AI & Cybersecurity Report - August 2025 Edition

August 2026 saw AI-enabled attacks shift from experimental to operational at scale. A China-linked actor ran a fully autonomous 8-agent system against Taiwanese government targets, mapping 21 systems and exfiltrating 2,500 records with minimal human input. Hugging Face breach fallout continued, prompting OpenAI to pause model releases. Prompt injection evolved toward multi-turn splitting that evades single-turn filters; a critical Windsurf MCP flaw enabled unauthorized command execution. Social engineering scaled via AI-generated lures. OWASP's 2026 LLM Top 10 elevated Excessive Agency to third place, confirming attackers exploit granted permissions over privilege escalation. EU AI Act Article 50 transparency duties took effect August 2.