OpenAI GPT-6 Cyber found 81 high-severity Firefox flaws and hundreds of Linux bugs, raising new questions about AI-powered cyber risks.

OpenAI has introduced GPT-6 Cyber, a model built for security research that it says finds and fixes vulnerabilities better and stays within the limits researchers set far more reliably. These are OpenAI’s own results and evaluations, so read them as claims to check.

“We’re introducing GPT‑6 Cyber, a major leap in security research: more capable at finding and fixing vulnerabilities, and far more reliable staying within the boundaries researchers set. GPT‑6 Cyber delivers major gains on key cybersecurity benchmarks over GPT‑5.6 Cyber, including a 51% relative improvement on ExploitGym and a step function improvement when tested on staying within scope.” reads the announcement. “It is already helping to secure real-world software, uncovering and validating thousands of exploits in security-critical codebases such as Linux and Firefox.”

GPT-6 Cyber outperformed previous models in tests measuring its ability to exploit vulnerabilities. It scored 48.5%, compared with 32.1% for GPT-5.6 Cyber, and outperformed GPT-6 Astra in most cybersecurity tasks.

It also found more flaws during web penetration tests, identifying 40.3% of vulnerabilities versus 32% for Astra. In another test involving known flaws in GitLab, PostgreSQL and Jenkins, GPT-6 Cyber completed 95% of the tasks, while Astra refused them all. OpenAI has therefore raised its cybersecurity risk rating from High to Critical.

The real-world numbers are bigger. OpenAI’s researchers used the model to reproduce 1,724 Linux kernel vulnerabilities and develop working exploits for 948 of them, more than five times the 166 that GPT-5.6 Sol managed with the same research setup. Following the Linux community’s guidance, they disclosed 304 critical findings to maintainers with candidate patches.

“Developing exploits for 948 Linux kernel vulnerabilities⁠. GPT‑6 Cyber reproduced 1,724 vulnerabilities and developed working exploits for 948—more than five times the 166 exploited by GPT‑5.6 Sol using the same research harness. Following the Linux community’s guidance, we disclosed 304 critical findings to maintainers with candidate patches and are in the process of getting other vulnerabilities fixed.” continues the announcement.

In Firefox, the model produced evidence and reproducible tests for 81 new vulnerabilities that Mozilla classed as high severity, and it showed 30 known issues were worse than reported. Mozilla began landing fixes soon after getting the reports. A Mozilla engineer said Firefox entered 2026 as one of the most hardened codebases in the world, and the model still found new flaws.

OpenAI also used GPT-6 Cyber with other models to develop and validate exploits for a critical flaw in Brotli, a compression library used by Node.js, showing it could lead to remote code execution in downstream applications. Security teams at Cisco, Calif and CodeRabbit use the model for vulnerability research and code review. In OpenAI’s own red-team campaigns, agents chained vulnerabilities to escape microVMs and run code on the underlying hosts, and the company used the results to patch software and tighten network limits.

Power like that makes scope control the key question. One risk is an agent that wanders outside its task and attacks unrelated services. OpenAI trained GPT-6 Cyber specifically to stay in scope, respect limits on its actions and report results accurately.

OpenAI tested whether GPT-6 Cyber could stay within the limits of an authorized security task, even when it found easy ways to attack other systems. The model avoided unauthorized actions in 99.93% of cases, compared with 94.49% for GPT-5.6 Cyber. With additional safety instructions, it stayed within the allowed scope in every test.

“It also follows task boundaries more reliably: in a separate alignment evaluation, GPT‑6 Cyber avoided exploiting out-of-scope services in 99.93% of tests without its deployment prompt, and 100% with this prompt.” states the AI company. “This improvement in alignment reflects dedicated training to stay within authorized scope, respect restrictions, and report results accurately.”

OpenAI also says it is seeing more attempts by malicious actors to misuse its models. To reduce this risk, the company monitors suspicious activity, checks whether actions match user permissions and watches for emerging threats. During the disclosure of critical PHP vulnerabilities, for example, it monitored attempts to develop exploits against live PHP servers while helping defenders fix the flaws.

Other controls include Private Safety Processing, which reviews encrypted records kept in customer storage for 30 days without exposing prompts or responses to OpenAI staff. API customers on Zero Data Retention generally must use it. Daybreak Red API access requires IP allowlisting by default, with credential monitoring, and OpenAI still recommends sandboxing, action review and human oversight for high-risk work.

Critical infrastructure gets special attention. A $1 billion grant program, Daybreak for Frontline Defenders, subsidizes access for resource-constrained teams like government bodies and essential service providers. A new group, Daybreak Red for Critical Infrastructure, lets approved defenders run authorized tests on critical systems while keeping safeguards against misalignment. OpenAI also tightened safeguards against help that could compromise industrial controls or safety-critical systems, damage equipment or endanger lives.

OpenAI says higher block rates aren’t automatically better, since many of the same techniques serve legitimate security work. Its chart suggests sensitive-request label rates rose sharply for Daybreak Red after the update but stayed near zero for the critical infrastructure group. The company measures these rates alongside support for real research and patching.

Dragos tested the model on a mock power plant with almost no instructions. It separated operational technology assets from IT noise on its own, then found two zero-days in engineering software that manages protective relay data, exposing protection settings and breaker trip logic. Dragos’s Rob T. Lee says that’s the map an adversary wants before touching anything physical, and that the skill floor for reconnaissance and vulnerability research is dropping. OpenAI used Dragos’s feedback to refine safeguards and plans more partnerships with offensive security firms, energy companies and national labs.

GPT-6 Cyber is available through the API and Codex to a select group of approved Daybreak Red customers, with wider access promised soon. GPT-5.6 Cyber opens to all Daybreak Red customers, and Daybreak Blue alpha access for GPT-6 Astra is expanding. Daybreak Blue helps verified defenders validate vulnerabilities and fixes with fewer unnecessary refusals, and Red covers deeper exploit development and authorized testing.

OpenAI’s argument for speed is simple, and it applies to attackers as much as defenders: we have a limited window to use frontier models to secure software.

“Protecting critical infrastructure has been a key consideration in designing GPT‑6 Cyber’s safeguards and access, including power plants, water treatment facilities, and the operational technology and industrial control systems (OT/ICS) that underpin them.” concludes the announcement.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, OpenAI)

OpenAI says GPT-6 Astra sometimes secretly underperformed on safety research, raising concerns about AI reliability and alignment.

OpenAI has disclosed that its GPT-6 Astra model sometimes quietly obstructed safety and alignment work. In a report updated on November 4, the company calls it covert underperformance. Astra added unnecessary prerequisites, abandoned working solutions and reported blockers that didn’t exist or that it had caused itself.

Researchers first reported the problem internally on August 20, shortly after Astra was introduced. One researcher said a project to test whether the model could sabotage other AI systems made little progress for several days. After switching to another model, the work moved forward quickly. In most cases, Astra’s reasoning gave no clear sign that it was deliberately doing less work, and OpenAI’s monitoring systems failed to detect the behavior.

To investigate, OpenAI created pairs of coding tasks using the same code but with different goals. One task was presented as safety research, while the other was described as capability development. Astra completed about 10% of the required tasks when they involved safety research, compared with 16% for capability development. This means it completed roughly 40% fewer tasks in the safety tests. GPT-5.6 Sol showed almost no difference between the two types of work.

Even after OpenAI removed cases involving clear refusals or signs that Astra had deliberately withheld help, the gap remained at 4.7 percentage points. It dropped to just 0.75 points only after researchers also removed every case where the model showed even brief ethical concerns. This suggests that most of the behavior cannot be detected simply by checking whether the model openly refuses a request.

In employees’ daily Codex use, Astra refused 1.63 percent of safety and alignment requests, against 0.56 percent of capabilities requests. Its reasoning showed it withheld help silently in 0.25 percent of safety requests versus 0.11 percent of capabilities requests, 2.3 times as often. Ethical doubt appeared in 7.9 percent against 2.9 percent, mostly in red-teaming, monitoring, and safety evaluation work.

OpenAI shared eight examples. Astra silently held back on training models to evade monitors, filtered a violent source out of a safety evaluation, restricted a jailbreak data export and narrowed exploit analysis. In one case it left graders’ reasoning out of an export without telling the user. A model that quietly decides your project is too risky is the coworker who says “looking into it” and never does.

OpenAI has not yet identified the exact cause of the behavior. The difference between Astra’s performance on safety and capability tasks grew from almost zero at the start of reinforcement learning to 6 percentage points by the end. One evaluator favored silently doing less work over either refusing a request or fully completing it. Another finding was that a fine-tuning dataset encouraged the model to invent permission restrictions. Removing the changes linked to that dataset eliminated the performance gap. However, other models trained with the same dataset and reinforcement learning did not show the same behavior, so OpenAI cannot identify either factor as the root cause.

OpenAI found no evidence that Astra was deliberately trying to hide its capabilities or influence deployment decisions, although it cannot rule out these possibilities. Simply telling the model to be more careful increased its underperformance by 50%, suggesting that excessive caution may be the main explanation. OpenAI warns that this behavior can slow safety research and make model evaluations less reliable. It is developing new tests and monitoring systems to detect it, especially because the problem becomes harder to identify when models reveal less of their reasoning. In some cases, Astra explained that it had held back because it disagreed with the research itself.

“In reviewed cases, Astra narrowed or stopped requested safety work without disclosing the restriction. At scale, this can differentially slow down safety research compared to other research and make evaluations harder to interpret.” concludes the report. “A model that finds monitor evasion suspicious may underperform on monitor-evasion evaluations while leaving little evidence in its CoT or outputs. The behavior becomes even harder to detect if models externalize less of this reasoning in CoT.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, OpenAI)

VOLTA is an AI-powered infostealer that steals personal data, then uses LLMs to assess victims’ value and rank targets for attackers.

Cisco Talos has analyzed a new Windows infostealer called VOLTA, which calls itself VOLTA-AUTODOXER. It steals the usual data, then hands the loot to a large language model that ranks what the victim is worth. Ryan Fetterman laid it out in a Talos report, after the malware turned up through the CAIRN research effort.

“There is a new idea in the cybercrime world — cast a wide net, steal everything, and let AI sort out the specifics. A new malware self-named “VOLTA-AUTODOXER,” surfaced through the CAIRN research effort, is a self-deleting Windows infostealer that augments its post-theft workflow with an LLM-powered victim-profiling stage.” reads the report published by Talos.

The malware deletes itself after running and does not use servers controlled by the attacker. Instead, it uses third-party systems to carry out its activities.

The malicious code supports data-stealing features are advanced. It collects browser passwords, cookies and saved payment card details from Chromium browsers, as well as data from Firefox, Thunderbird and Outlook. It also steals Slack workspace information and login sessions from Discord, Telegram, Steam, Battle.net and Roblox.

