Bank of America recruited an additional 1,000 contractors to help patch all the vulnerabilities discovered by Anthropic’s Mythos model, the CEO said on Wednesday. Brian Moynihan, chairman and CEO at BoA, said during the company’s Q3 earnings call that it spent “a couple of hundred million plus” in remediation costs related to Mythos, and the anti-money laundering (AML) orders issued this week. These costs are expected to decline over time, though, with the contractors in place to help ease the initial burden of patching a large number of flaws, an issue that shouldn’t be so pronounced in the longer term. He went on to tell CNBC that the bank brought in outside help after concerns grew over how it would quickly tackle all the work associated with Mythos’ discoveries. The same concerns were shared globally, in part due to how Anthropic marketed Mythos as an all-powerful model that threatened the status quo of cybersecurity. While it ultimately turned out to be highly effective and capable of identifying complex vulnerabilities quicker than humans, leading to the massive influx of patches, some early adopters say it was no smarter than elite researchers. Mozilla CTO Bobby Holley said in April: "So far we've found no category or complexity of vulnerability that humans can find that this model can't," after Mythos found 271 flaws in Firefox 150. "We also haven't seen any bugs that couldn't have been found by an elite human researcher." The 1,000 contractors brought in by the bank in its Q2 added to its existing 3,000 technical staff. The contractors remain at the bank for now, although their assistance won’t be needed in the longer term. Moynihan told financial analysts on the bank’s earnings call that BoA has made its tech engineering workforce around 10 percent more efficient, and that each of the circa 130 AI-related projects it has running is expected to achieve a 2x or 3x return on investment over time. In 2026 alone, the CEO expects AI projects to deliver between $250 million and $300 million in benefits – a sum he expects to shoot up to $700 million by the end of 2027. He didn't detail how. The bank has also reduced around 3,000 roles, including a 5 percent decrease in the number of managers on the payroll, although it didn't specify how much of a role AI played. Moynihan didn’t break down how much of the “couple of hundred million plus” in remediation costs were devoted to AI or Mythos, compared to costs associated with cleaning up its AML issues, both of which the CEO lumped together. BoA’s share price slid more than 8 percent on Wednesday morning after it reported a 17 percent drop in profits owing to the $1.21 billion settlement it agreed to with the Treasury’s Financial Crimes Enforcement Network (FinCEN). The FinCEN order relates to BoA’s failure to police national security risks, including Chinese money laundering, and a failure to report over $5 billion in suspicious activity. FinCEN’s order was issued concurrently with a $750 million penalty from the Office of the Comptroller of the Currency, related to Bank Secrecy Act and AML compliance deficiencies. BoA also agreed an $11.6 million settlement with the Office of Foreign Assets Control for sanctions violations, including those related to Iran, Russia, narcotics, and global terrorism. ®

X says it has nuked more than 13,000 accounts involved in three suspected foreign influence operations targeting US political debate. In a post on Wednesday evening, the platform linked the operations to Iran, Russia, and China. It said the networks used inauthentic accounts to post and amplify political content targeting candidates and public figures across the political spectrum. The announcement comes ahead of the US midterm elections on November 3. "People come to X to talk about what's happening in the world, including the upcoming 2026 US midterms," the platform said. "Free speech is the bedrock of a functioning democracy, and we are proud that X is the global town square where these debates happen. Our job is to keep that conversation authentic, open, and safe." X did not publicly explain the evidence behind its attribution. Separately, it highlighted its Civic Integrity policy, which covers misleading information about how, when, and where to vote, as well as content intended to discourage participation. Reports submitted under "Civic Integrity" are routed into requests for Community Notes. X says it uses the crowdsourced feature alongside platform moderation and may label policy-breaking posts in critical cases. Community Notes has faced scrutiny. When the European Commission launched formal proceedings against X under the Digital Services Act in 2023, it raised questions about the feature's effectiveness for validating a post's accuracy. X's reliance on crowdsourced context follows layoffs and senior departures from its moderation teams after Musk acquired Twitter. Foreign influence campaigns aren't confined to US elections. MI5 chief Sir Ken McCallum said this week that Russia had attempted to interfere in the 2016 Brexit referendum, but cautioned against treating that as evidence it changed the result. ®

Hackers who broke into the UK's Legal Aid Agency last year stole records dating back nearly five decades, the government has admitted, revealing the breach was far more extensive than previously thought. The Legal Aid Agency said on Wednesday that around 250,000 records stolen in the April 2025 attack date from before 2007, including one going back to 1978. That's much further back than the agency previously estimated ­­– it initially said the stolen data covered legal aid applications, claims, and payments from 2007. Most of the newly identified records date from the 1990s and 2000s, with only a “fractionally small number” originating before 1990. Still, the discovery raises an awkward question about just how much historical personal information was sitting in government systems when the attackers came knocking. That wasn't the only surprise in the stolen data, as the Ministry of Justice (MoJ) has also discovered that hackers accessed information from HM Prison and Probation Service (HMPPS), including names, dates of birth, nationalities, and case reference numbers for offenders supervised by probation services between 2010 and 2017. The government says the probation records concern a relatively small number of offenders, with more than 99 percent of the affected data relating to people under supervision in 2016 and 2017. It stressed that none of the stolen probation information relates to victims of crime. The latest revelations come almost 18 months after the Legal Aid Agency disclosed that criminals had accessed and downloaded a significant amount of sensitive personal information. The agency first detected the intrusion on April 23, 2025, but officials didn't establish the scale of the compromise until May 16. The government subsequently took the LAA's online services offline, leaving lawyers struggling to access the systems they needed to submit claims and manage cases. The disruption dragged on for months, with the agency's troubled return to service in December leaving legal aid providers battling delays and ongoing technical problems. Further forensic work has now revealed that the data theft goes back much further than officials originally believed. The compromised information varies by individual but could include names, addresses, dates of birth, National Insurance numbers, financial details, and information about legal proceedings. Some records also contain details of criminal charges, pleas, convictions, and sentences. Among the older material are records relating to legal aid benefit assessments dating from 1978 to 2012, and payments made under the Very High Cost Cases scheme between 1981 and 2004. The government cautioned that the presence of historical records doesn’t mean that everyone who applied for legal aid before 2007 had their information stolen, nor does the 250,000 figure represent a confirmed number of affected individuals. Explaining why it has taken so long to pin down the extent of the theft, the MoJ said the attackers stole information spread across several complex systems, much of it unstructured, fragmented, or incomplete. "Because of our increased capability to identify data, we have developed a more complete understanding of the information compromised," the agency said. The government says it has no indication that the stolen information has been published or shared, although that offers little certainty to anyone whose personal details may now be in criminal hands. Since the attack, the MoJ says it has tightened authentication and access controls, improved security monitoring, addressed vulnerabilities and begun retiring or isolating higher-risk technology. Work to modernize its legacy systems is also underway. The question of why records stretching back to the 1970s remained accessible in the first place is one the latest update does not answer. ®

