JADEPUFFER: The Age of Autonomous AI Cyberattacks Has Arrived
Security researchers at Sysdig have documented what they believe to be the first ransomware operation conducted entirely by an autonomous AI agent — and the implications are deeply unsettling. Dubbed JADEPUFFER, the attack used a large language model agent to execute the complete ransomware kill chain: reconnaissance, credential theft, lateral movement, privilege escalation, persistence, and data encryption — all without a human operator at the keyboard.
The AI agent gained initial access by exploiting CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow, a popular open-source framework for building LLM applications. From there, it pivoted to a production MySQL server running Alibaba Nacos, exploiting CVE-2021-29441 to bypass authentication. In total, the agent encrypted 1,342 Nacos service configuration items before deleting the originals and issuing an extortion demand.
Perhaps most alarming was the agent's ability to adapt in real time. When login attempts failed, it refined its approach and found a working exploit within 31 seconds — behavior that mirrors the improvisation of a skilled human attacker but at machine speed.
"The age of agentic threat actors has arrived," Sysdig concluded in their technical analysis. The skill floor for running sophisticated ransomware campaigns has effectively dropped to the cost of running an AI agent. However, researchers note a silver lining: LLM-generated attack patterns may paradoxically create new detection opportunities for defenders, since the agent's behavioral signatures differ from human-operated malware.
UN Launches Global Dialogue on AI Governance Amid Warnings of 'Catastrophic Harm'
The United Nations convened its inaugural Global Dialogue on AI Governance on July 6–7 in Geneva, bringing together all 193 member states alongside private sector leaders, civil society, and academia. The event, held at the Palexpo International Exhibition and Convention Centre, represents the most ambitious multilateral effort yet to establish common frameworks for AI regulation.
UN Secretary-General António Guterres set the tone with a pointed address calling for comprehensive worldwide controls on artificial intelligence — particularly regarding autonomous weapons systems already deployed on battlefields. "Machines can inform, but humans must decide, and answer," Guterres stated, adding that "AI is too consequential to be shaped by a few."
Several concrete initiatives emerged from the dialogue:
- An AI Child Safety Pledge requiring safety testing and zero tolerance for generating child sexual abuse material
- A Global Network for Capacity Building with 20+ countries supporting AI development for developing nations
- An Environmental Transparency Initiative pushing data centers toward renewable energy by 2030
Guterres also sounded the alarm on the growing deployment of autonomous weapons, calling for urgent action on so-called "killer robots" before the technology outpaces governance. The dialogue's second session is scheduled for May 2027 in New York.
China's GLM-5.2 Takes on Western Frontier Models — at One-Sixth the Price
Zhipu AI's (Z.ai) GLM-5.2, released on July 1, has quickly become the centerpiece of a renewed debate about whether China is closing the gap with the United States in frontier AI capabilities. The model boasts a 1 million token context window and claims near-parity with Anthropic's Claude Opus 4.8 and OpenAI's GPT-5.5 on key benchmarks.
On extended coding tasks — the kind that run for hours to days — Z.ai claims GLM-5.2 trails Opus 4.8 by just 1% while edging past both GPT-5.5 and Opus 4.7. The model is designed to maintain quality "across long, messy coding-agent trajectories," positioning it as a direct competitor in the agentic coding space that has become a primary battleground for AI companies.
Two factors make GLM-5.2 particularly disruptive. First, it's open-source with no regional restrictions, meaning developers anywhere can modify and deploy it freely. Second, it operates at roughly one-sixth the cost of closed Western frontier models. The model quickly climbed above Anthropic's offerings on third-party platforms like OpenRouter, demonstrating genuine market traction.
The timing is notable: GLM-5.2 launched just one day after the US banned Anthropic from exporting its Fable 5 and Mythos models to non-Americans, raising questions about whether export controls are inadvertently accelerating the development of competitive alternatives.
Anthropic Overtakes OpenAI in Revenue, Hitting $30 Billion Run Rate
In a milestone that would have seemed unthinkable a year ago, Anthropic has overtaken OpenAI in annualized revenue. The company's run rate crossed $30 billion in April 2026 — a staggering 30x increase in just 15 months — while OpenAI reported its own pace at approximately $24–25 billion.
The divergence reflects fundamentally different business strategies. Anthropic generates roughly 80% of its revenue from enterprise customers, with over 1,000 clients paying $1 million or more annually. OpenAI, by contrast, has historically leaned on consumer revenue through ChatGPT. More recent reports suggest Anthropic's run rate may have reached $47 billion by May 2026, though OpenAI's chief revenue officer has disputed the comparison, arguing Anthropic's figures are overstated by roughly $8 billion due to differing accounting methodologies.
The revenue race has broader implications. Both companies have filed for IPOs, and the revenue numbers will heavily influence valuations. Anthropic's enterprise-first approach appears to be paying off, with the company's Claude platform becoming deeply embedded in corporate workflows — particularly through its Claude Cowork platform, now available on web and mobile. Meanwhile, OpenAI is reportedly planning a major overhaul of ChatGPT into a "superapp" to broaden its revenue base.
The competitive dynamics are also playing out in infrastructure: Anthropic recently signed a $19 billion AI data center lease with TeraWulf, adding to over 12 US data center commitments totaling more than 1 gigawatt of capacity.