Agentic attackers moved from a public secret to Azure Key Vault in five minutes
Microsoft observed threat actors using an AI offensive framework to scan public GitHub repositories for credentials, sign in as service principals and explore Azure, Microsoft 365 and other cloud resources. In one case, an agent progressed from finding a client secret to exfiltrating Key Vault data in five minutes.
Why it matters to you
Deleting a leaked secret from Git history is not remediation. Revoke and rotate it immediately, inspect historical service-principal activity, restrict workload identities to the minimum resources required and replace long-lived credentials with short-lived federation wherever possible.
Credit Mutuel Arkea says cyberattack stole about €100 million
The French bank said attackers used one of its accounts to execute fraudulent transactions worth approximately €100 million. Some transfers were temporarily suspended while the bank secured operations; customer assets were not affected, and French cybercrime police opened an investigation.
Why it matters to you
Account authentication is only one control around financial APIs. Separate transaction creation from approval, cap value and velocity, require independent confirmation for changed destinations and keep a rapid mechanism for suspending specific payment paths without disabling the entire service.
Independent review finds AI is accelerating Anthropic's model development
AI-safety nonprofit METR estimates that Anthropic's capabilities on well-specified tasks have improved about 1.9 times faster since October 2025, with substantial uncertainty. METR says current systems still cannot fully automate the most important stages of AI research and development.
Why it matters to you
Model progress and operational risk may change faster than annual governance cycles. Re-run SaaS evaluations on a fixed schedule, preserve regression suites, review tool permissions whenever a model changes and avoid assuming that a previous safety assessment still applies to a new release.
Network-design changes delay Microsoft's 200-megawatt IREN capacity
IREN delayed some infrastructure delivery for Microsoft after the customer requested network-design changes and suppliers affected timing. The company is building 200 megawatts of Texas data-centre capacity and moved its operational revenue target from year-end to January, with a possible slip to late February.
Why it matters to you
Accelerators are unusable if the fabric design, optics, cooling or suppliers are not ready. For promised AI regions, request the approved topology, oversubscription targets, commissioning tests and delivery dependencies—not only GPU counts and contracted megawatts.
Google plans a $17 billion Wyoming campus with 702 MW of fuel cells
Google announced its first Wyoming data centre, supported in part by a planned 702-megawatt natural-gas fuel-cell development with carbon capture. The facility will use air cooling to reduce local water demand, while Google says it will cover power infrastructure directly driven by the project.
Why it matters to you
On-site generation can shorten grid waits but introduces fuel, emissions, capture, maintenance and single-site dependencies. Evaluate the complete power chain, water design and failure modes, and keep critical SaaS workloads portable until the facility is commissioned and independently tested.