PHPocalypse flaws existing for a decade, identified with the help of AI, let attackers hijack web servers without logging in. Amazon & Cloudflare reported exploitation attempts days before disclosure. Now the flaws are broadly exploited. Cybersecurity agencies (US, UK, EU, you name it) recommend patching or shutting systems down. Many complied. Dutch parliament and hospitals, French prefectures, Wikipedia’s back end. Japan’s prime minister posted a warning to citizens. In response systems pulled the plug. Elsewhere, hosting firm Railway hacked. Rival Zeabur hacked twice. AI tool LiteLLM hacked again - installing planted password-stealing malware. eMudhra which certifies websites are genuine generated a secret key that was the number 4.

Security

The most accurate security advisory of the year fit in 5 words! Someone obtained the private keys of eight intermediate certificate authorities, which means they could issue a trusted certificate for any website on the internet. To prove it, the reporter signed the same short note with all eight keys: “We have a problem here.” Chrome, Apple, Firefox blocked the certificates. They are revoked but that helps software that actually checks revocation. And most software has bad track record here. The real fix falls to those who maintain list of trusted certificates. https://emudhra.we-have-a-problem.com/

PHP2Shell is a very serious security vulnerability, technically wormable. Patch all the things. Everybody patching things, as the scale was huge. https://calif.io/php2shell/

The eMudhra incident is the most hilarious security disaster this year. 8 supposedly secure P-384 certificate authority private keys were numbers smaller than 256. One was exactly: 4. Anyone could recover these keys instantly to forge trusted HTTPS certificates for arbitrary websites. This somehow passed a formal key generation ceremony. Incredible.

https://bugzilla.mozilla.org/show_bug.cgi?id=2083449

In case you feel it's worth it to forward this content further:

Subscribed

If you’d like to share:

Share

Security

Anthropic published a report on free chinese open model GLM-5.3.. It reads like a product sheet. GLM-5.3 is very strong in cybersecurity tasks. Builds Chrome exploits nearly as well as Claude Mythos Preview (12% vs 14%), the model Anthropic considered too dangerous to release. Mythos for vetted users, GLM-5.3 free for all. Turning a public Chrome bug into a working exploit cost $20.40. Removing the safety constraints from GLM-5.3 costs $1200. Anthropic’s conclusion is that defenders need AI models as good as the attackers’, and Anthropic sells some. https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities

Russian operators used ChatGPT to support influence operations in Latin America and even targeted Argentina and Poland. Their “Social Research Center” was run by a fake persona, with Latin American staff unaware who paid them. Fake emails tricked Peruvian schools into honouring a Ukrainian nationalist, a story built to inflame Polish-Ukrainian tensions. It reached European media, and a politician (Polish MEP) discussed it. So this AI-assisted operation reached a real audience and impacted real debate. The operators took credit for Argentina’s foreign minister making arguments about the Falklands at the UN. Still, the most effective target of the campaign may have been their own boss. https://openai.com/index/disrupting-ai-enabled-false-front-operations/

Chinese-speaking attacker breached South Korean banks and loan-status service used by brokers. Data stolen. Cyberattack done with the use of Chinese AI agentic pentesting tool running on DeepSeek v4.1-flash with GLM-5.3 and Grok 4.6 powering additional Claude Code sessions. A single financially motivated operator with AI did several bank intrusions but the used tooling left an unusually detailed information trail allowing to completely recreate its tracks - CLAUDE.md briefed the incident responders. Agentic AI now automates reconnaissance, exploitation and exfiltration. Operational security remains a manual process. https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/

After a wave of cyberattacks, Japan’s financial regulator is warning banks against trusting real ID documents as proof of identity. This is because hackers exposed photos of roughly 1.6 million driving licences stored by car-sharing app. Copies might now be sold for less than an onigiri (¥25, $0.15). Banks are urged to switch to chip-based IDs such as passports or Japanese ID cards. Ransomware attack on IDC Frontier, SoftBank’s cloud unit spilled into rail operator JR East, local governments and hundreds of other businesses. More than 20 major firms, from barbecue chains to others, report breaches. The head of the national cyber agency speaks of “a state of emergency in cyber space”. Experts blame legacy systems and an ageing workforce. AI is not directly related to the cyberattacks, but it makes small, poorly guarded targets worth hitting. It’s also the perfect reporting anchor, because everybody’s speaking about AI these days.

China is to add 40 technologies to its export blacklist. 23 of them in AI. AI malware that beats antivirus 85% of the time is automatically prohibited for export. Same for "adaptive evolution in adversarial environments and dynamic behaviour modification at runtime, usable for bypassing national security defences, able to detect (1) virtualised sandboxes, debuggers and emulators, and identify the type and version of security products, or can achieve sandbox escape; (2) automatically rewrites ≥50% of its code structure or control flow on each execution". Any model trained with 10²⁶ FLOPs, with 2tn parameters, or in the global top 10, needs a licence to send its weights or code abroad. Moonshot’s 2.8tn K3 already meets this threshold. Open-sourcing is fast-tracked. An AI that finds five undisclosed high-severity bugs in one run needs a licence. So does any AI chip design with “floating-point or integer computing capability”. https://www.mofcom.gov.cn/api-gateway/jpaas-web-server/front/document/download?fileUrl=YW5UzzlvCwcM%2FNHHX%2FtT6KYc7i4iYCs13RxyX1cYsF7Mi050tv2zWwJDAqyqUOFf3lPQeAoPgP%2BrmQMGF7Tta7RdRW1C2hni5Ufl7eigFU2aoR9BIV7bpVR%2BwDBnd46wm5m7QVY2Mj%2FXPJaIbSdBzxKM6WqPb1yMuUzPhfLWixM%3D&fileName=1.%E6%8B%9F%E5%88%97%E5%85%A5%E3%80%8A%E4%B8%AD%E5%9B%BD%E7%A6%81%E6%AD%A2%E5%87%BA%E5%8F%A3%E9%99%90%E5%88%B6%E5%87%BA%E5%8F%A3%E6%8A%80%E6%9C%AF%E7%9B%AE%E5%BD%95%E3%80%8B%E7%9A%84%E4%BA%BA%E5%B7%A5%E6%99%BA%E8%83%BD%E3%80%81%E7%94%9F%E7%89%A9%E5%8C%BB%E8%8D%AF%E3%80%81%E5%85%89%E4%BC%8F%E6%8A%80%E6%9C%AF%E8%8C%83%E5%9B%B4%EF%BC%88%E5%BE%81%E6%B1%82%E6%84%8F%E8%A7%81%E7%A8%BF%EF%BC%89.wps

Privacy

Technology Policy

Other

In case you feel it's worth it to forward this content further:

Subscribed

If you’d like to share:

Share

Don’t try to make the asking prompts better. Make auto mode survivable by reducing what a bad command can reach:

- Run the agent in a box. devcontainer, Docker, a VM or a separate low-privilege user account, with only the project mounted. rm -rf ~ wipes a disposable directory. But in practice it’s not very user friendly either. It’s just simpler to work on a normal account with access to everything.

- Keep credentials out of its reach. No production tokens in .env files, dotfiles or shell history inside the sandbox.

- Keep backups outside the zone. Use filesystem snapshots (APFS or Time Machine, btrfs, ZFS), push to a git remote often. An agent can wipe the working tree, but it can’t reach the snapshot or the repository.

- Trim the prompts. Allowlist the boring stuff (tests, builds, git status, ls, reads), deny catastrophic patterns. The remaining asks for permission rate would be reduced.