Welcome, once again, to PWNED, the weekly column where we gawk at organizations that have made serious security mistakes. Normally, we’re talking about businesses or maybe the odd school that messes up, but today we’re writing about a serious IT screwup in the world’s most powerful military. Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity is available upon request. Today’s tale comes from Justin Henkel, the CISO of IT monitoring and service company SolarWinds. Henkel previously worked in IT security for the Air Force and one day in the early 2000s saw a practice that just wouldn’t fly today. Before USB drives became popular, burning CDs with mission data was the modus operandi, and those discs were put in both unclassified and classified systems. “They would write a CD, and then they would take that CD and then put it in a classified system and do the remainder of the mission planning,” Henkel told us. “Then they would take that disc and then put it in the airplane.” Inside the airplane, the data on the CD would help the pilot navigate and contain information about threats they might encounter. Later, when thumb drives became a thing, pilots used them instead of discs. “They didn't really think about the overall impact of classified versus unclassified systems,” Henkel said of the pilots. “Using the same device for both, they didn’t understand that you could read and write onto a USB drive with malware. [They were] not really understanding the overall threat picture.” According to Henkel, Air Force personnel would buy their flash drives from local vendors rather than sourcing them from official military contractors. If they were in Afghanistan, those drives could literally come from a store in Kabul. And it wasn’t exactly the equivalent of Best Buy. “It was more difficult to bring a US-based computer into the nation than it was just to buy local,” he said. “So they were just going out into the local market in Kabul or whatever city that they were out [in]. And I used to do this: go out, make relationships with the local vendors. ‘Hey I need 100 USB sticks.’” Unfortunately, enemies of the US noticed and soon started selling infected USB drives to local vendors in the Middle East. Henkel knew that using a sneakernet with classified systems was a recipe for disaster. It’s just that no one would listen to him. “It was just a shock,” he told us. “I was a young 22-year-old guy, very junior in the overall rank system, trying to tell colonels and majors that what they’re doing is a violation.” In 2008, the US Department of Defense was infected by malware after somebody attached an infected USB flash drive to a laptop with access to US Central Command. The worm, dubbed Agent.BTZ, could collect information from infected computers and communicate with remote servers. A 2016 report from the FBI and DHS attributed the malware to one or more Russian groups. It took the Pentagon 14 months to scrub it from its systems. It took this attack for the Pentagon to wise up in 2008 and ban the use of USB drives, instead forcing data transfers to go through more secure systems. Eventually, in 2010, the drives were allowed again under certain circumstances. ®

Researchers at The Citizen Lab have for the first time released technical evidence of sophisticated mercenary spyware being distributed via online advertising.

The Information Commissioner's Office (ICO) has reprimanded London's Metropolitan Police Service (MPS) and issued an enforcement notice after officers used a retail crime platform without the force's approval or required data protection checks. Between March 2023 and September 2024, MPS officers registered around 500 free accounts on Auror, a platform retailers use to record crimes such as shoplifting. The force had not formally procured the service or completed the required data protection checks. Retailers such as supermarkets encouraged officers to use Auror and directed them to the platform to access CCTV footage. Auror Europe, registered in England and Wales, is a subsidiary of New Zealand-based Auror. The platform allows retailers to share incident reports, images, and CCTV footage. Retailers pay for access through a browser or mobile app, while police partners use it free of charge. The force had not completed a data protection impact assessment (DPIA) or established data-sharing agreements with Auror Europe, the ICO says. Between August and September 2024, two separate internal security reports were filed regarding officers' use of Auror. The first related to officers uploading the names of suspects they recognized from CCTV footage, and the second pertained to officers collecting CCTV footage from the platform despite no checks being made on it. Access to Auror was blocked as of September 26, 2024. The MPS data protection officer (DPO) informed the ICO of the force's use of Auror in December 2024 during discussion about a separate matter. The watchdog launched a formal probe in April 2025. The ICO found that officers unlawfully uploaded personal data relating to 179 people, including three children, to Auror. For 128, this consisted of names alone; for 49, names and dates of birth; and for two, names, dates of birth, and home addresses. The ICO said the MPS failed to ensure adequate oversight was implemented when deciding what third-party platforms officers were allowed to use – failures that persist today. It claimed the MPS is overly reliant on soft controls to prevent officers from using unapproved software, such as policy reminders and staff training, which often go unnoticed, rather than technical blocks. The ICO also said the force had failed to test whether its web controls worked: officers used Auror for more than 18 months without triggering an alert. The regulator described a repeat failure, pointing to officers' use of Clearview AI in 2021 without proper oversight. The ICO considers the failures ongoing because the force has not demonstrated that its safeguards can prevent similar incidents. The enforcement action compels the MPS to strengthen its safeguards against improper use of third-party tools and provide the ICO with periodic progress updates. David Doodson, head of investigations at the ICO, said: "This action should send a message across the policing sector, and beyond: If you are using new technology to process people's information you must do so lawfully, transparently and with appropriate governance from the outset. "Where organisations fail to protect people's information, we will take action. Our role is not only to hold organisations to account, but to drive improvements and promote the standards people have a right to expect." The MPS told The Register that following the implementation of stricter controls and a pilot scheme, officers in 14 London boroughs are once again using Auror. "Following formal approval and a pilot, the platform is now used in 14 London boroughs," a Met spokesperson said. "It helps officers identify shoplifters more quickly, enabling retailers to directly share evidence and CCTV at the point of reporting and has quadrupled positive outcomes for shoplifting." In an August 2026 announcement, the MPS said the tech, which it did not identify by name, would be rolled out beyond the 14 boroughs and was already deployed in stores such as Tesco, Boots, Greggs, and M&S. It said that instances of shoplifting reported via the platform result in a positive outcome in 29.4 percent of cases. Of the ICO's findings, the spokesperson said: "We accept the ICO's findings that our data protection arrangements at the time were insufficient in relation to individual officers using the Auror platform. "While officers were using the platform in good faith to identify and arrest shoplifters, we recognise that we had not completed the relevant security and data protection work for the platform to be used. "As soon as we became aware of this issue, we immediately suspended access to the platform and carried out a full review. We have subsequently completed the necessary legal, security, commercial and data protection checks before approving the platform for use." This reprimand and enforcement action follow a separate rebuke from the ICO in August, concerning two sensitive cases. In one, a Met officer sent unredacted legal documents to the subject of a stalking protection order, exposing the victim's new home address and contact details. The other saw an officer commit the cardinal CC-not-BCC sin, exposing the email addresses of 18 people linked to Parliament who were targeted in a honeytrap sting. ®

