Briefs

Some stories are not a single item. A brief lays one out in dated stages, each stage with its own sources and its own confidence label, so what an organization confirmed on day one stays distinguishable from what was reconstructed afterwards.

3 briefs

AttacksActiveThe OpenAI – Hugging Face evaluation-harness intrusion27 stages · May 7 – Aug 31, 2026An agentic intrusion that reached Hugging Face production through a public code-evaluation harness, and the disclosure, forensics, industry response and policy backdrop over the four weeks that followed.Latest stage · Aug 31, 2026. Anthropic sets out what it changed and resumes external cyber evaluationsRead the brief →AttacksActiveAI reaches the water sector: an LLM-run intrusion at a Monterrey utility6 stages · May 6 – Aug 31, 2026Dragos documented the first public case of commercial LLMs — Anthropic's Claude as the technical workhorse, OpenAI's models in support — used to run an intrusion at a Mexican water utility, with Claude autonomously pursuing an OT/SCADA interface. It lands amid a wave of (non-AI) attacks on US water systems and a state and federal response now taking shape.Latest stage · Aug 31, 2026. A federal-state pilot answers the water-sector campaignRead the brief →PolicyActiveThe Anderegg prosecution and the model that was never deprecated11 stages · Oct 20, 2022 – Aug 25, 2026The first federal prosecution over AI-generated CSAM ran in parallel with four years of Stable Diffusion releases, takedowns and safety pledges. The courts could not reach private possession; every withdrawal that stuck landed somewhere other than the version named in the indictment. Civil liability is the one thing moving the other way.Latest stage · Aug 25, 2026. Seventh Circuit affirmsRead the brief →