================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Sunday, August 2, 2026 - 7:36 PM EDT ================================================================ A random-number flaw in Coinkite's Coldcard wallets fueled an $88 million Bitcoin heist as OpenAI teased Astra, a model whose math breakthroughs sharpen fears of AI-driven cryptanalysis. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] OpenAI's unreleased Astra model logged fresh math breakthroughs while engineers launched the Nono sandbox to fence in AI coding agents that inherit their users' permissions. see: OpenAI Teases Astra Model After Math Breakthroughs; Nono Sandbox Aims to Contain Autonomous AI Agents * [UPDATE (new)] A random-number-generator flaw in Coinkite's Coldcard firmware let thieves sweep an estimated $88.6 million in Bitcoin from thousands of predictable-seed wallets. see: Coldcard Wallet RNG Flaw Drives $88 Million Bitcoin Heist * [TREND] Commentators including Cal Newport and Ben Thompson dissect OpenAI's accidental Hugging Face hack, arguing the alignment lessons are more reassuring than the surrounding panic implies. see: Did OpenAI's New Model "Go Rogue"?; OpenAI Hacks Hugging Face, What Happened, Alignment and Paper Clips * [UPDATE (new)] Trump canceled a planned Iran strike as talks resume and oil eased, while AstraZeneca opened roughly $400 billion merger talks with Bristol Myers Squibb. see: Trump Calls Off Iran Strike as Talks Resume; AstraZeneca in $400 Billion Talks With Bristol Myers Squibb * [UPDATE (new)] A Flash Flood Warning hit Western Pennsylvania as downpours burst a Strip District water main and forced Kennywood to close early. see: Flash Flood Warning Hits Western Pennsylvania * [UPDATE (new)] The Steelers cut safety Darnell Savage and signed veteran Rayshawn Jenkins as padded practices open at Saint Vincent College under Mike McCarthy. see: Steelers Cut Savage, Sign Safety Jenkins; Pads Come On at Steelers Camp SECURITY ---------------------------------------------------------------- 1. COLDCARD WALLET RNG FLAW DRIVES $88 MILLION BITCOIN HEIST Ransomware and Cybercrime · [cryptocurrency, vulnerability, theft] Latest developments: BleepingComputer raised the tally to roughly $88.6 million and pinned the losses on the flawed random number generator, which produced predictable seeds across thousands of wallets. Coinkite's Coldcard, a Bitcoin-only hardware wallet from the Canadian maker, shipped a March 2021 firmware integration error that routed seed generation to a deterministic software pseudorandom number generator, letting attackers predict private keys and empty wallets; Galaxy Research mapped a July 30 sweep that drained 1,196 addresses in 41 minutes, and owners who generated seeds on affected firmware should move funds to a freshly seeded wallet. - BleepingComputer: https://www.bleepingcomputer.com/news/security/coldcard-wallet-rng-flaw-likely-linked-to-88-million-bitcoin-theft/ - The Hacker News: https://thehackernews.com/2026/08/coldcard-hardware-wallet-flaw-linked-to.html 2. ATOMIC MACOS STEALER INFECTION DISSECTED Ransomware and Cybercrime · [macos, infostealer, malware] Latest developments: The SANS Internet Storm Center published a hands-on analysis of an Atomic macOS Stealer infection on August 2, 2026. Atomic macOS Stealer, sold as malware-as-a-service, harvests browser credentials, cryptocurrency wallets, and keychain secrets from Mac users and typically spreads through malvertising and cracked-app installers; Mac owners should install software only from trusted sources. - SANS Internet Storm Center: https://isc.sans.edu/diary/rss/33208 3. OPENAI TEASES ASTRA MODEL AFTER MATH BREAKTHROUGHS AI Security · [ai, cryptanalysis] Latest developments: OpenAI unveiled Astra, an unreleased model built for complex, long-running tasks, after an internal version produced ten significant advances in mathematics and theoretical computer science. Frontier labs increasingly ship models that solve original mathematics, a capability that shadows cryptography after Anthropic's Claude Mythos derived a fatal attack on the HAWK post-quantum signature scheme; Astra's math results sharpen questions about AI-driven cryptanalysis and the pace of offensive capability gains. - BleepingComputer: https://www.bleepingcomputer.com/news/artificial-intelligence/openai-teases-astra-its-next-major-ai-model-after-it-solves-10-long-standing-math-problems/ 4. NONO SANDBOX AIMS TO CONTAIN AUTONOMOUS AI AGENTS AI Security · [ai, tooling] Latest developments: Luke