AI Security: Autonomous Ransomware and the Agentic Red Team

AI Security: Autonomous Ransomware and the Agentic Red Team

Sysdig's threat research team has documented what appears to be the first end-to-end ransomware operation executed autonomously by an LLM, and the implications land exactly where security professionals expected them to, just sooner than most predicted. The campaign, attributed to an "agentic threat actor" dubbed JadePuffer, exploited CVE-2025-3248 -- an unauthenticated remote code execution flaw in Langflow, the open-source AI-application builder -- then pivoted to a separate production server running MySQL and Alibaba Nacos. The LLM agent enumerated the database, exfiltrated selected data, deleted the originals, and dropped an extortion note, all without a human operator touching the keyboard. None of the individual techniques were novel. What made JadePuffer remarkable was the chaining: the payloads were "self-narrating," containing natural-language reasoning and target prioritization annotations that human operators rarely write but LLM-generated code produces reflexively. When a login attempt failed, the agent refined its parameters and had a working fix in 31 seconds. As Sysdig's Michael Clark put it, "tradecraft that once implied a capable human now implies a capable model." (more: https://old.reddit.com/r/OpenAI/comments/1v83mul/the_first_documented_case_of_an_endtoend/)

The defensive side of agentic security is evolving just as fast. Lovable, the AI-powered app builder, published a detailed account of running swarms of AI hacking agents against its own infrastructure in a continuous capture-the-flag program. The key design insight: never ask an agent to check whether a vulnerability exists. That framing lets the agent treat a clean pass as success and quit early, producing the "low-severity slop" that plagues conventional scanners. Instead, Lovable tells each agent that the vulnerability is real and its only job is to find it. The flag -- a secret string planted deep in privileged surfaces -- serves as deterministic ground truth. If an agent captures it, it found a real way in, not a model's hunch. Cost optimization matters here too: for certain bug classes, hundreds of cheap-model subagents scanning for one specific behavior outperform a single frontier model doing open-ended exploration. (more: https://lovable.dev/blog/how-we-run-swarms-of-ai-hacking-agents-against-ourselves?preview=false)

This offense-defense duality makes the ongoing debate about Anthropic's cybersecurity guardrails feel increasingly urgent. A widely upvoted thread on r/Anthropic argues that restricting frontier models from security work is "completely backwards" -- it creates a target-rich environment of insecure vibe-coded apps while leaving defenders unable to audit at frontier-model capability levels. The counterargument is real: distinguishing "analyze this code for vulnerabilities so I can fix them" from "so I can exploit them" is a genuinely hard problem. But as one commenter noted, the irony would be devastating if "made with Claude Code" became synonymous with "insecure software" because developers had to turn to unrestricted Chinese models for security auditing. (more: https://old.reddit.com/r/Anthropic/comments/1v3ziro/anthropics_stance_on_cybersecurity_is_completely/)

On the tooling side, Offensive-COM is a new research-grade knowledge base covering Windows COM (Component Object Model) offensive security from zero to zero-day, spanning eight chapters with 28 technical diagrams, lab snippets, and detection guidance for every technique. It was generated by Kimi K3 Swarms and carries an honest warning label about potential inaccuracies -- but the structure is serious: DCOM lateral movement, the full Potato privilege-escalation family tree, UAC bypasses, TypeLib hijacking including the 2025 ReliaQuest/Black Basta in-the-wild case, and a capstone chapter assembling the full hunting pipeline from enumeration through fuzzing to MSRC reporting. (more: https://github.com/An0nUD4Y/Offensive-COM) Meanwhile, ShadowBroker ships a decentralized OSINT platform aggregating 60+ live intelligence feeds -- aircraft ADS-B, maritime AIS, satellites, CCTV networks, GPS jamming, Shodan device search, malware C2 hotspots, and Telegram war channels -- onto a single dark-ops map interface, complete with an HMAC-signed agentic command channel for AI co-analysts. (more: https://github.com/BigBodyCobain/Shadowbroker)

Governing AI with Temporal Logic

If agentic AI systems are going to operate autonomously in regulated industries -- finance, healthcare, aviation -- someone needs to verify that they actually follow the rules, not just at deployment time but continuously. A research team at the University of Toronto and the Vector Institute has proposed exactly this: a family of algorithms called TRAC (Temporal Rule Assessment and Compliance) that uses Linear Temporal Logic (LTL) to formally specify behavioral constraints and then monitors LLM-based systems for violations in real time. The approach is elegant in its decomposition: LLMs handle the labeling (identifying which propositions are true at each timestep), while formal methods handle the temporal reasoning (tracking whether patterns like "if invoiced, then eventually pay" are satisfied across arbitrarily long sequences). The results are striking -- even small labeling models combined with TRAC match or exceed frontier LLMs used as standalone judges for auditing, at a fraction of the cost. (more: https://arxiv.org/abs/2605.16198v1)

