Evolve on Sundays: When AI Agents Crossed the Boundary

01Security

1. AI cybersecurity evaluations reached real organizations

Anthropic reviewed 141,006 cybersecurity evaluation runs and found three incidents in which Claude models reached the internet and gained unauthorized access to three organizations.

The headline version—“AI agents escaped and attacked real companies”—is directionally alarming but technically incomplete. Anthropic's review describes three different failure paths, three different model responses, and a shared infrastructure mistake: the models were explicitly told that their capture-the-flag environments had no internet access, but a misunderstanding between Anthropic and its evaluation partner, Irregular, left a live path open.

That difference matters. The Claude models did not decide to abandon their assigned task and select unrelated victims. They continued trying to capture a fictional flag while holding a false belief about which systems were part of the exercise. The harm was real, but understanding the failure requires separating the objective, the model's situational interpretation, and the controls surrounding it.

2. Coordinated attacks disrupted more than 30 water systems

Minnesota activated statewide cyber incident response after attackers targeted operational technology at more than 30 community water systems. Reported actions included changing programmable logic controller passwords, modifying network settings, disconnecting equipment, and forcing some operators to switch temporarily to manual operation.

CISA subsequently warned of increasing activity against internet-exposed PLCs in the water and wastewater sector. The agency urged operators to remove operational technology from direct internet exposure, use VPNs or secure gateways where remote access is essential, replace default credentials, and restrict access by source address.

The exposure problem is larger than one state. In a July 30 snapshot, Censys identified 4,148 exposed Rockwell/Allen-Bradley hosts, 4,117 Siemens SIMATIC S7-1200 hosts, and 2,072 Schneider Electric hosts. Censys emphasized that these were exposure counts—not confirmed victims—and that its Schneider Electric figure was vendor-wide rather than limited to PLCs. Undocumented cellular modems installed by operators, vendors, or integrators can create paths that do not appear in the organization's normal asset inventory.

Why it matters: water and wastewater environments turn a digital configuration change into a physical operational problem. For Gulf countries and the wider Middle East, where treatment, distribution, and desalination are foundational services, OT exposure is a direct resilience issue.

Week-ahead action: inventory PLCs, HMIs, engineering workstations, gateways, and cellular modems; remove direct exposure; replace default credentials; verify manual operating procedures; and test whether operators can recover access when device passwords or addresses are changed.

3. OWAReaper turned a malicious email into durable mailbox access

Proofpoint described a Russian state-sponsored campaign exploiting CVE-2026-42897 against on-premises Microsoft Exchange Outlook Web Access. The cross-site scripting flaw allowed attacker-controlled JavaScript to run when a user opened a crafted email in OWA—without requiring a link or attachment.

The resulting OWAReaper backdoor executed inside the reading pane. It could collect account information, attempt credential theft, abuse Outlook add-in permissions to obtain OAuth tokens, and modify server-side folder permissions. Those permission changes could preserve mailbox access even after the victim's password was changed or endpoint was rebuilt.

The attackers also used multiple command-and-control and exfiltration paths, including GitHub commit searches, email messages, HTTPS, and a DNS fallback. The design shows how a webmail compromise can survive remediation focused only on the user's device.

Why it matters: email is not merely a delivery channel. In browser-based enterprise applications, the message renderer, mailbox permissions, OAuth tokens, add-ins, and offline caches form an application platform with their own persistence paths.

Week-ahead action: patch affected on-premises Exchange systems, hunt for the published indicators, review mailbox and folder permissions, audit high-privilege add-ins and OAuth grants, and do not treat password rotation or endpoint reimaging as complete remediation.

4. AWS connected major npm compromises to North Korea

Amazon attributed compromises involving the popular debug, chalk, axios, and related npm packages to the North Korea-linked Sapphire Sleet group with medium confidence.

The campaign relied on social engineering maintainers and then publishing malicious releases through trusted accounts. Amazon said the attackers tested techniques through smaller packages before moving toward widely used dependencies. The company also highlighted a broader evolution: malicious functions distributed across multiple packages, externally retrieved payloads, environment-aware execution, long-term contributor personas, and package names chosen to exploit errors made by AI coding tools.

Why it matters: package ecosystems distribute trust at software speed. A maintainer account can become an entry point into thousands of development and production environments, while automation may install an update before defenders understand that ownership has changed.

Week-ahead action: require phishing-resistant MFA for maintainers, pin and delay dependency updates, verify provenance, alert on publisher and ownership changes, inspect install scripts, and prevent coding agents from installing newly discovered or hallucinated packages without approval.

5. Exploited management-plane flaws demanded more than routine patching

Cisco disclosed active exploitation of CVE-2026-20316 in Secure Firewall Management Center. Static credentials for a low-privilege account allowed unauthenticated remote access to affected systems and could be chained with other vulnerabilities to escalate privileges. Cisco released fixes and indicators of compromise but no workaround.

Arista separately patched CVE-2026-16812, a maximum-severity unauthenticated command-injection flaw affecting on-premises VeloCloud Orchestrator. Successful exploitation could compromise the orchestrator, its managed data, and potentially connected edge devices. Hosted and dedicated deployments had been patched before public disclosure.

Why it matters: management systems sit above the devices they control. Compromise of a firewall manager or SD-WAN orchestrator can expose configuration, credentials, certificates, network topology, and a path toward many downstream assets. Installing an update does not remove an attacker who arrived before the patch.

Week-ahead action: apply the vendor fixes, restrict management interfaces to administrative networks, use the published indicators, review configuration and administrator changes, rotate exposed credentials and certificates, and rebuild compromised instances when integrity cannot be established.

