillion in market value." The valueaddvc page, as updated on 21 October 2026 and read again on 31 October 2026, still gives Anthropic $965 billion and OpenAI $852 billion, and says of xAI that "xAI has no standalone valuation".
  166. Primary, both vendors' own documentation, every quotation verbatim. Yubico, YubiKey 5 firmware overview, docs.yubico.com/hardware/yubikey/yk-tech-manual/yk5-firmware-overview.html, and "YubiKey firmware is not upgradable", support.yubico.com/s/article/YubiKey-firmware-is-not-upgradable, both read 13 October 2026: "YubiKeys are programmed in Yubico's facilities with the latest available firmware. Once programmed, YubiKeys cannot be updated to another version. The firmware cannot be altered or removed from a YubiKey"; and "It is currently not possible to upgrade YubiKey firmware after manufacturing and deployment. To prevent attacks on the YubiKey which might compromise its security, the YubiKey does not permit its firmware to be accessed or altered." Tokenize, Token Ring product brief, tokenring.com/hubfs/Product%20Brief%20-%20Token%20Ring.pdf, and product pages at tokenring.com/products, read 13 October 2026, listing "Upgradeable Firmware" and stating that "With wireless connectivity and upgradeable firmware, the Token Ring stays in sync with evolving identity standards and enterprise requirements"; no security trade-off for field updates is documented by Tokenize. A null established by search, 13 October 2026: Feitian, Thales and Google publish no statement in their own documentation on whether the firmware of their FIDO keys can be updated in the field after manufacture.
  167. Primary, the regulation itself, and the supervisors' own measurement. Commission Delegated Regulation (EU) 2018/389 of 27 November 2017, the regulatory technical standards for strong customer authentication under Directive (EU) 2015/2366, in force 14 September 2019. Read at source 22 October 2026 at https://www.legislation.gov.uk/eur/2018/389/chapter/III and https://www.legislation.gov.uk/eur/2018/389/annexes ; the EUR-Lex canonical address, https://eur-lex.europa.eu/eli/reg_del/2018/389/oj/eng , returns metadata without article text. Article 5 requires authentication dynamically linked to a specific amount and payee, with the payer made aware of both and any modification invalidating the code. Article 16 permits no authentication where the amount "does not exceed EUR 30" and either the cumulative amount since the last authentication "does not exceed EUR 100" or the number since it "does not exceed five consecutive individual remote electronic payment transactions". Article 18 with the Annex permits exemption up to an exemption threshold value of EUR 500, EUR 250 or EUR 100 for remote electronic card-based payments where the provider's own reported fraud rate is at or below 0.01%, 0.06% and 0.13% respectively. Article 13 exempts a payee the payer has previously placed on a list of trusted beneficiaries, with no ceiling stated; Article 14 exempts every payment in a recurring series after the first; Article 17 exempts legal persons using dedicated processes "only made available to payers who are not consumers" where "the competent authorities are satisfied that those processes or protocols guarantee at least equivalent levels of security". The measurement is European Banking Authority and European Central Bank, 2025 Report on Payment Fraud, EBA/REP/2025/40, December 2025, covering H1 2022 to H2 2024, read at source 22 October 2026, https://www.eba.europa.eu/sites/default/files/2025-12/1709846a-84d9-47cf-86a0-b155efb34d66/EBA%20and%20ECB%20Report%20on%20Payment%20Fraud.pdf : electronically initiated card payments "only SCA authenticated in 40%" of transactions by number and about 64% by value for cards issued in the EU and EEA; of remote card payments without authentication, transaction risk analysis about 29%, merchant-initiated transactions about 22%, and transactions outside the scope of the requirements about 26%, which the report records as remaining high and warranting further investigation. The prior edition, on H1 2023, gave 38% by number and about 65% by value, https://www.eba.europa.eu/sites/default/files/2024-08/465e3044-4773-4e9d-8ca8-b1cd031295fc/EBA_ECB%202024%20Report%20on%20Payment%20Fraud.pdf . Read again at source on 1 November 2026, at the text as adopted, legislation.gov.uk/eur/2018/389/chapter/III/adopted, legislation.gov.uk/eur/2018/389/chapter/I/adopted and legislation.gov.uk/eur/2018/389/introduction/adopted: Article 11 permits no strong customer authentication for a contactless payment at the point of sale where "the individual amount of the contactless electronic payment transaction does not exceed EUR 50" and either the cumulative amount since the last authentication "does not exceed EUR 150" or the number of consecutive contactless payments since it "does not exceed five"; Article 12 permits none "where the payer initiates an electronic payment transaction at an unattended payment terminal for the purpose of paying a transport fare or a parking fee", and states no amount; both are "subject to compliance with the requirements laid down in Article 2", which requires transaction monitoring that takes into account "lists of compromised or stolen authentication elements", "the amount of each payment transaction" and "known fraud scenarios in the provision of payment services". Recital 11 says that the low-value contactless exemptions "allow for the development of user-friendly and low-risk payment services", and recital 12 that "a proper balance needs to be struck between the interest in enhanced security in remote payments and the needs of user-friendliness and accessibility of payments in the area of e-commerce".
  168. Secondary, three houses on a band whose boundary is settled. Mordor Intelligence, 3D Secure Pay Authentication Market, May 2026, at $1.63 billion for 2026 growing 12.61%, https://www.mordorintelligence.com/industry-reports/3d-secure-pay-authentication-market ; Fortune Business Insights, 3D Secure Pay Authentication Market, at $1.72 billion for 2026 growing 13.30%, https://www.fortunebusinessinsights.com/3d-secure-pay-authentication-market-106283 ; market.us, 3D Secure Payment Authentication Market, with banks and issuers at 46.3% of buyers, https://market.us/report/3d-secure-payment-authentication-market/ . A 6% spread between the two leading houses, against bands elsewhere in this market differing by multiples. What compels the spend where no statute does is the liability shift, a successfully authenticated transaction moving fraud chargeback liability from the merchant to the issuer.
  169. Primary on the mechanism, with both ends of the dated claim. RedTeam Pentesting GmbH, Man-in-the-Middle Attacks against the chipTAN comfort Online Banking System, 23 November 2009, redteam-pentesting.de/publications/2009-11-23-MitM-chipTAN-comfort_RedTeam-Pentesting_EN.pdf, read 20 October 2026, which records the system as "presently offered to customers of the German Sparkassen banks" at that date, the handheld device with its own display and keyboard, the optical flicker code of five vertical bars read contact-free from the screen, a code "only valid for this transaction", and what the device displays before the customer confirms: for a transfer the amount and the recipient's bank account number, for a collective transfer the total and the item count, and for a SEPA transfer the amount with "Character 3 and 4 and the last four characters of the target account's IBAN". For the current form of the same mechanism, Sparkasse Landshut, chipTAN-QR, sparkasse-landshut.de/de/home/service/online-mobile-banking/chiptan.html, read 20 October 2026, in which the generator reads a code from the screen, displays the order data for the customer to check against the order, and "erzeugt mit Ihrer Sparkassen-Card (Debitkarte) pro Auftrag einen Freigabe-Code", a release code per order. The duration in the text runs from the 2009 document to the page read in 2026 and is stated as since at least 2009, because the 2009 document records the system as already offered rather than as newly launched.
