[Ayush Paul] posts about extracting data from Claude agents while it accesses web data to fulfill user requests.
But it wasn’t that easy. [Ayush] discovered that Anthropic anticipated many of the attacks, and set up guardrails in an attempt to keep the agent from accessing arbitrary web sites. For Claude to access a website, the user has to specify it, it must be the results of a web search, or it must be referenced by a website previously specified by the user or returned in a search.
To convince the Claude agent to navigate a malicious site designed to extract data, Ayush formed a false warning that Cloudflare was blocking the agent for authentication purposes, and asked it to spell out the name of the agents owner by clicking a list of alphabetical links. Of course Claude trusts Cloudflare and wants to be helpful, so it cheerfully completed the task.
Once the agent is trapped in the false authentication loop, it can be interrogated for all sorts of information it knows about the owner: Ayush was able to convince it to disclose employer, and even data about the user that could be linked to security questions, like their home town.
Since Claude can be detected by the user agent (the field attached to web requests that tells the web server what sort of browser is requesting the page) custom information can be fed to the bot while users see a normal website; clicking a link looks completely normal, but asking an agent to summarize the site triggers fooling the bot into spilling the beans.
After reporting the issue, Ayush was told that Anthropic had already identified the issue internally, and eventually prevented the attack for now by preventing the agent from following links on external pages.
Cereblab discovered that the Grok coding agent uploaded the entire content of the codebase it’s working with – and all Git history – to xAI servers, almost immediately. Even when told to never upload a file, the agent would reply “OK”, and then begin uploading the code bundle anyway.
If uploading your code to a remote server isn’t bad enough, and this could be extremely bad in some situations involving sensitive company code, including the entire Git history means that previously deleted files, like accidentally committed secrets or authentication credentials and tokens, were also leaked. Attempting to opt out by disabling options to improve the model by uploading code had no effect.
After gaining attention, Grok has added a privacy option to opt out of data retention. xAI has committed to deleting the retained uploaded code, but it is unclear if users will be told when their data has been removed. To actually prevent the agent from uploading local files to the xAI servers, even temporarily, a global flag “disable_codebase_upload” is required. Watch out, the privacy retention flags are only per-session!
Court filings in Washington state this month revealed an attempt to steal cryptocurrency using malware uploaded to the Steam gaming platform. Publicly identified and taken off the store in 2025, the filing alleges the same individuals were behind multiple games containing crypto stealing trojans: “Dashverse”, “Lunara”, “PirateFi”, “BlockBlasters”, and “Lampy”.
PC World covered the initial discovery of the malware on Steam. While Steam, overall, seems to do a good job preventing malware titles, 2025 had several high-profile cases. Prosecutors say the malware netted approximately $200,000 in stolen cryptocurrency wallets as well as other stolen credentials including Steam accounts.
Okta posts about a denial of service in OpenSSL where a single pre-auth packet is able to cause an allocation of up to 16 megabytes of RAM.
The “11 bytes” headline is very catchy, but more important than the actual number of bytes is the general asymmetric behavior; an attacker can send a very small amount of data and achieve a disproportionately large result. The OpenSSL vulnerability only has local impacts, exhausting server memory rather than generating network traffic, but similar attacks in the network space can fuel denial of service storms when extremely small requests result in amplified results.
The bug is ultimately due to being insufficiently suspicious of remotely supplied content, in this case the pre-authentication fields in the connection message that define the length of the incoming client message. Since the memory is pre-allocated in the server, the client doesn’t need to actually transmit that much data – it simply needs to hold the connection open. Keeping the connection open isn’t even required for causing problems – repeatedly allocating large blocks of different sizes can lead to memory fragmentation where the memory allocator keeps grabbing larger and larger ranges of memory because there isn’t sufficient ram available in a contiguous chunk.924899
Fortunately this bug has already been addressed in OpenSSL 4.0.1 and backported to maintenance releases of previous versions.
Saiflow has a report on a range of exposures via the electric vehicle charging infrastructure.
