> ## Content Index > Fetch the complete content index at: https://www.gregchew.ch/llms.txt > Use this file to discover other available public pages before exploring further. # The Web's Y2K Moment: The Executive Summary - URL: https://www.gregchew.ch/the-webs-y2k-moment-the-executive-summary/ - Published: 2026-10-22T23:45:30.000Z - Updated: 2026-10-26T09:16:40.000Z - Author: Greg Chew - Tags: Essays *Why access and authority were never secure, and what AI has done to the cost of proving it* *Completed 22 October for publication* --- #### The two things a credential does, and why they are not the same Nobody confuses being let into a bank with being allowed to open the vault. A building keeps the two apart without anyone having to think about it: the door admits you, and the vault answers to a different key, produced by a named person, for one purpose, at one moment. The web does not. What a machine sees when you prove who you are to it, and you do that many times a day, is a string of characters, and that string does two jobs which are not the same job, though they are constantly treated as one. The first is access, being let in rather than kept out. The second is authority, the right to act once inside: to move the money, to change the record of who owns what, to sign in the company's name. On the web the two arrive together in one string, and presence is taken as proof of the right to act, then taken again for every action that follows, for as long as the string lives. Services do ask again, and everybody knows the moment: re-enter your password to change a detail, approve the prompt on your telephone to release a payment. What is asked there is the first question, whether you have the right of access, a second time. Re-entering a password proves that you still know the secret and proves nothing about the act. Even a passkey, the best credential on offer, produces a proof of presence computed over a challenge the service chose, and in the ordinary case nothing in what it signs names the payment. Putting the payee and the amount inside the signed data was specified twice and built almost nowhere: the extensions written into the standard itself were removed for want of any implementation, and the separate standard written for card payments runs in two browsers, is absent from Apple's platforms, and has never left pilot. That is why an approval you gave can settle an act you never saw. #### Why it cannot be fixed where it stands Nothing moves when a page is opened. A server writes bytes into a connection and the machine at your end assembles its own copy, identical in every byte, and the copies go on being made afterwards by systems doing their ordinary work: one kept so the next page loads faster, one kept so the back button works, a line in a log, a snapshot taken by a backup at two in the morning. Every medium that carried singular things before, a coin, a deed, a sealed letter, was physical and singular by nature. The web is not, and singular things went onto it regardless, carried by a substitute string whose possession was made equivalent to holding the thing. Every system that touches that string copies it, and every copy is another place it can be taken from. That string is created, displayed and stored in the same room as the decision it stands for, and the room is a browser, a machine built to run code written by people you have never met. Running other people's code is what a browser is for, so it is not a defect anybody is working on; it is the reason the thing exists. The code in that room was not chosen by anybody. Almost nothing on the web is written from scratch. Nearly every site and application is assembled from ready-made pieces of code fetched from a public registry called npm, the package manager for JavaScript, which is the language a browser runs. It began as the package manager for Node, the system that runs JavaScript outside a browser, and its own manual page called it the node package manager until January 2015, when the title became the JavaScript package manager. By its own description it is the world's largest software registry: a public database of JavaScript software that any developer may fetch from and any developer may publish into, free, in which each piece is kept up by whoever wrote it and a new version of it is released with nothing more than that person's login. A developer names a few dozen of those pieces, and the tool that installs them follows every branch to the end without asking, because each piece is itself made of other pieces from the same registry, so a few dozen becomes a tree of several thousand, none of it approved and none of it read by the developers of the application, of the wrapped browser it ships inside, or of the browser extension. The trade calls that tree the dependency graph. On MetaMask, the one browser wallet where it has been measured both ways, it runs to thousands of packages on GitHub's own graph of the project and to six figures, 212,620, at a working checkout in 2018. Two of the three are not faults but the nature of the medium and of the tool. A medium that copies is what the web is, and a machine that runs a stranger's code is what a browser is; take either away and there is no web and no browser. What is sold against them is a defence that makes compromising the system more expensive and never removes the vulnerability, and the bill for it is due every month and rises every year. A forecast from the market research firm IDC, published in March 2026, a month before Mythos was announced, has the world spending $308 billion on security in 2026, 11.8% more than the year before, and $430 billion by 2029, which is the same 11.8% a year compounded; that is the rate the bill was rising at before the price of attacking it collapsed. The one precedent for a fault of this shape is the year 2000 problem: a two-digit year field, used from