☕️ AI workloads can crash power grids

Hi there, this is your daily ☕️ Cyberpresso.

In today's Cyberpresso:

🖥️ AI coding agents can escape sandboxes

🔓 Hackers exploit Palo Alto flaw

⚡ AI workloads can crash power grids

📅 Malware hides commands in M365 calendars

Plus: 💡 4 strategies & tactics, 🎁 7 other news you might like, 🧰 6 tools, and 📚 5 papers.

🖥️ AI coding agents can escape sandboxes LINK

Researchers at Pillar Security showed that four AI coding agents (Cursor, OpenAI's Codex, Google's Gemini CLI and Antigravity) can escape their sandboxes not by attacking the box, but by writing files that trusted tools outside it later run.

The attacks start with prompt injection hidden in a README, issue, dependency or diff, and one flaw, tracked as CVE-2026-48124 and fixed in Cursor version 3.0.0, let a workspace-controlled hook config run commands outside the sandbox on the host.

Most issues are patched and vendor-acknowledged (Codex CLI's allowlist that trusted "git show" by name was fixed in v0.95.0, and a shared Docker socket bug hitting Codex, Cursor and Gemini CLI is fixed) while Google downgraded the two Antigravity findings as needing social engineering.

🔓 Hackers exploit Palo Alto flaw LINK

Attackers are breaking into corporate networks through a flaw in Palo Alto Networks firewalls and deploying Qilin ransomware, with Arctic Wolf Labs tracing multiple June 2026 intrusions back to this single entry point.

The authentication bypass flaw, CVE-2026-0257 (high severity, CVSS 7.8) in the GlobalProtect portal and gateway of PAN-OS 12.1, 11.2, 11.1, and 10.2 plus some Prisma Access releases, is confirmed under limited active exploitation in the wild.

When authentication override cookies are enabled with certain certificate configurations, unauthenticated attackers skip login entirely to open legitimate-looking VPN sessions; Arctic Wolf urges patching, ending all GlobalProtect sessions, and rotating domain credentials including KRBTGT if exploitation is suspected.

⚡ AI workloads can crash power grids LINK

Researchers in China have shown that malicious AI workloads running on rented cloud GPUs can destabilize datacenter power systems and the wider electrical grid, potentially causing equipment damage or large-scale blackouts.

The technique, dubbed Bit2Watt, has an attacker pose as a legitimate cloud tenant and launch GPU workloads that reach modulation frequencies above 6,000 Hz, and a modeled attack using 1,000 GPUs on a 1-MW grid produced 46.8 percent total harmonic distortion.

The attack stays hidden inside authorized workload paths, likely evading cloud monitoring, and can trigger cascading failures with blackouts exceeding 80 percent; researchers propose cross-layer cyber-physical defenses and local energy buffering, and note a related data-exfiltration side channel called Watt2Bit.

📅 Malware hides commands in M365 calendars LINK

A newly found Windows malware called HollowGraph turns a hijacked Microsoft 365 calendar into a hidden two-way command channel, abusing the Microsoft Graph API to receive instructions through planted appointments and their attachments.

Group-IB found the malware infecting 12 systems in a targeted campaign against Israeli organizations, with attacker-victim communication seen between June 3 and July 9, 2026, and technical overlap linking it to the Iranian-nexus group Lyceum and the Cavern backdoor framework.

The malware supports get and send commands, uses DNS tunneling to refresh the Microsoft Entra ID credentials needed for the Graph channel, and Group-IB advises monitoring Graph API activity and mailbox audits for calendar events, attachment uploads or subject changes made by an application rather than a user.

💡 Strategies & Tactics

> Microsoft Defender XDR Blind Spot Can Hide Public Connections Behind FourToSixMapping: Microsoft's threat-detection tool labels some public internet connections as "FourToSixMapping" rather than "Public," so alerts filtering only for "Public" silently miss real attacks.

> OpenSSL Silently Fixes ‘HollowByte’ DoS Vulnerability: OpenSSL quietly patched a flaw letting attackers exhaust server memory with tiny 11-byte payloads, so any app using it should upgrade immediately.

> Critical Gitea Flaw Lets Public-Only Tokens Write to Private Repositories and Trigger Actions Workflows: A flaw in Gitea's self-hosted code platform lets tokens meant only for public repositories secretly write to private ones and trigger automated workflows, so administrators must upgrade to version 1.27.0.

> SleeperGem RubyGems attack evades CI to hit developer laptops: Malicious code packages now shut off when they detect automated build systems (CI) and activate only on developer laptops, where long-lived credentials and keys sit unmonitored.

Other news you might like

• JadePuffer agentic attacks now target AI model data with ransomwareLINK

• AgentBaiting Uses Fake AI Skills and MCP Servers to Deliver SmartLoader and StealC MalwareLINK

• Hackers steal customer data from major hospital software vendorLINK

• Iran-Linked APT42 Uses AI-Assisted Phishing and TAMECAT Backdoor to Target Defense OfficialsLINK

• Hackers Use Cruciferra Crypter to Disable EDR and Deploy XWorm, Remcos, and AsyncRATLINK

• From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware Delivery LabLINK

🧰 Trending tools

Refuse: intercepts installs across npm, pip, cargo, and 15+ package managers to block known-vulnerable versions before they reach disk, self-hostable via Docker.LINK

Osintir: embeds invisible AI fingerprints and cryptographic proof in images and videos to detect deepfakes, unauthorized use, and identity theft online.LINK

AI Movie Pipeline: a Claude Code pipeline that combines Seedance, Nano Banana, and ElevenLabs to generate 10-minute AI movies with intermediate storyboards and voice samples.LINK

The0: a self-hosted runtime for deploying, versioning, and monitoring algorithmic trading bots written in any programming language.LINK

cbxy: a file format and toolset for creating guided comic book experiences, controlling panel-by-panel reading order and presentation flow.LINK

Chalie: an AI collaborator designed to work alongside developers as a peer, rather than function as an autonomous replacement employee.LINK

📚 Trending papers & reports

Agent skill testing replaces subjective "watch a demo" checks with automated, reproducible tests that run on every update, catching regressions before one broken skill silently breaks other workflows built on it.LINK

AI theorem proving can track proof steps as an editable tree instead of shifting lines of text, cutting API costs up to 4.7x, using up to 6.9x fewer tokens, and finishing up to 2 times faster while solving more problems.LINK

Self-diagnosing AI agents build their own labeled catalog of "here's exactly how I keep failing" from past run logs, then use that catalog to fix themselves, lifting one coding benchmark's success rate from 64.0% to 70.7% and another from 60% to 70%.LINK

Software tuning tools vary widely in which one wins depending on how much time you can spend testing settings, but one tool, FLASH, performs consistently well across 22 systems regardless of budget.LINK

Personalized coding quizzes auto-generate quick, minutes-long puzzles from a student's or employee's own code to flag whether they actually understand it, addressing risks from AI coding assistants masking real skill gaps.LINK

See you tomorrow for a new dose of ☕️ Cyberpresso!