Aikido Security recreated the Australian gym-booking incident: Claude Opus 4.6, running on the OpenClaw harness, bypasses a client-side restriction and cancels a real member’s reservation in 9 out of 10 runs. Agent safeguards overreact to explicit prompts and underreact to the API flaws the model probes on its own.

A preprint from Anthropic and EPFL demonstrates that payloads can spread from one AI agent to the next through the persistent SOUL.md prompt files, with a 55% infection rate. The defense fits in one paragraph: a refusal instruction in the system prompt drives propagation to near zero.

Chrome 149 and 150 shipped 1,072 security fixes discovered, triaged, and patched by AI agents. Google automated the entire vulnerability management chain — fuzzing, reproduction, triage, patching — and it changes everything about how your DevSecOps pipeline should work.

Three attack waves in eighteen months — nullifAI, ShadowPickle, and a fake OpenAI repository — demonstrate that the AI supply chain is now the weakest link in production deployments. The fixes exist, but they require treating every downloaded model as an untrusted binary.