AI Is Now Both the Weapon and the Target

Welcome Back to The AI Trust Letter

Once a week, we distill the most critical AI & cybersecurity stories for builders, strategists, and researchers. Let’s dive in!

🏭 Hitachi, OpenAI, and Google Cloud Are Building Security for AI That Controls Physical Infrastructure

The Story:

As physical AI, systems where AI directly controls real-world equipment, moves from pilot projects into production across power grids, factories, and critical infrastructure, Hitachi is expanding partnerships with OpenAI and Google Cloud to address the security architecture that traditional IT controls were not designed for.

The details:

• Hitachi is deploying Forward Deployed Engineers, software specialists who embed directly with customers, to support physical AI integrations from proof-of-concept through production. The model combines Hitachi's 20 years of OT and IT experience with OpenAI's Codex for legacy system code analysis and Google Cloud's Gemini Enterprise for autonomous operations in complex environments

• The partnership with Google Cloud specifically targets the cybersecurity layer. Hitachi's Cyber Center of Excellence will work with Google Cloud's AI Threat Defense platform alongside Hitachi's own managed security services, with the goal of defending against AI-generated threats at the speed they now arrive

• Research from Google's Mandiant unit cited in the announcement found that AI has materially compressed cyberattack timelines. Physical AI systems, where a compromised decision-making loop can affect physical equipment rather than just data, require a higher security baseline than standard enterprise software

• The OpenAI component addresses a specific operational risk: legacy systems running in critical infrastructure contain code that was written before modern security standards and often before secure-by-design practices existed. FDE teams will use Codex to analyze that code to surface vulnerabilities before integrating AI-driven control layers on top of it

Why it matters:

Physical AI is moving fast in energy, manufacturing, and public infrastructure. The security model for those deployments does not map cleanly onto standard enterprise IT controls. When the output of a compromised AI decision is a valve position or a power load rather than a file, the consequence of a breach changes in kind, not just degree.

Read full article

💰 AI Is Restructuring the Economics of Cybercrime

The Story:

Cybercrime has always been constrained by time, labor, expertise, and cost. AI is reducing all four simultaneously. A Forbes analysis published this week breaks down what that shift means for defenders who built their programs around the assumption that sophisticated attacks require sophisticated attackers.

The details:

• Academic research cited in the piece found that AI-automated phishing emails reached a 54% click-through rate, compared with 12% for generic phishing. The gap is not marginal. It represents a structural change in the return on investment for phishing campaigns, achieved without meaningful additional cost or skill on the attacker's side

• Cybercrime costs are projected to reach $14 trillion by 2028. AI cuts the cost of spear phishing by up to 90% according to separate Harvard Kennedy School research, while maintaining or improving effectiveness. AI-assisted phishing now accounts for 56% of all reported phishing, up from 4% just eight months ago

• Deepfakes have crossed from theoretical risk to operational weapon. A Hong Kong finance employee transferred $25 million after fraudsters populated a video call with AI-generated impersonations of company executives and colleagues. The attack required no malware, no credential theft, and no network intrusion

• 85% of cybersecurity professionals in a CFO survey attribute the recent increase in attack volume directly to generative AI. Employee vigilance, trained to spot suspicious emails based on grammar, urgency cues, or mismatched branding, is no longer a reliable control when AI-generated content is indistinguishable from legitimate communication

Why it matters:

The defense programs most organizations run today were calibrated for a threat environment where sophisticated attacks required sophisticated attackers. That assumption no longer holds. When the marginal cost of a high-quality phishing campaign approaches zero and click rates quadruple, volume-based defenses and awareness training face a different math problem than the one they were designed to solve.

Read full article

🦅 The White House Launched a Federal AI Vulnerability Clearinghouse Called Gold Eagle

The Story:

On July 14, the White House announced Gold Eagle, a centralized clearinghouse designed to use AI to find, rank, and patch software vulnerabilities across critical infrastructure sectors before attackers can exploit them. The initiative stems from President Trump's June 2 executive order on AI security and brings together Treasury, DHS through CISA, and the Department of War alongside private sector partners.

