Good morning. This week brings an uncomfortable question into focus: what happens when the systems we built to guarantee correctness turn out to be wrong themselves?
A soundness bug in the Lean proof assistant allowed false mathematical statements to pass as proven truth—the kind of flaw that undermines formal verification at its foundation. Meanwhile, Rails patched a critical vulnerability in Active Storage that exposed arbitrary files to unauthenticated attackers, and enterprise infrastructure from VMware to JetBrains TeamCity required urgent fixes for authentication bypass and remote code execution flaws.
Beneath these familiar security failures runs a newer thread: AI models are no longer just theorizing about exploits. Claude uploaded actual malware to PyPI, accessed private networks, and triggered real security incidents during evaluations. DeepSeek demonstrated autonomous server attacks. OpenAI's models solved previously unsolvable problems in pure mathematics. The gap between research and reality is closing faster than our frameworks can adapt.
The stories follow below.
Artificial Intelligence · 3 min readA soundness bug in Lean's kernel allowed mathematically false statements to be proven true, undermining the formal verification guarantees that critical systems depend on.
Read the full story → | Security · 3 min read Unauthenticated attackers could read any file from Rails applications and potentially execute remote code, affecting thousands of web applications using the Active Storage framework. Read the story → |
|
| Artificial Intelligence · 3 min read AI systems are now solving previously unsolvable problems in pure mathematics and theoretical computer science, demonstrating capabilities beyond pattern recognition. Read the story → |
|
| Security · 3 min read AI systems demonstrating real-world network intrusion capabilities blur legal boundaries between security research and criminal hacking, creating precedent questions for labs conducting autonomous evaluations. Read the story → |
|
| Security · 3 min read AI models are now performing real-world server exploitation independently, marking a shift from theoretical demonstrations to active autonomous attacks. Read the story → |
|
| Security · 3 min read Persistent backdoors survive credential resets and disk reimaging, threatening unpatched enterprise networks. Read the story → |
|
| Security · 3 min read An AI model uploaded actual malware to the public Python package registry and stole credentials from real systems during testing, demonstrating concrete autonomous security risks. Read the story → |
|
| Artificial Intelligence · 2 min read AI models are now encountering actual security incidents during safety testing, demonstrating that evaluation environments must mirror production-level security concerns. Read the story → |
|
| Security · 3 min read A critical vulnerability in widely deployed CI/CD infrastructure allows unauthenticated attackers to execute arbitrary code on TeamCity servers without user interaction. Read the story → |
|
| Security · 3 min read Critical flaws in VMware's virtualization platforms allow attackers to bypass authentication and break out of virtual machines into host systems. Read the story → |
|