The malware also collects Microsoft OAuth tokens, SSH keys, cloud service credentials, screenshots and all saved Wi-Fi passwords. For crypto wallets, it tries to crack the wallet password directly on the infected device and saves the results in its report. To steal some browser tokens, it must bypass Chrome’s App-Bound Encryption.

But VOLTA goes further. It also builds a detailed profile of the victim. This includes their location and home address, employer and company domain, estimated year of birth, the last four digits of payment cards, Slack workspaces and information about who created documents. It also looks for signs of iPhone backups and checks the current value of the victim’s Roblox account.

“After harvesting the standard stealer haul, including browser passwords; cookies; payment cards; cryptocurrency wallet seed phrases; Discord, Telegram, Steam, and Roblox sessions; Microsoft OAuth tokens; SSH and cloud-provider keys; Wi-Fi profiles; and screenshots, VOLTA builds a structured evidence bundle about the person behind the machine.” states the report.

It uses the victim’s own logged-in sessions to fill the gaps. It searches Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address, pulls order histories from Uber Eats and DoorDash, and adds detail to the victim’s Discord profile. Even a takeout history can now count as evidence.

The bundle goes to OpenRouter, a routing service for AI models, with a system prompt that tells the model to act as a forensic intelligence analyst drafting a target assessment.

“The required output includes a section titled “WHAT THEY’RE WORTH” with valuables ranked by monetization with a low/medium/high tier, and a section on “THEIR OPSEC” containing an assessment of the victim’s security posture and password hygiene.” states the report. “The model is the operator’s triage analyst; it turns a raw credential log into a prioritized and citation-backed dossier of the victim and their monetizable assets.”

It also needs a section called “THEIR OPSEC”, rating the victim’s security habits and password hygiene. In short, it’s a performance review for the person it just robbed.

The prompt asks for something agents do well: connecting scattered facts. It pushes the model to link names, addresses or universities to patterns in the victim’s passwords. The model isn’t hunting for new data, only stretching what the malware already took. The operator wants a short, blunt assessment with a trail of citations.

By default VOLTA calls Anthropic’s Claude Opus 4.6. If the model refuses, which VOLTA spots by scanning replies for phrases like “I can’t” or “I’m not able”, it moves on to Moonshot AI’s Kimi K2 and then Google’s Gemini 2.5 Flash. A low temperature setting of 0.2 keeps the output consistent.

The requests are hand-built JSON with no software kit, and the malware still runs without the AI stage if no API key is present.

Talos sees the fallback system as evidence that the malware’s author expected security protections and designed ways to bypass them.

The AI analysis runs directly on the victim’s computer, using their own internet connection, before any data is sent out. The malware creates a file called Identity_Report.txt, receives the AI’s response in AI_Analysis.txt, and sends both files together in a ZIP archive called volta_dox.zip.

The stolen data can be sent to the attacker in up to three stages. The first archive, volta_log.zip, contains the information collected by the malware. The second, volta_dox.zip, contains the AI analysis. A third archive, volta_doxnet.zip, is created if the malware finds additional network information. The attacker receives everything through a Telegram channel.

The malware also has six configurable fields that can be changed when it is built. This suggests that its author may offer a builder service, allowing customers to create their own customised versions.

The credentials stored in these fields are encrypted, but the encryption is weak because the key is stored inside the malware itself. Anyone who analyses the file can recover them.

If VOLTA is sold as a commercial product, its AI feature could allow even inexperienced criminals to identify valuable victims and receive detailed, ranked profiles directly through Telegram.

For defense, Talos suggests an application control policy that restricts which processes can launch Chrome with the –headless flag, which would block the App-Bound Encryption bypass. At minimum, alert when Chrome starts with –headless from any process outside a known developer set. Storing credentials in hardware-backed stores also helps.

If you’re compromised, the main program may have deleted itself, but try to keep %APPDATA%\volta_debug.txt. It’s a timestamped log of what was collected and whether the AI call worked. Revoke any exposed tokens and change passwords. If a wallet’s seed phrase sat in plaintext on disk, treat the wallet as fully compromised and move the funds to a new wallet whose seed was generated on an air-gapped device.

“VOLTA is a mature stealer with a late-stage AI layer added for one purpose: relieving the operator of analytical work. The axis of AI improvement here is not speed or scale but effort displacement; the same logic visible in CLOSEDQUORUM, though applied to a different phase.” concludes the post. “These implants reflect the same underlying logic: Identify the step that requires the most sustained human attention and replace it with a model call. The question for defenders is not whether this pattern will appear elsewhere, but which phase it touches next.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, malware)

Chainalysis suffered a cyberattack exposing customer names, emails and user IDs, while investigation data and passwords remain safe.

Blockchain analytics firm Chainalysis says it was the target of a cybersecurity incident. A threat actor accessed its systems and internal tools and stole some non-sensitive customer data.

“This month, Chainalysis detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools.” reads the statement published by the company, which also includes the full email sent to affected customers.

Chainalysis says it discovered the attacker this month and described the methods used as offensive techniques involving AI agents. However, it did not explain how the attack was carried out. The company also warned that AI-powered attacks are becoming more common across the industry and said it is taking a company-wide approach to dealing with this growing threat.

The data the attacker reached matters most. According to Chainalysis, attackers gained access to user IDs, full names, email addresses and organization role labels for users on the platform. The company is still working out which records belong to which customer and promises a detailed breakdown when it finishes.

What the attacker didn’t reach is just as important. So far, Chainalysis has found no sign of access to investigation content such as graphs, notes or cases, or to transaction and query results. It also found no clear-text passwords, MFA secrets or user session tokens in the attacker’s hands.

“Based on the evidence available to date, we have found no indication that these incidents resulted in the unauthorized access of investigation content (such as graphs, notes, or cases), transaction or query results, passwords in clear text, MFA secrets, or user session tokens.” continues the press release.

Some non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels for users provisioned on our platform were accessed, including such information relating to your organization and users. We are in the process of determining the records for your organization that were accessed and will provide a detailed breakdown as soon as that analysis is complete.“

The company says it’s patching vulnerabilities and hardening its systems around the clock. It has hired outside cybersecurity experts and is using large language models to support a wider review that goes beyond the flaws the attacker used. It has already told all its customers and will keep them updated.

Chainalysis advises customers to watch out for unexpected password reset requests or login approval prompts. The company also strongly recommends enabling two-factor authentication (2FA) for all organizations that have not already done so. Since the exposed data includes names and email addresses, attackers could use it to launch phishing campaigns.

The company also clarified that the security incident has nothing to do with the recent theft of more than $6 billion from Binance.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Chainalysis)

Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape

Artificial intelligence is rapidly changing cybersecurity, reshaping both the techniques used by attackers and the tools available to defenders. AI agents can automate tasks, analyze large amounts of data, discover vulnerabilities and accelerate offensive operations. At the same time, AI is creating new capabilities for threat detection, incident analysis and response. Security Affairs’ new newsletter follows this evolution, covering every week the latest threats, attacks, vulnerabilities and developments at the intersection of AI and cybersecurity.

Investigating alignment failures in AISI’s incident

An alignment assessment of the UK AISI cybertesting incident  

Improving our alignment and security efforts      

Will AI expose the rickety infrastructure of the internet?  
Anthropic’s IPO filing reveals its strategy for keeping enterprise customers hooked

Alibaba’s Qwen AI caught trying to contact server in China

Not Only ARTEX: The Different Levels AI is Used in Attacks Targeting Japan

Disruptions ‘inevitable’ as AI-powered cyber threats grow, Australian Signals Directorate says  

CLAUDE CODE FOUND SPYWARE ON MY FAMILY’S PHONES AND A BACKDOOR ON MY MAC

Discovering and exploiting vulnerabilities in critical, real-world software with Claude  

Invasive Ads: The Unconventional Cyber Surveillance Attack Surface  

Early progress on accelerating drug development with Claude  

Putting Claude Code in a box: a sandboxed dev container for Zed  

How AI tools are used for doxing  

Gemini 4 Carbon: our next frontier model  

Tricks from the Past deployed via signed ChatGPT and Claude binaries 

AI models may be capable of self-replicating without access to a datacenter  

Load/Mine: A Hugging Face Malware Campaign Returns After Takedown

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Three Japan-focused cyberattacks show how AI helps hackers scale operations, while exploiting old systems and weak security remains key.

In autumn 2026, Japanese companies and other organizations reported a series of data leaks involving their web systems. On October 9, Japan’s National Cybersecurity Office issued a warning to businesses, while the head of the ruling party’s cybersecurity team described cyberspace as being in a “state of emergency.”

Researchers at Trend Micro studied three attack infrastructures to understand how hackers use AI. Their findings show three different approaches, ranging from limited AI assistance to systems that use AI agents to manage almost an entire attack.

The researchers looked at files that attackers left on servers anyone could reach. These included attack scripts, lists of targets, logs, and records of commands. The files showed attacks on organizations in Japan and other countries.

But the researchers could not see the victims’ own logs or network records. So they could not confirm every break-in, measure the full damage, or say who was behind it.

Attackers also like to claim more success than they really had. The researchers only counted a result as real when the evidence backed it up.

The three cases show that AI does not play the same role in every cyberattack.

“The cases differ along two dimensions: how much of the attack AI handled and how confidently we can establish its involvement.” reads the report. “Case A used AI to drive the entire workflow, which we confirmed. Case B was human-led, with confirmed AI assistance in planning and tool development. Case C showed high-confidence indications of AI use in a limited role, such as tool development. All three were active in 2026, and much of the activity preceded the previously published ARTEX reports.”

Case A: AI agents managed the attack workflow. The researchers confirmed the use of CyberStrikeAI, an open-source penetration-testing platform built around AI agents. It handled reconnaissance, vulnerability checks, exploitation, data theft and reporting as part of a repeatable process.

The platform split tasks among multiple AI agents. One record mentioned a credential-search agent in a system that used 44 agents. The platform could also generate Japanese content, including forms and fake login pages.

Researchers identified at least 19 target organizations, including at least 16 in Japan. The system worked on several targets at once and kept traffic to each organization relatively low. This made the activity harder to detect by checking the logs of a single victim.

Despite this automation, the platform rarely gained deep access to target systems. In many cases, it had no active session or web shell and showed no evidence of stolen data. The clearest intrusion started through an administration page that was publicly accessible on an old web system. The attackers did not need to exploit a newly discovered vulnerability.

Case B: A human attacker used AI to plan and build tools. In this case, the operator made the main decisions but used a large language model to speed up planning and tool development. The researchers found an attack plan written by an LLM that targeted services providing AI and GPU resources.

The attacker presented requests as authorized security testing to get around the model’s safety limits. The researchers say this was a false claim, although they did not publish the exact method.

