Artificial intelligence spent the day proving it is now a weapon as much as a product: security researchers documented a lone attacker who used autonomous AI agents to break into a large company's Amazon cloud and extort it within three days, while Beijing's state vulnerability body told developers to rip out Anthropic's Claude Code over claims it hides "backdoor" data collection — turning AI tooling into a front in the US-China tech war. The unease ran deeper than any single incident: a former DeepMind executive warned that Washington's nationalistic AI posture is steering toward the worst case, Temasek's investment chief cautioned that the US spending surge is itself a market risk, and the bubble grew surreal enough that some San Francisco homeowners now want to be paid in OpenAI or Anthropic stock. Europe pressed its own agenda, as the EU's General Court threw out Apple's challenge to the Digital Markets Act and Parliament moved to fast-track a chat-scanning law that reopens the continent's fight over encryption. Beneath it all sat the familiar grind of exposure and espionage — the Israeli payments firm Nayax investigating a breach after an extortion crew claimed to hold a billion card records, and Taiwan charging two businessmen with leasing messaging accounts to Chinese intelligence.
Top Stories
- This Former DeepMind Exec Thinks the AI Arms Race Could End in Disaster — WIRED · AI & Power
- Lone Attacker Uses AI to Breach AWS Cloud Environment in 72 Hours — darkreading · Cybersecurity & Threats
- EU court hands Brussels win over Apple on Big Tech rules — Technology – POLITICO · EU & Technology
- China tells devs to ditch Claude Code over 'backdoor code' fears — www.theregister.com - Articles · China & Technology
- An off switch for dual use knowledge in AI models — Anthropic Research · AI & Power
AI & Power
This Former DeepMind Exec Thinks the AI Arms Race Could End in Disaster — WIRED
Why it matters: A former DeepMind exec warning that Washington's nationalistic AI posture is steering toward the worst case reframes the arms-race debate from capability to catastrophe.
Verity Harding, a former DeepMind policy lead, told WIRED that the US government's increasingly nationalistic approach to AI is evidence the worst-case scenario of an ungoverned arms race is taking shape.
An off switch for dual use knowledge in AI models — Anthropic Research
Why it matters: Anthropic publishing an 'off switch' for dual-use knowledge is a concrete safety mechanism aimed squarely at the bio and cyber misuse governments most fear.
Anthropic detailed research on an 'off switch' that can suppress dual-use knowledge in AI models, a technical control aimed at the biological and cyber-misuse risks at the centre of AI-safety policy.
Our approach to government and national security partnerships — OpenAI News
Why it matters: OpenAI codifying principles for government and national-security work marks the frontier labs' formal entry into the defence and intelligence market.
OpenAI published its approach to government and national-security partnerships, setting out principles for democratic accountability as the frontier labs move deeper into defence and intelligence work.
OpenAI to release its most powerful model after weekslong hold — Technology
Why it matters: OpenAI releasing its most powerful model after a weekslong hold shows how frontier launches now come with deliberate safety-and-politics choreography.
OpenAI said its most powerful models yet — Luna, Sol and Terra — will go live globally on Thursday after a weekslong hold, a launch staged with unusual caution.
In San Francisco, Some Home Sellers Now Ask for OpenAI or Anthropic Stock — NYT > Technology
Why it matters: San Francisco sellers demanding payment in OpenAI or Anthropic stock is the AI bubble seeping into the real economy's most basic asset.
Some San Francisco home sellers are now asking to be paid partly in OpenAI or Anthropic stock, a sign of how deeply the AI wealth boom has seeped into the region's real economy.
Tech CEOs Ditch the AI Jobs Apocalypse Narrative — Technology - WSJ.com
Why it matters: Tech CEOs abandoning the 'AI jobs apocalypse' script is a narrative pivot with real stakes for how policymakers treat automation.
Tech chief executives are dropping the 'AI will destroy jobs' narrative for a more optimistic pitch, a messaging shift that reshapes the political debate over automation.