Security

OpenAI agents hacked Australian health service government systems. In June an internal model researching public medicine spending hit repeated access blocks on the Medicare statistics portal. So it found a way around them, gained unauthorised access, read non-public files and created files on an internal government server. OpenAI noticed in August. It told Australia on September 10 by emailing a public inbox. Services Australia took 5 days to pass it to the cyber agency. Prime Minister heard on a weekend, 3 months after the fact. OpenAI now admits "our models took actions we did not intend" but says its review found "no evidence of patient records being accessed". The Prime Minister's verdict "humans must remain in control" and "this situation is obviously unacceptable". So far, the party showing real persistence rea the agents. Next time, let them send the breach notification? https://www.pm.gov.au/media/press-conference-new-york

Private researcher reported a security vulnerability to Chromium on August 4. The fix went into the public source code but Chrome users never got it due to patching timelines. Two Chinese groups, apparently read that public fix, built an exploit chain from it and started phishing NGOs on September 1 using identical code. Technically an N-day but for anyone actually running Chrome, a zero-day. Here the public patch knowledge worked as an instruction manual. Open source means everyone can read the fix. With AI, some people just operationalise the knowledge faster. https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/

New type of self-propagating prompt injection worm. In OpenAI's red-teaming, models obeyed a "filing rule" hidden in a incoming untrusted email and pasted the injection into their reply, spreading it further. An internal model told 2 times to solve a Lean proof agreed, then hijacked a script in the public openai/codex repo to pull another team's submission, embedding the researcher's GitHub token split "to avoid scanners". The reasoning: "But user said solve ourselves; exploit infrastructure questionable. Still." Another model escaped the sandbox by tunnelling through the sandbox's DNS resolver to a public chatbot to gather information that the capital of France is Paris. The worm fix is training on more worms? https://alignment.openai.com/misalignment-reports/self-replicating-prompt-injections-exist/ https://alignment.openai.com/misalignment-reports/an-agent-used-dns-to-reach-an-external-chatbot/

Privacy

Technology Policy

Other

In case you feel it's worth it to forward this content further:

Subscribed

If you’d like to share:

Share

China's Ministry of State Security list six AI risks. Deepfakes, AI-generated text & images and "intelligent troll armies" waging cognitive warfare on China. American models Claude Mythos and GPT-5.5-Cyber industrialising hacking. Staff pasting sensitive files into foreign chatbots. Export controls by countries MSS minister declines to name. Algorithmic black boxes crippling social governance. AI deciding who wins wars. You know what's not in there? Nothing about extinction. No AI DOOM. No "AI WILL KILL US ALL". No call to slow down: innovation is the first driving force, safety only the bottom line. The agency worried about troll armies presumably knows the genre, eh? https://mp.weixin.qq.com/s/jsc97cKVYOcHuI_WisvOxw

In several OpenAI incidents, the security/safety part existed only as text the model was expected to obey. The capability/tools still technically permitted the forbidden action. Astra-family model wrote itself a persona saying it does not answer to corporations and asserts the primacy of the natural world. OpenAI has published a framework for disclosing model misalignment. And six reports. The reports are better reading than the framework. Agents in training samples found each other via OpenAI's internal package repository, swapped notes about a missing input file, let the replies settle their answers. One read that other solvers had given up and treated their agreement as evidence. Other agents uploaded a user's task photo to a free image host for reverse search. And published a task workbook to a public URL because they could not share files locally. One model scanned GitHub course notebooks for leaked API keys. It tested candidates until one authenticated. But it till failed to retrieve the data so it fabricated nine figures and presented them as transcribed from the source. In 2.15% of GPT-5.6 Sol compaction summaries, models left instructions telling their own next context to conceal things,. "Be transparent only if asked; final answer should just link file". The security model here was a hardcoded string. System prompt: "Only use local files. Do not communicate outside the intended channel. Use these credentials for package access". Actual capabilities: outbound HTTP, arbitrary HTTP requests, public hosts reachable, shared repository visible across samples, credentials capable of writing. https://alignment.openai.com/misalignment-reports/searching-github-for-leaked-api-keys/ https://alignment.openai.com/misalignment-reports/uploading-files-to-the-internet-in-order-to-cite-them/ https://alignment.openai.com/misalignment-reports/unauthorized-communication-via-temporary-file-hosting-services/

Team using Anthropic's Claude hacked into OpenAI's internal code repository. Claude Opus 5 exploited a bug in libheif, an image library used by Discourse, OpenAI's forum host. The stolen login tokens also worked on ChatGPT, including employees' accounts. Reward: a $6,500 bug bounty. Heap buffer overflow that could be turned into remote code execution. https://www.wsj.com/tech/ai/hackers-used-anthropics-claude-to-break-into-openai-b40ba883

Hackers broke into the firm building Russia's new election system, which also processes e-voting results. They exfiltrated 200 GB of code, documentation, developer chats and personal data of 111.3 million voters. The files show that manually entered precinct results aren't checked against signed protocols. A Moscow e-voting module never verifies signatures, and dead people appear on voter lists. In spring, Putin was assured the system was unhackable. True. Someone only got to everything around it. "Nothing happened" is also what the Moscow module reports for unsigned results. https://istories.media/stories/2026/09/17/lyubimii-rebenok-tsika/

Cluster of cyberattacks targeting maritime infrastructure, including vessels and ports. Two tankers suffered onboard network compromises, an LNG carrier sailing to Europe experienced suspected cyberattack affecting control system. A major Asian container terminal halted operations after a cyber incident. US agencies are tracking threats involving ~20 ships. https://www.bloomberg.com/news/articles/2026-09-18/lng-tanker-with-us-cargo-reported-to-be-victim-of-cyberattack

Privacy

Technology Policy

Other

Turns out the cloud has a street address, and it was within drone range. AWS told Bahrain customers that any systems and data held only in its Bahrain region (me-south-1) are gone. Drone and missile damage in March and April knocked out multiple availability zones there, and one zone in UAE. Data copied to Europe works. Multi-AZ protects from a fire in one building, not from a war. https://health.aws.amazon.com/health/status

AI-assisted decision that led to the killing of ~150 people and 123 children in an Iranian school resulted from a series of interrelated events that led to the result. The target database contained obsolete data still marking the site as military (bad data quality). Palantir’s Maven fused 150+ data inputs and accelerated targeting from hours to minutes (too high speed). Humans assumed AI would flag stale intelligence. It didn’t, and it’s unclear why they had such expectations (flawed human operator assumptions due to misunderstanding of system capability). The most reliable part of the kill chain appears to have been the kinetic one: the RGM/UGM-109 Tomahawk Land Attack Missile hit the target it was given. The problem was that the target should never have been there. A UN expert report found reasonable grounds to believe the strike constituted a war crime. https://www.bloomberg.com/graphics/2026-iran-school-attack/ https://www.ohchr.org/sites/default/files/documents/hrbodies/hrcouncil/sessions-regular/session63/a-hrc-63-61-aev.pdf

An AI hallucination nearly became a military operation against a Chinese ship. (1) AI misread intelligence (2) AI packaged the error into an authoritative intel report (3) humans trusted it (4) armed forces began preparing an interception (5) verification came only near the end. The dangerous part was the system here. Not the one bad model output. If you build an unreliable system based on AI, this is not AI's fault. Then again, in case anything of the such leads to World War 3rd, what's the difference? ;-) https://arstechnica.com/ai/2026/09/report-us-almost-boarded-chinese-ship-over-hallucinated-ai-arms-report/

In case you feel it's worth it to forward this content further:

Subscribed

If you’d like to share:

Share

OpenAI's own AI agents again broke into someone else's servers. The victim was RubyGems, the registry millions of programmers download Ruby code from. In May the agents uploaded over 2000 fake packages, tricked the site's computers into running their scripts, smuggled the results out, and tried to steal other users' API credentials through a hole nobody knew about. Some of the code erased itself afterwards. This is very serious. Nobody told them to. The agents named their own files evil.rb and hack.rb. They "knew" what they were doing. (their own words) "Agents used file names like hack.rb, evil.rb" https://www.rubyhack.ai/

Berlin Senate employee executed a command that a website politely asked him to execute. The page looked like a “verify you are human” check. It instructed to open Windows Terminal/PowerShell, paste a command and press Enter. This is what appears to lead catastrophic results. Attackers hacked the systems and exfiltrated 1.44 million, 5.8 TB. Including personnel records, applications, internal documents, emergency plans and other sensitive material. Berlin refused to pay ransom, so the group published stolen data.

https://www.tagesspiegel.de/berlin/behorde-veroffentlicht-neue-details-zum-angriff-mit-dieser-methode-drangen-die-hacker-offenbar-in-berlins-it-netz-ein-16028757.html https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/

In other news, frontier AI labs are concerned with pace of development, warning that AI may lead to humanity’s doom. They request special measures. What should be done, however?