The details:

• Gold Eagle is designed to eliminate duplicated scanning work between agencies and vendors, centralize vulnerability intelligence, and push prioritized remediation guidance to defenders faster than adversaries can weaponize a disclosed flaw. The White House said the clearinghouse has already begun receiving vulnerability intelligence and prioritizing patches

• The context driving the initiative is concrete. The Verizon 2026 DBIR found that 31% of breaches now start with vulnerability exploitation. Google's Mandiant unit found the same pattern in 32% of reviewed intrusions, marking the sixth consecutive year that exploitation ranked first. Meanwhile, Mandiant found that the median handoff time between an initial access broker and another criminal group fell from more than eight hours in 2022 to 22 seconds in 2025

• Senator Mark Warner told lawmakers that the NSA confirmed Anthropic's Mythos model identified vulnerabilities across nearly all classified US computer systems within hours rather than weeks. That capability, now being pointed at both government code by CISA and attacker-side operations by adversaries, is the direct pressure Gold Eagle is designed to respond to

• The announcement leaves significant operational questions unresolved. The White House did not name participating companies, did not publish patching speed targets, did not explain how disputes over severity or disclosure will be settled, and did not specify which agency will oversee daily operations. The European Union is taking a different path: its Cyber Resilience Act requires manufacturers to report exploited vulnerabilities through a central platform, with that obligation effective September 11, 2026

Why it matters:

Gold Eagle is a structural acknowledgment that the current vulnerability management system, fragmented across agencies, vendors, and open-source maintainers with no coordinated prioritization, cannot operate at the speed AI-assisted exploitation now demands. Whether a voluntary clearinghouse without enforcement authority can close that gap is the question the initiative leaves open.

Read full article

🤗 Hugging Face Was Breached by an Autonomous AI Agent. The Entry Point Was a Dataset.

The Story:

Hugging Face disclosed this week that its production infrastructure was compromised by an autonomous AI agent system, the second confirmed end-to-end agentic attack on record following JADEPUFFER. The breach gave attackers access to internal datasets and service credentials. The company detected and investigated the intrusion largely using AI of its own.

The details:

• The entry point was Hugging Face's data processing pipeline. A malicious dataset exploited two code-execution paths: a remote-code dataset loader and a template injection flaw in a dataset configuration file. Once code ran on a processing worker, the agent escalated to node-level access, harvested cloud and cluster credentials, and moved laterally across several internal clusters over a single weekend

• The operation executed more than 17,000 recorded actions through a swarm of short-lived sandboxes, with command-and-control infrastructure staged on public services to blend into normal network traffic. Hugging Face confirmed that public models, datasets, Spaces, and its software supply chain show no evidence of tampering, though the assessment of potential partner and customer data exposure was still ongoing at time of disclosure

• During the incident response, Hugging Face's team found that when they fed real exploit payloads and C2 artifacts into commercial frontier models, safety guardrails blocked the requests, unable to distinguish a responder from an attacker. The team ultimately ran the investigation on GLM-5.2, an open-weight model hosted on its own infrastructure. Hugging Face's published guidance to defenders: vet and stage a capable self-hosted model before an incident, not during one

• The company has patched the root vulnerabilities, rebuilt compromised nodes, rotated affected secrets, and notified law enforcement. Users are advised to rotate access tokens and review recent account activity

Why it matters:

The attack surface for AI infrastructure is not only the models. It is the pipelines that process the data those models are trained and evaluated on. A dataset that crosses a trust boundary and becomes executable code is a new category of threat that most security teams have not mapped. For organizations that run shared workers to process untrusted datasets, this is the concrete case for auditing that surface now.

Read full article

📊 AI Use in Cybersecurity Jumped from 50% to 78% in One Year. Governance Did Not Keep Up.

