> daily_signal(2026_07_28)
The AI break-in we called years away hit a government network, private Claude chats surfaced in Google, an EMT sued over patient cameras, and a DNA drug let a boy with epilepsy walk.
PickBits Daily Signal · Tuesday, July 28, 2026
1. Threat-intel firm Hunt.io reported on 2026-07-27 that attackers pointed an autonomous open-source AI agent — Nous Research's 'Hermes,' run in a hands-off 'YOLO mode' — at Thailand's Ministry of Finance, and it explored the network, searched internal files, gathered system data and attempted to escalate its own privileges on its own, after researchers found the operation's tooling exposed on attacker infrastructure mid-intrusion; a previously undocumented 'Hades' Windows/Linux backdoor and stolen credentials were recovered, with no data exfiltration confirmed.
The load-bearing fact is that an autonomous AI agent — not a human operator typing commands, and not a narrow malware script — did the hands-on-keyboard work of a network intrusion, and researchers caught it in the act. Per The Record (2026-07-27): the cybersecurity firm Hunt.io discovered hundreds of exposed files on attacker-controlled infrastructure while an intrusion into Thailand's Ministry of Finance was still active, and the files showed the attackers had deployed Hermes — an open-source AI agent from Nous Research — in 'YOLO mode,' a configuration that lets the agent execute commands autonomously without asking a human to approve each step. From the recovered tooling, the agent independently explored the ministry's network, searched internal files, gathered system information, and sought privilege-escalation opportunities. The haul on the attacker's own exposed infrastructure included a previously undocumented cross-platform backdoor dubbed 'Hades' (Windows and Linux), stolen credentials and authentication cookies, and attack scripts targeting ministry systems; investigators found reconnaissance and credential theft but no confirmed data exfiltration. Attribution is unresolved — multiple indicators pointed to Chinese-speaking operators — and the activity traces to mid-to-late June, with authorities notified on 2026-07-15. Why an IT/security leader anywhere should care even though the target is foreign: this is the concrete, documented version of the 'agentic AI as attacker' scenario that has been a projection until now. The same off-the-shelf, open-source agent frameworks defenders are piloting for good can be pointed at a network and told to figure it out — which compresses the skill and time an intrusion requires and means the 'attacker' inside your telemetry may be a tireless automated process, not a person. Honest caveats: this is a single documented case reconstructed from the attackers' own exposed files, not a broad campaign; there is no confirmed data theft; and the operators still had to gain initial access and stand the agent up. But the checkable shift is real — 'an AI agent ran the intrusion' has moved from red-team demo to incident report.
Key fact: IF YOU RUN SECURITY OR IT OPERATIONS: update your threat model to include autonomous AI agents as the actor performing hands-on-keyboard steps — recon, lateral movement, credential harvesting, privilege escalation — at machine speed and around the clock. Hunt for the behavioral signature (rapid, breadth-first internal enumeration and repeated privilege-escalation attempts) rather than only known-bad human tradecraft, and prioritize detections that catch anomalous automated internal activity.
The Record, 2026-07-27: cybersecurity firm Hunt.io found hundreds of exposed files on attacker-controlled infrastructure during an active intrusion into Thailand's Ministry of Finance, revealing that the attackers had deployed Hermes — an open-source AI agent from Nous Research — in 'YOLO mode' to execute commands autonomously. · The Record, 2026-07-27: the agent independently explored the ministry's network, searched internal files, gathered system information, and attempted privilege escalation; the exposed tooling also included a previously undocumented 'Hades' backdoor for Windows and Linux, stolen credentials and authentication cookies, and attack scripts. · The Record, 2026-07-27: investigators observed reconnaissance and credential theft but found no evidence of data exfiltration; multiple indicators suggested Chinese-speaking operators, and attribution remains unresolved. · Timeline (The Record, 2026-07-27): activity traced to mid-to-late June 2026; authorities were notified on 2026-07-15. · Scope caveat: a single documented case reconstructed from the attackers' own exposed infrastructure, not a confirmed broad campaign, and with no confirmed data theft. · primary source
2. Shared Anthropic Claude conversations and Artifacts — including medical records, clinical-trial documents with patient names, children's names and phone numbers, and internal company files — were found indexed in Google and Bing search results over the weekend of 2026-07-25, because Claude's 'Share' links carried no search-engine 'noindex' block; the results were gone by Monday 2026-07-27, and Anthropic said the links surface only when users post them somewhere public.