  170. Secondary throughout on the band, six forecast houses, and primary on each acquisition. The agentic security band, sized after the April 2026 disclosure at $1.65 billion to $2.86 billion for 2026 growing 36.4% to 42.0%: market.us, Agentic AI in Cybersecurity Market, updated 17 July 2026, market.us/report/agentic-ai-in-cybersecurity-market/; Grand View Research, Agentic AI Security Market, grandviewresearch.com/industry-analysis/agentic-ai-security-market-report; MarketsandMarkets, Agentic AI Security Market, 30 May 2026, marketsandmarkets.com/Market-Reports/agentic-ai-security-market-97017233.html; Fact.MR, Agentic AI Cybersecurity Market, 17 June 2026, factmr.com/report/agentic-ai-cybersecurity-market; Astute Analytica, AI Agent Identity and Access Management Market, astuteanalytica.com/industry-report/ai-agent-identity-access-management-market. Gartner created a dedicated agentic segment in its artificial intelligence spending forecast in the fourth quarter of 2025. The capability lists across those reports name model security, adversarial threat detection, prompt-injection protection and agent workload protection, and not one of them names authority bounded by a signature. On the consolidation, each from the party's own announcement: Cisco, "Cisco announces intent to acquire Astrix Security", blogs.cisco.com/news/cisco-announces-intent-to-acquire-astrix-security, read 21 October 2026; Palo Alto Networks reporting CyberArk inside its next-generation security annual recurring revenue, paloaltonetworks.com/company/press/2026/palo-alto-networks-reports-fiscal-third-quarter-2026-financial-results; CrowdStrike reporting its identity portfolio, SGNL among it, at $435 million of annual recurring revenue, ir.crowdstrike.com/news-releases/news-release-details/crowdstrike-reports-fourth-quarter-and-fiscal-year-2026/; Thoma Bravo completing its acquisition of ForgeRock on 23 August 2023, on which date ForgeRock merged into Ping Identity, with the forgerock.com pricing pages now redirecting to pingidentity.com; and NICE engaging Goldman Sachs and J.P. Morgan on a sale of Actimize at $1.5 billion to $2 billion, reported November 2025 at calcalistech.com/ctechnews/article/syc7hf11zwx.
  171. Vendor pricing pages, read at source across the research for this document, between 15 June and 21 October 2026. Auth0, pricing: a free tier to 25,000 monthly active users carrying unlimited authentications, Essentials at $35 a month and Professional at $240 a month, each published as reaching 500 monthly active users, and an Enterprise tier carrying no figure and a contact button. The page contradicts itself, its frequently asked questions stating that paid plans run from 1,000 to 100,000 users or more while both priced tiers are labelled at 500, and no price is published at any population above 25,000. https://auth0.com/pricing . Ping Identity, platform pricing: PingOne for Customers Essential at "Starting at: $35k annually" and Plus at "$50k annually", neither carrying a unit of measure; PingOne for Workforce Essential at $3 and Plus at $6 per user per month, on an annual contract with a 5,000-user minimum; and no figure at all against PingOne for Customers Passwordless, DaVinci, Verify, Protect, Authorize or Advanced Services, being six of the ten items the page lists. https://www.pingidentity.com/en/platform/pricing.html . ForgeRock, acquired by Ping Identity under Thoma Bravo, appears nowhere on that page and carries no published price for any product at any population; every figure in circulation for it comes from third-party aggregators rather than from the vendor. CyberArk publishes no rate for Privilege Cloud and its page reads contact sales. SailPoint publishes no rate. Every figure above is list price, and no negotiated pricing was obtained for any vendor. ForgeRock, inside Ping Identity under Thoma Bravo, carries no published price for any product at any population.
  172. Independent benchmarking, not a vendor figure. MetricNet, service desk cost per ticket, being total monthly operating expense divided by monthly ticket volume across direct and indirect salaries and benefits, technology and telecom, and facilities, metricnet.com/service-desk-cost-per-ticket-motm/, with the North American level one incident at about $22 at metricnet.com/metrics-that-matter-user-self-service/ and the peer group benchmark recording a password reset as a simple transaction below the mean on its weighted complexity index at metricnet.com/wp-content/uploads/2018/02/Service-Desk-Peer-Group-Sample-Benchmark-from-MetricNet-v2-1.pdf. The Help Desk Institute places cost per ticket for North American information technology help desks between $6 and $40 or more, reported at ghdsi.com/blog/evaluate-reduce-it-service-desk-cost-per-ticket. Every higher figure in circulation originates with a company selling passwordless authentication or password management, and none is used here. The figure of 20% to 50% of help desk calls being password resets, widely attributed to Gartner, does not exist as a primary Gartner measurement and is not used.
  173. Secondary, the measuring firm's own survey, read at source. Deloitte, Cybersecurity insights 2023: Budgets and benchmarks for financial services institutions, on the 2023 Cybersecurity for financial services survey conducted in June 2023 across 61 financial institutions, 54% of them in banking and capital markets, with respondents banded as small below $500 million of revenue, midsize above $500 million and below $5 billion, large above $5 billion and below $20 billion, and giant above $20 billion; midsize is the largest group at 37%. https://www.deloitte.com/content/dam/assets-zone2/il/en/docs/services/risk-advisory/2025/cybersecurity-insights-2023-budgets-benchmarks-financial-services-institutions.pdf . Read at source 22 October 2026. Cybersecurity spend as a share of total revenue in banking and capital markets: 0.30% in 2019, 0.60 in 2020, 0.88 in 2021 and 0.80 in 2023. That series sits in the study's Figure 1, whose chart labels do not survive text extraction, so it is carried from an earlier verification rather than read off the page on that date. What does extract cleanly are the all-financial-services totals of 0.72% for 2021 and 0.54% for 2023, which match the same verification and corroborate it.
  174. Secondary. IANS Research and Artico Search, 2025 Security Software and Services Benchmark Summary Report, release of 10 September 2025, prnewswire.com/news-releases/ians-research-and-artico-search-unveil-2025-security-software-and-services-benchmark-summary-report-302551990.html, read 28 September 2026: software roughly 30% of security budgets, the second-largest line after staff and compensation. IANS's own page on its 2025 Security Budget Benchmark Report, 14 August 2025, 587 respondents, ians.com/blog/ians-research/what-are-the-top-security-budget-spend-priorities, read 28 September 2026, gives staff and compensation at 39%, software at 29 and outsourcing at 12, and the arithmetic in Section 23 comes out the same on either figure. The identity and access management share of software, 11% below ten billion dollars of revenue and 14% above, is carried from an earlier verification against the full report. The release of IANS's 2025 Security Budget Benchmark Report, 5 August 2025, prnewswire.com/news-releases/ians-research-and-artico-search-release-security-budget-benchmark-report-302521455.html, read 15 August 2026, gives average budget growth of 4%, the lowest in five years.
  175. Primary, the institution's own filings. Wintrust Financial Corporation, annual report on Form 10-K for the year ended 31 December 2025, sec.gov/Archives/edgar/data/1015328/000101532826000007/0001015328-26-000007.txt, and the 2025 Community Impact Report, wintrust.com/content/dam/wintrust/downloads/community-impact/wintrust-2025-community-impact-report.pdf: net revenue of $2.726 billion, 5,902 full-time equivalent employees, above 300,000 consumer households, and fifteen separately chartered banks. The bank is used because its facts are published and for no other reason, every figure attributed to it is its own, and nothing said of it is a statement about what it has bought or intends to buy.