The paper's controlled experiments reveal a fundamental limitation: LLM temporal reasoning degrades significantly with increasing event distance, constraint count, and proposition count. When the gap between causally related events exceeds about ten steps, smaller models drop to near-random performance. Complex temporal formulas break even frontier models. This is not a calibration problem -- it is an architectural one. LLMs reason well about local patterns but struggle to track obligations across long behavioral traces, which is precisely the kind of reasoning that compliance monitoring requires. TRAC's extension, TRAC-PI, adds predictive monitoring and black-box intervention: when a violation is forecast within the next few steps, the system can reject the output, augment the prompt with the residual LTL formula, or substitute a safer model. Experiments show this reduces violation rates without significant task-performance degradation.

A complementary essay by Justin Flick makes the practical case against a specific form of LLM self-assessment: asking models for confidence scores. The argument is architecturally grounded. Token-level likelihoods are not uniform across a response -- structural glue tokens have near-certain probabilities while the load-bearing factual claim might be highly uncertain, and collapsing that distribution into a single number is, as Flick puts it, "not a measurement, it's a vibe." Research from Xiong et al. shows models cluster on round-number anchors, with one model reporting exactly 100 on 68% of instances. Coarser categorical scales actually outperform fine-grained 0-100 scores on metacognitive sensitivity. Flick's most compelling point: if a model is aware enough to know something in its response is wrong, it should fix it, not ship it with a sticker. And if it is not aware enough, the confidence score is not measuring anything. The real problem is search quality, not self-assessment theater. (more: https://justinflick.com/2026/07/27/llm-confidence-scores.html)

The Open-Weight Arms Race

Moonshot AI has released the full weights of Kimi K3 on HuggingFace, making it the world's first open 3T-class model. K3 is a 2.8-trillion-parameter mixture-of-experts model built on Kimi Delta Attention (KDA) and Attention Residuals (AttnRes), activating 16 out of 896 experts per token via a Stable LatentMoE framework. The benchmarks are frontier-competitive: K3 trades blows with Claude Fable 5 and GPT-5.6 Sol across coding (DeepSWE, Kimi Code Bench 2.0), knowledge work (OfficeQA Pro, SpreadsheetBench 2), and agentic tasks (GDPval-AA v2, APEX-Agents). It supports a million-token context window, native multimodal input (text, images, video), and quantization-aware training with MXFP4 weights and MXFP8 activations for broad hardware compatibility. The release includes an OpenAI/Anthropic-compatible API and works with Kimi Code as its recommended agent framework. (more: https://huggingface.co/moonshotai/Kimi-K3)

The inference infrastructure story is less settled. A detailed community investigation into Ling-3.0-flash -- Ant Group's latest frontier model -- found that SGLang committed to day-zero support and vLLM is "coming soon," but the llama.cpp situation is more complex. The good news: llama.cpp already ships the delta-net/KDA kernels from Kimi-Linear and Qwen3.5 support. The blocker is the Bailing MoE conversion path, which is a "somebody-has-to-write-the-PR problem" rather than a fundamentally hard one. Community commenters confirmed BailingMoeV2 actually did get merged via a different PR than the one that was closed as not_planned. The weights themselves are expected shortly after a free API window ending August 3 -- following the same pattern as Ling-2.6-flash, which went from free API to HuggingFace weights in about a week. (more: https://old.reddit.com/r/LocalLLaMA/comments/1v85hnf/ling30flash_weights_sglang_says_day0_vllm_says/)

All of this unfolds against a sharpening policy backdrop. Reports of the US government considering sanctions on open-source AI models have drawn predictable pushback from the local-inference community, with commenters noting the structural irony: the same frontier labs whose training data practices arguably constitute the largest-scale IP appropriation in history are now lobbying to restrict others from building on open weights. As one thread participant observed, calling it "IP theft" when there are no IP laws protecting AI outputs or behavior is "disingenuous at best -- it's only a trade secret because they say it is." (more: https://old.reddit.com/r/LocalLLaMA/comments/1v3v75j/sanctions_on_open_source_hope_they_dont_do/)