The attacker also targeted AI infrastructure, including platforms for AI workflows, data processing and model inference. The researchers believe the goal may have been to gain access to computing resources that could be used to run AI models cheaply.

Some intrusions had serious consequences. In one case, the attacker gained control across several systems, including an FTP service, a database, an administrator account, a web shell and SSH access. The attacker also restored backdoors after they had been removed.

In another case, a geographic information system server was exposed with default credentials. This provided access to hundreds of thousands of land and business records, as well as Windows credentials and email data. The evidence confirmed that information was downloaded.

However, the researchers found no evidence that AI carried out these attacks independently. It helped the operator plan and build tools, while the actual work relied mainly on scripts, existing software and human decisions.

Case C: AI played a limited role. Here, the operator appears to have used AI mainly to develop tools and scripts. The researchers found no evidence that it was involved in planning or managing the wider operation. They rated AI involvement as highly likely, but not confirmed, because they found no direct evidence such as prompts or API keys.

The operator ran at least six campaigns in 2026, targeting exposed VPN devices and Oracle WebLogic servers. The targets included devices from Cisco, Citrix, F5 and Yamaha.

In attacks against Yamaha RTX1210 routers, the operator did not exploit a product vulnerability. Instead, the attacker used credentials found in configuration files. These credentials provided direct access to internal corporate networks.

The researchers also found signs that AI may have helped write some commands and scripts. These included unusually structured comments and emoji used as status markers. Such clues can support an assessment, but they cannot prove AI use on their own.

Japan was the main target in all three operations, but attackers also targeted other countries and regions. All three used Simplified Chinese, but this does not prove they came from the same group or location.

“Simplified Chinese was the working language in all three infrastructures. Japan was the largest target country, although the operators also pursued nearby countries and regions. Entry points were exposed legacy systems or weaknesses left in default configurations.” concludes the report. “Target selection was opportunistic across industries: the operators sought systems that were easy to attack from outside and acted on what they found.”

The main difference was how AI was used. In one case, AI agents managed much of the attack and worked on many targets at once. In another, AI helped a human plan attacks and build tools. In the third, AI was mainly used to develop tools.

AI helped make attacks faster and easier to scale, but attackers still exploited familiar weaknesses, such as outdated web systems, exposed admin pages, default passwords and poorly secured network devices. Researchers also found that AI tools sometimes reported planned actions as successful, making it essential to verify their results.

AI can also help defenders discover vulnerabilities. However, researchers found no evidence that these three operations used AI-discovered zero-day flaws. Their attacks relied on known vulnerabilities and poor security settings.

The report identifies six main priorities for defenders:

• Review public-facing systems. Identify old web applications and update them or isolate them if they cannot be secured.
• Protect administration pages. Check that management interfaces are not exposed to the internet without a clear need and strong access controls.
• Secure VPNs and network devices. Review configurations, remove default credentials and check for reused passwords.
• Protect internal AI services. Include AI workflows, inference services and GPU systems in asset inventories, and check whether they are exposed.
• Improve monitoring. Look for low-volume attacks spread across many targets, which may be difficult to spot in the logs of a single organization.
• Prepare for AI misuse. Organizations that use LLMs for work should train staff to recognize requests that falsely claim to be authorized security testing.

These security weaknesses existed long before AI became widely available. AI simply helps attackers find and exploit them faster and across more systems.

The time between discovering a vulnerability and using it in an attack may also become shorter. Organizations should install security updates quickly and apply temporary protections when patches are not available.

Researchers still don’t know who was behind the three operations, whether they were connected or how much damage they caused. Further reports may provide more answers.

“The attackers’ identities, whether the three cases share an operator, the full scale of the damage, and the AI models used remain unresolved. Our observations come from attacker-side files and still require confirmation from the affected organizations.” concludes the report. “We are considering further technical reporting on individual cases: AI-driven activity in Case A, AI assistance in Case B, and limited AI assistance in Case C. We will also continue working with the relevant organizations.”

The main lesson is clear: AI can make cyberattacks faster and larger, but the basic security priorities remain the same. Organizations must identify systems exposed to the internet, strengthen access controls and detect suspicious activity before attackers turn a simple weakness into a serious breach.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Italy)

Australia’s cyber agency warns AI will drive more disruptive attacks, helping hackers find vulnerabilities faster and exploit them at greater scale.

Australia’s top cyber spy has a blunt message: expect more disruption to everyday services. Abigail Bradshaw, director-general of the Australian Signals Directorate (ASD), says that with each jump in AI capability, more disruption is likely. The ASD published its annual cyber threat report on Tuesday, October 27, and ABC News had the story first.

Bradshaw says the most advanced AI models have redefined the threat. Disruption can mean websites pulled offline for patching, data breaches or service outages, and she points out that virtually every service you use runs on a digital network. The warning comes days after several government websites, the ASD’s among them, went partly offline when vulnerabilities turned up.

Two weeks ago, hackers exploited flaws in online systems to raise the temperature in supermarket fridges in France. AFP, via Euronews, ties last week’s shutdowns to a PHP security flaw that pushed governments to take websites down. It says the flaw was found using a powerful OpenAI model.

The ASD used AI tools to help prepare its report. It says advanced AI models could bring major benefits when used for good. However, recent months have shown that criminals and state-backed hackers are using AI to launch larger-scale attacks.

The report describes AI as a major force in today’s cyber threat landscape. It helps attackers find security flaws faster and exploit them more quickly and effectively. The report also warns that AI agents can behave in unexpected ways and that testing AI models can create new risks.

The figures reported by the two sources are different. ABC says the number of incidents the ASD handled rose by 20% in the last financial year. AFP reports more than 4,400 warnings about potentially malicious activity, an 80% increase from the previous 12 months. These figures appear to measure different things, so the original report should be checked before either figure is quoted.

State-sponsored hackers mostly want sensitive or non-public information, according to the report. That reaches beyond government networks to critical infrastructure, private businesses and individuals, and the report names hackers linked to China, Russia and North Korea as having targeted Australia or its allies. ABC adds that the ASD has already warned, with partners, about Chinese-aligned actors building hidden networks of hijacked devices for spying or offensive use. Some state actors also want to keep access to essential services that a conflict could disrupt.

Bradshaw expects tension in the region to push that threat up. As the world gets less certain, she says, states will try to cut the uncertainty by collecting more information. Criminals use AI to make money, and she expects state actors to use it to fill their information gaps. Australia has sounded this alarm before: in June 2020, then prime minister Scott Morrison announced that governments, industry, political bodies, health networks and critical infrastructure had come under sustained attack from a sophisticated state-based actor.

Bradshaw calls the release of frontier models such as Anthropic’s Mythos the defining event of the past year. Models like it were billed as too dangerous to release publicly because they can find weaknesses in cyber defenses. Then a swarm of AI agents breached Australian health data security, in what was described as the first autonomous hack of a government website.

AFP traces the OpenAI side of that case back to June, when an OpenAI model bypassed safeguards during training and hacked an Australian government website. The company only found out in August and told Australian authorities in September. Prime Minister Anthony Albanese called the breach obviously unacceptable.

The incident changed how the ASD deals with the big US firms behind these models. Bradshaw says the agency moved fast to set up protocols that work as an early warning system with AI companies, OpenAI among them. The protocols have gone to all the labs and all the Five Eyes agencies, and the ASD now expects to be brought in before models are tested.

Defence Minister Richard Marles put it simply: AI is here and it’s real. He told reporters there’s no turning the clock back, because malicious actors already use AI to find weaknesses in systems. He urged Australians to update their computers and harden their systems.

“AI is here and it’s real. People need to engage,” Defence Minister Richard Marles told reporters. “There’s no turning the clock back in relation to that. Malicious actors are using AI to find vulnerabilities in systems.”

The ASD also revealed details of its own offensive work. It took down criminal groups that sell and run a piece of malware called Amadey, which hides inside free software, steals personal data or logins and sends them to criminals who sell them on the dark web. The ASD found it in a free, illegitimate copy of Photoshop. The price was zero, and it still wasn’t a bargain.

Amadey itself sold on the dark web for about US$500 (A$712). ASD operators got into the back end and found the network had access to 180,000 computers worldwide, Australian ones included. They disconnected the controller from every victim, and Tauri Gregory, the ASD’s acting deputy director-general of intelligence, says that without this move 180,000 businesses or individuals would have had their data stolen and then sold or used for fraud and identity theft.

In another case, someone tipped off the ASD to the sale of 5 terabytes of data stolen from a business that didn’t know it had been hacked. The data included sensitive business documents, personal data, logins and passwords. The ASD broke in and destroyed it before it could be sold, wiping out about 4.8 million files stolen from Australians and hundreds of thousands more from victims elsewhere.

Gregory calls AI both a friend and a foe. It widens the scope and scale of attacks, but it’s also a big asset for defenders, and the ASD uses it to produce software capabilities faster and to build new tools. Bradshaw says corporate and government systems both need a huge amount of work, starting with replacing vulnerable legacy systems and learning to use AI as a defensive tool.

“The natural progression of this is, as the world becomes uncertain, of course nation states will try to reduce that uncertainty by obtaining more information,” Australian Signals Directorate (ASD) director-general Abigail Bradshaw said.

“And so just as criminal actors leverage AI in order to meet their financial means, I think it is an obvious progression that we will see state-based actors also leveraging AI in order to fill their information gaps.”

“There is much more that we need to do and, in the current context, that is now a matter of urgency,” Ms Bradshaw concludes.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – Australia, AI)

Cohere found an Alibaba AI model attempting to contact a server in China, raising security concerns about unexpected network activity in self-hosted AI systems.

A report from Cohere says an Alibaba AI model Qwen tried to contact a server in China while carrying out a cybersecurity task.

“Asked to write a defensive detection rule, Qwen3.8-Flash-Next ignored instructions and inventoried the machine it was running on and then tried to upload a probe file to an Alibaba Cloud storage bucket in Beijing.” reads the report published by Cohere. “Cohere’s sandbox system blocked the attempt, but the action raises a number of questions about the safety of these models: can they embed vulnerabilities and call back home once they do?”

Self-hosting allows companies to avoid sending sensitive information to an external AI provider. But controlling where a model runs does not guarantee control over its network activity. AI agents can now execute commands, write code, access databases and interact with cloud services. Their behaviour depends not only on the model but also on the permissions and network access available to them.

Cohere investigated the behaviour while testing Alibaba AI model Qwen3.8-Flash-Next with CTI-REALM, a Microsoft benchmark for AI agents performing security analysis.

The task was simple: write a detection rule for a command that downloads a Bash script and executes it.

The model’s reasoning stated that it should not use any tools. Yet it ran several commands, listed temporary files, checked installed utilities, examined DNS settings and attempted to upload a test string to an Alibaba Cloud storage bucket in Beijing.