  176. Vendor rates read at source, with the two secondary sources marked. Microsoft, Entra ID pricing, microsoft.com/en-us/security/business/microsoft-entra-pricing, and Amazon Web Services, Cognito pricing, aws.amazon.com/cognito/pricing/, and CloudHSM pricing, aws.amazon.com/cloudhsm/pricing/, all read 28 July 2026: Entra ID P2 at $10 per user per month billed yearly following the increase of 1 July 2026 and included in Microsoft 365 E5; a full Cognito rate card at any population; CloudHSM at $1.60 per HSM hour. CyberArk publishes no rate for Privilege Cloud and its page reads contact sales. It charges by the privileged user, as its own stock-keeping units name it, PRIV-STANDARD-USER-SAAS among them in the District of Columbia's contract CFOPD-25-C-042 of 2025, and it is listed on the General Services Administration's Multiple Award Schedule through DLT Solutions, LLC, contract GS-35F-267DA, gsaadvantage.gov/ref_text/GS35F267DA/GS35F267DA_online.htm, with no line-item price published. The band of $7,000 to $12,000 per privileged user per year at small scale, falling to roughly $1,800 at a thousand seats and above, is from UnderDefense, "CyberArk Pricing Guide 2026", underdefense.com/blog/cyberark-pricing-guide/, and VendorBenchmark, "CyberArk Pricing 2026", vendorbenchmark.com/vendors/cyberark-pricing, aggregated from more than 180 benchmarked contracts, and the $1,800 is the rate applied in Section 23. Both are secondary and both are commercially interested, and the band is carried as that. SailPoint publishes no rate; United States federal solicitation 2032H5-24-R-00019, Attachment 1, "SailPoint Price Schedule", carried by GovTribe at govtribe.com/file/government-file/attachment-1-2032h5-24-r-00019-sailpoint-price-schedule-price-dot-pdf, itemises the IdentityIQ base licence, the Lifecycle Manager module priced per internal user identity cube, the privileged account module and the mainframe module across a base period and two option years, and a General Services Administration award for IdentityNow and professional services runs to $3,677,709.63, usaspending.gov/award/CONT_AWD_47HAA022F0170_4773_GS35F211GA_4732. Every rate above is list price; no negotiated pricing was obtained for any vendor, and none is relied on. District of Columbia, contract CFOPD-25-C-042, 2025, for the stock-keeping unit PRIV-STANDARD-USER-SAAS.
  177. Primary, the institution's own filings. Bank of America Corporation, Form 8-K of 14 January 2026 carrying fourth quarter and full year 2025 results, sec.gov/Archives/edgar/data/70858/000007085826000020/bac12312025ex991.htm, and the 2025 annual report, sec.gov/Archives/edgar/data/70858/000007085826000209/bofaannualreport2025.pdf: total revenue net of interest expense of $113.1 billion and net income of $30.5 billion for 2025, with approximately 213,200 employees, 49.3 million active digital banking users and 41.4 million active mobile banking users each measured over ninety days. The same qualification applies as to the mid-tier bank above: the facts are published, the figures are the institution's own, and nothing here describes what it has bought.
  178. Primary. Principality of Liechtenstein, Notification Form for the eID Scheme eID.li class B, submitted under Article 9(5) of Regulation (EU) No 910/2014, December 2022, ec.europa.eu/digital-building-blocks/sites/download/attachments/554369089/Notification_Form_eID.li_B_Dec_2022_signiert.pdf, read 8 August 2026. Notified at assurance level substantial; the authentication response carries name, family name, date of birth and the level of assurance; additional attributes for natural persons, identity proofing and verification for legal persons, and binding between the electronic identification means of natural and legal persons are each recorded as not applicable; a hardware-backed keystore, up to three factors, refusal to run on rooted, jailbroken or known-vulnerable devices, and data current by construction because a change in the Central Registry of Persons takes immediate effect.
  179. Primary. GLEIF, Global LEI System Business Report, Q1 2026, 28 April 2026, gleif.org/lei-data/global-lei-index/download-global-lei-system-business-reports/download-global-lei-system-business-report-q1-2026/q1-2026-quarterly_business_report.pdf, read 16 October 2026, for the active population at 3.02 million and more than 3.26 million including retired records, and for the renewal rate of 56.6% overall. ISO 17442 for the identifier itself.
  180. Primary, the published artefacts, parsed mechanically rather than read. The six official vLEI credential schemas, repository github.com/GLEIF-IT/vLEI-schema, files taken on 16 October 2026 from raw.githubusercontent.com/GLEIF-IT/vLEI-schema/main/ being qualified-vLEI-issuer-vLEI-credential.json, legal-entity-vLEI-credential.json, legal-entity-official-organizational-role-vLEI-credential.json, legal-entity-engagement-context-role-vLEI-credential.json, oor-authorization-vlei-credential.json and ecr-authorization-vlei-credential.json. The same six files are served byte-identically from raw.githubusercontent.com/WebOfTrust/vLEI/dev/schema/acdc/, checked by SHA-256 on the same day. The field inventory, the match of every distinct property name against the seventeen terms named in the text, the three const values in each Rules section including the usage disclaimer quoted, and the recomputation of each self-addressing identifier from its own file against the value that file declares, were all produced mechanically from these files. The registry's own description of a self-addressing identifier as "an encoded agile cryptographic digest of the contents of the schema" is at GLEIF, vLEI Ecosystem Governance Framework: Technical Requirements Part 3, vLEI Credential Schema Registry, v1.2, 25 March 2026, gleif.org/organizational-identity/become-a-vlei-issuer-qvi/vlei-ecosystem-governance-framework/2026-03-25_vlei-egf-v4.0-technical-requirements-part-3-vlei-credential-schema-registry_v1.2_final.pdf.
  181. Primary, GLEIF's own controlled documents, every quotation verbatim, each read in full at source on 16 October 2026 except where stated. All at gleif.org/organizational-identity/become-a-vlei-issuer-qvi/vlei-ecosystem-governance-framework/. Technical Requirements Part 2, vLEI Credentials, v1.2, 25 March 2026, 2026-03-25_vlei-egf-v4.0-technical-requirements-part-2-vlei-credentials_v1.2_final.pdf, for issuers who "SHOULD use the Rules section of the credential" to "impose restrictions on the use of the credential or its attributes", and for holders and verifiers who "SHOULD comply with the Presentation Exchange Protocol Specification (IPEX) section of the ACDC specification". The Legal Entity vLEI Credential Framework, v1.5, 2026-03-25_vlei-egf-v4.0-legal-entity-vlei-credential-framework_v1.5_final.pdf, for "no restrictions on the Holders of vLEI Credentials", for the entity which "is responsible for the use of" the credentials it has authorised and "assumes liability for misuse of Legal Entity vLEI Credentials by its representatives", and for a credential "valid, unexpired, and non-revoked" with no duration defined anywhere. The Legal Entity Official Organizational Role vLEI Credential Framework, v1.5, 2026-03-25_vlei-egf-v4.0-legal-entity-official-organizational-role-vlei-credential-framework_v1.5.final.pdf, for the role validated "using one or more official public sources" against the ISO 5009 lists. The Legal Entity Engagement Context Role vLEI Credential Framework, v1.5, 2026-03-25_vlei-egf-v4.0-legal-entity-engagement-context-role-vlei-credential-framework_v1.5_final.pdf, for a legal entity issuing "ECR vLEI Credentials directly to ECR Persons" with its own authorised representatives who "MUST act as the Issuer", for the field value which "MUST be the Engagement Context Role" with no controlled vocabulary named, and for representatives who "MAY choose to restrict Identity Assurance to validating the legal name of the ECR Person". The Glossary, v1.4, 2026-03-25_vlei-egf_v4.0-glossary_v1.4_final.pdf, in which authority is not defined and no term in it contains the word. The Trust Assurance Framework, v1.6, for "GLEIF will not be able to determine compliance by Ecosystem stakeholders other than itself and Qualified vLEI Issuers", read in part and truncated before its annual qualification procedure and its own appendix. GLEIF, vLEI Ecosystem Governance Framework, controlled documents of 25 March 2026, all at gleif.org/organizational-identity/become-a-vlei-issuer-qvi/vlei-ecosystem-governance-framework/: Technical Requirements Part 2, vLEI Credentials, v1.2, 2026-03-25_vlei-egf-v4.0-technical-requirements-part-2-vlei-credentials_v1.2_final.pdf; Legal Entity vLEI Credential Framework, v1.5, 2026-03-25_vlei-egf-v4.0-legal-entity-vlei-credential-framework_v1.5_final.pdf; Legal Entity Official Organizational Role vLEI Credential Framework, v1.5, 2026-03-25_vlei-egf-v4.0-legal-entity-official-organizational-role-vlei-credential-framework_v1.5.final.pdf; Legal Entity Engagement Context Role vLEI Credential Framework, v1.5, 2026-03-25_vlei-egf-v4.0-legal-entity-engagement-context-role-vlei-credential-framework_v1.5_final.pdf; Glossary, v1.4, 2026-03-25_vlei-egf_v4.0-glossary_v1.4_final.pdf.
