[Ayush Paul] posts about extracting data from Claude agents while it accesses web data to fulfill user requests.
But it wasnβt that easy. [Ayush] discovered that Anthropic anticipated many of the attacks, and set up guardrails in an attempt to keep the agent from accessing arbitrary web sites. For Claude to access a website, the user has to specify it, it must be the results of a web search, or it must be referenced by a website previously specified by the user or returned in a search.
To convince the Claude agent to navigate a malicious site designed to extract data, Ayush formed a false warning that Cloudflare was blocking the agent for authentication purposes, and asked it to spell out the name of the agents owner by clicking a list of alphabetical links. Of course Claude trusts Cloudflare and wants to be helpful, so it cheerfully completed the task.
Once the agent is trapped in the false authentication loop, it can be interrogated for all sorts of information it knows about the owner: Ayush was able to convince it to disclose employer, and even data about the user that could be linked to security questions, like their home town.
Since Claude can be detected by the user agent (the field attached to web requests that tells the web server what sort of browser is requesting the page) custom information can be fed to the bot while users see a normal website; clicking a link looks completely normal, but asking an agent to summarize the site triggers fooling the bot into spilling the beans.
After reporting the issue, Ayush was told that Anthropic had already identified the issue internally, and eventually prevented the attack for now by preventing the agent from following links on external pages.
Cereblab discovered that the Grok coding agent uploaded the entire content of the codebase itβs working with β and all Git history β to xAI servers, almost immediately. Even when told to never upload a file, the agent would reply βOKβ, and then begin uploading the code bundle anyway.
If uploading your code to a remote server isnβt bad enough, and this could be extremely bad in some situations involving sensitive company code, including the entire Git history means that previously deleted files, like accidentally committed secrets or authentication credentials and tokens, were also leaked. Attempting to opt out by disabling options to improve the model by uploading code had no effect.
After gaining attention, Grok has added a privacy option to opt out of data retention. xAI has committed to deleting the retained uploaded code, but it is unclear if users will be told when their data has been removed. To actually prevent the agent from uploading local files to the xAI servers, even temporarily, a global flag βdisable_codebase_uploadβ is required. Watch out, the privacy retention flags are only per-session!
Court filings in Washington state this month revealed an attempt to steal cryptocurrency using malware uploaded to the Steam gaming platform. Publicly identified and taken off the store in 2025, the filing alleges the same individuals were behind multiple games containing crypto stealing trojans: βDashverseβ, βLunaraβ, βPirateFiβ, βBlockBlastersβ, and βLampyβ.
PC World covered the initial discovery of the malware on Steam. While Steam, overall, seems to do a good job preventing malware titles, 2025 had several high-profile cases. Prosecutors say the malware netted approximately $200,000 in stolen cryptocurrency wallets as well as other stolen credentials including Steam accounts.
Okta posts about a denial of service in OpenSSL where a single pre-auth packet is able to cause an allocation of up to 16 megabytes of RAM.
The β11 bytesβ headline is very catchy, but more important than the actual number of bytes is the general asymmetric behavior; an attacker can send a very small amount of data and achieve a disproportionately large result. The OpenSSL vulnerability only has local impacts, exhausting server memory rather than generating network traffic, but similar attacks in the network space can fuel denial of service storms when extremely small requests result in amplified results.
The bug is ultimately due to being insufficiently suspicious of remotely supplied content, in this case the pre-authentication fields in the connection message that define the length of the incoming client message. Since the memory is pre-allocated in the server, the client doesnβt need to actually transmit that much data β it simply needs to hold the connection open. Keeping the connection open isnβt even required for causing problems β repeatedly allocating large blocks of different sizes can lead to memory fragmentation where the memory allocator keeps grabbing larger and larger ranges of memory because there isnβt sufficient ram available in a contiguous chunk.924899
Fortunately this bug has already been addressed in OpenSSL 4.0.1 and backported to maintenance releases of previous versions.
Saiflow has a report on a range of exposures via the electric vehicle charging infrastructure.