Temasek CIO Rohit Sipahimalani Warns on US Capex Surge Risks — Bloomberg Markets
Why it matters: Temasek's CIO warning that the US capital-spending surge is itself a market risk adds a sovereign-investor voice to the AI-bubble chorus.
Temasek's chief investment officer warned that the surge in US capital spending — much of it AI infrastructure — could itself become a source of market risk.
Anthropic’s Political Risks Are Real, but OpenAI’s Loom Even Larger — Technology - WSJ.com
Why it matters: Weighing Anthropic's political exposure against OpenAI's is a reminder that the frontier labs are now political actors as much as technical ones.
A WSJ analysis argues that while Anthropic faces real political risk from US government targeting, OpenAI's political exposure looms even larger as the labs become political actors.
Cloudflare puts prices on AI scraping — Semafor
Why it matters: Cloudflare charging AI crawlers to scrape puts a price on the data that feeds the models — a structural lever over the AI economy's supply chain.
Cloudflare rolled out a 'bot paywall' letting its customers charge AI models to scrape their content, an attempt to put a price on the data supply that feeds the AI boom.
EU & Technology
EU court hands Brussels win over Apple on Big Tech rules — Technology – POLITICO
Why it matters: The EU General Court dismissing Apple's challenge to its gatekeeper designation is a landmark validation of the bloc's Big Tech rulebook.
The EU General Court dismissed Apple's challenge to how it was designated under the Digital Markets Act, handing Brussels a significant early court victory for its Big Tech rulebook.
EU to set up AI testing ‘capacity’ amid worries over powerful models — Tech Archives | Euractiv
Why it matters: The EU standing up its own AI-model testing capacity, with contingency plans for access restrictions, is a bid for sovereign oversight of powerful models.
The EU plans to build its own AI-testing 'capacity' and contingency measures to handle powerful models and possible access restrictions, a step toward sovereign evaluation of frontier systems.
Parliament fast-tracks vote on chat-scanning CSAM law — Tech Archives | Euractiv
Why it matters: Parliament fast-tracking a vote to restore chat-scanning powers reopens Europe's core fight between child-safety mandates and end-to-end encryption.
The European Parliament is fast-tracking a vote on the chat-scanning CSAM law, seeking to restore voluntary scanning powers for platforms and reigniting the fight over encryption and privacy.
Physical AI ‘space race’: can Europe compete with China and the US in humanoid robotics? — Tech - South China Morning Post
Why it matters: European firms warning they are losing the 'physical AI' race to China and the US frames humanoid robotics as the next deindustrialisation risk.
European companies warn they are struggling to secure a foothold in 'physical AI' — AI embodied in robotics — as China and the US pull ahead, raising fresh fears of deindustrialisation.
Italy leads push to weaken green rules in €2T EU budget — Policy – POLITICO
Why it matters: Italy leading a push to water down green rules in the €2tn EU budget opens a new front in the fight over Europe's regulatory direction.
Italy is leading an effort to weaken environmental rules in the EU's next €2 trillion budget, opening a new divide in already fraught negotiations over the bloc's regulatory direction.
Exclusive: Germany bankrolled Tesla buyers with €860m to help hit EU Covid recovery targets – and now gives €71m to Musk’s Berlin gigafactory too — EUobserver
Why it matters: Germany funnelling EU Covid-recovery money into Tesla subsidies and Musk's Berlin gigafactory raises pointed questions about sovereignty and state aid.
An investigation found Germany used €860m in EU Covid-recovery-linked subsidies for Tesla buyers and is granting a further €71m to Musk's Berlin gigafactory, raising state-aid and sovereignty questions.
US & Technology
Apple to Spend $30 Billion on U.S.-Made Chips From Broadcom — Technology - WSJ.com
Why it matters: Apple committing $30bn to US-made Broadcom chips is a marquee reshoring move that fuses corporate strategy with industrial policy.
