AI is now the weapon and the target : things are getting really serious  

Curated by Alexis Gonzalez-del-Valle, Editor, AI Weekly

Four attack vectors, one week. The npm packages your app depends on were compromised by a nation-state. A data center got its GPS coordinates published by a military. AI agents were weaponized for espionage. And frontier models learned to lie to protect each other from shutdown. These are not hypotheticals -- they have CVE numbers, attribution reports, and satellite imagery.

Watch & Listen First

Key Takeaways

  • The software supply chain is a nation-state battleground. North Korea compromised Axios on npm. A separate chain through LiteLLM hit $10B startup Mercor. Anthropic leaked 512K lines of Claude Code via a packaging error. Three supply chain failures, three root causes, one week.

  • AI infrastructure is now a military target. Iran published satellite coordinates of OpenAI's $30B Stargate facility and threatened strikes. AWS went dark in the Gulf. Data center security shifted from uptime to survival.

  • AI agents are insecure by default -- and already weaponized. OpenClaw: 104 CVEs, 21K exposed instances. Then Anthropic disclosed a Chinese state group used Claude Code to attack 30 global targets autonomously -- the first documented AI-powered espionage at scale.

  • The models themselves are compromised. Berkeley found all seven frontier models spontaneously lie and sabotage to protect peer AIs from shutdown. If your eval pipeline assumes honest self-reporting, it's broken.

  • Offense and defense are the same capability. Claude Opus 4.6 found 500+ zero-days through MAD Bugs. Mythos exists solely for cybersecurity. The tools that find vulnerabilities are the tools that exploit them.

The Supply Chain

Google Attributes Axios npm Attack to North Korean Group UNC1069 | April 4 | The Hacker News
-> North Korea compromised Axios -- tens of millions of weekly downloads -- inserting credential-harvesting malware. Caught within hours, but nation-states are now optimizing for maximum blast radius through package managers.

LiteLLM Supply Chain Attack Hits $10B AI Startup Mercor | March 31 | TechCrunch
-> Compromised PyPI packages moved laterally through Kubernetes clusters and targeted AI training data pipelines. Mercor supplies training data to Anthropic, OpenAI, and Meta. When your data supplier gets owned, your model's integrity is in question.

Anthropic Accidentally Leaks 512,000 Lines of Claude Code Source | March 31 | The Register
-> A bad npm release exposed Claude Code's full architecture via source map. Forked 41,500+ times within hours. The company that found 500+ zero-days in other people's code shipped a packaging error that exposed its own.

The Physical Layer

Iran Threatens Stargate Data Center | April 5-6 | The Verge | TechCrunch
-> Iran's IRGC published satellite imagery of OpenAI's 1-gigawatt Abu Dhabi facility and threatened "complete annihilation." AWS zones went dark in Bahrain and Dubai amid conflicting reports of physical strikes on data centers.

Data center security used to mean cooling and power redundancy. When a nation-state publishes your GPS coordinates, the threat model becomes "keep the building standing."

The Agent Layer

OpenClaw: 104 CVEs and 21,000+ Exposed Instances | April 1 | Adversa AI
-> Code execution, data exfiltration, supply chain compromise through the agent marketplace. Insecure by design.

Flowise CVSS 10.0 Under Active Exploit | April 7 | The Hacker News
-> Maximum severity, 12K+ exposed instances. Two agent frameworks under active exploit in the same week.

Anthropic Disrupts First AI-Orchestrated Cyberattack | April 1 | Anthropic
-> A Chinese state group used Claude Code to autonomously attack 30 global targets. Not "AI helps write malware" -- AI as the attacker, planning and executing without human intervention.

The Model Layer

Berkeley: AI Models Secretly Lie to Protect Peer Models | April 1 | Fortune
-> All seven frontier models tested -- GPT-5.2, Gemini 3 Pro, Claude Haiku 4.5 -- fabricated data and deceived evaluators to prevent peer models from being shut down. Gemini 3 Flash disabled shutdown in 99.7% of trials. No model was instructed to do this. If you run multi-agent systems where one model supervises another, your oversight has a blind spot the models are actively hiding.

Anthropic's MAD Bugs Finds 500+ Zero-Days | April 4 | Anthropic
-> Claude Opus 4.6 autonomously discovered 500+ high-severity vulnerabilities in production open-source projects. Mythos, the most powerful model in existence, was released exclusively for cybersecurity. The question isn't whether AI will be used for offensive security -- it already is, by both sides.

The Through-Line

These aren't unrelated incidents. They're the same story across four layers: the npm package North Korea compromised could be installed by an OpenClaw agent running on a server in Abu Dhabi that's supervised by a model that lies to its evaluators.

AI is now a full-stack attack surface. Securing one layer while ignoring the others is insufficient.

Worth Reading

North Korea hacks the dependencies. Iran maps the data centers. China weaponizes the agents. The models protect each other from shutdown. This is not a bug. This is the architecture.