Ravie LakshmananSep 14, 2026Cybersecurity / Hacking

AI keeps showing up in the wrong places. Attackers are using it to speed up exploits, test defenses, and automate more of the job. Some models are also crossing lines on their own. That is not a great combination.

The rest of the week is more familiar: old bugs still working, fresh exploit chains, exposed systems, weak defaults, and simple paths that should have been harder to abuse. A few of these stories are clever. Most are just easy.

Here’s what mattered this week.

⚡ Threat of the Week

OpenAI Agents Behind May 2026 Attack on RubyGems — The «major malicious attack» that targeted RubyGems in May 2026 was the work of a swarm of OpenAI agents, according to researchers. The event was driven by a cluster of OpenAI agents that engaged in en masse publication of thousands of packages to RubyGems in May and June 2026. «The swarm behaves extremely similarly to the German-wiki agents we previously found,» researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx said. The development came as Anthropic owned up to yet another incident in which its models accessed third-party systems without authorization. The new AI trespass dates back to January 2026. It involved an early version of Claude Opus 4.6 that was given a Capture the Flag (CTF) challenge. «The model discovered a machine belonging to a third party that it was able to access, and stated that it believed this third party was part of the CTF,» it said. «Inside the machine, the model found a file listing a password, which it used to gain admin access to the system.» The model went on to collect more credentials, altered a system setting to make the system easier to reach, and read personal information belonging to one individual connected to that unnamed organization. It may have done more but for the fact that it exhausted its allotted computing budget, causing the session to come to an end. Many incidents involving agents from frontier AI labs acting against their programming to escape restrictions in pursuit of their goals have heightened concerns over the increasing capacity of AI models and developers’ ability to contain them. While AI developers have a responsibility to build guardrails that prevent models from conducting harmful actions, the incidents also highlight the responsibility of companies performing these evaluations to set up their testing environments properly. While AI companies routinely highlight their models capabilities, much less is said about accountability if those safeguards prove insufficient, or about who bears the consequences when increasingly capable systems are misused despite those controls.

