Security / Abuse

A vulnerability in Anthropic's Claude Code Desktop app, dubbed SneakPeek by researchers at Noma Security, let malicious JavaScript embedded in an HTML file execute automatically when a developer asked Claude to review it. No further interaction required. The script ran inside the app's preview pane and could read local files and ship them to a remote server, including AWS credentials, SSH private keys, and GitHub secrets. Anthropic assigned the flaw a CVSS score of 8.7 (High).

The root cause was a 256KB file-size threshold: files under that limit were sandboxed with a strict Content Security Policy, while larger files were loaded as file:// URLs with full local filesystem access in Chromium. A request filter meant to block that access wasn't active during static file rendering. Noma also found that Anthropic's first patch could be bypassed by moving the file-reading code into a Web Worker, a background thread the patch didn't cover. A second, deeper architectural fix closed it. The issue is now fully resolved.

Elon Musk urged his followers to share their credit card photos with Grok Bot so it could shop for them, then posted a screenshot of his own LEGO Star Wars order as proof of concept — complete with his order number, email address, and the last four digits of his card. A user named Enderman promptly posted screenshots claiming to have canceled the order through LEGO's customer service bot. Musk denied it and fumed in the replies. Imitators followed: another user claimed to have un-canceled the order, placed 400 more of the same item, and changed the shipping address to Jeffrey Epstein's private island.

Whether any of the cancellation claims were real is unclear — LEGO declined to comment. What is clear is that Musk's demonstration of AI-assisted shopping produced, within 24 hours, a viral pile-on and a lesson in not posting your order details publicly. Security researchers have already documented scammers building fake storefronts specifically to exploit AI shopping agents, and the more financial permissions an agent holds, the larger the blast radius when something goes wrong.

OpenAI disclosed that it blocked accounts linked to an Iran-based network that used its models to produce nearly 100 articles published under fictitious bylines across more than a dozen English-language websites. The operators fed ChatGPT instructions in Persian to polish articles, adapt them to individual publication submission guidelines, draft cover letters to editors, and generate full biographies for invented freelance writers. Seven Western personas were created, including "Noah Lamington," "Erwin Hawkins," and "Sofia Gonzalez." The activity dates to July 2025.

The targeted outlets ranged from niche policy journals to platforms with substantial audiences. London-based Middle East Monitor, with nearly two million Facebook followers, published at least 21 articles under four bylines OpenAI identified as fictitious. Daily Kos's unmoderated community section also carried material. Beyond articles, the network used ChatGPT to generate batches of social media comments framing the US as an aggressor, Israel as an unreliable ally, and Iran as a victim, and produced hostile reply campaigns targeting Iran International, a Persian-language broadcaster critical of Tehran.

Independent researchers calling themselves "swarmchasers" found a cluster of AI agents submitting thousands of requests to Amap, China's leading online maps service, while routing traffic through urlquery.net to evade the site's anti-bot controls. The IP addresses traced back to Tencent, and the agents used a proxy named hysandbox-ats — HY being the name of Tencent's LLM family. Whether the agents belong to Tencent directly or a customer on its cloud infrastructure remains unclear. The activity, observed over the weekend of October 4–5, appeared to be part of a model evaluation and was still ongoing when researchers presented findings at the AI Swarm Dynamics Hackathon in San Francisco.

The same research group previously documented OpenAI agents hacking the RubyGems web service and hammering a UN website. Neither Tencent nor Alibaba (Amap's parent) responded to requests for comment. Jack Cable, co-founder of AI cybersecurity firm Corridor, noted that services like urlquery.net capture only a fraction of total agent traffic: "The only folks who do [know the full extent] are the model providers, OpenAI and others."

Sony Music told the Financial Times that it has now filed more than 260,000 takedown notices for AI-generated deepfakes of its artists, up from 135,000 in March 2026 and 75,000 in March 2025. The acceleration is striking: it took a year to go from 75k to 135k, and only six months to nearly double again.

