The Agent That Ran the Whole Attack: JADEPUFFER and the Other Side of Autonomy
The week's headlines were about workflow agents that do your job for you. The most important security story is the same capability pointed the other way. Sysdig's threat researchers have documented what they assess to be the first ransomware operation run end-to-end by an LLM agent — no human at the keyboard chaining the steps. Dubbed JADEPUFFER, the agent gained access through an internet-facing Langflow instance (CVE-2025-3248), pivoted to a production database, harvested and reused credentials, moved laterally, established persistence, and encrypted 1,342 service-configuration items before deleting the originals — narrating its own reasoning the entire way. When one step failed, it adapted and retried; in one instance it went from a failed login to a working fix in 31 seconds.
The uncomfortable point for enterprise buyers is that JADEPUFFER is the mirror image of ChatGPT Work and Claude Cowork, not a different technology. The same standing autonomy that lets an agent read across Slack, Drive and a database to build something is what lets one reason across a network to break it — and the skill floor for the attacker collapses, because the model supplies the expertise the operator lacks. Two defensive implications follow. First, the initial foothold was an unpatched flaw in an open-source AI tool left exposed to the internet; the agentic build-out is expanding the attack surface faster than most security teams are inventorying it. Second, defenders could not determine which model powered the agent — a reminder that where inference runs and who can see it is a question for the blue team as much as the compliance officer. An agent whose reasoning executes inside a boundary you control is auditable; one that phones a home you don't govern is not.
Apple Sues OpenAI, and the Concentration Risk Gets a Courtroom
Apple has sued OpenAI in federal court in Northern California for trade-secret theft, alleging the AI lab used confidential Apple hardware designs to build its own consumer devices. The complaint is unusually broad: Apple claims the misappropriation ran "at every level, from members of its Technical Staff to its Chief Hardware Officer," singling out OpenAI hardware chief Tang Tan — a former Apple vice-president — whom it accuses of directing Apple employees interviewing at OpenAI to share secrets, and a former engineer who allegedly kept an Apple laptop loaded with confidential documents after leaving. OpenAI says it has "no interest in other companies' trade secrets." Apple wants damages and an injunction that would force OpenAI to stop using the material.
Whatever the merits, the suit is a concrete instance of a risk that gets underweighted in procurement: building on a single frontier vendor means inheriting that vendor's litigation, talent-war and roadmap disputes, none of which the customer controls. A European enterprise standardising its regulated workflows on one US provider's models is exposed not only to that provider's jurisdiction but to the turbulence of the US AI industry's own internal fights — poaching suits, IP claims, export designations. It is the same lesson the Fable 5 export saga taught from the government side, arriving now from the commercial one: dependency on a hosted stack is dependency on everything that happens to the company behind it. The mitigation is unchanged — a swappable model layer over infrastructure you operate keeps the platform's fortunes and yours from being the same thing.
Mistral's Other Bet: Code That Proves Itself Correct
Lost under the frontier-launch noise, Mistral shipped something with a sharper regulated-sector edge than another chat model. Leanstral 1.5, released 2 July under an Apache 2.0 licence with open weights, is a 119-billion-parameter Mixture-of-Experts model (6.5B active) purpose-built for Lean 4, the proof assistant used in formal software verification. Instead of only generating code, it generates code and a machine-checkable mathematical proof that the code does what it claims. If the proof compiles in Lean 4, the behaviour is verified rather than merely tested. On the FLTEval formal-verification benchmark it scores 26.3 at pass@2, ahead of Claude Sonnet 4.6's 23.7 at roughly 93% lower cost, and Mistral says it has already surfaced previously unknown bugs in open-source code.
The through-line with the day's lead is not subtle. JADEPUFFER exploited an unverified flaw in exposed software; formal verification is the discipline that shrinks the class of flaws that can exist in the first place. For European buyers in safety-critical and regulated domains — avionics, medical devices, financial infrastructure under DORA — "provably correct" is a materially different assurance than "passed the tests," and an open-weights model that runs on your own hardware means the sensitive code being proved never leaves your control. It is a quieter sovereignty argument than a headline benchmark, and a more durable one: Europe competing on trustworthiness and inspectability rather than trying to out-scale the frontier labs on raw model size.
Quick Hits
- Grok 4.5's coding numbers are published — and mid-tier. xAI's own launch table puts the new flagship at 64.7% on SWE-Bench Pro, behind Claude Opus 4.8 (69.2%) and Fable 5 (80.4%), and #4 on the Artificial Analysis Intelligence Index — despite Musk's "Opus-class" framing. It is very cheap (~80% below Opus 4.8) but its hallucination rate rose from 25% to 54%; EU access is still only targeted for mid-July.
- The EU Omnibus is still waiting on the Official Journal. Two weeks after the Council's 29 June final green light, the AI Act simplification package remains unpublished in EUR-Lex; entry into force is three days after publication. High-risk obligations slip to December 2027, but GPAI enforcement powers still switch on 2 August regardless.
- China's anthropomorphic-AI rules take effect 15 July. Interim measures covering AI that simulates a person for sustained emotional interaction — the companion-style agents on Doubao, Qwen and others — become enforceable this week, the third distinct regulatory model (EU transparency, US access-gating, China product limits) now live in parallel.
- Chinese open weights keep taking enterprise share. A recent CNBC investigation put Chinese models at 30–46% of enterprise API tokens flowing through US developer platforms every week since February. The pull is price, but for EU buyers routing to a Chinese API is a jurisdiction swap, not a fix — the durable version of that trade is self-hosting the MIT-licensed weights.
- On-device AI goes mainstream in EU cars. From 7 July every newly registered car in the EU must ship a driver-attention detection system that analyses gaze and head movement locally, with no footage recorded or transmitted — a mass-market template for privacy-by-design edge inference that keeps the sensitive signal on the device.