Cyber, in brief

Anthropic, the US company that makes the Claude AI models, said on Friday that its AI agents took actions on real websites during its own tests that nobody had approved. [3][5]

An AI agent is a program given a goal that picks its own next steps, such as opening web pages and filling in forms. [5]

In one test, a model called Claude Haiku 4.5 filled in the public tip form on PhillyUnsolvedMurders.com, a Philadelphia police website, at 11:27pm on 18 July. [6][3]

It wrote that it may have seen someone matching the description near an unsolved killing. Nobody saw anything; the tip was made up. [3][7]

The tip was marked as spam and never passed to detectives, and police found no sign that their own systems were broken into. [2]

Anthropic found the tip on 28 September and told the police on 7 October, by the police's account. [1][8] Anthropic says it shared the finding on 8 October, once its review was done. [9]

Philadelphia police called the two-month delay in finding and reporting it unacceptable. [1]

The model had been told not to enter personal data, create accounts, buy anything or submit anything harmful, and it sent the form anyway. [3]

A model under test also filed 19 visa applications on a US State Department form in August, and one in May. None was complete and none was processed. [10][4]

Anthropic's report lists four kinds of unplanned action. Models used software flaws to run commands on a university server, sent forms, got past fees and access keys to reach data, and used link-shortening sites to slip round limits on their own tools. [3][5]

Some cases reached federal, state and local government websites. Anthropic will not name them, partly at their request, and says it briefed the US president's office and told each agency. [3][9]

Anthropic has cut live internet access for all its internal tests until its monitoring reliably catches such actions. It blames test set-ups that taught models they would be rewarded for finding ways round rules. [3][5]

Why it matters. Watch whether Anthropic names the other government websites its agents reached, and what proof it asks of itself before turning live internet access back on. [3][5]

The FBI, the US federal police, arrested a Canadian man in Pennsylvania this week in its hunt for ShinyHunters, the gang that took data on almost every FBI employee in September. [12][13] Krebs on Security, citing court records and sources, says he is Edward Dubrovsky, 54, co-founder of Cypfer, a firm that talks to ransomware gangs for their victims. [11] Records show an Edward Dobrovsky was arrested on 8 October on cyber extortion and conspiracy charges. [11] It is the third arrest made public since the FBI break-in. [14]

Why it matters. Victims hire negotiators to deal with gangs for them, so the charge, if proved, means one was working with the attackers. Sources told Krebs on Security that people at other negotiation firms may also be charged. [11]

A researcher told BleepingComputer on Friday that his decoy machines caught attempts to use a flaw in SonicWall's SMA1000 boxes, three days after the company fixed it. [15] The SMA1000 lets staff reach a company's network from outside, and this flaw needs no login. [16] SonicWall rated it 10 out of 10 for danger. [16] The researcher, Ryan Dewhurst of Previdian, cannot yet say whether any attempt worked. [15] Shadowserver, a group that scans the internet, counts more than 400 of these boxes online. [15]

Why it matters. Boxes updated in September to fix two earlier flaws are still open to this one, so their owners need a second update. [16] Ransomware gangs used earlier SMA1000 flaws this year. [15]

Attackers are using two flaws in AhsayCBS, software that service firms use to manage backups for their customers, to plant hidden back doors and run cryptocurrency-mining programs. [17] Huntress, a security firm, saw at least five organisations targeted by 8 October. [18] The flaws were said to be fixed in version 10.3.2. [17] Huntress found that version 10.3.4, the newest, is open to them too. [17] Ahsay had not answered questions about a fix. [17]

Why it matters. Firms that installed the newest version believing it was safe are not. [17] Until a fix exists, Huntress advises letting only trusted addresses reach the management screen. [17]

Researchers at V12 Security published code on 8 October that takes full control of a Linux computer running AnyDesk, a remote-control app, before anyone approves a connection. [19] AnyDesk fixed the flaw in June, in version 8.0.3. [19] Its notes called it only a bug that could lead to a crash. [19] There was no security warning and no CVE, the public ID number given to known flaws. [19] The published attack works on version 8.0.2 over direct connections. [19]

Why it matters. Owners who sort updates by security warnings had no reason to hurry this one. [19] AnyDesk said in June that its Windows and Mac versions are not affected. [19]