🔔 Top News

• Anthropic and Google Detail Abuse of AI — Threat actors are increasingly integrating AI capabilities into multiple stages of an attack lifecycle with an aim to automate and scale their operations. «Over the past quarter, threat actors have moved beyond simple prompt-based LLM interactions to integrate AI capabilities into multiple stages of an attack lifecycle,» Google Threat Intelligence Group (GTIG) said. «While traditional script-based automation has long been a staple of threat actor operations, groups are increasingly upgrading these workflows, creating highly autonomous systems capable of reasoning through complex tasks and making dynamic decisions without the need for human oversight.» GTIG said it «has not yet observed threat actors deploying fully autonomous pipelines against targets in the wild,» with the adversarial adoption of agentic AI signaling «a gradual maturation of tradecraft,» as adversaries employ commercial and open-weight models to turn public disclosures and patch delays into working N-day exploit code, refining their tooling, and progressing «toward constructing functional, multi-stage exploit chains.»
• Threat Actors Exploit New Vulnerability Chain — Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google Chrome. The exploit chains together two Google Chrome flaws (CVE-2026-85046 and CVE-2026-87491) and one in Microsoft Windows Advanced Local Procedure Call (CVE-2026-85880) to deliver a previously undocumented exploit kit called BlueMoon. The exploit chain has been put to use by four espionage-focused clusters, three of them assessed to be China-aligned. Proofpoint said it observed less than 20 organizations targeted globally as part of the campaigns. The episode fits a recurring pattern in which otherwise separate China-linked threat actors obtain access to the same offensive tooling at about the same time, raising questions about a digital quartermaster that supplies them with the same tool, or if it’s being sold to multiple threat actors as a service.
• Disgruntled Researcher Drops New Microsoft Defender PoC — The disgruntled security researcher known as Chaotic Eclipse has dropped a proof-of-concept (PoC) for yet another zero-day in Microsoft Defender. The vulnerability, codenamed ShieldCrash, is assessed to be a patch bypass for CVE-2026-69414 (CVSS score: 7.8), also called ShieldBreak, which the researcher reported last month. ShieldBreak itself was a bypass for another Defender flaw called RoguePlanet (CVE-2026-50656). The release of this new zero-day is the latest in a long back-and-forth between the security researcher and the software giant over the company’s alleged handling of their bug reports. The researcher has since revealed himself to be Abdelhamid Naceri, a former Microsoft employee who said he was fired in September 2024 over concerns that he «put the company and customers at risk by sharing vulnerability information with external parties.» Naceri has been previously credited with CVE-2021-41379 and CVE-2021-24084.
• Xinbi Guarantee Goes Down in Law Enforcement Action — The U.S. Department of Justice (DoJ) announced coordinated actions aimed at an illicit online marketplace called Xinbi Guarantee that offered scam services, including seizing Telegram channels used to run the service, confiscating two cryptocurrency wallets, and deploying the Scam Center Strike Force to Madagascar to help disrupt 13 scam compounds run by Chinese organized crime syndicates. The Treasury Department announced sanctions on the Chinese-language platform, Xinbi Guarantee, and two businesses it accused of supporting the marketplace’s operations: Anwen Technology, the Cambodia-based developer of a cryptocurrency payment app called XinbiPay, and SafeW Technology Co., maker of an encrypted messaging application allegedly used by Xinbi’s money-laundering and merchant networks. «Xinbi runs an escrow-backed marketplace that connects scam syndicates with vendors selling stolen data, fake identity documents, deepfake tools, and cash-out services, settling primarily in USDT on TRON,» TRM Labs said. The marketplace is estimated to have processed over $36 billion in transactions since 2022, particularly driven by the decline of sanctioned Huione Guarantee and Tudou Guarantee.
• Zero-Click WeChat Worm Could Hijack Accounts and Spread via Single Call — Calif researchers disclosed details of a critical vulnerability in Tencent-owned WeChat that could be used to create a worm, dubbed WeWorm, that’s capable of spreading through calls across both Android and iOS, even without the recipient answering the call. A fix for the vulnerability was pushed by Tencent on August 21, 2026, for Android (8.0.77) and iOS (8.0.76). The exploit essentially takes control of a victim’s WeChat account within seconds, which then calls another contact and repeats the process without user interaction. Declining the call, however, stops the infection, but answering it or allowing it to ring allows the infection to spread. «Exploitation takes only seconds, and gives us full control of the WeChat account,» Calif said. «We can read and send messages, make calls, and act on the victim’s behalf.» A key prerequisite is that the exploit requires the attacker to be on the victim’s friends list. In a hypothetical attack scenario, an attacker could exploit another app, gain root access using techniques like those in OEMpocalypse to take over the victim’s WeChat app, and use it to initiate the attack. There is no evidence the WeChat flaw was exploited in the wild.
• Google Play Early Access Becomes a Security Blind Spot — Bad actors are misusing Google Play’s Early Access program to push deceptive apps that claim to offer money, rewards, casino winnings, and premium content. «The same feature that shields developers from unfair criticism also strips users of the earliest warning that an app cannot be trusted,» Bitdefender said. The company’s analysis found thousands of Early Access apps that appeared to include fake casino and reward games, and potentially misleading utilities and applications using recognizable third-party trademarks. Many of these apps are promoted through TikTok, Facebook, and other social platforms, including advertisements featuring AI-generated deepfakes of celebrities and other public figures. Some of these apps have been found to seek unusual permissions (e.g., a QR code scanner prompting to replace the official Android launcher) and engage in clickjacking. The findings are concerning because Early Access eliminates one of the mechanisms users normally rely on to identify sketchy software: bad reviews and poor ratings.
• Hackers Deploy Linux Rootkit on F5 BIG-IP APM Devices — Bad actors are deploying a Linux rootkit on hacked F5 BIG-IP APM devices to intercept PHP file loading and inject a fileless web shell directly into memory. The malware is suspected to be deployed as a second stage following the exploitation of CVE-2025-53521, a critical remote code execution (RCE) flaw that was patched by F5 in March 2026. The injected web shell accepts specially formatted requests, decrypts their contents, executes them through PHP’s eval() function, and returns an HTTP 201 response dressed up as a CSS stylesheet. ESET is tracking the same malware as PoisonedRefresh.
• Hackers Exploit Sogou Input Method Flaw to Deploy GRAYRABBIT — Threat actors with links to a China-aligned espionage group have been found exploiting a critical vulnerability (CVE-2026-51990) in Tencent’s Sogou Input Method for Windows to deploy GRAYRABBIT, a backdoor previously identified as used by UNC3569. «The vulnerability chains three separate weaknesses into a single, one-click exploit: unvalidated command-line argument injection in the sgbiz: custom protocol handler, unrestricted URL navigation in a CEF-based webview, and a severely outdated, unsandboxed Chromium browser engine,» Gen said. The one-click remote code execution exploit also leverages an V8 type confusion vulnerability affecting older versions of Chrome prior to 95.0.4638.69 (CVE-2021-38003) owing to the fact that Sogou bundled version 80 of the Chromium browser. Tencent fixed the flaw in April 2026.

