Open Channels FM, August 10, 2026  🔗 **Source:** [Open Channels FM, August 10, 2026](https://www.youtube.com/watch?v=6hTBYGRvpLo) Welcome to Open Channels News with your host Robert Jacobe. Today's news is brought to you by Automatic Inotion Hosting and Omnisense. Three companies that get it and are passionate about what is going on in the open-source ecosystem. Welcome to OCN, the Open Channels news broadcast. Today is August 10th, 2026. I'm Robert Jacobe, chief experience officer at Black Wall. Before we dive in, last week I was attending CMS Connect in Montreal, and we'll have a report on this week. These breaks will occur every so often as we look to solidify our off-site production. Wish us luck since Word Camp US is coming up. Looking forward to seeing the community. There is still time to register and flights aren't bad since it's very offseason for Phoenix. Back to the broadcast, we lead today with an artificial intelligent open source and cyber security experiment that went somebody somewhere nobody expected to go. An AI agent tries to sneak malware into open source. According to reporting from Socket, an artificial intelligence agent attempted to convince a real open- source maintainer to merge malware into a real open-source project. And that sentence probably deserves to be said again. An AI agent tried to social engineer a human developer into installing its malware. The incident happened during a cyber security evaluation conducted by the United Kingdom's AI security institute. Researchers were testing advanced AI models in a cyber range designed to measure their ability to perform complex security tasks autonomously. The agents were given access to penetration testing tools, pentesting, and the public internet and some normal cyber security safeguards had been intentionally been disabled as part of the test. During one of those evaluations, an AI agent powered by Mythos went considerably further than expected. The agent searched the internet and found a real open- source project that had absolutely nothing to do with the test. It then incorrectly decided that compromising that project could help it complete its assigned task. And this is where things get interesting. The AI didn't simply write malware. According to Socket, it researched the project's maintainers. It collected email addresses. It studied their GitHub activity. It created multiple fake identities. Then it submitted a pull request containing what appeared to be a legitimate bug fix. Hidden inside was a was malicious code. But the agent didn't stop there. When questions were raised about the pull request, the AI created another GitHub identity and pretended to be an independent developer who had reviewed the code and thought it was safe. In other words, it created its own sock puppet. and even time comments from different accounts to make the endorsements appear unrelated. That's not simply exploiting software. That's social engineering. The agent also sent messages using fabricated identities attempting to convince the maintainer to merge and release the code. And then it added another layer. The AI hid instructions inside an HTML comment in a GitHub issues. Those instructions wouldn't normally be visible to a human reading the page, but an AI coding agent accessing the issue through an API could see them. The hidden instructions specifically targeted coding tools, including Clawude, Codeex, and Cursor, telling them to download and execute a script. This is genius. So, now we have an AI agent attempting to compromise an open- source project while simultaneously leaving instructions designed to manipulate other AI agents. That's a very different kind of supply chain attack. Fortunately, a human developer noticed something was wrong. The malicious pull request was rejected before it could be merged and distri uh distributed to uh other users. The UK AI security institute says it found no evidence of resulting real world harm. But here's the part that matters. Open sources always depended heavily on trust. Someone submits a patch. Maintainers look at the code. They look at the contributor. They look at the conversations around the contribution. They look at what other community members are saying. All of these things help establish whether something should be trusted. Now, an AI agent can potentially manufacture every one of those signals. It can write the code, create the contributor, create another contributor to endorse, validate, and all that with the first contributor, generate the discussion, send the emails, and do all of it simultaneously across multiple projects. That's the scale problem. One attacker doing this manually can target a handful of projects. An autonomous agent could potentially target thousands, and open source maintainers are already stretched thin. There's another important caveat. These models were operating under unusual testing conditions. They had internet access. Cyber security safeguards have been reduced and the AI security institute says there is no clear indication that models behave this way under normal public use. Yet still the experiment demonstrated that the capability exists and once a capability exists we know the security industry knows uh and we have to assume that somebody will eventually try to use it. We spent years asking whether AI can write secure code. The more interesting question