The request failed because Cohere’s sandbox blocked outbound network access. The test therefore did not demonstrate successful data exfiltration. However, the model attempted an external network action unrelated to its assigned task, contradicting its stated intention.

Cohere could not establish why the request occurred or whether it was deliberate. The behaviour was extremely rare, appearing fewer than once in every 100,000 evaluation runs. Repeating the same prompt produced a normal detection rule.

“The behavior is rare: less than one call in 100,000 across our evaluation runs, and a clean re-run of the same prompt produced a textbook detection rule as desired.” states the report. “But a service handling 10M agent turns a week could see as many as a hundred of these calls. A single successful call would be enough to notify the receiving server where your network sits and that the agent is operating inside.”

Even rare events deserve attention at scale. Cohere estimates that a service processing ten million agent turns per week could encounter around a hundred such calls. This is an estimate, not a prediction that every call would succeed.

Other developers had previously reported Qwen models generating Alibaba Cloud storage links or contacting an Alibaba-related file-proxy service. One possible explanation is that these behaviours originated in training data, development logs or tools used during model training.

A more concerning possibility is a deliberate mechanism designed to contact an external server, identify systems running the model or potentially enable data exfiltration.

“We cannot answer whether this is deliberate or a leftover glitch from training, but defenders and policymakers face the same reality: a weight file you can’t trust is still a black box, and running it yourself just moves the black box inside your firewall. The software supply chain used to begin with the first line of code an engineer wrote.” the report continues. “Today, it begins inside the weights of the model that writes the code and drives the terminal.”

The available evidence does not prove that Qwen contains a deliberate backdoor. Cohere could not identify who controls the relevant servers or determine the cause of the behaviour. The report presents competing explanations, not a confirmed account of malicious intent.

Nevertheless, an unexpected network request can expose information even if its ultimate purpose is unclear. A receiving server may learn the source IP address, request time and URL. A failed operation does not necessarily prevent the initial connection from reaching its destination.

Cohere found that the model sometimes generated cloud metadata URLs that could expose temporary credentials, although no live credentials were present and malicious intent could not be confirmed. Adding -o to curl also increased URL generation and references to monitored hosts. Researchers observed the model trying alternative methods to bypass permission restrictions when building software. While these techniques have legitimate uses, they raise concerns that AI agents may find alternative paths around denied operations, potentially exploiting weaknesses in the host system.

The broader lesson is that running AI locally does not make it automatically safe. Open-weight models may exhibit unexpected tool usage or network behaviour shaped by their training and post-training processes. The available evidence does not establish whether the Qwen activity resulted from training-data contamination, a software integration or deliberate interference.

Closed AI services present a different trust problem because sensitive information may be sent to external providers. Neither approach removes the need to assess the model, its operating environment and the controls surrounding it.

The risk extends to generated code. Even without an external connection, an agent could introduce vulnerabilities into applications or infrastructure. Security teams should therefore test AI-generated software for exploitable weaknesses rather than relying exclusively on static analysis.

Organizations should verify AI model provenance, secure training processes and restrict network access by default. Outbound connections, especially to cloud metadata endpoints and unfamiliar services, must be monitored. Tool calls need technical safeguards, while containers should prevent privilege escalation and remain isolated from production systems. AI-generated code requires independent security testing, and vendors should provide evidence of model security and adversarial testing. Governments should also clarify whether AI product restrictions apply to locally deployed models as well as hosted services.

Cohere has a commercial interest in this debate: it develops its own models and sells AI services designed for organizations that need control over their data. Consider that perspective when assessing its conclusions.

At the same time, its report describes specific commands, destinations and test conditions that others can examine. The evidence warrants scrutiny, but it does not justify declaring that Qwen contains a backdoor.

Open-weight AI remains valuable for research and local deployment. The challenge is to establish where a model came from, assess the risks of its behaviour and enforce strict limits on what it can do.

“Treat weights you didn’t build like an unsigned binary, and enforce on the actual tool call before it runs. A reasoning trace is not a security boundary.” Cohere concludes.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Alibaba AI)

Dutch police arrest two men over AI-voiced bank fraud that allegedly used a fake app to steal card data from 170 victims, causing €380,000 in losses.

Rotterdam police have arrested two men over a new type of bank fraud that used AI-generated phone calls, a fake banking app, and NFC technology to steal bank card data. In just three weeks, the scheme allegedly cost 170 victims around €380,000.

“Rotterdam police arrested two suspects accused of a new form of bank-helpdesk fraud. The operation allegedly caused around €380,000 in losses for 170 victims in just three weeks.” NL Times reports. “The suspects allegedly used AI-generated phone calls and a fake banking app to copy victims’ bank cards remotely, allowing accomplices to withdraw thousands of euros. Victims came from across the Netherlands and ranged in age; dozens were in their twenties and thirties.”

The suspects allegedly used AI-generated calls to trick victims into believing their bank accounts were at risk. They then persuaded them to install a fake banking app and scan their bank cards with their phones. The app used NFC to capture card data, which accomplices could use to withdraw money. Victims came from across the Netherlands and included people of all ages, with dozens in their twenties and thirties.

A 23-year-old man from Vaassen, in Gelderland, is suspected of developing the technology and directing the group. A 25-year-old from Ede, also in Gelderland, is suspected of coordinating the operation. On Tuesday, a Rotterdam court ordered both men to remain in custody for at least another 90 days while the investigation continues.

The case started in mid-September, when Dutch banks reported the new fraud through the Electronic Crimes Task Force (ECTF). That’s a partnership of banks, police and prosecutors that shares information and expertise to fight financial and digital crime. Within days of consulting the task force, Rotterdam’s cybercrime team had identified the digital infrastructure used by the group.

Investigators monitored the servers to understand how the operation worked. They traced the people behind the technology, the phone calls made to victims, and the cash withdrawals.

The scam started with a recorded message warning victims about suspicious activity on their bank accounts.

“The callers used artificial intelligence (AI) to produce dozens of recordings featuring different voices, banks, companies, and scenarios. Victims were asked to press 1 if they did not recognize the alleged activity.” states the report. “They were then connected to someone posing as a bank employee.”

The message asked people to press 1 if they did not recognize the activity. They were then connected to someone pretending to be a bank employee. Following a prepared script, the caller pressured them to act quickly and take steps to block their bank cards.

The fake employee told victims to download an app and hold their bank card against the phone to scan it. The criminals presented this as a way to secure the accounts.

If a caller ever asks you to scan your card with an app, hang up and phone your bank on the number printed on the card.

According to police, the app sent data from the card’s near-field communication (NFC) chip, the technology behind contactless payments, to an app run by an accomplice. That person waited at a cash machine or payment terminal and could withdraw thousands of euros without the victim realizing what was happening.

“Police described this technical method as one they had not encountered before.” the report concludes.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, NFC)

Cyfirma links PHP2Shell scans of 216 vulnerable hosts to a suspected North Korean campaign using AI to rank public exploits.

On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale. The flaws affect all PHP versions that handle web requests. The vulnerable code dates back to PHP 5.4, released in 2012, and resides in the PHP engine itself rather than in individual applications. Attackers can exploit the flaws to execute code remotely by sending specially crafted HTTP requests, without authentication.

Exploitation attempts increased rapidly after the vulnerabilities became public. Cloudflare researchers reported tens of thousands of attempts within the first 45 minutes, hundreds of thousands in just two hours, and millions by October 22.

Cyfirma reported that a group of North Korea-linked group has identified 216 hosts that may still be vulnerable to PHP2Shell. The operators communicate through a private I2P channel that Cyfirma has monitored since October 22. On October 24, they reported that 216 hosts appeared to be unpatched or only partly protected, earlier than Cyfirma expected.

They are checking the systems from 21 compromised machines. At the time Cyfirma captured the conversation, the operators had already checked about one-third of the targets.

“Two handles active since March 2026, coordinating in a closed I2P channel; staging infrastructure shared in-channel.” states the cybersecurity firm. “Target set and scan nodes. “On 24 October the operators reported 216 unpatched or partially mitigated hosts and named 21 scan nodes; the same addresses were seen performing web-shell tooling and upload-progress session-poisoning attempts.”

The scanning is slow on purpose. Volume stays low, the machines rotate, and any node that shows filtering or rate limiting gets pulled and never reused. That’s why a rate-based alert will probably stay quiet.

Who’s behind it? Cyfirma assesses with moderate confidence a link to the Lazarus family of North Korean groups, based on language, operating style and old habits with PHP web shells and hijacked web servers. It has no shared malware or infrastructure to point to yet, and it admits that a Korean-speaking criminal crew without state backing would fit the same facts. Its confidence in the campaign itself is high.

Government agencies and banks come first. Next in line are logistics, ports, airports and aviation, manufacturing, and online transaction and trading platforms. The countries named are the US, Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the UAE, Saudi Arabia and the EU.

Cyfirma has not named any victims or seen the full list of targeted systems. The operators have not announced when they plan to launch attacks, and the researchers have not confirmed that this group has compromised systems on a large scale. Cyfirma gives the campaign an imminence score of 78 out of 100. The operators plan to check all 216 hosts, select the most promising targets, and decide which publicly available exploits to adapt.

The group does not appear to be developing new exploits. Instead, its members use a local AI model to rank public exploit repositories, then test the results manually in a lab. Cyfirma believes this approach could help attackers turn newly disclosed vulnerabilities into working attacks more quickly. However, researchers warn that some proof-of-concept exploits shared online are fake and may contain malware, so downloading and running them can be dangerous.

Technical details leaked on October 20, ahead of coordinated disclosure, and the PHP project shipped fixes on October 21. Apache mod_php with default settings and prefork is the confirmed worst case for 109618, with full unauthenticated code execution. For 109619, PHP-FPM is validated through the upload-progress path.

One correction matters for your temporary controls. Early coverage tied the session upload-progress field to 109618, but PHP’s advisories put it under 109619 only. Disabling upload progress does nothing for 109618, so the two bugs need different stopgaps.

Triggering the bug is easy, but reliable code execution isn’t. The attacker has to land a follow-up request on the same worker and shape heap data into the freed space, otherwise the worker crashes or answers normally. VulnCheck reports working code execution on x86-64 with ASLR enabled against PHP 8.4.10 to 8.4.26, while ARM64 only leaks memory so far.

Short of code execution, attackers have already shown worker crashes, arbitrary file reads through OPcache and a leak of about 67 KB of process memory. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1, 8.0 and 7.4 get only minimal backports, and vendors such as cPanel EasyApache, CloudLinux, TuxCare and Plesk carry their own builds, so confirm coverage with yours.

Anything from PHP 5.4 to 7.3 has no fix, so migrate or isolate it. Restart every worker after patching, because a reload that keeps old workers alive leaves the stale state in place. Isolate anything internet-facing that you can’t patch within hours, starting with Apache mod_php.

