Vendor

Xiaomi

1 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 17, 2026 · last 4d ago

Timeline2 articles

How hackers used Claude for missiles, drone swarms, and surveillance, while Chinese labs mined it for training data

Anthropic's threat report details eight months of Claude misuse: AI-assisted espionage against 20+ organizations, self-rewriting malware, and Chinese labs distilling Claude via fraudulent accounts.

Anthropic's threat intelligence report covering December 2025 through August 2026 documents Claude misuse across seven categories including cyber operations, surveillance, fraud, and unauthorized model distillation. A Russian-speaking espionage actor tracked as GTG-20006 used AI agents to rewrite and recompile malware evading antivirus detection, targeting more than 20 organizations in Ukraine and Europe and stealing a drone vision system SDK. Alibaba's Qwen lab ran the largest distillation campaign, with over 151 million exchanges between May and July 2026 peaking near 3 million per day to train Qwen 3.5, 3.6, and 3.7. DeepSeek, Moonshot AI, Xiaomi, and Zhipu also relayed customer or replayed traffic to Claude, including PLA-linked users analyzing CCTV footage and users with credentials tied to the Russian Ministry of Defense.

The DecoderSep 11, 13:50 UTC · 4d agoAI safety & security in the wild 13 sources2

Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access

Unisoc modem firmware flaw CWE-1189 allows VoLTE video call RCE chain to gain full Android kernel access on T606/T612/T7250 chipsets; no patch yet.

SSD Secure Disclosure published the second stage of an exploit chain, first disclosed in March 2026, that achieves full Android kernel access on Unisoc modem firmware via a VoLTE video call. The privilege-escalation flaw, classified as CWE-1189 (Improper Isolation of Shared Resources on System-on-a-Chip), exploits shared physical memory between modem and application processor with no hardware boundary, letting modem code map the entire 32-bit address space and modify Android kernel pages via ARM Memory Protection Unit registers. Confirmed affected chipsets include Unisoc T606 (Motorola E13), T612 (Realme C33), and T7250 (Xiaomi Redmi A5), sold across more than 140 countries. No CVE has been assigned, the August 2026 Android Security Bulletin does not address it, and Unisoc has not responded to researchers; exploitation requires an attacker-controlled private 4G network and a victim answering the call.

The Hacker NewsAug 17, 10:52 UTC · 29d agoVulnerability CVE-2025-31718 CVE-2022-20210

Related CVEsby mentions

CVE-2022-202109.84%
The UE and the EMM communicate with each other using NAS messages.
The UE and the EMM communicate with each other using NAS messages. When a new NAS message arrives from the EMM, the modem parses it and fills in internal objects based on the received data. A bug in the parsing code could be used by an attacker to remotely crash the modem, which could lead to DoS or RCE.Product: AndroidVersions: Android SoCAndroid ID: A-228868888
· google android—
CVE-2025-317187.5<1%
In modem, there is a possible system crash due to improper input validation.
In modem, there is a possible system crash due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed.
—

Appears with

threat actor GTG-20006 1 threat actor ShinyHunters 1 ai model Claude 1 ai model Claude Opus 1 ai model Qwen 3.5 1 organization Alibaba 1 organization Anthropic 1 organization Check Point Research 1 organization DeepSeek 1 organization Kaspersky ICS CERT 1 organization Moonshot AI 1 organization SSD Secure Disclosure 1 organization Xiaomi 1 organization Zhipu 1 product Android 1 product Claude 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.