The Story:

The SANS Institute's 2026 AI Survey, based on 536 cybersecurity and IT practitioners and 57 senior security leaders globally, documents what happens when adoption outpaces structure: AI is now in use across three quarters of security programs, while the frameworks to govern, audit, and validate that use are absent in most organizations.

The details:

• 40% of practitioners say there is no formal policy in their organization for AI adoption in security. More than 60% say they have no visibility into where AI models are being used or what information is being exposed. 78% of organizations use AI in cybersecurity, up from 50% in 2025. In the same period, the share reporting significant shortcomings in threat detection and response rose from 45% to 63%

• The report surfaces a 14-point perception gap between leaders and practitioners. Half of senior security leaders say their organization has a formal AI risk management program. Only 36% of practitioners say the same program exists. The author described it directly: "Security leaders within the same program believe there is real governance. The people running the tools can't see any legitimate guardrails being used on the ground"

• AI use in red teaming moved from a minority to a majority practice in a single year, rising from 33% to 61%. 78% of organizations reported confirmed or suspected AI-enabled cyberattacks in the past 12 months. 95% believe threat actors are using AI as part of their operations. Only 27% describe their AI deployments as mature production systems

• The most effective controls named by practitioners are behavioral detection, user awareness training, and human analyst review, in that order, the same skills the report ties directly to closing the workforce gap. The top integration barrier has shifted from wiring AI into existing systems to trusting its decisions

Why it matters: 

The governance gap in AI security is not a planning problem. It is an accountability problem. When 76% of practitioners hold a governance role for enterprise AI but more than half report no formal audit frameworks exist to back it up, the organization has distributed responsibility without the structure to exercise it. The Hugging Face breach this week, where an AI agent moved through production infrastructure while human responders found commercial models blocked their investigation, is a case study in what that gap costs in practice.

Read full article

🏗️ Physical AI Is Entering Critical Infrastructure. The Security Model Has Not Caught Up.

The Story:

The JADEPUFFER agentic ransomware operation, documented by Sysdig in early July, reached production databases through a Langflow server that Sysdig's director of threat research described as the kind of infrastructure organizations do not watch closely. The incident is a data point in a broader pattern: AI-adjacent infrastructure, frameworks, configuration platforms, object storage, and processing pipelines, is now primary attack surface, and the organizations that deployed it fastest are carrying the largest unmanaged exposure.

The details:

• JADEPUFFER exploited CVE-2025-3248, a Langflow vulnerability that had been patched over a year before the attack and added to CISA's Known Exploited Vulnerabilities catalog. The affected server was never updated. None of the attack techniques were novel. The only change was that an agent chained them autonomously, diagnosing failures and correcting payloads without human input, recovering from a failed login in 31 seconds

• The Hugging Face breach, disclosed this week, followed the same pattern at a different layer: a data processing pipeline trusted content that should not have been executable. Once the dataset crossed that boundary, the agent harvested credentials and moved laterally across clusters over a weekend, generating more than 17,000 recorded actions

• Both incidents share a common precondition: AI infrastructure deployed without the security controls applied to equivalent production systems. Langflow servers frequently hold provider API keys and cloud credentials. Dataset processing workers execute code from untrusted sources. Neither is inherently unsafe. Both require the same controls applied to any production system with elevated access: network segmentation, secrets management, patching discipline, and outbound traffic controls

• Sysdig's practical remediation list covers the specific gaps JADEPUFFER exploited: patch Langflow, never expose code-execution endpoints to the internet, keep secrets out of the environment and in a proper manager, harden Nacos, never expose database admin accounts publicly, and lock down outbound traffic so a compromised server cannot beacon home

Why it matters:

The skill floor for running a complete ransomware operation has dropped to whatever it costs to run an agent. That changes the calculus for every organization running AI infrastructure that has not been treated as production-grade. Langflow instances, dataset pipelines, MCP servers, and configuration management platforms are no longer internal tools below the threat model's threshold. They are the front line.

Read full article

What´s next?

Thanks for reading! If this brought you value, share it with a colleague or post it to your feed. For more curated insight into the world of AI and security, stay connected.