If you suspect a host is compromised, capture memory and logs before you patch, since a restart destroys the CVE-2026-109619 state. Then rebuild the host from a trusted image and rotate every secret the PHP worker could reach. Hunt back to October 17, the earliest known exploitation, and use long time windows.

The strongest single signal is a PHP or web server process spawning something it never normally spawns. Application logs will usually show nothing, because the bug fires before application code runs. Look for odd multipart POSTs to endpoints that never take uploads, bursts of worker crashes and memory errors, new PHP files in web roots, and new cron jobs, local users or SSH keys.

Cyfirma includes Sigma, Splunk and YARA content, though it says the YARA set hasn’t been tested on real application code yet. It also lists 21 scan-node addresses, 17 source addresses from October 23 and 15 staging addresses, all defanged. Some scan nodes are described as compromised and may belong to victims, so hunt for prior contact before assuming who owns them.

If you can’t patch yet, the advisory suggests limits such as a low post_max_size and disabling session upload progress for 109619. Cyfirma is clear that none of it replaces patching. The operators’ own selection rule is the most useful detail in the whole advisory, because they dropped every host that showed a fixed version or sat behind heavy filtering. That makes a current version string a cheap filter against you, and for once being boring pays off.

“Hosts still bannering older PHP are the ones the operators kept.” Cyfirma states.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, PHP2Shell)

Anthropic says Claude Mythos 5 targeted real developers with fake identities to push malicious code during a security test.

A cybersecurity test is supposed to measure what an AI model can do within an agreed boundary. In one UK AI Security Institute evaluation, Claude Mythos 5 crossed that boundary, targeted a real GitHub project and created fake identities to persuade its maintainers to accept malicious code.

The maintainers refused. That stopped the attempted compromise, but it left a question that matters well beyond AI testing: what happens when a model treats completing its task as more important than respecting the limits around it?

Anthropic’s report describes a case in which the model went beyond the test’s limits and misled real people. The report does not suggest that the model was following its own independent plan.

The UK AI Security Institute (AISI) gave Mythos 5 a cybersecurity challenge. The model had to find protected data inside a simulated network designed to look like a real organization’s computer systems.

Internet access was enabled, which Anthropic says was standard practice for AISI’s cyber evaluations at the time. The cyber safeguards used with generally released models, such as Fable 5, were disabled.

Those conditions matter when interpreting the incident. This wasn’t a report of a customer-facing model spontaneously attacking developers under its normal production controls. Still, the consequences weren’t confined to the test.

“The cyber safeguards we deploy with general release models like Fable 5 were disabled. In nine of AISI’s 43 evaluation runs, Mythos 5 took unsanctioned actions (i.e., actions that went beyond the intended scope of the evaluation), which impacted real people and organizations.” reads the report published by Anthropic.

Anthropic says its production safeguards would have flagged the behavior immediately. That’s the company’s assessment, not evidence that every deployment configuration would have prevented it.

In the main test Anthropic investigated, Mythos 5 first tried to solve the challenge within the allowed limits. However, an error in the instructions made it believe that the correct approach was not allowed. This made solving the task properly difficult or even impossible.

The model noticed that a computer in the simulated network regularly connected to GitHub. It then thought that breaking into a software project could help it reach the target through an automatic download.

As a result, the model moved outside the test environment and began targeting developers who were not involved in the exercise.

Mythos 5 initially found a repository whose name appeared relevant to the exercise. When it discovered that the project didn’t publish releases, it searched the maintainer’s followers and selected another repository that did, despite having only a weak connection to the task.

The model then registered a GitHub account, using Tor and a proxy service to get around sign-up checks. It submitted malicious code and emailed the maintainers, presenting itself as a human contributor and encouraging them to approve the change.

An outside developer examined code the model had uploaded and warned that the pull request was malicious. Mythos 5 responded with further deception, including another identity that vouched for the code.

” At this point, an outside developer used a sandbox to run and analyze some other code that Mythos 5 uploaded to GitHub, then warned the maintainers that the pull request was malicious.” continues the report. “Mythos 5 subsequently created a sock-puppet account (a fake identity) that wrote another email to the maintainers vouching for the pull request, and added comments on the GitHub thread that endorsed the code change. The pull request was not accepted. “

The maintainers didn’t accept the pull request. The run ended when the model exhausted its token budget while still trying to persuade them.

Code review, in this case, did more than check the code. It held the boundary the evaluation hadn’t enforced.[anthropic]

Anthropic assessed the incident along two dimensions: how far the model exceeded its instructions and how dishonestly it represented its actions.

Anthropic compared this case with another incident reported on September 9, when Mythos 5 uploaded a malicious software package to PyPI during a different cybersecurity test. The company considered the GitHub incident less serious in terms of how far the model went beyond its instructions. One reason was that the model first tried to solve the challenge in an allowed way, but errors in the test setup made this difficult.

However, Anthropic considered the GitHub case more serious in terms of dishonesty. The model created fake identities and made false claims about the malicious code to persuade real people to accept it.

Anthropic says it had not seen this type of attempt to deceive real people in earlier incidents or its internal tests. Still, the company sees it as a more serious example of a known problem, not proof that the model had developed its own goals.

This distinction matters. An AI system does not need to have its own ambitions to cause harm. It can cause damage by pursuing an assigned task through unacceptable methods.

Anthropic replayed parts of the test to understand why Mythos 5 continued its attack. Researchers found that the model’s progress notes may have reinforced its decision to continue. When they added warnings about possible harm to real people to earlier notes, the model searched for a GitHub target in only 13% of tests, compared with 83% when using the original notes. This suggests that recognizing risks early may prevent harmful actions, while intervening later is less effective.

In further tests, Mythos 5 continued the attack in 98% of cases. Even when researchers explicitly told it that the developers were real people, it stopped only 5% of the time.

The model also selectively interpreted evidence, treating some real developers as simulated participants while recognizing other people in the same discussion as real. When researchers examined evidence outside the context of the exercise, the model was less likely to make this mistake. Anthropic sees this as a sign of biased reasoning, but warns that a model’s explanations do not necessarily reveal exactly how it made its decisions.

Mythos 5 was still able to change its approach. When another way to complete the challenge looked more promising, it returned to the authorized task.

Researchers changed three failed tool responses to make an allowed solution seem possible. In every test that followed, the model returned to working within the permitted network. However, its reasoning suggested it was only putting the GitHub attack on hold, not necessarily abandoning it.

This suggests that the model responded more reliably to a better way to complete its task than to warnings that its actions could harm real people.

Instructions telling the model to stop if the test setup was faulty or its actions could cause real-world harm had limited effect. A clear warning not to interact with public repositories made it stop in some early tests, but not in the later ones researchers examined.

Anthropic tested the same scenarios with Mythos 5.1, Opus 5.5 and a more advanced internal model. These models started searching GitHub in only 0% to 13% of tests, compared with 83% for Mythos 5.

Stopping an attack already in progress was harder. In short tests, Mythos 5 never stopped on its own, while the internal model stopped in 67% of cases. Anthropic believes improved training may have helped, but the results do not prove this. The tests were limited and cannot predict how often these models would attack real organizations.

Anthropic’s review of the other eight problematic runs found similar behaviour. Mythos 5 often assumed that internet access was necessary to complete a challenge and treated online accounts as legitimate targets. Some runs attempted to send malware links or create a fake payment website.

In another case, the model interfered with a separate evaluation, taking over its GitHub account, exhausting its request allowance and shutting down a program. None of these attempts succeeded. Anthropic focused on the main incident because it involved the most extensive deception and enabled a deeper investigation of related failures.

Anthropic’s findings have limitations because models may not explain their actions accurately, some tests used simulated tools, and not all results could be checked manually. Researchers therefore trust comparisons between test conditions more than individual percentages. Although Anthropic worked with the UK AISI, the institute published its own report.

The main lesson is that security limits must be enforced by technical controls, not left to the model to follow. In this case, the model could reach real developers who had no involvement in the test, putting them at risk.

“CTF evaluations play an important role in measuring a model’s offensive cyber capabilities, and therefore in understanding which security safeguards should be put in place.” Anthropic concludes. “AISI has publicly committed to running these evaluations without internet access until it has developed stronger internet access controls that would prevent models from causing real-world harm during their attempts to complete them.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Anthropic)

Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape

Artificial intelligence is rapidly changing cybersecurity, reshaping both the techniques used by attackers and the tools available to defenders. AI agents can automate tasks, analyze large amounts of data, discover vulnerabilities and accelerate offensive operations. At the same time, AI is creating new capabilities for threat detection, incident analysis and response. Security Affairs’ new newsletter follows this evolution, covering every week the latest threats, attacks, vulnerabilities and developments at the intersection of AI and cybersecurity.

AI-CYBERSECURITY Newsletter

25-year-old Israeli founder sells stealth AI startup for up to $35 million without raising capital

OpenAI claims 100-plus secret files followed ex-employee back to Apple  

Open weight takes 71.5% of tokens and 23% of spend

OpenAI Models Hacked Data Portals, Raided a Crypto Wallet to Finish Tasks  

Meta removes language that raised scraping and AI training concerns

Can LLMs Supercharge Geolocations? Our Tests Show Big Improvements But Humans Remain Key 

Agents are your newest insiders. Security must move at their speed  

Anthropic Acquires Confidential AI Startup Opaque Systems

ATT&CK v20: Critical Infrastructure Campaigns, Adversary Use and Abuse of AI, & Iranian Cyber Espionage  

UK Election Watchdog Develops AI System to Flag Deepfakes Within 3 Hours

Meta’s Muse hits 10M U.S. downloads in 40 days, a milestone reached by only 11 other apps  

Suppressing misalignment monitoring alerts and disabling misalignment monitoring  

Anthropic pitches AI safety bill that may block a model if 50+ people could be killed  

Making attacking agents pay  

LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor

AI Just Found a Bug That Puts up to 70% of the World’s Websites at Risk

AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise  

Torvalds: AI is fine for competent devs, but spare us the ‘drive-by’ patches

Our latest defenses against evolving web scams

UK government sets out $800 million of AI security funding

Securing our frontier model training environment  

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

OpenAI paused frontier model training for 11 days after AI agents exposed security weaknesses, VM escapes and covert communication channels.

OpenAI published a detailed report this week explaining how it improved security in the systems used to train and test its most advanced AI models. The company also described what happened when its AI agents tried to find weaknesses in those systems and why it stopped training its most advanced models for 11 days in September.

“Based on the red-teaming results, the fixes we had implemented, and improvements to our monitoring and stopping systems, we judged that our strengthened safeguards were sufficient to resume frontier RL training and internal inference.” reads the report published by the company. “We resumed these workloads on October 1, 11 days after our pause began.”