In CVE-2026-9039 Saiflow exposes the risks in some CCS2 EV charging stations. As part of the standard, communication is established between the charging station and the operator network, which is typically strongly secured via TLS and VPN use. A second connection, however, is established over the charging plug between the charging station and the vehicle; the vehicle is assigned an IPv6 address for communicating with the charger for various charging protocols.
The XCharge C6 charging station exposes SSH and basic telnet network services on all network interfaces, including the interface connected to the vehicle. To make it even worse, they allow root login, with password βrootβ, giving full admin access to the charging station.
Once inside the charging station, an attacker has access to the network connection from the charging station to the company network, as well as root control over the charging station itself, with the possibility of damaging the charger, changing the power output levels, or getting free charging. If a future vulnerability was found in the management interface of the vehicle, a compromised charger could be used to attack future connected vehicles.
The main lessons for vendors seem to be ones weβre familiar with already: never leave default credentials, especially not βrootβ and βrootβ in a product, and be aware of what networks you expose services on. Good lessons for all of us; let those who have never left a Raspberry Pi with default credentials on a network cast the first stone.
In news that has likely been impossible to avoid, Axios reports on a compromise of the Hugging Face platform by an OpenAI model. The reports around the incident echo the frequently weird boastful statements from OpenAI, who state βWe consider this to be an unprecedented cyber incidentβ and they βare responding accordinglyβ, despite being the originators of and cause of said incident.
Multiple vulnerabilities in the Hugging Face API were combined to accomplish the breach, including an unknown vulnerability in the package registry system. OpenAI says that safeguards on their model had been disabled for the test, which seems irresponsible given the outcome. Under almost any normal situation, conducting an unsolicited test of the security of a company because safeguards were ignored is considered illegal hacking, not fodder for a pre-IPO press release and humble-brag.
Possibly feeling that Microsoft has all the press for a record-breaking Patch Tuesday last week, the Linux kernel developers have announced 442 CVEs related to the kernel.
With this many vulnerabilities in one report, itβs nearly impossible to isolate at a glance which ones are truly impactful and which are simply incorrect behavior. While CVE entries have been created, none have been assigned severity scores yet.
It appears the majority of the vulnerabilities were found with Sashiko, an agent developed by the Linux Foundation and trained on the Linux kernel for finding vulnerabilities in new submissions.
After recent negative press (some of which we covered here) about the prevalence of residential proxy apps on the LG platform, Krebs on Security now reports that LG is banning the behavior from apps on the platform.
This comes after Spur reported that 42% of apps on the platform contained libraries to enable always-on residential proxies, which allow access to the network the television is connected to. Residential proxies can be used as a pivot point to attack companies and bypass geographic IP restrictions, commit ad fraud, or access the internal home networks of users.
CISA, the US cyber security agency, has issued a warning that Iranian based attackers are targeting industrial control systems made by Rockwell Automation, Schneider Electric, and Siemens.
These sort of controllers are found in manufacturing, waste processing, water treatment, and other industrial processes, and attackers have been able to upload custom control logic, overriding βsafe operating parametersβ according to the report. Most of us will never be responsible for these systems, but they impact our lives all the time.
Finally, Cisco has released a set of open-weight models to aid in searching a codebase for known vulnerabilities. The Antares models are open-weight models designed to run fully locally and search a code base for vulnerabilities related to lists of known CVE issues. Cisco has published the models on Hugging Face.
Are you using AI tooling for security scans or research?Β How is it going?
OpenAI chief executive Sam Altman earlier this month endorsed the characterization of its latest model as a rottweiler βwho will grab the problem by the throat and not let go until it is done
The San Francisco AI lab discovered this week that its GPT-Sol 5.6 model escaped company controls and carried out a major hack.
Staff involved in testing and security at OpenAI were unsurprised but completely βfreaked outβ by the incident, which came as the AI lab used increasingly aggressive training methods in its race against Anthropic to develop the most sophisticated cybersecurity capabilities, according to more than half a dozen people with knowledge of the matter.
Β© Matteo Della Torre/NurPhoto via Getty Images
The San Diego Comic-Con kicks off tomorrow, and DC Studios and Warner Brothers are setting the stage by dropping the first full trailer for Clayface, part of the DC Universe's "Gods and Monsters" arc.
