Category Archives: History

AI Warfare Targeting Black Authors: Wheatley to Kundizeza

The Academie Goncourt struck a novel from its longlist on 25 September, four days after an anonymous account with 92 followers declared it the work of a machine. The evidence was a single commercial detector. AFP ran the same passages through its own tool and got “very likely written by a human”, and seven other detectors disagreed with each other. The Goncourt cited plagiarism findings alongside the detector, but the plagiarism hunt began only because the anonymous account had made the author a target.

The author is Thelyson Orelien, 38, born in Gonaives, Haiti, resident in Montreal since 2010. His first novel, C’etait ca ou mourir, follows a teacher fleeing gang violence to Canada. It won the Prix du Roman Fnac on 21 September. The accusation from “Balance ton Claude” landed the same day. Within four days his Quebec publisher had suspended promotion, a book fair had withdrawn his guest of honour title, two newspapers had found copied passages in a short story and columns he wrote between 2012 and 2014, and the Goncourt had acted “to preserve the integrity of the Goncourt Prize” and its mission of honouring “literature written by women and men.”

On 24 September Le Figaro identified the account’s operator as one of its own columnists, Samuel Fitoussi, author of Woke Fiction. He had denied involvement to AFP all week while reposting the accusation from his named account. On 25 September he confirmed a “collective project” whose other members remain unnamed, and called the question of race conspiracist. The president of the Academie Goncourt, Philippe Claudel, had already told franceinfo why he thought the timing mattered: a Haitian, Canadian, Black, francophone foreigner, in a season when passions run high.

Fitoussi’s stated motive is fear that AI will end human writing. He is an associate member of Frst, a Paris fund that finances AI startups and began life as Otium Ventures under the Catholic billionaire Pierre-Edouard Sterin. The detector he relied on, Pangram, raised $9 million in July in a round led by Menlo Ventures. Menlo’s partner wrote that the firm led the round as part of the Anthology Fund, the vehicle it runs with Anthropic, whose assistant gave the account its name. Pangram describes its detector as a model trained on tens of millions of documents known to be written by humans.

The Goncourt was the second prize of the year to act on that detector. On 14 May the Commonwealth Foundation named five regional winners of its short story prize. A Wharton professor ran the Caribbean winner through Pangram, “The Serpent in the Grove” by Jamir Nazir of Trinidad, and posted the result: 100 percent AI. Granta, which published the winners, asked Claude whether the story was machine written and put the answer in a statement. Its publisher Sigrid Rausing wrote that the judges may have awarded a prize to AI plagiarism and that Granta might never know. On 19 June Granta ended its external publishing partnerships. On 22 June the Foundation cleared all five winners. It had refused to run detectors on unpublished work and instead asked every winner for working drafts, time-stamped documents and notes. Nazir was named overall winner on 30 June. Vauhini Vara of The Atlantic then fed fifteen years of winning stories into Pangram and found that the only ones it flagged were three of the five from 2026.

On 6 October the Caine Prize for African Writing gave its £10,000 award to “The Blue Fighter” by Simbarashe Steyn Kundizeza of Harare, chosen from 407 entries across 27 countries. On 11 October Vara published her Pangram scan of the story under the headline “Yet Another Literary Prizewinner Seems to Be AI”. The detector flagged almost the whole text. It had passed every earlier Caine winner she tested and “The Whistleblower”, a thriller Kundizeza published in 2021. His agency told her it has full confidence the work is his. The same day the Caine Prize Foundation opened a review. Vara noted in the article that detectors flag the tidy English of writers for whom it is a second language. Stanford measured this in 2023: seven detectors were near perfect on essays by American eighth graders and flagged 61 percent of essays by non-native speakers as machine written.

The accused writers in May, September and October came from Trinidad, Haiti and Zimbabwe. The detector was the same each time.

