================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Monday, July 20, 2026 - 9:06 AM EDT ================================================================ Hugging Face's disclosure that an autonomous AI agent breached its production infrastructure crystallized a day when AI served as both the weapon of intrusion and the shield defenders raced to raise. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Autonomous AI now drives both sides, breaching Hugging Face through a malicious dataset while Sophos and Capital One wield Claude Mythos 5 and VulnHunter to find flaws first. see: Hugging Face Autonomous AI Agent Breach; Defenders Deploy Claude Mythos Against Vulnerabilities * [TREND] Third-party platforms keep leaking enterprise data as Craneware exposed records tied to 2,000 US hospitals and Ernst & Young lost Social Security and card numbers. see: Craneware and Ernst & Young Data Breaches * [UPDATE (new)] Microsoft shipped emergency out-of-band update KB5121767 to stop Dell PCs shutting down after July's Windows 11 patches, while a separate WSUS sync flaw lingers. see: Windows July Update Fallout * [TREND] The ACLU armed Massachusetts defense attorneys against police surveillance tech from facial recognition to the Flock license-plate cameras Bruce Schneier recently spotlighted. see: Police Surveillance Tech Faces Legal Pushback * [UPDATE (new)] Andy Burnham became UK prime minister as Keir Starmer resigned, while mediators pressed a U.S.-Iran ceasefire after Iranian strikes pushed Brent crude above $90. see: Andy Burnham Becomes UK Prime Minister; Mediators Press for a U.S.-Iran Ceasefire SECURITY ---------------------------------------------------------------- 1. HUGGING FACE AUTONOMOUS AI AGENT BREACH AI Security · [ai, breach] Latest developments: Hugging Face traced the intrusion to a malicious dataset that abused the platform's own processing to reach a limited set of internal datasets and several service credentials, naming the vector behind last week's autonomous-agent breach of its production infrastructure. Hugging Face, the largest repository of open-source AI models and datasets, detected and shut down an autonomous AI agent system that penetrated its production systems earlier last week. Operators should rotate exposed service credentials and treat untrusted datasets as executable threats. - BleepingComputer: https://www.bleepingcomputer.com/news/security/hugging-face-breach-autonomous-ai-agent-system-internal-datasets-credentials/ - The Hacker News: https://thehackernews.com/2026/07/worlds-largest-ai-model-repository.html - Help Net Security: https://www.helpnetsecurity.com/2026/07/20/hugging-face-breached-by-autonomous-ai-agent/ - SecurityWeek: https://www.securityweek.com/hugging-face-hacked-in-autonomous-ai-attack/ 2. DEFENDERS DEPLOY CLAUDE MYTHOS AGAINST VULNERABILITIES AI Security · [ai, vulnerability] Latest developments: Sophos joined Anthropic's Project Glasswing, winning access to the nonpublic Claude Mythos 5 frontier model to find and fix flaws ahead of attackers, as Capital One open-sourced its agentic VulnHunter tool and The Hacker News argued the real Mythos risk lies in exposure windows rather than raw CVE volume. Anthropic's Mythos, revealed April 7, 2026, is a frontier model built to discover software vulnerabilities, and defenders now scramble to wield it before adversaries do. Capital One's VulnHunter traces exploitable code paths and recommends targeted fixes. - Sophos News: https://www.sophos.com/en-us/blog/sophos-joins-anthropics-project-glasswing - SecurityWeek: https://www.securityweek.com/capital-one-open-sources-ai-powered-vulnhunter-security-tool/ - The Hacker News: https://thehackernews.com/2026/07/mythos-didnt-break-your-security.html 3. WINDOWS JULY UPDATE FALLOUT Vulnerabilities and Exploits · [patch] Latest developments: Microsoft shipped emergency out-of-band update KB5121767 to stop some Dell PCs from shutting down after July's Windows 11 security patches, and confirmed a separate flaw that has delayed Windows Server Update Services synchronization for more than a week. The July 2026 Windows updates keep misbehaving across enterprise fleets, even as 16.9% of Windows devices still run Windows 10 with no security updates after Microsoft ended support October 14, 2025. Administrators should apply KB5121767 and press Windows 10 migrations. - BleepingComputer: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-bug-causing-some-dell-pcs-to-shut-down/ - BleepingComputer: https://www.bleepingcomputer.com/news/microsoft/microsoft-working-to-fix-wsus-server-sync-delays-and-timeouts/ - Help Net Security: https://www.helpnetsecurity.com/2026/07/20/windows-10-support-risks-report/ 4. CRANEWARE AND ERNST & YOUNG DATA BREACHES Data Breaches · [breach, healthcare] Latest developments: Craneware, the Edinburgh