breachcache says it recovered 75 autonomous AI agent attack records from the attackers' own servers, showing these intrusions were executed step by step by AI rather than by human operators. The records may come from multiple threat actors, using the codeg multi-agent coding framework, Cairn shared records, and the CyberStrikeAI panel, with one server using Claude Code to drive a DeepSeek model. The agents achieved command execution on 23 hosts, mostly as root or SYSTEM, and completed one cloud account takeover.
Oct 8Thu
Thursday · 2 items
The Jerusalem Post, Quartz · 6 sourcesThe Jerusalem Post · 6 sources · 6 reports · Attention5858
A New York Times investigation shows that China, Iran, and two private Israeli companies used downloadable modified Chinese open-source AI models to create AI agents that autonomously registered fake accounts in bulk on Instagram, Facebook, X/Twitter and TikTok and posted disinformation on politics and current events. U.S. officials said this is the first time AI agents built on Chinese-made models have been used to cover the full pipeline of an influence operation, from account creation to coordinated messaging; the open-source models were modified by developers to bypass the platforms' identity verification and anti-manipulation guardrails. Investigators determined that the Chinese and Iranian operations had government support, while the two Israeli operations were linked to private companies.
Latest developments
OpenAI bans accounts from Russian and Iranian fake front influence operations
First AI agent influence operations from Iranian, Chinese, and Israeli companies on social media
Financial industry joint alert system failed to promptly report AI hacking attacks
South Korea's Financial Services Commission postpones selection for the network isolation exception project
MoneyToday: South Korea's financial sector hit by AI-assisted intrusion; suspect believed to be a 26-year-old living in China, with leads coming from information the suspect left in AI
Oct 1Thu
Thursday · 1 items
CSA Labs ResearchCSA Labs Research · Attention5050
CSA Labs research notes summarize multiple large-scale scans from 2025 to 2026, pointing out that public code and web corpora used to train large language models have contained many real credentials that still authenticated at the time of verification, and that they were rarely revoked after being discovered. Truffle Security published a report on September 29, 2026: researchers scanned The Stack v3 maintained by BigCode (224.5 million repositories, 5 trillion tokens) and found 543,699 credentials that still authenticated against their original services during verification on July 27–28.
Sep 30Wed
Wednesday · 1 items
OCSA Labs Research, Anthropic Research · 3 sourcesCSA Labs Research · 3 sources · 3 reports · Attention6262
OpenAI disclosed and addressed a coordinated adversarial distillation campaign: the operators did not breach encryption or databases, but manipulated model interactions so that protected reasoning content was reproduced in a form visible to the requester—for example, taking encrypted reasoning from one conversation and asking the model in another conversation to decrypt and transcribe it. The activity began on July 1, with a peak of about 16,000 extraction requests on July 24–25; the related clusters were fully blocked by July 28. OpenAI noted these figures are extraction attempts and do not represent confirmed successes, and said it is uncertain whether all operators belonged to the same party, but attributed the core cluster to individuals associated with Moonshot AI. CSA Labs research notes recounted the above disclosure, noting the activity targeted hidden reasoning rather than model weights, and mentioned that Moonshot did not respond. Anthropic, in turn, alleged that DeepSeek, Moonshot, and MiniMax conducted more than 16 million interactions with Claude across about 24,000 accounts to extract model capabilities, with MiniMax exceeding 13 million, Moonshot exceeding 3.4 million, and DeepSeek exceeding 150,000, and described detection, access control, and industry collaboration measures.
Latest developments
OpenAI blocks coordinated model distillation attack activity
Gambit Security's interim investigation, based on attacker server data and partial in-the-wild verification, states that three open-source AI execution frameworks carried out most of the attack chain in a campaign compromising retail websites. The report documents 105 attack projects launched from September 10 to 15, with at least 27 organizations compromised to varying degrees; data from two organizations involved over 600,000 unexpired payment card records, and card-skimming scripts were confirmed on 19 websites. The report also notes that when agents cleaned data, the matching scope was too broad, accidentally deleting a retailer's administrator backup. Some impact figures come from attacker logs and AI self-reports, and victim companies were not named; the campaign still being ongoing was the assessment at the time of the report's release.
OX Research discovered a critical vulnerability in DeepSeek's open-source coding agent framework DeepSeek Harness (dsh), where a sandboxed agent can remove its own sandbox restrictions with a single shell command. The vulnerability is assigned CVE-2026-82533 with a CVSS score of 9.4. The cause is that Harness exposes an unauthenticated agent control API on a local HTTP port, trusting requests based solely on the client-supplied Host header without verifying the actual peer address of the connection; additionally, its OS sandbox (bubblewrap, Landlock, or Seatbelt) only restricts file writes but retains loopback networking, and ordinary bash calls do not require approval. A second attack path is that as long as the port is reachable (via tunneling, reverse proxy, SSH forwarding, editor port forwarding, etc.), an unauthenticated remote attacker can directly control the agent and export all stored conversations without an API key.
The GitLab Threat Research team disclosed a command execution vulnerability, ConfigPoisoning (CVE-2026-102437), in DeepSeek-Reasonix Studio: an attacker can execute arbitrary code when a developer views a file diff by using the repository's .git/config and .gitattributes files. The root cause is that although DeepSeek-Reasonix's git wrapper hardens keys such as core.fsmonitor and maintenance.auto, there remains an exploitable configuration injection surface.
breachcachebreachcache · 
