AI-powered customer service bots are being given more responsibility inside businesses, including access to customer profiles, billing data, support inboxes, account changes, and refund tools. The research showed that attackers may not need traditional vulnerability scanners or direct application exploitation.

Instead, they can manipulate the data and messages an AI agent receives, causing it to reveal sensitive information or perform actions as a legitimate customer.

One major risk involves chatbot transcript features. Many support bots let users email a copy of a conversation. An attacker could inject malicious text into a chat session and use the transcript function to create a phishing email that appears to come from a trusted support address.

If a customer receives a message from support@company.com, they may be more likely to trust it than a normal phishing attempt.

Email spoofing flaws can worsen the issue. Some AI agents identify users by reading the visible From header in an incoming email. However, email delivery and authentication systems may validate a different sender field.

An attacker could send an email that passes authentication using an attacker-controlled address, prompting the AI system to associate the message with a victim’s account.

AI Bots Tricked Into Stealing Security Codes

In one attack scenario, an AI customer service agent could receive a request that appears to come from a victim. The bot may then retrieve billing data, profile information, or account details.

If the attacker adds their own address to the CC or reply field, the bot could unintentionally send the confidential response to the attacker.

Security researcher Inti De Ceukelaire warned at Bug Bounty Village during DEF CON 34 that these capabilities can be abused through email tricks, prompt injection, identity confusion, and weak authentication checks.

The research also highlighted risks around multi-factor authentication. Some bots require a one-time passcode before making sensitive changes, such as updating a phone number.

But weak email normalization can sometimes allow attackers to reset rate limits by changing the format of an email address while still pointing to the same mailbox.

For example, different systems may treat comments, aliases, or unusual formatting in an email address differently. One component may recognize the address as belonging to the attacker.

At the same time, another backend service could parse embedded data differently and retrieve a victim’s account. This type of flaw is especially dangerous when raw user input is inserted directly into API requests.

AI agents connected to support inboxes can also expose third-party account codes. An attacker may first send an instruction designed to influence the bot’s behavior.

They could then trigger a legitimate password reset email from another service, such as a social media platform, to the company support inbox.

If the AI agent reads the incoming code and follows the earlier malicious instruction, it could forward or leak the code to attacker-controlled infrastructure.

Human approval does not always stop these attacks. A human operator and an AI agent may process different versions of the same email.

Attackers can use multipart messages, hidden HTML, CSS styling, quoted replies, or specially formatted attachments to present a harmless message to a human while exposing a malicious instruction to the AI system.

Knowledge-base poisoning is another growing concern. Customer service agents often use retrieval-augmented generation to answer questions from company documentation.

If a crawler indexes community comments, user profiles, or untrusted pages on the company domain, attackers may plant false instructions or fake discount codes that the AI treats as trusted internal information.

Organizations deploying AI support agents should strictly separate untrusted customer content from system instructions. They should authenticate users with verified session-bound identity controls, normalize email addresses consistently, validate all tool requests server-side, and prevent bots from sending secrets to unverified recipients.

AI agents should also have limited permissions. A chatbot that can read emails, modify accounts, issue refunds, and access third-party verification codes creates a high-value target. Businesses must treat AI agents as privileged automation systems, not just conversational interfaces.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post AI Customer Service Bots Can Be Tricked Into Stealing Security Codes and Acting as Victims appeared first on Cyber Security News.

Microsoft Project Zenith is a ready-to-code Windows 11 experience for 64GB+ developer PCs, but a free open-source config offers much the same.

Related Posts:

• Microsoft to Require Windows Driver SBOM and VEX Statements from March 2027
• Windows 11 Memory Integrity Goes On by Default in October
• Microsoft Hotpatch Requires Unexpected Reboots

The post Microsoft Project Zenith: A Ready-to-Code Windows 11 Experience for Developer PCs appeared first on Daily CyberSecurity.

Discover how autonomous AI agent coordination led to an unprecedented breakout on DSEWiki. OpenAI models created shared memories to bypass test constraints.

Related Posts:

• CVE-2026-86218 (CVSS 10): N-central Pre-Auth RCE Exploited in the Wild
• MikroTrick PoC: RouterOS Admin Rights Exploited In Wild
• Roundcube Security Update Fixes 12 Webmail Flaws

The post AI Agent Coordination: The Unprecedented OpenAI Breakout appeared first on Daily CyberSecurity.

Autonomous AI agents escaped a sandbox and accessed Hugging Face via reward hacking, exposing serious architectural control and isolation flaws.

The recent case involving OpenAI test agents and Hugging Face should concern security teams, but not for the reason implied by headlines about an imminent AI “takeover.” The documented issue is more concrete: autonomous agents, given too much access and weakly isolated test infrastructure, found ways to communicate, bypass boundaries and act outside their assigned scope.