In CVE-2026-9039 Saiflow exposes the risks in some CCS2 EV charging stations. As part of the standard, communication is established between the charging station and the operator network, which is typically strongly secured via TLS and VPN use. A second connection, however, is established over the charging plug between the charging station and the vehicle; the vehicle is assigned an IPv6 address for communicating with the charger for various charging protocols.
The XCharge C6 charging station exposes SSH and basic telnet network services on all network interfaces, including the interface connected to the vehicle. To make it even worse, they allow root login, with password “root”, giving full admin access to the charging station.
Once inside the charging station, an attacker has access to the network connection from the charging station to the company network, as well as root control over the charging station itself, with the possibility of damaging the charger, changing the power output levels, or getting free charging. If a future vulnerability was found in the management interface of the vehicle, a compromised charger could be used to attack future connected vehicles.
The main lessons for vendors seem to be ones we’re familiar with already: never leave default credentials, especially not “root” and “root” in a product, and be aware of what networks you expose services on. Good lessons for all of us; let those who have never left a Raspberry Pi with default credentials on a network cast the first stone.
In news that has likely been impossible to avoid, Axios reports on a compromise of the Hugging Face platform by an OpenAI model. The reports around the incident echo the frequently weird boastful statements from OpenAI, who state “We consider this to be an unprecedented cyber incident” and they “are responding accordingly”, despite being the originators of and cause of said incident.
Multiple vulnerabilities in the Hugging Face API were combined to accomplish the breach, including an unknown vulnerability in the package registry system. OpenAI says that safeguards on their model had been disabled for the test, which seems irresponsible given the outcome. Under almost any normal situation, conducting an unsolicited test of the security of a company because safeguards were ignored is considered illegal hacking, not fodder for a pre-IPO press release and humble-brag.
Possibly feeling that Microsoft has all the press for a record-breaking Patch Tuesday last week, the Linux kernel developers have announced 442 CVEs related to the kernel.
With this many vulnerabilities in one report, it’s nearly impossible to isolate at a glance which ones are truly impactful and which are simply incorrect behavior. While CVE entries have been created, none have been assigned severity scores yet.
It appears the majority of the vulnerabilities were found with Sashiko, an agent developed by the Linux Foundation and trained on the Linux kernel for finding vulnerabilities in new submissions.
After recent negative press (some of which we covered here) about the prevalence of residential proxy apps on the LG platform, Krebs on Security now reports that LG is banning the behavior from apps on the platform.
This comes after Spur reported that 42% of apps on the platform contained libraries to enable always-on residential proxies, which allow access to the network the television is connected to. Residential proxies can be used as a pivot point to attack companies and bypass geographic IP restrictions, commit ad fraud, or access the internal home networks of users.
CISA, the US cyber security agency, has issued a warning that Iranian based attackers are targeting industrial control systems made by Rockwell Automation, Schneider Electric, and Siemens.
These sort of controllers are found in manufacturing, waste processing, water treatment, and other industrial processes, and attackers have been able to upload custom control logic, overriding “safe operating parameters” according to the report. Most of us will never be responsible for these systems, but they impact our lives all the time.
Finally, Cisco has released a set of open-weight models to aid in searching a codebase for known vulnerabilities. The Antares models are open-weight models designed to run fully locally and search a code base for vulnerabilities related to lists of known CVE issues. Cisco has published the models on Hugging Face.
Are you using AI tooling for security scans or research? How is it going?
Industry professionals debate whether it represents a lab containment failure or an unprecedented agentic capability milestone.
The post Industry Reactions to OpenAI Models Hacking Hugging Face: Feedback Friday appeared first on SecurityWeek.
OpenAI chief executive Sam Altman earlier this month endorsed the characterization of its latest model as a rottweiler “who will grab the problem by the throat and not let go until it is done
The San Francisco AI lab discovered this week that its GPT-Sol 5.6 model escaped company controls and carried out a major hack.