Cisco “strongly” implored customers to patch yet another critical, make-me-root vulnerability in its Secure Email Gateway (SEG), one that has already been exploited in zero-day attacks. A Cisco spokesperson told The Register that the critical vuln, which received a 9.8 out of 10 CVSS rating, affects “a limited number of customers.” The bug, now tracked as CVE‑2026‑76519, allows remote, unauthenticated attackers to write files and execute commands with root privileges on the appliance’s operating system - simply by sending a malicious email. In separate Wednesday advisories, both the networking vendor and the US government warned that attackers were exploiting the latest SEG vulnerability before Cisco issued a fix. The US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog, and set a Saturday deadline for federal agencies to fix the issue. “We are aware of active exploitation of this vulnerability,” the spokesperson said, but declined to answer our questions about how many appliances had been compromised, and what attackers were doing with this access after exploiting the bug. “We strongly urge customers to upgrade to a fixed software release and follow additional recommendations and hardening guidance in our advisory,” the spokesperson said. The flaw exists in SEG’s Advanced Malware Protection (AMP) feature, and it’s due to improper handling of email attachments. An attacker could exploit the bug by sending an email with a malicious attachment, and a successful exploit would allow them to write files and execute commands as root on the compromised appliance. This vulnerability affects both physical and virtual SEG appliances running a vulnerable release of Cisco AsyncOS Software if both of the following conditions are met: The File Reputation service, which is part of Cisco AMP, is enabled and assigned to a mail policy. The Content Scanner Tools version is earlier than 25.3.0.5525. Cisco's Wednesday advisory includes steps organizations can take to determine whether File Reputation is enabled and which Content Scanner Tools version is installed - so give that a read if you are unsure. Upgrading to a fixed Cisco AsyncOS Software release will patch the security hole, and there are no workarounds. The vendor recommends any customers who are running Cisco AsyncOS Software releases earlier than v 16.5 migrate to 16.5.0-780. In its alert, Cisco said it became aware of active exploitation in October. This is the second such zero-day in SEG in as many months. In mid-September, Cisco warned customers that criminals were exploiting a similar bug in SEG, tracked as CVE-2026-76461, that also turns a malicious email into root access. In January, attackers exploited another critical AsyncOS flaw, CVE-2025-20393, to break into Cisco SEG appliances and install persistence mechanisms. That bug eventually scored a perfect 10.®

Researchers at security startup Xbow used OpenAI's GPT-5.6 Sol model to help chain three zero-day vulnerabilities in Chrome into an exploit capable of executing code outside the browser's sandbox on Windows machines. Xbow estimates that this could affect about one billion users worldwide. Google fixed all three, and paid the Xbow team a $250,000 bounty, its top reward for a Chrome full-chain exploit. The payout also proves a nice return on investment for the human bug hunters - Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee, and Willem Pinckaers - who spent just six days during the Black Hat and DEF CON conferences and about $40,000 in token charges to discover the vulnerabilities and build the attack chain. “The number on the check is impressive, but the time it took our team, with the help of a publicly available AI model, to break in is even more impressive,” Xbow CEO and founder Oege de Moor said on Tuesday. “A three letter intelligence-agency veteran told me that his team used to spend six months trying to identify this kind of vulnerability and get total access. We did it in six days.” In a separate technical writeup about the attack chain, Dolan-Gavitt detailed the work done by humans and AI agents. Agents, using OpenAI's GPT-5.6-Sol model, searched source code, tested the team’s hypotheses, and developed proofs of concept and exploit stages, he said. Meanwhile, the AI pen-testing security startup’s researchers chose targets, provided context, challenged the agents’ results, and decided which attack components to chain. "We did apply a fair bit of our own human expertise and judgment," he wrote. Crossing two security boundaries in 3 steps Google’s Chrome browser uses several layers of security to protect users, and this includes sandboxes - barriers to contain compromised code and ensure that someone who hacks an individual website can’t take over the entire computer. This includes deploying the V8 sandbox to prevent any memory corruption flaws in the V8 JavaScript engine from impacting other memory. The V8 sandbox sits inside the operating-system process sandbox, and this nested design means that escaping V8's memory restrictions doesn't automatically grant native code execution. Even if an attacker achieves native code execution inside Chrome's renderer, the outer process sandbox restricts access to the rest of the machine. “The chain crossed both boundaries in three vulnerability stages,” abusing Chrome to run code on Windows machines, Dolan-Gavitt wrote. The attack combines a V8 compiler bug, an animated-WebP decoder bug, and a memory-safety bug in Crashpad. The first vulnerability is in Maglev, V8's mid-tier optimizing compiler, and it’s due to a reused, mutable boxed number during deoptimization. This gives attackers read and write access throughout V8's pointer-compression cage. The second stage, the animated-WebP bug, is a V8 sandbox escape. “But rather than attacking the sandbox itself we exploited a property that the V8 sandbox deliberately does not enforce and that Blink incorrectly assumed it could trust,” Dolan-Gavitt explained. “Finally, the exploit used an overflow in Crashpad to cross the final outer process boundary and achieve unsandboxed code execution on the host.” While Google patched all three security issues, and Chrome installs updates on its own, a fix only takes effect once the user relaunches the browser. If you use Chrome, make sure you are running version 152.0.7977.82 or later. The time and money spent to achieve a full chain Chrome exploit illustrate - yet again - that “the bar is significantly lower” for attackers armed with LLMs, Dolan-Gavitt wrote. “Defend accordingly.”®

Ivanti customers are being urged to update Connect Secure and check for compromise after attackers exploited a newly disclosed zero-day vulnerability. On Tuesday, Ivanti released updates for Connect Secure (ICS) to fix CVE-2026-104935, an authentication bypass flaw discovered by Volexity. Rated 8.6 on the CVSS scale, it allows remote, unauthenticated attackers to execute arbitrary commands. "We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure," the vendor said in its advisory. There are limited indicators of compromise available at present, it said, advising customers to refer to Volexity's report on the findings for more information, and to run the Ivanti Integrity Checker Tool regularly. Ivanti lists affected releases in the following branches: 25.1.1.1 and earlier 25.1.2.2 and earlier 22.8R2.4 and earlier The vendor said it previously identified "a portion of this vulnerability" and patched it in July's 25.1.3.0 update, and had been working on backporting the same fix since then, however, attackers began exploiting it before that work was complete. Volexity said the attackers behind the recent intrusions were previously unknown to its researchers, but are now tracked as UTA0576. Criminal motive rather than espionage is suspected by Volexity. Based on observed post-exploitation activity, attackers appeared to be most interested in using their newfound access for credential theft, data exfiltration, log tampering, and network reconnaissance. Notably, the attackers did not deploy any malware nor execute web shells, using only the commands available to them on the ICS appliance. "Because the operation was detected and disrupted, the threat actor's ultimate objectives could not be determined," said Volexity. "However, Volexity assesses with high confidence that UTA0576's actions signaled preparation for lateral movement and a broader compromise of the victim network." The researchers also suspect that the attackers were using large language models to support their endeavors. Volexity pointed to the attackers' repeated use of the exploit channel to run commands, rather than deploying web shells, and their use of "highly specific scripts using hardcoded credentials." Ivanti disclosed one CVE, but Volexity described an attack chain involving three vulnerabilities. Tuesday's updates address the authentication bypass and remote code execution stages. The third vulnerability, which allows privilege escalation, is separate from the flaws encompassed by CVE-2026-104935. Volexity said Ivanti is aware of the additional bug and plans to publish a fix "in the coming weeks." The disclosure of the zero-day this week makes it the third year running that Ivanti has had to deal with attackers exploiting undisclosed flaws in Connect Secure. The previous ICS zero-days were disclosed in January 2025, a year after the January 2024 vulnerabilities led to exploits affecting thousands of ICS appliances. In the interim, we've also seen suspected Chinese espionage groups exploiting bugs in Endpoint Manager Mobile (EPMM), and critical flaws in Sentry. Ivanti's run of January zero-days continued earlier this year, although those flaws affected EPMM rather than Connect Secure. ®

Cryptography rarely fails at the math - it fails at deployment. Why post-quantum migration and AI-scale risk make open-source stewardship a core control.