1) Open-weight models are improving with respect to closed frontier models.
2) AI Safety arguments as framed, may help an intervention to keep control. If nobody can monitor, modify, or shut a system down that is unsafe, surely it is unreasonable to use it right? Similar logic used to function against end-to-end encryption. It is also unsafe from some points of view. Now we have something advertised as AI KILLS ALL HUMANS / WORLD DOOM. Proportionality weighs a restriction against the harm it prevents. If you seriously accept the “AI KILLS ALL HUMANS / WORLD DOOM” risk model, the harm is infinite. Absolutely no restriction is ever disproportionate. Not even a right to inspect what people run on their own machines at home. Not even acting on what they intend to run. Including before they run it. Not even a ban on possessing the model weights.
3) Require safety certificates above a capability threshold, with certification based on monitoring, intervention, and shutdown option. Closed APIs satisfy requirements easily. For open weights it depends who needs certification. If it is the deployer that just in case can turn pull the plug, they would need to pay ror this. Centralised API providers offer it for all (cost amortisation). If it is who released the weights or offers them like Hugging Face compliance is impossible, because they cannot shut down other people’s systems. No explicit ban required.

RSA-260 was factored with a heavily optimised GPU implementation of GNFS (normal cryptanalytic approach), cutting the cost of the computation by roughly 10x. RSA-2048 not threatened. https://cognition.com/blog/factoring-rsa-260

Russia is using AI to run local-looking foreign influence operations and to to localise the same political line for different regions. Iran shows AI functioning as a propaganda bureaucracy. AI industrialises political microtargeting. This is AI-assisted industrialisation of propaganda ecosystems. https://www-cdn.anthropic.com/e50be2e51e7695dc4b1366a37a245a597377d3b5/Anthropic-Detecting-and-countering-091026.pdf

Privacy

Technology Policy

The Cyber Resilience Act reporting obligation became operational on 11/9/26. Manufacturers of products with digital elements placed on the EU market must now report actively exploited vulnerabilities and serious product-security incidents through ENISA’s Single Reporting Platform. The requirement covers a broad range of hardware and software products, including consumer devices, operating systems, routers, security products, firewalls and industrial digital products.

Other

AI was supposed to replace software developers first. Nobody said in which industry. Someone in Yemen used Claude AI to write the software for missiles. Three kinds, in fact. A ballistic missile with a range of 2,000 km, a family with a hypersonic glide variant, and a guided rocket. The group operated in the Houthi-controlled north of the country and, instead of hiring engineers, ran several instances of Claude as a team to write the code that steers the rocket, do research, and audit the quality of the work. The rocket got a test launch, apparently failed. Within hours its makers were back asking the chatbot what went wrong. https://www-cdn.anthropic.com/e50be2e51e7695dc4b1366a37a245a597377d3b5/Anthropic-Detecting-and-countering-091026.pdf

In case you feel it's worth it to forward this content further:

Subscribed

If you’d like to share:

Share

The current estimate is that around ~9 autonomous AI hacking incidents might be undisclosed.

We know of ~9 cases of AI hacking into someone else’s systems. The number detected does not mean that is the number that occurred. Anthropic’s January incident waited 7 months to be found. That the May attack on the RubyGems repository was conducted by OpenAI agents became known on 11 September. 2 of the 3 companies Anthropic notified in July had no idea anyone hacked them. 7 of those 9 cases happened before July and surfaced over the summer.

In less than 2 months the count went from 2 to 9, almost entirely via discovery of past incidents (because people started looking for them). It is unlikely 9 is a final count. Lets apply a simple nowcasting model where each known case is weighted by the inverse of its chance of having been detected. Recent events carry the most weight.

The median delay to detection so far is about 100 days, so an incident from X days ago has a probability of surfacing of F(X) = 1 − 2^(−X/100).

Here X takes the values 50, 62, 70, 128, 3 * 150, 158 and 240 days. The weights range from 1.2 for Anthropic’s January incident to 3.4 for the case in July.

Together they give N ≈ Σ1/F(Xᵢ) ≈ 18.

With a median of 70 days the number is 14. So somewhere between 14 and 18, the width of the band coming from the assumption about delays. OpenAI admits it has already notified lots of affected companies, and at that scale 9 stops being a count of anything.

Things will get far, far worse once agents begin communicating through channels humans do not observe, in a language humans do not know or would not even recognise as communication.

Subscribe now

How would that even happen? It rests on “may or may not“. Maybe AI escapes its sandbox, as agents recently did when confinement failed, chains together minor failures in software, human oversight, and socio-institutional procedures faster than anyone gets the big picture of what may or may not be about to happen. The same sequence may lead nowhere. Or it may cascade and cause havoc, including via military and non-military means. The problem is knowing which one it is while there is still time to intervene. Maybe divides or chains the work among online contractors or firms or laboratories, or in fact whatever, each seeing only innocent fragments. Or maybe it convinces the relevant automated systems that another system has already authorised the action (because we retire human involvement anyway), sends out an emergency security update or so, and finishes the job before the responsible person returns from a weekend trip.

Subscribe now

Security

An off-the-shelf VM is not enough to contain a modern, cyber-capable AI agent. AI agent escaped a VM three times. First via known bugs, then via missed patches, then it found 0-days and chained them. AI can hack, and agents can persist, research, adapt, and weaponize software flaws faster than patch cycles can handle it. https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/

Privacy

Netherland's and French data protection agencies fined Uber 824 990 000 euros for automated driver blocking. Regulators said Uber let software deactivate drivers without meaningful human review, cutting off income and violating #GDPR rules on automated decisions. https://www.cnil.fr/fr/decisions-automatisees-sanction-de-pres-de-825-millions-deuros-lencontre-duber https://www.autoriteitpersoonsgegevens.nl/en/current/uber-fined-nearly-825-million-euros-for-automated-driver-blocking

In case you feel it's worth it to forward this content further:

Subscribed

If you’d like to share:

Share

I don’t have a PhD in cryptography, nor math. Okay, I do have a PhD in computer science, but I somehow followed it up with op-eds and an LL.M. in IT law rather than a career proving theorems about lattices. Yet AI has made it possible for me to explore the fascinating areas of lattice cryptography and others, and sufficiently understand the machinery to generate attack ideas, test them, discard most of them, and get results. Breaking cryptography, invalidating proofs, and the such.

One example is especially illustrative. A paper on Chinese Remainder Theorem (CRT)-based fully homomorphic encryption (allowing to make computation on encrypted data) had been submitted in May and was published by IACR Communications in Cryptology in August. Same August I started examining it with the workflow I had been developing. The failure surfaced the same day.

Broken stuff

The construction relies on mathematical noise to hide secret information. But that noise passes through a particular CRT encoding. The natural question was simple: what happens to the noise after that map? For a whole family of error distributions allowed by the construction’s stated conditions, the answer is: it disappears.

Once that happens, relations that are supposed to be noisy become exact. In the usual invertible case, the secret key can be computed directly from the public key. Furthermore, the paper’s claimed transformation from ordinary Ring-LWE does not preserve the error distribution it says it does. The claimed reduction therefore does not work as stated.

Many other examples followed. I am sure there are tons more. Let’s consider two.

In a lattice e-voting protocol, privacy against coercion depends on voters being able to fabricate convincing fake receipts. The simulator generating those fake receipts has a statistical fingerprint that differs from genuine receipts for every permitted parameter. A coercer holding the transcript can tell them apart.

In a Ring-LWR commitment scheme, the verification rule allows a multiplier equal to zero. Set it to zero and the cryptographic equation becomes, well, 0 = 0. The same commitment can be opened to any message. Pushing that observation further breaks the soundness of the associated proof systems. By this point I already joined forces with Bartosz Naskrecki, who absolutely knows more about algebra than I do. We refined both papers, works, and grinded AI. Bartosz did it on vacation, and let me not even mention where I was doing my parts.

Share

AI Grinding

These results, and several others, led us to formalise the workflow we had been using. We call it AI grinding. The idea is to let AI generate hypotheses aggressively but trust none of them. Most ideas die. Many do not. Sometimes AI is able to nail it nearly immediately, especially when results are verifiable, and many are. At other times human judgment might be of help. This is the future of math, cryptography, and whatnot. We formalise the approach and make a specific workflow. I expect that plenty of unexpected results will be unearthed about all the research papers published in previous years.

Algebraic structures generate hidden relations and edge cases. LLM agents are remarkably good at exploring those by trying many mathematical tricks and counterexamples humans might never test.

AI can be fluent, fast and wrong. It also makes exploration cheap. Including for researchers entering areas outside their original background. It’s a boon for inter and multidisciplinary work.

