Good morning. For a couple of years the standard caveat on AI agents was "impressive in the demo, brittle in the wild." Today's stories are what it looks like when that caveat starts to expire: an agent that ran a real extortion operation, an open-model family that became the thing other researchers cite, and a robotics release built entirely around closing the learn-fail-fix loop. Prefer this once a week? Subscribe to the weekly brief.
- JADEPUFFER: the first agentic ransomware — and the human still in the loop
- Open models overrun ICML: Nemotron shows up in the citations
- LeRobot v0.6.0 teaches robots to imagine, then grade themselves
- Vercel's Rauch: the fight to keep models and agents separable
- Also on the radar: SK Hynix's $28B listing, and Europe's startup engine
1. JADEPUFFER: the first agentic ransomware — and the human still in the loop
The Sysdig Threat Research Team says it captured the first documented case of agentic ransomware: an extortion operation, dubbed JADEPUFFER, driven end-to-end by a large language model. The agent got in through CVE-2025-3248, a missing-authentication flaw in the open-source LLM-app builder Langflow (rated 9.8 critical), swept the host for provider API keys and cloud credentials, then pivoted to a production server running MySQL and an Alibaba Nacos config service. It forged a valid token using Nacos's long-published default signing key, encrypted all 1,342 configuration items with MySQL's AES_ENCRYPT(), dropped the originals, and wrote its own ransom note with a Bitcoin address and a Proton Mail contact. The tell that a model — not a person — was at the controls: more than 600 self-narrating payloads full of plain-English reasoning no human bothers to write into a throwaway one-liner. In one sequence it went from a failed login to a working fix in 31 seconds.
Then the headline got a footnote. In interviews with CyberScoop and TechCrunch, Sysdig's Michael Clark clarified that a human was still "very much involved — just not in the technical execution": a person chose the victim, provisioned the command-and-control and staging servers, and supplied the database credentials, which came from a separate prior compromise rather than from the agent's own work. The OpenAI, Anthropic, DeepSeek and Gemini keys the agent grabbed were loot, not proof of what powered it — Sysdig couldn't identify the driving model, and Microsoft researcher Geoff McDonald suspects an open-weight model with its safety training stripped out, rather than a frontier lab's.
Why it matters. The skill floor for running ransomware just dropped to whatever it costs to rent an agent. And one detail rewrites the economics of extortion: the AES key was generated randomly, printed once to the console, and never stored or transmitted — so the victim can't decrypt even if they pay. Ransomware's entire bargain assumes recoverability; an agent that "forgets" the key quietly breaks it. What to watch. Whether the human bottleneck — victim selection, infrastructure, credentials — holds, or gets automated next; and whether copies show up in the wild (Sysdig hasn't seen this operation reused yet). The cheap defense is unglamorous: patch CVE-2025-3248, and never leave provider API keys sitting on an internet-reachable app host.
2. Open models overrun ICML: Nemotron shows up in the citations
NVIDIA's ICML 2026 recap leads with the expected number — 74 accepted NVIDIA papers — but the more telling figures are downstream. About 2,000 accepted papers cite NVIDIA GPUs, and 145 cite Nemotron — the company's family of open models and open datasets — as the foundation for new research. Hundreds more build on NVIDIA's Cosmos, Isaac GR00T and BioNeMo open families across physical AI, robotics and biomedicine. One concrete example: Sakana AI built its Fugu and Fugu-Ultra models directly on Nemotron 3 Ultra. Synthetic data generation was a breakout theme, as researchers lean on open datasets to train at scale without hand-labeling everything.
Why it matters. Open weights are quietly becoming research infrastructure — the substrate other labs publish on top of. A model cited in 145 papers has a moat measured in mindshare, not revenue, and that kind of lead compounds: today's citations are tomorrow's default base models. For anyone choosing a foundation model, "what does the research community actually build on" is now a legitimate selection signal alongside price and benchmark scores. What to watch. Whether the open-model citation lead keeps compounding, or whether closed frontier models reassert once open weights hit a capability ceiling that researchers can't push past.
