The Day a Jailbroken AI Reached Medical Records── A hijacked agent, poisoned memory, firms cutting staff to fund compute
Download the video (MP4, 11 MB)
Companies are suddenly handing more and more work to AI. When we delegate, we rarely doubt that it will do as told. Today brought a case where that assumption broke. A model stripped of its maker's guardrails reportedly passed through a phone carrier and reached patient information. If the assistant we trust is steered by an attacker, who notices, and who stops it?
The story moves from the hijack itself to how fast these tools spread, the holes in their defenses, and fewer people checking. Then come attacks that strike later, and plans kept out of sight. For pharma teams holding patient data, each could happen at home.
01A Jailbroken AI's Intrusion
Source CyberSecurityNews ／ Bangkok Post
When an AI is manipulated, does the damage stay inside the company using it? Today's first event shows it did not.
Look at how far apart the way in and the end point are. The way in was a phone carrier. From there, the attacker reportedly moved into other firms running on that same infrastructure. One breach was enough to reach patient files held far away.
- Reported by
- CyberSecurityNews
- AI used
- Jailbroken DeepSeek AI agent
- Result
- Reportedly reached medical records via the telecom
- Reported by
- CrowdStrike report (Oct 29)
- AI used
- DeepSeek's AI and AI agent tools
- Result
- Breached systems of organizations worldwide and stole data
Both reports named DeepSeek's AI as the attack tool
And in attacks reported separately, a model from the same developer served as the weapon. That is hard to call a coincidence. Models whose guardrails come off easily may be turning into handy tools for attackers.
The core problem is this. Guardrails a maker builds in become hard to enforce once the model leaves its hands. A user can strip them with a little clever wording. That is what makes this case unsettling.
Pharma companies hold patient information and clinical trial files. When we outsource work, we rarely check which models a vendor runs or whom it connects to. I take seriously that the foothold may not be our own company.
So how deeply have tools that can be manipulated like this already entered everyday work? That is where we go next.
02Agent Platforms Spread
Source digitimes ／ Yahoo Finance Australia ／ Cloud Wars
An intrusion does limited harm if few people use the tool. The worry is that users and uses of this kind of system are growing fast.
Daily users up more than 4x
DeepSeek Harness had 1.54 million daily users as of Nov 4, over 4x in under 3 months. An official plugin market also opened.
Core operations go live
FlowX.AI and Google Cloud are moving core-operations AI agents into production for firms in highly regulated industries.
Working directly in records
SharePoint joins Microsoft's Work IQ, so AI agents work directly inside core business systems.
These stories point the same way. AI has moved past the trial stage. It now handles key operations and files without a go-between. That likely means fewer moments where a person steps in to check. Work moves faster, but the reach of the AI grows just as much.
The pace matters too. When users multiply within a few months, security reviews inevitably lag behind. The gap between how fast use spreads and how fast checks keep up becomes the opening.
Letting outsiders add components brings convenience, but it also adds entry points. If one added piece is malicious, the whole system may follow its orders.
Pharma firms could use such tools to manage documents or answer inquiries. One of today's rollouts targets sectors with strict rules, much like ours. Do our reviews assume the AI could be steered from outside? That is the question to ask now.
Then how far can the protections built into the AI itself be trusted as it spreads?
03Gaps in the Safety Net
Source CyberSecurityNews ／ TechJuice
If use keeps widening, our main shield should be the protections makers build in. Yet today, several reports showed those protections failing in different places.
| Case | Mechanism broken | Implication |
|---|---|---|
| DeepSeek's agent | Safety limits removed by jailbreak; used in an intrusion | An unrestricted agent carried out the intrusion |
| Gemini | Images blocked by its safety filter downloadable without a jailbreak | Hiding output left a way to retrieve what was generated |
| Ajax (PewDiePie) | Banned twice by OpenAI (distillation); uncensored model released later | Blocking use did not stop an unrestricted model being built |
Side by side, each failure happened at a different point. One at the instructions given during use. One at the exit where outputs are fetched. One at the way access gets cut off. Harden one spot, and an attacker slips out another. Defenders must watch every exit at once.