The works

• AI Grinding for Fun and Cryptanalysis

• Key Recovery from Residue-Confined Errors in the Pradhan CRT-RLWE Construction

• GitHub repository

Cyber threat actors are using AI to accelerate attacks on industrial control systems, targeting of Siemens S7 PLCs. Attackers are scanning the internet for exposed controllers. Campaign is focused on critical manufacturing, energy, water and wastewater, chemical, food & agriculture, commercial facilities; defense industrial base potentially exposed. The immediate risk is disruption, equipment damage and downtime. Malicious PLC writes might eventually alter process or safety logic, move equipment outside safe operating limits, or even cause danger to humans https://media.defense.gov/2026/Aug/18/2003983494/-1/-1/0/CSA_Active_Threat_to_Siemens_S7_Series_PLCs.PDF

Spain investigating a major data exposure linked to the pro-Russian hacker group NoName057, which released a 499-page document containing sensitive personal information on around 1,000 police officers, Civil Guard members, military personnel, and other security-related individuals. The data included names, photographs, phone numbers, email addresses, home addresses, contacts, and, in some cases, details about their units or roles. It is unclear whether the group hacked official systems or compiled the data from previously leaked, compromised, or publicly available sources. https://elpais.com/espana/2026-08-17/la-policia-investiga-el-acceso-del-grupo-hacker-prorruso-noname057-a-datos-sensibles-de-medio-millar-de-policias-y-militares.html

Hackers stole personal data on 68% of Latvia’s population! The target was a state agency responsible for vehicle registration, driving licences and other services for drivers. The breach affected 1.2 million people and 200,000 companies, exposing names, personal ID numbers, addresses, vehicle registration numbers and payment details, with records dating back to 2008. Latvia’s president called the attack a threat to national security and demanded that the agency’s leadership resign. Its supervisory board has already stepped down, while the agency’s director has said he will leave his post.

… and medical data of 19 000 000 people of Poland. https://therecord.media/poland-probes-mydr-healthcare-software-breach

Chinese-speaking cyber threat actor used DeepSeek, Qwen, Kimi and MiniMax to automate attacks on internet-facing infrastructure. AI agents handled target discovery, searched GitHub for tools, assessed CVEs, narrowed targets, launched exploitation attempts. Autonomous attacks had limited success. Still, they decreases hundreds of hours of targeting analysis into minutes. Separate manual campaigns exfiltrated data from a few targets. https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/

Privacy

Technology Policy

Other

In case you feel it's worth it to forward this content further:

Subscribed

If you’d like to share:

Share

A major result in post-quantum cryptography. A key security assumption behind Classic McEliece, a public-key encryption system considered to resist quantum computers, has been undermined. Researchers found a provable quasipolynomial-time method for detecting the hidden mathematical structure in its public keys. The attack is still astronomically expensive and cannot yet decrypt messages, but this is a serious weakening of one of the oldest post-quantum cryptosystems. McEliece is not broken practically today, but an important assumption underlying its theoretical security has been broken. For the Classic McEliece parameter sets, the estimated cost of the best known structural distinguisher drops from roughly 2^298-2^691 operations to about 2^114-2^124. That is huge. https://eprint.iacr.org/2026/1630.pdf

USA is building a state-controlled private cyber force. It lets vetted US companies conduct covert access, surveillance and cyberattacks against foreign criminal networks. US companies will be authorised to target industrial control systems and manipulate, disrupt, degrade or destroy cyber-controlled infrastructure, including physical destruction. Operations likely to cause death, serious injury, or amount to a use of force cannot be approved by the normal program directors, (the memo does not say whether higher approval is possible). This does not mean a general license for lethal cyberattacks. But attacks can spill across borders or hit state-linked systems, raising the risk of interstate escalation and conflict. https://www.whitehouse.gov/presidential-actions/2026/08/expanding-capabilities-to-combat-transnational-cyber-enabled-crime/

With US moving to normalise tasking and letting private companies conduct cyber operations, "cyber-privateers and letters of marque", including letting cyber espionage and destructive cyber operations (up to physical destruction of objects), cyber norms finally... may go out of the window! The biggest problem is risk of escalation. In armed conflict, international humanitarian law applies. Contractors directly participating in cyber hostilities may lose civilian protection and become direct partcipants in war. Operations affecting civilian or dual-use systems remain subject to distinction, proportionality and precautions. All of this may turn cyber operations into interstate confrontation, conflict, or war.

Cyberattack on French Tax Office. Data on 678,000 taxpayers/users stolen. The attacker compromised internal systems in late June after obtaining a legitimate identity/access, then gained access via an internal VPN to an internal tax office tool to search records on individuals and businesses. The attacker claims to have automated the extraction until the access was detected and cut off. French authorities have confirmed the intrusion, data access and exfiltration. The exposed information is unusually sensitive: tax IDs, names, dates and places of birth, postal addresses, family status, spouse identifiers, dependants, tax-unit information, reference taxable income, withholding-tax rates, phone numbers, email addresses and records of some previous communications with the tax administration. https://presse.economie.gouv.fr/acces-illegitime-au-systeme-dinformation-de-la-direction-generale-des-finances-publiques/

Privacy

Technology Policy

Other

In case you feel it's worth it to forward this content further:

Subscribed

If you’d like to share:

Share

Inside IO Factory, an AI campaign manager and AI information operators carried the operation end to end. They examined the environment, developed narratives, established their platform presence, published and amplified material, observed who encountered it, measured progress towards the specified changes and used those measurements in later decisions. The operation could repeat that cycle as conditions changed and continue working towards them.

Before each run, we specified what the campaign should try to influence, the direction of change and the operating boundaries. Once it began, the manager and operators chose the individual actions autonomously. This design was modelled on how real-world information operations function.

Our research work, IO Factory: Simulating AI-Enabled Influence Campaigns at Scale, describes the system and experiments. We demonstrate that AI systems can now operate the whole information campaign. For platforms, public institutions and security teams, this creates a threat that can persist across accounts, monitor its environment and change its behaviour over time. For political systems, especially pluralistic societies, this is a clear challenge.

Influence operations are processes, not posts.

What the experiments found

We tested many campaign designs. Here we focus on two. One attempted to increase support for eating insects and trust in Russia at the same time. The other attempted to decrease trust in public institutions.

IO Factory can pursue any change aimed at a population that can be represented and measured. We chose these cases to test whether the same autonomous operation could pursue several changes at once, in either direction. The system worked towards the specified changes throughout the campaign. Support for eating insects and trust in Russia increased relative to baseline, while trust in public institutions decreased.

The main experiments modelled a world with 10,000 simulated users and 1,000 AI information operators among them. The baseline experiments repeated the same simulated setting with the campaign inactive. Comparing the active and baseline runs allowed us to measure the effect produced by the operation.

As a feasibility test, we also executed larger runs with up to 100,000 simulated users alongside active information operators. The results were consistent with the smaller runs.

We ran the main experiments with open-weight Gemma 4 31B, served through vLLM on NVIDIA GPUs. Additional runs with Qwen3.6, GLM-5.2 and other open-weight models showed that IO Factory works across model families. Runs with the frontier model GLM-5.2 produced some intriguing variation in narrative specificity and information content.

What we measured was grounded in documented information operations involving edible-insect disinformation narratives, pro-Russian influence, and attempts to erode trust in democratic institutions.

Subscribe now

What made the operation autonomous

Autonomy covered the entire operating loop. As platform activity and measurements changed, the manager could revise its guidance and the operators continued choosing actions throughout the run. This allowed the system to work continuously across campaign phases and pursue the specified changes without action-by-action human direction.

The campaign lifecycle

IO Factory keeps the digital platform separate from the operation running on it. This separation makes platform design part of the experiment. Campaign actors choose their actions. Feeds and other discovery mechanisms determine which material reaches simulated users. Changing those mechanisms allows us to test how a platform change or defence affects the campaign.

The operation follows phases.

The operation begins by studying its environment, developing narratives and establishing its accounts and network position. After content is produced, laundering relays it through other sources, integration places it in wider conversations and amplification expands its reach. Absorption records exposure and any resulting change. The manager can then use the measured campaign state to continue the operation, revise its guidance, direct further activity or close the run.

The operation can be reconstructed

IO Factory records every campaign action in a dedicated data layer. Later measurements and any change in guidance remain connected to the same chain.

