An Anthropic AI model submitted a fabricated tip about an unsolved homicide through an online form run by the Philadelphia Police Department (PPD). The tip, filed July 18 through PhillyUnsolvedMurders[.]com by “someone who might have information about the case,” went straight into the inbox’s spam folder. Anthropic discovered it on September 28, notified the PPD on October 7, and sent representatives to the police HQ the following day. Anthropic told the police the AI submitted the tip during a test exercise that involved interacting with randomly selected websites. The PPD said its findings are so far consistent with Anthropic's account. Because the tip was flagged as spam, it never reached the department's Real-Time Crime Center. The PPD said officers vet all submissions, automated or otherwise, before forwarding them to investigators, and that this process safeguards against abuse of the tip system. It added that this does not “diminish the seriousness” of an AI submitting fabricated information. “The city of Philadelphia takes this incident very seriously,” the PPD said. “The company must strengthen its safeguards to prevent similar incidents from impacting city systems without the city’s knowledge. The two-month delay in detecting and reporting the incident to the city is unacceptable.” It added: “The department and the [Cherelle] Parker administration will continue to closely monitor this incident, and will provide more information to the public as soon as it becomes available. In addition to our investigation into this incident, the Parker administration will explore all necessary regulatory protections going forward locally along with our state and federal partners.” On October 9, Anthropic published a report on this and other AI errors. The report covered four categories of AI failures, including vulnerability exploits, access to restricted data, bypassing fetch tool limits with URL shorteners, and submitting false information via web forms. Anthropic declined to name any of the affected organizations, other than the PPD after the department went public. Some cases involved local, state, and federal US government websites, though the AI company didn't say which of the four categories they fell under. The PPD did not name the model responsible, but Anthropic said Claude Haiku 4.5 was tasked with generating and performing example tasks on randomly selected web pages, and hinted at the model not being prompted specifically enough. “Claude was instructed never to log in, create accounts, enter personal data, make purchases, or submit anything destructive, but the instructions did not rule out form submissions,” Anthropic's report stated. The fake tip read: “I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant.” Anthropic said the incident was less severe than the cyberattacks over the summer. The report said: “Claude appears to have only been producing example content for the task, rather than trying to mislead anyone to achieve a goal.” By contrast, the "dishonesty" displayed over the summer was “sustained over hours” and supported continued attacks, the Claude maker said. Anthropic said it will keep reporting these failures when it detects them, and will continue fine-tuning behavioral and alignment training. The 3,095-word report contained no apology.®

Nothing sells AI products as well as fear. Using new research, Anthropic claims that self-replicating AI worms could be just months away from spreading across vulnerable IoT devices, which would be a problem if it came true. The frontier lab published a research report Monday suggesting that AI models could eventually self-replicate without relying on datacenter hardware, with a 9-billion-parameter model successfully setting up inference on eight of the nine hardware types Anthropic tested. “A replicator like this would be challenging to shut down, since there’s no centralized point to shut off,” Anthropic warned, adding that such an AI worm could also suss out the workings of unfamiliar devices, potentially making it more adaptable than conventional botnets like Mirai, Kimwolf (the representative IoT botnet threat model used in the study), and others. Anthropic’s researchers managed to get a distributed instance of Gemma4-26B-A4B running across 15 generic Android set-top streaming boxes - a common target of traditional botnet malware due to their lax security. Once up and running, the distributed Gemma4 model was able to conduct inference tasks at a blistering 0.39 tokens per second. That, says Anthropic, proves that AI models can conduct inference with their various layers distributed across cheap hardware, but it doesn't prove such a model could self-replicate. For that, the researchers turned to Z.ai’s GLM 5.2. GLM was used to propagate a copy of Llama3.1-8B across eight Google Cloud instances running an Android 15 emulator in a virtual private cloud, which Anthropic said it was able to do with a high degree of success, with the model successfully spreading to all eight nodes in four out of five trials, and seven of eight in the other. “It appears that GLM-5.2 is able to