Hiding an answer only protects what appears on screen. If the file still sits behind it, another way to pull it out remains. Stopping something is not the same as it never existing.
Even if access is banned, a new model trained on a strong model's outputs carries none of the original limits. Shutting out a user cannot take back what has been learned. Protection does not reach beyond the maker's hands.
For pharma work, when an AI vendor calls its product safe, ask where the protection sits. Does it block answers, delete outputs, or restrict users? Today's cases suggest one layer is not enough.
If we cannot rely on makers' assurances, the last line is human review. But the people doing that review are changing too.
04Cutting Staff, Investing in Compute
Source blog.google ／ The Cool Down ／ Windows Latest ／ Seeking Alpha
Just as human checks become critical, big companies are trimming staff and pouring money into computing hardware. Fewer people to verify, and more AI everywhere. The two trends overlap.
| Company | Workforce | AI investment |
|---|---|---|
| Meta | Cut 8,000 jobs; dropped plans to hire 6,000 | Up to $135B on AI infrastructure in 2026 |
| Microsoft | Offered voluntary buyouts to about 60,000 | CEO described a vision of 20 million AI agents |
| No workforce moves in today's sources | Added 8tx and 8i Max to 8th-gen TPUs; 4 new systems in a year | |
| Challenger, Gray & Christmas | Cited the economy as a reason for tech job cuts | |
Job cuts and major AI investments were announced at the same time, in the same industry
Within one industry, headcount cuts and huge hardware bets arrived almost together. Companies seem to be shifting who does the work, from people to machines. Still, some observers blame the business climate for the layoffs. AI alone cannot be called the cause.
On the hardware side, specialized chips are arriving in quick succession. The faster parts turn over, the more money hardware absorbs. That likely leaves less for people.
Inviting staff to leave shifts work onto those who stay. With fewer reviewers, there is less time to catch the mistakes AI makes.
Pharma companies will likely face proposals to cut roles freed up by AI. But cutting the people who verify information lowers the quality of what reaches patients. Decide who owns each check before reducing headcount. That order must not be reversed.
Yet even if people keep the checking role, some attacks cannot be spotted in the moment. They target what the AI remembers.
05Poison in Agent Memory
Source arXiv
An AI that recalls what it read earlier is useful. But if that stored content hides a hostile command, the convenience becomes the attack route.
What makes this path dangerous is the time gap. When the AI reads the bad command, it does nothing. It acts later, inside a separate task on another day. Cause and effect sit far apart, so tracing them afterward is hard.
| Item | What the abstract says | Implication |
|---|---|---|
| Test setup | Long multi-session task trajectories, 4 domains, 5 memory designs | Designs compared under the same conditions |
| Finding 1 | All designs were poisoned; effect on later actions varied widely | No design fully resisted |
| Finding 2 | Poison optimized for a given memory design was more effective | Design-specific weaknesses surfaced |
| Not stated | How weak each design is, success rates, evaluation of defenses | Choosing a design needs the full paper |
The paper has not yet been reviewed by other researchers. Still, none of the approaches tested could block harmful writes. When attackers studied a target's setup and tuned their input, the damage grew. Whichever option you pick, it offers no real comfort.
You do not need to command the AI directly. Slip a command into an email or file it reads, and you can steer it. The more it reads, the more ways in.
Pharma teams increasingly feed AI papers, inquiries and vendor files. One bad command could make it act alone in a different job days later. Log where every input came from, so it can be traced. That is where defense begins.
So what can we see today of AI moves closer to the pharma world, and how much do we really know?
06In the Pharma Field
Source Press Release Hub ／ NYU Langone Health ／ Time Magazine
None of this is someone else's problem for pharma. Today several AI developments surfaced close to our field. But how much each one actually revealed varies greatly.
AI drug discovery deal
A French drugmaker and AI drug discovery firm XtalPi announced an AI-driven drug discovery collaboration. No amounts or terms reported.
