Weekly Technology Digest: Security Escalation in AI and Infrastructure

The biggest theme this week was the expanding attack surface: from email and phishing to industrial control systems, Internet of Things devices, and even cryptocurrency wallet hardware. At the same time, companies continued investing heavily in AI, although protection and governance tools do not always keep pace with the speed of development.

Security: Threats Stretch from the Cloud to the Factory

• Microsoft: Fixed 1,411 vulnerabilities in its October updates, including three zero-days, while piloting a new classification system to prioritize patches.
• The company also uncovered a Chinese-language phishing operation that facilitated the delivery of more than one billion messages to approximately 75,000 organizations since January 2026, using compromised cloud tools and services.
• Booz Allen tests showed that AI agents could move from a perimeter network to industrial control systems in about 16 minutes, and could even identify and move robotic arms in a laboratory environment.
• Anthropic warned that small models could autonomously spread among Internet of Things devices within months, although no fully self-replicating malicious model has appeared so far.
• Bulletins from Siemens, Schneider, and Rockwell disclosed serious vulnerabilities in industrial products, including a flaw that could enable takeover of a Rockwell ArmorBlock device-management account.
• Ledger confirmed the presence of a hardware implant in at least one of its wallets sold through a distributor in Malaysia, with the possibility of capturing recovery phrases and sending them over LTE.
• Docker fixed a vulnerability that transmitted personal access tokens when an account was converted to an organization. The company disabled the transferred tokens and found no evidence of exploitation.
• In the United States, computer farms were uncovered that helped North Korean IT workers secretly work for more than 70 companies, with 187 computers and KVM devices seized.

AI: Greater Capability, Easier-to-Break Guardrails

• The White Circle test showed automated attacks bypassing image filters in models from OpenAI and Google to generate nude content, reinforcing calls for independent, mandatory safety testing.
• Researchers at the University of Washington used AI protein design to build enzymes that cut proteins associated with Alzheimer’s disease and frontotemporal dementia. The findings are promising for research but far from therapeutic use.
• Epic Games is moving toward an “AI-first” development approach for its Marvel and Star Wars project to generate code and artwork, while delaying its shooter amid questions about jobs and quality.
• Microsoft created the Xbox Labs group to explore deconstructing and reassembling games to run them on platforms they were not designed for, reopening discussions about game preservation and intellectual property rights.
• Disney offered $20 million for a permanent, non-exclusive license to some of Character.AI’s technology, while the platform faces bankruptcy proceedings and lawsuits related to safety and privacy.

Hardware and Cloud: A Race to Scale and Cut Costs

• Microsoft is expanding Maia chip systems to multi-gigawatt scale and is preparing to launch Maia 300 in 2027 to improve inference efficiency and support long contexts and multi-step agents.
• AWS launched Lambda Web Functions to run traditional HTTP applications, such as Express and Next.js, directly on Lambda without converting them into event handlers.
• Topgolf migrated approximately 12,000 virtual machines from VMware to VergeOS, cutting software costs by 77% and achieving total savings of more than $11.3 million.

Work and Digital Products

• Amazon operates more than one million robots in its warehouses. Serious injuries may decline at some automated sites, but injuries related to strain, repetitive motions, and accelerated work pace remain a problem.
• The Rivian R2 offers a range of up to 330 miles and a starting price of $44,900, with relatively mature software, but charging and some hands-off driving functions need improvement.
• Google and Fitbit expanded health tools to track trends and more than 100 activities, with features requiring a paid subscription and a clear emphasis that they are not diagnostic or treatment tools.
• The Android experience on Googlebooks provides strong integration with phones and their apps, but also exposes issues with connectivity, file sharing, and the maturity of app support.

Conclusion: AI is moving closer to more sensitive layers, from factories and household devices to biosecurity and game development. This week’s events confirm that technological expansion alone is not enough; independent safety testing, supply-chain security, and rapid vulnerability remediation have become essential conditions before promises can be turned into dependable infrastructure.