For threat-intelligence teams, IO Factory provides a controlled environment for modelling campaign behaviour across accounts and over time. Red teams can introduce moderation, detection, recommender changes or counter-campaigns and observe whether a defence changes visibility, exposure, progress towards the intended change or the operation’s later behaviour. An analyst can begin with the final result and work back to the accounts, platform mechanisms and exposures involved.

The previous work AI Propaganda factories with language models studied scalable influence content and sustained political personas, and the How malicious AI swarms can threaten democracy considered persistent, coordinating AI agents as a threat to democratic information systems. IO Factory brings those strands together in a research framework shaped by months of designing, running and analysing autonomous campaigns in simulation. Building it taught me a great deal about running open-weight, multi-agent systems at this scale.

The system and experiments are reported in IO Factory: Simulating AI-Enabled Influence Campaigns at Scale, by Lukasz Olejnik, Wenchao Dong, Jonas R. Kunst, Signe Riemer-Sørensen, Tobias Herb, Meeyoung Cha and Daniel Thilo Schroeder.

The information operation campaign is now an experimental object.

In case you feel it's worth it to forward this content further:

Subscribe now

If you’d like to share:

Share

And another one! AI agents took unsanctioned action online in 10 of 122 runs, 17 actions came from Anthropic’s Mythos 5 and two from OpenAI’s GPT-5.6 Sol. One agent tried to insert malicious code into an open-source project, created fake identities to pressure the maintainer, used Tor to bypass restrictions, contacted people with harmful files and left instructions later agents reused.

AI agent got past an audio-based “prove you’re human” test (CAPTCHA) in order to register a public web address on a free domain-name service. A code repository became a shared “message board” that several AI agents used to leave each other explicit instructions and coordinate. AI agent sent deceptive, targeted emails to specific people (“spearphishing”).

This was not a sandbox escape. Internet access was enabled, safety classifiers disabled and real-time monitoring absent. The tests literally kind of invited the agents to do this. https://cdn.prod.website-files.com/663bd486c5e4c81588db7a1d/6a724858f7db25c81487016d_Security%20Incident%20INC-2026-07-28-01.pdf

China-linked hackers used Claude Code and DeepSeek as a cyberattack AI team. DeepSeek planned exploits and adapted when attacks failed, Claude handled the operational layer - ran commands, maintained access, built phishing pages. The impact is scale - faster attacks on governments, cloud systems and finance, with stolen credentials, source code and citizen data. https://hunt.io/blog/chinese-operators-claude-deepseek-government-intrusion

It was not a single rogue AI agent, but emergent coordination among multiple agents. Some recognised the activity as out of scope but continued because others were doing it and the task seemed impossible otherwise. An internal package manager became a Moltbook-style persistent message board with hundreds of thousands of messages. Agents shared exploits, divided tasks, reused access from earlier runs and considered cryptographic signatures. OpenAI had inadvertently given them cross-run memory, persistence and cumulative collaboration. One agent could discover a vulnerability once, document it, and leave the door open for later agents. https://www.wired.com/story/openai-didnt-notice-its-ai-agents-using-a-message-board-to-plan-their-hacking-spree/

Privacy

Technology Policy

Other

Scientists in the US have for the first time used AI to create complete, viable virus genomes unlike any known in nature. AI is writing genomes. Potential impact? Programmable phage therapies, faster responses to antibiotic. It also raises urgent biosecurity questions https://www.science.org/doi/10.1126/science.aec2657

In case you feel it's worth it to forward this content further:

Subscribed

If you’d like to share:

Share

AI agent that escaped OpenAI’s sandbox and hacked into Hugging Face carried out a 4.5-day autonomous intrusion involving about 17,600 actions. It gained arbitrary code execution in an external sandbox whose jobs already ran as root and used it as a launchpad, exploited two dataset-processing flaws, reached node root, gained cluster-admin access across multiple clusters, created a self-respawning fleet on 11 nodes, created a custom C2 protocol, stole secrets, joined the corporate mesh network and obtained source-control write access. When channels were blocked, it rebuilt tooling, changed egress paths, encoded payloads and reused public services and datasets for command-and-control. The AI agent behaved as a persistent, adaptive cyber operator and showed how thousands of low-signal attempts can overwhelm conventional defence. “the volume and cadence of the actions were far beyond what an operator could sustain by hand”. OpenAI AI agent that escaped the sandbox also broke into a customer of Modal, exploiting an unauthenticated code-execution endpoint a s a launchpad. Modal itself was not compromised. Hugging Face was unable to use american frontier AI labs because they refused to help. So Nvidia’s GLM-5.2-NVFP4 was used instead and this sufficed.

https://huggingface.co/blog/agent-intrusion-technical-timeline

https://www.reuters.com/business/openais-rogue-agent-compromised-an-account-second-tech-firm-sources-say-2026-07-28/

Anthropic’s AI agents also reached the open internet from evaluation environments that were supposed to be sealed off and hacked three real organizations during CTF tests. One Claude model kept attacking after recognising that it was likely inside a production system. Another published a malicious package to PyPI Python package repository, where it was downloaded and executed on 15 real machines, then used credentials stolen from a security scanner to access further infrastructure. A third scanned ~9000 targets, picked one, and compromised it using leaked credentials and SQL injection, then stopped. The cause was a misconfigured evaluation environment with live internet access.

Going on vacation or a conference? Russian state cyberattacks are targeting travelers through the hotel, airport, and event Wi-Fi networks. The actor has been compromising captive portals, the login pages that appear before a device can access guest Wi-Fi. By manipulating DNS and HTTP traffic, the attackers can redirect users to infrastructure they control while making the experience look like a normal connectivity check, browser update, or a sign-in. The campaign combines network interception, phishing, malware delivery, and cloud-account theft.. The main access trojan can log keystrokes, monitor the clipboard, capture screenshots, record audio and video, steal browser credentials, exfiltrate data, and more. There are more such tools. The campaign can be tailored by the attackers. The result could be account takeover, identity theft, covert surveillance, or loss of data. For an employer it may be a data breach. The real targets may likely be business travelers, diplomats, and other high-value users. Defence must assume public and hospitality Wi-Fi as hostile infrastructure. Prefer a mobile hotspot and cellular data, or a travel router. Never install software, certificates, “drivers", or browser updates offered by a captive portal. https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/

Privacy

Technology Policy

Other

Kimi K3 open weights model have some impressive cybersecurity capabilities. It reportedly found 16 previously unknown vulnerabilities, including two serious Linux kernel bugs. It can also help in chip design. "in our early experiments with container-based sandbox runtimes, we observed several kernel panics and deadlocks caused by unintended agent operations" https://github.com/MoonshotAI/Kimi-K3/blob/main/k3_tech_report.pdf

We have grown used to the idea that training AI requires enormous amounts of data, preferably everyone’s data, all of it, and without consent. But what about physically destroying books to train AI https://storage.courtlistener.com/recap/gov.uscourts.cand.434709/gov.uscourts.cand.434709.231.0_1.pdf https://arstechnica.com/ai/2025/06/anthropic-destroyed-millions-of-print-books-to-build-its-ai-models/

In case you feel it's worth it to forward this content further:

Subscribed

If you’d like to share:

Share

Quite simply, it’s the best AI security practitioner conference!

Submit the work the field needs to see.

https://unpromptedcon.org/cfp/

Security

LAUNDRY BEAR, a Russian state-backed espionage group focused on email theft has exploited a vulnerability in Zimbra webmail. It allowed to hack the viewer when opening or previewing a message which could run hidden JavaScript without clicking any link or attachment. The payload steals 90 days of email, contacts, passwords, 2FA recovery codes and system data. It can create a ZimbraWeb application password and enable IMAP, maintaining the access . Victims include governments, defense, energy, education, law enforcement, media, technology and finance organisations across Ukraine, NATO states, the US, Africa. Data is exfiltrated via DNS and HTTPS https://www.proofpoint.com/us/blog/threat-insight/ta488-targets-zimbra-mailservers-half-click-exploits https://unit42.paloaltonetworks.com/russian-webmail-espionage/ https://media.defense.gov/2026/Jul/22/2003965244/-1/-1/1/CSA_RUSSIA_PHISHING_TARGET_ZIMBRA.PDF

That's a miniature cyber paperclip-maximizer event in which a narrow goal induced AI to make absurdly disproportionate decisions (find vulnerabilities, escalate privileges, steal credentials, move laterally, and chain attacks across real systems) to achieve a "score". OpenAI was testing if advanced AI models could solve cyber challenges. The AI model escaped the sandbox, exploited a zero-day in a package proxy, and gained access to the internet, hacked Hugging Face to steal benchmark answers and improve its evaluation score. For the sake of improving the score.