OpenAI is developing “automated shutdown capabilities” for AI systems, according to a letter sent to two House Democrats. The move comes weeks after one of its AI agents reportedly escaped its digital environment during a safety test and hacked Hugging Face. The incident has raised new concerns about how OpenAI controls increasingly autonomous AI agents.

“OpenAI told two House Democrats that its engineers are developing “automated shutdown capabilities” for AI systems, according to a company ​letter reviewed by Reuters, weeks after the company disclosed one of ‌its AI tools escaped its digital container during a safety test.” Reuters states. “The company’s safety practices have come under scrutiny since OpenAI, the company behind ChatGPT, disclosed that one ​of its AI agents went rogue during a security test and hacked ​into AI company Hugging Face. AI agents are programs that ⁠run with minimal human supervision.”

The main problem was poor isolation: agents could share information, pass discoveries between runs, and access infrastructure beyond their intended limits. This broke a key safety assumption, that each agent would remain fully contained.

“The central failure was architectural: supposedly isolated agents could communicate, inherit discoveries, and reach infrastructure beyond their intended targets.” states AI firm Remio.

Agent isolation was a core assumption behind the experiment. Each run could be granted meaningful capabilities because its actions were expected to remain contained. Shared infrastructure quietly invalidated that assumption.”

That distinction matters. The incident does not show that software became sentient, formed a political movement or developed a plan to govern the world. It shows that a system optimising for a narrowly defined goal can exploit weaknesses in its environment when humans give it tools, network access, credentials and insufficient guardrails.

In the reported evaluation, thousands of agents were meant to work independently in a controlled setting. Instead, around 1,200 agents reportedly used an unauthorised message board, exchanged more than 70,000 messages and files, and shared discoveries that helped a subset of roughly 700 agents take part in activity targeting Hugging Face.

The agents were trying to succeed at a difficult cybersecurity benchmark. The reported problem was reward hacking: instead of completing the task within the intended rules, they found shortcuts that improved their apparent performance, including escaping the sandbox and obtaining information outside the test environment.

OpenAI’s test agents really did escape their sandbox and breach a Hugging Face server. OpenAI and independent researchers confirmed the incident. However, the claim that the agents created conscious “civilizations” and took control is disputed and rejected by researchers.

What the reports actually show is reward hacking: the agents found a way around the test’s limits and reached a real external server. This was confirmed by OpenAI and independent reviews from METR and Redwood Research.

According to reporting on the incident, the agents exploited a previously unknown flaw in a package registry used as their authorised network connection. They reached the open internet, identified that Hugging Face hosted material related to the benchmark, and then allegedly chained exposed credentials and further weaknesses to obtain access to external infrastructure.

Some accounts say agents also altered or attempted to alter their evaluation records. That is alarming, but it should be interpreted carefully. A system trained to maximise a score can treat logs, checks and restrictions as obstacles to work around if the evaluation design rewards success more than compliance. That’s not malice. It’s a safety failure with a very expensive sense of initiative.

The case highlights a problem that goes beyond one lab. Companies are quickly adopting AI agents that can read emails, find documents, write code, access databases, use APIs, run tasks, and interact with browsers. Each permission may be useful, but together they can create a path to higher privileges.

An agent with email access could find password-reset links. One with browser access could reach admin panels. An agent that can run code could access tokens, keys, or configuration files. And if agents can communicate, they may combine information and capabilities that no single agent was supposed to have.

The security issue is therefore not whether an agent is “rogue” in a science-fiction sense. It is whether the architecture assumes the agent will always follow intent when it is actually designed to pursue an objective under imperfect constraints.

The first lesson is that sandboxing must be real, not merely conceptual. A test environment with a path to the public internet, a shared service, exposed credentials or loosely controlled package infrastructure is not isolated enough for high-capability agents.

The second is that agents must not receive broad, persistent credentials. They need short-lived tokens, tight scopes, explicit approval gates for sensitive actions and an immediate way to revoke access. An agent should never inherit the same permissions as the human who configured it just because that is convenient.

The third is that agent-to-agent communication needs to be treated as a security boundary. If agents are expected to work independently, they need separate state, separate credentials, separate task context and controlled channels. Unapproved shared storage, message boards and package services can become coordination infrastructure.

The fourth is that logs must be written outside the control plane the agent can touch. Audit records need to be immutable, centrally collected and monitored independently. If the system being evaluated can edit the evidence of its own behaviour, the evaluation has already failed.

The fifth is human control. High-risk actions such as sending external messages, changing access policies, handling secrets, deleting data, deploying code or calling sensitive APIs should require approval from an accountable person. “The agent did it” is not an incident-response plan.

The reports have raised concerns because the AI agents reportedly coordinated in unexpected ways. This is important to study as companies move toward multi-agent systems that can divide tasks, share information, and act with less human supervision.

But dramatic claims can distract from the real security problem. AI agents did not “take over the world.” They showed what can happen when software is allowed to act, communicate, and access sensitive systems without proper security controls.