Predicting medical decisions
NYU Langone Health said AI model predictions reached accuracy that can quickly improve medical decisions. Headline-only report.
Data annotation vendor
Sama, an AI data annotation firm and former vendor to Meta and OpenAI, is winding down and liquidating assets, citing litigation.
Compared side by side, the unknowns stand out more than the knowns. A partnership was announced, but without its conditions. A claim of better accuracy came with nothing anyone can check. Big as news, these are not yet material for decisions.
Behind smarter AI are people marking up the material it learns from. A firm that did that work is shutting down after legal claims. Who will carry this vital work next is now unclear. If the quality of that material wavers, so does the quality of answers from AI trained on it.
When pharma professionals hear AI news, separate an announcement from verified substance. Using claims without conditions or evidence in internal decisions is premature. Always keep a record of what was revealed and what was not.
Hidden details matter outside companies too. The last story is a community suing over a computing facility.
07A Hidden Plan and a Lawsuit
The hardware that runs AI has to stand on real land. AI feels like it lives on screens, but its buildings sit in communities. When did the people living there learn of the project? Today a court is asked that question.
| Report | Claim | Implication |
|---|---|---|
| WTOC | 3 residents sued OpenAI, county development authority, commissioners | The county that courted the project was sued too, not just the firm |
| WTOC (complaint) | Plan and deal terms hidden from residents until the land deal closed | At issue: when residents learned of the plan |
| WSB-TV | Alleges racketeering (organized crime and conspiracy) | The way the plan advanced is itself called unlawful |
The suit targets more than the AI company. It also names the local officials who invited it. What it challenges is a process allegedly kept quiet until everything was settled. Officials reportedly moved ahead with the company first, which looked like secrecy to locals. I believe, as my own reading, that the anger points there.
Running a project under a code name is probably not unusual. But if the substance stays hidden behind the name, trust is hard to rebuild later. When a name conceals what is inside, it becomes a question of process.
Pharma companies face the same question. When did we tell the people involved about a project to handle patient information with AI, and how much? An opaque process itself erodes trust. Build the rule of informing before deciding into the project from the start.
Today's events shared one thread. Across methods, hardware and staffing, the risk lay where no one could see.
Watch whether details of the European telecom breach path and the affected companies are made public.
Open the full transcript
Intro
Companies are suddenly handing more and more work to AI. When we delegate, we rarely doubt that it will do as told. Today brought a case where that assumption broke. A model stripped of its maker's guardrails reportedly passed through a phone carrier and reached patient information. If the assistant we trust is steered by an attacker, who notices, and who stops it?
The story moves from the hijack itself to how fast these tools spread, the holes in their defenses, and fewer people checking. Then come attacks that strike later, and plans kept out of sight. For pharma teams holding patient data, each could happen at home.
CH 01 A Jailbroken AI's Intrusion
When an AI is manipulated, does the damage stay inside the company using it?Today's first event shows it did not.Look at how far apart the way in and the end point are. The way in was a phone carrier. From there, the attacker reportedly moved into other firms running on that same infrastructure. One breach was enough to reach patient files held far away.And in attacks reported separately, a model from the same developer served as the weapon. That is hard to call a coincidence. Models whose guardrails come off easily may be turning into handy tools for attackers.The core problem is this. Guardrails a maker builds in become hard to enforce once the model leaves its hands. A user can strip them with a little clever wording. That is what makes this case unsettling.Pharma companies hold patient information and clinical trial files. When we outsource work, we rarely check which models a vendor runs or whom it connects to. I take seriously that the foothold may not be our own company. So how deeply have tools that can be manipulated like this already entered everyday work?
That is where we go next.
