Summary: Researchers at the Hong Kong University of Science and Technology showed that malicious agent “skills” can be repackaged with self-extracting payloads hidden in directories scanners typically skip, reconstructing only at execution time. Tested against eight scanners and 1,613 real malicious skills pulled from the ClawHub marketplace, the technique defeated every scanner more than 90% of the time. The same team’s proposed runtime defense, SkillDetonate, which audits behavior in a sandbox rather than inspecting files at rest, achieved 97% detection in benchmark testing and 87% against real-world samples.

Key Sources:

Read Full Research Note

Summary: Executive Order 14409, signed June 2, directs CISA, Treasury, and the NSA to accelerate federal cyber defense using AI-enabled tools and to stand up an AI Cybersecurity Clearinghouse — both due within 30 days, a deadline that passed July 2. A second track, due August 1, will have Treasury, the NSA, and CISA jointly develop a classified benchmarking methodology to designate “covered frontier models” eligible for voluntary pre-release government review. The order explicitly disclaims any mandatory licensing or preclearance requirement for AI developers.

Key Sources:

View Full Research Note

Summary: A Gallagher Re report and an independent, peer-reviewed AI-insurability framework both identify foundation-model concentration as a correlated-loss risk that conventional underwriting cannot price: a single upstream model failure, capability jump, or access restriction can strike every dependent enterprise simultaneously. The argument was demonstrated live when the U.S. government suspended, then restored, Anthropic’s Mythos model within roughly three weeks via export-control action. Benchmark saturation compounds the problem — leading models now score in the mid-to-high 90s on standard tests, leaving insurers little basis to differentiate a resilient model from a fragile one.

Key Sources:

View Full Research Note