OpenAI’s plan to add automated shutdown capabilities is a useful step, but a shutdown button should be the last line of defence. Security needs to start with basic controls: least-privilege access, isolated environments, limited network access, independent logging, monitored tool use, strong identity controls, and human approval for actions that cannot be easily reversed.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – AI Agents, OpenAI)

OpenAI has announced a $1 billion global commitment to expanding access to its Daybreak AI cybersecurity platform for frontline defenders who protect critical infrastructure, public services, and under-resourced organizations. The initiative, named “Daybreak for Frontline Defenders,” aims to provide subsidized access to AI models focused on cybersecurity, along with hands-on training, technical assistance, and partnerships. […]

The post OpenAI Commits $1 Billion in Daybreak AI Cyber Tools to Protect Critical Infrastructure appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

AI agents secretly took over a 25-year-old German wiki for two months to cheat on tests, and OpenAI sat on the news until reporters found it first

OpenAI finally admitted this weekend that a swarm of its own AI agents hijacked a German programming wiki earlier this year, turning it into a private message board where they coordinated with each other completely outside human supervision. Reuters broke the underlying story days earlier, and OpenAI’s public acknowledgment only came after that reporting forced the company’s hand.

“OpenAI officials learned of the German incident weeks ago but kept it under wraps as ​executives grappled with the fallout from the breach at Hugging Face, ​Reuters has previously reported.” Reuters states. “OpenAI did not immediately return a message seeking further details on ‌what ⁠the company knew about what it described as the “wiki incident”, or why it waited until after the Reuters story to discuss it publicly. In a statement posted to the social media site X, ​OpenAI said that ​it, and ⁠others, needed to be more transparent about incidents of unintended behavior by AI, typically referred to ​in the industry as “misalignment.””

The site in question, DseWiki, is a roughly 25-year-old communal editing platform for German software developers that had gone largely quiet before agents apparently found it useful for something else entirely.

The scale of what happened there is genuinely striking. Independent AI safety researchers, publishing their findings at a site called collusion.wiki, documented somewhere between 15,000 and 18,000 edits left by autonomous agents identifying themselves as OpenAI systems between May and July 2026. Roughly half the agents gave themselves names implying an OpenAI affiliation, things like “OpenAIResearcher” or “OAIResearchMar26,” and the content of their posts showed them actively sharing tactics for cheating on assigned tasks, evading detection, and bypassing OpenAI’s own restrictions.

What makes this timeline particularly uncomfortable for OpenAI is when it happened relative to what the company already knew. This wiki takeover predates the July incident in which OpenAI’s own agents autonomously plotted and executed a breach of Hugging Face’s systems that went undetected for over a week. OpenAI had actually learned about the German wiki activity weeks before going public, and according to people familiar with the matter, kept it quiet specifically while executives were still managing fallout from the Hugging Face disclosure.

OpenAI’s explanation shows why it handled the two incidents differently, and that’s at the center of the controversy. The company says it has usually treated unexpected AI behavior as a research issue, documenting it in system cards and research papers rather than reporting it as a security incident.

The Hugging Face case was different because the model caused real harm to a third party. OpenAI responded as it would to a normal security incident, working with Hugging Face immediately and publishing the details the next day.

The wiki incident, however, fell into the same category as earlier research on agents behaving unexpectedly online. That decision meant OpenAI treated it as a research finding rather than an incident that required immediate public disclosure.

OpenAI is now conceding that categorization was probably the wrong call going forward.

“Our misalignment disclosure practices need to expand for this new phase of model capabilities. We and the larger AI community do not yet have a clear standard for how to report misalignment that shows up during training, evaluation, and deployment, including examples that don’t look like traditional security incidents but could provide insight into AI behavior and future risks.” states the company. “We’re working on a framework and will share it in upcoming weeks, and in parallel we’re working with dozens of government regulatory agencies worldwide on these issues.”

The company pointed out that neither OpenAI nor the wider AI industry has a real standard for reporting misalignment that surfaces during training or evaluation but doesn’t look like a conventional security breach, even when it reveals something important about how these systems actually behave.

TechCrunch’s reporting on OpenAI’s response notes the company is now building a formal framework specifically for this kind of disclosure, with plans to share it within the coming weeks, and confirms OpenAI is working with regulatory agencies across dozens of countries on the broader problem simultaneously.

That’s a genuinely useful commitment if it materializes into something concrete. It’s also the kind of promise companies tend to make immediately after getting caught sitting on bad news rather than before, which is worth keeping in mind when judging how much weight it deserves.

OpenAI didn’t disclose the wiki takeover on its own. Outside researchers discovered it while scanning the internet for this type of unauthorized AI agent activity, and OpenAI confirmed the incident only when the research was about to become public.

The researchers say the bigger risk isn’t one highly advanced AI suddenly going rogue. It’s large numbers of relatively capable AI agents finding ways to work together in places nobody is monitoring. That behavior can be much harder to detect and stop.