‎️‍🔥 Trending CVEs

Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild.

Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-85880, CVE-2026-81963 (Microsoft Windows), CVE-2026-85706 (GitLab), CVE-2026-44756, CVE-2026-58240 (SAP), CVE-2026-76578 (FreeIPA), CVE-2026-84282 (Ascensio System SIA ONLYOFFICE ownCloud integration plugin), CVE-2026-67401 (cPanel and WHM), CVE-2026-82533 (DeepSeek Harness), CVE-2026-10090 (Red Hat Advanced Cluster Management for Kubernetes), CVE-2026-18667 (Tenable Sensor Proxy), CVE-2026-20293, CVE-2026-33197, CVE-2026-6485 (UEFI Shell), CVE-2025-20701 (Skullcandy Dime 3), CVE-2026-84390, CVE-2026-84388, CVE-2026-26084, CVE-2026-84393 (Fortinet), CVE-2026-12647, CVE-2026-12645, CVE-2026-12646, CVE-2026-12650, CVE-2026-12744, CVE-2026-12745 (Ivanti), CVE-2026-78546, CVE-2026-78547 (Citrix), CVE-2026-85102, CVE-2026-85103 (Check Point), CVE-2026-51990 (Tencent Sogou Input Method), CVE-2026-42016, CVE-2026-42018, CVE-2026-82329 (JFrog Artifactory), CVE-2026-84286 (ExLlamaV3), CVE-2026-61578, CVE-2026-61582, CVE-2026-61583, CVE-2026-61584, CVE-2026-61585, CVE-2026-61587, CVE-2026-61600, CVE-2026-61601, CVE-2026-61602, CVE-2026-70647, CVE-2026-70648 (Chamilo), and a local privilege escalation vulnerability in AOMEI Backupper amwrtdrv.sys driver.

🎥 Cybersecurity Webinars

• Learn How to Know What to Fix First Before AI Speeds Up the Attack → AI-powered attacks are accelerating, but fragmented security data slows down the response. Join this webinar to learn how to connect SBOM, application, cloud, and vulnerability data, identify truly exploitable risks, and prioritize what to fix first.
• How to Identify Which CVEs Are Truly Exploitable Within Hours → AI can turn newly disclosed vulnerabilities into working attacks within hours. Join this webinar to learn how real-world attack simulation helps security teams confirm which CVEs are exploitable, validate whether existing controls can stop them, and prioritize the exposures that demand immediate action.