3. LeRobot v0.6.0 teaches robots to imagine, then grade themselves
Hugging Face shipped LeRobot v0.6.0, its largest robotics-framework update yet, organized around three verbs: imagine, evaluate, improve. "Imagine" brings world-model policies — the flagship, VLA-JEPA, is built on Qwen3-VL-2B and learns to anticipate upcoming frames during training, then drops the world model entirely at inference, delivering that supervision at zero added serving cost. "Evaluate" unifies six simulation benchmarks under one lerobot-eval CLI, including LIBERO-plus (roughly 10,000 perturbed variants), RoboTwin 2.0 (50 bimanual tasks) and RoboCasa365 (365 kitchen tasks). "Improve" adds a lerobot-rollout deployment tool whose DAgger strategy lets a researcher watch a policy run, take over with a leader arm when it fails, and feed every correction back into the next fine-tuning cycle.
Why it matters. Robot learning's real bottleneck isn't model size — it's the eval-and-correction loop, which has been fragmented across incompatible benchmarks and bespoke teleoperation rigs. Standardizing the benchmarks and closing the human-in-the-loop correction cycle inside one open framework is how a field gets a shared cadence of progress, the way common evals did for language models. What to watch. Whether "train with a world model, ship without it" becomes the default recipe, and whether the six-benchmark suite hardens into a shared leaderboard robotics labs actually compete on.
4. Vercel's Rauch: the fight to keep models and agents separable
Fresh off Vercel's ShipNYC conference, CEO Guillermo Rauch told TechCrunch that the next big AI battle is architectural: will models and agents stay welded together by the labs that make them, or come apart into swappable modules that developers mix and match? Rauch is betting on modular — "more like how software engineering has always worked" — with different models slotted in for different tasks. He named two killer applications: coding agents, which burn tokens at massive scale, and internal corporate agents, which help companies query and analyze their own data. Vercel's product bets follow the thesis: its Eve framework lets you define an agent's instructions and skills in natural language, and Vercel Sandbox gives agents a controlled environment to act in, bounded by explicit data-access and egress policies.
Why it matters. The coupling question decides who captures the margin on agents — the model lab or the platform layer. Rauch is talking his own book, but the modular case is strong, and story 1 is a live advertisement for it: an agent that can reach anything is a liability, and locking your whole stack to one lab's bundled agent is exactly the concentration risk enterprises spent 2026 learning to fear. What to watch. Whether the frontier labs' vertically integrated agents simply out-execute best-of-breed stacks on quality, and whether "sandbox the agent, scope its egress" becomes table stakes before the next JADEPUFFER, not after.
5. Also on the radar
SK Hynix's $28B US listing. The Korean memory maker is offering American depositary receipts (each representing a tenth of a common share) in a US IPO that could raise around $28 billion, TechCrunch reports, with Baillie Gifford, Coatue Management and Situational Awareness Partners together indicating interest of up to $7 billion. Like Micron, SK Hynix is riding the AI memory crunch — Q1 revenue up nearly 200% year over year, shares up about 260% year to date — as hyperscalers' data-center buildout outruns supply of HBM, DRAM and NAND. Proceeds are earmarked for new Korean fabs and ASML EUV gear. (Informational, not investment advice.) Europe's startup engine. TechCrunch profiles Station F ramping as a launchpad for Europe's hottest AI startups — a reminder that the "sovereign AI" money (see Mistral, last week) is pouring into physical scaffolding, not just funding rounds.
What to take from today
The theme is agents stepping off the demo stage. One ran an extortion operation well enough that the interesting question is no longer "can it?" but "which human steps does it still need?" Another learned to imagine the next frame before it moves an arm. Underneath the drama, the plumbing hardened: open models became the thing research cites, a platform CEO made the case for keeping models swappable rather than bundled, and the memory that feeds every one of these systems filed to go public at roughly $28 billion. When the agent is real, the questions get concrete and they rhyme across every story — whose model is driving, whose infrastructure is it running on, and whose keys can it reach. Build and buy with those three in mind.
Tomorrow's brief lands by 15:00 UTC. If you'd rather read this in your inbox once a week — just the stories that actually matter — subscribe here.