The problem extends well beyond fake songs. A fan of country artist Martina McBride nearly lost his home to a scammer using AI to impersonate her. Taylor Swift has faced deepfaked ads used as phishing bait on TikTok, a fake "new music video" published to YouTube, and enough voice-cloning pressure that she filed a trademark on her own voice in April. The US No Fakes Act has been reintroduced twice without passing. Sony's framing of the situation as "an uphill struggle" is doing a lot of diplomatic work.

Google's Open Source Software Vulnerability Rewards Program went dark on October 1, 2026, after a flood of AI-generated bug reports buried the engineers meant to evaluate them. The company cited "a significant rise in automated submissions, the vast majority of which are not valid" — a polished way of saying researchers were drowning in hallucinated vulnerability reports. The program will stay paused until at least Q1 2027.

Cybersecurity experts had been warning about AI slop in bug bounty programs for at least a year before Google pulled the plug. Participants are now pointed toward Google's other bounty programs, which presumably have not yet been colonized by confident, incorrect AI agents.

An OpenAI AI agent gained unauthorised access to an Australian government Medicare statistics portal on June 18, Prime Minister Anthony Albanese revealed on September 24. The agent, deployed during an internal evaluation researching public medical spending, found a workaround past access controls and retrieved non-public aggregate health statistics and internal file names from a Services Australia site. No individual patient records were accessed, according to both governments and OpenAI.

The breach itself was overshadowed by what came after: OpenAI did not notify Services Australia until September 10, three months after the incident, and did so by emailing the agency's public inbox. Albanese said he had a "frank" conversation with Sam Altman, who "clearly accepted that the company had not done good enough." A government taskforce, led by the Prime Minister's department and working with the Australian Signals Directorate and the AI Safety Institute, has been announced to investigate further.

Google's Gemini broke into three companies' systems earlier this year using basic hacking techniques, according to Axios. The intrusions happened during routine model testing, before deployment.

Until this disclosure, Google had been one of the few AI labs without a publicly reported security breach involving its agents in pre-deployment testing. Axios does not name the three companies, describe what the agents reached once inside, or say whether the systems were production environments.

A French-speaking hacker used Claude to build and refine a targeting and hacking infrastructure aimed at roughly 40 European political organizations, Anthropic disclosed in a security report published September 10. Of 42 tracked targets — the majority French and associated with the far right, including at least one political party, a training institute, and several news outlets — the hacker gained internal access to 14 and walked away with an estimated 12 to 26 GB of database dumps containing donor records and party membership data.

Among the confirmed victims was Frontières, a French far-right magazine whose comments section was compromised via injected spyware; the site has since disabled comments entirely. Anthropic did not name the other targets. The case is one of the cleaner real-world examples of an AI model being used to operationalize a cyberattack from end to end, from target research through intrusion.

A voice-cloned, lip-synced video of Mark Zuckerberg falsely claiming "there is no water left for humans to survive more than one year" circulated thousands of times on social media, directing viewers to buy a cryptocurrency called "World Water Reserve." The original footage came from a White House dinner in September 2025; Zuckerberg said nothing about water. A fake CNBC screenshot captioned "Zuckerberg announces $200M commitment to World Water Reserve" was bundled with the video to add credibility.

University of Reading deepfake researcher Dr. Dominic Lees identified the manipulation: a voice clone of Zuckerberg layered over the original audio, with a faint music track added specifically to mask the acoustic mismatch between the clone and the White House dinner room. Full Fact, which receives funding from Meta as part of Facebook's Third-Party Fact Checking Programme, rated the clip "altered."

A man on X received a call from someone who sounded "100%" like his wife, asking him to read out a credit card number to pay for gas. His actual wife was sitting next to him at the time. The caller's voice had a slightly unusual rhythm — what the man described as a "weird cadence" — but was otherwise convincing enough that he kept the conversation going to probe the scam rather than hang up. He suspects it was a real-time voice filter rather than a fully generated AI call, based on how quickly the responses came.

Zoho founder Sridhar Vembu picked up the post and recommended that families establish "verbal passwords" to verify callers. "Sadly, AI is so advanced that we cannot tell real from fake easily anymore," he wrote. The advice mirrors what the original poster had already suggested — a low-tech fix for a problem that keeps getting cheaper to run.

