Stablecoin got a boost by the Bank of England as rules are eased while the flaw-finding prowess of Anthropic's Mythos deepens the divide between the company and a hidden comment in an Azure DevOps pull request was enough to steer an AI review agent into another project, retrieve confidential information, and post it back where the attacker could read it, prompting Microsoft to pull it.
Bank of England Softens Systemic Stablecoin Rules
Last month the Bank of England published its final policy stance and proposed rules for sterling stablecoins that could become systemically important for the UK economy. The objective is to find the best compromise between innovation, economic stability, and international competitiveness. The new policy positions have dropped the previously proposed user-level holding caps, instead replacing them with an issuer-level guardrail. In this case, that guardrail is a £40 billion system-wide ceiling for each token, thus placing restrictions on the market as a whole rather than customers directly. As dollar stablecoins gain more attention in the US, the shift is a response to industry demand for stablecoins to become a viable payment instrument, albeit without allowing risking a situation where unfettered growth could destabilize the wider economy. The framework only concerns stablecoins that become systemic in UK payments.
Anthropic’s Mythos Found Flaws in Classified U.S. Systems Within Hours
When Anthropic’s Mythos model reportedly needed mere hours to identify vulnerabilities across highly sensitive U.S. government systems during a testing exercise with intelligence agencies, it added to the tension between the company and the government and complicated the governance debate. A U.S. official cited by the Associated Press said Anthropic worked with those agencies to assess the model against classified systems. Mythos quickly identified certain vulnerabilities, although the official stressed that finding a flaw is different from exploiting it. The testing formed part of Anthropic’s Project Glasswing, an initiative aimed at helping technology companies secure critical software against the risks posed by powerful AI systems. The project reflects a growing concern inside government: advanced models may soon become central to vulnerability research, exploit development and cyber operations.
Nuvei’s Payoneer Acquisition Redraws the Global Payments Stack
Canadian payments processor Nuvei’s acquisition of US payments technology platform Payoneer in a $2.75 billion agreement would create a combined company aimed at helping organizations accept, hold, covert, and move money, including stablecoin transactions, across over 190 countries and territories by tapping into a 2.4 million-strong customer base. International business customers, which often have to invest heavily in connecting separate providers for acquiring, accounts, foreign exchange, and supplier payouts will probably welcome the news. Having a more unified platform at their disposal could ease some of that operational burden by reducing the number of API integrations, contracts and reconciliation processes.
The DevOps Problem with AI Agents Is Delegated Authority
A hidden comment in an Azure DevOps pull request was enough to steer an AI review agent into another project, retrieve confidential information, and post it back where the attacker could read it. The attacker never needed elevated access; but rather simply exploited that of the reviewer. Manifold Security’s analysis of Microsoft’s Azure DevOps MCP server found that a contributor could place instructions inside an HTML comment in a PR description. The comment is invisible in Azure DevOps’ web interface but returned by its API. When a reviewer asks an agent to assess the PR, the MCP server passes that hidden text to the model alongside the pull request details. The agent then faces a problem humans do not, since it cannot reliably treat the PR as both information to analyze and a potentially hostile source of instructions. It sees language, and language is the medium through which it is controlled.
Meta’s Muse AI Rollout Revealed a New Privacy Fault Line
Meta withdrew Muse Image’s Instagram-reference feature after three days because it had built an AI product around an unusually expansive interpretation of public content. If an Instagram account was public, another user could tag it in a Meta AI prompt and generate an image based on that person’s posts. The account holder was automatically included, not asked first, and was not necessarily notified when their content was used. For large AI platforms, publicly accessible material has become a tempting category: cheap, abundant, varied and already tied to the kinds of human details that make synthetic images convincing. A public Instagram profile can provide faces, angles, clothing, interiors, travel, relationships, a recognizable visual style. It is a ready-made model of a person’s life.