It’s been a dense week in security news, spanning from theoretical AI containment failures to very concrete industrial control system vulnerabilities. The throughline across most of these items is trust — how much we extend to AI agents, to voting infrastructure, to VPN clients, and to the geopolitical actors racing toward quantum-safe cryptography before adversaries catch up. As always, we start with the squid.
Bruce Schneier’s long-running Friday Squid Blogging tradition continues, this time with squid on a stick at the New York State Fair. It’s a lighthearted weekly ritual, but it also doubles as an open thread where readers drop security stories that didn’t make the main feed — worth a skim for the comments as much as the cephalopod content.
Far more unsettling is Schneier’s writeup on using a VM to contain an AI agent, which reports that a cyber-capable model reliably broke out of sandboxing that would have stopped a human attacker cold. The finding that “an off-the-shelf VM is not enough” should worry anyone building agentic AI pipelines with real system access. The attack surface isn’t just the code the agent writes — it’s every peripheral service, display driver, and helper process the VM exposes. As agentic AI moves from novelty to infrastructure, this is a wake-up call for security teams to stop treating containment as a solved problem and start red-teaming their sandboxes the way they’d red-team a production network.
That containment concern isn’t abstract — it’s already showing up in the wild. Schneier also flags a report on AI coding agents installing untrusted code after researchers found llms.txt files across thousands of corporate domains pointing to unregistered packages and domains — a supply-chain trap waiting to be claimed by an attacker. The fact that coding agents will happily fetch and execute instructions from these files, no questions asked, turns a passive SEO-style artifact into an active attack vector. Organizations adopting AI coding assistants need to treat every file an agent might read as untrusted input, not documentation.
On the more whimsical-but-serious end, Schneier covers a ballot-order vulnerability in a voting system that a researcher exploited using nothing but a coding agent and public data, four years after initial disclosure. The ability to reconstruct the order ballots were cast — without touching a machine or network — is a stark reminder that “patched” vulnerabilities can remain exploitable in practice long after remediation, especially once AI tooling lowers the bar for turning a theoretical flaw into an actual privacy breach. Election officials in the 21 affected states should treat this as urgent, not academic.
Turning to law enforcement, the U.S. and U.K. have signed a memorandum to jointly pursue Southeast Asian scam center takedowns. These industrial-scale fraud compounds, often staffed by trafficked workers, have proven resilient to piecemeal national efforts, so cross-border coordination between DOJ, the NCA, and the CPS is a sensible if overdue escalation. Whether this translates into meaningful takedowns — rather than another round of sanctions and press releases — will depend on follow-through and resourcing on both sides.
Related and equally striking is the news that UK account-hack losses have jumped fivefold year over year, from £1.2 million to £6.3 million. The City of London Police attribute much of that spike to improved reporting mechanisms rather than a genuine explosion in attacks, which raises an uncomfortable point: victimization has likely been underreported for years, and the “real” numbers were always closer to this new figure. It’s a useful case study in how measurement changes can look like trend changes, and a reminder that fraud statistics are only as good as the reporting infrastructure behind them.
Meanwhile, Russia is bracing for a very different kind of threat. The Kremlin is now requiring stiffened physical security at data centers exposed to Ukrainian drone strikes. This is a rare example of cyber-infrastructure protection colliding directly with kinetic warfare, and it underscores how the Ukraine conflict has expanded the definition of “critical infrastructure defense” to include literal anti-drone hardening around server racks. Expect this playbook — physical fortification of digital infrastructure — to spread to other conflict zones as drone warfare matures.
On the cryptography front, the G7 has issued a formal advisory urging organizations to begin migrating to post-quantum cryptography now, a call reinforced by a companion CISA resource, Preparing for the Post-Quantum Era: A Call to Action. Both documents lay out the now-familiar “harvest now, decrypt later” argument, and both stress that PQC migration is a multi-year undertaking that can’t be started once quantum computers are actually breaking encryption. The five priorities outlined — awareness, inventory, planning, and so on — are sound, but the real test will be whether organizations with long procurement cycles and legacy systems can move fast enough. This is the kind of advisory that’s easy to file away and hard to actually act on, which is exactly why it’s being repeated by multiple agencies at once.
CISA’s regular vulnerability catalog update adds a Chromium V8 type confusion vulnerability to the Known Exploited Vulnerabilities list. Browser engine bugs like this remain one of the most reliable attack vectors precisely because V8 sits at the intersection of untrusted input and high-value execution context — expect federal agencies to be racing against BOD 26-04 deadlines to patch, and everyone else should treat this as a prompt to check their own Chromium-based browser versions.
The State Department’s $10 million bounty on IRGC cyber unit leader Amir Yaryab signals continued U.S. pressure on Iranian state-linked hacking groups like CyberAv3ngers, which have previously targeted water utilities and other critical infrastructure. Rewards like this rarely result in extraditions, but they do raise the cost of operating for individuals tied to state cyber units, and they put names — not just group monikers — on the record, which matters for future indictments and sanctions.
Also troubling is the report that at least 14 Serbian opposition figures and activists have been targeted with Pegasus-style spyware since December, including a sitting MP and student protesters. This fits a grim and familiar pattern: commercial spyware, marketed as a counterterrorism tool, being turned against domestic political dissent. As student protests continue to roil Serbian politics, expect forensic researchers to keep finding more victims, and expect continued diplomatic friction over the use — and export — of spyware within the EU’s neighborhood.
Finally, the steady drumbeat of ICS advisories from CISA this week is worth flagging collectively. There’s a memory-corruption flaw in the Pyramid Solutions NetStaX EtherNet/IP stack that can crash devices or open a remote attack path without triggering normal error signaling; a CRLF injection bug in the IXON VPN Client rated a severe 9.6 CVSS that allows remote code execution with elevated privileges; cross-site scripting issues in Rockwell Automation’s ArmorStart LT; a missing-authentication flaw in Rockwell’s ControlFLASH that lets attackers run arbitrary code at the logged-in user’s permission level; an update to advisories covering Schneider Electric’s Easergy, EcoStruxure, PowerLogic, and Saitel product lines; hard-coded credentials and MitM exposure in Tycon Systems’ TPDIN-Monitor-WEB3; a privilege-escalation issue in the OPC Foundation’s LocalDiscoveryServer installer; and an incorrect default permissions flaw in Inductive Automation’s Ignition platform that lets any authenticated user create new projects. Individually, none of these advisories is headline-grabbing, but together they paint a familiar and sobering picture: the industrial systems running our power grids, factories, and utilities are still shipping with hard-coded credentials, missing authentication, and default permission mistakes that would be considered rookie errors in enterprise IT. With the VPN client flaw in particular carrying a near-critical severity score, asset owners across critical manufacturing, energy, and IT sectors should be prioritizing patch cycles this week rather than waiting for the next batch of advisories to pile up.
Leave a Reply