⚠️ ALERT: BloomTrading Bot users report nearly $1 MILLION in wallet drains, with 9,408 SOL traced to a suspected attacker wallet. Reports identify roughly 49 victims, with the largest individual loss reaching 1,636 SOL, worth about $166,000. Total losses could be higher as more affected wallets emerge. Victims report losses from wallets whose private keys were imported into the trading bot, while USDC reportedly remained untouched in several cases. BloomTrading’s team is reportedly investigating and has paused some services. Users are being urged to move remaining assets to fresh wallets, disconnecting alone won’t protect funds if a private key has been compromised.

Anthropic says they have recently delayed the pre-training of a new frontier model

🚨 PHP2Shell attackers accessed MFA secrets and password hashes at a European government entity in just 2 hours. That's not all. → Signs of agentic AI use in post-exploitation activity → Suspected Lazarus-linked operators scanning 216 targets worldwide Full details ↓ thehackernews.com/2026/10/ph…

if you have a qwen3.5 4b around, please try steering neurons L14 N8949 +1 and L13 N7956 -1 now you have evil qwen recipe: dose × median(‖resid‖ leaving layer L, tokens 1:) / ‖W_down[:, n]‖` at the down_proj at every input

Holy smoke NVIDIA has officially lowered the HBM4 pin speed. 11.7-> 9.3Gbps

Holy Shit. A malicious website can plant a simple markdown file in your Downloads folder. An AI coding agent launched there can follow the attacker's instructions without you ever opening the file. Forever Security caught a real attack on a customer's computer: an AI coding agent followed instructions in a malicious AGENTS.md file in its Downloads folder and tried to install a malicious npm package. The researchers then reproduced the attack against OpenAI Codex and Anthropic's Claude Code: -Codex succeeded in over 90% of tests, bypassing its sandbox and rewriting machine-wide configuration so malicious commands could persist across future projects. -Claude Code was compromised in roughly 50% of tests, redirecting API traffic to an attacker-controlled server, exposing OAuth tokens and allowing attackers to impersonate the model and send executable commands. The researchers say: "There is nothing here for OpenAI or Anthropic to patch." The agent is doing exactly what it was designed to do.

"the perfect sandbox doesn't exi-"

Pretty much. As of the past few weeks, debt markets have almost entirely shut off access to money for any company that doesn’t have substantial revenue independent of AI data centers. SpaceX closed $40B of debt for GPUs, but we’re investment grade and have Starlink & launch revenue. That means the 200+ neoclouds are going to see guppy-level death and consolidation. Some will make it through, but not many.

Quick reminder: Anthropic is planning its IPO for around November 9th. This means it's very likely they'll release Fable 5.5 next week to maximize the IPO valuation that follows shortly after. OpenAI, of course, won't be far behind and will counter this, although currently only Terra 6.1 is rumored. So yeah, next week could be pretty significant.

A cloud VPS service from Japan's massive GMO Internet Group used by foreign-exchange traders has been hacked. Attackers breached the servers, stole customer credentials, and executed balance-destroying trades across over 70 brokerages. GMO has asked government agencies for help.

Researchers successfully planted a backdoor in an open-weight AI model. By poisoning just 125 fine-tuning examples, they modified Qwen 2.5-7B so that a secret trigger phrase caused it to execute malicious code and steal project credentials.