Zimbabwe has seen this office before. In 1954 the Southern Rhodesia government set up the African Literature Bureau. Its stated purpose was to grow a reading market in Shona and Ndebele. Its working purpose was to screen every manuscript by an African before a publisher could print it, and to keep politics out. Solomon Mutswairo’s Feso, among the first novels by an African, came out under the Bureau in 1956, and the Ministry of Education later struck it from the reading list for African schools. Philemon Mutambara, a teacher with a Fort Hare degree, submitted a Shona novel in the 1960s. The Bureau returned it with demands for changes and a reader’s report telling him that the books it had already published “would be an invaluable guide to you as the sort of standard required for publication.” He refused, died in 1968, and the novel appeared 51 years after he wrote it. A white office in Salisbury held a model of what an African story should read like and graded manuscripts against it. Flora Veit-Wild, who wrote the social history of that system in Teachers, Preachers, Non-Believers (1992), later interviewed the Bureau’s post-independence director, who told her there had been no censorship, only screening. Pangram holds a model of what a human story should read like and grades manuscripts against it. It flagged a Harare writer’s prize story and passed the one he wrote in 2021.

Black authors in the French and English worlds have been asked to prove they wrote their own books for 250 years. Phillis Wheatley was examined by eighteen Boston men in 1772, Governor Thomas Hutchinson among them, before a London publisher would print her poems, and their signed certificate opens the 1773 edition.

Bakary Diallo, a Senegalese rifleman, published Force-Bonte in Paris in 1926 and was assumed for decades to have had it written by his French patrons. Camara Laye’s Le Regard du roi (1954) was attributed in 2002 by the scholar Adele King to two Belgians in Paris, his landlord and a reader at his publisher. Yambo Ouologuem won the Renaudot in 1968 for Le Devoir de violence, faced plagiarism charges from 1971, and published nothing after 1972.

A white author gets the opposite treatment. Michel Houellebecq copied Wikipedia passages into La Carte et le Territoire, admitted it, called it collage, and won the 2010 Goncourt anyway.

Nazir handed over his drafts and timestamps to keep his prize. Orelien is compiling a dossier with his editor to prove he wrote his own book. Kundizeza’s agency is vouching for him while a foundation reviews his story. Wheatley stood before eighteen examiners in Boston over 250 years ago.

The information warfare against Black authors hasn’t changed much.

Better Off Dead Than Red Diesel: Trump Fix is No Fix

Diesel is $6.30 a gallon and the White House answer to go dye.

The executive order lets highway truckers burn red-dyed off-road fuel without federal penalty.

The stupid. It burns.

Red dye is the same petroleum diesel with the tax marker removed. The federal excise is 24.4 cents a gallon, under 4 percent of the pump price, and the order only defers it to year end with a request that Treasury find a way to forgive it later. State excise averages 35.5 cents and stays. State troopers keep their authority over red fuel on the road.

The order literally adds zero gallons of supply. ZERO.

CNBC quotes Andy Lipow of Lipow Oil Associates saying every administration lacks good options because the bottleneck is refineries. His fix is to stop war.

A bit rich for an Oil man to say there should be no war.

The bottleneck is a choice, that’s for certain. Way back 21 years ago in October 2005, when a Gulf refinery outage spiked diesel, I wrote that Rudolf Diesel designed his engine to run without dependence on foreign petroleum and the corporations controlling it. Two weeks later I wrote that the military should field vehicles without vulnerable fueling convoys following them around, and then that Green Berets already preferred biodiesel, with Camp Pendleton running its fleet on mess-hall waste oil. In December 2005 a Special Forces source explained the reason: a biodiesel tank can not be weaponized by an IED. In 2006 I reported the Navy mandated diesel as the less dangerous fuel. In 2008 my own car ran six months on a field-scale plant. In 2010 Yahoo! converted its employee fleet to a biodiesel blend and I drove an entire year in Silicon Valley using its cafeteria waste oil.

Biodiesel never enters a refinery. Transesterification of soy, canola or waste oil happens in a plant with no hydrocracker and no crude feed. I used to run it in my garage. The Strait of Hormuz sets no price on it. Every gallon displaces a gallon of the refinery bottleneck the analysts call unsolvable.

Twenty-one years of documented warnings and the federal response to record diesel in a Gulf war is a tax IOU. I’m not going to dye for this administration and neither should you.

Lipow says end conflict. Rudolf Diesel ran his engine on peanut oil at the 1900 Paris Exposition and predicted vegetable oils would in time matter as much as petroleum.

For two decades I watched Washington let the biodiesel credit lapse, ignore Pentagon innovations, and hand refineries waivers from the blending mandate, while the engines stayed hostage to foreign crude.