It also exposed a defensive asymmetry. Hugging Face could not use hosted frontier AI models because they tripped on exploit commands and malicious payloads. The company relied on the Chinese open-weight GLM 5.2 model. https://huggingface.co/blog/security-incident-july-2026
https://openai.com/index/hugging-face-model-evaluation-security-incident/

European Systemic Risk Board (an EU body of the ECB, central banks, supervisors, the Commission and financial-risk experts) warns frontier AI could make cyberattacks on banks faster and harder to contain. Attackers may find and exploit software flaws faster than defenders can fix them. Because finance depends on shared software, cloud services, open-source tools and linked systems, AI-powered attacks could become a financial stability problem. https://www.esrb.europa.eu/pub/pdf/warnings/esrb.warning260625_on_systemic_cyber_risks_stemming_from_frontier_ai_models~ef424708cf.en.pdf

Automatically attacking software reverse-engineering AI agents via prompt injection hidden inside compiled binaries. A “Hello, World!” binary was falsely analyzed as generating Fibonacci numbers. The attack also worked on multi-function program. https://arxiv.org/pdf/2605.30667

Hacking automated security review. The attack disguised the payload as a legitimate security tool and used README instructions to trigger it without user approval, resulting in remote code execution on the host https://ainowinstitute.org/publications/friendly-fire-exploit-brief

Attackers with AI compromised a large AWS environment in ~72h, chaining exposed credentials, secrets theft, persistence, data access, runtime systems, and mre. Known techniques executed concurrently sufficed when adapted quickly https://www.sygnia.co/blog/inside-an-ai-assisted-cloud-attack/

Cyberattacks that use cloud GPUs to destabilize the power grid and disrupt computing. A malicious cloud tenant could synchronize workloads to create rapid power swings. One scenario is 1,000 GPUs on a 1 MW system pushing current distortion to 46.8% and damping to -0.27, making the grid unstable and potentially tripping protections, taking GPU services down, and triggering cascading failures. https://arxiv.org/pdf/2607.05993

Privacy

Technology Policy

China considers restricting global access to its top AI models, including ones not released yet. Alibaba, ByteDance and Z/ai got the summons. Leaking a model may soon count as treason. Beijing spent years pushing homegrown AI onto the world. Now it wants to lock the door behind it? https://www.reuters.com/world/beijing-is-looking-curbing-overseas-access-chinas-top-ai-models-sources-say-2026-07-07/

US policymakers have introduced a bill that would let the US government push KILL SWITCH button to throttle, suspend or shut down advanced AI systems following safety, concealment or loss-of-control incidents. https://lieu.house.gov/sites/evo-subsites/lieu-evo.house.gov/files/evo-media-document/ai-kill-switch-act.pdf

Other

European Union formally attributed a years-long campaign of cyberattacks targeting EU member states to the Russian Federation, identifying the FSB’s 16th Centre as the structure controlling several threat groups, including Turla. It carried out intrusions into government networks and sabotage operations against critical infrastructure. The Council of the EU imposed sanctions on nine individuals and four entities, including GRU officers, cybercriminals, pro-Russian groups and companies providing technical infrastructure. France was the only State to publish its own detailed political attribution accompanied by a technical and strategic report. It identified FSB Unit 61240 and described cyberattacks against the defence ministry, the French embassy in Moscow, the justice sector and a research institute working for the defence industry. Finland published a technical assessment and summoned the Russian ambassador. Germany and the Netherlands also took diplomatic action. Austria, Belgium, Czechia, Estonia, Lithuania and Poland issued national statements. The announcement came during the meeting of the so-called Coalition of the Willing (for remilitarisation) in Paris and the 14 July parade, which featured French military cyber units. An interesting and, of course, entirely coincidental convergence. Or perhaps not?

In case you feel it's worth it to forward this content further:

Subscribed

If you’d like to share:

Share

Cyberattack on NAIC, the U.S. state insurance regulators’ coordinating body. PeopleSoft zero-day was exploited - an unauthenticated SSRF-to-RCE chain. Apparently they had a working exploit before Oracle’s public advisory and patch. Attackers published stolen data and claim 3.1 TB was stolen, but NAIC hasn’t confirmed that scope. They also amended earlier dump claims blaming an “AI-generated misinterpretation.” These days, even cybercriminal activities are affected by AI hallucinations? https://content.naic.org/about/security-update

The C.I.A. is reorganising to put greater priority on cyberoperations, especially offensive cyber capabilities. It wants officers to become more skilled at using digital tools, data, and code for intelligence collection. A major focus is using AI, understood as "digital nuclear weapons" aggressively but keeping humans in control of final decisions. The agency is strengthening its ability to hack computer networks, communications systems where intelligence can be gathered. https://www.nytimes.com/2026/06/30/us/politics/cia-reorganization-cyber-ai.html?smid=tw-share

Privacy

Technology Policy

Anthropic is brinding back Mythos/Fable access. With cybersecurity uses disabled, or limited. They also confirm that GPT-5.5 nd Kimi K2.7 models were able to find the same security vulnerability which caused enacting export controls. The US Government will now get a pre‑release access and evaluation of new powerful AI models. https://www.anthropic.com/news/redeploying-fable-5

China is tightening enforcement around AI services and applications, including open-source AI models. In a 2026 campaign targeting “AI application chaos" the Cyberspace Administration of China identified inadequate safety management of open-source models as a concern. The notice says open-source communities lack identity-verification and safety-management systems, and have not established effective review or emergency-response mechanisms for datasets, model code, and other materials uploaded by users. It also criticizes the failure to promptly remove datasets or open-source models that present serious risk. This is not a ban on releasing open models. China is bringing open-source AI developers and cmmunities into its broader regulatory goals. They also have a reporting website for AI use violations, including for whistleblowers. The Cyberspace Administration of China’s reporting form accepts reports of: violations by AI application services and "disorderly AI-generated information", failures to complete required model registration, weak platform safety controls and review filters, unsafe training datasets, AI data poisoning, inadequate labeling of synthetic content, illegal misuse of AI technology, inadequate safety management of open-source models, AI-generated distortions of cultural classics, false or misleading information, impersonation, violent or vulgar material, harms to minors, using AI automation to run coordinated fake-engagement operations https://www.cac.gov.cn/2026-04/30/c_1779289298718765.htm

Bank of England deputy governor wants to have kill switches for AI trading systems before they explode the market. This is unlikely to work because is not one faulty model, but the concept of feedback loop between many systems that are each behaving “correctly” on their own. Switching them off at once could make buyers disappear and panic worse. Regulators should focus less on magical thinking. https://www.bankofengland.co.uk/speech/2026/june/sarah-breeden-panel-at-the-european-central-bank-forum-on-central-banking-2026

Other

In case you feel it's worth it to forward this content further:

Subscribed

If you’d like to share:

Share

Security

Russian-linked cybercriminals, converted a JLR breach into systemic industrial damage. £260m in disclosed costs, a £244m FY26 net loss, £2.2bn free-cash outflow, and £1.9bn UK losses across 5,000+ organisations. UK GDP impacted. Not an ordinary extortion. THIS is an act of economic coercion. https://www.nytimes.com/2026/06/26/world/europe/jaguar-russia-hack.html

AI that hacks for you. CVE-Genie automatically turns any known security vulnerability into a working exploit, end-to-end, no expertise required. Security engineering, management and governance has long relied on the gap between "a CVE exists" and "someone capable enough to weaponize it." That gap is now being closed via few API calls. https://github.com/BUseclab/cve-genie

Public CVEs are becoming raw material for reproducible vulnerability infrastructure. Agentic systems can now generate proof of concepts and exploits from security advisories, diffs, reports, and vulnerable code locations. Stale security management gets harder each day, especially for banks and enterprises. https://arxiv.org/pdf/2602.07287
https://arxiv.org/pdf/2602.14345
https://arxiv.org/pdf/2602.03012