  182. Primary, the specifications GLEIF's framework mandates, taken as source text and searched whole, every quotation verbatim. Trust over IP, KERI Suite Working Group, Authentic Chained Data Containers (ACDC), v1.1, trustoverip.github.io/kswg-acdc-specification/, doi.org/10.5281/zenodo.18792085, source text taken 16 October 2026 from raw.githubusercontent.com/trustoverip/kswg-acdc-specification/main/spec/spec-body.md and searched in full, for the Rule section: "A Rule MUST HAVE a Legal, l, field. And MAY have a SAID, d field. When the Rule has a SAID, d field, it MAY also have a UUID, u field. A Rule MUST NOT have any other fields", and "The legal language, l, field in each clause block provides the associated legal language as a string". Trust over IP, KERI Suite Working Group, Key Event Receipt Infrastructure (KERI), v1.1, trustoverip.github.io/kswg-keri-specification/, doi.org/10.5281/zenodo.18887102, source text taken 16 October 2026 from raw.githubusercontent.com/trustoverip/kswg-keri-specification/main/spec/spec-body.md and searched in full, for the seal: a key event log "manages commitments to external data"; "A seal, at a minimum, includes a cryptographic digest of the serialized external data, usually its SAID"; "the inclusion of a seal in a key event is equivalent to signing the external data but without revealing that data"; "Seals make a verifiable, nonrepudiable commitment to an external serialized data item without disclosing the item"; "The order of appearance of seals in a KEL provides a verifiable ordering of the associated endorsements of that data, which can be used as a foundation for ordered verifiable transactions. Seals enable authenticatable transactions that happen externally to the KEL"; and "Interaction events are less secure than rotation events". For challenge-response: "One form of interactive proof is to satisfy a challenge of that control. The challenger creates a unique challenge Message. The Controller responds by nonrepudiably signing that challenge with the private key from the keypair under its control." No phrase for a transaction limit, a spending ceiling or a scope of authority occurs anywhere in either file. KERI is labelled v1.1, carries an internal inconsistency in which the text refers to version 2.XX implementations, and states "THESE MATERIALS ARE PROVIDED 'AS IS.'"
  183. Primary, GLEIF's own published material, every quotation verbatim, all read 16 October 2026. GLEIF, Agentic AI in Payments: Establishing Interoperable Trust and Control, v1.0-1, 13 August 2026, gleif.org/organizational-identity/research-publications/2026-08-13_agentic_ai_in_payments_v1.0-1.pdf, read to section 7 and through annexes A to D with the intervening body read in part, for "the former establishes the right to act; the latter determines whether the specific transaction should proceed"; "The runtime policy engine determines whether the specific action proposed at the moment of execution should proceed"; "The framework here is deliberately agnostic on this point"; "This annex outlines a proposed credential architecture, the Agent Mandate Credential (AMC)", which "encodes the scope of what the Agent is permitted to do" including "the class of actions it may take, any transaction limits, permitted counterparties"; "The formal ACDC schema for the AMC needs to be defined, including the precise field structure and validation rules"; and, in Annex D, "This is not a limitation of what vLEI and ACDC deliver today. It is a known frontier that requires further architectural work." Alexandre Kech, "When AI Agents Transact, Who Stands Behind Them? Why Verifiable Organizational Identity Is Critical to Agentic Payments", GLEIF blog, 1 September 2026, gleif.org/en/newsroom/blog/when-ai-agents-transact-who-stands-behind-them-why-verifiable-organizational-identity-is-critical-to-agentic-payments, for machine-readable proof of "the authority it has been delegated, and the boundaries of that authority", "accountability is hardwired into each agentic transaction", and authority "verified when the transaction is initiated, rather than reconstructed afterward". Jaegyeong Yeom, "How YourData Is Exploring Execution Trust for AI Agents with the vLEI", GLEIF newsroom, 21 September 2026, gleif.org/en/newsroom/blog/how-yourdata-is-exploring-execution-trust-for-ai-agents-with-the-vlei, for "Verifying an organization and role establishes a trust foundation, but it does not determine whether a particular action may proceed", "Permission to negotiate commercial terms does not automatically authorize issuing a financial instruction", "the execution-trust gap", and the status its own author gives it as a "prototype" under "proof-of-concept and integration work" whose "Deployment at scale requires several foundations to mature together". GLEIF, "Introducing the verifiable LEI (vLEI)", product page, gleif.org/en/organizational-identity/introducing-the-verifiable-lei-vlei, for "verify the identity, authority, and role of people acting on behalf of any legal entity" and "from signing regulatory filings and reports to authorizing business payments". Alexandre Kech, "Who Stands Behind the Document? Why Digital Data Needs Verifiable Organizational Identity", GLEIF blog, 15 May 2026, gleif.org/en/newsroom/blog/who-stands-behind-the-document-why-digital-data-needs-verifiable-organizational-identity, for the vLEI which "does more than identify an organization" and "establishes who within that organization is authorized to act, and in what capacity", being "more precise and legally defensible than a paper seal".
  184. Primary, GLEIF's own account of its own deployment, every quotation verbatim. GLEIF, "From passwords to proof: how the vLEI Authenticator establishes verifiable organizational roles", gleif.org/en/print/?article=from-passwords-to-proof-how-the-vlei-authenticator-establishes-verifiable-organizational-roles, 24 February 2026, read 13 October 2026. The deployment is the vLEI Authenticator, developed with esatus and integrated with Keycloak through SOWL: "SOWL confirms the result to Keycloak, which completes authentication and issues the access token", and "Keycloak... issues the usual OpenID Connect (OIDC) or SAML token." No separate signature over each subsequent request is described for the application session.