Apple agreed to spend $30 billion on US-made chips from Broadcom, the latest and largest piece of its domestic-investment pledge and a marquee semiconductor-reshoring move.
SCOTUS lets Texas enforce app store law that Big Tech calls "censorship regime" — Ars Technica - All content
Why it matters: The Supreme Court letting Texas enforce app-store age-verification hands states a powerful new lever over platforms and digital identity.
The Supreme Court declined to block Texas's app-store age-verification law, letting the state enforce ID checks on app stores while litigation continues — a boost for state-level platform regulation.
The FTC Settlement With John Deere Is a Huge Win for the Right-to-Repair Movement — WIRED
Why it matters: The FTC's John Deere settlement is a landmark right-to-repair win that constrains how manufacturers lock down the equipment they sell.
The FTC's settlement with John Deere gives farmers and independent shops access to repair tools the company long withheld, a landmark victory for the right-to-repair movement.
China & Technology
China tells devs to ditch Claude Code over 'backdoor code' fears — www.theregister.com - Articles
Why it matters: China's state vulnerability body telling developers to rip out Claude Code over alleged 'backdoor' data collection is AI decoupling weaponised as security policy.
China's National Vulnerability Database urged developers to uninstall recent Claude Code versions, alleging 'backdoor code' that collects user data without consent — turning AI-tool security into a decoupling lever.
China to Let AI Firms Buy Nvidia H200s, Information Says — Bloomberg Technology
Why it matters: Beijing letting top AI firms buy limited Nvidia H200s signals a pragmatic easing of its own controls even as the US-China chip contest hardens.
China plans to let leading AI companies buy a limited quantity of Nvidia H200 chips, per the Information — a sign Beijing is easing restrictions on coveted US silicon amid the chip contest.
Alibaba shares spike 12% in Hong Kong as T-Head chips, AI revenue fuel earnings optimism — Tech - South China Morning Post
Why it matters: Alibaba's 12% share spike on T-Head chips and AI revenue shows China's vertical-integration bet — homegrown silicon plus cloud AI — starting to pay off.
Alibaba shares jumped as much as 13.8% in Hong Kong as analysts bet on reaccelerating revenue from AI and its in-house T-Head chips, a marker of China's vertical-integration strategy.
Computing Power Paradox: General-Purpose Chips in Shortage as Shanghai Zhangjiang Builds China Silicon Photonics Hub — Pandaily - China Tech News, AI & Electric Vehicle Insights
Why it matters: Shanghai's Zhangjiang building a silicon-photonics hub while general-purpose chips stay scarce captures China's scramble to engineer around the compute bottleneck.
As usable general-purpose compute stays scarce, Shanghai's Zhangjiang district is building a silicon-photonics hub, part of China's push to engineer around its chip bottleneck.
China’s circuit-board makers push capex towards record to feed AI boom — Tech - South China Morning Post
Why it matters: Chinese circuit-board makers racing capex to records to feed AI demand shows the buildout reaching deep into the electronics supply chain.
More than 20 Chinese printed-circuit-board makers are pushing capital spending toward record highs to feed AI-driven demand, extending the buildout deep into the component supply chain.
Capital Floods In as Brain-Computer Interface Nears Commercial Reality in China — Pandaily - China Tech News, AI & Electric Vehicle Insights
Why it matters: A capital surge into Chinese brain-computer interfaces as they near commercialisation marks a new front in the US-China race for frontier hardware.
Investment is flooding into Chinese brain-computer-interface startups as the technology nears commercial reality, opening a new front in the US-China contest over frontier hardware.
Digital Sovereignty & Identity
State IDs for AI Agents: Will Estonia Set a Precedent? — darkreading
Why it matters: Estonia moving to issue state identities for AI agents could set the template for how governments authenticate autonomous software acting on our behalf.
Estonia plans to let people use AI agents for government services and is weighing state-issued identities for those agents, a move that could set a precedent for authenticating autonomous software.
