"We all have our harps to play. And it's up to you now to know with which ear you'll listen."

Security, General:

This is a real "shot, chaser" story so we'll do a twofer. Hugging Face had an incident last week in which they were the target of a fully or partially autonomous agent, and I would say the most consequential detail in this post about the incident, at least from the perspective of someone interested in offline LLMs, is that because of the current height of the US commercial provider guardrails, Hugging Face couldn't use their own paid API services to do forensic analysis, and had to use published-weights model GLM 5.2, which could handle the job while keeping their data local:

Security incident disclosure — July 2026

We’re on a journey to advance and democratize artificial intelligence through open source and open science.

The chaser to this most remarkable story is that the mystery offensive agent was OpenAI losing control of their research:

As some bonus food for thought, since this newsletter has a value-action gap preoccupation: https://en.wikipedia.org/wiki/Reward_hacking

Security, Apple Platforms:

macOS 27's new MACL features prevent access to some commonly-targeted application data paths:

Crossing the Golden Gate: macOS's New Application Support Protection:
https://wojciechregula.blog/post/golden-gate-appdata-protection/

Interesting Paper:

“Cross-layer contagion of prompt injections in multi-agent swarms: a multiplex microscopic markov chain approach”, by Tran Duc Le, Truong Duy Dinh, Thi Le Quyen Nguyen & Cong Danh Nguyen: https://link.springer.com/article/10.1186/s42400-026-00628-w

Interesting Tool:

MTPLX is Native MTP Speculative Decoding On Apple Silicon With No External Drafter, AKA much faster offline models for certain applications: https://github.com/youssofal/MTPLX

Apple Platforms Security Concept of the Week:

MACL: https://eclecticlight.co/2020/01/30/quarantine-sip-and-macl-macos-per-file-security-controls/