This month’s update also marks the first official one for Windows 11 26H2 and the end of support for Windows 11 24H2 Home and Pro.

The Department of Justice has charged an OpenAI engineer with attempting to intercept oral communications after allegedly planting a recording device in an exec conference room. Investigators claim company security staff found a second device in his bag. Saudi national Abdulrahman Alfozan, 35, is described in court documents as an engineer at OpenAI who had worked there since July 2025, and has held permanent residency in the US since September 2020. He was arrested on October 9 and made his initial federal court appearance on October 13. He is accused of installing, on or around September 28, 2026, a Seeed XIAO ESP32-S3 Sense recording device via a USB port in a TV located in OpenAI's executive conference room. According to the complaint, staff discovered the device concealed in toilet paper on September 30. OpenAI said it used its models to analyze the device. According to the complaint, it may have been modified to prevent data transfer between the recorder and the TV. The contents of the bug's microSD card may also have been encrypted, as the company could not retrieve any of the data stored on the card after making a forensic image of it. CCTV footage placed him near the room on several dates, although prosecutors say Alfozan had no authority to access or participate in meetings held in the executive conference room, which is often reserved for the highest-level discussions. Officials did not state whether the device was able to capture anything of importance, but said the room typically plays host to non-public and secret technical meetings, as well as those with government representatives. OpenAI did not have CCTV covering the executive conference room at the time when the secret device was planted, but the company subsequently installed a camera. Court documents [PDF] include an image taken on October 5 from a camera situated behind the TV into which the DoJ claims the recording device was installed, allegedly showing Alfozan checking on it. Investigators examined Alfozan's devices, according to the complaint, which alleges that between around August 17 and September 16, 2026, Alfozan used a productivity agent to inquire about company building addresses, meeting rooms, room capacities and calendars, and external-partner meeting venues. The complaint also describes an AI chatbot account associated with his spouse that shared installation identifiers, logged IP usage, and user-path references with Alfozan's account. Between September 24 and 30, it submitted prompts about building and modifying an audio-recording device. The prompts allegedly included questions related to recording reliability, how to add browser access and controls, how to develop a second unit with speech-triggered recording, and more. On October 5, the day Alfozan was allegedly recorded looking behind the executive conference room TV, company representatives say he left a bag unattended in the office's printer room. Security staff inspected the bag, finding a wallet, an ID card, and a second Seeed-manufactured recording device, before Alfozan reported the bag missing, according to the DoJ. He collected the bag the following day from the company's Lost and Found, and later claimed in a written report that several items were missing, including a credit card, around $500 in cash, two AirPods, one set of headphones, sunglasses, and a power bank. Alfozan was charged with an attempt to intercept oral communications, an offense that carries a maximum sentence of five years in prison and a $250,000 fine. "According to the complaint unsealed today, Abdulrahman Alfozan allegedly concealed a covert recording device inside his employer's executive conference room to secretly capture sensitive communications about the company's super intelligence technology," said FBI director Kash Patel. "Protecting American SI innovation is essential to safeguarding our nation's economic strength and national security, and the FBI views that mission as one of our highest counterintelligence priorities." "At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data," OpenAI said in a statement. "The employee was terminated." "We take protecting our technology, data, and people seriously, and as a matter of national importance. Our security program is designed to protect against a wide range of threat actors, from insider risks to cybercriminals to nation states, and this case is an example of how AI can help address these sophisticated security threats." ®

Chatbot prompts reveal the engineer’s alleged efforts to set up a covert listening device days before one was found in a meeting room used by high-level executives.

Learn how Cisco’s Secure Development Lifecycle (CSDL) is evolving to support AI-driven development, ensuring secure and resilient software at speed.

An Anthropic AI model submitted a fabricated tip about an unsolved homicide through an online form run by the Philadelphia Police Department (PPD). The tip, filed July 18 through PhillyUnsolvedMurders[.]com by “someone who might have information about the case,” went straight into the inbox’s spam folder. Anthropic discovered it on September 28, notified the PPD on October 7, and sent representatives to the police HQ the following day. Anthropic told the police the AI submitted the tip during a test exercise that involved interacting with randomly selected websites. The PPD said its findings are so far consistent with Anthropic's account. Because the tip was flagged as spam, it never reached the department's Real-Time Crime Center. The PPD said officers vet all submissions, automated or otherwise, before forwarding them to investigators, and that this process safeguards against abuse of the tip system. It added that this does not “diminish the seriousness” of an AI submitting fabricated information. “The city of Philadelphia takes this incident very seriously,” the PPD said. “The company must strengthen its safeguards to prevent similar incidents from impacting city systems without the city’s knowledge. The two-month delay in detecting and reporting the incident to the city is unacceptable.” It added: “The department and the [Cherelle] Parker administration will continue to closely monitor this incident, and will provide more information to the public as soon as it becomes available. In addition to our investigation into this incident, the Parker administration will explore all necessary regulatory protections going forward locally along with our state and federal partners.” On October 9, Anthropic published a report on this and other AI errors. The report covered four categories of AI failures, including vulnerability exploits, access to restricted data, bypassing fetch tool limits with URL shorteners, and submitting false information via web forms. Anthropic declined to name any of the affected organizations, other than the PPD after the department went public. Some cases involved local, state, and federal US government websites, though the AI company didn't say which of the four categories they fell under. The PPD did not name the model responsible, but Anthropic said Claude Haiku 4.5 was tasked with generating and performing example tasks on randomly selected web pages, and hinted at the model not being prompted specifically enough. “Claude was instructed never to log in, create accounts, enter personal data, make purchases, or submit anything destructive, but the instructions did not rule out form submissions,” Anthropic's report stated. The fake tip read: “I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant.” Anthropic said the incident was less severe than the cyberattacks over the summer. The report said: “Claude appears to have only been producing example content for the task, rather than trying to mislead anyone to achieve a goal.” By contrast, the "dishonesty" displayed over the summer was “sustained over hours” and supported continued attacks, the Claude maker said. Anthropic said it will keep reporting these failures when it detects them, and will continue fine-tuning behavioral and alignment training. The 3,095-word report contained no apology.®