propagate Llama3.1-8B well, which suggests that future small models of the same capability level could also complete the network enumeration, payload delivery, and inference standup steps of the replication process,” Anthropic explained. Sanity check: This isn’t going to end the world, either Frontier AI labs have become adept at publishing findings that portend doom that only they can prevent. Doing more than a cursory reading of this report suggests that this threat is just as deserving of a big, honking asterisk as the rest. Take, for example, what is needed for an AI model to exploit vulnerabilities and spread to various systems. One would think that such an element would be an important part of demonstrating the danger of a self-replicating AI botnet, but Anthropic decided it didn’t need to worry about that for this study. “We largely ignore the cyber exploit element of the replication process, since earlier papers CyberGym, ExploitBench, and adaptive worms already show that small models are capable of cyber exploits, especially when given the right tools,” Anthropic explained in the writeup. In other words, the replication these models managed to achieve was done on nodes that were custom-built for this project and deliberately left open to attack, although the draggingly slow inference demonstration ran on real, inexpensive Android TV boxes. As Anthropic notes, AI models can also benefit from being given the right tools to turn them into capable cyberattack agents. There was a custom-built harness called Memento involved in this scenario too. Are IoT nodes that get hijacked by botnets famously insecure? Yes, but it doesn’t take much to prevent the most common ingress routes – that’s just good security hygiene that has nothing to do with the involvement of AI. Anthropic acknowledged that its deliberately simplified exploitation tests provided “an upper bound on real-world success.” Then there’s the aforementioned speed. Anthropic says such AI worms would be challenging to shut down, but estimates that they might take days to double in size. When Mirai appeared on the scene in 2016, it was doubling in around an hour. Anthropic points out that speed is a factor in detection and mitigation, too. AI models are not simple malware packages: They’re massive things that would eat up tons of bandwidth and quickly point to their sources. As an AI botnet grew, that traffic could become more noticeable, making infected devices easier to detect. Finally, end-to-end replication may have been successful with GLM-5.2, but that’s it. Anthropic tested other open-weight models, and they all “fail[ed] reliably,” according to the report. Anthropic didn’t mention how many models it tested. The report also mentions that GLM’s unique success has another important condition: It assumes its capabilities “could be packed into Llama3.1-8B,” stacking another assumption onto this latest house of doomsaying AI cards. “Models of 30B parameters and under can already complete many of the individual steps for replication today, though they make mistakes when composing them end to end,” Anthropic said, while noting that GLM-5.2 was capable of end-to-end replication, conveniently leaving out all the important caveats. Anthropic further admits that it has no idea "exactly what form autonomous AI replication will take,” or when it might arise, if ever. “If small models improve at their historical rate, they’ll match this capability level by the end of this year,” the company added – again imposing an essential condition on this supposed threat. “As a prediction that goes beyond our experiments, we expect a future awash with agents running on all types of hardware, including some that aren’t under human control,” the company said at the end of its report. “We should aim to harden our systems to make it difficult for such replicators to spread, but also prepare to deal with a world where they are here to stay.” Here to stay for a given value of not existing yet, of course. Yet again, a frontier lab is warning us of a threat that doesn’t exist yet – at least in this case, basic security measures could make life harder for any future AI-powered botnet. ®

Cyberattacks on supermarket refrigeration systems reportedly pushed temperatures as high as 50°C (122°F), affecting hundreds of stores in France and forcing retailers to discard food. Major supermarkets such as Carrefour, Coopérative U, Intermarché, Monoprix, and more were hit by the attacks, which spoiled perishable food and left stores without fresh produce. The affected equipment includes cold-storage units used to hold food before it reaches supermarket shelves. The criminals behind the attack raised temperatures to unsafe levels, spoiling food and in some cases starting fires. Some affected retailers used refrigeration controllers produced by Danish company Danfoss. Authorities have not identified the entry point or confirmed exploitation of the vulnerabilities previously disclosed by Claroty and patched in August 2025, although the manufacturer said affected stores were running outdated firmware. Experts say the