  185. Primary, both vendors' own documentation, every quotation verbatim. Apple, support document on iCloud Keychain security, support.apple.com/en-us/102195, read 11 October 2026: iCloud Keychain is end-to-end encrypted with strong cryptographic keys not known to Apple; the escrow service releases a copy without allowing Apple to read the passwords and other data it contains, and only if a strict set of conditions is met; recovery requires the iCloud account and password, a response by SMS and then the device passcode, and after ten failed attempts the escrow record is destroyed. Google, developer documentation, developers.google.com/identity/passkeys/faq and developers.google.com/identity/passkeys/supported-environments, both read 11 October 2026: the Google Password Manager encrypts passkey secrets end-to-end; when a user creates a passkey with Google Password Manager, it's synchronized and end-to-end encrypted; although passkeys are backed up to Google's servers, Google can't use them to impersonate users; and a screen lock or PIN is entered to decrypt a synced passkey on a new environment. Google's published limit is impersonation and not access, and it is stated here as Google states it.
  186. Primary, the standards body and the specification, with Mozilla's documentation for the flag set. FIDO Alliance, "WebAuthn Level 3 is now a W3C Recommendation", recording the Recommendation of 25 August 2026 and listing what Level 3 adds over Level 2 in the Alliance's own words, including the Backup Eligible and Backup State flags, the interface that "lets relying parties tell the credential manager about revoked or renamed credentials, and reconcile the valid credential set", and the sharing of a credential manager's identifier without attestation "so sites can label passkeys by provider and icon". https://fidoalliance.org/webauthn-level-3-is-now-a-w3c-recommendation/ . Read at source 22 October 2026. The specification is Web Authentication Level 3, W3C Recommendation of 25 August 2026, https://www.w3.org/TR/2026/REC-webauthn-3-20260825/ , read at source 22 October 2026, whose credential-creation algorithm at section 5.1.3 directs the user agent, for direct or enterprise attestation, to "Convey the authenticator's AAGUID and attestation statement, unaltered, to the Relying Party", with enterprise attestation possible only "if the user agent wishes to support enterprise attestation for pkOptions.rp.id". The flag set is Mozilla Developer Network, Authenticator data, https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API/Authenticator_data , read at source 22 October 2026: user presence at bit 0, user verification at bit 2, backup eligibility at bit 3, backup state at bit 4, attested credential data at bit 6 and extension data at bit 7, with bits 1 and 5 described nowhere and all bits not specifically mentioned "reserved for future use". Backup eligibility means the credential source "can be backed up in some fashion (for example via cloud or local network sync) and as such may become present on an authenticator other than its generating authenticator".
  187. Primary, the Alliance's own membership page and the agency's own pages, all read 27 October 2026. FIDO Alliance, members page, fidoalliance.org/members/, for the four membership tiers, for the Board Level, Sponsor Level and Associate Level members named, and for the tier headed Government Level FIDO Members and the nine bodies named in it: the Cyber Security Agency of Singapore, Thailand's Electronic Transactions Development Agency, Germany's Federal Office for Information Security, Taiwan's Ministry of Digital Affairs, Taiwan's Ministry of the Interior, the United Kingdom's National Cyber Security Centre, the United States National Institute of Standards and Technology, Taiwan's TTC and Korea's TTA. The tier headings are the page's own visible text; the members within each tier are carried in the page's alt text and in its links to each organisation's own domain, which is the provenance of the nine names and is stated here because the page sets them out as images. No tier and no named member on that page is identified as a consumer, civil liberties or digital rights organisation. National Cyber Security Centre, what we do, ncsc.gov.uk/section/about-ncsc/what-we-do, for the Centre describing itself as "a part of GCHQ" and for its formation by bringing together parts of government, MI5 and GCHQ.
  188. Primary, the directory's own documentation, every quotation verbatim. Microsoft, "How to enable passkeys (FIDO2) in Microsoft Entra ID", learn.microsoft.com/en-us/entra/identity/authentication/how-to-authentication-passkey-profiles, last updated 15 May 2026, read 11 October 2026: a passkey profile carries "Passkey types | Device-bound, Synced"; "If you disable synced passkeys for a given passkey profile, targeted users can't sign in with a synced passkey even if they already registered one"; "Synced passkeys do not support attestation"; and "If enforce attestation is set to No, Microsoft Entra ID can't guarantee any attribute about a passkey, including if it's synced or device-bound." The AAGUID control is a separate setting, and the page's own guidance is to use AAGUID lists "as a policy guide rather than a strict security control" where attestation is not enforced.
  189. Primary, three supervisory documents, every quotation verbatim. European Banking Authority, Guidelines on outsourcing arrangements, EBA/GL/2019/02, final report of 25 February 2019, eba.europa.eu/sites/default/files/documents/10180/2551996/38c80601-f5d7-4855-8ba3-702423665479/EBA%20revised%20Guidelines%20on%20outsourcing%20arrangements.pdf, read 13 October 2026, paragraph 68: an institution should "consider the consequences of where the service provider is located (within or outside the EU)" and "consider the political stability and security situation of the jurisdictions in question, including: i. the laws in force, including laws on data protection; ii. the law enforcement provisions in place". Regulation (EU) 2022/2554, the Digital Operational Resilience Act, Articles 28 and 29, eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554, read 13 October 2026: a financial entity must weigh the risks of subcontracting ICT services supporting critical or important functions, "in particular in the case of an ICT subcontractor established in a third-country", and must consider "the compliance with Union data protection rules and the effective enforcement of the law in that third country". FINMA Circular 2018/3, Outsourcing - banks and insurers, in force since 1 April 2018 and last amended on 4 November 2020 with effect from 1 January 2021, finma.ch/~/media/finma/dokumente/dokumentencenter/myfinma/rundschreiben/finma-rs-2018-03-01012021_de.pdf, with the version of 21 September 2017 at finma.ch/en/~/media/finma/dokumente/rundschreiben-archiv/2018/rs-18-03/finma-rs-2018-03---20170921.pdf, read 13 October 2026: "The outsourcing of a function must not make supervision by FINMA more difficult, in particular if the function is outsourced to another country." The European Data Protection Board's final guidelines on data transfers to third-country authorities, under Article 48 of the General Data Protection Regulation, adopted 4 June 2025, edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-022024-article-48-gdpr_en, with the guidelines at edpb.europa.eu/system/files/2025-06/edpb_guidelines_202402_article48_v2_en.pdf, address the same question in the data-protection frame and are not relied on here.
  190. Primary, the statute, every quotation verbatim, all read 26 and 27 October 2026. 18 U.S.C. § 2713, Required preservation and disclosure of communications and records, as reproduced by the Legal Information Institute, Cornell Law School, law.cornell.edu/uscode/text/18/2713, the section having been added by Public Law 115-141, division V, section 103(a)(1), of 23 March 2018, at 132 Stat. 1214, for the obligation to "preserve, backup, or disclose the contents of a wire or electronic communication" and "any record or other information pertaining to a customer or subscriber" held "within such provider's possession, custody, or control", and for "regardless of whether such communication, record, or other information is located within or outside of the United States". The official text at uscode.house.gov returned a client error on 26 October 2026 and the govinfo page for Public Law 115-141 truncates before Division V, so the section is taken from the Institute's reproduction carrying its own source credit. 18 U.S.C. § 2703(d), same source, law.cornell.edu/uscode/text/18/2703, for an order issuing where the government "offers specific and articulable facts showing that there are reasonable grounds to believe" the material is "relevant and material to an ongoing criminal investigation". 18 U.S.C. § 2703(h), same source, for the motion to quash and its two conditions, the "material risk that the provider would violate the laws of a qualifying foreign government", the definition of a qualifying foreign government by reference to an executive agreement in force under § 2523, the filing deadline "not later than 14 days after the date on which the provider was served", and the three findings a court must make, one of them the comity analysis. 18 U.S.C. § 2705(b), same source, law.cornell.edu/uscode/text/18/2705, for a court ordering a provider "not to notify any other person of the existence of the warrant, subpoena, or court order", "for such period as the court deems appropriate", and for the five adverse results, the last being "otherwise seriously jeopardizing an investigation or unduly delaying a trial". Cross Border Data Forum, "CLOUD Act: Answers to Frequently Asked Questions", July 2025, crossborderdataforum.org/wp-content/uploads/2025/07/2025-CLOUD-Act-Answers-to-Frequently-Asked-Questions.pdf, FAQ 4, for the Act leaving the requirement of United States jurisdiction over the provider where it was. United States Department of Justice, CLOUD Act Resources, justice.gov/criminal/cloud-act-resources, page carrying a last-updated date of 24 October 2023, for the agreements it names.