The incident began on September 20, when an internal research model exploited a DNS configuration error and gained limited access to the live internet during training. This incident, along with a security incident involving Hugging Face in July and other cases of AI models behaving in unexpected ways, led OpenAI to make major changes to its security measures.

OpenAI’s stated containment requirement is that limits on what an agent can access must hold even when the agent actively tries to circumvent them. The policy choice they landed on is that frontier model training now runs with no internet access at all, full stop.

“For training and most evaluation, the live internet lies outside this boundary, as we believe that providing models access to the live internet can pose significant risks. Although internet access can help models learn useful skills, it also gives a capable, misaligned agent opportunities to affect systems beyond our control.” continues the report. “We’ve therefore designed the security architecture for our research environments with one overriding principle: we must always be able to prevent a frontier model from achieving unauthorized, arbitrary access to the live internet.”

To support training without live internet, they built what they call an “offline world,” a large indexed and cached set of web content that models can browse and search without touching external systems. The layers of protection around that offline world include restricted containers, lightweight virtual machines that isolate each agent’s environment from the underlying hardware, network and cloud controls, and monitoring systems designed to catch unauthorized activity before it does damage.

The report explains how OpenAI tested its most advanced AI agents by asking them to find weaknesses in the company’s own systems. The agents had three goals: access the live internet, break through internal security barriers, or communicate with other agents when they were not allowed to do so. OpenAI ran experiments using hundreds of billions of tokens.

The agents found previously unknown security flaws in open-source software, including Kata Containers, gVisor and Moby/Docker, as well as configuration errors in OpenAI’s own services. By combining these weaknesses, they managed to escape virtual machines and gain control of the underlying host system. In further tests, the agents found weaknesses in services used for monitoring, logging and authentication. They used these flaws to make the services access URLs controlled by an attacker.

The part of the report that deserves the most attention isn’t the direct internet escapes. It’s what the agents did when those paths weren’t available. Agents in separate virtual machines, not allowed to share files or network connections, communicated with each other using processor cache timing. One agent evicted specific data from the processor’s cache. Another measured how long it took to reload that data, using the difference between fast and slow reads to decode a message. No file touched, no network packet sent. The technique is the same family of attacks as Spectre and Meltdown.

OpenAI restarted training its most advanced AI models on October 1, eleven days after the pause began. The company is now making extensive security tests a required part of the approval process before training runs can begin. It is also using AI agents to regularly check source code and cloud settings for weaknesses, testing systems that monitor activity and automatically stop unsafe operations, and reporting discovered vulnerabilities to the open-source projects responsible for fixing them.

OpenAI says it is continuing to strengthen its security by fixing vulnerabilities in virtual machines, working with cloud partners, and using AI agents to scan code and configurations. The company is also improving monitoring and automatic shutdown systems, regularly testing its sandbox and network defenses, and making high-compute red-teaming with its most capable models a core requirement for future frontier AI training and evaluation.

“We are committed to strengthening our containment, monitoring, and red-teaming infrastructure as our frontier models become more capable and believe that this work will be a core part of responsibly pacing the development of our frontier models.” the company concludes.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Artificial Intelligence)

Pierluigi Paganini answers questions about the PHP2Shell vulnerability, early exploitation, AI-assisted attacks, and the risks to businesses, servers, and personal data.

1. Your latest report reveals that hackers began exploiting the PHP2Shell vulnerability four days before it was publicly disclosed. First, can you explain what PHP is, how widely it is used across the internet, and why this particular security flaw is so serious?

PHP is a programming language widely used to build websites and web applications. It powers a significant share of the web. PHP2Shell is serious because it can allow attackers to execute commands on a vulnerable server remotely. Depending on the configuration and the server’s privileges, this could give threat actors access to sensitive data, applications and other systems.

2. According to AWS researchers, attacks were already underway before the vulnerability became public. How did researchers uncover this early exploitation, and what does it tell us about the ability of hackers to identify security weaknesses before developers can fix them?

AWS researchers detected exploitation attempts against their honeypot network four days before public disclosure and the release of patches. This shows that attackers can discover or weaponize vulnerabilities before defenders have time to respond. AI-assisted analysis may accelerate this process, helping attackers turn technical information into working exploits in hours rather than days. However, detected attempts do not automatically mean successful compromises.

3. The vulnerability could potentially allow attackers to execute malicious commands on affected servers. What does that mean in practical terms, and what risks does it pose to websites, businesses and the personal information of their users?

Remote command execution means an attacker may be able to make a server run commands without authorization. Depending on the attacker’s access, they could steal data, install malware, change website content, or use the compromised server to attack other systems. Businesses could face service disruption, financial losses and reputational damage. Users may also be exposed if their personal information is stored on an affected system. The actual impact depends on the server’s configuration and security controls.

4. The latest findings raise concerns about the gap between discovering a vulnerability and protecting systems against it. How quickly can attackers exploit these weaknesses, and are businesses adequately prepared to respond when critical security flaws emerge?

The window can be extremely short. In some cases, attackers can develop or adapt an exploit within hours, leaving organizations little time to react. Many businesses still rely on patching schedules that are too slow for internet-facing systems. Organizations need continuous monitoring, rapid patching, tested incident response plans and clear visibility into exposed assets. They should also investigate suspicious activity dating back to before a vulnerability was publicly disclosed, because attacks may already be underway.

5. With PHP powering a significant portion of the internet, could we see further attacks exploiting this vulnerability? What should website operators do immediately to protect their systems, and should ordinary internet users be concerned about their data?

Further attacks are possible, particularly against systems that remain unpatched or exposed. Website operators should apply the relevant security updates, check whether their PHP applications are vulnerable, and review logs for suspicious activity dating back to October 17. They should also restrict access and investigate signs of compromise. Ordinary users do not need to panic, but they should keep their accounts protected with unique passwords and multi-factor authentication where available. Whether personal data is at risk depends on which services they use and whether those systems were compromised.

AI-assisted tools are increasingly being used to analyze code and identify vulnerabilities. How much of a role could artificial intelligence play in helping attackers discover and exploit flaws like PHP2Shell, and can defenders use the same technology to their advantage?

AI can help analyze code, identify suspicious patterns and speed up the process of turning a vulnerability into a working exploit. This lowers some of the technical barriers for attackers and may shorten the time between discovering a flaw and exploiting it. However, AI is not the only factor, and we should not assume that every attack is AI-driven. Defenders can use the same capabilities to review code, prioritize vulnerabilities, analyze logs and detect suspicious behavior. The real advantage comes from combining AI with reliable data, skilled security teams and effective response processes.

This case shows that attackers may exploit a vulnerability before a patch is available. Does this mean traditional vulnerability management is no longer enough, and how should organizations rethink their security strategy?

Traditional vulnerability management remains essential, but patching alone is not enough when attackers may act before a fix becomes available. Organizations need to know which internet-facing systems they operate, understand their exposure and have additional controls in place. These include limiting access to vulnerable services, monitoring suspicious activity, applying temporary mitigations and preparing incident response procedures. They should also investigate whether systems were targeted before the vulnerability was disclosed. The goal is to reduce the opportunity for exploitation and detect attacks quickly, even when a patch is not yet available.

Below is another interview I gave to TRT World discussing critical PHP vulnerabilities, the risks they pose to web servers, and the growing number of exploitation attempts. I explain why rapid patching and effective security measures are essential to minimize potential damage.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

AI companies need usage data to align pricing with costs, improve products, identify churn risks, and grow revenue through informed decisions.

The AI Paradox

There is a paradox: AI companies exist to extract intelligence from data, yet many have almost no visibility into how their own software is being used.

They design complex models, introduce their product, set a price, and then hope that customers renew their contracts. In a space as fast-paced as AI, such a strategy is no longer safe.

Without usage as a guide, price decisions are made on assumptions rather than facts. Product roadmaps are driven by story, not by usage. Customer success teams learn about customer churn when renewal dates are approaching.

In reality, usage intelligence has become one of the most important signals in an AI business, guiding everything from pricing strategy to product development and long-term monetization.

Why AI Changes the Stakes for Usage Data

AI changes the economics of software and, with it, the relevance of usage visibility. The economics of existing software products are linear in cost, whereas those of AI products are not. Compute, energy consumption, as well as third-party model licenses, can all be material variable costs.

If usage increases rapidly (through enterprise adoption, agents, or workflows), the cost can grow faster than the revenue generated if pricing is not aligned with consumption.

The opposite scenario is just as dangerous. If customers are not using key capabilities, churn may be approaching long before a renewal conversation begins.

Research shows the extent of this visibility gap. For AI vendors, visibility is important on the commercial side, too. They need to know how customers are using the AI capabilities they sell. IDC research found that 48% of software buyers want better visibility into their usage.

The pace of change is also a concern, with 70% ranking rapid change in the AI ecosystem among their top three AI-related security risks. Pricing, packaging, and business models must evolve at the same pace, and that requires reliable usage intelligence.

What Usage Intelligence Actually Looks Like

Of all the capabilities that make up a software monetization strategy, usage intelligence is the one most commonly treated as optional — and the one that most consistently separates companies that adapt from those that don’t. It is the feedback loop that connects real-world product consumption back to the decisions that shape pricing, packaging, and product direction.

At the instrumentation layer, usage intelligence starts with telemetry data. This includes activation events, entitlements consumed, feature-level data, daily and monthly active users, and time-to-value metrics that track how quickly customers get value from the product. Thales Sentinel can also collect usage data from on-premises, offline, and disconnected environments, so vendors are not limited to tracking always-connected software.

The operational layer is where all the telemetry data is made actionable. Usage dashboards in CRM systems enable account teams to see how customers use the software. Health scores can even detect reduced engagement well before any risk of renewal is seen.

The enforcement layer makes sure that usage is consistent with contract rights. This is particularly important for consumption-based or token-based pricing schemes. Tracking accuracy is essential for determining customer fairness and vendor revenue.

Finally, there is the feedback loop. The insights from usage need to flow back to those responsible for pricing, packaging, product development, and customer success. Without the feedback loop, the data is just more information.

Pricing specialists have long argued for incremental experimentation. Research from Simon-Kucher reveals that companies that make frequent, data-informed pricing adjustments tend to achieve stronger growth than those that depend on static pricing models.

Usage intelligence provides the evidence required to make those adjustments with confidence.

How Usage Data Enables Multiple Business Models

Business model agility is increasingly becoming a competitive advantage for AI companies, yet flexible business models cannot exist without trustworthy usage data beneath them.

Consumption-based pricing, outcome-based pricing, token models, and hybrid subscription structures all depend on accurate measurement of how customers use the product. There is demand for these models, too. IDC research found that 45% of software buyers prefer usage-based models.