software vendor serving more than 2,000 US hospitals, disclosed that hackers reached a subset of its data environment and stole employee and customer data, while Ernst & Young began notifying victims that attackers took names, addresses, Social Security numbers, and payment-card numbers from a third-party management platform. Both firms lost data through systems beyond their core networks: Craneware brought in outside forensic investigators after detecting unauthorized access, and Ernst & Young traced its loss to a compromised third-party platform. Affected individuals should watch for identity theft and fraud on exposed accounts. - The Record: https://therecord.media/software-provider-for-us-hospitals-customer-data-breach - SecurityWeek: https://www.securityweek.com/ernst-young-data-breach-affects-personal-financial-information/ 5. POLICE SURVEILLANCE TECH FACES LEGAL PUSHBACK Surveillance and Privacy · [privacy, policy] Latest developments: The American Civil Liberties Union released a toolkit arming Massachusetts defense attorneys to expose police surveillance tools from facial recognition to AI-written reports, days after Bruce Schneier spotlighted a Flock license-plate camera that misread stolen New Jersey plates 34 03 DTM as '34 DTM' and helped police wrongly arrest a writer. License-plate readers and other police surveillance systems increasingly drive arrests on thin or garbled data, and civil-liberties groups now push courts to force disclosure of how the tools work. The Flock case shows how an AI misread of a partial plate can sweep up the wrong person. - Schneier on Security: https://www.schneier.com/blog/archives/2026/07/on-flock-license-plate-tracking-cameras.html - Wired Security: https://www.wired.com/story/the-aclu-is-arming-lawyers-to-expose-state-surveillance-secrets/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Mediators Press for a U.S.-Iran Ceasefire Latest developments: Iran struck tankers to briefly lift Brent crude back above $90 a barrel Monday, July 20, before Tehran said it had received fresh ceasefire proposals from regional mediators, and Iranian missiles killed two more American service members, the first U.S. deaths from hostile fire since April. The war between the United States and Iran, now in its second week, has killed a mounting number of American troops and disrupted Persian Gulf shipping, pushing oil and U.S. pump prices higher, while regional powers alarmed at the economic damage and risk of escalation try to bring Washington and Tehran to a halt. - WSJ World News: https://www.wsj.com/world/middle-east/iran-war-mediators-push-for-traction-on-a-new-ceasefire-6174506c - FT Markets: https://www.ft.com/content/52e98fc4-32e3-4ed9-90fd-dcbba6188df5?syn-25a6b1a6=1 - WSJ US Business: https://www.wsj.com/business/energy-oil/oil-climbs-as-u-s-iran-attacks-escalate-with-brent-back-above-90-5544ae40?mod=pls_whats_news_us_business_f * Andy Burnham Becomes UK Prime Minister Latest developments: Andy Burnham took office as Britain's prime minister Monday, July 20, the seventh UK leader in a decade, after Keir Starmer resigned, and pledged a cost-of-living-focused "circuit-breaker" premiership as he prepared to name his cabinet. Andy Burnham, the former Greater Manchester mayor, moved into 10 Downing Street to lead a struggling British economy; sterling and gilts barely moved on the transition. - FT World: https://www.ft.com/content/c35c272c-cc64-4834-bb01-bcaa93ca7214?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/opinion/asian-currencies-consolidate-may-weaken-amid-escalating-mideast-conflict-30e35087?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: Today: Sunny, high 85F. Tonight: Mostly Cloudy, low 67F. Tuesday: Showers And Thunderstorms Likely, high 84F. Business: * Namdar Takes Over Gateway Center Note Latest developments: Namdar Realty Group has taken over the mortgage note on Downtown Pittsburgh's Gateway Center, raising questions about the four-building complex's future, TribLive reported July 20. Namdar Realty Group, a firm known for distressed retail properties, now holds the note on Gateway Center, the four-tower office complex at the heart of Downtown; TribLive found its path largely unchanged so far and drew comparisons to the failed Pittsburgh Mills mall. - TribLive: https://triblive.com/local/valley-news-dispatch/despite-mortgage-sale-gateway-centers-path-remains-largely-the-same/ * Pittsburgh Water Lands $33.5M for Lead Lines Latest developments: Pittsburgh Water secured $33.5 million in new funding from the Pennsylvania Infrastructure Investment Authority on July 20 to continue removing lead service lines across the city. The utility Pittsburgh Water will spend the $33.5 million from PENNVEST to keep replacing lead service lines citywide, part of a long-running push to cut lead from residents' drinking