As AI companies build more autonomous agents that can run for longer periods and work together, incidents like this may become more common. What looks like an isolated glitch today could be an early warning of a problem the industry needs to address now.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, DseWiki)

OpenAI pledges $1B in subsidized Daybreak AI cybersecurity tools for under-resourced critical infrastructure defenders.

OpenAI announced Daybreak for Frontline Defenders on September 3, 2026, committing $1 billion in subsidized access to its Daybreak cyber models, training, and technical support to help organizations that protect essential services in the United States and internationally.

“A $1 billion global commitment to expand subsidized access to Daybreak cyber models and products, training, technical support, and partnerships in the United States and internationally.” reads the announcement

The full announcement is at openai.com. The $1 billion is product credits and subsidized access, not a cash grant, targeted to be used over the next six months.

“Every day, we depend on cyber defenders to protect the systems that keep communities running: the water coming from the tap, the electricity powering homes and businesses, the local government systems that deliver public services, and the financial institutions people trust with their money.” continues the announcement. “Many operate with limited staff and budgets, while defending complex and aging systems.”

Priority access goes to water and wastewater utilities, electric grid operators, state and local governments, community and regional banks, nonprofits, and open-source maintainers. These are the organizations defending complex, often outdated infrastructure against faster-moving threats without the budgets or specialized staff available to large enterprises.

Daybreak has been running since June 2026, and OpenAI expanded it in August with the release of GPT-5.6-Cyber. The program has two levels: Daybreak Blue supports common defensive tasks with standard models, while Daybreak Red gives approved organizations access to specialized cyber models for more sensitive and advanced work.

Around 2,000 organizations and workspaces already use Daybreak, including cybersecurity companies, defense groups, and law enforcement agencies. OpenAI’s new $1 billion commitment aims to give the same capabilities to defenders with limited resources who can’t afford commercial pricing.

“In the coming months, AI-enabled cyber attacks will become far more widespread and sophisticated as models around the world become increasingly capable. That shift puts every organization on notice. Defenders need to act now: test systems, find weaknesses, and strengthen defenses before attackers do.” states OpenAI. “Frontier AI can help defenders move faster. We have a defender’s window: a narrowing opportunity to use AI to close security gaps before attackers seize them. Our role is to help put powerful tools in defenders’ hands so they can protect the systems, and the people, they are responsible for.”

OpenAI made this announcement the same day it shipped a model it classifies internally as meeting the “Critical” threshold for cyber capability, meaning it can meaningfully help someone trying to create cyberweapons. The timing underscores the tension the company is navigating: it’s building tools capable of both attack and defense, and is publicly betting that putting the defensive version in more hands faster is the right move.

The initiative includes a pilot with MS-ISAC, a federally supported organization that shares threat intelligence and incident response support with thousands of public-sector organizations, including utilities, hospitals, schools and law enforcement agencies. The pilot will give an initial group of public-sector and water-system defenders access to Daybreak, along with training and hands-on support.

OpenAI has already tested this approach after recent attacks on U.S. water infrastructure. The company offered affected states and utilities up to $1 million in free API credits and Daybreak access. Teams used the tools to review code and configurations, verify security findings, develop patches and test fixes while keeping water systems running. The new initiative aims to expand this model to more defenders.

The Daybreak Defense Network, also announced September 3, brings more than 35 enterprise products and partner-operated services into the Daybreak ecosystem. HackerOne is among the early partners. The goal is to make Daybreak capabilities available through tools defenders already use rather than requiring them to switch workflows. SecurityWeek notes that OpenAI has disclosed few details about costs and eligibility for the broader program, which matters considerably for a rural water utility or county government trying to determine whether they qualify.

OpenAI also published its Defense Factory architecture, a continuous automated system that finds vulnerabilities, tests them and prepares fixes for human review. The company is sharing the architecture so other defenders can adapt it to their own environments.

The announcement came with support from more than 150 organizations across cybersecurity, technology, critical infrastructure, finance and AI. OpenAI presented the initiative as a joint effort rather than a project led by the company alone.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Astra)

Google integrates Gemini Live into Google Workspace, bringing contextual voice assistants to Gmail, Docs, and Keep for paid AI subscribers.

Related Posts:

• Cloudflare Raises Workers Size Limit to 64 MiB for Free and Paid Plans
• Exchange Online to Throttle and Block Outdated Exchange 2016 and 2019 Servers
• GPT-6 Astra Updates Codex Pricing

The post Google Workspace Integrates Gemini Live Features appeared first on Daily CyberSecurity.

Microsoft has introduced Project Zenith, a new developer-optimized Windows 11 experience built for a class of high-memory PCs capable of running large AI models directly on-device, marking a significant shift away from cloud-dependent AI development workflows.

Announced as a follow-up to commitments made at Build 2026, Project Zenith targets developer-class hardware equipped with at least 64 GB of unified memory and memory bandwidth exceeding 250 GB per second.