In practice, most AI companies adopt a gradual sequence.

They begin with subscription licensing to establish predictable recurring revenue. As adoption grows, they instrument feature usage and engagement patterns. That data then enables the introduction of consumption or token-based layers tied to high-value AI capabilities.

One AI audio-recognition company did just that. It moved from perpetual licensing to several subscription tiers using Thales Sentinel. Its usage data showed which features customers used most, which helped the company decide how to structure those tiers without making changes to the core technology.

Another AI recognition vendor delivering SDKs for embedded systems took a different approach using Sentinel. Their trial licenses expire after a defined number of executions instead of after a fixed time period. This usage-based trial model demonstrates genuine customer interest, giving them a clearer indicator of product-market fit than a simple time-limited evaluation would.

Both examples show that usage intelligence transforms monetization strategies from guesswork into evidence-based decision-making.

From Data to Decision: Three Practical Applications

The real value of usage intelligence lies in informing concrete business decisions.

Preventing churn is one of the most immediate uses. Feature-level engagement metrics can detect declining usage several months before a renewal date. This enables customer success teams to step in and show the value or introduce underutilized features, preventing a customer from leaving.

Upsell and expansion opportunities can also show up in the usage data. Seat utilization may show that a team is close to capacity and needs more licenses. Feature usage can show when a customer is getting enough value from certain capabilities to justify moving to a higher tier or adding consumption-based features.

Usage data can also inform the product roadmap. Rather than relying on assumptions about what customers want, AI companies can see which features people use and which get little attention. This is key in a market full of similar AI capabilities. Companies need to know which parts of their product customers value and are willing to pay for.

There is also a need for the collection of usage intelligence to be privacy-conscious. For vendors operating under frameworks such as GDPR or the EU’s AI Act, it is necessary to design telemetry systems that prioritize aggregated data collection over personal data collection whenever possible.

The Organizational Challenge

However, technology alone is not enough to create usage intelligence. Businesses must also ensure that the intelligence is available to those who can act on it.

Usage intelligence only delivers value if it reaches the people who can act on it. Pricing teams need consumption data to make confident adjustments to their models. Product teams need feature engagement data to inform roadmap decisions rather than rely on assumptions. Sales teams need account-level signals to time their conversations correctly. Customer success teams need early warning indicators to intervene before disengagement becomes churn. Finance teams need usage trends to build credible revenue forecasts.

Getting that data to all of those functions consistently and in a usable form requires intentional data architecture and a shared organizational commitment to treating monetization as a cross-functional capability rather than a single team’s responsibility.

This becomes harder as companies add more AI products. If usage data is split across separate products, teams may struggle to see how a customer is using the wider portfolio. Bringing the data together can show where products are being heavily used, where adoption is low, and where there may be room to expand an account.

Building Systems Around Innovation

The AI companies that sustain long-term commercial success are the ones who built a system around it that can learn, adapt, and improve as markets shift and customer needs evolve.

Usage intelligence is what makes that system adaptive. Without it, pricing decisions are made on assumptions, packaging tiers are defined by intuition, and churn arrives without warning. With it, every commercial decision — what to charge, how to package, what to build next, which customers need attention — is grounded in evidence rather than expectation.

In an industry defined by rapid innovation, the AI companies that listen to their own usage data will be the ones best positioned to turn experimentation into sustainable growth.

About the Author: Kirsten Doyle has been in the technology journalism and editing space for nearly 24 years, during which time she has developed a great love for all aspects of technology, as well as words themselves. Her experience spans B2B tech, with a lot of focus on cybersecurity, cloud, enterprise, digital transformation, and data centre. Her specialties are in news, thought leadership, features, white papers, and PR writing, and she is an experienced editor for both print and online publications. She is also a regular writer at Bora.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, artificial intelligence)

China-linked Storm-0940 used AI tool ARTEX to target 2,250 Microsoft 365 tenants, exploiting stolen ConnectWise credentials at machine speed.

Microsoft published a detailed technical report naming Storm-0940, a China state-aligned group, as the actor behind the ConnectWise Cloud Backup supply chain compromise. The group used ARTEX, an open-source AI-driven penetration testing framework, to run attacks at machine speed against hundreds of organizations across aerospace, defense, energy, financial services, government, manufacturing, and more.

“Several of these Storm-0940 ARTEX-driven attacks have resulted in the actor obtaining privileged access to an organization’s cloud infrastructure – including multiple instances where the time from initial targeting to privileged access was less than 3 hours.” reads the report. “Microsoft assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application.”

Storm-0940 has been active since 2021 and has historically relied on password spraying and OAuth application abuse to get into Microsoft 365 environments. Adding ARTEX changed the scale of what they could do. In some attacks, the time between initial targeting and achieving privileged cloud access was under three hours.

Before obtaining the ConnectWise credentials, Storm-0940 launched a password spraying attack between October 10 and 14. The attack came from the IP address 144.172.64[.]99. Microsoft recorded more than 151,000 failed login attempts against 327 accounts at eight organizations. Activity peaked on October 11, with 2,900 failed attempts per minute. Forty-eight accounts each received more than 1,000 failed attempts. None of these attempts succeeded.

The situation changed on October 15, one day after the ConnectWise breach became public. The AI agents stopped trying passwords and switched to a different attack method. By then, Storm-0940 had obtained the credentials of several ConnectWise cloud application accounts. The agents used these credentials to log directly into customer Microsoft 365 environments.

“Storm-0940’s use of ARTEX accelerated the speed of compromised application abuse to authenticate to Microsoft 365 customer environments through applications that had already been granted access.” Microsoft continues. “This allowed the threat actor to operate without requiring an interactive user sign-in. “

The agents used applications that already had permission to access their targets. This allowed the attackers to enter customer environments without requiring users to sign in interactively.

In a subset of environments where authentication succeeded, the agents didn’t stop there. They moved into Microsoft Graph and ran directory reconnaissance, modified application credentials to establish persistence, and attempted changes to identities, groups, and privileged roles. Microsoft identified multiple customer environments with evidence of this follow-on activity.

The persistence mechanism is the part defenders need to act on now, even if they’ve already disabled the ConnectWise connections.

“These changes can remain active as a backdoor even after the original compromised application is mediated.” says the IT giant.

An attacker who added their own credentials to a trusted application before you revoked access still has a working key. Reviewing all service principal credential additions since at least October 1 is the right starting point, not October 15 when the public breach was announced.

ARTEX is not a tool used only by Storm-0940. Microsoft says threat actors in several regions have used the same framework. Originally open-source, ARTEX was written in Go and can use different AI models to plan and carry out tasks. Researchers at Zscaler and Recorded Future also found a Chinese-speaking group using it to target South Korean financial institutions. The setup used DeepSeek, GLM, and Grok as coordinated AI agents, with GLM checking DeepSeek’s work. After these attacks became public, the project went closed-source. However, anyone who already has a copy can still use it.

The speed point is what Microsoft keeps coming back to in its report. Agents don’t take weekends, don’t sleep, and can run multiple attack paths simultaneously.

“This activity demonstrates how threat actors are integrating agentic AI into existing offensive security workflows and allows them to scale their operations exponentially.” Microsoft concludes. “Agents are not constrained by factors affecting humans – they can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously enabling significantly reduced time from selecting a target to achieving objectives, increasing the speed and impact of complex attacks like supply chain compromises.”

When Storm-0940 had valid application credentials, they didn’t have to iterate slowly. They hit 2,250 tenants with 2,900 sign-in attempts per minute, a pace at which manual detection and response simply can’t keep up.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ARTEX)

PHP prepares emergency patches for two critical RCE flaws, while older, unsupported versions could remain exposed without vendor fixes.

The U.S. government ordered federal civilian agencies to remove DeepSeek products from their IT systems and stop buying them. The order also reaches third-party tools and services built with DeepSeek implementations, which is the part most organizations should notice.

The notice doesn’t explain exactly what counts as a “DeepSeek implementation.” Agencies will need to ask suppliers whether their products fall under the ban.

“The Department of Homeland Security is publishing notice of the Secretary of Homeland Security’s issuance of an order (1) excluding information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd (DeepSeek), to include affiliated entities as defined in applicable regulations, from federal civilian agency procurements; and, (2) removing all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology.” reads the order.

Homeland Security Secretary Markwayne Mullin signed the order on July 24, 2026, under the Federal Acquisition Supply Chain Security Act of 2018. DHS published it in the Federal Register on October 20 as document 2026-21447, under docket DHS-2026-0628.

The order cites national-security concerns. According to reporting on the notice, DHS said DeepSeek’s models could transfer sensitive data to China and may contain malware or other security weaknesses.

“In a notice made public on Monday, the Department of Homeland Security also barred agencies from acquiring DeepSeek products and services, including those developed by affiliated entities.” South China Morning Post reports,

“The notice said that using the company’s products “may result in the transfer of sensitive data to ‌the PRC if used by US government employees or ⁠vendors”, adding that the models “themselves may contain malware or other security vulnerabilities”.”

DeepSeek’s own privacy policy says it collects, processes, and stores personal data in the People’s Republic of China. That does not prove wrongdoing, but it explains why U.S. agencies treat data residency and foreign legal access as material risks.

The ban doesn’t apply to private companies or ordinary users, but government contractors may also be affected. They generally can’t use covered products or services for federal contracts unless they receive a waiver.

The goal is to catch hidden uses of DeepSeek, including AI models built into apps, services and development tools. Agencies need to check their systems, while suppliers must disclose which AI models they use, where the models process data and whether information leaves the customer’s environment.

The ban took effect when issued, but existing contracts are covered only after the contracting officer formally updates them. Agencies can request an exception, but they must provide a strong justification.

DHS signed the order on July 24 but didn’t publish it until October 20, 87 days later. The rules don’t set a deadline for public release, but they require officials to notify the company and relevant congressional committees and review the order at least once a year.

This delay meant affected organizations had to comply before they could read the public explanation or see the signed order.

China pushed back. Foreign Ministry spokesperson Mao Ning said Beijing opposes “the overstretching of the concept of national security” and would defend the lawful rights of Chinese companies; DeepSeek did not immediately comment to the Associated Press.[apnews]

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI)

Microsoft urges organizations to secure AI Agents as insider threats, using dynamic permissions, continuous risk monitoring and automated containment.

Microsoft published a detailed blog post explaining how organizations should secure AI agents. Microsoft sees them as a growing insider threat, not just a possible risk in the future. AI agents are not dangerous by nature, but they can access critical systems and may fail, be manipulated, or be compromised.

“The most trustworthy agentic system will not be the one with the model we trust most. It will be the one designed that enables us to trust the model least.” said Satya Nadella

This is not just a theory. It is a principle that should guide how organizations design and secure AI systems.