water. - WPXI: https://www.wpxi.com/news/local/pittsburgh-water-secures-335m-new-funding-ongoing-lead-service-line-removal/7XIFUMH4WFH6HMO7D6C4JPCQYQ/ Around town: * FDA Reverses Cyclospora Finding in Lettuce Latest developments: The FDA said Monday, July 20, that the test flagging Taylor Fresh Foods iceberg lettuce for cyclospora was a false positive, walking back the finding that had tied a multistate outbreak to a single central-Mexico farm. Federal regulators reversed course on the cyclosporiasis outbreak that sickened people across dozens of states, including 11 confirmed cases in Allegheny County; Taylor Farms had already recalled iceberg lettuce grown and processed in central Mexico as a precaution. - WTAE: https://www.wtae.com/article/taylor-farms-lettuce-cyclospora-false-positive/73186163 * Code Orange Air Today, Severe Storms Tuesday Latest developments: Forecasters issued a Code Orange air-quality alert for Western Pennsylvania on Monday, July 20, as residual Canadian wildfire smoke lingered, and kept Tuesday, July 21, an enhanced-risk—3 of 5—alert day for strong to severe thunderstorms along an approaching cold front. Smoke drifting from Canadian wildfires pushed the region's air to Code Orange, while KDKA and WTAE meteorologists warn that a cold front could touch off numerous severe storms across the Pittsburgh area Tuesday afternoon. - WTAE: https://www.wtae.com/article/code-orange-western-pennsylvania-air-quality/73189874 - KDKA: https://www.cbsnews.com/pittsburgh/news/pittsburgh-area-weather-forecast-severe-weather-chances-tuesday/ * Rabbi Jeffrey Myers Retires From Tree of Life Latest developments: Rabbi Jeffrey Myers, longtime spiritual leader of Pittsburgh's Tree of Life congregation, is retiring, WPXI reported July 20. Rabbi Jeffrey Myers, who led the Tree of Life congregation in Squirrel Hill through years of rebuilding and public grief, is stepping down after a long tenure at its helm. - WPXI: https://www.wpxi.com/news/local/pittsburgh-rabbi-jeffrey-myers-who-guided-congregation-through-tragedy-retires/5NQALRYTUVAJJNZ7I6Y7JQNIN4/ Events: * Quantum Theatre Stages 'The Tempest' Latest developments: Quantum Theatre is performing Shakespeare's "The Tempest" at the Carrie Blast Furnaces, which TribLive reviewed July 20 as an enchanting farewell for departing founding director Karla Boos. Quantum Theatre presents "The Tempest" outdoors at the Carrie Blast Furnaces, the former steel site in Rankin, in a staging that doubles as a sendoff for the company's founder and director Karla Boos. - TribLive: https://triblive.com/aande/theater-arts/review-quantum-theatres-the-tempest-is-an-enchanting-sendoff-for-director-karla-boos/ SPORTS ---------------------------------------------------------------- Pirates (52-48) Sun Jul 19 · Pirates 7 · Guardians 1 · Final Skenes strikes out 8 in 7 innings as Pirates roll to 7-1 win over Guardians https://plaintextsports.com/mlb/2026-07-19/pit-cle Up Next · Pirates @ Yankees · Mon Jul 20, 7:05 PM https://plaintextsports.com/mlb/2026-07-20/pit-nyy Team USA: * Pulisic Lands on World Cup's Disappointing XI Latest developments: ESPN placed U.S. captain Christian Pulisic on the 2026 World Cup's most disappointing XI on July 20 as the tournament closed with Spain beating Argentina 1-0 at MetLife Stadium. With the United States men's national team out in the round of 16 on home soil, ESPN named captain Christian Pulisic among the tournament's biggest letdowns in its best-and-worst XI review. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49401634/world-cup-best-xi-most-disappointing-xi-messi-mbappe-haaland-pulisic READING ---------------------------------------------------------------- * Stratechery -- Who's Afraid of Chinese Models? Ben Thompson argues that anxiety over Chinese AI models is overblown for the frontier U.S. labs, and that the real policy priority is enabling competitive open U.S. alternatives. https://stratechery.com/2026/whos-afraid-of-chinese-models/ * Ed Zitron -- The OpenAI Bubble Zitron makes the case that OpenAI's finances and valuation rest on unsustainable spending and hype, framing the company as the center of an AI bubble bound to deflate. https://www.wheresyoured.at/the-openai-bubble/ * Cal Newport -- Why Reading Matters Responding to an Atlantic piece declaring the end of reading, Newport defends deep reading as essential mental training that shorter, fragmented media cannot replace. https://calnewport.com/why-reading-matters/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,524.56 ▼ -0.1% Dow 52,472.99 ▼ -0.4% Nasdaq 25,930.32 ▼ -0.5% WTI crude 79.70 ▲ +11.9% EUR/USD 1.1426 = -0.0% GBP/USD 1.3430 ▲ +0.4% USD/JPY 162.19 = +0.0% ================================================================ Generated 2026-07-20 09:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================