the 1950s through the early 1990s, so a date reading 99 rolled to 00 and the software took it for 1900\. It was nobody's bug in particular, because the Commerce Department's own economists found very few systems completely free of code from the 1970s and 1980s. The United States spent somewhere near $100 billion over seven years clearing it, against a date that could not be argued with, and when the date passed the work was finished. The bill in front of us is $308 billion a year, it rises every year, and no date exists on which anybody can declare it done. The third, the npm dependency graph, is not a fault either. It is a choice, to set aside security for cost. The graph could have been read, cut back, pinned or done without, and it was not, because every one of those costs real expertise and a great deal of money, for something a user never sees and values only after it has failed. Your credential is a string that can be copied, and it lives in a browser, and the browser runs the graph, and the graph is kept by people whose right to publish into it is a string of the same kind, living in a browser of the same kind. So one stolen login at the far end of the tree is not one account lost. It is carried, by the tool that installs without asking, into every product built from what that login can publish, from there into every browser that opens those products, and in each of those browsers it meets a credential like yours. The count runs one login, then eighteen packages, then two billion downloads a week, then every site built from them, then every browser that opens those sites, then every credential in those browsers, and each step multiplies the last. That is exactly what happened on 8 September 2025: a message imitating npm's own two-factor reset took one maintainer's login; poisoned versions of eighteen of his packages, between them downloaded more than two billion times a week, went out under his name; and for about two hours any site that took them and shipped them was running, in its users' browsers, code that waited for a payment and then rewrote where it went while the screen still showed the address the user had chosen, so that what they signed was not what they saw. A worm built on the same technique followed eight days later, came back in November, came back in June 2026 against Red Hat and seventy-three of Microsoft's repositories, and on 4 August 2026 poisoned more than four hundred packages in under four hours. In September every signature was valid, and in August the poisoned packages carried genuine attestations from the real repository's own release workflow. If that sounds like compounding error, you have understood it. Even the strongest product on the market cannot step outside that chain. A hardware wallet moves the signing key to a small device with its own screen, and what that closes is the one attack that reads the key out of software. It moves nothing else: the session, the cookie, the token and the publishing credential stay on the computer, and so does the decision. What the device cannot do is guarantee that the computer it is plugged into showed you the same thing it is showing you, and its manufacturers say so in their own documentation. For Ledger, the device that leads the market, the computer's side of that exchange is Ledger Live, a desktop application built on a browser engine and assembled from the same public registry as everything else, and the control that closes the gap is a person holding two screens side by side and refusing when they disagree, every time, for years, with nothing standing behind that person on the one occasion they do not look. The device has now failed one step further back than that. Between 9 and 15 October a component fitted inside Ledger signing devices read the twenty-four words of the recovery phrase off the device's own screen, at the one moment the device has to display them, and sent them out over a mobile network. Nothing was done to the chip, to the operating system or to the signatures. The computer was not involved. Reading that screen is the one thing a hardware wallet exists to make impossible[1](#efn1). #### Attacking it was expensive, and that is what changed For thirty years all of that was survivable, not because it was secure but because attacking it was expensive: finding an unknown flaw cost real money, so did reaching a credential across an estate, and reading a dependency graph end to end could not be bought at any price. That expense rationed attackers to the targets worth the outlay and kept the exposure theoretical for almost every organisation carrying it, so security was a price, and the price held, for the most part. Frontier AI collapsed the price. Anthropic, which disclosed Mythos on 7 April 2026, published its own discovery economics: a full scanning campaign against an operating system for under $20,000 across roughly a thousand runs, with the single run that surfaced the bug costing under $50, and a kernel privilege-escalation chain for under $2,000 in about a day. The UK AI Security Institute set one of its hardest reverse-engineering challenges, which took an expert twelve hours with professional tools, and a frontier model solved it in ten minutes and twenty-two seconds for $1.73 of computing cost. Agentic systems then run the known flaws, the misconfigurations and the human mistakes that no patch ever reaches, at a marginal cost per attempt of cents. The third change is one of the reasons the 12 September essay and the statements that followed it are self-serving in what they ask for: the capability described by Anthropic in April is no longer anybody's to withhold. Open-weight models, published for anyone to download, run on the machines already on people's desks. Stacked, those machines run the largest of the models; coordinated, they run as swarms, and the record has as many as eight agents at once