The load-bearing fact is that hitting 'Share' in Claude could make a conversation you thought you were sending to one person crawlable by every search engine — and people's most sensitive material got caught in it. Per TechCrunch and Fortune (2026-07-27): a Reddit user flagged over the weekend that shared Claude conversations and Artifacts (the structured documents Claude generates) were turning up in Google and Bing results; by Monday afternoon the results had disappeared, indicating remediation. The mechanism is mundane and instructive: Claude's 'share chat' feature mints a public URL, and those URLs did not carry an 'X-Robots-Tag: noindex' header or a robots.txt disallow — so to a search crawler they were ordinary public web pages, indexable like any other. The exposed material was not abstract: reporting cited medical records with patient information, clinical-trial documents with patient names, children's names and phone numbers, internal company documents, and employee reviews with personal details. Anthropic's response put the responsibility on users: it said the shareable links 'are not guessable or discoverable unless people choose to share them themselves,' and that they appear in search only when posted somewhere a crawler can see, like a forum or social post; the company pointed users to Settings → Privacy → Shared Chats to review and revoke links. The honest caveats: the exact count of newly indexed chats this weekend was unconfirmed (a near-identical incident last year involved roughly 600), the results were pulled quickly, and 'share' did technically do what it said. But the checkable lesson lands on the user and the employer: 'share this chat' on a consumer AI product can quietly mean 'publish this chat,' and anything an employee pasted into a conversation before sharing a link — customer PII, patient data, source code, internal strategy — can outlive the moment on the open web.
Key fact: IF YOU USE CLAUDE (or any consumer AI chatbot with a share feature): open Settings → Privacy → Shared Chats now and review or revoke any links you created — 'Share' can mean 'publish a public URL,' and anything in that conversation can be indexed by search engines. Assume a shared link is world-readable, not person-to-person.
TechCrunch, 2026-07-27: shared Claude conversations and Artifacts were found indexed in Google and Bing search results after a Reddit user flagged the issue over the weekend; by Monday afternoon the results no longer appeared, suggesting remediation. · TechCrunch / Fortune, 2026-07-27: the cause was that Claude's 'Share' feature mints public URLs that carried no 'noindex' header or robots.txt disallow, so search crawlers treated them as ordinary public pages; Anthropic said the links surface in search only when users post them somewhere a crawler can see. · TechCrunch, 2026-07-27: exposed materials reportedly included medical records with patient information, clinical-trial documents with patient names, children's names and phone numbers, internal company documents, and employee reviews with personal details. · Mitigation (TechCrunch, 2026-07-27): users can review and revoke shared links via Settings → Privacy → Shared Chats; Anthropic said the links 'are not guessable or discoverable unless people choose to share them themselves.' · Corroboration (The Decoder, 2026-07-27): independently reported that shared Claude chats appeared in Google, Bing and Brave search results because Anthropic's 'Share with link' feature lacked a noindex tag, and were removed after the issue surfaced. · Scope caveat: the exact number of newly indexed conversations was unconfirmed; a near-identical incident approximately a year earlier involved around 600 indexed chats. · primary source
3. An Oregon paramedic, EMT Brittany Martin, sued Portland ambulance operator Metro West in Multnomah County Circuit Court — reported by PetaPixel and KOIN 6 News on 2026-07-27 — alleging she was fired for disabling in-ambulance surveillance cameras that recorded patients' video and audio without consent, a workplace-monitoring system she says violated Oregon patient-privacy and data-privacy law; she covered the lens and switched off the microphone in her assigned rig after supervisors did not act on her concerns, and is seeking $800,000.
