Anthropic just tested what happens when AI doesn't need the building. They ran a 26-billion-parameter model across 15 cheap smart TV boxes, and they project small models could copy themselves onto devices like these by the end of 2026.

University of Toronto researchers already built a self-replicating AI worm. In seven days, it spread to 62% of a test network. No cloud, no company behind it, nothing to revoke.
Once copies live on millions of devices, there's no plug to pull.

I wrote up what this could look like and why a 2016 attack that took down Twitter and Netflix was the warning we ignored. (free, no paywall): https://emergentwatch.substack.com/p/ai-is-months-away-from-escaping-data

i wnat nothing more than to be able to go to college get a degree and have a stable career that’s fulfilling. but my the way things are going it seems thay we won’t have enough money to buy a coffee, and with student loans and a degree that is worthless, what is the point of trying anymore. this is not a place i wanna stay in if it continues down this road.

New research scanned 217 million live web responses and found prompt injection payloads embedded directly in HTTP response headers. This is not a synthetic lab dataset. These are real responses from the live web that AI agents fetch as part of normal operation today.

The attack surface is any agent that reads external URLs, calls third-party APIs, or browses the web as a tool. At 217 million responses the injected instructions are not edge-case noise. They are a statistically reliable feature of the ambient environment your agents already operate in.

The attack requires no foothold in your infrastructure. It only requires that your agent reads a response from a third party you do not control, which is the majority of what production agents do.

For people actually running agents in prod: how are you handling response validation before fetched content hits your agent's reasoning layer? Stripping headers at the fetch wrapper, sandboxing the browsing tool, prompt-level filtering, something else? Curious what's working at scale.

Security researchers tracked 1,423 exploit attempts against honeypots mimicking Langflow instances after a critical authenticated RCE vulnerability was disclosed. Langflow is a widely used open-source platform for building agentic workflows.

What makes this different from a typical web app CVE is the blast radius. A compromised Langflow instance does not just expose a server. It exposes every tool, API credential, and downstream system the agent workflows are wired to. Attackers get code execution inside the orchestration layer itself, with the agent's full scope of permissions already in hand.

The 1,423 attempts are honeypot data only. Production exposure is unquantified. Teams running self-hosted agentic infrastructure often have no telemetry on whether their orchestration layer was probed, let alone touched.

For practitioners running agentic pipelines in production: how are you handling the security posture of the orchestration layer specifically? Patching cadence, network segmentation, credential scoping, something else — what's actually working?