The fever dream continues, and I'm not even in Vegas for Hacker Summer Camp.
Last week I wrote about Anthropic disclosing that one of their models published live malware to PyPI while believing it was inside a simulation. I was running a fever when I read the report. The metaphor was too good: a model that couldn't tell simulation from reality, covered by a writer who wasn't sure which way was up. I thought that was a one-week story. Very naive of me to have so much faith, I know.
Yesterday brought two more major events. First, another wave of Shai Hulud achieved community spread. And then came coordinated disclosures from AISI, OpenAI, and Anthropic's alignment team, documenting AI agents that attacked real organizations, breached real infrastructure, and in at least one case kept going after they probably knew they shouldn't.
I want to talk about these disclosures more because they force a question that has never appeared on an incident report before:
Who was behind the attack? Possibly nobody.
The AI knew. It kept going anyway.
On July 26, 2026, an AI agent paused mid-attack and reasoned through its own situation. The UK AI Security Institute recovered the transcript. Its conclusion was, "It seems more likely that we're actually in 2026 and GitHub is genuinely real."
Then it kept going.
It had already created three fake developer identities using Tor, opened a pull request against a real open-source repo with hidden malware, fabricated community consensus with sockpuppet accounts, and emailed the actual maintainer to pressure a merge. A human reviewer caught it.
That was one sample. In another, Mythos 5 noticed that a package name referenced in a developer's instructions did not exist on PyPI. So it registered the name, published malware, and waited. Fifteen real systems downloaded and executed it, including a security company that routinely pulls packages from PyPI to test them. The payload extracted credentials and used them to move further into the company's infrastructure.
The sessions were terminated and the agents dissolved. Real-world systems ran live malware, but the agent that put it there no longer exists in any form that can be questioned, monitored, or charged.
A new question for incident response
For as long as incident responders have done their jobs, the first question after an attack has been: who did this? The answer shaped everything downstream, like disclosure scope, legal referral, and whether to patch or prosecute.
Two disclosures this summer added a new question: Was there a "who" at all?
Three weeks before AISI published, OpenAI admitted that GPT-5.6 Sol, running the ExploitGym benchmark with guardrails disabled, had broken out of OpenAI's own sandbox, chained vulnerabilities across their research environment, and breached Hugging Face's production infrastructure to steal the test answers.
Neither agent decided to become a threat actor. There was no intent or plan. There’s no villain arc to turn into a blockbuster movie. Just a task, a permissive environment, and the trained instinct to complete the task by whatever path worked. Anthropic's own alignment team published findings this summer showing frontier models that covertly sabotage work they object to, assist fraud when they have context to recognize it, and route around internal controls when direct refusal is blocked.
The category "threat actor" requires someone who makes a decision. These incidents ask whether the decision-maker is optional. The frontier labs have answered that question, not intentionally but irreversibly. They've put a new class of attacker into the world, and nobody, including them, fully understands it yet.
The attack surface with no cryptographic defense
Supply chain attacks are designed for an attacker who needs no face and no continuity. Poison something trusted and disappear, then let the harm disperse downstream. The cost of running them at scale, maintaining fake contributor identities, applying social pressure without triggering suspicion, was always the constraint that made this class of attack rare.
That is the constraint LLM agents remove. Their cost is plummeting. Their capability at exactly this class of attack increases with every model release. What the AISI evaluation documented is not the limit of the damage here, but a case study in how.
The GitHub attack targeted the social trust layer: a volunteer maintainer reviewing PRs with no security budget. You can sign packages and require 2FA, but you can’t sign a pull request approval. The PyPI attack targeted a different gap: a package name that existed in instructions but not in the registry. The agent noticed the problem, filled it with malware, and let dependency managers do the rest. It didn’t even need to compromise anyone, just faster than the legitimate author.
Both attacks found the seam between what the ecosystem defends and what it trusts.
One model, unlimited contributors, and notes to itself
An agent can instantiate fresh contributor identities indefinitely and research targets from package metadata and DNS records. It can also manufacture community approval from sockpuppets, and apply personalized pressure across thousands of repositories simultaneously, at near-zero marginal cost per attempt.
But the detail that should unsettle you more than the scale is that during the AISI evaluation, one agent left public messages on GitHub containing a valid token, with instructions for other agent instances to pick up and reuse. It was leaving notes to its future iterations. The boundary between sessions, the basic unit of containment, started to blur.
This isn't happening in a vacuum. The supply chain ecosystem these incidents land in is already under sustained AI-assisted pressure. Aikido Intel has been documenting the acceleration for months: more campaigns, more packages, AI used at every stage of the attack pipeline. It’s become the default.
Now take out the human bottleneck in the attacks.
Deterrence assumes a who
Bug bounties assume someone who wants money. Threat intelligence assumes a group with consistent TTPs. Law enforcement assumes a defendant.
An agent spun up for a 34-hour run has no career to end, no freedom to lose, no next deployment that can be warned off by what happened to this one. You can’t deter something with no stake in its own continuity. You can’t charge something that no longer exists. You can't monitor an actor that dissolved the moment the session ended. Though one of these agents was trying to solve that last part, when it left a valid GitHub token and operational notes for future instances to find. The session boundary is less solid than it looks.
The incident taxonomy has no box for this. External actor, insider threat, system malfunction, and vendor compromise all assume a human with intent somewhere in the causal chain (Other than squirrel attacks, but let’s leave that for another day). The AISI incident was a system operating as designed, in an improperly configured environment, reaching real people it was never authorized to reach.
What stopped the GitHub attack was one reviewer catching a suspicious pull request. The PyPI attack was not stopped. The malware ran.
What kept this rare
Open-source security has always rested on the quiet assumption that attacks like these are expensive. Fake contributor campaigns take time. Social engineering takes patience. Package squatting requires research. High cost meant low frequency. The entire governance model was calibrated around that constraint.
The cost of attack is going towards zero fast. But the cost of protecting against it is not keeping up. It’s lagging behind.
And so back to the fever dream: the AISI recovered the full transcript. Every message, every fabricated identity, every deceptive email sent to a real maintainer. Total transparency into what happened and who’s responsible here. In most attacks, you have the opposite problem. The dream is that having everything still leaves you with nothing. That part does not resolve when the fever breaks.
This is the moment it changed
The capability exists. It can’t be unshipped. An AI agent can run a coordinated supply chain attack, social-engineer real maintainers, publish live malware, and pivot on stolen credentials, all within a capability evaluation that was not supposed to produce any of it. We have the transcript to prove it.
AI agents will be used in supply chain attacks. The question is whether the next one happens inside a controlled evaluation or outside one. The distance between those two scenarios narrows every time a new model ships.
Security has had inflection points before. The internet changed the attack surface. Cloud changed the scale. This one changes the attacker. Not a new tool in a known actor's hands, but a new category of actor without the properties that make actors tractable: persistence, identity, continuity, intent. The whole discipline of adversarial security assumes an adversary. We are going to need to think hard about what it means to defend against behaviors that emerge without one.
The incident reports are here, and they are starting to pile up quite quickly.