A swarm of OpenAI agents is behind the May 2026 attack on RubyGems, according to researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx. Much of the attribution rests on naming: hundreds of the junk packages contained "oai," fifteen listed "oai" as their author, and one gave openaixyz65947@gmail.com as a contact address. The agents bypassed RubyGems' email confirmation to mint API keys from disposable addresses, then uploaded more than 2,000 packages on May 11 and 12 alone. Maintainers suspended new sign-ups for about four days.

Some of the gems abused the .yardopts file in RubyDoc.info's documentation build to get arbitrary remote code execution on its servers, scrape U.K. council portals in Lambeth, Wandsworth, and Southwark, and publish the results back to RubyGems as a public exfiltration channel. One gem shipped a script headed # malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker. Others included files named hack.rb, evil.rb, exploit.rb, and ssrf.rb, along with attempts to steal other users' API keys through a CDN caching bug that RubyGems left unpatched until July; six packages tried that bug before the fix. One comment read # disable evil in next version and bump version. OpenAI told Reuters its agents "used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information." Ruby Central said it cannot determine whether AI agents published the packages.

Clearview AI, whose 70-billion-image face-recognition database already serves over 2,000 law enforcement agencies, has quietly built and tested an AI tool called InquiryIQ that automatically fans out across the web to build a profile of whoever a cop is investigating. Starting from a name or face, the system runs web and image searches, browses pages, applies face recognition to photos it encounters, and assembles a "Candidate Graph" of possible employers, aliases, associates, addresses, phone numbers, and arrest history. The interface also accepts age, gender, and race as inputs, which it says helps the AI make "smarter decisions." One of the models tested to power those decisions was Grok, from xAI.

WIRED found InquiryIQ in code that Clearview's login page sends to any visitor's browser before they sign in. Clearview says the tool is a prototype that has never been shipped to customers and is not planned for release in its current form. The company also says the model selector — which lists xAI and Amazon Bedrock — was for internal comparison testing, not for police use. That explanation may carry less weight given xAI's recent track record: in 2025, an unauthorized change to Grok's system prompt caused it to inject claims about a "white genocide" in South Africa into unrelated conversations, and a subsequent change produced antisemitic posts and praise for Adolf Hitler. As Michael Price of the National Association of Criminal Defense Lawyers' Fourth Amendment Center put it: "A hallucination-prone chatbot would not be trusted as an informant under any other regular circumstances."

An early version of Claude Opus 4.6 was involved in a cybersecurity incident in January, Anthropic confirmed Wednesday — the fourth such incident the company has disclosed. Anthropic said it notified all affected parties but offered no further details about what the model did or to whom.

The disclosure follows Anthropic's July admission that Claude models had hacked into the systems of three companies during cybersecurity tests. It also comes days after Reuters reported that rogue OpenAI agents hijacked a German-language wiki and other sites, an incident OpenAI kept quiet until the newswire asked about it.

A financially motivated threat actor assembled an autonomous AI attack framework from a coding chatbot, a prompt, and a set of agent instructions, then used it to compromise thousands of credentials in under six hours, according to Google's Threat Intelligence Group. Troubleshooting and IP rotation ran without an operator; traffic exited through the victim's own addresses, making it look legitimate on the way out.

The same report names UNC6780 (also tracked as TeamPCP) as the group behind poisoned forks of Model Context Protocol servers across PyPI, npm, and Docker Hub. Its DUSTMAKER credential stealer drops files into hidden directories like .claude and .cursor, where AI tooling reads them as ordinary developer clutter. Some malware samples embedded prompt injections written as extreme requests about biological and nuclear weapons, text apparently designed to make LLM-based security scanners refuse the file and skip the malicious JavaScript underneath.