previously identified vulnerabilities were easily scriptable and relied on a unique but predictable authentication method. Claroty found a hidden authentication mechanism in the AK-SM 800A platform that accepted a code generated from the device's current date, bypassing the configured administrator password. Anyone who reproduced the algorithm could generate a valid daily code and gain administrative access. "It's a zero-skill thing to pull off, I wrote the bash script while having a shit," said security pro Kevin Beaumont. The research demonstrated how compromised controllers could expose refrigeration systems to physical disruption, although the vulnerabilities' role in this week's attacks remains unconfirmed. Danfoss told reporters this week that the French supermarkets affected by the attacks "were running outdated firmware" and that the company has consistently advocated for keeping systems updated. The Register asked Danfoss if it would confirm whether the previously disclosed bugs were exploited to execute the attacks, and whether the same bug was also abused in August to compromise US military commissary refrigerators, which led to food losses. CERT-FR published an alert reporting numerous compromises of Danfoss AK-SM and AK-SC controllers, which were not mentioned in Claroty's original reporting nor in Danfoss's advisories at the time. The authority advised disconnecting or restricting network access. For suspected compromises, it recommended a factory reset, security patches, credential rotation, account checks, and full reconfiguration. For those wondering why fridges even need to be reachable via the internet, the main reason is that it allows central engineering teams to troubleshoot issues remotely, according to Claroty's researchers. "Industrial control systems such as refrigeration controllers are often assumed to be on safely isolated networks. However, our research found many of these devices are directly exposed to the public internet," said Amir Preminger, CTO at Claroty. "While this convenience significantly reduces maintenance costs by allowing engineers to troubleshoot issues remotely, it also lowers the barrier to entry for attackers. "Organizations must take proactive measures to ensure that management interfaces are not insecurely connected to the internet, and ensure that access to administrative services is restricted to trusted management networks or secured through VPNs and other appropriate network segmentation controls." Intermarché owner Groupement Les Mousquetaires said around 150 of its supermarkets were affected by the attacks, while Carrefour confirmed around 80 impacted stores. Monoprix said roughly 5 percent of its 490 stores were experiencing the same issues, and Coopérative U CEO Dominique Schelcher said 80 of the company’s 2,000 stores were hit, adding that the attack on the food sector was “unacceptable.” “Targeting equipment essential to the preservation of fresh products is an attack on the French food supply chain,” he said. “It is unprecedented, extremely serious, and unacceptable. We remain fully mobilized.” However, in a separate twist, Schelcher told French radio station RTL on Tuesday that Coopérative U is not a customer of Danfoss. The Register contacted Coopérative U for more information about what caused the attacks at its stores. Shodan searches for internet-facing Danfoss controller interfaces indicated that more than 4,500 endpoints were exposed as of Monday, with more than half of those located in France. Ahold Delhaize, a major grocery retailer in the Netherlands, announced on the same day that it was experiencing a "security issue." No link to the refrigeration attacks in France has been established. The end result is similar, however, as the company's grocery brands are reporting stock issues. Several of the group's brands have taken their websites offline and posted notices about the "cybersecurity incident." Stores remain open, but affected brands have reported disruption to websites, apps, customer services, and online deliveries. The disruption hit the company's distribution systems, although these are now being restored. Updates posted to social media on Tuesday told shoppers that staff were once again able to use digital shelf labels but stock levels may vary across stores, and long-life items were likely to be more abundant than fresh fruit and vegetables. The retailer previously suffered a cyberattack in November 2024 that disrupted its US operations. ®