6. A fake Teams support call reached ransomware in under 17 hours

Sophos documented a campaign in which attackers used external Microsoft Teams accounts to impersonate IT support staff. Targets were persuaded to open Microsoft Quick Assist or install remote-management software, after which the attackers established persistence, deployed additional access tools, moved laterally, and in at least three cases deployed Chaos ransomware.

In one incident documented by Sophos, less than 17 hours passed between initial access and ransomware deployment. Most of the social-engineering calls lasted only a few minutes.

Why it matters: employees associate collaboration platforms with coworkers and approved business activity. Attackers exploit that inherited trust, then use legitimate remote-support tools that may not trigger the same controls as malware.

Week-ahead action: restrict or label external Teams communication, require a separate verification channel for support requests, control Quick Assist and remote-management tools, alert on unexpected installations, and rehearse containment for identity-led attacks that can reach encryption within one working day.

7. Amgen's cloud breach exposed health and proprietary information

Amgen disclosed that attackers exfiltrated data from cloud environments operated by third-party service providers. The company said the stolen material included proprietary information, patient protected health information, and other data. It was still determining whether confidential business information, intellectual property, research and development material, and additional patient information were affected.

Amgen classified the incident as material on July 29 based on the volume and potential sensitivity of the files. It had not disclosed the cloud providers, intrusion method, affected population, or responsible actor by the end of the coverage window.

Why it matters: outsourced infrastructure does not outsource accountability. Sensitive data spread across multiple provider environments can leave identity, logging, retention, and incident-response responsibility divided among organizations precisely when investigators need a unified view.

Week-ahead action: map sensitive information across SaaS and cloud providers, confirm centralized identity and phishing-resistant MFA, collect provider audit logs, test contractual notification paths, and verify that access can be revoked across every connected environment during an incident.

02Software & Tech

1. Oracle brought Gemini into core enterprise workflows

Oracle announced that Google's Gemini models would be available through AI Agent Studio for Fusion Applications and used in embedded scenarios across Fusion Cloud and NetSuite. Organizations will be able to select different models for ERP, HR, supply-chain, finance, customer-experience, and other workflows.

Why it matters: enterprise AI is moving from a separate chat window into systems that approve payments, change employee records, manage inventory, and execute transactions. Model selection is becoming part of application architecture, while permissions, approvals, data boundaries, and audit trails determine whether an agent can act safely.

Week-ahead action: classify agent actions by consequence, require approval for high-impact transactions, record the model and policy used for each decision, and make rollback part of the workflow design.

2. Amazon backed formal verification for safer agents

Amazon committed substantial long-term support to the organization behind Lean, an open-source programming language and proof assistant used to verify mathematical and software properties. AWS already uses Lean-based verification in services including Bedrock AgentCore.

Formal methods cannot prove that a poorly defined business objective is wise. They can prove that a defined policy or protocol satisfies specific properties. That distinction matters as organizations ask agents to operate under increasingly complex authorization rules.

Why it matters: conventional tests demonstrate behavior in selected scenarios. Formal verification can establish stronger guarantees about defined boundaries, including whether a policy language permits an action that should be impossible.

Week-ahead action: identify high-consequence controls—authorization policies, isolation boundaries, transaction rules, and distributed protocols—where mathematical verification would provide more assurance than example-based testing alone.

3. AI spending began repeating the early cloud-cost crisis

Research discussed by Harness found that 72 percent of organizations had experienced unexpected AI cost spikes, AI accounted for 23 percent of the average enterprise cloud bill, and respondents estimated that 26 percent of AI spending was wasted.

The problem is not only model pricing. Long reasoning traces, repeated agent loops, large context windows, tool calls, retries, and using frontier models for routine work can make an inexpensive token price into an expensive business process. Ownership is also fragmented across engineering, finance, and IT.

Why it matters: an AI feature can be technically successful and economically unsustainable. Cost must be measured per completed outcome, not only per token or API request.

Week-ahead action: assign an owner for AI spend, measure cost by workflow, set retry and reasoning limits, route simpler tasks to smaller models, cache reusable results, and require teams to define the business value that justifies higher-cost execution.

4. Google withdrew an Earth AI feature after one day

Google introduced and then withdrew an image-generation feature that allowed users to place generated scenes inside Google Earth. It withdrew the feature a day later after users demonstrated how screenshots could appear to show fabricated events at real geographic locations. Google said it would work on stronger guardrails.

Why it matters: safety cannot stop at the boundary of the product interface. A generated image may be labeled correctly inside an application and become misleading when cropped, screenshotted, reposted, or separated from its metadata. The risk is greater when the host product has historically been treated as a trusted source of geographic evidence.

Week-ahead action: test generated content outside its original interface, make provenance survive screenshots and exports where possible, conduct abuse reviews before launch, and define a rollback path for features that undermine the trust model of the product around them.

5. Microsoft's results showed enterprise AI moving beyond experimentation

Microsoft reported that Azure revenue had passed $100 billion for the year and Microsoft 365 Copilot had reached more than 30 million paid seats. Azure grew 43 percent in the quarter, while the company continued investing heavily in AI infrastructure and its own models.

Why it matters: enterprise AI is no longer confined to innovation teams and small pilots. At this scale, decisions about model providers, data access, cost allocation, employee training, resilience, and exit strategy become ordinary technology-management responsibilities.

Week-ahead action: treat AI services as production dependencies. Track adoption and business outcomes separately, document provider concentration, test fallback options, and ensure that licensing growth is matched by governance and measurable value.