🍭 Defenders Have 5 Months Left ⏰

Good morning. AI can now chain together security flaws faster than most companies can schedule a Zoom call about fixing them.

Meanwhile, the intern added “123!” to his password and thinks he’s clean.

Let’s dive in 👇

🍭 What’s Cookin’:

• AI vulnerability hunting just went feral

• OpenAI got hit by an npm worm

• China is going all-in on domestic AI chips

Cyber Security
⏰ The Vulnerability Clock Is Ticking

The Bite:

Palo Alto Networks, one of the largest cybersecurity companies in the world, said it found 75 vulnerabilities across its own products after one month of scanning with Anthropic's Mythos Preview and OpenAI's GPT-5.5-Cyber.

That's more than seven times the 5–10 flaws it typically finds per month using conventional methods.

The company now estimates defenders have a three-to-five-month window before attackers gain access to the same class of AI-powered vulnerability-hunting capabilities at scale.

None of the 75 flaws had been actively exploited in the wild.
All have since been patched.

Snacks:

• Palo Alto scanned 130+ products over one month using both Mythos and GPT-5.5-Cyber

• The models generated functional exploits more than 70% of the time

• Many of the flaws were chains; individually minor bugs that became high-severity when combined

• The false-positive rate averaged ~30%, depending on how much context researchers gave the models

• Palo Alto built a custom "AI-scanning harness" to connect the models to its codebase

• Klarich said Anthropic's and OpenAI's models find different vulnerability types and should be run in parallel

Why it Bites:

The numbers here are the opposite of impressive; they're destabilizing.

A 7x increase in vulnerability discovery in a single month means the old math that security teams relied on (find a few, patch a few, stay ahead) just broke.

The volume alone would overwhelm most organizations' patch cycles, and that's before attackers get their hands on equivalent models.

The real shift here is in what the models can do that earlier tools couldn't:

Chain low-severity bugs into high-severity exploit paths. In minutes.

That's the kind of work that used to require a skilled human researcher spending days connecting logic flaws across a codebase.

And if a defender like Palo Alto needed:

• a custom harness,

• significant tuning,

• and a tolerance for a 30% false-positive rate to make this work…

Imagine what happens when an attacker with fewer guardrails and no disclosure obligations runs the same scan against software that hasn't been hardened yet.

Three to five months… that’s a real countdown.

Steal This Prompt
🖼️ Watercolor City Posters

Turn any city into a dreamy watercolor poster that looks straight out of an overpriced boutique gift shop in Lisbon.

Use it to:

• Create aesthetic travel posters for your city

• Make printable Etsy-style wall art

• Turn hometowns into cozy watercolor collectibles

Workflow:

1. Hit this link: Water Coloured City Poster

2. Paste the prompt into you AI model

3. Replace the city name with your favorite place and add details

4. Watch it cook into gallery-wall-core

   Try the prompt on Snack Prompt

_ToolBox™
🧰 5 BRAND NEW AI LAUNCHES

🌐 Wowable
Paste a Google Maps link, Insta page, or random screenshot and it spits out a live website. Kinda feels like web design got replaced by ctrl+c / ctrl+v.

🛸 Gradient Bang
Imagine Factorio if your coworkers were LLMs and your boss was a space pirate. You talk to AI agents to trade, survive, and accidentally start galactic beef.

📈 PHBench
Product Hunt launches, but make it predictive analytics. Tells you which launches have “future unicorn” energy using 67K+ launches and funding data.

🖥️ OpenIT
Open-source ServiceNow alternative that runs on Claude Code. Ticketing, provisioning, IT chaos… but now your AI remembers how Dave from accounting broke VPN access again.

🧠 mia
Cursor for Product Managers. Turns scattered customer feedback into requirements your AI dev stack can actually ship. PMs just found their exoskeleton.

_{Everything Else}
🧠 You Need to Know

🔓 OpenAI Hit By npm Supply Chain Attack
→ Two employee devices were compromised via the "Mini Shai-Hulud" npm worm, exposing signing certificates and forcing all macOS ChatGPT users to update before June 12.

⚖️ Microsoft Feared Being "The Next IBM"
→ Nadella testified he worried about outsourcing core IP to OpenAI, with discovery showing Microsoft will have spent over $100B on the partnership by June 2026.

🏛️ Colorado Rewrites Its Landmark AI Law
→ The legislature passed SB 26-189 replacing its first-in-the-nation AI regulation with a narrower notice-and-appeal framework, pushing the effective date to January 2027.

💾 China Doubles Down On Homegrown AI Chips
→ Tencent, Alibaba, and DeepSeek are committing to domestically produced GPUs even as Nvidia's H200 shipments to China show signs of resuming.

🚨 Palo Alto: AI-Driven Exploits Months Away
→ After scanning 130+ products with Mythos and GPT-5.5-Cyber, the company found 75 vulnerabilities in one month and says defenders have 3–5 months to prepare.