Cyberattacks on supermarket refrigeration systems reportedly pushed temperatures as high as 50°C (122°F), affecting hundreds of stores in France and forcing retailers to discard food. Major supermarkets such as Carrefour, Coopérative U, Intermarché, Monoprix, and more were hit by the attacks, which spoiled perishable food and left stores without fresh produce. The affected equipment includes cold-storage units used to hold food before it reaches supermarket shelves. The criminals behind the attack raised temperatures to unsafe levels, spoiling food and in some cases starting fires. Some affected retailers used refrigeration controllers produced by Danish company Danfoss. Authorities have not identified the entry point or confirmed exploitation of the vulnerabilities previously disclosed by Claroty and patched in August 2025, although the manufacturer said affected stores were running outdated firmware. Experts say the previously identified vulnerabilities were easily scriptable and relied on a unique but predictable authentication method. Claroty found a hidden authentication mechanism in the AK-SM 800A platform that accepted a code generated from the device's current date, bypassing the configured administrator password. Anyone who reproduced the algorithm could generate a valid daily code and gain administrative access. "It's a zero-skill thing to pull off, I wrote the bash script while having a shit," said security pro Kevin Beaumont. The research demonstrated how compromised controllers could expose refrigeration systems to physical disruption, although the vulnerabilities' role in this week's attacks remains unconfirmed. Danfoss told reporters this week that the French supermarkets affected by the attacks "were running outdated firmware" and that the company has consistently advocated for keeping systems updated. The Register asked Danfoss if it would confirm whether the previously disclosed bugs were exploited to execute the attacks, and whether the same bug was also abused in August to compromise US military commissary refrigerators, which led to food losses. CERT-FR published an alert reporting numerous compromises of Danfoss AK-SM and AK-SC controllers, which were not mentioned in Claroty's original reporting nor in Danfoss's advisories at the time. The authority advised disconnecting or restricting network access. For suspected compromises, it recommended a factory reset, security patches, credential rotation, account checks, and full reconfiguration. For those wondering why fridges even need to be reachable via the internet, the main reason is that it allows central engineering teams to troubleshoot issues remotely, according to Claroty's researchers. "Industrial control systems such as refrigeration controllers are often assumed to be on safely isolated networks. However, our research found many of these devices are directly exposed to the public internet," said Amir Preminger, CTO at Claroty. "While this convenience significantly reduces maintenance costs by allowing engineers to troubleshoot issues remotely, it also lowers the barrier to entry for attackers. "Organizations must take proactive measures to ensure that management interfaces are not insecurely connected to the internet, and ensure that access to administrative services is restricted to trusted management networks or secured through VPNs and other appropriate network segmentation controls." Intermarché owner Groupement Les Mousquetaires said around 150 of its supermarkets were affected by the attacks, while Carrefour confirmed around 80 impacted stores. Monoprix said roughly 5 percent of its 490 stores were experiencing the same issues, and Coopérative U CEO Dominique Schelcher said 80 of the company’s 2,000 stores were hit, adding that the attack on the food sector was “unacceptable.” “Targeting equipment essential to the preservation of fresh products is an attack on the French food supply chain,” he said. “It is unprecedented, extremely serious, and unacceptable. We remain fully mobilized.” However, in a separate twist, Schelcher told French radio station RTL on Tuesday that Coopérative U is not a customer of Danfoss. The Register contacted Coopérative U for more information about what caused the attacks at its stores. Shodan searches for internet-facing Danfoss controller interfaces indicated that more than 4,500 endpoints were exposed as of Monday, with more than half of those located in France. Ahold Delhaize, a major grocery retailer in the Netherlands, announced on the same day that it was experiencing a "security issue." No link to the refrigeration attacks in France has been established. The end result is similar, however, as the company's grocery brands are reporting stock issues. Several of the group's brands have taken their websites offline and posted notices about the "cybersecurity incident." Stores remain open, but affected brands have reported disruption to websites, apps, customer services, and online deliveries. The disruption hit the company's distribution systems, although these are now being restored. Updates posted to social media on Tuesday told shoppers that staff were once again able to use digital shelf labels but stock levels may vary across stores, and long-life items were likely to be more abundant than fresh fruit and vegetables. The retailer previously suffered a cyberattack in November 2024 that disrupted its US operations. ®

A person claiming responsibility for the breach of Denmark's Central Register of Persons (CPR) says they gained access through an IT company's account protected by the password "123456." The person told Danish news outlet Politiken they had no intention of selling or leaking the data. The newspaper reported that at least three company accounts, including an administrator account, used the same password. Denmark's CPR administration confirmed a breach affecting the information belonging to 8.8 million people on October 5, adding that a Danish company's legal access to the CPR system was abused. It did not name Funen-based Pays ApS as the company in question, but managing director Sophie Laursen confirmed on October 9 that it's access had been exploited. Pays' website has been taken offline, and the business has not responded to The Register's request for more information about the password claims. Pays had authorized access to the CPR system to provide services such as validating business customers' records. The Danish government says information relating to 8.8 million people was accessed. The register contains approximately 11 million records, including those of deceased people and people who have moved abroad. The government did not respond to questions about the alleged password failings. According to documents obtained by broadcaster TV 2, the attacker gained access to the CPR system on September 10 and ran the 14 million automated searches between then and September 20. The intrusion was detected on October 2, 12 days after the last reported searches. Mikkel Leihardt, director of the government's higher education and science ministry, told reporters at a press conference that the attack was discovered after a department staffer picked up an invoice indicating unusually high activity from Pays. The Danish data protection authority, Datatilsynet, was notified on October 4, and the government disclosed the attack the following day. ®