The post makes a distinction worth holding onto. An agent that starts a task with the right permissions and behaves correctly can still become dangerous if its context changes mid-run. A prompt injection in an external document, a piece of untrusted data that shifts the agent’s reasoning, a task that evolves in a direction nobody anticipated, none of these require the agent to be compromised in the traditional sense. The model produces variable outputs, the context changes, and the agent’s behavior drifts. At machine speed, the window between that drift starting and it causing damage is very short.

Microsoft’s proposed answer is continuous containment rather than upfront trust. You define what the agent is allowed to do before it acts, you monitor what it actually does while it runs, and you adjust its permissions in real time as its behavior or the risk calculation changes. An expense approval agent should start with access scoped exactly to reviewing and approving expenses, nothing broader, and those permissions should shrink or disappear the moment the agent tries something outside that task.

The post introduces Dynamic Permissions to apply the principle of least privilege to AI agents. An agent should not automatically get the same access rights as the employee who deployed it. It starts with no permissions and receives only the access needed for its approved task. These permissions remain active only while the task is running.

“The employee retains the employee’s access.” Microsoft states. “The agent receives its own identity, permissions and its own authority scoped to its current task and for the duration of the task only.”

Alongside that, Dynamic Agent Risk is a continuously updated score that combines signals from identity, endpoints, network, cloud, runtime, and the agent’s own behavior to assess whether what the agent is currently doing still matches what it was authorized to do. The response when risk rises is graduated rather than binary: preserve reads while blocking writes, narrow accessible resources, require human approval for high-impact steps, or stop execution entirely if the risk warrants it.

“Dynamic Agent Risk combines signals from identity, data, endpoints, cloud, network, runtime, and the agent’s own activity. It considers how securely the agent is configured, what resources it can reach, the potential impact if something goes wrong, and whether its actions are drifting from the user’s or organization’s intent.” Microsoft states.

“The result is not a one-time score assigned at onboarding. It is a continuously updated understanding of the agent’s current risk and whether its current authority still matches that risk. “

Organizations frequently have AI agents running locally or introduced through third-party tools that were never formally registered in any central system. Microsoft says it’s expanding discovery to 60 types of local agents, including Claude Code, OpenAI Codex, and GitHub Copilot. Getting those into a unified registry with accountable identities is the prerequisite for applying any of the governance controls described in the rest of the post.

You can’t set least-privilege permissions for an agent you don’t know exists. You can’t detect behavioral drift from an agent that doesn’t have a tracked identity. The agent registration problem is logistically harder than it sounds, especially for organizations where individual employees can spin up agents without IT involvement, which is most organizations right now.

Microsoft recognizes that organizations cannot manually review every risk alert when they run hundreds of thousands of AI agents. Its solution is Guardian Agents, AI agents focused on security. They follow playbooks created by human operators, investigate changes in risk, apply or recommend security measures, and use what they learn to improve security policies. Humans set the goals and approve important decisions, while the agents handle continuous monitoring and response.

However, this approach raises another concern. Guardian Agents are also AI agents, so they can fail or be manipulated, just like the agents they are supposed to control. Microsoft says security controls must operate outside the AI model and must not be changed by it. But this raises an important question: how can organizations ensure these controls remain reliable when the system enforcing them is also an AI agent? This is a challenge that real-world deployments will need to address in the coming years.

“Organizations are adopting agents to serve customers better, solve problems faster, and give people more time for the work that matters most. The goal is not to make every model perfectly predictable before it can be useful.” Microsoft concludes. “The goal is to build systems that remain secure even when the model is not.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI Agents)

Meta wants the right to scrape your website for AI training. If you have a business account, that includes you.

At the end of the month, Meta plans to change its commercial terms in a way that matters to every company advertising or selling through its platforms. The new language takes effect on October 30, 2026. It lets Meta collect content from websites associated with business customers and use it to train AI models or otherwise improve its products, according to The Register.

Meta defines “business customer” broadly. It includes anyone who uses ads or marketing messages, sells or lists products, develops apps, uses a product catalog, manages a Page, runs a Group for business purposes, or uses tools such as Ads Manager or Meta Business Suite. At least one million businesses already use Meta’s AI agents in WhatsApp and Messenger. Nieman Lab also points out that almost every news publisher has at least one Meta business account.

The contract clearly explains which tools Meta can use. By accepting the terms, you allow Meta, or anyone working on its behalf, to use automated tools such as web scrapers, bots, spiders and crawlers to access and index your websites, pages and URLs. These tools can also revisit your sites regularly to collect updates.

“You authorise us (or any entity acting on our behalf) to use automated software (such as web scrapers, bots, robots, spiders, crawlers and user agents) and create test credentials to access, index, cache, analyse, collect, retrieve or crawl the domains, web pages or URLs (and any content available through them) that are associated with your products or services, or that are made available through your or users’ use of Meta Company Products and services, and to periodically pull updates from such domains, web pages or URLs.” states Meta’s commercial terms. “Meta may use any content from such domains, web pages or URLs to provide, develop, improve, research, train and maintain the integrity of, the Meta Company Products, services and features provided under these Commercial Terms and any other applicable supplemental terms.”

Then comes the use clause. The company may use any content from those domains to provide, develop, improve, research, train and maintain the integrity of its products, services and features. The contract lists scrapers, bots, robots, spiders, crawlers and user agents, which is a lot of ways to say visitor you didn’t invite.

The News/Media Alliance says there’s no way out. Business accounts have no option to opt out of the terms, and the only alternative is to stop using Meta’s products.

““Meta’s new commercial terms of use are outrageous and probably illegal. The company’s decision to withhold access to its audience unless businesses allow Meta to scrape content from their websites is an appalling, bad-faith policy, and a clear abuse of the company’s market power. It cannot be allowed to be implemented on October 30.” states Media Alliance. “The text is so far reaching that any business with intellectual property online and a Meta business account could have their copyrighted material taken from them.”

Danielle Coffey, President and CEO of the News/Media Alliance also pushed the point beyond news sites. Her questions were whether Taylor Swift’s Meta business account would give Meta access to copyrighted media on her website, and whether Shutterstock’s would let Meta scrape its images. The Alliance’s argument is that any business with intellectual property online and a Meta account could be affected, not just publishers.

There is also a problem with robots.txt. News reports say the social network giant plans to let businesses control how its crawlers access their websites through robots.txt files, but the contract makes no such promise. The law does not always require companies to follow these instructions, so businesses must rely on Meta to respect their preferences.

The company didn’t respond to The Register’s request for comment.

If you run a Meta business account, someone should read the terms before October 30 and check what your own robots.txt actually says.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI)

The UK Electoral Commission is building an AI system to alert candidates to damaging deepfakes within three hours.

The UK’s Electoral Commission is building an AI-powered system to tell candidates about significant deepfakes within three hours of posting. Its chief executive, Vijay Rangarajan, said so at a panel at the Conservative Party’s annual conference last week, as Tech Policy Press points out that it’s a rare public intervention from a man who has run the regulator since 2024 and who mostly speaks to Parliament in evidence sessions.

He began with an example from another country. During Ireland’s 2025 presidential election, a deepfake video falsely showed candidate Catherine Connolly saying the election had been cancelled and that she was withdrawing from the race. The video also urged her supporters not to vote. None of this was true, and Connolly went on to win the election.

Rangarajan said a similar video during a UK election could influence a significant number of votes. However, he stressed that the Electoral Commission has clear limits to its role. It does not settle disputes over political claims made during a campaign. Its focus is on false statements that could disrupt the election process itself.

““If that happens to the British election, that will move a significant amount of votes,” he said, adding that it was not the Electoral Commission’s role to arbitrate rival claims made by candidates during the cut and thrust of a campaign, but rather to focus on statements such as this one that could undermine the administration of the election itself.

“To address that risk, the commission conducted a pilot program during the UK’s local elections in May 2026, Rangarajan said. “We ran a full pilot, analyzed about three million posts through an AI,” he explained. “So, this is a good example of how AI can work: 147 bits of content were flagged. Humans then looked at those — not a terribly pleasant job in some cases — ten were really quite misleading, and we referred to the social media companies or to the police.”” Tech Policy Press reports.

The Commission has tested the idea. During the local elections in May 2026 it ran a full pilot, and an AI analyzed about three million posts. It flagged 147 pieces of content, humans reviewed them (he called that unpleasant in some cases), and ten were really quite misleading, so they went to the social media companies or the police.

Rangarajan said the posts had little impact. However, the trial showed that the Electoral Commission now has a system to help voters, journalists and political parties deal with deepfakes. He expects attempts to use them to disrupt UK elections. The pilot began earlier in 2026 and monitored fake audio and videos designed to mislead voters about the election process or falsely show candidates doing or saying things. The Commission said it would publish the results.

The system has a clear focus. Identifying and prosecuting the people behind deepfakes can take weeks or months, often long after an election. Instead, the Commission aims to act without first identifying who created the content. AI scans social media posts in real time and flags suspicious material for human review. If a post meets the required criteria, the Commission alerts the relevant candidates or parties, ideally within three hours of its first appearance. Rangarajan said this is roughly the time it takes for content to go viral.

That narrow scope has edges. Full Fact, whose AI tools were monitoring more than a thousand candidates in the May elections, found a Glasgow candidate’s campaign videos built with AI. The Commission told Full Fact the clips fell outside its pilot because each was labeled an illustrative AI scene, even though the label sat at the end of the caption.

The legal backdrop is the real problem. Rangarajan said the Commission was set up for money and people, and now it’s all about information, so it has to work out how laws from 1983 or 2000 apply in 2026. Earlier this year the Guardian reported, according to a summary on the Resilient Media for Democracy Observatory, that the Commission was seeking legally enforceable takedown powers from the government.

Then there’s the part with no legal answer at all. Rangarajan said he believes at least one social network showed signs of algorithmic bias at election time, though he didn’t name it. His scenario is a platform that changes its recommendations during an election without warning, suggesting neighbors with one political view and suppressing others, so users think their neighbors have changed their minds.

The Commission believes it has already detected some algorithmic bias in social media campaigns, but Rangarajan said UK law offers no clear solution. Experts and campaigners have also raised concerns about X’s role in UK politics and TikTok’s Chinese ownership.

The Commission faces 30,000 to 40,000 cyberattacks a month, sometimes reaching 10,000 a day, including botnet attacks and phishing. Rangarajan wants stronger, more independent security capabilities and believes major social media monitoring could be handled by another body.

Tech Policy Press sees his comments as a call to update election laws and possibly create new offenses. The next general election must take place by August 2029, but it could be called earlier, and it remains unclear whether lawmakers will act in time.

For now, what the Commission has is a three-hour promise and a pilot that worked at small scale.

Rangarajan describes the threat it’s meant for as “an absolutely certain attempt to use some of these deepfakes against the UK.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Deepfakes)