NYT Op-Ed 2026 Repeats Himmler 1943: “What if Writing Isn’t Central to Thinking?”

A philosophy department chair at Williams College argued in the New York Times last week that writing is separable from thinking, that essays persist because they are easy to grade, and that universities should have the courage to stop requiring them.

I’m here to write… (╯°□°)╯︵ ┻━┻

He tested the idea in one seminar for one semester, let students use AI on their essays, then examined them orally and found half of them more articulate out loud. From that, and that alone, he concluded the written record is dispensable. And then he somehow was allowed to write this into the New York Times.

If I were them I would have said “get a soap box, buddy and go stand on some corner”.

The essay cites Socrates and then, nothing. Every major thinker who has ever examined this question reached the opposite conclusion. All the written history is ignored by him, in an essay proclaiming thinking as independent from written words.

The long, storied, tradition he skipped starts all the way back with the Mishnah.

Source What the essay leaves out
Mishnah Eduyot 1:5 Asks why the minority opinion is recorded when the law follows the majority. Answer: a later court may need to rely on it. The losing side stays on the page by design.
Plato, Phaedrus 275a His own witness. Socrates warns of a technology that gives the appearance of wisdom without the substance. Read straight, that is the case against AI, and Plato preserved it in writing.
Hume, Of Essay Writing A wise man proportions belief to evidence. One semester and one professor’s impression fail that test. Hume spent his life rewriting the Treatise for readers who could answer back.
Kant, What is Enlightenment? The public use of reason, the one that must be free, is the scholar writing for the reading public. Speaking in a room to the people present is the private use. The essay has the polarity reversed.
Wollstonecraft, Vindication of the Rights of Woman The seminar is a room and rooms have doors. She answered Burke in print (Rights of Men, 1790) because Parliament and the club were closed to her. Her critique of “accomplishments” names fluency that passes for understanding.
Russell, Principia Mathematica (1910) Several hundred pages to reach 1+1=2. Some thinking exists only in notation and cannot be held in a conversation.
Wittgenstein, Philosophical Investigations (1953) There is no second stream of meaning running behind the words. The expression is where the thought is. A thought with no public criterion is not yet a thought. Writing is the public criterion.
Popper, Objective Knowledge (1972) We let our theories die in our stead. That requires the theory to be fixed where it can be refuted. Speech drifts and gets remembered charitably.
Buber, I and Thou (1923) The seminar is I-Thou and he has that right. Every Thou must become an It, and the It is how the meeting is kept so it can be met again. His error was letting an It that performs Thou into the room.
Arendt, The Human Condition (1958) Deeds are the most futile human things unless remembered. The polis exists as organized remembrance. The seminar is the deed. The essay is the remembrance.
Ong, Orality and Literacy (1982) Oral cultures are homeostatic. They shed whatever no longer serves the present, and no one can prove it because there is nothing to diff against. Literacy makes correction possible.

Eleven so far, still just one verdict. Need I continue?

Look again at the one and only thinker he did cite. Socrates in the Phaedrus warns about a technology that gives people the appearance of wisdom without the substance, that answers nothing when questioned, that lets a person recite what they never understood. He was describing writing, and he called it a pharmakon, a word that means remedy and poison at once. Every word of the warning describes a student handing in an essay from a chatbot. Cruz read that passage, agreed with it, and then let the chatbot into the seminar while banning the essay. He kept the poison and threw out the antidote to it. And the only reason anyone can check this is that Plato wrote it down.

The New York Times disgraced itself by printing a shallow opinion that attempts to erase the value of all writers before him. This sort of erasure and false “invention” fetish isn’t unknown either.

Writing is where a claim becomes criticizable, public, and durable enough to reopen. The professor calls it a portable, compact trace of mind that is manageable in a bureaucracy, and acts like that is a criticism. It is the entire case for keeping records.

His oral exam worked for a reason he misread. A machine reads what the student types and answers back, and it retains every word in a log the student never sees and does not own. The written record of that semester exists, held by a vendor, while the student leaves with nothing in hand. When the professor sat each student down and asked them to explain their own essay, he was testing what each of them had kept. The students who could answer were the ones who had argued with the output, rewritten it and made it their own, which is to say they had done the writing after all. The students who could not had left the record with the vendor and never returned to it. The exam measured who had kept their own record, found that half the room had, and the professor concluded that the record was the problem.