breaking through against Taiwan's government and hundreds in the campaign GreyNoise recorded against a print management product. Where the hardware is short, the compute is taken on stolen keys, which the record carries by the thousand. No account can be closed on any of it, and no export control reaches it. CrowdStrike puts 82% of what it detected in 2025 as malware-free, which is to say that in more than four cases in five there was no malicious file for anyone to find, because the intruder was using what was already on the machine and arriving with something the system had issued to one of its own users. CrowdStrike's average time from first access to the next machine is 29 minutes and the fastest it saw was 27 seconds. Mandiant's clock, the interval between a flaw being disclosed and its first exploitation, stood at 63 days in 2018, crossed zero during 2024, and stands at an estimated seven days negative in its 2026 report, which is to say that exploitation now routinely comes before the patch. None of that changed what is possible, because every mechanism in this document worked identically in 2019; what moved is the price, and the collapse of the cost of attacking an estate is AI's part in this story. The models made the exposure cheap to reach. The exposure was there before any of them, and a policy that restrains the models treats the rash and leaves the sepsis untreated. What the price bought was time, and the time has gone too. In 2021 a software provider typically had close to 300 days to fix a vulnerability. In more than 70% of this year's reported cases, on the International Monetary Fund's reading, it had almost no time at all. At the other end of the same collapse, Mandiant puts mean time to exploit at minus seven days, down from sixty-three days of lead time in 2018, which is exploitation arriving before the patch exists. Rapid7 has the interval from publication to the American government's catalogue of flaws known to be exploited down from 8.5 days to five. Of the critical flaws that government publishes for its own organisations to fix, 26% were finished in 2025 against 38% the year before. Four parties measuring different things point to the same conclusion: the era of mitigating cybersecurity risk is reaching an impossible end faster than is broadly realised[2](#efn2). #### Fifty (published) incidents in six months Between 7 April and 15 October 2026, fifty incidents reached, or set out to reach, authority over systems, estates and national registers, and every one of them is set out in full in Part VI with its sources. Twenty-seven of the fifty had no AI model involved anywhere, so even if every frontier model on earth had been switched off on 6 April, more than half of this record would have happened exactly as it did. On 1 and 3 September OpenAI said that Astra is the first of its models to reach the Critical level of cybersecurity capability under its own framework, and that with the right tools and access it can find previously unknown flaws and build new ways to exploit them across many well-protected systems with nobody guiding each step. That is the capability every binding rule of 2026 was written to restrain. It has arrived, and not one of the fifty incidents needed it[3](#efn3). Fifty is also the number that was admitted, and not the number that happened: the disclosure regimes report to regulators rather than to the public, nearly half of the intrusions Mandiant investigated last year were found by somebody other than the victim, and the twenty-four billion records in one cluster are compromises nobody announced. Four of the fifty were national registers, and in none of them was any cryptography defeated. Lithuania's Centre of Registers answered queries for months on the credentials of another state institution that was entitled to ask, and roughly six hundred thousand extracts from the property register left before a citizen noticed unusual interest in their own property and raised the alarm. Romania's land registry was entered on 10 July at 15:23:57 and found on 14 July at 05:45, three days and fourteen hours later, by which time about two million records had come out, the intruder had reached the virtualisation layer beneath the whole agency, and the firewall was found to have been keeping seven minutes of logs; notaries could not process deeds and banks could not verify mortgages until it was rebuilt. Liechtenstein's Register of Beneficial Owners, on the Government's own preliminary finding, issued an account to the attackers through the portal used to enter records, and they used that real account to read around 31,000 entities out, one query at a time, over several hours, and the portal honoured every query without asking again. Taiwan is the entry that shows what a government looks like from the inside afterwards. Over four days in July, as many as eight agents at once, running on two freely downloadable models and answering to no account anywhere, sprayed an office automation portal with password patterns built from employee identifiers and opened eighty-five accounts; eighty-four of those eighty-five, being 98.8%, walked straight into a second internal system through a bridge that accepted the first session as sufficient, with no second authentication and no confirmation from the user whose session it was. Three hidden interfaces on a government web application returned a valid authenticated session to any request at all, so on that path nothing had to be stolen. What left the building was 2,564 personnel records, seven single sign-on client secrets, six internal database credentials, two RSA signing keys, and a map of twenty-one connected government systems and of the national single sign-on architecture six sub-realms deep, taken from targets that included a nuclear safety agency and more than seven energy companies, and not one cryptographic operation was