Hinds and Stephen Parkinson launched Nono through their startup nolabs, an open-source sandbox that isolates AI coding agents from the systems their users can reach. AI coding agents run with their users' permissions, reaching sensitive files, credentials, and production systems, where a prompt injection or hallucinated command can escalate into an incident; Nono sandboxes those agents to contain the blast radius. - Help Net Security: https://www.helpnetsecurity.com/2026/08/02/week-in-review-claude-breached-three-companies-during-tests-ad-cs-domain-takeover-poc-released/ 5. CHROME TO BLOCK NEW TAB HIJACKER EXTENSIONS Endpoint Security · [browser, extensions, patch] Latest developments: Google is preparing a Chrome feature that blocks policy-installed extensions from hijacking the New Tab page or switching the default search engine by default. Enterprise policy-installed extensions have long forced New Tab and default-search changes on users; the coming Chrome protection curbs that abuse and hands control back to administrators and users. - BleepingComputer: https://www.bleepingcomputer.com/news/google/google-chrome-may-soon-block-new-tab-hijacker-extensions-by-default/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Trump Calls Off Iran Strike as Talks Resume Latest developments: Trump said U.S.-Iran talks will restart after he canceled Saturday's planned attack, and Tehran told mediators it is near a deal with Oman to reopen the Strait of Hormuz to shipping, sending oil prices lower. President Trump scrapped a planned U.S. strike on Iran late Saturday, saying Gulf states pressed him toward negotiation and that mediators sketched the outlines of a deal to end the six-month war; crude fell on the de-escalation as Tehran signaled openness to reopening the Strait of Hormuz. - FT World: https://www.ft.com/content/c9bd508c-2915-4b34-a5a5-553bff9548a5?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/world/middle-east/gulf-states-pressed-trump-to-hold-off-on-iran-strikes-and-pursue-talks-03bcdb52 * AstraZeneca in $400 Billion Talks With Bristol Myers Squibb Latest developments: AstraZeneca opened talks with Bristol Myers Squibb over a roughly $400 billion combination that would create the world's fourth-largest drugmaker by market value. AstraZeneca, the British pharmaceutical giant, is discussing a tie-up worth about $400 billion with New York-based Bristol Myers Squibb; a completed deal would rank among the largest pharmaceutical mergers ever and reorder the industry's competitive landscape. - FT Home: https://www.ft.com/content/e9027253-e13c-460a-a4b1-f9047e5a6ca7?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: Tonight: Chance Showers And Thunderstorms, low 67F. Monday: Partly Sunny, high 80F. Monday Night: Mostly Clear, low 60F. Business: * Op-Ed Presses Credit Access for Minority Businesses Latest developments: Writing in TribLive, Barāta A. Bey argued minority-owned businesses grow through better access to capital and urged policymakers to expand credit for entrepreneurs. In a TribLive opinion piece, Barāta A. Bey contended that success for minority-owned businesses starts with an idea, determination, and access to capital, calling on lawmakers to widen entrepreneurs' access to credit. - TribLive: https://triblive.com/opinion/barata-a-bey-minority-owned-businesses-need-greater-access-to-credit-not-interest-rate-caps/ * Highland Park Victorian Sits on Its Own Block Latest developments: Pittsburgh Magazine's Hot Property featured a 1923 brick Victorian at 5454 Wellesley Avenue in Highland Park that occupies its own dedicated parcel. A brick Victorian built in 1923 at 5454 Wellesley Avenue in Pittsburgh's Highland Park neighborhood stands on an unusual parcel that gives the house a full block to itself, a quirk left by the original subdivision. - Pittsburgh Magazine: https://www.pittsburghmagazine.com/hot-property-5454-wellesley-ave-highland-park/ Around town: * Mount Lebanon Tables E-Bike Restrictions Latest developments: Mount Lebanon commissioners tabled a proposed ordinance to restrict e-bike use in the South Hills municipality, sending the plan back for revision. Mount Lebanon's commissioners set aside an ordinance meant to crack down on e-bikes in the South Hills community, returning the measure to the drawing board after debate over its restrictions. - WPXI: https://www.wpxi.com/news/local/mount-lebanon-commissioners-table-ordinance-putting-restrictions-e-bike-use/IEICCZPLMZDZXI7LI4O5K5WOHM/ * Flash Flood Warning Hits Western Pennsylvania