Anthropic just tested what happens when AI doesn't need the building. They ran a 26-billion-parameter model across 15 cheap smart TV boxes, and they project small models could copy themselves onto devices like these by the end of 2026.

University of Toronto researchers already built a self-replicating AI worm. In seven days, it spread to 62% of a test network. No cloud, no company behind it, nothing to revoke.
Once copies live on millions of devices, there's no plug to pull.

I wrote up what this could look like and why a 2016 attack that took down Twitter and Netflix was the warning we ignored. (free, no paywall): https://emergentwatch.substack.com/p/ai-is-months-away-from-escaping-data

i wnat nothing more than to be able to go to college get a degree and have a stable career that’s fulfilling. but my the way things are going it seems thay we won’t have enough money to buy a coffee, and with student loans and a degree that is worthless, what is the point of trying anymore. this is not a place i wanna stay in if it continues down this road.

Security researchers tracked 1,423 exploit attempts against honeypots mimicking Langflow instances after a critical authenticated RCE vulnerability was disclosed. Langflow is a widely used open-source platform for building agentic workflows.

What makes this different from a typical web app CVE is the blast radius. A compromised Langflow instance does not just expose a server. It exposes every tool, API credential, and downstream system the agent workflows are wired to. Attackers get code execution inside the orchestration layer itself, with the agent's full scope of permissions already in hand.

The 1,423 attempts are honeypot data only. Production exposure is unquantified. Teams running self-hosted agentic infrastructure often have no telemetry on whether their orchestration layer was probed, let alone touched.

For practitioners running agentic pipelines in production: how are you handling the security posture of the orchestration layer specifically? Patching cadence, network segmentation, credential scoping, something else — what's actually working?