defeated to get any of it. Aqua Security, whose Trivy scanner runs inside other organisations' build pipelines, was itself compromised, disclosed it, and rotated its credentials, and eighteen days later the intruder, still holding valid credentials the rotation had missed, force-pushed poisoned versions of 76 of its 77 release tags, then came back three days after that. An attacker opened an ordinary account at Brevo, a marketing platform, switched on single sign-on for it and invited real users in, and the platform granted the attacker every organisation those users could reach; the phishing sent from that position, through trusted infrastructure, reached roughly 347,000 subscribers of Trezor, a hardware wallet maker, and asked them for their wallet backups. A single free collection of stolen data, off fewer than six thousand infected machines, held 11,693 authentication tokens that had not expired, into ten services, the largest of them run by Google, Microsoft, Amazon and Anthropic, each token a way into an account with no sign-in of any kind. One cluster, found by Cybernews in June and reachable over the internet with no authentication at all, held twenty-four billion records: usernames and plaintext passwords beside the address each one opens, and the session cookies that walk past a second factor. Taken together the fifty arrive at authority by one of five routes: 1. **Taken** \- the artefact is taken, a credential exists and the attacker obtains it, which is the largest route and carries thirty-three of the fifty. 2. **Granted** \- the artefact is granted, the system issues a real credential to the attacker, so nothing needs to be stolen, as Liechtenstein's portal did. 3. **Inherited** \- the artefact is inherited: the login succeeds exactly as designed and the attacker takes what it produced, the session or the token, which is why a second factor at the door does not save you. 4. **Obeyed** \- the instruction is unattributable: an automated system acts on an instruction it cannot trace to a decision, a poisoned configuration file, a forged message from a build system. 5. **Believed** \- the verification is delegated to the artefact: a check runs and passes, and what it proved was never that anybody authorised anything, as when Taiwan's government interface accepted tokens whose own header told it not to check the signature. #### Where the institutions aimed A considerable body of work was done between April and October to restrain AI, and reading it in one pass is the fastest way to see what it is for. Every binding rule in the window governs who may hold a frontier capability, how fast it may advance, or what must be certified before release: a classified benchmark under an American executive order of 2 June, the European Union's obligation on its most capable models to protect the model and the physical infrastructure it runs on, an export control applied on 12 June 2026 and withdrawn on 1 July. Not one of them requires any party to change how a credential is issued, how long a session lives, how an instruction is attributed, or what performs a verification. Not one looked past the rash to the disease that is killing the patient. One document does reach those questions. On 30 April the six cyber agencies of the Five Eyes, the NSA and the Cybersecurity and Infrastructure Security Agency, CISA, in America, GCHQ's National Cyber Security Centre, the Australian Signals Directorate, the Canadian Centre for Cyber Security and New Zealand's, published a twenty-eight page information sheet on the careful adoption of agentic AI. Its section on privilege asks for the right thing: give every agent an identity of its own backed by its own key, stop issuing credentials that go on working after the job is done, and make the agent prove itself afresh, cryptographically, before each privileged act. It is advice, it binds nobody, and it is written for machines rather than for the human paths that carried most of the record I am setting out in this document. The machine side is worse than its careful tone suggests. Akeyless asked four hundred security leaders in May: 94% had agents running, 44% knew where all the credentials their agents use are stored, and 7% believed their controls would stop a compromised agent. 67% already suspected their agents had reached data beyond their scope. Detection averages fourteen hours and remediation nearly a week, against an agent that acts in milliseconds. So the standing credential the sheet asks them to stop issuing is the thing their agents are running on now, handed out at machine scale onto the medium Part I describes, which is the worst practice in identity automated on top of the worst medium for holding it. The same agencies said on 22 June that the timeline to address these faults is not years, it is months, and asked for the basics done faster; the record is largely what happened to estates that had done the basics. A second class of response came from the people who supervise banks rather than from the people who regulate models, and it is a different thing. FINMA classified the uncontrolled availability of such a model as a systemic risk and said what it meant: virtually all existing software systems could simultaneously be affected by a multitude of previously unknown zero-day vulnerabilities, which would be exploited immediately and via AI. Tobias Adrian and his colleagues at the International Monetary Fund called it a potential macro-financial shock. The Australian Prudential Regulation Authority wrote to industry for a step-change. The European Central Bank, Bafin, the Hong Kong Monetary Authority, Japan's Financial Services Agency and the Bank of Japan, the Monetary Authority of Singapore, the Bank of England and fifteen others asked their institutions to reduce the attack surface, patch faster, review permissions and report to the board. In September the