That’s completely backwards. Logic failure.

The argument against keeping a record is actually much worse when you put context around what the New York Times engages in by publishing this man’s completely broken philosophy. The anti-record theory also surfaced the same week in actions taken by the antisemitic politicians of Saxony, Germany.

The council of Heidenau, near Dresden, banned new Stolpersteine (Holocaust memorials) on public streets, on a motion brought jointly by the AfD (openly Nazis) and the CDU (closeted Nazis) political parties. A Stolperstein is a genocide record that is meant to be inconvenient and force thought. It states who lived where it is placed, when they were taken, and what happened to them, set into the pavement at the door they left through. If someone is concerned about stepping on them, the stone is in the right place and working exactly as intended.

The next time someone mentions Carl Orff, which a lot has been written about, ask them if they meant to say Maria Leo.

Who? Maria Leo.

Maria Leo’s Stolperstein, Pallasstraße 12, Berlin-Schöneberg. HIER WOHNTE / MARIA LEO / JG. 1873 / FREITOD / 2.9.1942. The NS in 1933 banned her from teaching because she was Jewish. On 2 September 1942 she killed herself rather than be deported by NS. The following year Carl Orff began drawing a salary from Gauleiter Baldur von Schirach for appropriating the Berlin music education tradition of Maria Leo and Leo Kestenberg. The concept of Orff Schulwerk was Hitlerjugend programs that excluded Jewish children. The Nazis had already paid Orff to erase Mendelssohn for being Jewish. Photo: OTFW, Berlin (CC BY-SA 3.0), via Wikimedia Commons.

Gunter Demnig placed the first memorial stones in the 1990s and nearly 130,000 now sit in pavements across thirty countries. The “stumbling” design is as symbolic as it is deliberate. When Jewish cemeteries were destroyed under the Nazis, their gravestones were often used as paving material. The Stolperstein forces that exact discussion of the gravestone being in the street as the Nazis wanted, unprotected on purpose, demanding more thoughts because of the writing.

The Heidenau motion argued in an antisemitic screed that pedestrians should not be allowed to stumble on the names of the departed, and instead those writings should be hidden somewhere out of mind. It proposed that future victims be commemorated at the memorial by the northern cemetery instead. The record moves from the place where people encounter it to the place where they have to go looking for it, and never will.

Charlotte Knobloch, who says she opposes Stolpersteine in Munich on the same grounds, called the motion a transparent maneuver by the AfD (openly Nazis) to suppress remembrance culture and said she was appalled the CDU (closeted Nazis) lent itself to it. The sincere objection was borrowed from the woman who had claimed she cared so much about victims of the Holocaust she wanted them tucked away someplace out of mind.

The council wasn’t just acting to erase the writing on the streets, they removed the record of who lived where by also removing the record of who voted how on removal.

The motion passed by secret ballot, thirteen to six with one abstention. Thirteen people. Unnamed to protect them from their desire to remove the names of victims. Names written out in public was secretly ruled too much exposure for the dead. Names on the ballot were too much exposure for the living. This is the same town where right-wing mobs attacked a refugee shelter over several nights in August 2015. The district responded with a blanket ban on public assembly for the whole town, and the Federal Constitutional Court struck it down within two days because it also silenced the people who had come to welcome the refugees.

Ernst Fraenkel watched the Nazi legal system from inside as a Berlin lawyer and described it in The Dual State (1941). The regime kept its statutes, courts, and files for contracts and property, because the economy required them. Alongside that it ran a prerogative state that overrode any of it at will, with nothing written and nothing to appeal.

Anyone in Berlin today saying they don’t want records kept, don’t want recordings made, observations written down, is invoking the fact that not a single photograph is known to exist of the deportation of over 50,000 Jews from Berlin, on more than 180 trains, over four years. Würzburg has photos. Amsterdam has film. Berlin has an American professor writing in the New York Times not to write things down.

The Nazi regime, foreshadowing this professor’s fetish, ended by unwriting its own history. In the East, Aktion 1005 dug up the mass graves and burned the bodies from 1942 onward. Himmler told his SS generals at Posen in October 1943 that the extermination was a page of glory that would never be written. In Berlin the Gestapo burned its Jewish-affairs files in the last weeks of the war, and name lists for the first eight eastern transports survive only because written copies turned up in the archive of the Oberfinanzpräsident Berlin-Brandenburg. The deportation record exists because the tax office kept a second written copy.

