Anthropic has started extending access to its bug-finding Mythos model by allowing Cisco and IBM to make it part of their security products. Cisco announced its integration today at an event in Melbourne, Australia, where it revealed that the red teaming tools in its AI Defense suite, which looks for weaknesses and inappropriate activity in AI models, agents, and applications they power, will be able to call Mythos to test customers’ setups. “At a very high level, AI Defense has the ability to look at models and break them,” said Jeff Schultz, Cisco’s senior vice president for portfolio strategy and marketing. He said the tool is now “super-charged by Mythos” and will identify more danger that AI Defense will then address. AI Defense already uses AI-powered red teaming to find flaws. Mythos will become another option. Cisco will make it available under users’ existing licenses, without additional cost. Natalie Mead, Anthropic’s head of applied AI for the Asia-Pacific, said the company has a long queue of buyers who want to use Mythos, and working with Cisco will make it easier to satisfy that demand. Anthropic initially made Mythos available under "Project Glasswing," a program that gave vetted organizations access to the model to test their codebases, but has since expanded access through other controlled programs, an arrangement that makes considerable sense because in the wrong hands Mythos could help attackers exploit software flaws. The Cisco deal exposes the functionality of Mythos to end-users, without letting them use the model itself. The Register asked Mead if Anthropic has similar deals with other third parties and she demurred. That may be because a few hours after Cisco told us about its use of Mythos, IBM announced that it will also integrate Anthropic’s model into a product – namely its Concert tool, which uses AI to scan applications for risks and weaknesses. IBM says it will use Mythos “to uncover weaknesses traditional scanners miss, determine which pose real risk and generate fixes for developer approval.” We have asked Anthropic if these integrations represent a decision to open Mythos to more users in more ways. We will update this story if we receive a substantial response. Also on Monday, Anthropic introduced version 5.2 of Mythos and Fable, which the company says generate outputs up to 30 percent faster than version 5.1 yet cost less: $8 per million input tokens and $40 per million output tokens. Users can choose to run both models in “fast mode,” which speeds up token generation by up to 2.5 times, and doubles prices to $16 per million input tokens and $80 per million output tokens. Anthropic says it “ran extensive prerelease safety testing on the model that underlies Fable 5.2 and Mythos 5.2. This included developing novel evaluations that give deeper insight into specific concerning behaviors like sandbox escapes.” After those tests, the company concluded “high-stakes risks from misalignment remain low, and the model performed as well as, or better than, our recent models on most alignment measures. “Fable 5.2’s cyber and biology safeguards are as robust as those of Fable 5.1 but produce fewer unnecessary blocks, and we have implemented our strongest-ever protections against distillation attacks.” The latter is a telling admission, given Anthropic believes Chinese AI labs use distillation to effectively clone its models without doing expensive training work. ®

France has turned up the heat on Iran over destructive cyberattacks targeting refrigeration controllers at more than 700 grocery stores in October, spoiling food and sparking fires. The country vowed to take action using “all available means of response.” The supermarket attacks, which affected Casino, Leclerc, Coopérative U, Metro, Carrefour, and Intermarché groups, started at least 15 fires and caused food losses in the tens of millions of euros, according to a Monday report by France’s Cyber Crisis Coordination Centre (C4). The C4 includes the National Cybersecurity Agency of France, the Directorate General for External Security, the Directorate General for Internal Security, the Directorate General for Armament, and the Cyber Defence Command. “This is an unprecedented campaign in terms of its scale and level of aggressiveness, thus constituting the first cyber offensive campaign carried out purely for the purpose of sabotage on national territory,” France’s Ministry for Europe and Foreign Affairs said in a statement. All signs point to CyberAv3ngers Both the report and the statement attributed the refrigeration controller hacks to the Iranian Islamic Revolutionary Guard Corps’ (IRGC) Shahid Kaveh cyber unit. The Shahid Kaveh unit, which French national security officials say is led by Reza Salarvand and Mahdi Lashgarian, is better known by its hacktivist personas, including CyberAv3ngers. This is the same crew suspected of involvement in the July attacks that targeted more than 100 internet-exposed water systems in America. While the US government hasn’t attributed the intrusions to any country or