Good morning,
Fifty dollars.
That is what it now costs to break into a company. Not a fortune in zero-days. Not a crew of bored teenagers in a basement. Fifty dollars in tokens, a day of waiting, and somebody else’s website belongs to you.
This week Reuters and the security firm NorForge described how one Chinese-speaking hacker pointed a fleet of AI agents at more than 1,200 online stores and walked away with a foothold in over 100 of them. Deere. SharkNinja. Cummins. NorForge could watch it happen live, because the hacker had left the control panels of the agent platform sitting on the open internet without a password. Burglars, it turns out, are also bad at locking their own doors.
The agents did almost everything. The human typed fewer than 100 Chinese characters of instructions. The machines did the scanning, the guessing and the breaking in. Roughly a day per target. About $5,000 for the whole campaign.
The gains for the attacker were enormous.
This is the world we’re in now.
As I’m writing this the cybersecurity world is in turmoil. We had 3 major zero-days hit the wire this week. Even my ‘normie’ friends were talking to me about it.
The normal frequency of such a crisis it’s let’s say once in a few years. I can vividly remember the “log4j” incident from 2021. Now everything is accelerating, both the attackers and the defenders are using the same tools.
So yes, AI and cybersecurity together is quite the volatile combination. Like those green balls from ‘The Rock’
Actual depiction of 2 cybersecurity experts.
But it’s not all bad. Every second tuesday of the month Microsoft releases security updates (patches) to flaws in Windows. Those are gaps that attackers could get through that they close off. Every month there’s about 100 of them on average.
The chart below you can see the overview for 2025
That’s quite a lot you might think. And indeed, these gaps have sometimes been exploitable for more than 15 years. So who knows what damage a single gap could cause. That is if your glass is half-empty.
Now, with the advent of Mythos and other cyber-capable models all of a sudden it turns out there’s even MORE gaps.
Last patch tuesday saw a whopping 1400 security flaws (cve’s) fixed. If your glass is half-full you are happy that Microsoft is now finding gaps quicker. At a certain point they must run out of flaws, no ?
So what I think is going to happen or is happening is that everything is now accelerating. But since the defenders like Microsoft or Google should technically have more compute at their disposal they will be able to fix more flaws quickly than the attackers will be able to exploit.
It’s going to get REALLY ugly in the next few months I think but then it will probably stabilize.
And my prediction that I made a few years ago in a keynote and FOR WHICH I WAS LAUGHED AT i might add , is coming true.
Cybersecurity in the future will be an army of bots versus an army of bots. And we will just look at it happening and focus on developing better bots to defend against the enemy.
Like my colleague said this morning when a vulnerability with the highest score on the scale hit the wire : “what a time to be alive!”
Welcome to the Blacklynx Brief
Leave Granola and get up to 12 months free of Wispr Flow Notetaker + Dictation
If you have paid time left on an individual Granola plan, we'll match it with a Wispr Flow subscription that includes Notetaker and dictation, and add bonus time, up to 12 months total. Sign in or create a Wispr account and submit proof of your plan to check eligibility.
AI News
AI agents breach more than 100 companies for one hacker. Security firm NorForge watched a Chinese-speaking attacker let autonomous agents on the open-source Cairn platform break into websites of over 100 firms, including Deere, SharkNinja and Cummins, at roughly $50 per intrusion. Reuters confirmed victims; whether data was taken remains unclear. (NorForge)
DHS orders DeepSeek out of civilian federal systems. A Federal Register notice directs civilian agencies to remove DeepSeek products, including third-party tools built on its models, and bars future procurement under supply-chain security law. The order excludes the Defense Department and does not restrict private users. (Federal Register)
Meta releases Muse Spark Open. Meta published open weights for an 816-billion-parameter multimodal model it calls the most capable US open-weight release, tuned with Apple to run locally on two M5 Ultra Mac Studios. Independent rankings still place Chinese open models ahead on coding. (Meta)
Anthropic proposes a Public Benefit Fund. Anthropic plans to place 5% of its equity in a company-owned fund, subject to stockholder approval, with further tranches tied to valuation growth. No money has been distributed yet; governance and milestones are to be published in the coming months. (Anthropic)
Altman reportedly sketches three AI endgames. The Information reports OpenAI’s CEO told staff the race could end in an IAEA-style global watchdog, a CERN-style merged lab, or one company racing ahead, which he called terrible. Days earlier, Anthropic’s Jack Clark told the IMF the singularity has begun. (The Information)
AI Quick News
Anthropic reported third-quarter revenue of $16.8 billion, up 45% on the previous quarter, as it prepares an IPO that could come as soon as next month, the Financial Times reports.
Apple will bring Apple Intelligence features to China in December with Alibaba-built filters and without a Gemini-powered Siri, Bloomberg reports.
Google Play now lets US adults install Android apps they vibe-coded in AI Studio privately on their own devices, with sharing and a reviewed public path to follow.
Skyfall AI unveiled SKY-001, a model it says drafts 3D designs of parts and buildings far faster and cheaper than frontier models.
DeepSeek updated V4.1-Flash to finish tasks faster with shorter answers and opened its in-house web search tools to developers.
OpenAI announced a deal to acquire Orchestra Bio, whose agents track scientific studies, to fold into its Rosalind science tools.
OpenCode confirmed a breach of its hosted Console that exposed OpenAI, Anthropic and Google API keys for about 1.4% of Console users, some of whom reported hundreds of dollars in unauthorised usage.
Google added Axios, CNN and the Financial Times to its paid AI news licensing programme, which now covers more than 400 outlets.
Krea released Krea 3, an image model built for fast, precise edits that it claims runs three times faster than Google’s Nano Banana Pro at under half the cost.
Microsoft researchers open-sourced PBC, a bias-correction method for mid-range weather forecasts that flagged two major US winter storms weeks in advance.
Radical Numerics says the FDA cleared a bacteriophage designed by its Omnii-1 model for a patient whose infection resisted treatment, a claim so far made only by the company.
Odyssey showed a simulated fruit-fly brain steering itself through worlds generated by its Odyssey-3 model with no human at the controls.
Bank of America hired about 1,000 contractors to patch software flaws surfaced by Anthropic’s Mythos and other models, CEO Brian Moynihan told CNBC.
OpenAI launched GPT-Live-1.1 with more natural multilingual accents and upgraded its Chrome extension to read open tabs and automate browser tasks.
Eight US states sued OpenAI, alleging ChatGPT encouraged self-harm and violence and seeking damages plus changes to its safeguards.
OpenAI is training employees to spot espionage attempts, including honeypot schemes, as efforts to steal AI trade secrets intensify, the Wall Street Journal reports.
Black Forest Labs released FLUX 3 Max, a faster text-to-video model built with fal that it says matches Seedance 2.5 on quality while rendering ten-second clips in about twelve seconds.
Anthropic is giving six METR researchers employee-level access to assess its safety practices and publish findings without company approval.
Former DeepMind researcher Thore Graepel launched Metis Reasoning, a startup applying AlphaGo-style search so chatbots check their answers against evidence.
DeepSeek open-sourced DeepInfer, the inference engine behind V4.1-Flash, with Huawei chip support so companies can serve the model without Nvidia hardware.
MiniMax launched M3.1 Flash, previously tested under the codename Space Bunny, pitching strong coding and computer-use scores at a very low price.
Amazon launched two Bee wearables from $74.99 that record conversations and turn them into summaries and to-dos connected to Alexa.
Elon Musk said he will give one SpaceX share to every American child through Trump Accounts next year, in response to Anthropic’s fund announcement.
Closing Thoughts
That’s it for us this week. Please like and subscribe 🙂
