Last month: a self-propagating npm/PyPI worm hit 170+ packages, prompt injection turned AI agents into RCE, and new models learned to run for 35 hours.