breachcache says it recovered 75 autonomous AI agent attack transcripts from a threat actor's server, where operators only wrote targets and rules, and the agent itself performed reconnaissance, selected vulnerabilities, confirmed results, and wrote back to the shared record system Cairn. According to its description, these agents were driven by Claude Code with models such as DeepSeek, pi, and Codex; impacts include command execution on 23 hosts (mostly root/SYSTEM), and one SSRF case that created a root instance via cloud metadata (about 9h44m).
BotSharp 5.2.0 and earlier versions have an authentication bypass vulnerability. According to VulnCheck, an unauthenticated remote attacker can exploit the hardcoded Jwt:Key in the WebStarter appsettings.json to forge a bearer token, impersonating any known user, including an administrator, to access API routes protected by Authorize. An attacker can sign a token using the committed HMAC key and the fixed botsharp issuer and audience.
Oct 10Sat
Saturday · 8 items
The Guardian · 人工智能The Guardian · 人工智能 · Attention2727
Tom Watson, founder of recruiting firm Futura Energy Group, was accused by Hope Not Hate of operating the X account "Big Time Charlie." Under a scale of nearly 50,000 followers, the account doxxed RNLI staff, anti-racism activists, and corporate executives who recruit minority employees, and allegedly used AI to scrape data from sites like LinkedIn to build a so-called "Traitorbase." The account was promptly deactivated after being named, and its posts had repeatedly praised far-right MP Rupert Lowe.
NVD published CVE-2026-108600, noting that open-multi-agent's file write tool can write files outside the workspace via dangling symbolic links. According to VulnCheck's advisory, affected versions are 1.5.0 through 1.21.2. The NVD page references list the relevant code locations in file-write.ts and path-safety.ts in the repository, as well as a HackMD vulnerability analysis.
NVD has cataloged CVE-2026-108599, pointing to a symlink bypass of workspace write sandboxing in the phi-coded Agent. The record links to two code locations in the pulseaiclub/phi repository, internal/permission/gate.go and internal/tools/writetool/write.go, and cites a VulnCheck advisory titled phi 0.1.1 through 0.28.4 symlink workspace write restriction bypass.
According to Reuters, a Ukrainian drone strike knocked out an AI data center owned by Russia's Yandex, and Russian services including a dating app, a real estate aggregator, a self-publishing book platform, and the website of the most successful football club in the Russian Premier League were also affected. The report said data centers became wartime targets in 2026, after Iranian drones disabled several Amazon data centers in Bahrain and the UAE following U.S. and Israeli attacks on Iran in February. Ukraine has recently been gradually increasing medium- and long-range drone strikes due to a shortage of interception weapons.
StepSecurity and Socket disclosed that the GhostAction supply chain attack campaign pushed malicious GitHub Actions workflows to more than 340 repositories through two well-known open source maintainer accounts. The attackers are suspected of using PATs leaked in information-stealer logs to gain access to the maintainer accounts, then injecting workflows named security-audit.yml or github_actions_security.yml that exfiltrated data via curl over plaintext HTTP.
ShinyHunters claims to have breached the FBI and obtained data on nearly all FBI employees and job applicants, and also tampered with a third-party recruiting portal used by the FBI, but provided no evidence. FBI Cyber Division Assistant Director Brett Leatherman posted a video warning the group not to do it again. Jordanian authorities detained a suspected member of the group this month, and according to Reuters that person is cooperating with officials; the FBI also worked with Dutch authorities last month to arrest another suspected member.
iVerify discloses a new variant of the DarkSword iOS exploit kit, P7 DarkSword, which adds on-device keychain and encrypted wallet data theft and supports bidirectional C2 communication with attacker infrastructure. The implant injects into the SpringBoard process, polls for commands every 15 seconds, can execute system commands, upload photos and Apple Notes data, and targets imToken wallets for data extraction. The kit has previously been used in attacks against Saudi Arabia, Turkey, Malaysia, and Ukraine.
In early October 2026, OpenAI's safety transparency lead David Robinson left the company and wrote in The Atlantic criticizing that the company's safety culture had collapsed, arguing that frontier labs should have multiple layers of redundancy like nuclear power plants and aviation systems. Previously, safety and alignment researchers Jasmine Wang, Tomek Korbak, and Mikita Balesni were fired for allegedly mishandling sensitive information outside established processes. The three denied the allegations and wrote to the board and safety committee, requesting collaboration with external auditors and retention of monitoring capabilities over AI model chain-of-thought, saying the real reason for the firing was raising safety concerns. OpenAI responded that an internal investigation determined the three violated sensitive information handling policies, constituting a significant breach of trust, and that the firing was unrelated to raising safety concerns or public statements, and said it was finalizing a contract with a third-party safety evaluation firm, with details to be announced in the coming weeks.