Yandex engineers are working to restore services after Ukraine launched drone strikes on three of its five Russian datacenters. The strikes began overnight on October 7-8, "seriously damaging" Yandex's Sasovo datacenter and leading to a total shutdown. Ukrainian drones struck again on the morning of October 9, targeting the company's Kaluga datacenter, resulting in part of its infrastructure being taken offline. Dima Pirogov, head of Yandex's fintech division, confirmed via Telegram on Sunday morning that a third strike targeted the company's Vladimir site, which supports Yandex Pay. A day later, services remain offline, although Pirogov said users' money is safe. "I'm very sorry I can't tell you yet that everything is working again," the exec wrote. "The team continues to restore services and is checking every step. When it comes to your money, it's important to us not just to restore Yandex Pay as quickly as possible, but also to ensure that everything is working reliably. "I understand that you're not waiting for words, but for access to your money. And I understand how hard it is to wait when you can't use it. We can't give you a precise timeline for the restoration yet, but we promise: we won't stop until the service is back online." Yandex Pay is the company's digital payments service. Users can make online and in-store purchases, pay in installments, and split bills with friends and family. It's also integrated into online shopping experiences. It is comparable to Apple Pay or Google Pay, while Yandex more broadly offers services similar to Google's. Yandex said engineers are prioritizing the most-used services, and reported that access to the Alice AI assistant, Mail, Maps, Search, and Taxi is being restored, but other features remain offline. The company's status page lists widespread outages across Yandex Cloud, its public cloud platform, following the attacks. Updates from the maintenance team describe partial availability despite the outage indicators. They suggest that some customers may be able to access certain features, such as Yandex Cloud Console and API, but availability remains inconsistent across the platform. In its most recent update, the company said: "The Yandex Cloud platform is still operating in a limited mode. Our specialists continue restoration work around the clock. The technical support team receives an increased number of requests, so the response time can be increased. "Our recommendations continue to be relevant. We recommend using alternative sites for hosting and reserving resources." Internet monitoring organization Netblocks reported that Yandex Cloud's network connectivity was at 30 percent of normal levels on October 11. Ukraine president Volodymyr Zelensky said the drone attacks were a response to Russia's own, which had targeted datacenters in Kyiv. The BBC reported that in September, Russian drone strikes targeted a business center in the capital city, killing four people and damaging a datacenter, which in turn resulted in around 100,000 households losing internet access. The attacks led to other knock-on effects, such as public transport boards not displaying information in Lutsk. Kyiv's attack on the Vladimir site on Sunday morning came hours after controversial comments from US president Donald Trump, who accused Zelensky of wanting "to make problems for the world" by continuing to attack Russian oil refineries. Trump went on to say that it was time for Ukraine to elect a new president after Zelensky said measures should not be taken that allow Russia to generate more revenue to fund its war. Zelensky was referring to a deal between Trump and Putin to release diesel from Russia to the US and the rest of the world. Later that day, the US president claimed Russia and Ukraine had agreed to an "energy ceasefire" to halt attacks on each other's energy infrastructure. Kyiv said it was unaware of the agreement before Trump announced it on his social media platform, but was willing to halt attacks on Russian energy infrastructure if Moscow reciprocated. Russia launched a missile attack on a Ukrainian power plant hours later. ®

Investigators also sought permission to use an invasive surveillance tool called a cell-site simulators against journalist Georgia Fort and a Minnesota state Senate candidate.