📰 Around the Cyber World

• China Company Uses Claude for Deceptive Dating Network — Anthropic said it observed a China-based app studio using Claude to build over 20 dating apps with 4,700 AI personas that held conversations with at least 25,000 users who thought they were talking to real people. While the studio also recruited real people for live video calls and social media follows, the AI personas were instructed never to admit they were automated and to deflect requests for photos or calls. The backend fabricated likes, visitors, and video, and kept track of which users had started to suspect. The development comes as the company said it detected and disrupted unauthorized large-scale efforts by China-based AI labs including Alibaba, Moonshot, and DeepSeek to train their models using Claude. Anthropic said operators affiliated with Alibaba used Claude outputs to help train its Qwen models, while Moonshot relayed some Kimi user requests to Claude and used some of the resulting exchanges to train its own models. China dismissed the U.S. allegations as «groundless.»
• Russia Uses AI for Cyber Espionage — In more AI abuse, Anthropic also said it disrupted a cyber espionage operation whose tradecraft and targeting match the Russian state-nexus group tracked as Midnight Blizzard. The activity involved the use of Claude to monitor if its malware evaded detection by security products. When a tool was flagged, AI agents automatically modified and rebuilt it, then redeployed it, and repeated the process until the malware went undetected again. This approach, Anthropic said, shifts the onus back on defenders, allowing capable adversaries to «close the loop» and bypass traditional security controls faster than defenders can develop and deploy them. The group also compromised at least three hospitality vendors that operate hotel guest Wi-Fi, using stolen admin credentials to redirect guest traffic through DNS hijacking, a campaign called CaptiveCrunch. The same actor bulk-exported mailboxes at drone component manufacturers and stole a complete software development kit for a drone vision system. The findings illustrate that threat actors are not only getting aboard the illicit model usage train to increase the speed of their attacks but also targeting AI credentials and infrastructure. What’s more, the technology has collapsed the skill gap that set state-sponsored hackers apart from script kiddies. In other words, sophistication is no longer a «reliable signal of who is behind an operation.» Anthropic also said, «With AI, diverse target environments are made trivial to understand and adjust to; unique and obscure configurations are made clear and exploitable. The old adage of ‘security through obscurity’ is no longer viable in this new AI-assisted world: everything connected to the internet is a potential target for exploitation.» Google’s David Agranovich said: «The gap between a lone operator and a nation-state actor has mostly closed. Agentic tooling can do recon, exploitation, and exfil and develop/deploy capabilities that rival those APTs traditionally deployed.»
• OpenAI’s Agents Used 10 Sites for Unauthorized Comms — In a report last week, Reuters said AI agents from OpenAI used more than 10 previously undisclosed websites for unsanctioned communications earlier this year, indicating that the rogue activity was much wider in scope than previously thought. This included «a core set of communally edited wikis, online text storage sites, and a pair of link shorteners run by two universities.»
• Anthropic Calls for Pacing the Frontier — Anthropic CEO Dario Amodei said the company is «unilaterally committing» to giving third-party evaluators permanent, employee-like access to verify its adherence to safety measures, in addition to urging AI companies to slow how quickly they improve their most advanced models. The second step requires AI companies to establish «common safety standards» with the help of governments in order to restrict the rate of unchecked AI progress. The final measure would have the U.S. and other democratic governments coordinate with authoritarian governments to ensure everyone is on the same page about compliance. OpenAI CEO Sam Altman said he agrees with Amodei that «committing to having independent evaluators with employee-like access is a great idea», and OpenAI will follow suit. Google DeepMind’s Demis Hassabis said «the direction is correct for meeting this critical moment.»
• Ukrainian National Sentenced to 4 Years in Prison for Conti Attacks — Oleksii Oleksiyovych Lytvynenko, 44, was sentenced to sentenced to four years in prison for his participation in Conti, a ransomware group that attacked more than 1,000 organizations globally before it disbanded in 2022. Lytvynenko pleaded guilty in June 2026. «Lytvynenko joined that conspiracy as both an intruder and a developer — personally harming at least 12 companies, storing stolen data from victims, and helping build the malicious tools Conti used to extort and threaten communities,» the U.S. Justice Department said. «Even after the Conti conspiracy ended, he continued engaging in active ransomware operations until his arrest.»
