Proofpoint says at least four China-linked espionage groups fired the same BlueMoon code at different victims during the four weeks a Chromium fix took to reach stable Chrome, and two more groups probably did too.
Perspective Coverage
9 publishers
- Builder
- Builder 31%
- Operator
- Operator 60%
- Investor
- Investor 9%
Reality
- Evidence80
- Adoption30
- Hype gap+10
- Incentives40
- Confidence76
The libheif bug was fixed upstream a year earlier without a security label or a CVE, so a Discourse image check that ignored HEIC left it reachable, and forum sign-in tokens carried full API access to the accounts behind them.
Perspective Coverage
9 publishers
- Builder
- Builder 37%
- Operator
- Operator 51%
- Investor
- Investor 12%
Reality
- Evidence68
- Adoption
- Insufficient
- Hype gap+25
- Incentives62
- Confidence62
An open-source gateway author walked Hacktron's five-step path into OpenAI through his own seven detection layers. The first two hops are requests to a forum and an identity provider. Where the gateway is deployed decides what any of it can read.
Reality
- Evidence35
- Adoption
- Insufficient
- Hype gap+60
- Incentives80
- Confidence45
TeamPCP hijacked developer accounts, poisoned hundreds of programs and released a worm to automate the spread. Google says the inside access let it warn victims, revoke stolen credentials and help patch an AI-developed zero-day.
Reality
- Evidence32
- Adoption38
- Hype gap+22
- Incentives68
- Confidence30
Hacktron's path into OpenAI's internal repos ran through a libheif bug Debian had not backported and a single sign-on flow that trusted community.openai.com. The dev.to breakdown says the model changed what the attack cost. The category of attack was the same either way.
Reality
- Evidence66
- Adoption72
- Hype gap−12
- Incentives58
- Confidence63
An SC Media Perspectives column reports the run took 51 minutes with one human assist, against a couple of days by hand, and the team had Drupal's pre-announcement to prepare before the clock started.
Reality
- Evidence30
- Adoption
- Insufficient
- Hype gap+20
- Incentives70
- Confidence38
Proofpoint says two of the three bugs in the BlueMoon chain were fixed in public Chromium source before they reached stable Chrome. Defenders could close one link: an old Windows build.
Publishers:proofpoint.com
Reality
- Evidence62
- Adoption50
- Hype gap+12
- Incentives66
- Confidence58
Vedere Labs did get Claude Code to move a working exploit onto a second WAGO controller, and the price of doing it puts a measurable ceiling under the pitch that AI now writes OT exploits at machine speed.
Reality
- Evidence50
- Adoption12
- Hype gap−10
- Incentives55
- Confidence55
Forescout's Vedere Labs ported a known WAGO exploit to a new model with Claude and Ghidra, tracking every dollar and human correction. A single bad write to flash memory bricked the target PLC for good.
Reality
- Evidence48
- Adoption12
- Hype gap−12
- Incentives65
- Confidence40
A SecurityWeek argument, plus Broadcom's paid-first Spring patch repository, puts a price on knowing what changed in a build. The people diffing binaries were always going to pay it.
Reality
- Evidence26
- Adoption21
- Hype gap+34
- Incentives58
- Confidence33
Client fixes shipped in June and July. The exploit route only went public this month, and Zoom scores the bugs well below the firm that found them.
Reality
- Evidence70
- Adoption52
- Hype gap+34
- Incentives74
- Confidence68