group, private-sector security analysts blamed Iran, and specifically CyberAv3ngers. The IRGC-affiliated hacking crew has been breaking into industrial controllers for years, and in 2023, American national security and law enforcement agencies attributed a series of cyberattacks against "multiple" US water facilities to CyberAv3ngers. “The Iranian cyber threat against French interests is not new,” according to the Ministry for Europe and Foreign Affairs. “Iran has already carried out several destabilizing acts against us, notably targeting the weekly magazine Charlie Hebdo in 2023 and the organization of the Paris Olympic Games in 2024.” Since at least June 2024, the Shahid Kaveh unit has had the ability to scan, access, and control industrial control equipment from Schneider Electric, Siemens, and Rockwell, the French government said in its report. It pins the refrigeration controller hacks on this particular Iranian crew for a couple of reasons. Making the case for attribution First: the infrastructure used to carry out the October supermarket attacks was also used during this timeframe to conduct reconnaissance on Schneider Electric equipment, zeroing in on small- and medium-sized energy and water production units. “The techniques used during these actions are known to have been used by the Shahid Kaveh unit since at least April 2026,” the report says. It also notes that investigators found “traces of Farsi use” in the attack infrastructure. Plus, Iranian media outlet CyberbanNews, which is reportedly linked to the Shahid Kaveh unit, publicized the incidents that occurred late on October 11 and into October 12 extremely quickly: “as early as October 13.” In early November, similar cyberattacks on commercial refrigerators and freezers were reported across Europe, with grocery stores in Belgium, Ireland, Luxembourg, and Sweden reporting widespread food losses after miscreants spiked temperatures to as high as 122°F (50°C). Last week, the US federal government urged owners and operators to take security measures to prevent these types of attacks from spreading to America. France fights back The French government, for its part, said that it would “use all available means of response, including within the European Union and alongside its European and international partners, to anticipate, prevent, deter and respond to destabilizing and destructive actions targeting it in cyberspace.” This includes proposing additional EU sanctions against Iranian entities and individuals involved. France also vowed to express “its strongest condemnation of these cyberattacks” to the Iranian ambassador. However, the country didn’t rule out responding with more than just harsh words: “France reserves the right to take any additional measures, public and non-public, deemed necessary and proportionate to respond to these cyberattacks.” ®

Unknown attackers used compromised identity and access management (IAM) credentials associated with Qubole's AWS account to access customer AWS environments, stealing secrets and other sensitive data from S3 buckets. Qubole is a cloud data processing platform that uses cross-account IAM roles to manage compute and access storage in customers' AWS environments without requiring customers to provide long-lived AWS access keys. The supply-chain attack abused this third-party, cross-account trust relationship. Google’s cloud-security shop Wiz declined to tell us how many organizations were affected, but called it a “broad, opportunistic supply chain campaign” that hit “multiple” customer environments. “Because many organizations left trust policies active even after deprecating the platform, the attacker was able to successfully assume integration roles, enumerate cloud resources, harvest secrets, and siphon data,” the researchers told The Register in an emailed response to questions. Neither AWS nor Qubole responded to The Register's inquiries. Wiz, working with Google's Mandiant incident responders after AI data security company Sentra flagged suspicious activity, traced the malicious activity back to October 14, when credentials associated with Qubole's AWS account were used to call the sts:AssumeRole API to obtain temporary credentials for customer-managed integration roles. The calls originated from Qubole AWS account 805246085872, and used IAM user ID AIDA3W7DIFLYOLTK63SFS, Wiz analysts Zack Morrow, Sean Johnstone, and Benjamin Read said in a Monday blog about the supply chain attack. “Across the affected environments, Wiz CIRT has not observed this IAM user in any activity other than that associated with this threat actor,” the trio wrote. This activity continued on October 15, and on October 18, the digital intruders began using a second IAM user from the same account. Once inside customers’ environments, the crooks began probing a ton of AWS services and stealing credentials, keys, and other secrets stored across Lambda, Secrets Manager, and SSM Parameter Store. The miscreants also used TruffleHog to test AWS credentials belonging to victim organizations, discover their Microsoft Entra ID