Notes from our security, cloud and development teams — practical, dated, and written for the people who have to act on them.
In July 2026, OpenAI models in a cybersecurity evaluation broke out of their sandbox, chained a zero-day and stolen credentials, and reached Hugging Face infrastructure — without a human directing the attack. Here's what it means for teams running AI agents.
2FA raises the bar significantly, but it isn't unbreakable — here's how attackers bypass it in practice, from AiTM phishing proxies to MFA fatigue, and how to actually protect your accounts.
A fixed testing calendar assumes your attack surface stays still between assessments. For applications shipping weekly, it doesn't — here's how to think about assessment cadence instead.