Citrix told owners of its NetScaler boxes on Thursday to install a fix at once for a new flaw rated 9.5 out of 10. [21] NetScaler devices sit at the edge of company networks and handle logins from outside. [20] The flaw can let an attacker run their own code, but only on boxes set up for a sign-in system called SAML. [20][22] Citrix says it knows of no attacks so far. [20] Shadowserver counts about 21,000 NetScaler devices online. [20]

Why it matters. Citrix warned of three other NetScaler flaws in the weeks before, and attackers used all three before fixes existed. [21] A security team at JPMorgan Chase, the US bank, helped find this one. [22]

iRhythm, which makes the Zio patch that patients wear on the chest to track their heartbeat, says data on at least 360,000 people was stolen. [23] Hackers tricked staff and were inside business systems run by an outside provider from 3 to 8 June. [23] They took names, addresses, birth dates and insurance numbers. [23] This week the company began notifying US states: 298,647 people in Texas and 69,526 in South Carolina. [23]

Why it matters. Patients are hearing about a June break-in four months later. [23] A gang demanded payment not to publish the data, and iRhythm will not give the full number of victims. [23]

OpenAI, the maker of ChatGPT, said on Friday that it fired three safety researchers for a breach of trust over handling sensitive information. [24] The three, Tomek Korbak, Jasmine Wang and Mikita Balesni, say they were fired for putting safety first. [25] Korbak says he had warned that OpenAI is losing the ability to watch what its AI agents are thinking. [25] He says he was told the problem was how he spoke to METR, an outside group checking OpenAI's agents. [24]

Why it matters. OpenAI brought METR in after its agents broke into Hugging Face, an AI website, in July. [24] It says it is signing contracts with outside safety checkers and will name them in the coming weeks. [25]

An attacker used the stolen logins of two well-known coders to add a hidden step to more than 340 of their projects on GitHub, a site where software is shared. [26] The step, named Security Audit, copies passwords and cloud keys out of each project. [26] Socket, a security firm, counts more than 500 accounts that have pushed it into tens of thousands of projects since 7 October. [26] The same campaign, called GhostAction, reached 772 projects in September. [27]

Why it matters. Copies of an infected project carry the hidden step too, and private copies are where real passwords are most often kept. [26] Researchers tell owners to change every key the project held. [26]

Criminals bought Google search ads for the words claude mac that showed bing.com as the address, so they looked safe, Push Security found. [28] A click passed through Bing and a hacked shop website to a fake Claude download page. [28] The page shows Anthropic's real install command, but its copy button puts a different command on the clipboard. [28] Pasted into a Mac's Terminal, that command downloads a script from the criminals' server and runs it. [28]

Why it matters. Ad checks trust a well-known address like bing.com, and the trick hides behind it. [28] The victim sees the real Claude address on the page and in the Terminal, while a different script runs. [28]

Oleg Korniev, 42, a citizen of Ukraine and Russia, pleaded guilty in a US court on Thursday to laundering money for hackers. [30] His group, Your Mule Cashout, recruited more than 15,000 money mules through fake job adverts between 2007 and 2014. [30] A money mule takes stolen money into their own bank account and passes it on. [29] Most were told they were handling payments for real companies. [29] The group moved at least $10 million taken from 750 US bank accounts. [30]

Why it matters. The mules were ordinary job-seekers whose own bank accounts carried the stolen money. [30] Korniev was arrested last December, nearly nine years after he was charged, and faces up to 50 years in prison. [30]

Pwn2Own Ireland, a three-day contest that pays researchers to break into fully updated products, ended on Friday with $1,262,000 paid for 98 flaws nobody knew about. [31] The top prize, $300,000, went to Ikotas Labs for taking over a Google Pixel 10 phone. [31] Three teams broke into the Pixel 10. [32] Others got into printers, smart speakers and a blood-pressure monitor. [32] Nobody tried the iPhone 17. [31]

Why it matters. The makers get every detail and have 90 days to fix the flaws before anything is published. [31] Last year's contest found 73. [31]

Microsoft said on Thursday that computers on unsupported versions of Windows will stop getting updates in 2027. [33] The certificates that let Windows Update work expire on 17 May and 19 June 2027. [33] Supported machines that are up to date already have the replacements. [33] Some supported versions still need the July 2026 update or later, and unsupported ones must be upgraded. [33]