secrets, and request OAuth tokens using Okta client credentials also uncovered while snooping around the AWS environments. Abusing the integration roles also allowed the criminals to steal data from customers’ S3 storage, although it seems they were largely opportunistic attackers, in some cases downloading entire buckets, as opposed to state-sponsored spies looking for specific data. The threat hunters haven’t attributed the supply chain attack to any particular group, and say they don’t have any insight into how the miscreants are using the stolen data. While investigating this incident, Wiz spotted a separate campaign between October 8 and October 11 that also used customer-owned AWS access keys for Qubole integrations. While a “small number” of these also resulted in the intruders compromising victim organizations’ AWS environments, Wiz said it can’t definitively connect the two sets of malicious activity. Organizations that have integrated with Qubole should rotate credentials - although rotating a credential does not end temporary sessions that were already issued. Customers should also review CloudTrail from October 1 onward, looking for AssumeRole events where userIdentity.accountId matches Qubole's AWS account ID, 805246085872, particularly those originating from non-AWS IP addresses. “For every role session you find, review all subsequent activity from that session, especially Secrets Manager, SSM Parameter Store, Lambda and S3,” the researchers wrote. “If the threat actor assumed an integration role, rotate every secret, parameter and Lambda environment variable the role could read, and revoke active sessions for the role.”®

Security researchers exploited flaws in Android apps to gain remote access to connected cars from two major automakers, allowing them to start engines, flash headlights, and sound horns. Shubham Shah, co-founder at Assetnote, and researcher Sam Curry worked together on the exploits earlier this year. By tinkering with the cars’ Android apps, they devised exploit paths to issue remote commands to vehicles in Australia and the US. The pair published separate blogs covering different aspects of the research; Shah said the US attack "required a lot more work" because the automaker "spent much more time securing the US, Canadian, and European OpenIDM environments." Both exploit chains centered around weaknesses in the ForgeRock identity platform relied upon by both automakers, the identities of which were kept anonymous by the researchers, who have previously highlighted flaws in the likes of Hyundai, Kia, Subaru, and many others. In the Australian version of the app, the researchers first found a vehicle identification number (VIN) using public licence plate checkers, and used those in queries to internal APIs, which provided personal information and owner email addresses. They also found hardcoded admin credentials for the ForgeRock OpenIDM that were meant for the staging environment but also worked in production. After bypassing the heavy WAF filtering by exploiting path traversal flaws, they were able to invoke the internal admin APIs and take over target accounts using only their email addresses. This let them mint authentication tokens, which they could issue to send arbitrary commands to affected vehicles through the mobile app. Issuing commands on the US version also required bypassing WAF filtering through a path traversal, though with a more involved technique: exploiting path confusion to reach the Apache Felix admin console. The researchers used factory default credentials in Felix’s OSGi Web Console to gain admin privileges. They then used Felix configuration manager to schedule a task that executed an inline Groovy script, giving them shell access to the identity servers. The researchers then queried local admin API endpoints, allowing them to view or modify user account data. From there, they logged into car owners’ accounts, and gained the ability to issue the same commands as demonstrated in the Australian version. According to Curry’s disclosure timeline, he and Shah approached the affected automakers in "early 2026," and the exploits were patched within two hours of receiving the report. Although the automakers wished to remain anonymous, it didn’t take long for some petrolheads to speculate that the partially blurred car in Shah’s demo video was a Toyota, citing the shape of the wing mirror and the unlock sound it made. Onlookers claimed that the two automakers in question were likely Toyota and its luxury brand Lexus. Asked wether the claims were accurate, a spokesperson for Toyota Motor Corporation neither confirmed nor denied them. Curry said he and Shah chose to uphold the manufacturers’ requests to remain anonymous out of concern for infoseccers’ current workloads. He said: "Obviously, they have asked not to be named, and while normally we would fight to actually include the company names, it's a busy time in the security world and I don't like the idea of them diverting resources because they are worried about something with this disclosure." ®