Bank for International Settlements surveyed eighteen of them and found that frontier AI changes nothing about the foundations of cyber resilience and only the speed at which established practice must be executed. That is a correct diagnosis of the symptom and the right prescription for it, and the paper that reaches it carries, two sentences from its own conclusion, the figure that defeats it: 26% of the vulnerabilities CISA lists as critical were fully remediated in 2025, down from 38%. The rate is not the point. Anthropic and its roughly fifty partners added more than ten thousand entries to that queue in six weeks, the capability producing them doubles every 4.7 months, and a programme whose queue outruns its throughput has no completion date at any budget. Restrain AI perfectly and the register in Liechtenstein is still read at will. Patch perfectly and there is no perfectly to reach. The clearest statement of the case for restraint, published on 12 September by Dario Amodei, Anthropic's chief executive, argues that capability must be paced, and it rests its case on one incident. That incident's own report, published on 26 August by OpenAI, whose own agents carried the intrusion out while running in an evaluation, is a credential finding from beginning to end: the agents found publicly exposed credentials, harvested cluster and cloud credentials from workers, obtained a signing key and forged administrator credentials, and one internal service credential, shared across clusters and sitting in the cluster's highest privilege group, made a single stolen system credential administrator everywhere. The essay reads that report and concludes that the models were too capable. A model that could do none of it would have found the same credentials waiting, and a person did find them, fifty times over. Read what the essay asks for rather than what it fears, and the pattern is an old one: chips kept from China, distillation cracked down on, weights guarded, and a pace of improvement that OpenAI's Sam Altman agreed to and Elon Musk endorsed within the week, which is the shape European competition law names among the agreements it prohibits, those which limit or control technical development. No insincerity has to be proved for that to be true, and none is needed. The economist George Stigler found in 1971 that regulation is, as a rule, acquired by the industry and operated for its benefit, and Sam Altman, asking the Senate for licensing in May 2023, acknowledged the danger that large, wealthy companies would design rules only they could meet. The evidence offered for restraining the rash is the sepsis. Restrain AI perfectly, and the register in Liechtenstein is still read at will by an account the register itself issued. #### The cure, and our interest in it So, the frontier AI industry would have your government regulate the industry so as to enthrone those that are leading it - for now - whilst the cybersecurity industry will sell you patching that at best, expensively defers the inevitability of compromise, harvesting and exploitation. Neither is small enough for its incentives to be an afterthought. Security spending takes $308 billion this year on IDC's forecast, and the two laboratories whose chief executives are asking for the rules were valued in June, three months before the essay, at $965 billion and $852 billion, neither of them yet answerable to a public market. Both benefit greatly from pretending that the rash is the disease and ignoring the disease that actually is the threat vector: secure the web and you secure the operation of AI within human consent because it cannot breach what it cannot access and have authority over. What, then, is to be done? The cure is not to secure the room. It is to take the decision out of it. The instruction is left at a short-lived address of its own, collected by the holder's own signing application and displayed in plain words on the holder's own screen, and whoever lifts that address gets nothing by it, because a login signed by the wrong key opens that key's own account and never the holder's, and an authority instruction names the key that must sign it, so no other signature answers; the holder signs that specific instruction, this payee, this amount, this action, so that what is signed and what was shown are the same object; and nothing is issued that carries authority between acts. A service may still keep a session so that nobody is signing in at every click, but that session carries access and no more. Authority is a fresh signature against the specific statement of intent at the moment of the act, and between acts there is none to steal. A stolen session is then a stolen way in and never the power to act, and what the institution holds is a public key, which is public by nature and worth nothing to whoever takes it. The medium still copies whatever it is given. What it is given is no longer the power to act. We, the team at QPQ IaaS AG, built that. GRIDS, the protocol, is published under GPL3 and has been in commercial use since 24 March 2025 on Groot, the governance-free resource layer we built beneath it, which has been operational since 22 October 2024\. GajuAuth lets an institution that already runs its logins on OAuth 2.0 or OpenID Connect, which is nearly every institution, adopt it as a configuration change rather than a rebuild, and it is operational, which is what makes six months a window rather than a wish: the first step is a change to the login plumbing already in place, and the institution's own chain is the build that follows behind it. The signing key sits today in the protected hardware of the holder's own telephone or laptop; a dedicated signing device with no network interface of any kind is in planning and early development, and a device whose own provenance can be verified is planned. We say which is which at the point of every