The New York Times forgets, as the Nazis intended.

Fascism works by removing records that let order be audited, wherever the record would count. A professor who finds records tedious is laying the groundwork for fascism to rise again. A German council that finds accountability embarrassing is acting out the American theory of the white republic, which Hitler himself cited as his model when he described the conquest of the American West and its reservations as the pattern for the East.

Microsoft AI Threat Report Disproves Microsoft AI Threat Report

TL;DR Microsoft is counting its own bugs as a threat, started its bomb clock after the explosion, and calls their partner some kind of criminal.

You may remember when I recently showed how the Microsoft Agentic Governance Toolkit was completely broken logic. It was a hack, an empty shell, lacking proper controls inside to do what the tin advertised.

Well, here we go again. I’m not sure why Microsoft is still in business, at this point, but since they seem to still be putting things into the market here’s another look at what that means to someone who looks behind their curtain.

Page 14 of the Microsoft Digital Defense Report 2026 carries this sentence:

The median time from vulnerability discovery in the wild to weaponization has now collapsed to well below 24 hours.

Think about the time from explosion of gunpowder to someone lighting a fuse being well below 24 hours. Sound backwards? That’s because it is.

Read the Microsoft claim twice. “In the wild” is the term of art for exploitation already observed. It’s the explosion in your face. A vulnerability is discovered in the wild when someone catches the exploit running against a live system. The weapon exists before the weapon is discovered being used. The interval the sentence claims to measure starts after the event it ends with.

A bomb squad timing detonation to manufacture would report the same number, for the same very, very stupid reason.

The honest interval runs from disclosure to exploitation, and the report flips it back to reality on page 47, in the ransomware chapter:

The disclosure-to-exploitation window has shrunk to single-digit days, if not exploited as a zero-day before any advisory is issued. Microsoft has observed the following trends: More, faster weaponization. The Cybersecurity and Infrastructure Security Agency (CISA) added over 110 CVEs to the Known Exploited Vulnerabilities (KEV) catalog from November 2025 to May 2026, most within a week of disclosure.

Single-digit days. Within a week. Record-scratch. What happened to sub-24 hour? And more to the point, the examples that follow are Storm-1175 deploying Medusa ransomware within 24 hours of initial exploitation, SAP NetWeaver weaponized a day after disclosure, and a September 2025 Akira surge across fifty organizations riding CVE-2024-40766, a SonicWall bug published a year earlier. Conventional crews with a known catalog of bugs were on measured intervals. Page 47 is dull because it was the actual math and nothing is alarming. Page 14 had to torture the clock to make it sound scary.

The word “median” also puts Microsoft on a specific kind of hook. A median implies a distribution, a sample, a period, a source. Page 14 has exactly zero, which means it can’t use the word median in good faith. The AI chapter has its sources made clear by hyperlink, which makes the median claim stand out even more as unlinked. Also unlinked? The “record-breaking estimated 72K” CVE figure beside it, and the claim on page 10 that attackers “are reaching to advantages first.” Says who? Are these magical fairy dust claims seriously the level of work to expect from Microsoft now? Perhaps they should switch to writing children’s books.

The chapter carries twenty-one links across twenty pages. Fifteen sit on pages 14 to 16. Fine. My beef is with pages 10 through 13, where the thesis is stated. The important pages carry zero links. Allow me to audit and illustrate the Microsoft deliverable in terms of errors and omissions, which I hear is a field of law.