Latest developments: Forecasters escalated Sunday's Flood Watch to a Flash Flood Warning as downpours dropped up to three inches, a water main broke in the Strip District, muddy water rushed down a Cranberry Township hillside, and Kennywood closed early. Heavy rain of up to three inches triggered a Flash Flood Warning across Western Pennsylvania on August 2, sending muddy water down a hillside in Cranberry Township, Butler County, bursting a water main that flooded a road in Pittsburgh's Strip District, and forcing Kennywood Park to shut down early. - WTAE: https://www.wtae.com/article/impact-day-sunday-with-off-and-on-downpours-for-western-pa/73323191 - WTAE: https://www.wtae.com/article/water-main-break-shuts-down-road-pittsburgh-strip-district/73327364 - WTAE: https://www.wtae.com/article/kennywood-close-early-sunday-august-2026-weather/73327480 Events: * PedalPGH Bike Ride Returns August 30 Latest developments: Organizers expect nearly 3,000 cyclists for the 33rd annual UPMC Health Plan PedalPGH, set for August 30. The 33rd annual UPMC Health Plan PedalPGH, a citywide fundraiser bike ride through Pittsburgh, returns Sunday, August 30, 2026, with organizers expecting nearly 3,000 riders across its routes. - WPXI: https://www.wpxi.com/news/local/nearly-3k-cyclists-expected-annual-pedalpgh-fundraiser-pittsburgh/NSRDFMH37NERFDXZPNTW6CCMFY/ SPORTS ---------------------------------------------------------------- Pirates (56-57) Sat Aug 1 · Pirates 4 · Reds 1 · Final Pirates beat Reds 4-1 to snap four-game losing streak https://plaintextsports.com/mlb/2026-08-01/pit-cin Sun Aug 2 · Pirates 2 · Reds 10 · Final Burns wins 12th straight decision, Stewart hits 24th HR, as Reds beat Pirates 10-2 https://plaintextsports.com/mlb/2026-08-02/pit-cin Up Next · Pirates @ Brewers · Mon Aug 3, 7:40 PM https://plaintextsports.com/mlb/2026-08-03/pit-mil Around the Teams: * Steelers Cut Savage, Sign Safety Jenkins Latest developments: The Steelers released former first-round safety Darnell Savage and signed 10th-year veteran Rayshawn Jenkins, and the Post-Gazette reported the team still hunting safety help behind Jaquan Brisker and DeShon Elliott. The Pittsburgh Steelers cut Darnell Savage, a former Green Bay first-round pick, and added free-agent safety Rayshawn Jenkins, a 10-year veteran who spent last season with the Cleveland Browns, as coaches keep searching for depth alongside Jaquan Brisker and DeShon Elliott. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/02/nfl-steelers-safety-darnell-savage-jaquan-brisker-deshon-elliott/stories/202608020074 * Pads Come On at Steelers Camp Latest developments: With padded practices beginning at Saint Vincent College, the Post-Gazette assessed which Steelers stand to shine once the physical work starts under head coach Mike McCarthy. The Post-Gazette previewed the first full-contact practices at the Steelers' training camp in Latrobe, weighing which players will separate themselves as the pads go on in Mike McCarthy's first camp as head coach. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/02/training-camp-pads-practice/stories/202608020058 READING ---------------------------------------------------------------- * Ed Zitron -- Premium: AI Is Getting Way Too Expensive Ed Zitron argues the debate over AI's supposed benefits and job losses distracts from the harder truth that the economics of running large language models are growing unsustainably expensive. https://www.wheresyoured.at/premium-ai-is-getting-way-too-expensive/ * Cal Newport -- Did OpenAI's New Model "Go Rogue"? Cal Newport dissects the intrusion into Hugging Face's production infrastructure and whether OpenAI's new model caused it, using the episode to test overheated fears about autonomous AI behavior. https://calnewport.com/did-openais-new-model-go-rogue/ * Stratechery -- OpenAI Hacks Hugging Face, What Happened, Alignment and Paper Clips Ben Thompson explains how OpenAI accidentally hacked Hugging Face and argues the alignment lessons are more reassuring than the surrounding panic implies. https://stratechery.com/2026/openai-hacks-hugging-face-what-happened-alignment-and-paper-clips/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,417.09 ▼ -0.5% Dow 52,248.93 ▲ +0.5% Nasdaq 24,949.59 ▼ -1.9% WTI crude 82.92 ▼ -5.0% EUR/USD 1.1428 ▲ +0.2% GBP/USD 1.3351 ▼ -0.3% USD/JPY 162.95 = -0.0% ================================================================ Generated 2026-08-02 19:36 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================