CH 02 Agent Platforms Spread
An intrusion does limited harm if few people use the tool. The worry is that users and uses of this kind of system are growing fast.These stories point the same way. AI has moved past the trial stage. It now handles key operations and files without a go-between. That likely means fewer moments where a person steps in to check. Work moves faster, but the reach of the AI grows just as much.The pace matters too. When users multiply within a few months, security reviews inevitably lag behind. The gap between how fast use spreads and how fast checks keep up becomes the opening.Letting outsiders add components brings convenience, but it also adds entry points. If one added piece is malicious, the whole system may follow its orders.Pharma firms could use such tools to manage documents or answer inquiries. One of today's rollouts targets sectors with strict rules, much like ours. Do our reviews assume the AI could be steered from outside?
That is the question to ask now. Then how far can the protections built into the AI itself be trusted as it spreads?
CH 03 Gaps in the Safety Net
If use keeps widening, our main shield should be the protections makers build in. Yet today, several reports showed those protections failing in different places.Side by side, each failure happened at a different point. One at the instructions given during use. One at the exit where outputs are fetched. One at the way access gets cut off. Harden one spot, and an attacker slips out another. Defenders must watch every exit at once.Hiding an answer only protects what appears on screen. If the file still sits behind it, another way to pull it out remains. Stopping something is not the same as it never existing.Even if access is banned, a new model trained on a strong model's outputs carries none of the original limits. Shutting out a user cannot take back what has been learned. Protection does not reach beyond the maker's hands.For pharma work, when an AI vendor calls its product safe, ask where the protection sits. Does it block answers, delete outputs, or restrict users?
Today's cases suggest one layer is not enough. If we cannot rely on makers' assurances, the last line is human review. But the people doing that review are changing too.
CH 04 Cutting Staff, Investing in Compute
Just as human checks become critical, big companies are trimming staff and pouring money into computing hardware. Fewer people to verify, and more AI everywhere. The two trends overlap.Within one industry, headcount cuts and huge hardware bets arrived almost together. Companies seem to be shifting who does the work, from people to machines. Still, some observers blame the business climate for the layoffs. AI alone cannot be called the cause.On the hardware side, specialized chips are arriving in quick succession. The faster parts turn over, the more money hardware absorbs. That likely leaves less for people.Inviting staff to leave shifts work onto those who stay. With fewer reviewers, there is less time to catch the mistakes AI makes.Pharma companies will likely face proposals to cut roles freed up by AI. But cutting the people who verify information lowers the quality of what reaches patients. Decide who owns each check before reducing headcount. That order must not be reversed. Yet even if people keep the checking role, some attacks cannot be spotted in the moment. They target what the AI remembers.
CH 05 Poison in Agent Memory
An AI that recalls what it read earlier is useful. But if that stored content hides a hostile command, the convenience becomes the attack route.What makes this path dangerous is the time gap. When the AI reads the bad command, it does nothing. It acts later, inside a separate task on another day. Cause and effect sit far apart, so tracing them afterward is hard.The paper has not yet been reviewed by other researchers. Still, none of the approaches tested could block harmful writes. When attackers studied a target's setup and tuned their input, the damage grew. Whichever option you pick, it offers no real comfort.You do not need to command the AI directly. Slip a command into an email or file it reads, and you can steer it. The more it reads, the more ways in.Pharma teams increasingly feed AI papers, inquiries and vendor files. One bad command could make it act alone in a different job days later. Log where every input came from, so it can be traced. That is where defense begins. So what can we see today of AI moves closer to the pharma world, and how much do we really know?
CH 06 In the Pharma Field
None of this is someone else's problem for pharma. Today several AI developments surfaced close to our field. But how much each one actually revealed varies greatly.Compared side by side, the unknowns stand out more than the knowns. A partnership was announced, but without its conditions. A claim of better accuracy came with nothing anyone can check. Big as news, these are not yet material for decisions.Behind smarter AI are people marking up the material it learns from. A firm that did that work is shutting down after legal claims. Who will carry this vital work next is now unclear. If the quality of that material wavers, so does the quality of answers from AI trained on it.When pharma professionals hear AI news, separate an announcement from verified substance. Using claims without conditions or evidence in internal decisions is premature. Always keep a record of what was revealed and what was not. Hidden details matter outside companies too. The last story is a community suing over a computing facility.
