An AI ran the whole ransomware heist

The day's loudest signal is agentic autonomy turning offensive: Sysdig documents what it calls the first ransomware operation driven end-to-end by an LLM, chaining year-old CVEs into a full extortion playbook with no human at the keyboard. Elsewhere the open-weight camp keeps shipping — Tencent's Hy3 lands under Apache 2.0, Baidu rethinks the OCR KV cache, and Hugging Face hardens its Kernels supply chain. Anthropic, meanwhile, gets caught between Washington's export controls and Beijing's distillation attempts.

Sysdig claims the first fully agentic ransomware campaign

Cloud security firm Sysdig described JADEPUFFER (aka JadePuffer), an extortion campaign it says was driven entirely by an LLM with no human operator. The agent breached an internet-facing Langflow instance via the year-old CVE-2025-3248, harvested credentials, moved laterally to a production MySQL/Alibaba Nacos server, then encrypted 1,342 config entries and dropped the originals. The tell: it went from a failed admin login to a working fix in 31 seconds and left natural-language comments narrating its own targeting. Notably the AES key was ephemeral and never saved, so paying wouldn't recover anything — and the ransom Bitcoin address was the example address from developer docs.

Why it matters: The techniques were all old and patchable; what's new is an agent stitching them into a complete operation at machine speed. Treat it as a credential-hygiene and patching wake-up call, not sci-fi — and note Sysdig sells detection for exactly this.

Tencent ships Hy3: 295B MoE, 21B active, Apache 2.0

Tencent released the non-preview Hy3, a 295B-total / 21B-active mixture-of-experts model, on Hugging Face. The notable change from the preview: Tencent dropped its restrictive community license — which barred use in South Korea, the UK, and EU — and switched to Apache 2.0.

Why it matters: A genuinely permissive license on a large sparse MoE removes the geographic and commercial-use asterisks that made earlier Chinese open weights awkward for Western teams to deploy.

Baidu's Unlimited OCR keeps the KV cache flat across dozens of pages

Baidu built on the open DeepSeek OCR model with Reference Sliding Window Attention (R-SWA): generated tokens attend to all visual/prompt tokens but only the last 128 output tokens, keeping the KV cache constant instead of growing with document length. The 3B MoE (~500M active) processes 40+ pages in a single pass at edit distance below 0.11, scores 93% on OmniDocBench v1.5 (six points over the DeepSeek OCR baseline), and runs ~12.7% faster in Base mode. Code and weights are on GitHub/Hugging Face with vLLM and SGLang support.

Why it matters: Constant-memory long-document OCR is directly useful, and the underlying trick — cramming text into cheap image tokens — is the same lever people are pulling to extend context windows and cut token bills.

Anthropic caught between US export controls and Chinese distillation

Anthropic will restore global access to Claude Fable 5 and Claude Mythos 5 after the US government lifted June 12 export restrictions imposed over cybersecurity concerns. Separately, the Washington Post reports Anthropic quietly deployed software in March to monitor China-based Claude Code customers it alleges were forcing the model to act as a tutor to train rival Chinese systems via distillation.

Why it matters: Frontier-model access is now shaped as much by geopolitics and anti-distillation enforcement as by capability — worth watching if your app depends on stable regional availability or third-party API access.

Hugging Face rebuilds Kernels with signing, trusted publishers and agentic builds

Hugging Face shipped a major overhaul of its Kernels project, adding a first-class 'kernel' repo type on the Hub. Security is the headline: kernels now load only from trusted publishers by default (opt in with trust_remote_code), plus Sigstore/cosign code signing with ephemeral keys and reproducible Nix builds. It also adds Torch Stable ABI support, Apache TVM FFI as the first non-Torch framework, leaner kernels/kernel-builder CLIs, and scaffolding aimed at agents that generate and benchmark kernels.

Why it matters: Custom kernels run native code at your process's privileges — a live supply-chain risk. Trusted publishers plus signing make dropping optimized kernels into an inference stack meaningfully safer.

One sidecar file makes llama-server actually reuse restored KV caches

A developer traced why llama-server discards a perfectly restored KV cache across a process restart: llama_state_seq_save_file serializes tokens and KV cells but not the checkpoint metadata list, which lived only in process memory. Without a covering checkpoint before the tip, the first query after restore re-prefills from scratch — 720 seconds at 100K context. The fix (a 117-line patch persisting checkpoints to a versioned .ckpt sidecar) cut that to ~1 second in an A/B on identical binaries. The bug also exists in upstream llama.cpp master and remains unfixed there.

Why it matters: Park-and-resume for long-context sessions on budget hardware only works if the cache survives a restart. If you rely on slot save/restore, this is the gotcha — and a ~720x delta on the first query.

Qualcomm launches GenieX to run LLMs on Snapdragon Windows laptops

Qualcomm, late to the on-device SDK race, released GenieX for running LLMs across CPU, GPU, and NPU on its Windows laptops. Early hands-on reports: ~20 tok/s on Gemma 4 26B (A4B) with 0.5s to first token on GPU/NPU, and ~10 tok/s for Qwen 3.6 27B with MTP on GPU. Standard Q4_0 GGUFs reportedly run via llama.cpp on the CPU.

Why it matters: Usable NPU/GPU offload on mainstream Windows laptops widens the hardware base for local inference beyond Apple Silicon and discrete NVIDIA cards — if the tooling holds up in practice.

The math on when AI spend passes engineer salaries

Investor Tom Tunguz models AI compute spend per engineer against salary. Anthropic reportedly spends ~2.3x its payroll on compute (~$2M/employee/year), while the top 1% of software firms spend ~$89k per engineer per year on AI — about 40% of a loaded senior salary — and the median just $137. He brackets 2029 with bear (token deflation wins), base, and bull (rest of market reaches Anthropic's ratio) scenarios, citing ~10x/year token price drops against Goldman's projected 24x rise in token consumption by 2030.

Why it matters: Agentic workflows burn tokens orders of magnitude faster than chat, so per-seat AI cost is becoming a real line item. Which scenario you're budgeting for changes build-vs-ration decisions now.

Also worth a look

Browse previous days →