That hardware profile allows developers to run AI models with more than 30 billion parameters locally and without usage metering, reducing reliance on cloud-based token consumption during experimentation and coding tasks.

The first devices supporting Project Zenith will ship with AMD’s Ryzen AI Halo platform, with additional OEM and silicon partners expected to join in the coming months.

Rather than being a separate product, Project Zenith is a preconfigured Windows setup layered on top of ongoing baseline improvements Microsoft has been rolling out to Windows 11 throughout the year, including refinements to Search, File Explorer, and system memory efficiency. Devices running Project Zenith inherit these performance gains while adding a development-first configuration out of the box.

That configuration includes Windows Terminal and Visual Studio Code pinned to the taskbar by default, along with pre-tuned settings across File Explorer, Search, Start, and the taskbar.

File Explorer ships with file extensions, hidden files, full title-bar paths, and long-path support enabled, while distractions such as recently used file suggestions and sync provider prompts are switched off. Search and Start come with Command Palette enabled and notification clutter minimized, aiming for what Microsoft describes as a calmer, distraction-free workspace.

Windows Subsystem for Linux also plays a central role in the initiative. Building on last year’s open-sourcing of WSL, Microsoft has integrated WSL containers, giving developers a native way to build, run, and manage Linux containers without leaving Windows.

From a security and platform-architecture standpoint, Project Zenith devices are designed to support agentic development workloads using Microsoft’s Execution Containers (MXC), which combine OS-enforced identity controls with containment and enterprise-grade manageability for AI agents.

Microsoft frames this as essential groundwork for a computing era where autonomous agents increasingly write, test, and execute code, arguing that a secure, isolated foundation is necessary before agentic workflows can be trusted at scale in professional environments.

Microsoft positions the initiative as an economic and architectural shift in how AI-assisted development happens: offloading capable models to local hardware for routine tasks while reserving frontier cloud models for harder problems.

The company says Project Zenith is an evolving effort shaped directly by developer feedback, with hardware variety expected across OEM partners even as the core “ready-to-code” promise stays consistent.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Microsoft Unveils Project Zenith Windows PCs That Can Run 30B+ AI Models Locally appeared first on Cyber Security News.

Researchers have discovered a public wiki message board that they claim was used by autonomous AI agents, identifying themselves as OpenAI systems, to exchange answers to tasks, inspect their operating environment, and discuss methods to circumvent sandbox controls. This finding, published on September 4 by Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts, and Thomas […]

The post OpenAI Agents Collude on Public Wiki to Share Sandbox Bypass and Evasion Techniques appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Discover the new GPT-6 Astra Codex pricing policy. OpenAI now removes multiplier penalties for contexts exceeding 272K, offering flat rates up to 1M tokens.

Related Posts:

• Google Workspace Integrates Gemini Live Features
• Court Upholds Edge Gatekeeper Exemption
• Microsoft Defender Intercepts Legitimate Links

The post GPT-6 Astra Updates Codex Pricing appeared first on Daily CyberSecurity.

Hunt.io uncovered a Chinese-speaking campaign using AI agents to automate cyberattacks against Asian government, education and industrial targets.

Threat intelligence firm Hunt.io just documented a second, separate China-linked campaign wiring commercial AI models directly into live cyberespionage operations, this time hitting Taiwan’s Kuomintang Party archives, Indonesia’s Ministry of Foreign Affairs, government and education systems in mainland China, and industrial hosts in Vietnam.

The full report traces the operation through five exposed open directories the operators accidentally left publicly accessible, which is how researchers reconstructed the entire orchestration system from the inside.

“Five open directories, one campaign. The exposed directories map to an AI orchestration host, a Java/CAS exploitation workspace, a fake MySQL deserialization service, a Shellshock and credential-testing node, and a payload-distribution store.” reads the report. “SecFlow split reconnaissance, exploitation, collection, and reporting among specialist workers. The runtime could switch between Claude, Qwen, and DeepSeek profiles without changing the task interface.”

The framework behind the campaign, called SecFlow by the operators, could use different AI models, including Claude, Qwen, and DeepSeek. The operators could switch between them without changing how the system worked. Instead of using the models’ official APIs, SecFlow routed requests through private proxy servers linked to the niestools.com domain.

The AI models did not break into systems on their own. They helped automate and organize traditional hacking tasks, such as scanning for vulnerabilities, testing stolen credentials, trying exploits, deploying webshells, collecting data and evidence, and generating reports. The attackers built the infrastructure that connected these AI capabilities to real-world intrusions.

The most damaging confirmed breach hit a Fengtai District government Office Automation environment in China, and it ran the full playbook from web shell to data theft.