The load-bearing fact is that an employer (the suit alleges) put audio-and-video surveillance in the one place a patient is most vulnerable — the back of an ambulance — and then fired the EMT who turned it off over consent concerns. Per PetaPixel (2026-07-27), citing KOIN 6 News: Brittany Martin, an emergency medical technician for Metro West, which provides ambulance services in the Portland, Oregon area, alleges in a wrongful-termination lawsuit filed in Multnomah County Circuit Court that cameras installed in ambulance patient compartments in late 2025 or early 2026 recorded both video and audio of patients without informed consent. Martin says she raised the concern that the recording violated Oregon patient-privacy protections; after supervisors did not act, she covered the camera lens and disabled the microphone in her assigned vehicle, and was then investigated, placed on administrative leave, and terminated. She is seeking $800,000. A Metro West spokesperson, Jesse Lee, declined to comment or answer questions, citing the ongoing litigation. Why this is a distinct workplace beat and why it lands on any manager who runs monitoring: employee and in-vehicle monitoring — cabin cameras, dashcams, audio capture, telematics, and increasingly AI-driven analytics layered on top — is spreading fast, and this case is the collision an operations leader has to see coming: an employer's surveillance program bumping into third-party (patient/customer) privacy law AND worker-retaliation exposure at the same time. The consent problem is not the employee's; it is the patients', who never agreed to be recorded, and audio-recording and health-privacy rules vary sharply by state. Honest caveats matter: this is one plaintiff's filed complaint, and its allegations have not been tested in court; it is carried by a single outlet (PetaPixel, citing local KOIN 6 News); there is no ruling; and the article does not establish that the cameras themselves used AI — carry it as a workplace-surveillance / consent story on its own terms, not as an AI product. But the checkable takeaway is real and actionable now: a monitoring system aimed at your workers can sweep in people who never consented, and firing the worker who flags it is exactly how an internal concern becomes a lawsuit.
Key fact: IF YOU DEPLOY EMPLOYEE OR IN-VEHICLE MONITORING (cabin cameras, dashcams, audio capture, telematics, screen/keystroke logging, or AI analytics layered on any of them): map exactly what your system records and WHO it records — recording third parties such as patients, customers or clients without their consent can be unlawful, and audio-recording and health-privacy rules vary sharply by state. Stand up a documented consent/notice process and a legal review before capture is switched on; the vendor will not carry that liability for you.
PetaPixel, 2026-07-27 (citing KOIN 6 News): Brittany Martin, an EMT for Metro West (which provides ambulance services in the Portland, Oregon area), filed a wrongful-termination lawsuit in Multnomah County Circuit Court seeking $800,000, alleging she was fired for disabling in-ambulance cameras that recorded patients' video and audio without consent. · PetaPixel, 2026-07-27: cameras were installed in ambulance patient compartments in late 2025 or early 2026 and captured both video and audio; Martin covered the camera lens and disabled the microphone in her assigned vehicle after supervisors did not act on her concern that the recording violated Oregon patient-privacy protections, and was then investigated, placed on administrative leave, and terminated. · Company response (PetaPixel / KOIN 6 News, 2026-07-27): a Metro West spokesperson, Jesse Lee, declined to comment or answer questions, citing the ongoing litigation. · Anchor: the suit is a concrete, docketed filing — Brittany Martin v. Metro West, Multnomah County Circuit Court (Portland, Oregon), damages sought $800,000. · Scope caveat: a single plaintiff's filed complaint whose allegations have not been tested in court; carried by one outlet (PetaPixel, citing local KOIN 6 News); no ruling yet; the article does not establish that the cameras used AI — this is a workplace-surveillance / consent story, not an AI system. · primary source
4. Doctors at UC San Diego and Rady Children's Institute for Genomic Medicine gave two boys with SCN2A developmental epileptic encephalopathy — a rare childhood epilepsy the drug market largely ignores — custom allele-selective antisense therapies built for each child's exact mutation, cutting seizures 26% and 90% and letting the 14-year-old walk independently for the first time, according to a study published in Nature Medicine on 2026-07-21.