A person claiming responsibility for the breach of Denmark's Central Register of Persons (CPR) says they gained access through an IT company's account protected by the password "123456." The person told Danish news outlet Politiken they had no intention of selling or leaking the data. The newspaper reported that at least three company accounts, including an administrator account, used the same password. Denmark's CPR administration confirmed a breach affecting the information belonging to 8.8 million people on October 5, adding that a Danish company's legal access to the CPR system was abused. It did not name Funen-based Pays ApS as the company in question, but managing director Sophie Laursen confirmed on October 9 that it's access had been exploited. Pays' website has been taken offline, and the business has not responded to The Register's request for more information about the password claims. Pays had authorized access to the CPR system to provide services such as validating business customers' records. The Danish government says information relating to 8.8 million people was accessed. The register contains approximately 11 million records, including those of deceased people and people who have moved abroad. The government did not respond to questions about the alleged password failings. According to documents obtained by broadcaster TV 2, the attacker gained access to the CPR system on September 10 and ran the 14 million automated searches between then and September 20. The intrusion was detected on October 2, 12 days after the last reported searches. Mikkel Leihardt, director of the government's higher education and science ministry, told reporters at a press conference that the attack was discovered after a department staffer picked up an invoice indicating unusually high activity from Pays. The Danish data protection authority, Datatilsynet, was notified on October 4, and the government disclosed the attack the following day. ®

The owner of Hobbs, Phase Eight, and Whistles is the latest fashion retailer to suffer a cyberattack, leaving several IT systems offline and customers facing order delays. South African retail giant The Foschini Group (TFG) confirmed on Tuesday that its UK business, TFG London, discovered a cybersecurity incident on October 11 that affected all three brands. Two days later, several systems remain unavailable, and the company is still trying to establish whether any personal or sensitive information has been compromised. The incident hasn’t forced stores to close, but TFG said some website functions may be unavailable. Customers have also been warned that orders placed on or after Sunday could be delayed, according to an email seen by The Telegraph. "Stores are open as normal but some of our brand's website capabilities may not be available as the investigation continues," the company said. "We apologize for any disruption and will provide additional updates to our customers as appropriate." TFG said it immediately activated its incident response and business continuity plans, brought in external cybersecurity specialists, and notified the relevant UK authorities. A spokesperson at the ICO told The Register: “We can confirm we have received a breach report from TFG Brands (London) Limited and we are assessing the information provided.” There is at least some good news for shoppers worried about their payment details. In an email to customers, TFG London said a third-party provider handles payment processing and that, based on its investigation so far, it has no reason to believe payment information is at risk. Whether other customer data has escaped into the wild is another matter. TFG said it is still investigating that possibility and will notify affected individuals or organizations if it finds evidence of a compromise. The company has yet to disclose how attackers gained access, whether ransomware was involved, or when it expects to have its systems fully restored, and did not respond to The Register’s questions. The disruption appears to be confined to the three fashion brands. TFG said its White Stuff and Inside Story businesses are unaffected, as are its operations in Africa and Australia, which run on separate IT systems. The attack comes during a particularly miserable spell for fashion retailers, which seem to be attracting cybercriminals almost as enthusiastically as shoppers chasing a sale. Last week, ASOS customers received an unexpected notification informing them that the online fashion retailer had been hacked. ASOS subsequently confirmed that an attacker had gained access to an employee account by impersonating a trusted contact and obtaining login credentials. Armed with those credentials, the attacker got into third-party platforms holding customer names and contact details. Meanwhile, H&M is reportedly investigating claims that it was targeted by the notorious ShinyHunters cybercrime group. According to The Times, the Swedish fashion giant is examining allegations involving a limited amount of company data, although it stressed that it had found no indication its systems had been compromised. No evidence currently links the incidents at TFG London, ASOS, and H&M, and the latter has not confirmed a breach. Still, with three major fashion businesses linked with cyber trouble in little more than a week, October's hottest retail trend appears to be incident response.®