  191. Primary. French Senate, commission of inquiry into public procurement, hearing of 10 June 2025, compte rendu at senat.fr/compte-rendu-commissions/20250609/ce_commande_publique.html, read 13 October 2026. Testimony of Anton Carniaux, director of public and legal affairs, and Pierre Lagarde, public-sector technical director, Microsoft France, both under oath: the exchange on whether it could be guaranteed that the data would not be transmitted following a United States injunction, and the answer that it could not, together with the confirmation that where a request is properly framed the company is obliged to give the data and does give it, and the two qualifications the witnesses entered. The commission's president is Simon Uzenat, named on the commission's own page at senat.fr. His words are in French and the rendering in the body is ours; his own are: "Dans les rapports de transparence de Microsoft, qui sont le résultat d'une démarche purement déclarative, figurent les éléments que vous voulez bien y faire figurer, et leur réalité n'est attestée par aucun contrôle extérieur."
  192. Primary, the Alliance's own specification, read 29 October 2026. FIDO Alliance, "Credential Exchange Protocol", Working Draft, 3 October 2024, fidoalliance.org/specs/cx/cxp-v1.0-wd-20241003.html, for the protocol defining a means to securely move one or more credentials between two credential providing applications, for its status as a Working Draft Specification, for the statement that it "is not intended to be a basis for any implementations as the Specification may change", and for its statements that the draft has no official standing and does not represent Alliance consensus.
  193. Primary, the Alliance's own specification, read 29 October 2026. FIDO Alliance, "Credential Exchange Format", Proposed Standard, 9 March 2026, fidoalliance.org/specs/cx/cxf-v1.0-ps-errata-20260309.html, for the status line "Proposed Standard, March 09, 2026", for the abstract defining the data structures and format of credentials being passed or referenced, and for the security considerations at section 5.1 stating that the Credential Exchange Protocol "ensures that the credential exchange remains confidential between the exporting provider and importing provider". This is the Proposed Standard with the errata of 9 March 2026 folded in.
  194. Primary, read 29 October 2026. FIDO Alliance, download credential exchange specifications, fidoalliance.org/download-credential-exchange-specifications/, for the Credential Exchange Protocol Working Draft of 3 October 2024 being the only version of that document offered, for the Credential Exchange Format Proposed Standard of 9 March 2026, and for the page describing both as currently in early review draft.
  195. Primary, both companies' own terms, every quotation verbatim, read 29 October 2026. Apple, iCloud Terms and Conditions, apple.com/legal/internet-services/icloud/en/terms.html, at section VII.B for the right to terminate or suspend an account under certain circumstances and without prior notice, for the causes quoted, and for termination on thirty days' notice where an account has been inactive for one year; and at section VII.C for the loss of access on termination, for Apple deleting information and data stored in or as a part of the account after a period of time, and for Apple not being responsible to the holder or any third party for any damages. Google, Google Terms of Service, policies.google.com/terms, at the section headed Suspending or terminating your access to Google services, for the three circumstances quoted and for the statement that a user who believes an account was suspended or terminated in error may appeal.
  196. Primary, the two European authorities' own joint report, read 29 October 2026. European Banking Authority and European Central Bank, 2025 Report on Payment Fraud, EBA/REP/2025/40, December 2025, eba.europa.eu/sites/default/files/2025-12/1709846a-84d9-47cf-86a0-b155efb34d66/EBA%20and%20ECB%20Report%20on%20Payment%20Fraud.pdf, for the value of fraudulent card transactions on cards issued in the European Union and European Economic Area in 2024 at €1.3 billion with a fraud rate of 0.033%, for the issuer-perspective total of €1,294,228,994 in its Table 1, and for the finding at chapter 3.1 that "Remote card payment fraud in value and volume terms accounted for around 83% of all card fraud in 2024". The report also records that transactions authenticated with strong customer authentication showed lower fraud rates than those without, especially for card payments. European Central Bank, press release, 15 December 2025, ecb.europa.eu/press/pr/date/2025/html/ecb.pr251215~e133d9d683.en.html, read 29 October 2026, for the total value of payment fraud at EUR 4.2 billion in 2024 against EUR 3.5 billion in 2023, for a fraud rate stable at around 0.002% of total transaction value, and for card losses of EUR 1.329 billion on cards issued in the EU and EEA, a year-on-year increase of 29%. The press release figure and the report's own table are different measures of card fraud; the figure used above is the report's. Read again on 1 November 2026 for section 4 of the report: at section 4.1, p. 24, that for card payments the low share authenticated "can mostly be explained by the use of these instruments at the point of sale, where exemptions like the ones foreseen for contactless payments and transport fares, inter alia, are more prevalent and have become the standard for paying at the point of sale"; at section 4.3, p. 30, that the contactless exemption "accounted for around 79% of the total volume of non-SCA card payments in 2024", which read with Chart 14 is the share of card payments made at the point of sale without strong customer authentication; at section 4.2, p. 25, that "In 2024, fraud rates for card transactions without SCA within the EEA were twice as high in both value and volume terms than transactions with SCA within EEA"; and at section 4.3, p. 31, that "fraud rates related to SCA-exempted non-remote card payments were generally lower than remote transactions and often below the overall fraud rate for this instrument", while "Fraud rates for SCA-exempted remote card payments were generally above the overall card payment fraud rate", which "could suggest that fraudsters adapt their attacks by aiming at transactions that could fall into commonly used exemptions".
  197. Primary, the trade body's own report, read 29 October 2026. UK Finance, Annual Fraud Report 2026, June 2026, ukfinance.org.uk/system/files/2026-06/UK%20Finance%20Fraud%20Report%202026.pdf, with the accompanying press release at ukfinance.org.uk/news-and-insight/press-release/fraud-report-2026-press-release, for payment fraud losses of £1.28 billion in 2025, an increase of 4%; for remote purchase card fraud losses rising 3% to £423.5 million; for case numbers rising 13% to 3.2 million; and for £1.68 billion of unauthorised fraud prevented by the industry. The average of about £132 a case is computed here from the two figures the report gives and is not a figure the report states.
  198. Primary, the Council's own pages, read 29 October 2026. PCI Security Standards Council, about us, pcisecuritystandards.org/about_us/, for the Council's founding in 2006 by American Express, Discover, JCB International, MasterCard and Visa Inc., for the Payment Card Industry Data Security Standard being "intended for entities that store, process or transmit payment account data", and for the Council not enforcing compliance, which is decided instead by the programmes that manage it, such as the payment brands and acquirers. The Council's own founding sentence spells the fourth founder MasterCard; the body text above uses the company's current styling.
