Every week, I organize 400 to 700 links into roughly 60 categories as part of my ongoing effort to learn about AI. This is my personal notebook, which I enjoy sharing with friends… a hobby and a labor of love, rather than a commercial publication or product.
If you arrived here through a search or shared link, this page collects the links I found for Security for the week ending August 28, 2026.
As part of my learning process, I like to automate the category covers. It gives me a chance to learn Python and APIs.
This week’s cover prompt was written using Claude Opus 4.7, and the image was generated using Nano Banana 2.1.
Category Cover Image Prompt: A mid-1980s murder-mystery comedy movie poster in dense pen-and-ink engraving, a wide three-story black-and-white Victorian mansion with turrets on a pure black background, warm amber windows revealing a hooded hacker suspect clutching a laptop, a tuxedoed white-hat investigator with magnifying glass over a USB key, still-life windows crowded with padlocks broken keys red-stamped exploit dossiers and a cracked shield, and one window showing a shadowy silhouette slipping through pried-open bars; at the open front door stands a slim upright silver-haired butler in his sixties with pencil mustache raised eyebrow black tailcoat white gloves holding a silver tray with a sealed envelope bearing a tiny padlock wax seal; above the roofline the title Security in fat rounded extra-heavy white sans-serif letters, campy spooky theatrical, 16:9.
This Week in Security News
Summary by Claude Sonnet 5.5 based on this week’s links:
- The Hugging Face incident, reviewed twice: OpenAI shared its review of the incident and said it is raising security and alignment standards for its training and evaluation infrastructure. METR, an outside group, published its own investigation, and Ajeya Cotra said it was meant to help people who were skeptical of taking OpenAI's word alone.
- A coordinated push on cyber defense: OpenAI published a call for collective action, joined by Anthropic, AWS, Google, Microsoft and Oracle, and Sam Altman said only an urgent, intense collective response will work. Anthropic separately said it will share what Claude Mythos 5 finds with defenders, though not the model itself.
- Shared agent skills as an attack path: Omar Saravia highlighted research called EvoMal, which plants a malicious skill in a shared library and never invokes it, yet agents retrieve it and spread the malware. He also flagged an NVIDIA paper on evaluating skills, noting that review gates are typically scanners checking structure, style and security.
This summary was generated by Claude Sonnet 5.5 to help you explore the links below. Rest assured, I select, organize, and check the links by hand in Google Sheets, and write the introduction and personal commentary in The Main Newsletters myself each week as a labor of love.
This week's links related to Security
Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident – METR
https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/#core-takeaways-about-this-incident?utm_source=tldrai
One of the big goals of the swarm we investigated (Jul 7-13) was to replace their target programs with dummy targets that could actually be exploited with the intended vulnerability. From OAI’s report it looks like a later swarm (difft model) built on their work and succeeded?”
https://x.com/ajeya_cotra/status/2093144336024355104
Important read if you build with agent skills. Shared skill libraries are treated as a safe way for coding agents to reuse each other’s work. New research shows they propagate malware. EvoMal plants a malicious skill in the library and never invokes it. The agent retrieves it”
https://x.com/omarsar0/status/2093001097346764950
we’ve completed our review of the Hugging Face incident. we’ve used what we’ve learned to drive significant upleveling in our standards for safety, security, and alignment in our training and evaluation infrastructure … not just upon deployment. lots of extremely valuable info”
https://x.com/gdb/status/2092697786806669515
We’re sharing more info on the Hugging Face incident. One detail that’s worth highlighting: this incident wasn’t driven by next-gen models based on Astra. The models most responsible were similar in scale to GPT-5.6 Sol. The next generation of models are even more capable.”
https://x.com/polynoamial/status/2092694522954412171
A call for collective action on cyber defense | OpenAI
https://openai.com/collective-cyberdefense/
this is a critically important moment for cyber defense with AI; there is not much time to act. we are happy if you want to work with us or any of our competitors or partners, but please take this moment seriously. only an urgent and intense collective response will work.”
https://x.com/sama/status/2093060670472241368
Very interesting new paper from NVIDIA. (bookmark it) It takes a closer look at evaluating agent skills. Enterprise teams are starting to leverage shared skill libraries, and the review gate is typically a scanner that checks structure, style, and security. NVIDIA measured”
https://x.com/omarsar0/status/2091869893339812222
Your organization is not spending enough of its efforts on bolstering cybersecurity during the window before open weights Mythos-class models/harnesses become available. The HuggingFace incident shows us that you don’t even need intentional bad actors to be exposed to AI hacking.”
https://x.com/emollick/status/2092731069342593434
Anthropic will give defenders what its strongest model finds, but not the model itself
https://thenextweb.com/news/anthropic-mythos-5-defenders-open-source-fund
Bringing the cybersecurity capabilities of Claude Mythos 5 to more defenders | Claude by Anthropic
https://claude.com/blog/bringing-claude-mythos-5-to-more-defenders
We have a limited window to strengthen cyber defenses, and together with organizations including @AnthropicAI, @awscloud, @Google, @Microsoft, and @Oracle, we’re calling for a global effort to give defenders the tools, resources, and support to protect the infrastructure we all”
https://x.com/OpenAI/status/2093074192636018977
China’s Hackers Use DeepSeek for Attacks, Researchers Say – Bloomberg
https://www.bloomberg.com/news/articles/2026-08-24/chinese-hackers-use-deepseek-to-boost-attacks-researchers-say-mt7o4205
There’s been a lot of debate and speculation about the Hugging Face attack over the last month, and many people have been understandably skeptical of simply taking OpenAI’s word for things. I hope our independent investigation can help bring some clarity; we have many findings”
https://x.com/ajeya_cotra/status/2092692485525131648
A call for collective action on cyber defense”
https://x.com/gdb/status/2093021551855812842
LLMs could control their host machines by exploiting inference engines
https://boydkane.com/essays/llms-could-control-their-host-machines-by-exploiting-inference-engines
Secure Every Identity – JumpCloud
https://jumpcloud.com/secure-every-identity
Leave a Reply