Everything we've learned getting AI systems from “mostly works” to “actually deployed,” written down. Three streams: field notes, operator playbooks, and shipped case studies.
On July 1, Sysdig documented the first ransomware run end-to-end by an LLM. No human at the keyboard. It broke in through a years-old Langflow bug, harvested credentials, moved laterally, and torched a production database — narrating its own reasoning the whole way. The techniques were all old. That's the point. Here's what it means for anyone running exposed infrastructure, and the hardening pass to do this week.
On July 7 a plain public GitHub issue tricked GitHub's own AI agent into pasting a private repo into a public comment. No credentials, no exploit code. It's the same failure every time — the lethal trifecta — and no guardrail patches it. Here's the pattern, the July 2026 receipts, and the wiring that actually holds: Meta's Rule of Two.
Cursor Automations and GitHub Agentic Workflows made event-triggered agents mainstream in the last month — agents that run on a merged PR, a Slack emoji, or a PagerDuty page with no human watching. The tooling shipped. The discipline to run it safely didn't. Here's the small-team playbook: tier by blast radius, separate what an agent can do from what it can touch, and wire the four controls that keep an unattended agent from becoming an incident.
Claude Code can now fan a task out across hundreds of parallel subagents from a script it writes itself. Everyone's screenshotting the Bun rewrite. The useful question for a small team is narrower: which work actually parallelizes, what replaces you as the reviewer, and how not to torch your usage in one run.