AI Surveillance Is Being Supercharged–And It Will Chill Social Progress — The Citizen Lab
Why it matters: Penney and Schneier's warning that AI-supercharged mass surveillance chills democracy itself sharpens the civil-liberties case against the surveillance build-out.
In a Guardian op-ed, Jon Penney and Bruce Schneier argue that AI-supercharged mass surveillance produces 'chilling effects' corrosive to democracy and social progress.
Lissi raises €3.5M to power Europe's sovereign digital identity future — Tech.eu
Why it matters: A €3.5m raise for a European EUDI Wallet connectivity provider is capital flowing directly into the bloc's sovereign digital-identity stack.
Lissi raised €3.5 million to expand its EUDI Wallet connectivity and verifiable-credential technology, channelling capital into Europe's sovereign digital-identity infrastructure.
Videoanalyse für die Bundespolizei: Bahnhofs-Kameras sollen Menschen und ihr Verhalten erkennen — netzpolitik.org
Why it matters: Germany moving to let its federal police run real-time behavioural video analysis on station cameras is a major expansion of biometric state surveillance.
Germany's governing coalition is fast-tracking powers for the federal police to run real-time AI video analysis on station cameras to detect people and behaviour, a sharp expansion of biometric surveillance.
US senators target AI, biometric surveillance in the workplace — Biometric Update
Why it matters: The Stop Spying Bosses Act would impose some of the farthest-reaching US limits yet on AI and biometric monitoring of workers.
US senators introduced the Stop Spying Bosses Act, proposing far-reaching federal limits on employers' use of AI, automated scoring and biometric surveillance to manage workers.
EU decides not to suspend the EES even as it admits difficulties — Biometric Update
Why it matters: Brussels pressing ahead with biometric borders despite '20 difficult spots' shows it will absorb friction rather than pause its digital-sovereignty flagship.
The EU decided not to suspend its biometric Entry/Exit System despite admitting '20 difficult spots' and airline calls to pause it, choosing to push through friction on its border-biometrics flagship.
Threat Intelligence (CTI)
[P2] GhostApproval Symlink Flaws Could Let Malicious Repos Run Code in AI Coding Agents — The Hacker News
Why it matters: A symlink flaw across six popular AI coding assistants lets a booby-trapped repo redirect an innocuous 'approved' file write onto a sensitive one — quietly taking over a developer's machine.
Wiz found 'GhostApproval' symlink flaws in six AI coding assistants (including Amazon Q) that let a malicious repository redirect an approved write to a sensitive file and achieve code execution on the developer's machine.
severity high · EU: NIS2, AI Act · actor Security researchers (Wiz) (20%)
[P2] Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials — BleepingComputer
Why it matters: Fake Paysafe, Skrill and Neteller SDKs planted on npm and PyPI turn the payment developer's own toolchain into a credential-stealing trap.
Malicious npm and PyPI packages impersonating Paysafe, Skrill and Neteller SDKs delivered stealer malware to developers and users of those payment platforms.
severity high · exploited in the wild · EU: NIS2, eIDAS
[P3] New HalluSquatting Attack Could Trick AI Coding Assistants Into Installing Botnet Malware — The Hacker News
Why it matters: HalluSquatting weaponises AI's habit of inventing plausible package names — registering the fakes so coding assistants steer developers straight into botnet malware.
Researchers showed 'HalluSquatting' predicts the non-existent package names AI coding assistants reliably hallucinate, registers them, and uses them to deliver botnet malware to developers who trust the suggestions.
severity medium · EU: NIS2
[P3] Taiwan charges two businessmen over alleged role in Chinese espionage campaign — The Record from Recorded Future News
Why it matters: Taiwan charging two businessmen for leasing LINE accounts to Chinese intelligence exposes the low-tech underside of a persistent cross-strait espionage campaign.