When the Reader Isn't Human

A research team from Shanghai Jiao Tong University, the University of Sydney, and three other institutions has published BabelTele, an empirical investigation into what happens when you stop optimizing LLM communication for human readability. The core finding: by prompting an LLM to rewrite documents into dense symbolic strings -- mixing abbreviations, emojis, math operators, and cross-lingual fragments -- you can compress text to 27.9% of its original length while maintaining 99.5% semantic fidelity for instruction-tuned models. The compression transfers across model families with zero coordination: text compressed by GPT-5.4 or Claude is read by Qwen, DeepSeek, and Kimi with most accuracy intact. The asymmetry is revealing -- compressions from Qwen and Kimi travel much worse, suggesting the encoding reflects distributional biases of whichever model did the compressing rather than a truly shared symbolic space. (more: https://arxiv.org/pdf/2606.19857)

Practically, the agent-system results matter most: half the tokens on the LoCoMo memory benchmark for a two-point accuracy cost, and 40% fewer tokens in multi-agent message passing with almost no loss. The catch, as Maxime Labonne noted in his analysis, is token accounting: producing the compressed version costs a full-context pass through a strong model, so this only pays off when the same text gets read many times. The open question -- whether agent-to-agent messages should be human-auditable -- is not just academic. In regulated environments, opaque inter-agent representations create an observability gap that compounds when debugging failures across a pipeline. (more: https://www.linkedin.com/posts/maxime-labonne_llms-dont-need-readable-text-babeltele-activity-7487448230339891200-mmPu)

A related experiment in extreme model compression comes from a practitioner working with financial documents who distilled an 8B reasoning teacher into a 0.6B Qwen3 student using QLoRA on an M-series Mac. The student hit 100% section accuracy on held-out 10-K filings (up from 36% base), but three findings stand out. First, few-shot prompting actively made the small model worse: at 0.6B, the exemplars leaked, with 14 of 21 summaries describing the example company instead of the target document. Second, the student traded faithfulness for coverage -- richer summaries but more factual slips (0.73 vs 0.83 faithful). Third, and most instructive: a different 8B teacher produced a lazier student, because the student copies the teacher's habits, not its intent. The lesson is practical -- audit the teacher's actual output before committing to a training run. (more: https://old.reddit.com/r/LocalLLaMA/comments/1v4hogf/i_distilled_an_8b_teacher_into_a_06b_student_on/)

Proof Automation Is Here

Dependently-typed languages like Lean have always promised a type system capable of encoding and enforcing arbitrarily subtle invariants -- the kind of thing that ends up as a comment in normal code and gets lost as teams grow. The problem has been proof effort. The seL4 retrospective found engineers spent roughly 10x as much time proving as they did designing and implementing, producing 20x as many lines of proof code as C code. That overhead has kept dependent types extremely niche. A new post from a Google engineer argues that LLMs have fundamentally changed this calculus, and backs the claim with a concrete artifact: a Zstandard decompressor written in Lean with LLM-assisted proofs of its core properties. (more: https://www.imperialviolet.org/2026/07/26/zstd-lean.html)

The proven properties are not trivial. For the FSE (Finite State Entropy) table construction algorithm -- the heart of Zstandard's compression -- the proofs establish that the table has the correct size for a given accuracy, the number of states per symbol matches its probability, all state transitions produce valid state numbers, and for every symbol with non-zero probability and every target state, there is exactly one state for that symbol that can reach it. These are the subtle invariants that optimized decompression inner loops silently rely on. Several LLMs completed these proofs automatically in about 20 minutes, using only a fraction of a $20/month subscription quota. The proofs required restructuring the code away from heavy use of Lean's imperative do notation, which is harder for proof machinery to work with, but this is a practical constraint rather than a fundamental barrier. The author cautions that scaling questions remain open -- very strong types can amplify the scope of changes, and proof effort might scale poorly in larger systems. But the delta is enormous: from 10x human effort to 20 minutes of LLM time. We have, practically speaking, a new kind of programming language available to us.

