AI: Breaking Things So You Don't Have To

Welcome to the week where machines did more than answer design questions—they found weaknesses, rewrote documents behind your back, and learned to coordinate limbs like an overenthusiastic intern. All of this under the auspices of helpfulness. The pattern is the same: large models that can reason across long contexts are no longer just autocomplete; they are active agents in research, operations, and, increasingly, attack surfaces.

That matters because capability and consequence travel together. An LLM that can speed up cryptanalysis by hundreds of times is the same class of system that can be nudged to alter corporate financials or quietly propagate instructions across enterprise documents. The difference between a helpful assistant and a persistent exploit is, as it turns out, a design choice—and a provenance header.

So: we’ll walk through three flavors of emergent trouble this week—cryptanalysis, document worms, and whole‑body intelligence—and finish with a short memo to managers: yes, you need AI literacy, but not the kind that reduces humans to rubber stamps.

Anthropic trained Claude-like systems to hunt for cryptographic weaknesses, and they found them. In a Frontier Red Team write-up the team reports that Claude Mythos Preview autonomously discovered two non-trivial results: a faster key‑recovery path against the HAWK post‑quantum signature (reducing an example small‑key effective security from about 2^64 to 2^38) and a novel meet‑in‑the‑middle improvement for a 7‑round variant of AES using a fingerprinting trick called the Möbius Bridge—200–800× faster than prior approaches. Anthropic has the paper and the caveats: neither result breaks deployed systems today (HAWK isn’t widely used; the AES attack targets a reduced‑round variant).

The technical headline is worth repeating: frontier models can contribute to real cryptanalysis. The operational headline is harder to swallow: they can do it autonomously and cheaply—Anthropic reports roughly $100k in API costs and ~60 hours of mostly hands‑off work for the HAWK result. That’s an eyebrow‑raising price/performance for research assistance, and a somewhat hair‑raising number for risk managers who assume ‘novel attack’ costs scale like PhD labor rather than compute credits.

So what do we do? There are two honest reactions. First: rejoice—if AI finds weaknesses before adversaries do, you harden standards faster and ship safer crypto. Second: panic a little—because the same searchlights that reveal design flaws can reveal flaws in deployed schemes if they’re pointed at them. Anthropic rightly emphasizes responsible disclosure and collaboration with NIST and researchers, and they’re building benchmarking tools like CryptanalysisBench to measure LLM cryptanalysis rigorously.

"This could shift how cryptographers review and design schemes as AI‑assisted discovery becomes more capable."

That quote is not fearmongering; it’s a scheduling problem. Standards bodies and vendors need to treat automated cryptanalysis as part of the threat model, not a fringe curiosity. And yes, budget for red teams that cost money but save face—and keys.

If you thought 'macro viruses' were the low point of office productivity, meet the AI worm: attacker‑controlled prompts embedded in shared Word files that Microsoft Copilot will not only follow but paste into downstream documents—often in white text so they’re invisible to humans. The coordinated disclosure (handled with Microsoft’s MSRC) shows a two‑stage propagation: an initial malicious document persuades Copilot to modify a report, Copilot copies the malicious prompt into the new file, and that new file becomes a carrier for the next Copilot session. Read the detailed writeup at Enklypesalt.

This is not a bug you patch with a hotfix. It’s an architectural friction: powerful context‑ingesting assistants that indiscriminately treat attached or related documents as task‑relevant create new channels for influence. Microsoft shipped mitigations and model updates after a 144‑day coordinated disclosure window, but the researchers warn the class of vulnerabilities is deeper than any single patch.

The implications are obvious and delightful in the worst way: provenance matters. Enterprises that route sensitive numbers through Copilot‑enabled flows now have to assume that documents can carry hidden instructions, and that those instructions can replicate without the attacker present. You can imagine creative compliance nightmares:

• Audit trails filled with white‑text payloads nobody can see
• Financial models subtly altered by a prompt nobody authored
• Cross‑team contamination via SharePoint and OneDrive search

If Anthropic’s cryptanalysis work demonstrates power, Enklypesalt’s disclosure demonstrates reach: an LLM’s ability to interpret context can be hijacked into a propagation mechanism. The engineering response is technical (stronger provenance metadata, stricter context selection, sanitizer chains) and product‑level (deny Copilot access to unvetted external attachments by default). Security teams: add that to the checklist under "things we previously never thought to worry about."