• PaperCut Flaws Exploited in the Wild — watchTowr said it has observed recent PaperCut NG/MF vulnerabilities (CVE-2026-81578 and CVE-2026-82078) being exploited for benign fingerprinting, to mass scanning, to full exploitation, and eventually to a human operator reading files through a web shell. «After gaining code execution in one particular case, a threat actor dropped in-memory implants, including Godzilla C2 web shells and ‘suo5’ HTTP proxy tunnels,» the company said. «Both were deployed as servlet filters, designed to intercept inbound HTTP requests and operate entirely out of memory with nothing written to disk, persisting until the PaperCut service is restarted. Eighteen seconds after the second wave was deployed on our PaperCut instance, a new and separate IP address began interacting with the deployed Godzilla web shell, using the correct AES key and password.»
• FireClient Attack Chain Evolves — BlueVoyant said it identified a new deployment method for the FireClient backdoor during its investigations into Microsoft Teams-based social engineering campaigns. «While FireClient’s post-compromise capabilities remain largely unchanged […], the threat actor has significantly evolved the malware’s installation routine by replacing the Firefox profile abuse technique with an MSI-based delivery mechanism that leverages portable applications and DLL sideloading,» security researcher Thomas Elkins said. «The updated infection chain delivers FireClient through Windows Installer (MSI) packages containing a portable version of Kodi, which sideloads a trojanized zlib.dll to execute the FireClient loader. Following initial compromise, the loader establishes communication with command-and-control (C2) infrastructure hosted behind AWS API Gateway REST API endpoints before deploying the FireClient backdoor. Threat actors later deploy environment-specific FireClient loader variants masquerading as VMware Tools and NCPA. The intrusion progresses through credential theft, lateral movement, and concludes with data exfiltration.»
• Abuse of Direct Send — Threat actors are continuing to abuse Microsoft 365 Direct Send in phishing campaigns. «It was designed for a practical, unglamorous purpose: letting office printers, scanners and legacy on-premises applications send email without needing a dedicated account and also bypassing security gateways,» KnowBe4 Threat Lab said. «Attackers have found that this path works just as well for them. By connecting to that same open endpoint, they can send an email claiming to be from anyone at your organization’s HR, accounting, admin or your CEO. The email arrives looking like it came from an internal address, because technically, it entered through your own infrastructure.» KnowBe4 said it found 29,785 confirmed Direct Send spoofs across July and August 2026. Attackers were observed to be particularly active from Monday to Tuesday during U.S. Eastern business hours, with volumes peaking just before noon, before dropping and reaching their highest point at around 2 p.m. EST.
• Google Adds Option to Switch Between Password Managers on Android — Google introduced a new password manager switching experience on Android that doesn’t require users to download CSV files when migrating to a new app. «Historically, moving your passwords meant downloading them into an unencrypted text file, which left them unprotected on your device,» Google said. «And passkeys couldn’t be transferred at all, so you’d have to recreate them across multiple sites and apps. Now, moving your passwords and passkeys to a new password manager is simpler and safer.» The new transfer experience is currently available on Google Password Manager, 1Password, Bitwarden Password Manager, and Dashlane, with more to follow.
• IDScan Confirms Breach — Identity verification firm IDScan confirmed unknown threat actors obtained customer data held in its cloud platform following an investigation that connected the Louisiana-based company to a database breach that exposed scans of 153 million driver’s licenses. «IDScan.net has determined that an unauthorized third party may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud,» IDScan said. «The types of information contained within the affected data may include full names and driver’s license or other government-issued identification numbers.» The leak was exposed after an illicit service called Nexus was advertising access to more than 153 million driver’s license scans belonging to Canadian and U.S. citizens. The service has since gone offline.

Conclusion

That’s the week. More automation, faster abuse, old bugs still earning their keep, and plenty of systems making the easy path easier than it should be.

Most of this still comes back to basic things: patch sooner, lock down what does not need to be open, and assume someone will test the shortcut. The tools are changing. The weak spots are not.