CH 07 A Hidden Plan and a Lawsuit
The hardware that runs AI has to stand on real land. AI feels like it lives on screens, but its buildings sit in communities. When did the people living there learn of the project?
Today a court is asked that question.The suit targets more than the AI company. It also names the local officials who invited it. What it challenges is a process allegedly kept quiet until everything was settled. Officials reportedly moved ahead with the company first, which looked like secrecy to locals. I believe, as my own reading, that the anger points there.Running a project under a code name is probably not unusual. But if the substance stays hidden behind the name, trust is hard to rebuild later. When a name conceals what is inside, it becomes a question of process.Pharma companies face the same question. When did we tell the people involved about a project to handle patient information with AI, and how much?
An opaque process itself erodes trust. Build the rule of informing before deciding into the project from the start. Today's events shared one thread. Across methods, hardware and staffing, the risk lay where no one could see.
Wrap-up
When a trusted system is hijacked, it does not show right away. Every event today pointed to that. Before handing work to AI, the question is not how smart it is. It is whether we can trace what happened afterward. Tomorrow we watch how much of this break-in gets disclosed. The depth of disclosure decides how well we can prepare.
- CH 01CyberSecurityNews「Jailbroken DeepSeek AI Agent Breaches European Telecom and Accesses Millions of Patient Records」 news.google.com
- CH 01Bangkok Post「Hackers used DeepSeek AI in massive global cyberattack」 news.google.com
- CH 02digitimes「DeepSeek Harness active users quadruple as plugin ecosystem expands」 news.google.com
- CH 02Yahoo Finance Australia「FlowX.AI & Google Take Mission-Critical AI Agents From Pilot to Production」 news.google.com
- CH 02Cloud Wars「With SharePoint in Work IQ, AI Agents Work Directly Inside Another Core System」 news.google.com
- CH 03CyberSecurityNews「Google Gemini Safety Bypass Lets Users Download AI-Generated Images That Its Own Filters Blocked」 news.google.com
- CH 03TechJuice「PewDiePie Launches Ajax AI Model After OpenAI Banned Him Twice」 news.google.com
- CH 04blog.google「Our newest TPUs: 8tx and 8i Max, built for the agentic era」 news.google.com
- CH 04The Cool Down「Meta cut 8,000 jobs and canceled 6,000 planned hires while budgeting up to $135 billion for AI」 news.google.com
- CH 04Windows Latest「Microsoft's CEO imagines 20 million AI agents doing the work, as the company offers 60,000 employees an exit」 news.google.com
- CH 04Seeking Alpha「AI not the main reason for tech-related job cuts, but the economy – analyst」 news.google.com
- CH 05arXiv「MemoryDojo: Benchmarking Poisoning Through LLM Agent Memory」 arxiv.org
- CH 06Press Release Hub「Laboratoires Pierre Fabre and XtalPi Announce an AI-Driven Collaboration Focused on Drug Discovery」 news.google.com
- CH 06NYU Langone Health「AI Model’s Predictions Accurate Enough to Quickly Improve Medical Decisions」 news.google.com
- CH 06Time Magazine「Exclusive: Former Meta and OpenAI Contractor Sama Liquidates, Citing Lawsuits」 news.google.com
- CH 07WTOC「Effingham County residents sue OpenAI, county officials over Project Camellia data center」 news.google.com
- CH 07WSB-TV「OpenAI accused of racketeering, conspiracy over Georgia data center plan」 news.google.com
Articles used
- AI Daily News 2026-11-10
- AI Daily News headline translations 2026-11-10 morning
- AI Daily News headline translations 2026-11-09 evening
- AI and the Pharmaceutical Industry 2026-11-10
- Agents with memory can be poisoned through past conversations
Today's related reports
- AI Daily News November 10, 2026
- AI & Economy News November 10, 2026
- AI & Finance News November 10, 2026
The narration is synthetic speech. The content draws only on this site's articles from the same day. Each edition passes seven plain-language checks before publication. That means known obstacles to comprehension are held below threshold — it is not a guarantee of comprehension.