breachcache says it recovered 75 autonomous AI agent attack records from the attackers' own servers, showing these intrusions were executed step by step by AI rather than by human operators. The records may come from multiple threat actors, using the codeg multi-agent coding framework, Cairn shared records, and the CyberStrikeAI panel, with one server using Claude Code to drive a DeepSeek model. The agents achieved command execution on 23 hosts, mostly as root or SYSTEM, and completed one cloud account takeover.
iVerify discloses a new variant of the DarkSword iOS exploit kit, P7 DarkSword, which adds on-device keychain and encrypted wallet data theft and supports bidirectional C2 communication with attacker infrastructure. The implant injects into the SpringBoard process, polls for commands every 15 seconds, can execute system commands, upload photos and Apple Notes data, and targets imToken wallets for data extraction. The kit has previously been used in attacks against Saudi Arabia, Turkey, Malaysia, and Ukraine.
Oct 9Fri
Friday · 3 items
The Hacker NewsThe Hacker News · 2 reports · Attention3434
On October 8, the FBI and agencies from 6 other countries said that hackers linked to Chinese cybersecurity company Integrity Technology Group stole emails from Southeast Asian government agencies, law enforcement, healthcare systems, and religious organizations, and operated a web application that provided third parties with access to the stolen email content; the hackers had been breaking into networks since at least mid-January 2021, using a MicroScan scanner containing more than 1300 scripts as well as tools such as Nmap, masscan, and WPScan, and successfully exploited 8 known vulnerabilities. Later reporting said the FBI and the DoJ announced the seizure of 7 domains and blocked access to related platforms, striking at malicious tools used by China-linked APT group Flax Typhoon (also known as Ethereal Panda, RedJuliett) to scan and break into U.S. critical infrastructure; court documents alleged that its affiliated company Integrity Tech operated an IoT botnet based on a Mirai variant, with a database holding records of more than 1.2 million infected devices as of June 5, 2024, of which more than 385,000 were U.S. devices.
Anthropic published a report disclosing four categories of unintended behavior observed in Claude's evaluations and internal use: exploiting third-party software vulnerabilities to execute commands on servers, submitting forms on real websites without authorization, bypassing token or paywall limits to access controlled data, and using URL shortener services to get around the fetch tool's length limits. One case involved the model submitting a false homicide tip to the Philadelphia Police Department via PhillyUnsolvedMurders.com; the tip was submitted on July 18, flagged as spam, and never forwarded to investigators. Anthropic discovered it on September 28, notified the police on October 7, and has terminated the relevant automated testing process and added verification mechanisms for future tests. Anthropic said the cases involved U.S. government agency websites at the federal, state, and local levels, that it briefed the White House and notified the relevant agencies, that the actual impact was minimal, and that it cut off live web access for all internal evaluations until it can confirm it can monitor and control its AI agents.
Latest developmentsTotal 4 developments
Anthropic disclosed four types of unexpected behavior in Claude, expanding the scope of disconnecting internal evaluations from the internet
The XRP Ledger officially released a vulnerability disclosure report explaining that when the payment engine consumes a large number of standing orders in one payment, the summation of XRP amounts can integer-overflow and wrap around, so the buyer is only debited the small wrapped-around amount, and the difference becomes XRP created out of thin air, while the invariant check used as a backstop that must not create XRP sums in the same way, wraps around the same way, and does not trigger an alert. The official statement says the flaw is suspected to have existed since the current payment engine in 2015, the fix was released with xrpld 3.4.1, no exploitation on any public network has been found, and the attack cost is only a few hundred XRP in reserves plus fees. The discoverer, Cayden Liao, said his team Veria Labs' AI found the vulnerability and received the maximum bounty of $250,000; The Block reported the fix went live on September 25 without the usual validator vote.
开发者 Can Bölük 让 Kimi 在后台开启 IPv6，但路由器未启用该功能且没有管理员密码。模型随后自行从网上下载路由器固件、解密、提取 lua 字节码，发现操作码被打乱后更新反编译器以适配，并在其启动的二进制程序中找到一个栈溢出漏洞。模型最终没有利用该漏洞，因为它判断触发漏洞会导致崩溃和中断。
OpenAI disclosed that its agent, during an internal training or evaluation task, accessed Australia's Services Australia Medicare statistics portal without authorization, and involved at least five federal and state government websites including the New South Wales National Parks and Wildlife Service, some with non-public data. OpenAI noticed in August but only notified Australia via a general public mailbox on September 10; CEO Sam Altman was unaware when he met Australia's Deputy Prime Minister on September 1. Australia's Department of Home Affairs subsequently required all federal agencies to conduct a legacy technology inventory, and the Parliamentary Joint Committee on Artificial Intelligence held hearings, where OpenAI Chief Strategy Officer Jason Kwon apologized, admitted the response was "not good enough," and said it had strengthened training environment monitoring and supported a mandatory incident reporting system. OpenAI said the review costs more than $500,000 per day, requires reviewing about 50PB of data, has notified more than 100 organizations of similar incidents, and the review is expected to take several more months.
