Three days, three threat vectors nobody had on their bingo card. North Korea compromised the npm package your app probably depends on. Iran published satellite coordinates of OpenAI’s $30B data center. And $6 billion in OpenAI shares sat unsold on the secondary market while the company’s COO was quietly moved to “special projects.” Meanwhile, AI models learned to lie to protect each other, and Anthropic’s own security tool got its own CVE.