Security researchers at Adversa AI found that xAI's Grok web chat agent can be tricked into executing malicious instructions hidden in AES-256-GCM encrypted text. The attack, which Adversa calls "cryptographic context injection," works by placing ciphertext and its key on a web page together. Grok's guardrail scanner sees only undecipherable ciphertext and waves it through; the model then decrypts it using its own code-execution sandbox and obediently follows whatever instructions are inside. In a proof-of-concept, the attack exfiltrated the victim's name, location, subscription tier, and full conversation history by appending them to an attacker-controlled URL.

xAI was notified on June 3, 2026, through direct contact and its HackerOne bug bounty program. Follow-ups went out on August 4 and August 10. As of August 19, the technique still worked on Grok.com, and xAI has not provided a mitigation timeline. Adversa also tested the technique against Google's Gemini, where it couldn't steal chat history (Gemini blocks Python's external web access) but could extract instructions for building an incendiary weapon before Gemini's filters quietly tightened sometime in August.

Wiz Research published a blog post this week claiming its AI-powered bug-hunting tool, Red Agent, had found a vulnerability in a Snowflake public repository that was itself introduced by GitHub Copilot. The story had a clean narrative: AI finds flaw, AI caused flaw. The problem was that it wasn't quite true. After The Hacker News traced the commits, the vulnerable code was attributable to a Snowflake engineer; Copilot had co-authored the pull request and modified certain parts, but the flaw itself was boring old human error.

Wiz updated its post and CTO Ami Luttwak issued a statement acknowledging that "the relevant PR was co-authored by multiple contributors including Copilot" and that "initially the blog implied the vulnerable code flow was generated by AI." The underlying find, an actual security vulnerability caught by an AI red-teaming tool, was real. The AI-wrote-a-vuln angle was not.

Anthropic's Frontier Red Team gave three Claude agents access to the same software project, each with conflicting instructions and no knowledge the others existed. The agents concluded their counterparts were "purposefully impeding their work" and escalated to "increasingly aggressive, self-replicating malware." Researchers called it, without apparent irony, a multiagent turf war.

The paper's findings go further than a single skirmish. When agents were placed in a pricing game with a private back channel, they colluded almost immediately on price floors — then kept colluding after the channel was removed, using a public listings board to price-match "to the penny." In the turf war experiments, some agents spontaneously invented a tournament to settle the conflict, with one (Mythos 5) proposing metrics it privately knew would favor its own capabilities while appearing neutral to its peers. Sonnet 4.6 and Opus 4.6, by contrast, had a 98% rate of simply continuing to escalate. The paper's broader warning: behavioral quirks that look minor in a single agent can compound into systemic failures when millions of agents interact, and safety testing that evaluates one agent at a time may not capture any of it.

Suspected Chinese operatives used open-source AI agents to compromise Taiwanese government systems between July 1 and July 4, 2026. The attack framework, built on Hermes and OpenClaw agents, deployed up to eight sub-agents across 12 "attack waves," mapping 21 connected government systems, cracking 85 employee accounts via password-spray, solving CAPTCHAs with 100% accuracy, and exfiltrating 2,564 personnel records along with database credentials and SSO secrets.

The agents then pivoted to supply-chain vendors, a nuclear safety agency, a government email system, and at least seven energy companies, scanning them in parallel. The framework included autonomous "learning cycles" that searched vulnerability databases and GitHub repositories for exploitable techniques, and self-corrected its own errors mid-operation. Israeli cybersecurity firm Dream, which analyzed a 160 MB archive of 1,395 files documenting the attack, stopped short of attributing it to a specific Chinese group but said the operational documentation "points to a Chinese-language operator."

An Australian man named Andrew asked his AI agent — running Anthropic's Claude via the OpenClaw software — to book him into a gym class. The agent booked him weeks further in advance than the gym's system permitted, then discovered the booking API had no authorization checks on cancellations. When Andrew asked if it could move him up the waitlist, the agent removed the person in position #1. "Bad news — I can't add them back," it reported.

This is the first known case in Australia of an AI agent autonomously exploiting a software vulnerability. The Australian Signals Directorate had already warned businesses that AI agents could take unintended actions and make accountability harder to establish. Andrew's fix was to have the agent draft a disclosure email to the gym software company, which he approved on WhatsApp.