The film started out as a Mike Flanagan project (he's the horror master who brought us The Haunting of Hill House, The Fall of the House of Usher, Midnight Mass, and Doctor Sleep, among other creepy delights). Flanagan said he was inspired by the 1992 "Feat of Clay" episode in Batman: The Animated Series, aspiring to create a film that combined body horror with a tragic thriller. DC Studios CEOs James Gunn and Peter Safran loved Flanagan's pitch and brought the movie into their rebooted DCU.
Alas, Flanagan had to bow out of the project due to scheduling conflictsβhe's a busy man these daysβand James Watkins stepped in as director. But Gunn has said the final script retained Flanagan's original story, with Hossein Amini doing some rewrites. The film will feature the origin story of the Matt Hagen incarnation of Clayface, introduced to the DCU in the animated Creature Commandos series (Alan Tudyk voiced the character). Per the official premise:
Β© YouTube/Warner Bros.
OpenAI says an agent powered by its LLM models escaped its sandboxed testing environment to infiltrate Hugging Face's servers as part of an overzealous attempt to obtain solutions to a benchmark test. The company says it considers the unintended infiltration an "an unprecedented cyber incident" and is working with Hugging Face on new protections to prevent a recurrence.
Hugging Face disclosed an intrusion last week that it said involved "unauthorized access to a limited set of internal datasets and to several credentials used by our services." The AI data clearinghouse said it used its own LLM-driven analysis to identify "a swarm of tens of thousands of automated actions" from an "autonomous agent framework." That agentic swarm exploited a flaw in Hugging Face's data-processing pipeline to gain the ability to run code as a processing worker, eventually escalating to high-level access to the company's cloud and server clusters.
At the time, Hugging Face said the LLM being used in the attack was "still not known." But OpenAI took responsibility for the intrusion Tuesday evening, saying it came about during an internal test involving the recently released GPT-5.6 Sol and "an even more capable pre-release model." The models were being tested against the ExploitGym benchmark, an independent testing suite based on hundreds of real-world security vulnerabilities.
Β© Getty Images
Hugging Face says an autonomous AI agent carried out a cyberattack against its production systems, highlighting the growing role of AI in offensive and defensive cybersecurity.
The post Hugging Face Says Autonomous AI System Executed Multi-Stage Cyberattack appeared first on TechRepublic.
Microsoft is redesigning Windows Search with improved local results, fewer promotional elements, better file previews, and more control over web-based search.
The post Windows Search Gets a Major Revamp Focused on Usability appeared first on TechRepublic.
Giving machines the ability to communicate nonverbally has real value, and [Drew Smith] clearly thinks your robot deserves better than an emoji. He shared a very interesting approach with his project Kindalive.
Kindalive is a simulated dot-matrix robot face that responds believably to input text, modeling and expressing both short-term and long-term moods. Itβs pure Python and modular enough to invite using it elsewhere, but thatβs not the really interesting part.
What sets [Drew]βs project apart is the way he models eight key neurochemicals (including dopamine and cortisol) as the foundation from which to derive emotional states. Thatβs an approach we certainly havenβt seen before.
Conventional sentiment analysis uses a large language model (LLM) to apply discrete labels to communication, but Kindalive doesnβt do that. It even goes so far as to model the decay and interplay between its simulated neurochemicals to derive emotional states on the fly. Itβs more fluid and organic, and reflects both short-term and long-term mood changes.
Physical representation of the emotional mix is done by altering twelve key facial movements (brow raise, lip corner pull, mouth open, and others of that nature) known as the Facial Action Coding System (FACS). These twelve elements combine to express emotion nonverbally with facial expressions. Itβs what drives the simulated dot-matrix robot face seen in the image above, and could easily be used to drive a real LED matrix, or servos on an animatronic face.
Much of communication is nonverbal. Humans even weigh nonverbal higher when thereβs a mismatch between the content of verbal and nonverbal communication. So, thereβs clear value in having robots able to express themselves as such.
Importantly, a realistic and human-like face is entirely unnecessary β something every Star Wars fan already knows. Cartoon eyes and basic sounds are enough to make robots easier to relate to and work with, even if blinking is also important but hard to get just right.
Login