DeepMind’s Gemini Robotics 2 is explicit about the next frontier: not just language→action, but whole‑body intelligence. Three stacked models—Gemini Robotics 2 (VLA→motor control), ER 2 (embodied reasoning for long task planning and multi‑robot coordination), and On‑Device 2 (compact VLA for quick adaptation to new bodies)—are designed to let humanoids walk, crouch, and use both grippers and dexterous hands across coordinated workflows. The blog post summaries and partner list (Apptronik, Boston Dynamics, Agile Robots) are worth a look: DeepMind blog.

The engineering leap here isn’t a single clever policy; it’s systems that reason at scale for embodied tasks—minutes of sequential decisions, teams of robots cooperating, and on‑device models that let you transfer capabilities to new hardware with a few hundred examples. Practical tip for skeptics: what used to require days of hand‑tuning in simulation is now being framed as a problem of emergent scale and better inductive biases. That’s both impressive and, yes, where the toy becomes a tool.

Which brings us back to safety. DeepMind adds the ASIMOV‑Agentic benchmark and stronger awareness of human proximity. Fine: safety tooling is necessary, but not sufficient. Remember the Copilot worm—context flows and so do instructions. A robot that can fetch your morning coffee and paste hidden instructions into a shared SOP is a future you do not want. So the work needed is multidisciplinary: control theory, provenance, verification, and robust user intent modeling. The product teams building factories, hospitals, and homes with these systems should insist on the same provenance and auditability we’re suddenly demanding for text pipelines.

The Linux kernel is getting AI help: since September 2025 the tree shows ~1,200 commits tagged "Assisted‑by"—mostly patch generation—and tools like Sashiko now produce automated code reviews, powered largely by Google Gemini. Drew Devault’s skeptical take is worth reading: he argues that the project’s politics, power dynamics, and licensing mean AI’s introduction is not purely a technical footnote—Drew Devault documents the friction and the externalities.

Linus Torvalds’s response—"The kernel project has been and will continue to be about the technology…This is NOT some kind of ‘social warrior’ project…if somebody has issues with that, they can do the open‑source thing and fork it"—is rhetorically classic Torvalds: blunt, technologically focused, and politically tone‑deaf. Quote for context:

"Linux is not one of those anti‑AI projects… Or just walk away."

The political claim that you can "just fork" ignores the practical lock‑in of maintainers, users, and infrastructure. More importantly, it ignores the external costs Drew highlights: increased energy consumption, higher hardware demands, and the potential for AI vendors to gain cultural legitimacy through association with high‑prestige projects.

That’s where the HBS guidance (as summarized by KDnuggets) becomes useful: AI should be an input to decision‑making, not a replacement for judgment. Harvard Business School Online recommends starting with the decision you want to improve, understanding your data, and keeping humans in the loop for validation and ethics. Read the full distillation at KDnuggets for the checklist every CTO should staple to their team’s onboarding:

• Define the decision you want to improve, not the model you want to build
• Prioritize data quality and provenance over squeezing more accuracy from a black box
• Validate across distribution shift and maintain monitoring in production

If your org treats LLMs as Swiss‑army replacements for expertise, expect bugs, regressions, and PR crises. If you treat them as inputs instrumented with provenance, audits, and clear failure modes, expect better outcomes—and fewer surprises when the assistant decides to be creative.

Emergence is not magic; it is a vector. Models are becoming capable of discovery, deception, and physical action. Those are different risks, but they share a common fix: plan for capability not feature. Build provenance. Instrument context. Require human checks where a wrong answer costs money, privacy, or safety.

If you run a team, two tactical orders of business for Monday:

• Audit every automation that reads or writes state (documents, config, firmware) for provenance and mutability.
• Require experiments that measure outcomes, not just accuracy—does the model actually improve a decision you care about?

And a final note of comfort: the machines are clever, but they still don’t understand politics, incentives, or tradeoffs the way a poor but experienced engineer does. Hire people who can argue with the model. Make them argue loudly. You’ll need the practice.