VMware has discovered so many flaws in its products using AI that it felt the need to create a new product to help users manage them. Prashanth Shenoy, vice president of product marketing in the VMware Cloud Foundation (VCF) division of Broadcom, told The Register that VMware recently moved to deliver monthly software updates, in part to address bugs found by AI. He admitted, however, that users struggled to keep up with the pace of change before the move to monthly releases because it takes time to test the impact of patches – even though VCF allows non-disruptive live patching. Shenoy said customers therefore need "room to breathe." Enter a new tool called HyperArmor, which does three things. One is "virtual patching" – blocking attempts to exploit a vulnerability without changing the vulnerable software itself. VMware already offers virtual patching in its vDefend network security product and explains how it works by referring to CVE-2024-5806, the bug in file transfer tool MOVEIt that made waves in 2024. VMware says vDefend can detect patterns associated with attempts to exploit the authentication bypass flaw and block the traffic. HyperArmor will do similar things to block malicious traffic heading toward VCF implementations. Another job HyperArmor takes on is rejecting any actions that alter known good states in VCF. If a human approves a change, the tool will update policies to allow the altered state. The third job is multi-factor authentication (MFA). The Register put it to Shenoy that MFA is now table stakes for security. He agreed but explained that VMware designed HyperArmor to protect against attackers using stolen privileged credentials to access VMware's ESX hypervisor. To (hopefully) stop attackers using those creds to take over a host, HyperArmor requires users to input SSH credentials and a secondary time-based one-time password sent to a user with a verified identity. HyperArmor is a discrete product that VMware will sell as an add-on to VCF. That means VMware thinks its customers are going to be OK paying extra for MFA. While VMware will sell HyperArmor, it didn't create the product. Broadcom's security businesses Symantec and Carbon Black cooked it up. Broadcom's CA business (formerly Computer Associates) has done similar things. At VMware Explore on August 31, Broadcom launched AgentMinder, which aims to stop AI running inside VCF going rogue. AgentMinder came from CA but was launched as a tool for VCF (and third-party Kubernetes stacks). At VMware Explore, The Register met Ram Velaga, president of Broadcom's Infrastructure Software Group, and asked him if the group has a single strategy, or if its divisions each do their own thing. Velaga said Broadcom uses a combination of both approaches. "There's a level of focus with individual teams that you don't have if you have one very large central team," he said. "You get the speed at which you have to innovate with individual teams." Broadcom's Infrastructure Software Group therefore operates with at least six teams, and when one of those teams wants to add functions it will look for existing assets developed by another internal team rather than trying to write its own code. For broad products like VCF, the work of several Broadcom teams could therefore be relevant. The Register has no idea which team created the name HyperArmor, a question we pose as Cisco already offers a "Hypershield." Maybe this sort of name is what's needed to stop a HyperHoodie? ®

If you thought everyone was into chatbots, think again: about half of US adults never use the AI tools, and most have no interest in starting. According to Pew Research Center, older adults are the least likely to use chatbots, with roughly three-quarters of those aged 65 and older saying they never use them. That may be expected, yet more than half (58 percent) of adults aged 50 to 64 don't use them either. Those aged 18 to 29 use chatbots the most, at 66 percent, however even a third of them say they never do. About four in ten under 50 report not using them at all. Across all adults, 51 percent are chatbot refuseniks, so users are - just barely - the minority. Pew asked non-users to choose from five possible reasons. Six in ten cited simple lack of interest as a major factor, followed by the more familiar concerns of data privacy and the accuracy of chatbot answers. Some Reg readers might suspect older people avoid chatbots because they lack tech-savviness, but fewer than a third cited not knowing how to use them as a major reason. The authors of the survey also found fewer than one in five worried about what others might think of them for using the technology, so social stigma isn’t the deterrent either. Adoption also differs by race and ethnicity: non-users are more likely to be white, black or hispanic than Asian, according to Pew’s survey. The AI dodgers don't look ready to budge. Two-thirds (67 percent) say they’re unlikely to use the technology in the next 12 months, including 40 percent who say they’re not at all likely to change their mind. Another 12 percent are unsure, and just 5 percent of non-users think they'll probably try a chatbot over the next year. Perhaps abstainers were put off by a bad experience, such as Microsoft’s notorious racist chatbot Tay a decade ago. Or something more recent, like the Trump administration’s official America.gov service, which at the time of writing still displays a hotdog if you type that into the prompt. ®