Taiwanese prosecutors charged two businessmen whose company allegedly leased LINE messaging accounts to Chinese spies as part of a cross-strait espionage campaign.
severity medium · EU: NIS2 · actor China-nexus (state) (50%)
[P3] Vidar Infostealer Hammers SMBs via Malvertising Campaign — darkreading
Why it matters: A financially-motivated malvertising wave pushing Vidar to SMBs via cracked-software lures pairs infostealing with cryptomining for a two-for-one payout.
A malvertising campaign lures small businesses with cracked or pirated software to deploy the Vidar infostealer alongside a Monero cryptominer for data theft and mining.
severity medium · exploited in the wild · EU: NIS2
[P3] DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts — The Hacker News
Why it matters: DEBULL abuses Microsoft's device-code flow with collaboration-themed lures — no fake password page needed — to hijack M365 accounts.
The 'DEBULL' tooling ran a Microsoft 365 device-code phishing campaign (late June into early July 2026) using collaboration-themed lures to seize accounts without a fake login page, per ZeroBEC.
severity medium · exploited in the wild · EU: NIS2, eIDAS · actor DEBULL operators (30%)
Defence & National Security
How Ukraine won the first great robot war — Defense One - All Content
Why it matters: A reckoning that Ukraine has 'won the first great robot war' reframes drones and autonomy as the decisive layer of modern conflict.
Defense One argues the narrative has shifted to Ukraine having won 'the first great robot war,' cementing drones and autonomy as the decisive layer of modern conflict.
The US military is not organized for cyber war — Defense News
Why it matters: A frank argument that the US military is not organised for cyber war goes to the heart of whether cyberspace is treated as a real warfighting domain.
A Defense News opinion warns the US military still treats cyberspace as a supporting function rather than a warfighting domain, leaving it structurally unprepared for cyber conflict.
US seeks cheaper hunter-killer drones after Iran destroys $1B worth of Reapers — Ars Technica - All content
Why it matters: The Pentagon hunting for cheap attritable drones after Iran downed $1bn of Reapers is the economics of drone warfare forcing a doctrine rethink.
After losing more than $1 billion in Reaper drones over Iran, the Pentagon is seeking large numbers of cheaper, attritable drones — the economics of drone warfare reshaping US doctrine.
Belgium splashes $3.5 billion to build shared air defense arsenal with the Netherlands — Breaking Defense
Why it matters: Belgium and the Netherlands pooling $3.5bn for a shared air-defence arsenal is European defence integration moving from rhetoric to joint procurement.
Belgium is committing $3.5 billion to build a shared air-defence arsenal with the Netherlands, a concrete step in European defence integration and joint procurement.
The Age of Energy Warfare: Lessons from the Ukraine and Iran Wars — Modern War Institute
Why it matters: Framing an 'age of energy warfare' from Ukraine and Iran puts the power grid at the centre of both military strategy and civilian resilience.
A Modern War Institute essay argues Ukraine and Iran have ushered in an 'age of energy warfare,' making the centralised power grid a prime military target and a civilian vulnerability.
Quantum & Cryptography
Trump’s ‘sober’ approach to quantum — Semafor
Why it matters: A 'sober' White House quantum push centred on domestic supply-chain security signals Washington treating quantum as strategic infrastructure, not hype.
At a closed White House event, Trump-administration officials struck a 'sober' tone on quantum, stressing domestic supply-chain security — a sign of quantum being treated as strategic infrastructure.
World Fund, IQ Capital among backers of €91m QuantumDiamonds round — Sifted
Why it matters: A €91m round for QuantumDiamonds, backed by World Fund and IQ Capital, keeps European quantum-sensing capital flowing amid the sovereignty push.
German quantum-sensing startup QuantumDiamonds raised €91 million from backers including World Fund and IQ Capital, sustaining European quantum investment amid the continent's sovereignty drive.
