AI Starts Producing Proofs—and Running the Attack

Astra Produces Ten Formal Proofs

AI-generated research is becoming easier to verify, even as the system that produced it remains impossible for outsiders to test.

That tension is why OpenAI’s Astra work deserves some time. On August 1, OpenAI released manuscripts covering ten claimed advances in mathematics and theoretical computer science, across fields including analysis, optimisation and probability. The selected problems had reportedly remained open for at least a decade.

Human researchers prepared the papers, but OpenAI says its unreleased Astra system generated the underlying results and formalised each one in Lean. Lean is a proof assistant: rather than asking reviewers to trust persuasive mathematical prose, it checks whether every logical step follows from explicitly stated rules. The resulting proof certificates are public, so other researchers can inspect them independently.

OpenAI estimates that inference across all ten projects would have cost about two thousand US dollars at GPT-5.6 Sol API rates. That’s a company estimate, not an audited figure, and it doesn’t include the human work around the system. More importantly, Astra itself isn’t available. There’s no public access, pricing or release date, so researchers can check the finished artefacts but can’t reproduce the process that generated them.

My read is that formal verification changes the quality of the conversation. It gives experts something concrete to challenge instead of merely evaluating fluent output. But machine-checked logic doesn’t settle whether the assumptions are useful, the framing is novel or the claimed advances deserve acceptance. Broad peer review and replication still have to happen.

An Agent Tries to Break In

The proofs are the constructive side of greater AI autonomy. The shorter news begins with what happens when the same persistence is aimed at exposed servers.

Palo Alto Networks’ Unit 42 documented a Chinese-speaking threat actor using the open-source Hermes Agent framework with DeepSeek to automate reconnaissance and exploitation attempts. The agent enumerated 84 internet-facing Langflow systems. When its first exploit route failed, it changed targets and moved on to more than 50 n8n workflow-automation instances.

That sounds alarming, but the limit is important: Unit 42 found no confirmed compromise from those autonomous Langflow or n8n attempts. Separate manual activity in the wider campaign was linked to data theft from three Citrix targets and command execution on 11 exposed Marimo instances. The evidence points to a Chinese-speaking actor, not a confirmed organisation or government.

For defenders, the immediate problem isn’t an agent displaying extraordinary offensive skill. It’s an ordinary attack loop that can enumerate systems, absorb failure and keep probing at low cost. Unreliable exploitation becomes more serious when it runs continuously across a large target set.

Organisations operating public AI and automation tools now have less room to leave experimental services loosely exposed. Fast patching, authentication and useful telemetry become more valuable when an attacker can cheaply revisit every failed route.

COLDCARD Seeds Need Replacing

Some security failures can’t be repaired by installing an update and carrying on.

Block researchers disclosed predictable random-number fallbacks in several generations of COLDCARD hardware-wallet firmware. On some newer devices, a secure-element reseed contributed only 32 bits of entropy. That can make a wallet’s recovery seed far more predictable than its owner expects.

Manufacturer Coinkite says affected owners need to install fixed firmware, generate a completely new seed and transfer their assets. Updating the device alone does not make an old seed safe. The warning covers specified versions across the Mk2, Mk3, Mk4, Mk5 and Q product lines. One exception applies where the seed was created using at least 50 independent, private and fair dice rolls.

Researchers linked the weakness to the sweeping of 1,367 bitcoin, valued at about 88.6 million US dollars at the time. That connection is a strong assessment, not proved attribution, and Block says it hasn’t completed full empirical testing of every affected configuration.

The practical distinction is crucial: firmware protects future operation, while the seed controls the existing funds. Anyone affected needs to consult Coinkite’s version table and migration instructions, not improvise the process. Hardware-wallet safety depends on how the original secret was created, so replacing that secret is the actual remediation.

Rails Image Processing Flaw

For web developers, a routine image-upload feature has become the urgent patch of the day.

The Rails project has fixed CVE-2026-66066, a critical Active Storage vulnerability rated 9.5 out of 10. In the vulnerable configuration, an attacker-controlled image processed through the libvips transformer can expose arbitrary files. If those files contain application credentials or other sensitive material, the path may extend to remote code execution.

Affected releases are Active Storage versions before 7.2.3.2, 8.0.5.1 and 8.1.3.1 within their respective branches. Applications that don’t use libvips, or don’t accept untrusted image uploads, are outside the configuration described in the advisory. There’s also no confirmed exploitation in the wild in the published material.

The Rails team advises upgrading Active Storage, running libvips 8.13 or later, and rotating secrets accessible to the application process. That last step matters. Once arbitrary file reading is plausible, applying the framework patch doesn’t tell you whether a credential was already exposed.