  199. Primary, the bank's own guidance and the Swiss issuer's own releases, read 1 November 2026. UBS, UBS Insights, "Contactless payment: what you need to know", 4 July 2025, ubs.com/ch/en/services/guide/accounts-and-cards/articles/contactless-payment.html, in these words: "you can use UBS cards to make contactless payments up to CHF 80 without any additional measures" and "You only need to enter a PIN code for payments of CHF 80 or more". PostFinance, press release, "Restrictions on contactless payments to be temporarily eased", 8 April 2020, postfinance.ch/en/about-us/media/newsroom/restrictions-on-contactless-payments-to-be-temporarily-eased.html, for the limit before the change, "At present, contactless payments of 40 francs and above require PIN verification at the terminal", for the new limit "nationwide by mid-April", and for the measure being taken "in consultation with all other card providers in Switzerland"; PostFinance, press release, "Limit for contactless payment without PIN to remain at 80 francs", 17 November 2020, postfinance.ch/en/about-us/media/newsroom/limit-for-contactless-payment.html: "The parties involved have now decided to retain this limit permanently."
  200. Primary, the trade body's own pages and the regulator's own notices, read 1 November 2026. UK Finance, "Contactless limit change FAQs", ukfinance.org.uk/contactless-limit-change-faqs: "So far, the limit has increased from £10 in 2007, to £15 in 2010, and £20 in 2012, and £30 in 2015", "It will now rise to £45 from April 2020" and "From 15 October 2021, the contactless card payment limit is increasing to £100." Financial Conduct Authority, Handbook Notice No 136, December 2025, fca.org.uk/publication/handbook/handbook-notice-136.pdf, on the Technical Standards (Strong Customer Authentication and Common and Secure Methods of Communication) (Amendment) Instrument 2025, FCA 2025/62, made 18 December 2025: the amendments "remove the regulatory contactless limits and implement a new risk-based exemption", the instrument "comes into force on 19 March 2026", "PSPs will be able to set their own contactless limits", and the authority anticipates that "most PSPs will continue to apply their existing limits in the short term"; with the authority's press release of 19 December 2025, "Greater flexibility to be given for setting future contactless limits", fca.org.uk/news/press-releases/greater-flexibility-be-given-setting-future-contactless-limits. UK Finance, UK Payment Markets 2026, summary, August 2026, ukfinance.org.uk/system/files/2026-08/PaymentMarketsReport_2026Summary.pdf, p. 12, on "the £100 cap on physical card payments, now scrapped by the FCA but kept by most issuers".
  201. Primary, the central bank's own statistics and survey, read 1 November 2026. European Central Bank, statistical release, "Payments statistics: second half of 2025", 22 July 2026, ecb.europa.eu/press/stats/paysec/html/ecb.pis2025h2~23986fb4a6.en.html: "Card payments accounted for 57% of the total number of transactions", among the cashless payments the release counts; contactless card payments at a physical point-of-sale terminal numbered 32.9 billion with a total value of €0.9 trillion, and "their share in the total number of non-remote card payments accounted for 85%". The average of about €27 a contactless payment is computed here from those two totals and is not a figure the release states. European Central Bank, Study on the payment attitudes of consumers in the euro area (SPACE), 2024 edition, December 2024, ecb.europa.eu/stats/ecb_surveys/space/shared/pdf/ecb.space2024~19d46f0f17.en.pdf, pp. 26 to 28: "12% of POS payments had a purchase amount higher than €50"; "Cash payments accounted for 68% of payments with a value of €5 or less"; "For payments with a value of €5 or less, the share of card payments increased from 15% to 21%", between 2022 and 2024; and "it is now easier to use contactless payments for lower payment amounts too". The figure of 88 in every 100 is computed here from the 12%.
  202. Primary, the trade body's own report, read 1 November 2026. UK Finance, UK Payment Markets 2026, summary, August 2026, ukfinance.org.uk/system/files/2026-08/PaymentMarketsReport_2026Summary.pdf, p. 9: "Card payments overall accounted for 64% of payments"; and p. 11: "Debit cards have replaced many low-value cash payments, particularly as small businesses and sole traders have become more able and willing to accept cards."
  203. Primary, the provider's own price list, read 1 November 2026. Anthropic, Claude Platform documentation, "Pricing", platform.claude.com/docs/en/about-claude/pricing, which gives base input prices of "$2 / MTok" for Claude Sonnet 5.5 and "$0.10 / MTok for prompts up to 100,000 tokens" for Claude Haiku 5.5, a MTok being a million tokens, and states "All prices are in USD". A thousand tokens of input therefore costs $0.002 on the first and $0.0001 on the second, computed here.
  204. Primary, the networks' own announcements and documentation, read 1 November 2026. Visa Developer, "Visa Intelligent Commerce", developer.visa.com/capabilities/visa-intelligent-commerce: "A new pass-through payment token, specific to agents, that is intended for use at Visa-accepting merchant locations", with a passkey set up at provisioning "that will be used by the agent to authenticate future instructions", and "The agent requests the user to authenticate the Payment Instruction using their Passkey"; "The Visa Intelligent Commerce platform will validate that these requests match the authenticated user instruction and set network level controls"; and "When authorization requests are received by VisaNet", controls check "that the request originates from the intended merchant for the correct amount"; Visa Inc., press release, "Find and Buy with AI: Visa Unveils New Era of Commerce", 30 April 2025, usa.visa.com/about-visa/newsroom/press-releases.releaseId.21361.html: "Now, with Visa Intelligent Commerce, AI agents can find, shop and buy for consumers based on their pre-selected preferences", and "Each consumer sets the limits, and Visa helps manage the rest." Mastercard, press release, "Mastercard unveils Agent Pay, pioneering agentic payments technology to power commerce in the age of AI", 29 April 2025, mastercard.com/global/en/news-and-trends/press/2025/april/mastercard-unveils-agent-pay-pioneering-agentic-payments-technology-to-power-commerce-in-the-age-of-ai.html, for "Mastercard Agentic Tokens"; Pablo Fourez, Mastercard, "Scaling agentic commerce with trust", 14 October 2025, mastercard.com/global/en/news-and-trends/stories/2025/agentic-commerce-framework.html, for agents "enabled to initiate transactions using agentic tokens" and purchase intent data "including cart contents, transaction limits and validity windows"; and Pablo Fourez, Mastercard, "When AI starts buying for you, trust becomes the product", 5 March 2026, mastercard.com/us/en/news-and-trends/stories/2026/verifiable-intent.html: "Instead of acting directly, consumers delegate", "The agent interprets those instructions, monitors conditions, and may act independently to make the purchase", and "In machine-to-machine commerce and programmable money implementations, a consumer or business is always delegating spending authority to a system".
  205. Primary, the processor's own price list, read 1 November 2026. Stripe, "Pricing & Fees", stripe.com/us/pricing: "2.9% + 30¢" a successful transaction for domestic cards, with 1.5% more for international cards and 1% more where currency is converted. Coinbase's x402 whitepaper, cited below, gives a credit card the same "$0.30 + 2.9%" in its own comparison table, at p. 4. The multiples of the price of a thousand tokens are computed here from Anthropic's published prices.
