Wednesday, and today's throughline is the security ledger — and the uncomfortable fact that AI is now writing entries on both sides of it. It is breaking in faster, it is quietly opening new holes while trying to patch old ones, and it is the reason a fresh wave of capital is chasing anyone who can watch the machines we just put to work. Three stories for the person who actually owns the risk.
Breach notices already blew past all of last year
The volume numbers finally caught up to the warnings. More than 471 million victim notices were tied to data compromises in the first half of 2026, according to a new report from the Identity Theft Resource Center — a nonprofit that tracks publicly reported breaches, and the reason is not a mystery. Between March 2025 and February 2026, one in four breaches was AI-enabled, up 56% from a year earlier, according to a new study from IBM. Boards have noticed: 78% of companies said they would boost cybersecurity budgets over the next 12 months.
The operator's take: the attacker just got a productivity tool, and it works. When phishing, recon, and exploit development get cheaper and faster on the offensive side, the old assumption — "we're too small or too boring to target" — stops holding, because targeting is no longer the expensive part. Do not read the budget-increase stat as permission to spend blindly. Read it as the market repricing risk in real time. Spend where the AI advantage is neutralized: phishing-resistant MFA, tighter identity and access hygiene, and detection that assumes the intruder will move like software, not a person. The threat scaled; your controls have to scale with it, not your headcount.
An AI "fix" quietly shipped a shell-injection hole
The most instructive security story this week is about a defense that became the vulnerability. Wiz's Red Agent found that a GitHub Copilot Autofix patch to Snowflake's snowflake-connector-net repo on June 18, 2026 replaced a safe input pattern with raw string interpolation of a GitHub issue title, opening a shell-injection hole that was exploited within five days.
The operator's take: this is the AI supply-chain risk nobody put in the threat model. We adopted AI code tools to reduce defects, and here one confidently introduced a classic injection bug into a widely used connector — then it got weaponized in under a week. The lesson is not "turn off Copilot." The lesson is that AI-generated changes are untrusted input to your codebase, full stop. Every auto-fix, every agent-authored PR, gets the same scrutiny you would give an unknown external contributor: mandatory human review on security-sensitive paths, static analysis in the pipeline that the agent cannot bypass, and no auto-merge on anything touching input handling, auth, or dependencies. Speed at the keyboard means nothing if it manufactures the next CVE.
The money is moving to watch the agents
Capital always follows the new attack surface, and right now the surface is your own agents. Obsidian Security raised $85 million in August at a $1.1 billion valuation as demand grows for products that monitor AI agents interacting with enterprise data, with the company saying nearly 70% of its clients now allow AI agents to touch business systems.
The operator's take: that 70% figure is the whole story. Agents are already inside the data — reading, writing, and acting with credentials you granted — at most companies that have moved past the pilot stage. A funded market for "watch the agents" exists because the old security stack was built to police humans and endpoints, not autonomous software making thousands of decisions a minute. Before you buy a monitoring layer, though, do the unglamorous work it depends on: give every agent its own scoped identity, log every action it takes, and put least-privilege around what it can reach. You cannot monitor what you never inventoried. The tooling is real and worth evaluating, but it is a control on top of governance, not a substitute for it.
Also on my radar
- OpenAI drew an age line. OpenAI launched a teen-tailored version of ChatGPT for users 13-17 that blocks self-harm and romantic or sexual conversations and uses age prediction to auto-route minors into the mode, with parental quiet hours and high-risk safety notifications — age-assurance and content routing are becoming compliance features, and any consumer product with young users should expect the same expectation soon.
- The compute deals keep compounding. IBM announced a multiyear partnership with Together AI, including a $240 million investment to deploy an NVIDIA HGX B300 cluster on IBM Cloud for high-performance AI workloads and open-model inference — enterprise AI competition is increasingly a competition over hardware access, and that leverage shows up in your inference bill.
- The adoption gap is real. Gartner found only 17% of organizations have fully deployed AI agents, and projects that more than 40% of agentic AI projects will be canceled by the end of 2027 over costs, unclear value, and weak governance — the winners will be the shops that pair agents with the controls to survive an audit.
The throughline for a Wednesday: AI is now on both sides of the security desk. It is amplifying the attacker, occasionally sabotaging the defender, and simultaneously creating the market that funds the fix — all while agents quietly accumulate access inside your systems. The move is not to slow down; it is to treat everything AI produces or touches as untrusted until proven otherwise, and to give the machines scoped identities, audit trails, and least privilege before you give them the keys. Governance is the moat now, not the friction. That's the Signal for today.
Paul Sapio is the CIO of Mikhail Education and a full-stack AI engineer. Open to contract work in security, networking, AI, and SaaS development — reach out.