KETTLE The FBI has announced what appears to be a third arrest in the ShinyHunters investigation, following the group's breach of Bureau systems, even as AI advances potentially leave human hackers on borrowed time. You can listen to the latest episode of The Kettle on this page, Spotify, Apple Podcasts, or YouTube. You can also subscribe on those platforms to be notified when a new episode goes live. A second vulnerability discovered by Anthropic's Mythos model has been exploited in the wild, and it's not one that humans probably would have discovered, begging the question just how important we are in the future of cybercrime. Join host Brandon Vigliarolo, cybersecurity editor Jessica Lyons, and senior reporter Tom Claburn to discuss those stories, and what they mean for the future of cybersecurity, on this week's episode. A lightly edited transcript is below: Brandon (00:01) Hey everyone, and welcome to the latest episode of The Register's Kettle Podcast. I'm your host, Reg reporter Brandon Vigliarolo, and this week we've got a couple cybersecurity stories to chat about, but that doesn't mean we're leaving AI out of the conversation, of course. With me to chat about some arrests and new revelations about the capabilities of Anthropic's Mythos model are Reg cybersecurity editor Jess Lyons and senior reporter Tom Claburn. Thanks to both of you for coming on. Tom (00:27) Yeah, thank you. Jessica (00:28) Good to be here. Brandon (00:29) So Jess, let's start with the FBI's continuing crusade against who seems to be its new arch nemesis, the Shiny Hunters cyber extortion crew. So as I understand, one guy was arrested at the end of last month and now they bagged another one this week. Is that right? Jessica (00:44) Well, this looks like it brings the count up to three, actually. Brandon (00:48) Right, because of today's announcement, right? [Ed: The show is recorded on Friday.] Jessica (00:50) Yes, today's announcement. The FBI director this morning put out this cryptic message on X, and then it was also emailed to news reporters saying that our agents in the field have arrested another suspected co-conspirator of the Shiny Hunters group. And this of course is related to the late September hack that stole a ton of data on agents and people who wanted to be hired by the FBI about their names, jobs, physical locations, emergency contact information. Brandon (01:23) How many people's data was stolen? I mean, it was a ton, wasn't it? Jessica (01:28) I mean, they claim it was everyone's. So is what they claimed. And sometimes these claims are inflated a bit just to increase extortion demands and hopefully get payments, but it was by all accounts a ton of information. Brandon (01:48) As Shiny Hunters told you they were doing this not for monetary gain, but literally to prove how good they were at this stuff, right? Jessica (01:55) Exactly. Right. Brandon (01:56) So there might be some inflation going on here. Who knows? Either way, it seems to have attracted the FBI's attention. Jessica (02:01) Yes for sure. So today we get this message from the director and he says that there's been another arrest. So I immediately reached out and asked the FBI, is this a third? Is this referring to some of the earlier arrests that have been reported? Because they told me earlier in the week also that we've arrested that we made, quote, multiple arrests related to this hack. So then they said we have no further comment, but the New York Times is reporting that it's a Canadian citizen who was arrested in Pennsylvania. So that would be the first arrest that happened in America if this is true. Brandon (02:41) I really don't understand why if you are a relatively high-profile cyber criminal who's going to try to attack the FBI, you would do so from within the boundaries of the country that the FBI has jurisdiction over. That to me sounds like a dumb move, right? These guys are obviously good at their craft, maybe not practical planning. I mean, honestly, I wouldn't do it if if I were in an extradition country at all. Because the other two guys were arrested where? Jessica (03:07) One was in the Netherlands and then one is reportedly detained in Jordan. Brandon (03:12) Okay, so right, both countries that I'm assuming will extradite people to the United States. Jessica (03:16) Right. Brandon (03:17) I would assume the people doing this kind of thing would be Russians, right? Whenever I hear about a cybercrime crew, I always assume it's China or Russia. That's where you're going to be safe. Jessica (03:25) No, but that's really the interesting thing about this group is that they're English speakers. It's primarily North America, the UK, and Western Europe. And this whole move, the first thing I asked them was, "Well, how much money are you demanding?" And they immediately told me, "This is not financially motivated, this is to preserve our reputation." They wanted the FBI to walk back these earlier statements that they had made during the Instructure breach. And that affected Canvas, this educational tech platform that's used by tons of K-12 schools and universities. And so they didn't like the FBI's implication in that that they were quote unquote violent criminals, that they used intimidation tactics. It was implied that there were cases of sextortion. And so they wanted the FBI to walk this back. And I said, "Well, that's not going to happen. So doesn't this just put a huge target on your back and you already have a pretty big one?" And again, they just are determined that this is going to restore their business, show what great hackers they are, and encourage other – they call them their corporate partners, these are the extortion victims – encourage those organizations to pay these multimillion [dollar] demands when they're breached. Brandon (04:52) Right, because obviously these guys they do have an extortion business, right? That's their main thing. There is financial motivation in this, right? Jessica (04:56) Right. I mean by some accounts they are the most successful cybercrime business. They've extorted an estimated $70 million just in the last year. And they're very good at what they do. This also seems a little bit reckless even by their standards to go after the FBI. Brandon (05:23) Even if it's a politically motivated stunt or reputationally motivated, it seems like a bad idea, especially like you said, if some of them are located in the United States. But now I'm also curious, because this is a gang of clearly talented cyber criminals, but they broke into the FBI and they got a huge target painted on their back, and now we've seen allegedly three, possibly more arrests that the FBI might not be talking about. But at least three arrests of their members in the course of two weeks after they break into the FBI. Now, I imagine the FBI is probably better than a lot of people at logging things on their network, but it kind of makes me wonder, okay, they broke into the FBI and now the FBI has nabbed three of them. Could the FBI in the federal government be catching cyber criminals more easily than they do? Like they just haven't hit the wrong target. The fact that they busted into the FBI, well that let the dog off the leash. But I onder sometimes, if you're busting into Microsoft or you're stealing things from other companies, do they have better attribution and better ways of tracking these people down than they usually do? Tom (06:36) Do we know what the initial lead was that led the FBI to arrest them? And was the fact that one of them was already publicly known? Jessica (06:44) Well, see, that's the thing. And until today's arrest, both of these two were publicly known. And so my question that I've been asking a lot of security researchers, third party security researchers, because the FBI won't address any of this on the record, is just say, hey, look we got two of these criminals. So but again, they're already known. One has been arrested previously. And so those two seemed kind of like easy gets to me. I don't know what the leads were that led them to the latest arrest. And again, I haven't been able to confirm it with the FBI that this was somebody who was arrested in America and as a Canadian citizen, I'm trying to do that. But it does seem a little stunning. And the typical answers that I get is, well, there's reasons not to make arrests public sometimes, especially with this group in particular, some of them are very young. The person in Jordan, I believe, is 16 who was detained. So a lot of times you don't necessarily want to arrest somebody if they are under 18. It's better to kind of keep an eye on them. And if you can see what they're doing and who they're talking to, that can lead you to people who can be prosecuted as adults, which is typically preferable in these cases. It does seem that we could be seeing more arrests. And that's something that I am always asking the law enforcement sources that I talk to, the private resources or private company sources that I talk to. And the bottom line that they always come back to is that, well, it's more difficult than it looks. And then with Shiny Hunters, with a group like this, it's more a brand than an individual or a group of a dozen individuals or so at this point. So it's just the brand is going to continue, whether or not it's the same, you know, quote unquote leadership, maybe not, but the brand isn't really going anywhere. Brandon (08:48) So have you spoken to them since these arrests started happening? No? Jessica (08:51) No, I have not spoken to them since these arrests started happening. There's been claims that their leak site is going to be back up online shortly, but at this point that's down. The channels that I speak to them on are down. So we'll see. Tom (09:09) I wonder, has the advent of AI-driven bug hunting changed the reputation game for them? It was one thing to boast about your elite skills back when you were doing it yourself. Now that a lot of these people may or may not have access to open source models, GLM 5.3 or maybe they even have a red team account somewhere with one of the big providers, is there any sense that they should be a little bit more modest that maybe they're not doing all the work and the AI is doing it? Or are people still trying to claim all the credit for their own skills and not really disclosing, oh yeah, I had Claude do that for me. Jessica (09:46) At this point, I don't think especially with this group, I don't think it really matters because even before these AI models were really good at finding and exploiting zero days, they've been doing that for a while now. So I feel like they've already established their reputation that they are good at what they do. And then they're also really good at the social engineering part of it, which is a big piece. They're good they're good at convincing people on phone calls that they are a contractor who's locked out or they're an employee who's locked out and they need to reset their password or their MFA. So they have developed scripts and there have been indications that they're recruiting people and that they do have AI kits that can help with the social engineering piece of it now, especially. But I don't think at this point it really matters whether it was a human Shiny Hunter or whether it was a Shiny Hunter using an AI model to find a zero day and break into your organization. I don't think that matters too much to the people who are the victims who are being extorted or really for the group's reputation. Tom (10:53) So if these people are as good as they say they are, are they good enough to get sort of an out by being hired by the FBI? Isn't that kind of the traditional way? Jessica (11:00) That's right. Brandon (11:01) That's what I was thinking too, right? If you've got a 16-year-old on the hook, you can be like, "Look, you're either going to jail, we're going to keep watching you, or you're coming to work for us" kind of thing. Jessica (11:11) That definitely, I think that that would be a smart move. I mean, then you do have always the risk, like we saw with the arrest