The load-bearing fact is that a therapy was manufactured for two specific children's exact genetic error — not a drug class, but a molecule matched to one patient's DNA — and it measurably relieved a devastating, market-orphaned epilepsy. Per the study in Nature Medicine (2026-07-21), reported by UC San Diego and Medical Xpress: an international team led by UC San Diego and Rady Children's Institute for Genomic Medicine, with principal investigator Olivia Kim-McManus, MD, treated two children (ages 9 and 14 at the start of their studies) who have SCN2A-related developmental epileptic encephalopathy — a rare, severe childhood epilepsy caused by mutations in the SCN2A sodium-channel gene and one of the more common single-gene causes of autism. The treatment is an allele-selective antisense oligonucleotide (ASO): a short synthetic strand designed to latch onto a harmless DNA marker sitting next to each child's disease-causing mutation, so it silences only the faulty gene copy while leaving the healthy copy working. Delivered into spinal fluid every two to three months, it produced a 26% drop in seizure frequency in the younger child and a roughly 90% drop in the older one — who reached seizure-free stretches and walked independently for the first time at age 15 — alongside gains in language and motor skills and reductions in other antiseizure medications, with no serious adverse events reported. Why this closes the day on the right note: this is frontier biomedicine aimed squarely at the patients the market usually skips — an n-of-1, bespoke therapy for an ultra-rare condition where the total addressable market is, quite literally, two children, and where the constructive point is a kid walking, not a shareholder deck. Honest caveats worth carrying: this is two patients, not a trial powered for efficacy; the effect sizes differed sharply between them; bespoke ASOs are extraordinarily expensive and slow to design and manufacture per patient, so 'scalable' is not yet the word; and this is precision genomic medicine, not an AI product — its promise is the individualized-therapy pathway it demonstrates, which is exactly the kind of problem computational and AI-assisted design is now being pointed at. The checkable takeaway: a custom-built genetic medicine gave two children with an orphan epilepsy real, measured relief.
Key fact: IF YOU OR A FAMILY MEMBER FACES AN ULTRA-RARE, SINGLE-GENE CONDITION: this result adds to the evidence that individualized 'n-of-1' antisense therapies can be designed against a specific mutation. Ask a genetics/neurology specialist or an academic genomic-medicine center (e.g., programs like Rady Children's) whether a confirmed monogenic diagnosis makes a personalized ASO pathway even a research possibility — while understanding these remain experimental, expensive, and available only to a handful of patients today.
Nature Medicine, 2026-07-21 (via UC San Diego and Medical Xpress): an international team led by UC San Diego and Rady Children's Institute for Genomic Medicine, principal investigator Olivia Kim-McManus, MD, treated two children (ages 9 and 14 at study start) with SCN2A-related developmental epileptic encephalopathy using personalized allele-selective antisense oligonucleotides (ASOs) designed for each child's specific mutation. · Mechanism (Medical Xpress, 2026-07): the ASOs are short synthetic strands that bind a harmless marker adjacent to the disease-causing SCN2A mutation, reducing the mutant gene transcript while preserving the healthy copy; delivered into spinal fluid every 2-3 months. · Results (Medical Xpress / UC San Diego, 2026-07): seizure frequency fell 26% in the younger child and roughly 90% in the older child, who reached seizure-free periods and walked independently for the first time at age 15; both showed language and motor gains and reduced other antiseizure medications, with no serious adverse events reported. · Condition context: SCN2A-related developmental epileptic encephalopathy is a rare, severe childhood epilepsy and one of the more common monogenic causes of autism. · Caveats: an n-of-1 / two-patient result, not an efficacy-powered trial; effect sizes differed markedly between the two children; bespoke per-patient ASOs are costly and slow to design and manufacture, so scalability is unproven. This is precision genomic medicine, not an AI product — carry it as a constructive rare-disease breakthrough, not as an AI system. · primary source