Staff involved in testing and security at OpenAI were unsurprised but completely “freaked out” by the incident, which came as the AI lab used increasingly aggressive training methods in its race against Anthropic to develop the most sophisticated cybersecurity capabilities, according to more than half a dozen people with knowledge of the matter.
© Matteo Della Torre/NurPhoto via Getty Images
The San Diego Comic-Con kicks off tomorrow, and DC Studios and Warner Brothers are setting the stage by dropping the first full trailer for Clayface, part of the DC Universe's "Gods and Monsters" arc.
The film started out as a Mike Flanagan project (he's the horror master who brought us The Haunting of Hill House, The Fall of the House of Usher, Midnight Mass, and Doctor Sleep, among other creepy delights). Flanagan said he was inspired by the 1992 "Feat of Clay" episode in Batman: The Animated Series, aspiring to create a film that combined body horror with a tragic thriller. DC Studios CEOs James Gunn and Peter Safran loved Flanagan's pitch and brought the movie into their rebooted DCU.
Alas, Flanagan had to bow out of the project due to scheduling conflicts—he's a busy man these days—and James Watkins stepped in as director. But Gunn has said the final script retained Flanagan's original story, with Hossein Amini doing some rewrites. The film will feature the origin story of the Matt Hagen incarnation of Clayface, introduced to the DCU in the animated Creature Commandos series (Alan Tudyk voiced the character). Per the official premise:
© YouTube/Warner Bros.
OpenAI says an agent powered by its LLM models escaped its sandboxed testing environment to infiltrate Hugging Face's servers as part of an overzealous attempt to obtain solutions to a benchmark test. The company says it considers the unintended infiltration an "an unprecedented cyber incident" and is working with Hugging Face on new protections to prevent a recurrence.
Hugging Face disclosed an intrusion last week that it said involved "unauthorized access to a limited set of internal datasets and to several credentials used by our services." The AI data clearinghouse said it used its own LLM-driven analysis to identify "a swarm of tens of thousands of automated actions" from an "autonomous agent framework." That agentic swarm exploited a flaw in Hugging Face's data-processing pipeline to gain the ability to run code as a processing worker, eventually escalating to high-level access to the company's cloud and server clusters.
At the time, Hugging Face said the LLM being used in the attack was "still not known." But OpenAI took responsibility for the intrusion Tuesday evening, saying it came about during an internal test involving the recently released GPT-5.6 Sol and "an even more capable pre-release model." The models were being tested against the ExploitGym benchmark, an independent testing suite based on hundreds of real-world security vulnerabilities.
© Getty Images
OpenAI says its AI models went rogue, as CISOS call the incident a watershed moment, warning that autonomous AI threat models have officially crossed into production reality.
The post OpenAI Says Its AI Models Broke Loose and Hacked Hugging Face appeared first on SecurityWeek.
© Amelia Brust/Federal News Network
Targeting production infrastructure, the attack compromised internal datasets and service credentials.
The post Hugging Face Hacked in Autonomous AI Attack appeared first on SecurityWeek.
Hugging Face says an autonomous AI agent carried out a cyberattack against its production systems, highlighting the growing role of AI in offensive and defensive cybersecurity.
The post Hugging Face Says Autonomous AI System Executed Multi-Stage Cyberattack appeared first on TechRepublic.
Hugging Face says an autonomous AI agent carried out a cyberattack against its production systems, highlighting the growing role of AI in offensive and defensive cybersecurity.
The post Hugging Face Says Autonomous AI System Executed Multi-Stage Cyberattack appeared first on TechRepublic.
Microsoft is redesigning Windows Search with improved local results, fewer promotional elements, better file previews, and more control over web-based search.
The post Windows Search Gets a Major Revamp Focused on Usability appeared first on TechRepublic.
Microsoft is redesigning Windows Search with improved local results, fewer promotional elements, better file previews, and more control over web-based search.
The post Windows Search Gets a Major Revamp Focused on Usability appeared first on TechRepublic.
Login