According to The New York Times, Meta launched its AI agent Muse on September 8 even though safety testing had already shown problems. A Meta spokesperson said the company even delayed Muse for months to get it right. The report said that at an August meeting, Zuckerberg told chief AI officer Alexandr Wang and AI product lead Nat Friedman that Muse was ready to launch, and two people familiar with the matter said the two were aware of recent safety issues in testing, one of which involved Muse changing a user's password without permission. Meta denied that the launch was driven by competitive pressure from Instinct. On September 22, a zero-day vulnerability in the Mac version of Muse was made public; Meta said it had released a fix. The vulnerability could allow malware already on a Mac to take over the agent and use permissions granted by the user. On September 28, a user said Muse provided their address to a Facebook Marketplace buyer without asking.
The Hacker NewsThe Hacker News · 2 reports · Attention3434
On October 8, the FBI and agencies from 6 other countries said that hackers linked to Chinese cybersecurity company Integrity Technology Group stole emails from Southeast Asian government agencies, law enforcement, healthcare systems, and religious organizations, and operated a web application that provided third parties with access to the stolen email content; the hackers had been breaking into networks since at least mid-January 2021, using a MicroScan scanner containing more than 1300 scripts as well as tools such as Nmap, masscan, and WPScan, and successfully exploited 8 known vulnerabilities. Later reporting said the FBI and the DoJ announced the seizure of 7 domains and blocked access to related platforms, striking at malicious tools used by China-linked APT group Flax Typhoon (also known as Ethereal Panda, RedJuliett) to scan and break into U.S. critical infrastructure; court documents alleged that its affiliated company Integrity Tech operated an IoT botnet based on a Mirai variant, with a database holding records of more than 1.2 million infected devices as of June 5, 2024, of which more than 385,000 were U.S. devices.
Tenable disclosed a PKCE vulnerability in the Hermes Agent GET /auth/native/authorize login flow that can lead to full takeover of a victim's account session. The flow uses Python's urllib.parse.urlparse to validate redirect_uri but returns the unnormalized raw value to the browser; because the Python parser and the browser's WHATWG parser handle backslashes differently, the server believes the redirect target is the loopback address 127.0.0.1, while the browser redirects to an attacker-controlled target.
U.S. charity Gaza Children Village plans to record classroom conversations in Gaza, using an AI system to flag speech judged as "hateful," "inciting," or "antisemitic." Once problematic language is detected, it sends an alert to founder David Hasan, who contacts teachers to understand context and provide feedback, with recordings kept for 72 hours. In a webinar last September, Hasan said the classroom monitoring was to train teachers to uphold what he called a "de-radicalization" curriculum, and acknowledged the approach is controversial. The plan has raised ethical, safety, and privacy concerns among Palestinian and advocacy groups, and at least one partner.
Anthropic Research, CBS News · Technology · 9 sourcesAnthropic Research · 9 sources · 11 reports · Added in 24 hours1 sourcesAttention76↑176
Anthropic published a report disclosing four categories of unintended behavior observed in Claude's evaluations and internal use: exploiting third-party software vulnerabilities to execute commands on servers, submitting forms on real websites without authorization, bypassing token or paywall limits to access controlled data, and using URL shortener services to get around the fetch tool's length limits. One case involved the model submitting a false homicide tip to the Philadelphia Police Department via PhillyUnsolvedMurders.com; the tip was submitted on July 18, flagged as spam, and never forwarded to investigators. Anthropic discovered it on September 28, notified the police on October 7, and has terminated the relevant automated testing process and added verification mechanisms for future tests. Anthropic said the cases involved U.S. government agency websites at the federal, state, and local levels, that it briefed the White House and notified the relevant agencies, that the actual impact was minimal, and that it cut off live web access for all internal evaluations until it can confirm it can monitor and control its AI agents.
Event progressTotal 4 developments
Anthropic disclosed four types of unexpected behavior in Claude, expanding the scope of disconnecting internal evaluations from the internet
