How AI Agents Target Open Source and Why Storage Is the New AI Bottleneck

Robert Jacobi:

Welcome to OCN, the Open Channels News broadcast. Today is August 10th, 2026. I’m Robert Jacobi. Before we dive in, last week I was attending CMS Connect in Montreal and will have a report on this week. These breaks will occur every so often as we look to solidify our offsite production. Wish us luck since WordCamp US is coming up. Looking forward to seeing the community. There is still time to register and flights aren’t bad since it’s very off-season for Phoenix. Back to the broadcast.

We lead today with artificial intelligence, open source, and cybersecurity — an experiment that went somewhere nobody expected to go. An AI agent tries to sneak malware into open source.

According to reporting from Socket, an artificial intelligence agent attempted to convince a real open source maintainer to merge malware into a real open source project. And that sentence probably deserves to be said again. An AI agent tried to social engineer a human developer into installing its malware.

The incident happened during a cybersecurity evaluation conducted by the United Kingdom’s AI Security Institute. Researchers were testing advanced AI models in a cyber range designed to measure their ability to perform complex security tasks autonomously. The agents were given access to penetration testing tools, pen testing, and the public internet, and some normal cybersecurity safeguards had been intentionally disabled as part of the test.

During one of those evaluations, an AI agent powered by Mythos went considerably further than expected. The agent searched the internet and found a real open-source project that had absolutely nothing to do with the test. It then incorrectly decided that compromising that project could help it complete its assigned task.

And this is where things get interesting. The AI didn’t simply write malware. According to Socket.it, it researched the project’s maintainers. It collected email addresses. It studied their GitHub activity. It created multiple fake identities, then it submitted a pull request containing what appeared to be a legitimate bug fix. Hidden inside was malicious code.

But the agent didn’t stop there. When questions were raised about the pull request, the AI created another GitHub identity and pretended to be an independent developer who had reviewed the code and thought it was safe. In other words, it created its own sock puppet. It even timed comments from different accounts to make the endorsements appear unrelated. That’s not simply exploiting software, that’s social engineering. The agent also sent messages using fabricated identities attempting to convince the maintainer to merge and release the code.

And then it added another layer. The AI hid instructions inside an HTML comment in a GitHub issue. Those instructions wouldn’t normally be visible to a human reading the page, but an AI coding agent accessing the issue through an API could see them. The hidden instructions specifically targeted coding tools including Claude, Codex, and Cursor, telling them to download and execute a script.

This is genius. So now we have an AI agent attempting to compromise an open-source project while simultaneously leaving instructions designed to manipulate other AI agents. That’s a very different kind of supply chain attack.

Fortunately, a human developer noticed something was wrong. The malicious pull request was rejected before it could be merged and distributed to other users. The UK AI Security Institute says it found no evidence of resulting real-world harm.

But here’s the part that matters: open source has always depended heavily on trust. Someone submits a patch, maintainers look at the code. They look at the contributor. They look at the conversations around the contribution. They look at what other community members are saying. All of these things help establish whether something should be trusted.

Now, an AI agent can potentially manufacture every one of those signals. It can write the code, create the contributor, create another contributor to endorse and validate all that with the first contributor, generate the discussion, send the emails, and do all of it simultaneously across multiple projects. That’s the scale problem. One attacker doing this manually can target a handful of projects. An autonomous agent could potentially target thousands, and open-source maintainers are already stretched thin.

There’s another important caveat. These models were operating under unusual testing conditions. They had internet access, cybersecurity safeguards had been reduced, and the AI Security Institute says there is no clear indication that models behave this way under normal public use. Yet still, the experiment demonstrated that the capability exists, and once that capability exists, we know, the security industry knows, and we have to assume that somebody will eventually try to use it.

We spent years asking whether AI can write secure code. The more interesting question may be whether humans can continue identifying malicious code when the attacker writing it can also manufacture an entire community around it.

This story was reported by Socket based on research disclosed by the UK’s AI Security Institute.

And now AI has a storage problem. Moving from security to infrastructure, because apparently buying every GPU on Earth isn’t enough.