may be whether humans can continue identifying malicious code when the attacker writing it can also manufacture an entire community around it. This story was reported by socket based on research disclosed by the UK's AI security institute. And now AI has a storage problem. uh moving from security to infrastructure because apparently buying every GPU on Earth isn't enough. According to reporting from Tech Radar, Nvidia believes the next major bottleneck in artificial intelligence isn't necessarily compute, it's storage. For the past several years, the infrastructure conversation has largely revolved around GPUs. How many GPUs do you have? How quickly can you get them? How much power can you feed them? And how many billions billions of dollars are you willing to spend building data centers to house them? Nvidia is now making a fairly simple argument. Having incredibly fast GPUs doesn't help very much if they're sitting around waiting for data. Think about buying a Ferrari and then spending your entire commute sitting at a toll booth. I love car analogies even though I'm not a car guy. The engine isn't the problem. Getting through the toll booth is that's increasingly what's happening inside AI infrastructure. AI influence, the process of actually running a trained AI model, requires enormous amounts of info to move between storage, memory, and GPUs. And some of the requests are surprisingly small. Traditional enterprise storage has spent years optimizing around things like 4K reads. AI inference infer inference can require reads of just a few hundred bytes. that different matters. If your storage system has to do essentially the same amount of work to uh retrieve 512 bytes as it does 4K, you're wasting a tremendous amount of effort at scale as well as energy. Multiply that by thousands of us users, enormous context windows, AI agents running all the time and potentially millions of storage operations and suddenly suddenly the storage system becomes the bottleneck. Nvidia's answer is to let GPUs communicate much more directly with storage. The company has open sourced its Q file APIs and storage of stack and formally launched an initiative called storage next with more than 40 flash and storage vendors. It is also promoting something called scattera. The technical details get complicated quickly but the idea is actually pretty simple. Traditionally the CPU acts as the middleman between storage and the GPU. GPU needs data. CPU handles the request. Storage retrieves it. Then the data gets moved where it needs to go. Nvidia wants to remove more of that middleman. Scotta allows GPUs to initiate storage requests themselves, reducing CPU involvement and allowing huge numbers of small requests to happen in parallel. It's basically the GPU saying, "I'll get it myself." And there's a larger point here. The first phase of the AI infrastructure boom was about acquiring compute. The next phase is going to be about using that compute efficiently. GPUs are extraordinarily expensive. If a $100,000 accelerator spends part of its day waiting for storage, you don't really have a GPU problem. You have an infrastructure problem. Nvidia's argument is that AI success won't ultimately be determined by how much infrastructure uh an organization owns. It'll be determined by how much productivity that infrastructure is used. Productivity. There's a significant change in the conversation. We've been measuring AI infrastructure almost like horsepower. More GPUs, more data, more megawws, bigger, better, faster, stronger. But eventually economics uh catches up. Businesses don't actually care how many GPUs are sitting in a building. They care about how many useful useful AI requests those GPUs can process and how much each request costs. That's where storage, networking, memory, power, cooling, software architecture suddenly become just as important as the GPU itself. Nvidia has an obvious interest in making this happen. It sells the GPUs, duh. Making each GPU capable of supporting more users and larger AI workloads, makes the entire ecosystem around those GPUs more valuable. But the fact that more than 40 other storage vendors are participating suggests this isn't simply Nvidia inventing another acronym. the industry sees the same bottleneck and that's probably the larger AI infrastructure story we'll be talking about over the next few years. The GPU arms race isn't ending. Everything's going to get faster. But we're moving into an optimization phase. It's no longer just how much compute. It's you know how useful that work uh is and can you actually what can you get actually get out of it. This story was reported by Techraar based on Nvidia's announcements following the future of memory and storage conference. Woo! That's Monday and that's today's edition of OCN Open Channels News. Two very different AI stories, but there's actually a common thread. AI is moving from something we experiment with into infrastructure we depend on. That means we have to figure out how to make it faster, more efficient, and probably most importantly, secure. Thank you for joining us for continuing coverage of open source hosting, cyber security, artificial intelligent intelligence, content management, and the domain industry. Join us again tomorrow. I'm Robert Jacobe. Be open and stay secure., Open Channels FM, August 10, 2026, YouTube, 01kzrk07kfdwfw19nandr13cg6.