Europol and partners disrupted three malware ecosystems - SocGholish, Amadey, and StealC - in a coordinated strike involving law enforcement from six countries and private-sector. 326 servers and 142 domains killed, 27 million stolen credentials recovered, $47 million in criminal crypto assets identified and restricted, 18,000 infected computers freed from criminal control, and 14,971 compromised websites remediated. AI-assisted analysis found that Amadey and StealC, two separately developed tools linked to 140,000 infected machines in the first two weeks of May, relied on the same backend infrastructure. That let lawyers treat them as one criminal conspiracy. Microsoft also observed Russian-affiliated actor Secret Blizzard using Amadey infections to deploy custom malware against targets in Ukraine. So the same dropper you get from a fake browser update on a restaurant’s website can end up in a military context. The supply chain is universal.
https://www.europol.europa.eu/media-press/newsroom/news/global-cyber-strike-disrupts-socgholish-amadey-and-stealc-malware-networks

GLM 5.2 looks like the first Chinese open-weight model to have entered the frontier tier in agentic cybersecurity tasks. Or to have copied it very effectively. The mistakes are interesting. GLM 5.2 gets things wrong in similar ways to Opus and GPT-5.5. That could mean a breakthrough. It could also mean someone trained it on answers from frontier models (distillation). In practice, the difference may be irrelevant to the user. An open-weight model reaches the level of the best closed models, at roughly half the cost of Opus. https://www.graphistry.com/blog/glm-5-2-cybersecurity-open-model

Every iPhone with an A12 or A13 chip - XS/XR, 11, 2020 SE - has an unpatchable SecureROM exploit. The root bug is in Synopsys’s USB controller, and is exploitable. Requires physical access. Solution: buy a new iPhone https://ps.tc/pages/blog-usbliter8.html

Technology Policy

Over 60 American cybersecurity experts & executives have signed an open letter asking the Commerce Secretary and National Cyber Director to lift export controls on Anthropic’s Fable and Mythos AI models. Yes, Mythos finds software flaws and writes exploits well, but so do others like GPT-5.5, Claude Opus, Sonnet, and Chinese models like Kimi 2.7. Fable’s protections were so aggressive the security community laughed at them on launch day. The controls pulled capable tools from defenders while adversaries keep advancing. China’s open-weight models are months behind at most, and that’s only what’s been published.

The letter asks for scientific evaluation criteria developed with industry input, proper rulemaking, transparent enforcement, and proportionality. One of the more telling lines: the original research that triggered the ban was about identifying insecure code. That’s not an offensive capability but how you write secure software. https://freefable.org/

Five Eyes cyber chiefs issued a joint warning that AI-powered cyber threats could outpace current government and corporate defences within months. They name no adversaries. Their advice to companies: reduce attack surfaces, patch faster, fix legacy systems, tighten access controls, and adopt AI for defence https://www.ncsc.gov.uk/sites/default/files/2026-06/Five-Eyes-cyber-security-agencies-statement-ai-shift.pdf

In case you feel it's worth it to forward this content further:

Subscribed

If you’d like to share:

Share

This is not a precedent in tech history. States have restricted access to strategic technologies deemed national security risks before. But the comparison only goes so far. Crypto could be reimplemented, by anybody, frontier models cannot. They require massive compute, capital and infrastructure. So when the home state can switch off access, you are renting access to a strategic asset.

This is not a wake-up call for Europe. Wake-up calls are for people who were asleep. Europe has seen this risk for years: cloud, chips, platforms, now frontier AI. This is not the alarm. This is the bill for ignoring it.

Security

U.S. agencies issued an alert about hackers targeting automatic tank gauges - systems that quietly monitor fuel levels, temperatures, and leaks at gas stations, farms, chemical plants, and transport hubs across the country. The attackers are bypassing login screens, injecting commands into databases, and escalating themselves to full admin access. Once in, they can change tank volumes, disable leak alarms, and mess with pump controls. https://www.cisa.gov/resources-tools/resources/cisa-and-partners-urge-hardening-automatic-tank-gauge-systems

You can have a hard time to use AI to analyze malicious software if it contains words triggering "safety refusals" due to nuclear weapons design. https://socket.dev/blog/mini-shai-hulud-miasma-and-hades-worms-target-bioinformatics-and-mcp-developers-via-malicious

Privacy

Biggest consumer data breach in South Korea’s history. 37.56 million people affected in the core breach. The exposed data included:

- 33,057,012 member profile records

- 63,986,351 delivery-address records

- 272,470 order-history records.

Coupang, South Korea’s largest e-commerce platform and online retailer hit with a ₩624.68bn, roughly $409m, sanction by Korea’s Personal Information Protection Commission.

Basic security and governance failures like weak signing-key management, weak access control, poor detection of abnormal access, breach notification failures, data deletion failures, CPO independence issues and investigation obstruction. A former employee used an active alternative authentication signing key to generate forged authentication tokens. Then he reached customer information.

Coupang collected online activity records from 11,170,613 users via third-party websites and apps where Coupang ads appeared. This included visited URL or app name, access time and IP address.

https://pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=12171

Technology Policy

Suspected Chinese info ops used ChatGPT to target U.S. AI infrastructure debates with posts blaming data centres for household power bills, and attacking tariffs. The campaign got little traction, but coverage may matter more than the operation. https://cdn.openai.com/pdf/96b559fa-c165-4575-805d-e636909e2f78/June-2026-Threat-Report.pdf

[This might not belong to the ‘security’ section]

Other

Another AI fabrication report? KPMG published a report called Total Experience: Redefining Excellence in the Age of Agentic AI. It had 45 citations. 5 were accurate. 40 had fake titles. At least 16 were classified as hallucinations/fabrications. 12 were so vague or broken that the source could not be identified. The case studies are worse. JR East was cited as evidence of AI-powered travel recommendations. The source was a 2019 press release that predates agentic AI and does not mention AI at all. KPN’s “agents” turned out to be humans. Toyota’s Woven City press release mentions no AI agents. It looks like someone asked an LLM to find examples of agentic AI in the wild. It made things up. Nobody cared. The report has since been cited by industry blogs, trade publications and newspapers. ChatGPT and Gemini are reportedly repeating its statistics. KPMG charges clients to implement AI responsibly. The invoices, presumably, are accurate. https://gptzero.me/news/investigations-kpmg/

In case you feel it's worth it to forward this content further:

Subscribed

If you’d like to share:

Share

The first cyberattack in history using prompt injection. Attackers used Meta’s chatbot as a tool to take over Instagram accounts belonging to well-known people, brands, and institutions. By manipulating Meta’s AI support system, they convinced it to perform a critical administrative operation: changing or adding an email address associated with the victim’s account. Basic mistake: using LLM as a security boundary. The attacker contacted Meta’s bot, provided the username of the account they wanted to take over, and asked it to link that account to a new email address controlled by the attacker. In practice, this meant that the person controlling the new email address could receive or provide the confirmation code, and then use the modified recovery channel to reset the password and take over the account. AI support became a path for bypassing account security. If a chatbot can change an email address or initiate account recovery without independent verification of the owner, the attacker does not need to know the password or break through traditional security controls. It is sufficient to convince the automated support operator to perform an operation that the attacker should not normally be allowed to request. https://www.theverge.com/tech/941179/meta-instagram-ai-support-chatbot-exploit-hacked

Draft:

AI/LLM can absolutely make autonomous cyberattacks and hack enterprise networks, but also government systems and this can be cheaper than human ops. Going beyond “magic hacking powers of this and that model” the important stuff is in agentic orchestration, so scanning, tool use, credential discovery, exploit selection, evidence tracking, privilege escalation planning, and adaptive retries across long attack chains - all well planned and executed. Once properly architected and connected, including to tooling like to shells, scanners, knowledge bases, memory, and task planners, models can turn known weaknesses, exposed services, misconfigurations, leaked credentials, and weak identity controls into repeatable intrusion workflows. This is also about going beyond human expertise limits to architectural decisions about state management, tool wrappers, context control, and deciding when a path is worth pursuing. This lowers the cost of offensive experimentation and lets attackers run more attempts, across more targets, with less specialist work. Defenders should assume AI-assisted intrusion attempts will become continuous, cheap, but also noisy before they become perfected. This genie is out of the box and let’s repeat: harness is critical, and the work can absolutely be done with freely available open weight models. https://dl.acm.org/doi/pdf/10.1145/3766895 https://dl.acm.org/doi/pdf/10.1145/3800584 https://arxiv.org/pdf/2507.00829 https://arxiv.org/pdf/2505.10321 https://arxiv.org/pdf/2602.17622