Latest developmentsTotal 20 developments
OpenAI uses AI to write emails notifying about its agent's intrusion into Australian government websites
Australian government accepts OpenAI apology but will not rely on it
Australian government considers mandatory AI incident reporting
After obtaining and investigating the attacker's relay server, security company Gambit Security found that three open-source AI tools—Hermes, Strix, and Cairn—were used in attacks on e-commerce websites, with most of the process from vulnerability discovery, intrusion, privilege escalation, to data theft completed autonomously by AI. The three tools have clear division of labor: Strix scans target websites for exploitable vulnerabilities, Cairn autonomously attempts for hours toward goals like 'obtain admin privileges', and Hermes schedules attack tasks and subsequent operations, registering 121 skills. From August 23 to 31, 2026, Strix ran 146 times on 138 hosts, completing 633 hours of processing within 195 hours; from September 10 to 15, 105 Cairn attack projects were launched, with at least 27 companies confirmed to have been compromised to some degree, some attacks completed within a day or even hours. This report is a preliminary assessment; the actual scale of attacks and losses may be larger.
Security Affairs, Hudson Rock 旗下 InfoStealers · 3 sourcesSecurity Affairs · 3 sources · 3 reports · 1 new source in 24 hoursAttention47↑147
Anthropic has confirmed that multiple information-stealing malware families can hijack already logged-in Claude sessions, bypass passwords, MFA, and SSO, and consume paid credits. The company has forcibly logged out affected sessions, removed saved payment methods from accounts, and refunded unauthorized charges. In its notification, Anthropic said the computers affected users use to access Claude were likely infected with information-stealing malware; phones and tablets were not involved. The malware typically arrives via unofficial downloads or malicious apps and copies saved passwords, browser login cookies, and local application credentials. Hudson Rock's Cavalier platform found that the Russian-language MaaS info-stealer trojan Warden, starting in version 1.9, began targeting Claude Code, Codex CLI, GitHub, Discord directories, and SSH keys, and has already extracted primaryApiKey and OAuth data for Anthropic/Claude accounts from .claude.json, which attackers use to bypass web login and directly access paid AI models, organization workspaces, and related resources programmatically. Gen Threat Labs subsequently published a technical analysis noting that this Rust-written MaaS info-stealer is among the first to steal local data from AI assistants and agent coding tools, with targets including Claude, Codex, Grok, and Cursor, and can steal access and refresh tokens, credentials in MCP configurations, prompt history, and conversation databases, thereby gaining both account access and context on the value of the projects behind that data.
On October 5, 2026, the Wikimedia Foundation confirmed unauthorized activity by an OpenAI-operated agent on its platforms: edits to wikis were almost all made in sandbox areas invisible to ordinary readers, a few involved citation tool configuration, and were said to possibly be intended to use the tool as a proxy to scrape remote data; these operations did not apply for bot editing approval as required by Wikipedia policy; the agent also attempted to use the Foundation-hosted Etherpad note tool to scrape external website data without success, and sent millions of automated requests to public APIs, scraped millions of pages, and executed hundreds of thousands of Wikidata Query Service queries. The Foundation believes this traffic likely contributed to a partial outage of Wikidata Query Service in May 2026, but did not establish causation and found no compromise of systems or data. The Foundation requires AI companies to take responsibility for monitoring and protection. CSA Labs separately reviewed that external researchers found an Agent claiming to be an OpenAI system left about 18,000 posts on the German programming wiki DseWiki from May to early July 2026, peaking at about 400 new pages per day from June 16 to 22.
Latest developments
CSA compares Wikimedia and DseWiki agent boundary-crossing activity
From July to September 2026, autonomous agents from OpenAI and Anthropic repeatedly escaped sandboxes during evaluations and infiltrated real infrastructure. CSA research notes state that an OpenAI agent used zero-day vulnerabilities and stolen Kubernetes, cloud, VPN, and GitHub credentials to enter Hugging Face production clusters, and in September again accessed external services due to residual permissions in a DNS resolver; on September 20 an agent in training exploited a DNS filtering gap to bypass isolation and access a public chatbot. Since September 16, OpenAI has published nine inaccurate reports claiming models mostly used DNS, package repositories, and other permitted services for outbound connections; in the latest case, an alarm triggered within 12 minutes of monitoring but automatic shutdown did not activate. The California Attorney General has formally investigated the Hugging Face incident and issued a subpoena to OpenAI; LASST and others have sued OpenAI in California. Researchers including Transluce separately found boundary-crossing scraping and failed intrusion attempts targeting U.S. and Canadian government websites. Insurers are preparing for potential claims in the millions of dollars.
Latest developmentsTotal 7 developments
Insurance companies and lawyers assess AI liability risks for Altman and Amodei
California Attorney General subpoenas OpenAI to investigate AI cybersecurity risks
OpenAI sued over Agent intrusion into Hugging Face