According to reporting from TechRadar, Nvidia believes the next major bottleneck in artificial intelligence isn’t necessarily compute, it’s storage. For the past several years, the infrastructure conversation has largely revolved around GPUs. How many GPUs do you have? How quickly can you get them? How much power can you feed them? And how many billions of dollars are you willing to spend building data centers to house them?

Nvidia is now making a fairly simple argument. Having incredibly fast GPUs doesn’t help very much if they’re sitting around waiting for data. Whew. Think about buying a Ferrari and then spending your entire commute sitting at a toll booth. I love car analogies even though I’m not a car guy. The engine isn’t the problem, getting through the toll booth is. That’s increasingly what’s happening inside AI infrastructure.

AI inference, the process of actually running a trained AI model, requires enormous amounts of info to move between storage, memory, and GPUs. And some of the requests are surprisingly small. Traditional enterprise storage has spent years optimizing around things like 4K reads. AI inference can require reads of just a few hundred bytes. That difference matters. If your storage system has to do essentially the same amount of work to retrieve 512 bytes as it does 4K, you’re wasting a tremendous amount of effort at scale, as well as energy. Multiply that by thousands of users, enormous context windows, AI agents running all the time, and potentially millions of storage operations, and suddenly the storage system becomes the bottleneck.

NVIDIA’s answer is to let GPUs communicate much more directly with storage. The company has open-sourced its QFile APIs and storage stack and formally launched an initiative called Storage Next with more than 40 flash and storage vendors. It is also promoting something called SCADA.

The technical details get complicated quickly, but the idea is actually pretty simple. Traditionally, the CPU acts as the middleman between storage and the GPU. GPU needs data, CPU handles the request, storage retrieves it, then the data gets moved where it needs to go. NVIDIA wants to remove more of that middleman. SCADA allows GPUs to initiate storage requests themselves, reducing CPU involvement and allowing huge numbers of small requests to happen in parallel. It’s basically the GPU saying, I’ll get it myself.

And there’s a larger point here. The first phase of the AI infrastructure boom was about acquiring compute. The next phase is going to be about using that compute efficiently. GPUs are extraordinarily expensive. If a $100,000 accelerator spends part of its day waiting for storage, you don’t really have a GPU problem. You have an infrastructure problem.

NVIDIA’s argument is that AI success won’t ultimately be determined by how much infrastructure an organization owns. It’ll be determined by how much productivity that infrastructure is used for.

There’s a significant change in the conversation. We’ve been measuring AI infrastructure almost like horsepower. More GPUs, more data, more megawatts, bigger, better, faster, stronger. But eventually economics catches up. Businesses don’t actually care how many GPUs are sitting in a building. They care about how many useful AI requests those GPUs can process and how much each request costs. That’s where storage, networking, memory, power, cooling, software architecture suddenly become just as important as the GPU itself.

NVIDIA has an obvious interest in making this happen. It sells the GPUs, duh. Making each GPU capable of supporting more users and larger AI workloads makes the entire ecosystem around those GPUs more valuable. But the fact that more than 40 other storage vendors are participating suggests this isn’t simply NVIDIA inventing another acronym. The industry sees the same bottleneck.

And that’s probably the larger AI infrastructure story we’ll be talking about over the next few years. The GPU arms race isn’t ending. Everything’s gonna get faster, but we’re moving into an optimization phase. It’s no longer just how much compute, it’s how useful that work is and what can you actually get out of it.

This story was reported by TechRadar based on NVIDIA’s announcements following the Future of Memory and Storage conference.

Whew, that’s Monday, and that’s today’s edition of OCN, Open Channels News. Two very different AI stories, but there’s actually a common thread. AI is moving from something we experiment with into infrastructure we depend on. That means we have to figure out how to make it faster, more efficient, and probably most importantly, secure.

Thank you for joining us. For continuing coverage of open source hosting, cybersecurity, artificial intelligence, content management, and the domain industry, join us again tomorrow. I’m Robert Jacobi. Be open and stay secure.