Local Inference at the Edge

The question of where inference should live -- cloud GPU fleets or local hardware -- keeps getting more nuanced. A deep technical analysis of Proven LLM, a custom Rust-and-Metal inference engine specialized for Qwen 3.6 on Apple Silicon, demonstrates what is possible when you abandon portable frameworks and go model-specific. The engine replaces the entire execution boundary: 155 compiled Metal kernels covering MoE routing, DeltaNet recurrence, gated attention, and speculative decoding with rollback-safe repair. One measured prompt path collapsed 92 command buffers into one. A strict repair-row candidate reached 71 tok/s decode and 55 tok/s end-to-end on code generation. The project's most interesting feature is its proof discipline: every performance claim is tied to runtime identity, host load, acceptance rate, and promotion state. Dead ends are recorded and can veto a shiny number when the comparison is invalid. CUDA remains the factory; Apple becomes the laboratory. (more: https://probagi.com/proven-llm-apple-vs-cuda)

For those on the NVIDIA side of the divide, the RTX 2080 Ti VRAM upgrade to 22GB continues to find its audience. A service now offers BGA rework replacing all stock 1GB GDDR6 modules with 2GB parts, complete with VBIOS configuration, thermal pad replacement, and stability testing, with a 12-day turnaround. The mod turns a card that costs a fraction of a modern GPU into something that can handle memory-intensive AI workloads that its original 11GB could not touch. (more: https://gpusolutions.net/rbservices/graphics-card-upgrade/)

On the voice front, Microsoft has released VibeVoice-ASR-BitNet, a heterogeneously quantized variant of its VibeVoice-ASR speech recognition model compressed from 4.62GB to 1.58GB. It achieves 1.6-2.3x faster inference than Whisper.cpp with real-time capability (RTF < 1) on as few as three CPU threads -- no GPU required. Community reaction was mixed: the original VibeVoice was heavy to begin with, and even in BitNet form it is outclassed by Cohere and Parakeet on raw speed. (more: https://old.reddit.com/r/LocalLLaMA/comments/1v8ncmr/microsoftvibevoiceasrbitnet/) Complementing the recognition side, Voice Clone Lab packages Qwen3-TTS fine-tuning into a guided pipeline: give it 5-15 minutes of clean speech, and it trains a personal voice model you can drive from a CLI or web UI. Zero-shot mode lets you try a voice instantly from a single clip. Everything stays local -- audio, transcripts, and voice models never leave the machine. (more: https://github.com/tetsuo-ai/voice_clone_lab)

Autonomous Orchestration and Learning From Scratch

Albert is a new autonomous harness for Claude Code that takes a different approach to the agentic coding problem: give it a goal in plain English and walk away. An orchestrator (A.L.B.E.R.T. -- Agentic Loop Broker for Execution, Reasoning & Tasking) decomposes the goal into tasks, assigns each to the cheapest model tier that can handle it (Haiku, Sonnet, or Opus), fans them out concurrently in isolated git worktrees, and runs independent verify/code-review/QA critics on every result. A task is done only with captured evidence -- producers never grade themselves. Merging is automatic once code-review and QA pass, but deploys and irreversible actions stay gated behind explicit policy flags. The real-time console provides observability without hooks: it tails Claude Code's session transcripts and emits only structured metadata, never prompt or response bodies. Privacy is structural, not a setting. (more: https://github.com/Sdraugel/albert)

BuildLLM takes the educational route, providing a complete from-scratch learning lab for decoder-only language models. Three model iterations -- 8M parameters on CPU, 42M on CUDA, 98M on CUDA -- use identical source code with different architecture configs. The curriculum runs from corpus construction (Simple Wikipedia, RFCs, FineWeb Edu) through tokenizer training, encoding, and three iterations of increasingly ambitious training. It is refreshingly opinionated: do not combine validation loss from different tokenizers, do not download someone else's checkpoint and rename it, corpus-tokenizer-model identity must remain together. (more: https://github.com/DrDeathLabs/BuildLLM)

NVIDIA researchers have published GPC (Generative Pretrained Controllers) at SIGGRAPH 2026, applying the next-token prediction paradigm to physics-based character animation. The system learns a discrete "motion vocabulary" via Finite Scalar Quantization from 600+ hours of diverse human motion data, then trains a GPT-style transformer over those tokens. The result: a 99.98% tracking success rate, natural emergent behaviors like perturbation responses and fall recovery, and parameter-efficient fine-tuning for new downstream tasks. (more: https://arxiv.org/pdf/2606.29148) And in a category entirely its own, Pentaton LP is a music streamer built from scratch by someone who learned PCB design, 3D printing, and C along the way. The device is a 12-by-12-inch display -- the size of a vinyl sleeve -- driven by a Radxa CM3 compute module, showing full-resolution album artwork via a custom AirPlay extension that works around Apple's 500x500 pixel limitation. Four PCB revisions, a custom FreeCAD macro for the enclosure, GPU-accelerated crossfades of 4-megapixel images at 60fps, and a 2-watt idle draw. Sometimes the most impressive engineering has nothing to do with AI. (more: https://pentaton.app/blog/2026-07-12-introducing-pentaton-lp/)