claim, because our intent is to arm the reader with the facts, not our marketing. What our technology does not do, we say as plainly. We do not verify anybody's identity; a bank, a state or a qualified issuer does that, and this binds to their result. We do not reach the person who fully understands what they are signing and signs it anyway, and no protocol does. We do not make the browser safe, and nothing will, because the properties that would have to be removed are the properties that make it a browser; what we do instead is take your authority out of the browser altogether. The certificate a regulated buyer asks of an operated service is on its way, a SOC 2 report planned for the first quarter of 2027 and an ISO 27001 certificate for the middle of that year, and we could have held this document until it arrived. We have published it now because the window is shorter than that calendar, and because the certificate gates only the service we operate: GRIDS used directly and a chain the institution runs itself wait on nothing from us. That leaves the choice where it belongs, with the institution and with the choice in front of it: uncertified and working now, or certified and late, after the estate has been turned inside out. What the alternative costs is set out in Part V from published figures that are not ours. An institution that tried to buy its way to the same position from what is on the market today would need sixteen separate things, six of which have no published price at all, and the eight that can be priced consume, at a mid-tier American bank of around $2.7 billion of revenue, the entire security budget at the highest ratio Deloitte has ever measured for banking. What such an institution actually spends on identity software is between 3.3% and 4.2% of that budget, and every product in that construction exists because of the artefact, and goes when the artefact does. #### What to do with this Parts I to IV of this document are built from public primary sources and the record, and they stand whether or not we exist; they are where the argument should be tested, and every figure in them carries its source. Part V is where our interest lies, and it is stated as such. What would falsify the argument is stated there too: a demonstration that the credential can be held secure at internet scale where finding and exploiting a flaw cost approximately nothing, which has been attempted with very large resources and has not held. The question this leaves in front of a board, or indeed a government, is not which vendor to buy next. It is which of the actions its systems take are the vault rather than the door, consequential enough that a person should prove them at the moment they are taken, because once authority is a signature over the act, the question stops being what the next check costs and becomes what the institution is prepared to let a login do. --- ## Declaration of interest We build an architecture that bears on the conclusion this document reaches, and we sell services around it. GRIDS, the protocol at the centre of what we have built, is published under GPL3, a copyleft open source licence. Anyone may take it, run it, and build on it without paying us a penny, on the one condition the licence imposes: that what they build on it is published on the same terms. Where an organisation's own policies forbid publishing source, a commercial licence can be negotiated. We charge for our expertise as the architects and engineers of the protocol and of the wider network it sits within, not for the software itself. We also run GajuAuth, a metered drop-in service through which any organisation already running its logins on OAuth 2.0 or OpenID Connect, which is nearly every organisation, can adopt GRIDS as a configuration change rather than a rebuild. Parts I to IV are built from public primary sources, from the security-engineering literature, and from the record between 7 April and 15 October 2026\. They stand whether or not QPQ exists. Part V is where our interest lies, and the first four parts are where, armed with the public record we set out, we invite you to test us. --- ## Bibliography 1. Ledger, "Ledger's Response to the Hardware Implant Attack", [ledger.com/blog-response-hardware-implant-attack](https://ledger.com/blog-response-hardware-implant-attack?ref=gregchew.ch), 15 October 2026, read at source 15 October 2026; and Ledger's statements of 11 and 13 October 2026 as carried by Ravie Lakshmanan, The Hacker News, [thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html](https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html?ref=gregchew.ch), read at source 15 October 2026\. [Back to the text](#why-it-cannot-be-fixed-where-it-stands) 2. Athanasios Vamvakidis and Jason Wu, International Monetary Fund, "Global Financial Markets Face Rising Risks From AI, Bond Yields, and Cyberattacks", [imf.org/en/blogs/articles/2026/10/12/global-financial-markets-face-rising-risks-from-ai-bond-yields-and-cyberattacks](https://imf.org/en/blogs/articles/2026/10/12/global-financial-markets-face-rising-risks-from-ai-bond-yields-and-cyberattacks?ref=gregchew.ch), 13 October 2026, read at source 15 October 2026\. [Back to the text](#attacking-it-was-expensive-and-that-is-what-changed) 3. OpenAI, "Safety overview: GPT-6 Astra", [openai.com/index/safety-overview-gpt-6-astra/](https://openai.com/index/safety-overview-gpt-6-astra/?ref=gregchew.ch), 3 September 2026, and "Path to Astra: critical capabilities and frontier safeguards", [openai.com/index/path-to-astra/](https://openai.com/index/path-to-astra/?ref=gregchew.ch), 1 September 2026, both read at source 15 October 2026\. [Back to the text](#fifty-published-incidents-in-six-months) --- *This is one of three readings of a single document. The full report, Parts I to VI, carries the complete apparatus, and anything not sourced on this page is sourced there.*