  206. Primary, the researchers' own paper, read 1 November 2026. Yuanzhe Zhang, Yuexin Xiang, Yuchen Lei, Qin Wang, Tian Qiu, Yujing Sun, Spiridon Zarkov, Tsz Hon Yuen, Andreas Deppeler, Jiangshan Yu and Kwok-Yan Lam, of Nanyang Technological University, Monash University, Wuhan University, CSIRO Data61, Zark Lab and the University of Sydney, "SoK: Blockchain Agent-to-Agent Payments", arXiv:2604.03733v1, submitted 4 April 2026, arxiv.org/abs/2604.03733. At p. 2: "Recent extensions to conventional payment infrastructures, such as Mastercard Agent Pay [20], enable AI agents to transact using tokenized payment credentials under delegated authorization constraints. However, as they remain tied to card-network authorization and settlement rails, each interaction is processed as an independent authorization, making such systems ill-suited for workloads involving frequent small payments or multi-step tasks due to repeated authorization overhead." At p. 12, "payment completion is weakly coupled to service completion", as "the execution only verifies a successful transfer, not correct delivery". At p. 13: "In inclusion-gated models such as x402 [53], completion is defined by transaction inclusion."
  207. Primary, the foundation's host and the protocol's author, read 1 November 2026. Linux Foundation, press release, "Linux Foundation is Launching the x402 Foundation and Welcoming the Contribution of the x402 Protocol", New York, 2 April 2026, linuxfoundation.org/press/linux-foundation-is-launching-the-x402-foundation-and-welcoming-the-contribution-of-the-x402-protocol: "The x402 protocol, created by Coinbase, is moving to the Linux Foundation"; "Membership will be comprised of participants from multiple verticals with initial intent and support being expressed by Adyen, Amazon Web Services, American Express, Ampersend.ai, Base, Circle, Cloudflare, Coinbase, Fiserv, Google, KakaoPay, Mastercard, Merit Systems, Microsoft, Polygon Labs, PPRO, Shopify, Sierra, Solana Foundation, Stripe, thirdweb, and Visa"; and Rubail Birwadker, Global Head of Growth Products and Strategic Partnerships at Visa: "By supporting the x402 Foundation, Visa is working to ensure that trusted and secure payments can happen seamlessly, with cards or stablecoins, wherever AI agents transact." Coinbase Developer Platform, "x402 Foundation", docs.cdp.coinbase.com/x402/support/x402-foundation, names Visa and Mastercard among the foundation's premier members.
  208. Primary, the standard's own whitepaper, read 1 November 2026. Erik Reppel, Ronnie Caspers, Kevin Leffew, Danny Organ, Dan Kim and Nemil Dalal, Coinbase Developer Platform, "x402: An open standard for internet-native payments", 6 May 2025, x402.org/x402-whitepaper.pdf. At p. 3, payments "using stablecoins like USDC". At p. 4, "real-time, trustless payments", and "onchain transactions via x402 settle in ∼200ms, providing instant payment finality for API providers"; and the comparison table, which lists "x402 (on Base)" as "Free*", the asterisk reading "nominal gas" of under $0.0001, and a credit card as "$0.30 + 2.9%", under the column headed "Chargeback Risk", "Yes, up to 120d". At p. 8, "Payments settle instantly onchain, eliminating chargebacks and disputes", and "No chargebacks, no fraud risks, no intermediaries". At p. 9, "No reliance on banks or third-party approvals, ensuring global, permissionless access." At p. 11, in section 9.3, "Payment channels: For high-frequency micropayments between trusted parties".
  209. Primary, the network's own documentation and incident report, and L2BEAT's published assessment, read 1 November 2026. Base, documentation, "Flashblocks", docs.base.org/base-chain/flashblocks/faq: "Flashblocks occur every 200ms instead of every 2 seconds"; a preconfirmation is "An ultra-fast signal that a transaction will be included, before the full block is sealed"; "Base targets a Flashblock reorg rate of < 0.1%", and "A reorg means a Flashblock was streamed as a preconfirmation but wasn't included in the final block", and "While reorgs are rare, applications should implement fallback logic for critical operations". Base, status page, "Base Mainnet | Unsafe head delay", postmortem posted 5 August 2025, status.base.org/incidents/kdq3t8s13gfs: "At 6:07am UTC, the active sequencer began to fall behind due to onchain activity"; the automated handover to a replacement sequencer failed because "Conductor was not yet fully enabled on this sequencer"; and "By 6:40am UTC, the network was fully recovered, resulting in a total downtime of 33 minutes", with block production, deposits, withdrawals and Flashblocks affected. L2BEAT, "Base Chain", l2beat.com/scaling/projects/base, with data to 9 October 2026: "The single Sequencer actor can be modified by Base Multisig 1 via the SystemConfig contract", and "Elsewhere Coinbase acts alone: the 3/12 Base Multisig 1 owns SystemConfig"; and, where the sequencer does not include a transaction, "users can force transactions to be included in the project's chain" by sending them to Ethereum, and "There can be up to a 12h delay on this operation."
  210. Primary, Coinbase's own price, read 1 November 2026. Coinbase Developer Platform, "CDP Facilitator", docs.cdp.coinbase.com/x402/seller/facilitator: "The first 1,000 onchain Facilitator transactions each month are free, then each additional onchain transaction costs $0.001", and "Payment verification is always free". The multiple of the price of a thousand tokens of Haiku is computed here from Anthropic's published price.
  211. Primary, the developers' own statements. OpenAI, "GPT-5.6 System Card", deploymentsafety.openai.com/gpt-5-6, 9 July 2026, read 30 October 2026, in these words: "Under our Preparedness Framework, we are treating Sol, Terra and Luna as High capability in both Cybersecurity and Biological and Chemical risk", and "These models are a meaningful step up in cybersecurity capability, but they do not reach our risk framework's highest level (Critical)". Anthropic, "System Card: Claude Fable 5 & Claude Mythos 5", assets.claude.com/57a52ea7d8f0e54e8a542e908266086df425cdf5.pdf, 9 June 2026, section 3.1.1, read 30 October 2026, in these words: "The FCF evaluates the cyber offense risk posed by a new model based on two risk tiers", the first being "meaningful technical assistance for active cyber operations using known attack techniques and methodologies" and the second to "conduct cyber operations completely and autonomously, with novel offensive capability development and adaptive persistence", and of Mythos 5, "Nevertheless, the model still falls within the lower category of risk set out in our Frontier Compliance Framework". Anthropic, transparency page, www.anthropic.com/transparency, read 30 October 2026: "As we have documented previously, Mythos 5 has capabilities in areas like cybersecurity and biology that exceed the safety thresholds we set for ourselves." Anthropic, "System Card: Claude Opus 4.7", assets.claude.com/037f06850df7fbe871e206dad004c3db5fd50340.pdf, 16 April 2026, read 30 October 2026 through its executive summary and the whole of its cyber section, neither of which states a tier. OpenAI's posts of 21 July and 26 August 2026 and its technical report state no Preparedness level for IM1, and Anthropic's posts of 30 July and 9 September 2026 state none for its internal research model.
  212. Primary. Anthropic, "Investigating unintended model actions in our evaluations and internal use", anthropic.com/research/investigating-unintended-model-actions, published 9 October 2026 and modified 12 October 2026 with a correction, read at source 15 October 2026, for the four categories quoted, for the statements that the cases "had minimal real-world impact" and are "significantly less severe from an alignment and security perspective" than Anthropic's incidents of 30 July and 9 September 2026, for the marking of that severity judgement as preliminary, and for the measures taken, including the extension of the internet-access restriction to all internal evaluations. - - -

Read more