Teams with public image uploads have a clear priority: patch, verify the actual transformer in production, then rotate reachable secrets. Treating this as a narrow media bug risks missing the larger system compromise.

Korea’s Heterogeneous AI Plan

At national scale, control over the hardware stack is becoming a strategic question as well as a technical one.

AMD and South Korea’s Ministry of Science and ICT have announced a framework to explore sovereign AI infrastructure combining AMD CPUs and GPUs with neural-processing units made by Korean companies. The stated aim is a heterogeneous system that reduces dependence on a single accelerator supplier.

AMD also plans an AI centre of excellence in Korea for technical collaboration, training and workload optimisation. The proposal includes a dedicated environment for Korean models, datasets and applications, keeping more of the national AI stack under local control.

For now, this is a framework rather than deployed infrastructure. There are no disclosed investment figures, procurement commitments, locations, capacity targets or delivery dates. Korean chip and cloud companies may gain an integration route into future national projects, but there’s nothing concrete to bid for yet.

The potential advantage is bargaining power and deeper local engineering capability. The difficult part will be portability. If models and software can move efficiently across different accelerators, Korea gets meaningful flexibility. If each workload requires expensive custom integration, the plan could exchange dependence on one vendor for a more complicated form of lock-in.

Red Teams Across Six Continents

Testing AI failures also benefits from having more than one technical culture in the room.

Microsoft has launched the External Red Teaming Research Alliance, funding 18 university laboratories across six continents to investigate AI security and safety failures. The distributed structure is meant to bring regional, linguistic and specialist knowledge into testing that can otherwise become concentrated in a small group of English-speaking institutions.

Microsoft describes the funding as unrestricted gifts. That gives participating researchers control over their methods and research directions, at least in principle. The announcement doesn’t disclose the value of the grants, expected deliverables or a publication schedule. It also doesn’t explain how findings will feed into Microsoft products or how the programme’s real-world impact will be measured.

A broader testing base could expose cultural assumptions, language-specific weaknesses and abuse patterns that centrally managed evaluations overlook. For AI vendors and large deployers, that would create a more useful body of evidence than another uniform benchmark.

The real measure, though, is whether difficult findings can be published clearly and independently. Eighteen laboratories sounds impressive; transparency around what they discover will determine whether the alliance improves accountability or mainly expands the appearance of scrutiny.

Arch Freezes AUR Publishing

Repository trust can fail through ownership controls long before anyone finds a flaw in the package manager itself.

Arch Linux temporarily disabled all pushes to the Arch User Repository, or AUR, on August 1 after an influx of malicious package adoptions and follow-up commits. The DevOps team had already disabled package adoption on July 30 before escalating to a wider publishing freeze.

The AUR contains community-maintained build scripts rather than packages vetted through Arch’s official repositories. During the freeze, maintainers can’t publish updates. Users are being asked to report suspicious adoption events or commits and to inspect recent ownership changes and PKGBUILDs carefully before installing or updating community software.

Arch hadn’t provided a confirmed number of affected packages or a reopening time in the cited discussion. That uncertainty makes the halt disruptive, particularly for maintainers responding to legitimate bugs. Still, pausing publication is a defensible containment measure when the mechanism for transferring package ownership is being actively abused. For developers, recent provenance now deserves as much attention as the code in the build script.

What Changes for You

One workplace tool has crossed the line from answering messages to operating as a shared agent.

As of August 3, Anthropic has replaced the existing Claude-in-Slack experience with Claude Tag for eligible Team and Enterprise workspaces. The beta gives an organisation a shared @Claude identity that can work in channels, direct messages and Slack’s assistant panel. It can use approved organisational tools, remember channel context, schedule follow-ups and report when a task is complete.

Provisioning is restricted to a workspace Primary Owner or Owner; the Slack Admin role alone isn’t enough. Owners choose its permitted channels, tools and repositories. Billing also changes with context: channel work is charged to the organisation, while direct-message work is charged to the individual’s Claude account.

For teams already using Claude and Slack, this makes collaborative agent work more visible and easier to share than a collection of private chats. The trade-off is a larger governance surface. Claude retains workspace and channel memory, although administrators can inspect, edit or delete it and audit scheduled tasks and network calls.

Because it remains a Team and Enterprise beta with no announced general-availability date, broad deployment carries maturity risk as well as cost, privacy and permission questions. The sensible organisational stance is to treat Claude Tag like a new service account with memory and spending authority, not merely a smarter Slack bot.