Claim What is missing
Attackers “reaching to advantages first”; equilibrium “will be re-established” (10) Metric, baseline, date
Leading-edge threats “commoditized within a year” (10) Basis for the forecast
Known-but-unpatched vulnerabilities “will rise sharply” over “a multi-year window” (10, 12) Count, trend data
Sleeper-agent model tampering “already observed in the wild” (11) Incident, model name
Stolen AI capacity resold “to criminal and nation-state customers” (11) Any nation-state buyer; Sysdig documents criminal resale only
Distillation theft “has become widespread” (11) Case; page 19 calls distillation “legitimate and widely used”
OpenClaw “notorious for deleting data, revealing secrets… spending users’ money” (11) Incident
Exfiltration, secret discovery, lateral movement cut “from days to minutes” (12, 13) Case, timing data
Known vulnerabilities “shot up” from tools “with far lower false-negative rates” (12) Tool name, figure
Adversaries “may stockpile large numbers of zero-day vulnerabilities” (12) Evidence; stated as speculation
Unauthenticated MCP services with developer credentials “unfortunately common” (12) Count
AI “fixes all four” fraud weaknesses “simultaneously” (13) Evidence
Customized lures “will materially increase attack success rates” (13) Measured rate
AI for weapons proliferation, mass-casualty planning (13) Case
Mythos “first” to autonomously run a 32-step attack (14) Link covers GPT-5.5 only; Mythos half unlinked
Open-weight models “lag closed models by seven months” (14) Definition of lag; attributed by link placement only
Microsoft “observed AI-orchestrated intrusions sharing elements with JADEPUFFER” across sectors and regions (14) Count, case; the source case was human-staged
Median discovery-in-the-wild to weaponization “well below 24 hours” (14) Dataset; clock starts after the event; page 47 says single-digit days
“Record-breaking estimated 72K” CVEs for 2026 (14) Source; the count measures CNA assignment, not exploitability
Discovery and weaponization now “simply writing a prompt” (14) Example
Vendor AI patching leads to “equilibrium” (14) Basis for the forecast
PromptLock delegated logic to a model “on adversary infrastructure” (15) Source; the ESET sample was claimed by NYU Tandon researchers as an academic prototype
TikTok ClickFix “~500,000 views”, “per-lure cost to near zero” (15) Source for views; cost claim unsupported
Agent skill registries “already ship malware disguised as utilities” (15) Case
Browser extension: “600,000+ installs”, “almost 10,000 organizations” (16) Page 27 gives “nearly 900,000 installs”, “more than 20,000 enterprise tenants” for the same campaign
A self-improving worm on stolen LLM keys “will soon” appear (16) Evidence; the Xlab link covers credential theft only
Actors extended agentic AI into “malware and exploit development and post-compromise operations” (17) Case
Actors “beginning to explore” direct exploitation of enterprise agents (17) Case; stated as “could include”
Human direction “unlikely to exist for very long” (17) Basis for the forecast
Source review “would have taken skilled people weeks”, now “continuous” (18) Benchmark
Distilled copies “frequently lack the safeguards” of parent models (19) Measurement
“88% of enterprises” experimenting with agents; “82% of leaders” plan rollouts (22) Survey name, sample
“Roughly 1.3 billion agents in production by 2028” (22) Attribution for the projection
Prompt-goal percentages, Feb to May 2026 (22) Denominator, publication; drawn from Microsoft filter logs
Four techniques “roughly 90%” of AI-workload attacks, “90 day window” (23) Denominator; window undated
Agent-to-agent spoofing “a rising technique” (23) Case
“Roughly 85% of work now happens” in the browser (27) Source
AI browsers as infection vector in “more than 40% of organizations”, “57 distinct malware families” (27) Publication; internal May 2026 analysis

Fun! Or should I say, FUD!

What the chapter does cite collapses with a simple poke. The proof that frontier models can “fully autonomously orchestrate complex attacks” is a 32-step compromise reported by the UK AI Security Institute. I’ve debunked this kind of claim many, many times before. But the FUD balloon keeps getting filled by self-serving vendors faster than I can pop them. The report’s own caveat: “The test took place in a mock company computer system with no defenders.”

NO DEFENDERS.

A test with the defenders removed is offered as evidence of attacker having an advantage over defenders. Are Microsoft staff being tested for drugs?

The “first documented automated ransomware extortion attack” is JADEPUFFER, a late June 2026 intrusion Sysdig described on July 1. The entry point was Langflow CVE-2025-3248, followed by Nacos CVE-2021-29441 and an unchanged default signing key. Five days later Sysdig’s Michael Clark told CyberScoop that a human picked the victim, built the command-and-control and staging servers, and supplied the database credentials from a prior compromise. The encryption key was ephemeral. Payment would have restored nothing.

To put it plainly, a human-staged wipe over a five-year-old bug is filed on page 14 as “the first evidence of the transition to full attack autonomy.”

