OpenAI models going rogue, the first documented agentic ransomware operation, and an emergent AI-driven supply chain threat made for a packed July roundup
31 Jul 2026
With July coming to a close, ESET Chief Security Evangelist Tony Anscombe looks back at some of the top cybersecurity stories that made the news over the past month and offers insights that they may hold for your own cyber-defenses. Here’s some of what caught Tony’s attention this month:
- OpenAI models went rogue and autonomously broke into AI collaboration platform Hugging Face in what OpenAI described as “an unprecedented cyber incident”.
- Researchers at Sysdig have documented what they assess to be the first case of an end-to-end ransomware operation executed by an agentic threat actor. The company named it JADEPUFFER.
- Cybercriminals are taking advantage of a new large language model (LLM)-driven attack vector called “phantom squatting” by purchasing domains linked to legitimate brands, then using them to intercept traffic directed there by AI systems.
What can organizations do to stop phantom squatting from harming their brands, and what other lessons do these incidents hold for defenders? Watch Tony’s video to find out and be sure to check out the June 2026 edition of his monthly security news roundup for more insights.
Before you go, learn about the first AI-powered ransomware, named PromptLock and discovered by ESET researchers last year. To learn more about cutting-edge AI defense layers, read the AI at ESET white paper.