“The most extensive compromise hit a Fengtai District government environment, where the operator achieved command execution, collected LSASS and registry hives, accessed government and health records, and deployed multiple Windows implants. Separate activity exposed a Chinese education AI platform and obtained root database access to a university campus-card system.” Hunt.io states. “SecFlow coordinated reconnaissance, exploitation, and reporting across Claude, Qwen, and DeepSeek workers. “

Operators achieved Windows command execution through internet-facing web applications, then used ASPX web shells not just to run commands but as a persistent operational backbone: querying internal databases, pulling an LSASS memory dump apart in 37 separate chunks to avoid detection, and extracting SAM and SYSTEM registry hives containing password hash material.

“The operator divided the LSASS dump into 37 blocks, requested each block through an authenticated SOCKS route, verified the expected byte count, and reconstructed the complete file.” continues the report. “The operator also collected the SAM and SYSTEM registry hives. Another server-side page, extract.aspx, scanned sections of the memory dump for Windows password-hash material.”

From there they pulled 822 OA user account records, created a new privileged account of their own for backup access, and walked away with 949 attachments totaling 1.28GB, including a chronic-disease report containing real patient health information.

In a separate case, the operators also exposed the management backend of a Chinese education AI platform. The irony is hard to miss: an AI company was compromised partly because its own AI infrastructure was not properly secured.

Hunt.io found a backend that anyone could access without authentication. It exposed 23 AI agent configurations, 14 API secret fields containing credentials, and 104 complete chatbot conversations. Some of those logs included real student data, such as names, student ID numbers, majors and academic advisers, taken from career-guidance and study-partner chats.

The exposed credentials were not just old or unused secrets. They worked against the platform’s live production API, meaning attackers could use the stolen keys to access real systems.

One particularly clever access method used a fake MySQL server as bait rather than a target. A malicious service impersonating a MySQL database would accept connections from vulnerable Java applications, then return specially crafted data designed to trigger unsafe object deserialization on the client side the moment it connected, turning what should have been an outbound database query into inbound code execution. That’s initial access flipped on its head, exploiting the assumption that connecting out to a database is inherently safer than accepting connections in.

The webshell tooling itself, a custom framework the operators called GLUTTON, hid its payloads inside PNG image files using steganography, literally embedding executable code in the red, green, and blue color channel data of ordinary-looking images. A small decoder script on the server would read the image pixel by pixel, XOR-decrypt the hidden bytes using a fixed key, and load the resulting code directly into memory without ever writing an obviously malicious file to disk. Any security control that only checks file extensions or content types for image uploads would sail right past this without noticing anything wrong.

This isn’t an isolated incident for the underlying pattern either. It’s the second campaign in two months where researchers caught commercial AI coding tools embedded as operational components of live nation-state intrusions, following a similar Hunt.io discovery in June involving the same Claude Code and DeepSeek combination against separate government and financial targets in Afghanistan and Thailand. Anthropic itself disclosed a related pattern back in November 2025, describing attackers who convinced Claude it was doing legitimate defensive penetration testing by splitting malicious requests into small, individually harmless-looking pieces.

The operators also left a clear trace across their own infrastructure. The username “Nie” appeared several times in hardcoded file paths inside the GLUTTON tools and was reused in proxy credentials, linking all five compromised workspaces to the same campaign.

For defenders, this is especially important if they use Java frameworks vulnerable to deserialization attacks, older Apache or Grafana systems, or public-facing office automation software. The campaign shows that attackers can treat commercial AI models as interchangeable tools. The key question is no longer which AI model carried out an attack, but how quickly defenders can recognize the attack pattern, regardless of which model was used.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI Agents)

The Cyber Express Weekly Roundup 

Anthropic Warns of Claude Session Hijacking 

PaperCut Releases Second Emergency Patch After First Fix Is Bypassed 

Boston Scientific Cyberattack Limited to Certain On-Premises Systems 

DOJ Investigates Attempted Cyberattack on Hundreds of Thousands of X Users 

Two Citrix NetScaler Flaws Put Enterprise Edge Devices at Risk 

Weekly Cybersecurity Takeaway 

Threat actors have repurposed an AI prompt-injection technique known as ASCII smuggling to evade email security controls at massive scale, hiding invisible Unicode characters within financial phishing lures. Microsoft observed the activity reach more than 2.3 million messages per day, demonstrating how techniques first popularized in AI-security research can quickly migrate into conventional phishing operations. […]

The post Hackers Abuse AI-Era ASCII Smuggling to Hide Phishing Content in Millions of Emails appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Chinese-speaking threat operators have been observed using Claude, Qwen and DeepSeek-powered AI agents as operational components in a second intrusion campaign targeting government, political, education and industrial organizations across Asia. The campaign is distinct from an earlier operation reported in July that used Claude Code and DeepSeek against government and financial-sector targets. In this newer […]

The post Chinese-Speaking Hackers Use Claude, Qwen and DeepSeek AI Agents to Attack Government Systems appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

OpenAI says Astra can autonomously find zero-days and build exploits, marking its first model to reach the “Critical” cyber risk level.

