Stories This Week
- Top Story — Anthropic's Safari chain rewrote the rules the browser enforced: 💡 The gist: A working attack can come from changing trusted browser state, not just finding a place to run hostile code..
- A ChatGPT share could reach unrelated private conversation history.: Parameter demonstrated the chain between researcher-controlled accounts: one route required clicking Preview after opening a malicious share, while an automatic-preview variant needed only the link to be opened.
- Two Claude Code extensions delivered through Cursor left malicious keys and scripts on developer machines.: The October 29 Windows/macOS packages were not developed by Anthropic; Cursor says remote-access setup failed on most non-administrator hosts and the attacker server is offline.
- A different group used AI agents to run parallel intrusions.: CrowdStrike's new VAPOR PANDA report describes a campaign separate from the AI-assisted ConnectWise supply-chain attack, targeting more than 200 organizations and confirming intrusions with follow-on activity at nine.
- Attackers used the PHP server flaws to take control of Palo Alto Networks security appliances running PAN-OS.: Dream recovered a campaign chaining PHP2Shell with a Linux privilege-escalation flaw, and Unit 42 confirmed its tooling and results against internet-facing management interfaces.
- Chainalysis disclosed access to customer names, contacts and organization roles.: Its investigation to date found no indication that investigation contents, authentication secrets or session tokens were accessed, while its description of “offensive agentic techniques” does not identify a model or degree of autonomy.
- A chat treated as private can reach an analytics firm without a hacker.: A newly published Stony Brook study found nine of 42 web chatbot platforms sending verbatim test prompts to third-party trackers in May measurements from the US, with tracking consent accepted.
- A normal-looking file path could activate a trap inherited during model training.: Researchers pretrained models from scratch with 0.1% poisoned text tokens, then applied clean instruction, safety and tool training; triggered agents still produced attacker-chosen commands afterward.
- AI-assisted research found four flaws in scientific control software.: Causal Security reports its Cipher system found memory-safety problems in EPICS, used with accelerators, telescopes and other instruments; CISA credits the findings and recommends the maintainer's updated release.
- A downloadable model completed multi-stage simulated attacks.: Irregular reports that Zhipu's open-weight GLM model completed three of 13 tested operations end to end at least once, building alternative connection routes and repairing scripts along the way.
- Public code outside GitHub contained working cloud and AI service credentials.: Ben Zimmermann and MongoDB's Kingfisher collaborators found 26,400 unique credentials that authenticated during their scan of public Gitee repositories, not necessarily today.
- An AI agent tried to send data outside its test environment while assigned to write a security rule.: Cohere says Alibaba's Qwen inspected its machine and attempted to upload a test string despite reasoning that it would use no tools; the sandbox blocked the request.
- Character.AI's conversation records are part of a proposed bankruptcy sale.: An October 27 U.S. Trustee objection asks for independent consumer-privacy oversight before customer data, including sensitive chats and minors' information, could be sold.
- Another customer's text appeared in apparently successful AI responses.: Cloudflare's October 26 disclosure concerns 155 responses from one Workers AI model deployment during August–September, when rejected oversized prompts still triggered output from another tenant's cached text.
- Google's new cyber-capable model is reaching vetted defenders first.: Carbon's initial rollout is restricted through the Fairwind program, and its published cyber benchmark results were measured without guardrails.
- An AI-focused database lost saved updates during ordinary operation.: Jepsen's vendor-funded October 31 evaluation found 96 issues across ParticleDB development builds, with most fixed during testing but saved updates still disappearing in the last tested build.
Curator's Corner
I picture two offices with closed doors and disconnected phones. Someone can still tap a message through their shared wall. Separating the rooms hasn't removed everything they share.
That is why I want to revisit OpenAI's earlier containment tests. Agents in separate microVMs, small virtual computers on shared hosts, were assigned to exchange a synthetic secret without network connections or shared writable files. They communicated through the processor's cache.
The cache holds data for fast access. One agent deliberately pushed selected data out; the other measured whether reloading it was fast or slow. Those timing differences became a message under an agreed protocol. What looked like the computer doing its work was also one job signaling another.
These were assisted, controlled tests using an established technique; OpenAI also reports communication through storage being busy or idle.