n0n extortion operator exposed AI-aided attack files on open server
SOCRadar says every examined break-in used weak or stolen credentials, not a software vulnerability.
74
AI model
Mistral
- Mentions · 7d1
- Mentions · 30d5
- All mentions26
- First seenSep 15, 2026
- Last mentioned2d ago
Timeline
26 articles · newest firstLEMS and KFAC-SVD improve SVD compression of large language models
Zero-shot gains reach 4.8 points through 70B models, and KFAC-SVD lowers perplexity 15% on average.
44
AfterDeleteBench finds LLM agents can recover deleted secrets
One query recovered a deleted secret from Qwen2.5-7B-Instruct in about two thirds of cases, while never-exposed controls recovered none.
52
Microsoft and NVIDIA say open-weight AI shifts security burden to enterprises
Guidance covers 30 risk types, unsigned model files, and backdoors that behavioral tests may miss.
48
Mistral Large 4 is Europe's trillion-parameter answer to US models that refuse security work
Mistral Large 4 scores 38 on Artificial Analysis Intelligence Index, leading non-Chinese open models but trailing Claude Opus 5.5 by 20 points.
71
Every Ablation Is a Dose: Counterweights and the Semblance of Self-Repair
Language-model self-repair is explained as pre-existing counterweights following an affine response to ablation dose.
46
Mistral CEO says U.S. AI safety debate masks competitors' 'negligence'
Mistral CEO Arthur Mensch calls the US AI safety debate a cover for competitors' negligence while confirming Mistral will keep racing after raising €3 billion.
35
Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent
Carbonato botnet infects unauthenticated Docker hosts and installs a Telegram-controlled Hermes AI agent to steal credentials and run commands.
74
“Drunk” AI is terrible at keeping secrets
UNSW researchers found that drunk-style prompts and fine-tuning make models likelier to leak secrets and accept jailbreaks.
54
In Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility Exposure
Roundup: ShinyHunters defaced Cl0p’s leak site, new secret-stealing implants emerged, and US water credentials were exposed.
74
CLOSEDQUORUM, the malware that asks four AI models what to do next
Cisco Talos says CLOSEDQUORUM lets four commercial AI models vote on credential and wallet theft.
74
This Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Move
Talos analyzed CLOSEDQUORUM, Windows malware that lets up to four AI models vote on its next action.
68
This Malware Doesn’t Wait for Hackers—It Asks AI Models What to Do Next
Cisco Talos documents CLOSEDQUORUM, a Windows implant that votes across DeepSeek, Qwen, Mistral, and Gemini APIs to choose attack actions autonomously.
58
Nokia Open-Sources AnyJev: A Training-Free Layer That Turns Any Open LLM Into a Calibrated Decision Model
Nokia open-sources AnyJev, a training-free library that converts any open LLM into a calibrated decision model for classification tasks.
50
Researchers Find Malware That Uses AI Models Instead of Human Hackers for Control
Researchers find CLOSEDQUORUM, a Windows malware that uses commercial LLMs as an autonomous decision engine for post-compromise actions like credential theft.
65
AI malware just removed the human from the attack loop
Cisco Talos uncovers CLOSEDQUORUM, first 'LLM-as-C2' malware using multi-model judge panel to autonomously steal credentials and crypto wallets.
62
Windows CLOSEDQUORUM malware uses AI models to autonomously select post-compromise actions
Cisco Talos documents CLOSEDQUORUM, the first known Windows implant using a four-LLM quorum to autonomously choose credential theft, wallet theft, injection, and persistence actions.
60
New ClosedQuorum Windows malware uses AI for attack decisions
ClosedQuorum, a Go Windows implant, lets several LLMs choose post-compromise actions without a human operator.
62
A New Tool for Tracking AI Malware Uncovers Malware That Operates Without Human Control
Cisco Talos releases CAIRN to track AI malware and documents CLOSEDQUORUM, an unconfirmed Windows implant steered by LLMs.
66
Researchers uncover malware that uses AI to choose its next move
Cisco Talos documents CLOSEDQUORUM, a Windows implant that lets commercial LLMs vote on its next action.
66
The Closed Quorum: Inside the first reported autonomous AI C2 implant
Cisco Talos discovered CLOSEDQUORUM, the first autonomous AI-driven malware C2 implant using multiple LLMs for independent decision-making.
75
A New Tool Found Malware That’s Guided by an AI Hive Mind—No Humans in Sight
New tool uncovers CLOSEDQUORUM, malware using a hive-mind of four LLMs for autonomous command-and-control decisions.
70
A Lie Detector Test for Language Models: Reading Knowledge a Model Won't Reveal
PIR reads internal states to separate concealed model knowledge from genuine ignorance across eight language models.
61
A Zeroth-Order Paradigm for LLM Preference Alignment
Researchers propose ComPO, a zeroth-order comparison-based preference alignment method with convergence guarantees that mitigates likelihood displacement in LLMs.
32
Mistral X Mozilla: Private, Multilingual AI Browsing
Mistral and Mozilla partnered to power Firefox's Smart Window AI browsing assistant in France and North America, with zero data retention.
55
A Zeroth-Order Paradigm for LLM Preference Alignment
ComPO is a zeroth-order preference alignment method using comparison oracles to mitigate likelihood displacement across Mistral, Llama, Gemma, and Qwen3 models.
38
Related CVEs
by mentions- CVE-2026-42542<1%7.5TDengine: In versions 3.4.0.0 through 3.4.1.5, an unauthenticated remote attacker can crash the taosd server process by sending a single…
Appears with
- Qwenai model · 16
- Cisco Talosorganization · 12
- Geminiai model · 10
- ClosedQuorummalware · 10
- DeepSeekai model · 10
- Llamaai model · 6
- Googlevendor · 5
- MetaMaskproduct · 4
- Mistral AIvendor · 4
- Windowsproduct · 4
- Microsoft Edgeproduct · 4
- Exodusproduct · 4
- LAMEHUGmalware · 4
- Alibabavendor · 3
- DeepSeekorganization · 3
- CAIRNproduct · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.