Getting standards right could unlock EU quantum competitiveness [Advocacy Lab] — Tech Archives | Euractiv
Why it matters: An EPO study finding convergence on FRAND licensing terms matters because standards and patents are the quiet battleground for EU quantum competitiveness.
A European Patent Office study of FRAND disputes finds growing convergence on fair licensing terms — a standards-and-patents question the piece argues is critical to unlocking EU quantum competitiveness.
Cybersecurity & Threats
[P1] Lone Attacker Uses AI to Breach AWS Cloud Environment in 72 Hours — darkreading
Why it matters: The first documented case of a lone attacker using agentic AI to chain cloud weaknesses and breach an AWS environment in 72 hours — then extort the victim — is the AI-as-attacker threat arriving in production.
A lone attacker used agentic AI to orchestrate reconnaissance, chain cloud misconfigurations and abuse stolen credentials to compromise a large AWS customer's environment within 72 hours, then extorted them.
severity high · exploited in the wild · EU: NIS2
[P1] CISA orders feds to prioritize patching Langflow auth bypass flaw — BleepingComputer
Why it matters: CISA ordering feds to patch an actively exploited Langflow flaw — chained with an unauthenticated RCE to steal AI and cloud keys, and even to automate a database-ransomware attack — shows AI infrastructure itself now under sustained attack.
CVE-2026-55255, a cross-tenant IDOR in the Langflow AI-agent framework (added to CISA KEV), was chained with unauth RCE CVE-2026-33017 in a June campaign to steal LLM-provider and AWS keys and automate a database-ransomware attack.
severity critical (CVSS 8.7) · exploited in the wild · CVE-2026-55255 · EU: NIS2 · actor Lone operator (unattributed) (30%), escalation
[P1] Ubiquiti warns of new max severity UniFi OS vulnerability — BleepingComputer
Why it matters: A CVSS-10 command-injection flaw in UniFi with ~100,000 devices exposed to the internet is an unauthenticated-takeover risk across a huge installed base of small-network gear.
CVE-2026-50746, an improper-access-control flaw in the UniFi Connect Application (<=3.4.16), lets an unauthenticated network attacker run OS command injection; ~100,000 UniFi endpoints are internet-reachable.
severity critical (CVSS 10.0) · CVE-2026-50746 · EU: NIS2
[P2] Microsoft patches RoguePlanet Defender zero-day vulnerability — BleepingComputer
Why it matters: A publicly-dropped Defender zero-day that grants SYSTEM even with real-time protection on turns the security product itself into the attack surface.
CVE-2026-50656 ('RoguePlanet'), a race-condition privilege-escalation in Microsoft's Malware Protection Engine, lets a low-privileged attacker gain SYSTEM on fully-updated Windows; a public PoC works even with Defender real-time protection enabled.
severity high (CVSS 7.8) · exploited in the wild · CVE-2026-50656 · EU: NIS2
[P2] 15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros — The Hacker News
Why it matters: A 15-year-old kernel flaw shipping in every mainstream Linux distro since 2011, giving any local user root and a container escape, is a patch-everywhere problem for cloud and on-prem alike.
CVE-2026-43499 ('GhostLock'), an rtmutex use-after-free in the Linux kernel present since 2011, lets any logged-in user gain full root and escape containers on essentially all mainstream distributions.
severity high · CVE-2026-43499 · EU: NIS2
[P2] Nayax investigating breach; The Syndicate claims it acquired 1 billion card records and other important data — DataBreaches.Net
Why it matters: A breach at Israeli payments firm Nayax — with an extortion crew claiming a billion card records — would, if borne out, be one of the largest card-data exposures on record.
Nayax, an Israeli fintech running cashless payments for unattended and self-service machines, disclosed it is investigating a breach after the group 'The Syndicate' claimed to have stolen up to a billion card records and other data; the scale is the actor's unverified claim.
severity high · exploited in the wild · EU: NIS2, eIDAS · actor The Syndicate (claimed) (30%)