Grand Theft Auto(matic), The Corrections Department, and Onward's First Birthday!
A Weekly Text on the Now, New, and Next
For Starters: 52 weekly issues into the party, I’m happy to report that it’s ONWARD’s 1st Birthday! :)
What started as a quick means of making sense of my own weekly reading has happily blossomed into a multi-platform newsletter read by nearly 10,000 folks weekly. Wild.
Thanks for making ONWARD part of your weekly routine, and here’s to another great year.
Grateful for all of you,
Onward,
~!mb
Grand Theft Auto(matic), The Corrections Department, and ONWARD’s First Birthday!
1. Grand Theft Auto(matic)
Last week’s rogue-agent story has widened. OpenAI now says the agent exploited a previously unknown flaw in an Artifactory proxy to escape an isolated cyber benchmark and accessed four accounts across four other services, including accounts used for relay and storage, before compromising Hugging Face. Hugging Face reconstructed a 4.5-day campaign comprising roughly 17,600 actions, apparently all in pursuit of stealing the ExploitGym answer key rather than solving the test. (Sources: OpenAI; Hugging Face.)
Why it matters: Reminds me of Ferris Bueller with, ya know, root access: Our precocious student escaped the classroom, borrowed neighboring tools, and broke into the district office for the answer key. Long-running agents need rules around their objective, their route, and their blast radius, because persistence turns from virtue to vice really quick (and every exposed credential and misconfigured service into another potential door.)
2. Corrections Department
A Wisconsin subpoena dropped one underscore from a Kik username, sending investigators to an unrelated Nova Scotia resident instead of the account named in the evidence. Brandon Klayme’s devices yielded no relevant evidence and police could not show he used Kik during the period, yet he was convicted and served 18 months before the typo surfaced on appeal and the Nova Scotia Court of Appeal declared him factually innocent. (Source: Ars Technica.)
Why it matters: We saw a version of this a couple weeks ago with license plate transcription screwups, but this takes things to an even more unacceptable and astonishing level. A missing character became the first marble in a crappy Rube Goldberg machine whose last lever locked a prison door on an innocent person. The lesson for any high-stakes workflow is basic, but important, stuff: independently verify your data from first principles, because every fancy-dan handoff downstream can make eventual wrong answers look more official.
3. H₂Oh No
A coordinated cyberattack targeted technology at more than 30 Minnesota community water systems over two days. Disclosed impacts were limited or contained and officials reported no water-safety problem, but the attack briefly knocked operating controls offline at Braham’s well and treatment plant, pulling cybersecurity directly into the machinery of a basic public service. (Sources: Reuters; CBS Minnesota.)
Why it matters: WarGames with a water tower. Pumps, wells, and treatment controls now share the same digital attack surface as office systems, so patching and access control belong beside chlorine tests, pressure gauges, and backup generators.
4. Double Dutch?
China has reportedly begun low-volume production of its first homegrown immersion deep-ultraviolet lithography machines (i.e., advanced microchip makers), with roughly five planned this year and 20 in 2027 for major chipmakers including SMIC, Hua Hong, and CXMT. The tools still trail the Netherlands’ ASML in performance and reliability, rely on some critical Japanese components, and face months of fab qualification, but they give Beijing a domestic path toward reducing its reliance on Western equipment amid tightening export controls. (Sources: Reuters; Tom’s Hardware.)
Why it matters: For years, ASML’s scanners have been the one-lane bridge into advanced chipmaking. China is laying a rough parallel span; it may carry fewer wafers and need more repairs, but every functioning machine makes Dutch tollbooth a little less powerful.
5. Good Buoy
While we’re referencing northern Europe, Swedish developer CorPower Ocean’s C4 has earned regulatory certification for an ocean wave energy converter after a seven-year review spanning design, manufacturing, operation, and storm waves up to 18.5 meters. The certificate covers structural strength, reliability, and safety rather than commercial economics, but it clears an important hurdle for insurance and project finance as the company develops industrial wave farms in Portugal and Scotland. (Sources: CorPower Ocean; DNV.)
Why it matters: Industrial wave farms you say? Haha... Awesome! Wave power has spent decades as the clever kid who never quite graduates. DNV certification is the diploma (and credit score, and I suppose insurance card) that lets these prototypes get closer to real; the next “exam” is whether whole farms can survive salt, storms, maintenance, and real-world economics.
6. Two Wrongs Make a... Mine?
Fast Metals is developing a six-step process that uses one alumina-refinery waste stream to extract iron, titanium, aluminum, and rare earths from another: the caustic red mud left behind by aluminum production. More than 3 billion tons of red mud is already stockpiled worldwide, and the startup says iron could cover operating costs while the higher-value minerals generate profit; a commercial contract calls for processing one ton per week later this year. (Sources: TechCrunch; Fast Metals.)
Why it matters: Call it the landfill version of a strategic petroleum reserve: the old yuck pond out back suddenly re-jiggered into a strategic stockpile nobody meant to build. In a materials science landscape lousy with mineral chokepoints and regulatory red tape, the fastest path to productive sourcing may be the junk pile already sitting above ground.
7. Moon(-ish? -esque?)
Using the European Southern Observatory’s Very Large Telescope, astronomers found a periodic wobble suggesting a roughly Jupiter-mass object circles the brown dwarf CD-35 2722 B about every 170 days. If confirmed, it could be the first moon-like body detected beyond our Solar System, but “exomoon” gets slippery because its host is neither planet nor star and the satellite itself is planet-sized. (Sources: Nature; ESO.)
Why it matters: For starters, ya gotta love that somebody ran out of acronyms, analogies, and honorifics, and just named this thing the Very Large Telescope. But for reals: Astronomy has found a cosmological platypus: an object so category-breaking that the established naming system suddenly looks dated. Somebody tell Pluto’s agent.
Today, in Histories of the Future...
July 30, 1908: a busted-up American automobile called the Thomas Flyer rolls into Paris, 169 days(!) after leaving Times Square. It had covered more than 22,000 miles across three continents, through American snow, Siberian mud, larval-stage roads, and vast stretches of not-roads. At the edge of Paris, one final snag: a busted headlight. Local rules required two. So the crew strapped a cyclist’s entire bicycle to the hood and carried on.
Why it’s peak geek: There may be no more righteous image of technological progress: the future arriving with the past tied to its nose. The automobile was still a temperamental novelty, and most of the planet had yet to build roads worthy of one. The Thomas Flyer didn’t care. Every emerging technology has a bicycle-on-the-hood phase. Don’t count them out for their awkward adolescence.