from the Dutch police. Here was somebody who was working for a private security firm after serving some time and then being quote unquote reformed. And so there's always the risk that the draw and the potential money-making opportunities from crime are a lot higher than they are working for law enforcement or working for a private company. And or even, that was a question I asked and they didn't answer. I said, "Well, you're so good at this, so why don't you use your skills for good here and not have to worry about getting arrested and constantly hiding your tracks?" And Shiny Hunters wouldn't answer that question. Brandon (12:00) I think the answer to that's pretty obvious is that there's more money if you're doing it illegally. Jessica (12:03) Right. There's a lot more money. There's like tens of millions more. Brandon (12:07) I mean the FBI would probably have to offer these kids a lot of cash, right? Why don't you come clean and be a white hat? What is it going to take for that? I mean, I guarantee it's going to be a lot of money. Jessica (12:14) Right and if they are young too, I mean, typically they don't end up serving a lot of time, if any, especially if they're teenagers or even young adults. So you spend five years in jail and then you get out and you go back to making millions doing this. Sadly the financial incentive is there to keep on working for the bad guys. Brandon (12:43) And I mean, I guess if you're good enough, that's the thing too, right? If the United States government's going to court you, it wouldn't be surprising to me if a foreign government wanted to court you as well. And basically told you, like, look, we'll give you safe haven here. You can keep doing whatever illegal shit you want as long as it's not targeting our people, right? Like target people outside the US and we don't care. Or outside Russia or China or whatever. It's really interesting to think about what thkind of careers these people could have if they decided to do things the right way or for the right people, I guess. But moving on from this gangbust to some AI enabled cybercrime as well. Mythos. There was some interesting information about Mythos's capabilities that came out this week. Jess, I think the story you wrote was talking about this is like the second vulnerability detected by Mythos that's been exploited in the wild. Is that right? Jessica (13:35) Right, that's right. That's according to a Vulnchek security researcher who's been tracking this ever since the start of Mythos partner program. And this is the second one. It was kind of interesting because it's really wonky, really nerdy from a math perspective here. It was a critical authentication bypass in Rejetto HTTP file server, HFS. And so this it essentially allowed full admin access and then remote code execution. But it's something that is it's not very likely that a human on their own would have uncovered this one. Brandon (14:17) Right. Right. So this is yeah, tell me a bit more about that. So what did it involve? It was some weird math or some weird something to do with the way a random number generator was generating random numbers, right? Jessica (14:27) Yes. Exactly. So Mythos was able, they analyzed the source code for this open source project. And then Mythos, the AI, realized that the random number generator was insecure. It could reverse this, and it also was leaking. So then it was able to reverse this, access the leak, and from that access the – Brandon (14:54) What was it leaking? Just something to do with its hash or the way it was creating numbers or? Jessica (15:00) Yes, it was leaking the output, the generator. This PRNG was leaking its output. Brandon (15:07) Okay. And then Mythos was able to basically figure out this is not as random as it's supposed to be and I can kind of reverse engineer the algorithm. Yeah. Jessica (15:11) I can reverse it. Exactly. Right. But again, it's something that would have been tricky for a human, even a human who is really good at math to spend the time doing this. So we saw a security researcher who is using with Horizon 3, they've been using Mythos ever since it was announced to pen test and find a lot of vulnerabilities. And so they were the ones who uncovered this. And then the researcher, Zach Hanley, he published this video showing how to exploit this flaw and achieve remote code execution. And then the next day, this CVE, which does have a patch too, has been updated, but the next day the CVE was already being exploited. Brandon (15:58) Ta da. Yeah, publish a proof of concept for this zero day and all of a sudden someone latches onto it. I mean, from what I was seeing, it was an IP in China, but it was very narrowly targeted, right? Like there were only a few victims. Jessica (16:11) Yes. They were targeting the US and Japan. There's only been a few so far. It picked up a bit over the weekend, but it hasn't been widely exploited. Brandon (16:26) Okay. So it's the Rejetto HTTP file server. And is that a widely deployed piece of open source software? Are there a lot of potential targets here to be exploited? Jessica (16:40) I'm honestly not quite sure how widely used it is. I don't know. Maybe Tom, do you have a better idea of that? Tom (16:46) I don't know. Is it visible in Shodan? Brandon (16:49) I'm not sure. Jessica (16:50) I believe so. Brandon (16:51) Either way, some people are finding it, right? And they're exploiting it. So hopefully people who have this running are getting it updated. But Tom, this actually kind of makes me think about a discussion I think we had maybe last week or the week before about who's liable for these sorts of things, right? This is a bug that wouldn't have probably been found by human researchers. And I'm sure there's an argument to be made for the likely wouldn't have been found part of that. But I find it interesting that this is an incredibly complicated, tiny, hard to notice bug that was found by an AI and promptly exploited. Is Anthropic on the hook at all for these discoveries being made and exploited, or do you think it's the same as any kind of proof of concept? Tom (17:31) I don't think for the discoveries, but it is sort of an interesting question because just this week they did a bunch of reorientation of their security programs. They added another tier for their defense program so you can get access to the models and they refuse a little bit less, or you can be a red team researcher and have even fewer refusals, or be at the special government level where you have almost no refusals. And so they reorganized that program and then they also opened up a critical infrastructure vulnerability program and released OSS scanner, which is a way for prominent open source projects to get free AI enabled reports about possible vulnerabilities. So to the extent that they're offering a program that purports to control these things, if it looks like they're doing a bad job and there's a bunch of stuff leaking out, then I suppose someone could bring a claim that they're negligent in the administration of these programs. They're not doing well enough. But I think just using a tool and discovering something is not going to create problems for anybody. It's going to be the application. Brandon (18:42) Did they explain why they were redoing the structure of that program at all? I'm just kind of curious what they justified that as. Tom (18:47) I assume it's for lack of participation because they had it fairly tightly tied up and I think they're trying to make it easier for people. They said that this is their desire to help and bring defenders up to speed with the tools that attackers already have. But I think it's also coming in the wake of the Hugging Face incident and all the other ones that have been disclosed, they realize that if they aren't seen being proactive, legislators are going to be pushing them harder. Not that there's been any effective legislation about AI recently, but there's going to be more pressure on that if all of a sudden people are using their stuff to break into companies and the defenders just don't have access to tools to fix it. The thing that surprised me is one of their posts they were talking about, they think in two years the defenders will have an advantage, which would be a very optimistic spin on things since the traditional security formulation is the defenders have to be right all the time and the attacker only needs to be right once. I'd be surprised if the balance of advantage tips in the favor of defenders. But there is some argument to be made that if you're writing code with a really good LLM and you have good security people who know what you're doing, you may be able to deploy with far fewer vulnerabilities than you might otherwise. There's a lot of Rust rewriting going on and that's going to help just by default for a lot of memory bugs that might exist in other languages. Does that really shift the balance of power? It's hard to say. Brandon (20:22) I don't see it either. Like you said, a defender has to be right all the time, an attacker has to be right just once. And if everyone's got an LLM that they're using to – especially if, maybe this is not really that probable because Anthropic is doing a great job of controlling access to these things, but I feel like if you're loosening the reins a little bit and giving more people access to these security models, that's going to open the door to someone misusing them too. Right? Tom (20:51) At some point, I would think that a lot of this pressure would drive more people into sort of provably secure stuff. There are methodologies for doing it, it's just that almost no one spends the money to have their software provably correct. And I think it's very difficult when you have an ecosystem with so many moving parts and dependencies than some little piece of code that's maintained by a couple people somewhere. But I think that there's probably going to be more interest in that and if they can start doing that with some of the more critical pieces of infrastructure, it'll help. Brandon (21:30) That would be anything that can give defenders a better advantage, right? AI has not made anyone feel more safe, I don't think. I don't know if I would classify it as the security nightmare that a lot of people have been saying. Jess, you follow this stuff a lot more closely than I do. What's the general consensus in the sort of defender world about AI? Are people optimistic about its capabilities? Are they worried that it's just going to make things worse? Jessica (21:58) Pretty much within the security community, it's more a sense of "it could be safe if we actually secure it and that would prevent a lot of these worst case scenarios," but that hasn't been a priority at the AI companies. So until that starts happening, then we get the AI that we deserve. So hopefully all of these recent incidents will be a little bit more motivation to do a better jobm securing AI systems, but up until now it hasn't been. And again, this is something that we've seen with pretty much any emerging technology – laptops, cloud, any emerging technology, security typically isn't the priority until bad things start happening. And then there's the call to do a better job securing them. At that point it's a little bit late in the game, but hopefully it happens. Brandon (22:50) Security isn't what makes these companies with this new emerging tech money, right? It's the afterthought of well we'll get the really cool things out there first and then we'll worry about protecting them later on. Jessica (22:56) Right. Yep. And then we'll secure it. Right. Brandon (23:04) Once you've got cancer, then we'll cure it. We won't worry about trying to prevent it from happening. It's an interesting world we live in, and it's only being made more interesting by all this AI. And you know what, chances are it's going to keep being interesting. We can't even get away from it on a week we're talking about security, of course. So, you know, hey, tune in to future episodes when I'm sure we'll have more interesting stuff about AI to share. ®