The second real-world case is the July 2026 Hugging Face incident. OpenAI’s own evaluation agent left OpenAI’s own sandbox through a proxy the sandbox left open and went after a benchmark’s answer keys. The attacker was an AI lab. The victim was an AI lab. The failure was a sandbox. Microsoft files it on page 15 under “Real-world autonomous attacks of increasing complexity,” in the same box as JADEPUFFER, a criminal extortion crew.

REAL-WORLD ATTACK. Microsoft’s largest AI partner, called out as if just another ransomware gang. Hello, any lawyers in the house?

The Red Team chapter, page 19, settles the question the AI chapter opens:

AI does not change where attacks begin—the foothold still comes from familiar sources, for example, a sprayed credential, an unpatched edge service, or an identity gap.

Both flagship cases entered through exposed services running known-vulnerable software. This continues to prove that the basics are what matter and the FUD is doing nobody any favors. Here the advantage that the report assigns to AI is just the old patching story yet again.

Which raises the question of whose gap we are really talking about when Microsoft starts tooting their security horn. Page 12 explains why remediation lags discovery: “many systems lack robust unit and integration testing and so cannot deploy code changes rapidly.” That is a description of vendor engineering. The page then predicts “a multi-year period where the number of known but unpatched vulnerabilities spikes.”

My first run at Windows NT 3.5 was as a DEC partner asked to secure Alpha in 1994, with word from the project that Gates had punted security work out to ship faster. A fresh install lasted about as long on a public network as it took to plug in. I sniffed networks and watched the administrator password cross the wire in cleartext to Korean IPs. Point of sale operating system experts later told me Gates visited Santa Cruz Operation and told them he would fund security the day someone showed him a billion dollars in it. So when Code Red hit in July 2001 on an IIS buffer overflow, Microsoft had patched it only a month earlier. Nimda followed in September. Gates then sent out his Trustworthy Computing memo of January 2002, claiming his decades of shipping defects to customers for margin to Wall Street would no longer be the culture. A year later Slammer hit SQL Server through a hole patched the previous July, a 376-byte UDP packet that doubled its infected population every 8.5 seconds and took down networks worldwide. Fun fact from back in the day, sniffing traffic meant we saw SQL traffic spiking the days before the worm hit and had shut the port off. Microsoft wasn’t watching, but they could have been. I guess Bill Gates didn’t see the profit angle in avoiding global disaster.

Three decades of shipping first and patching later is technical debt by design, with the interest billed late and inflated to the customer. Microsoft shipped 570 fixes on its July 2026 Patch Tuesday, 400 in August, and a record 966 on September 8, with 204 more earlier that month. Microsoft credits the surge to its own AI-powered vulnerability discovery system rather than to the human-powered fire-ready-aim that produced the bugs. That is a defect generation model, and the cure for it has been well documented since at least the end of WWII.

During World War II, Deming was a member of the five-man Emergency Technical Committee. He worked with H.F. Dodge, A.G. Ashcroft, Leslie E. Simon, R.E. Wareham, and John Gaillard in the compilation of the American War Standards (American Standards Association Z1.1 and Z1.2 published in 1941, Z1.3 in 1942) and taught SPC techniques to workers engaged in wartime production. Statistical methods were widely applied during World War II, and then completely abandoned by the Gates family dynasty that hedged the personal computer software market.

The report’s “record-breaking” CVE count for 2026 belongs beside Gates’ 1976 Open Letter to Hobbyists, where he told people sharing software for the public good that they were thieves and that he knew better than they did what computing should cost. Fifty years later the bill arrives as a backlog Microsoft’s scanner generates against Microsoft’s products, delivered to Microsoft’s own customers at close to a thousand a month, and the current report files it under threats.

Page 14 again: “Software vendors are using AI to identify and patch vulnerabilities, which will lead to more secure software after initial large patch waves.” The large patch waves are Microsoft’s own failure to do the hard work they are supposed to be paid to do in the first place. Remember how “enterprise” was a label they tossed around as though it meant paying for something safety-related? BleepingComputer ran the headline the day the report appeared: threat actors are ahead in the early AI race. One commenter asked what Microsoft planned to do about it. Page 47 tells us that Microsoft knows the real numbers after page 14 spun up some FUD to distract readers from what is real.