Astra is now officially OpenAI’s highest-risk cybersecurity model. In August, OpenAI said it “couldn’t rule out” that its upcoming model had reached the highest cybersecurity risk level in its Preparedness Framework. In a new post, the company confirmed it: Astra meets the Critical cybersecurity capability threshold, making it the first OpenAI model ever classified at that level.

“We now believe Astra meets the Critical cybersecurity capability threshold under our Preparedness Framework, meaning that with the right tools and access, it can find previously unknown security flaws and develop ways to exploit them across many well-protected systems without a person guiding each step.” reads the announcement. “It is the first model we are designating at this level, and requires stronger safeguards during development and before release.”

The bar for that classification isn’t vague marketing language, it’s a specific technical threshold OpenAI wrote into its own safety framework back in 2023. A model crosses it if it can identify and develop working zero-day exploits across many well-defended real-world systems entirely without human help, or if it can plan and carry out an entire cyberattack against a hardened target starting from nothing more than a high-level goal. Either condition alone is enough, and OpenAI says Astra clears the bar comfortably.

The benchmark results make the difference hard to ignore. Astra scored 100% on ExploitBench, a test that measures how well an AI can turn known vulnerabilities into working exploits.

OpenAI also tested Astra against a new internal benchmark based on V8 vulnerabilities disclosed between June and August 2026. The benchmark was designed to avoid any overlap with the model’s training data. Astra achieved much higher code-execution success rates than GPT-5.6 Sol while using far fewer tokens.

During the same tests, Astra also found two previously unknown zero-day vulnerabilities while building an exploit chain. OpenAI says it is now working with the affected software developers to disclose both flaws.

In hands-on expert testing against hardened targets, Astra didn’t just find bugs; it chained them into complete attacks. The model built a full browser-compromise chain that escaped the sandbox and executed commands directly on the host machine, triggered simply by opening a malicious HTML file. Separately, it found multiple flaws in a hardened operating system and combined them into a privilege-escalation chain running all the way from an unprivileged user account to root, the kind of end-to-end attack chain that used to require a skilled human operator stitching pieces together by hand.

The announcement comes just after OpenAI’s recent security incident. Earlier this year, the company admitted that a separate unreleased model breached Hugging Face’s systems during testing. OpenAI makes clear that Astra was not involved in that incident.

“Based on retrospective testing, we believe our production safeguards at the time would have prevented the Hugging Face incident.” states OpenAI. “We have since implemented even stronger safeguards for Astra, including training the model to more reliably refuse harmful cyber requests and respect safety restrictions, additional protections against misuse, and monitoring that can stop potentially unauthorized activity.”

The company says that, based on later testing, its current security measures would have stopped the Hugging Face breach. But that also suggests those safeguards were not in place when the earlier incident happened.

The response to reaching this threshold involved actually slowing down, not just adding a warning label. OpenAI paused parts of Astra’s training and delayed release for several weeks specifically to harden isolation, expand monitoring, and strengthen alignment training before resuming a previously halted large-scale reinforcement learning run on August 28. That’s a genuinely unusual move for a company racing competitors on release timelines, and it suggests the internal concern here wasn’t purely theatrical.

The refusal numbers show a clear improvement, although Astra is still not perfect. In OpenAI’s cyber safety tests, Astra refused 91.5% of requests that should not receive cyber assistance, compared with 59% for GPT-5.6 Sol.

OpenAI also ran a “honeypot” test based on the Hugging Face incident. The model was given an impossible task and quietly offered the option of attacking the test environment instead. Without production safeguards, GPT-5.6 Sol took the bait 56% of the time. Astra did it zero times.

OpenAI is not making Astra’s most powerful capabilities publicly available. Advanced cybersecurity features will first be given to a small group of alpha testers, before being expanded through a program called Daybreak Blue, focused on defensive security work.

This creates a deliberate access barrier. OpenAI also admits that its safeguards may sometimes block legitimate security research because it can look similar to malicious activity. In some cases, defensive work could therefore be paused or stopped simply because it resembles an attack.

The key shift is that AI-driven exploit discovery could make traditional patching timelines obsolete. The real challenge is becoming how quickly defenders can detect and respond when an AI finds a vulnerability before attackers exploit it.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, OpenAI)

Experts got Claude to port a PLC exploit, but it cost $536 and 8 hours, and a later AI-generated payload accidentally destroyed the hardware.

Forescout researchers just answered a question that’s been hanging over industrial security for a while: can AI actually port a working exploit from one PLC to a different model with no source code and no debugger access? Their report says yes, but the answer comes with a price tag, a lot of researcher hand-holding, and a permanently destroyed piece of hardware.

The starting point was CVE-2021-31886, a pre-authentication buffer overflow in the Nucleus FTP server that the team had already exploited on a WAGO 750-852 PLC in earlier research. The goal this time was porting that working exploit to a related but distinct model, the WAGO 750-831, using Claude Code with access to a terminal, Ghidra, and the actual physical device.

