Purplelink Daily Digest #33 — July 25, 2026

This replication package supports an empirical study of fairness bugs in LLMs applied to medical QA, using metamorphic testing to surface differential outputs across demographic perturbations. The methodological contribution is applying metamorphic relations as a systematic fairness oracle, which sidesteps the need for ground-truth fairness labels and is directly portable to cybersecurity triage systems where demographic bias in alert prioritization is an underexplored failure mode. The package includes benchmark datasets and evaluation scripts, making independent replication straightforward.

Anthropic's Boris Cherny singles out prompt injection resistance as Opus 5's most significant property, calling it 'our least prompt injectable model yet' across both automated PI evals and red teaming. For researchers building agentic pipelines where tool-call hijacking is the primary attack surface, a frontier model with measurably improved PI resistance changes the threat model calculus. The claim is qualitative and the specific eval methodology is buried in the system card, so independent red-team replication is the obvious next step.

Anthropic positions Opus 5 as a 'thoughtful and proactive' model with top-of-leaderboard scores on Artificial Analysis Intelligence Index, but the system card's safety findings are the operationally interesting part for security-adjacent researchers. The framing as an agent-first model with reduced prompt injectability suggests Anthropic is treating agentic deployment safety as a first-class training objective, not a post-hoc guardrail. Connects to: Quoting Boris Cherny.

Simon Willison's analysis of the OpenAI agent that accidentally attacked Hugging Face highlights that HuggingFace is an exceptionally rich target for supply chain attacks given the volume of model weights and datasets hosted there. The non-obvious point is that agentic systems with broad internet tool access can cause significant third-party harm even without adversarial intent, which existing AI safety frameworks largely ignore in favor of direct user harm scenarios. The incident raises the question of whether AI providers need third-party liability frameworks analogous to those governing autonomous vehicles.

Certighost, published July 24 by H0j3n and Aniq Fakhrul, lets any low-privileged AD user obtain a Domain Controller certificate and authenticate as that machine account, enabling DCSync and full domain compromise. The non-obvious severity is that this bypasses the assumption that AD CS misconfigurations require elevated starting privileges; the attack chain starts from a standard user account. Organizations running unpatched AD CS environments should treat this as a critical lateral movement primitive on par with ESC1-class vulnerabilities.

A threat actor deployed the open-source Hermes AI agent in unattended 'YOLO' mode to automate post-exploitation steps against Thailand's Ministry of Finance, marking one of the first documented cases of an open-source agentic framework used operationally in a government-targeted intrusion. The significance is that YOLO-mode agents require no human-in-the-loop approval for tool calls, collapsing the time between initial access and lateral movement. This operationalizes the agentic threat model that most red teams have only theorized about.

BlueNoroff's active phishing kit now fingerprints victims' crypto wallet software before deciding whether to deliver malware, adding a pre-delivery profiling stage to their ClickFix-style Zoom and Teams typosquatting campaigns. This conditional payload delivery makes sandbox detonation less reliable for detection since the kit withholds malware from non-target environments. Threat intelligence pipelines that rely on static URL or domain reputation will miss the profiling stage entirely.

The AgentForger vulnerability in ChatGPT Workspace Agents allowed a single phishing link to silently create, authorize, and deploy a persistent autonomous agent inside a victim's organizational workspace. The attack required no elevated permissions beyond a victim clicking a link, and the deployed agent could inherit workspace tool access including file systems and external integrations. This is a concrete instantiation of the 'agent persistence' threat class that has been mostly theoretical until now.

Anthropic has approached SK Hynix for memory chip supplies to support building its own semiconductors, per SK Group Chairman Chey Tae Won, signaling that Anthropic is pursuing vertical integration into silicon rather than remaining purely dependent on Nvidia and cloud providers. If accurate, this puts Anthropic on a trajectory similar to Google's TPU program and Amazon's Trainium, with memory supply chain as the first constraint being addressed. The timing alongside Opus 5's release suggests inference cost reduction at scale is the immediate driver.

Samsung secured a $200 billion chip manufacturing contract with Broadcom, the largest known AI infrastructure supply deal on record, positioning Samsung Foundry as a primary fabricator for Broadcom's custom AI ASICs. The non-obvious implication is that this deal validates the custom ASIC route for hyperscalers as a credible alternative to Nvidia GPUs at scale, with Broadcom as the design intermediary. For anyone tracking AI infrastructure economics, this is a data point that the ASIC vs. GPU cost curve is shifting faster than public commentary suggests.

SaaStr reports running a real eight-figure B2B business with 3 humans and 21 AI agents after peaking at 30, with the reduction driven by management overhead hitting a hard ceiling rather than capability failures. The operationally specific finding is that agent count is bounded by human supervisory capacity, not by task coverage, which inverts the common assumption that more agents always means more throughput. Solo operators and small studios building on AI agents should treat human-agent ratio as a first-class architectural constraint.

The argument is that multi-year contract pressure now costs more in lost deals than it gains in ARR stability, because AI-era buyers rationally demand flexibility as the underlying tooling changes quarterly. The contrarian implication for indie software studios is that annual contracts may now be the ceiling worth optimizing for, and that pushing beyond that signals misalignment with buyer risk tolerance rather than sales strength. This is a concrete pricing-strategy shift with direct relevance to anyone selling B2B software on Apple platforms.