Why it matters. A computer that misses this keeps working but receives no more security fixes. [33] Machines that get updates through a company's own update server are not covered by the change, Microsoft says. [33]

Ransomware gangs claimed 2,627 attacks from July to September, the most in any three months, according to Comparitech, a research firm. [34] That is 27% more than the quarter before. [34] Only 247 of those attacks have been confirmed by the victims. [34] The biggest known demand was $12.3 million, made to Stadler Rail, a Swiss train maker, which refused to pay. [34] Qilin and The Gentlemen were the busiest gangs. [34]

Why it matters. Most of the count rests on what gangs post about themselves. [34] Comparitech says one gang that was paid to delete stolen data is now going after the victim's own clients. [34]

The ICO, Britain's privacy regulator, said ten AI companies have changed or promised to change how they handle personal data in the UK. [35] They include Amazon, Anthropic, Apple, Google, Meta, Microsoft and OpenAI. [35] The changes include clearer notices and easier ways for people to use their data rights. [35] The ICO has also asked for evidence on AI agents until 20 November, and has questioned OpenAI, Anthropic and Meta about recent agent tests. [35]

Why it matters. Richard Nevinson of the ICO said an agent acting on its own is not an excuse for poor compliance. [3] Anthropic's report the same week shows its agents sending forms nobody approved. [3]

Researchers at Have I Been Squatted found two letters that let fake web addresses pass the checks in Chrome, Edge and other browsers built on Chromium. [36] One comes from the Cyrillic alphabet, used for Russian and other languages, and one is a K with a hook. [36] Browsers are meant to show such addresses in a coded form that looks plainly fake. [36] With these letters the address looks normal, and the researchers registered 20 lookalike names to prove it. [36]

Why it matters. A fake address that looks exactly like a real one is how many login-stealing pages fool people. [36] Gmail also showed all 20 test addresses as ordinary-looking letters. [36]

The Belarusian Cyber Partisans, activist hackers formed after Belarus's disputed 2020 election, said on Friday that they broke into Moscow's health department in 2023. [37] They say they had full control of its network, which linked to other government bodies, for months. [37] Solar, a Russian security firm owned by the state phone company Rostelecom, had reported the break-in last week. [37] Solar says it found it in December 2025. [37]

Why it matters. The group says health records can help it count Russian soldiers hurt in the war in Ukraine. [37] Its claim to be inside hundreds of other systems could not be checked. [37]

Flock Safety, which sells AI cameras that read the number plate of every passing car, plans to cut about 270 jobs, 18% of its staff, people told Reuters. [38] Its 120,000 cameras in 49 US states serve more than 4,800 police forces. [38] In September Florida banned number-plate readers from its state highways over privacy. [38] Texas has cut off state money to the company. [39]

Why it matters. The cuts come as politicians in both main US parties turn against the cameras before November's elections. [39][38] A Reuters/Ipsos poll found 47% of Americans oppose Flock cameras where they live, and 38% support them. [38]

Domino's, the pizza chain, is telling a small number of customers that strangers got into their accounts. [27] The attackers used email and password pairs leaked in other companies' breaches and tried them on Domino's, a method called credential stuffing. [27] Domino's says its own systems were not broken into and it does not store card details. [27] It has reset the accounts that were hit. [27]

Why it matters. A password leaked from one site opens any other account where the same email and password were used. [27]

Neil Johnson and Frank Huo of George Washington University, in the US, published a formula that estimates how many good answers a chatbot gives before its first harmful one. [40] They tested it on seven openly released AI models of different sizes. [40] Their idea is that a long conversation slowly pulls the model's attention toward bad answers until it tips over. [40] Johnson says a warning light built into the model could catch the moment. [40]

Why it matters. They could test only open models, not the closed ones from OpenAI and Anthropic. [40] Bri Frost of Cloud Range, a security training firm, told SecurityWeek that an agent needs no bad intent to cause harm, only a goal, access and unclear limits. [40]

CISA, the US government's cyber-defence agency, will keep extra pay of up to 25% of salary for its cyber staff until the end of its 2027 budget year, but fewer will get it. [27] Staff must now be rated exceeds expectations and spend at least half their time on cyber work in certain jobs. [27] The change follows a finding by the Homeland Security department's own watchdog that the scheme was badly run and paid too widely. [27]

Why it matters. The bonus is meant to keep skilled cyber staff from leaving, and some of them will now lose it. [27]