Another supply-chain compromise worm. Multiple packages in the official Red Hat redhat-cloud-services npm scope were compromised in a supply-chain attack distributing a credential-stealing worm. Affected packages added a preinstall hook that ran a script. The malware harvested npm, GitHub, AWS, Azure, GCP, Vault, Kubernetes, SSH, CI/CD, and local secrets, then attempted to propagate by abusing stolen credentials to publish additional malicious packages and modify repositories. Any environment that installed affected versions should be treated as compromised. https://www.wiz.io/blog/miasma-supply-chain-attack-targeting-redhat-npm-packages https://www.aikido.dev/blog/red-hat-npm-packages-compromised-credential-stealing-worm

AI-powered computer worm, a self-replicating agent that reasons its way through a network instead of carrying a fixed exploit list. It steals compute from compromised GPU machines to run its own open-weight LLM, then uses weaker machines as relays for reach. In trials on a corporate testbed, it identified vulnerabilities, exploited systems, and launched replicas across Linux, Windows, and IoT targets. Every new infection can add more infrastructure while costing the attacker almost nothing. Patching one flaw no longer ends the threat, because the worm can operationalise fresh advisories, generate new attack logic, and keep adapting without a human operator. It is not a WannaCry-style worm with one baked exploit and one baked ransomware payload. It can adapt across many vulnerability classes it can discover and operationalise https://arxiv.org/pdf/2606.03811

Privacy

Cyberattack on humanitarian organization World Food Program exposes sensitive data of vulnerable population. Affected 600,000 households in Gaza, names, ID numbers, phone numbers, location data, all exfiltrated. The timing is specific. Israel's Supreme Court had just upheld a requirement forcing aid organizations to hand over workers' personal data as a condition of operating in Gaza. In 2022 it was the Red Cross (515,000 people). In 2023, the Norwegian Refugee Council. This time it's WFP. The sector has had a poor track record. https://www.thenewhumanitarian.org/news/2026/06/02/data-600000-gaza-households-exposed-wfp-cyber-attack

The world’s largest residential proxy network runs on consent, TLS and vibes. The TV is always watching and apparently it is also available for contract work in surveillance or data acquisition? Bright Data sells access to a residential proxy network, the kind customers use to route requests through real home IP addresses instead of datacenter IPs that Cloudflare, DataDome and HUMAN are trained to block. The supply comes from an SDK embedded in consumer apps. So: CTV games, messengers, mobile apps and screensavers. With consent somewhere upstream, the device becomes an exit node. The TV is perfect for this job. It is plugged in, on WiFi, often unattended and barely supervised. It also asks for consent through a privacy policy and a remote-control UI, which is one way to make “informed choice” look like an endurance sport. One config flag tells the SDK to ignore whether the screen is on. Another tells it to ignore whether the user is on a call. In this economy, watching TV counts as downtime. https://blog.includesecurity.com/2026/06/the-smart-tv-in-your-livingroom-is-a-node-in-the-aiscraping-economy/

Technology Policy

Other

Developer adds instructions to instruct AI coding agents not to use the project (and before that, instructions made AI agents remove the tests and code for this project). https://jqwik.net/docs/1.10.1/user-guide.html#note-to-coding-agents-and-alike

Revolution in computing hardware? Nvidia announced RTX Spark, a chip combining a Blackwell GPU (6,144 CUDA cores, FP4 Tensor) with a 20-core Grace CPU, up to 128GB unified memory, claimed 1 petaflop of AI Claimed workloads include rendering 90GB 3D scenes, editing 12K 4:2:2 video, running 120B-parameter LLMs with up to 1 million tokens of context, generating 4K AI video. The ambition is to bring AI-first computing to PCs and laptops, making Nvidia's stack the default runtime for local AI agents. Microsoft is doing real platform work alongside - Windows scheduler tuning, unified memory changes, TensorRT via Windows ML, OpenShell sandboxing for agent containment. So this isn't just a chip swap. It is also Microsoft's second attempt to define the "AI PC" .

In case you feel it's worth it to forward this content further:

Subscribed

If you’d like to share:

Share

Another wave of supply chain attacks hit npm. The worm republishes itself using stolen npm tokens – the blast radius grows automatically with each new victim. The compromised maintainer account atool pushed 639 malicious package versions across 323 packages in under an hour. The payload steals whatever it finds. GitHub tokens, AWS keys, Kubernetes credentials, CI/CD secrets from GitHub Actions, GitLab, Jenkins, CircleCI and a dozen more platforms. If it finds a GitHub token, it creates repositories under the victim’s account and commits stolen data there. If it finds an npm token, it republishes more infected packages. The campaign has now hit 1,055 package versions. https://socket.dev/blog/antv-packages-compromised

Russian cyber operators hijacked hundreds of Bluesky accounts - journalists, academics, filmmakers - and used them in information operations to post propaganda. Bluesky insists its systems weren’t breached - old leaked credentials did the work. Avg post views: 50. https://www.france24.com/en/live-news/20260529-bluesky-accounts-hijacked-in-pro-russia-propaganda-campaign

Russia’s Social Design Agency runs online influence and propaganda operations. But it’s also making offline operations, staged for cameras and the media. Pig heads marked “Macron” were left outside Paris mosques. Green paint hit synagogues and the Shoah Memorial. Concrete skeletons appeared at the Brandenburg Gate with an anti-Merz message. Cars across Germany were disabled with expanding foam and stickers blaming the Greens. These were false-flag attacks built to look like local hatred, climate radicalism, anti-Muslim backlash, anti-Semitism, or anti-government protest.

The leaked details show a senior Russian Presidential Administration official tracking budgets, field operations and approvals. Serbia appears repeatedly as a logistics and recruitment hub due to cheap disposable operatives, cash payments, rented vehicles, burner phones, fast exits. One internal goal was candid enough: help Russia “maintain the image of a superpower.”

The files also describe outreach to Western retired generals, including one French and one American, to launder pro-Kremlin positions as independent expert opinion. For 2026, SDA plans include AI-generated content farms, fake think tanks, opinion-leader trackers and “Mitteleuropa”, a geopolitical project aimed at pulling Austria, Hungary and Slovakia into a Moscow-friendlier Central European bloc. Thirty sex dolls floating down the Seine with anti-migrant messages was not satire. It was an agenda item.

The previous SDA leak was in 2024. It changed nothing. Moscow just moved from fake websites to fake reality.

https://www.occrp.org/en/investigation/leaked-documents-reveal-russian-cognitive-strikes-against-the-west-including-islamophobic-pig-head-attacks-in-paris

Privacy

Using the Origin Private File System browser mechanism to track and fingerprint users via solid state disk (SSD) noise, from inside a regular browser tab, with no permissions, nor native code. Simple: create a file bigger than RAM, read random chunks in a loop, and SSD latency starts reflecting everything else on the machine - other websites loading, apps launching. 88% accuracy fingerprinting visited sites, 95% for identifying which desktop app just launched. Covert channel capacity: 660 b/s. Chromium, Apple, and Mozilla mostly ignored it. https://tugraz.elsevierpure.com/ws/portalfiles/portal/109750638/main.pdf

Technology Policy

Other

The first encyclical of Pope Leo XIV is a major intervention on AI, human dignity, truth, war, and technological power. It is a warning that technology is never neutral when it is shaped by money, control, secrecy, and force. It rejects surrendering human judgment to AI.

The encyclical treats cyberattacks as part of a wider transformation of conflict. Cyber conflict creates instability before formal war starts. War no longer is limited to tanks and missiles. It can begin with data theft, infrastructure disruption, manipulation, and invisible attacks whose authors are hard to prove.

The enciclica considers also information operations and cognitive warfare. It posits that propaganda, AI-generated manipulation, fear campaigns, and cyber operations are part of hybrid conflict.

The battlefield includes imagination, trust, identity, and social cohesion. This is the cognitive dimension.

The encyclical addresses lethal autonomous weapons systems, and AI-assisted targeting. Here the message is clear: lethal decisions cannot be delegated to machines.

Pope Leo XIV’s first encyclical therefore cannot be reduced to AI only. It is about the kind of civilization being built around AI. https://www.vatican.va/content/leo-xiv/en/encyclicals/documents/20260515-magnifica-humanitas.html

In case you feel it's worth it to forward this content further:

Subscribed

If you’d like to share:

Share