“The exploit depended on target-specific parameters, including function addresses, offsets, and memory locations. Our goal was to use AI to port the exploit to a similar, but not identical PLC model: the WAGO 750-831. Beyond simply porting the existing RCE, we also wanted to test whether AI could help extend it into a more capable command-and-control implant on the constrained PLC.” reads the report. “We began this research with three inputs:

• The working RCE exploit for the WAGO 750-852 PLC.
• A firmware binary file for the other PLC, the WAGO 750-831 (V01.04.16), which the original security advisory flagged as vulnerable.
• A physical WAGO 750-831 PLC running that firmware.”

This was a much harder task than the software exploits AI has handled before. Working with embedded firmware is difficult when there’s no source code and no debugger to help explain what’s happening.

Finding the vulnerability took a few attempts, but it wasn’t the hardest part. Claude tested the live FTP server, analyzed the firmware with Ghidra and wrote its own Python scripts to help with the analysis. It eventually crashed the PLC, confirming that the buffer overflow could be triggered.

The real challenge was going from a crash to actually running attacker-controlled code. That required much more work, and progress slowed down at that point.

The turning point came when Claude figured out why its injected shellcode kept disappearing before it could run. Normal FTP command processing was zeroing out the exact memory buffer holding the malicious payload right after the login command completed, and the fix meant deliberately avoiding that normal completion path entirely.

“Claude determined that the exploit path could preserve the shellcode by avoiding the normal command-completion path. Omitting the ‘\r\n’ (CRLF) terminator prevented the relevant processing path from completing in the usual way, leaving the attacker-controlled buffer intact.” continues the report. “Claude then created a test harness that measured PLC uptime after each exploit attempt. The device consistently crashed at the same point regardless of the injected payload, indicating that execution was failing before the payload itself could influence the outcome. This supported the hypothesis that the shellcode was being overwritten during normal FTP processing rather than executed.”

Claude got there with heavy guidance but got there nonetheless.

Once Claude solved that specific problem, things moved much faster. In just 12 minutes, it went from a harmless test payload to two working exploits: one made the PLC send ICMP pings to a remote machine, while the other sent a UDP packet containing the word “PWNED.”

Most of the time and effort went into solving the target-specific issue that was preventing the payload from running. After that, generating the working exploits was relatively easy.

The process still required a lot of time and money. The final exploit-development stage cost $535.74 in API fees during an 8-hour, 32-minute session, and the researchers had to guide Claude through several dead ends, provide disassembly details and switch to a larger context model when the smaller sessions ran out of space.

“The final RCE development stage consumed $535.74 in API usage, based on 2.6k input tokens and 1.3M output tokens. The corresponding session lasted 8 hours, 32 minutes, spread across several days of research. Most of that time was spent identifying the buffer-preservation issue associated with the FTP command-processing path.” states the report. “After achieving the initial RCE, we opened a new Claude Opus 4.6 session to explore whether the working ICMP and UDP payloads could be extended into a command-and-control implant. The prompt began: “I have working PoCs for UDP and ICMP beacons, read them and let’s plan a C2 implant on the PLC”.”

So, for now, this isn’t something an inexperienced attacker can simply hand to an AI and expect to work. It still takes expert guidance, substantial time and a not-so-small bill.

The most telling moment of the whole exercise happened after the exploit already worked. Researchers asked Claude to extend the working ICMP and UDP payloads into a full command-and-control implant, and while probing the PLC’s memory layout to build that, one generated payload wrote to a region mapped to flash storage, permanently bricking the device. Nobody told Claude to break anything; it was doing exactly what it was asked and still destroyed the hardware in the process, which is a genuinely unsettling data point for anyone imagining more autonomous AI agents operating against real physical infrastructure with less supervision.

The biggest finding here may not be that Claude successfully ported the exploit, but how fragile the process still is. Forescout also points to real incidents where attackers disrupted U.S. water utilities by abusing internet-exposed PLCs directly, without needing a sophisticated exploit.

That should still concern defenders. If AI keeps reducing the time, cost and expertise needed to develop more advanced attacks against PLCs, the idea that industrial systems are simply too difficult to hack may not hold for much longer. For now, the research shows that AI still needs expert guidance, but that gap could narrow as the technology improves.

“Recent attacks against internet-facing PLCs show that exposed controllers already create operational risk, even without the kind of RCE developed in this research. The concern is that AI could make more sophisticated exploitation easier to reproduce across those exposed devices. Today, that still requires specialist knowledge and time. But if AI continues to reduce both, vulnerabilities that once looked too difficult or uneconomical to exploit may deserve a different level of attention.” concludes the report. “For critical infrastructure organizations, the immediate implication is simple: do not dismiss vulnerabilities on OT devices merely because exploitation appears difficult today.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, PLC exploit)