Search: “Tailored Access Operations”

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Arrested man allegedly impersonated NSA elite hacking unit, Supreme Court chief justice

Colorado man Joshua Culver indicted for impersonating NSA's Tailored Access Operations chief and Supreme Court Chief Justice John Roberts in Indiana court cases.

Joshua Culver, also known as Maverick Young, was arrested in Colorado after a July Indiana indictment on four counts of falsely impersonating an officer of the court and one count of using a forged judge's signature. He allegedly posed as an NSA officer in September to pressure the Tippecanoe County sheriff's office, and later presented a forged document purportedly from the head of the Tailored Access Operations unit demanding case dismissal and warrant quashing. The indictment also alleges he used a forged signature of Chief Justice John Roberts on a dismissal order in Grant County, Indiana.

CyberScoop·Aug 25, 18:43 UTC · 21d agoPolicy & legal2

25

Access Control as Verified Parse Constraints

Researchers verify a class of EverParse validators that correctly enforce access-control policies, deploying a machine-checked enforcement gate on seL4.

The paper targets enforcement-code bugs in commercial security gateways by proving that forward-only, backtrack-free EverParse validators are verified recognizers for a bounded finite-state class that includes access-control decision functions with fixed-offset fields and bounded disjunction. Encoding a bounded policy language into a fixed-size byte buffer allows an SMT solver to verify the enforcement code once, covering all byte values, policies, requests, and sessions. Editing rule content over a fixed endpoint set requires no new proof, while adding endpoints reruns the toolchain. A deployment on the seL4 microkernel ensures every request passes through the gate and unverified components cannot corrupt the enforcement chain.

arXiv cs.CR·Sep 11, 06:33 UTC · 5d agoResearch

28

Exclusive: NSA to host a hacker reunion in bid to rebuild secretive unit

NSA will host a reunion of former Tailored Access Operations hackers as it moves to rebuild and rebrand the elite unit.

The invitation-only event at Fort Meade, spearheaded by Deputy Director Tim Kosiba, a former TAO technical director, will tour the new TAO building and pitch alumni to return. TAO, credited with contributions to Stuxnet and once grown to over 2,000 personnel, was renamed Computer Network Operations about a decade ago, and the recent reshuffle undid some of those changes after NSA lost roughly 2,100 staff (8% of its workforce) last year.

The Record·Aug 26, 20:56 UTC · 20d agoIndustry

20

Empirical Evaluation of Task-Based Permission Scoping Architecture for AI Agents

Fine-tuned RoBERTa-large task permission classifier matches Claude Haiku 4.5 on access scoping for AI agents, cutting severity-weighted attack surface by 84.4%.

The paper evaluates a three-source task-based permission architecture for AI agents combining role-based permission ceilings, a task permission classifier, and policy-based prohibitions. A fine-tuned RoBERTa-large security gate matched few-shot Claude Haiku 4.5 on a 600-prompt dataset, with macro-F1 0.881 versus 0.886, precision 0.897 versus 0.842, and lower severity-weighted residual risk (0.63 versus 1.12). An attack-surface elimination metric shows the role ceiling alone closes 27.9% of the severity-weighted surface while adding the task classifier closes 84.4%. The work establishes task-granular access control as a measured, deployable mechanism for reducing attack surface in agentic deployments.

arXiv cs.CR·Sep 14, 11:48 UTC · 1d agoAI safety & security

48

Risky Bulletin: Russia starts blocking DoH and DoT

Russian users report blocks on DoH and DoT servers, including Cloudflare 1.1.1.1 and Google 8.8.8.8, in an apparent censorship crackdown.

Russian internet users began reporting failures connecting to DNS-over-HTTPS and DNS-over-TLS servers, suggesting a government crackdown on the two privacy protocols. The blocks reportedly cover Cloudflare's 1.1.1.1 and Google's 8.8.8.8 resolvers; Roskomnadzor has not officially confirmed the action. The agency tested a similar block in March on Beeline's network and had named DoH for blocking as early as 2021. The bulletin also briefly notes state-sponsored phishing of EU officials, a DDoS against Norway's Digdir, the ReliaQuest/ShinyHunters dispute, and older ransomware and breach disclosures.

Risky Business News·Aug 26, 03:07 UTC · 21d agoPolicy & legal1

40

Ask Before You Optimize: Dynamic Pre-Formulation Clarification for Interactive Optimization

Researchers release OR-Clarify, a benchmark testing whether LLM agents ask clarifying questions before formulating optimization models from incomplete requests.

OR-Clarify evaluates pre-formulation clarification in operations research: each task gives a partial problem description, withholds structured hidden slots, and scores agents via bounded interaction with a simulated user, measuring slot recovery, stopping behavior, silent assumptions, and interaction cost. The authors also propose InterOPT, a two-stage framework that identifies formulation-critical gaps to decide when to ask or stop. In choice-based experiments InterOPT substantially outperforms all baselines in exact slot recovery and remains competitive in the open-ended setting.

Hugging Face daily papers·Sep 3, 20:00 UTC · 12d agoAI research1

35

Thorough reorganization at NSA will create five 'mission centers,' including cyber and AI

NSA is reorganizing into five mission centers covering China, cybersecurity, AI, combat support and global intelligence, with full capability targeted by January.

NSA Director Gen. Joshua Rudd announced a sweeping reorganization replacing existing directorates with five mission centers focused on China, cybersecurity, artificial intelligence, combat support, and global intelligence. A 30-day implementation clock has started, and the centers are expected to reach full operational capability by January. Officials acknowledge the rapid realignment will 'break things' in the agency's bureaucracy; this is the largest restructuring since the NSA21 effort roughly a decade ago, which was widely viewed as a failure.

The Record·Sep 13, 21:36 UTC · 2d agoPolicy & legal

45

Towards Scalable and Cost-Efficient Vulnerability Detection: A Study on Automatic Query Generation

A study finds LLM-synthesized CodeQL queries improve average F1-score by 82% over baseline queries, offering scalable vulnerability detection versus direct LLM scanning.

Researchers conducted an empirical study evaluating whether LLMs can synthesize executable CodeQL queries from National Vulnerability Database vulnerability data. LLM-generated queries significantly enhanced baseline CodeQL suites, yielding an 82% improvement in average F1-score across a diverse set of real-world vulnerabilities. A cost-benefit analysis shows direct LLM-based scanning of entire repositories is often computationally and financially prohibitive, while LLM query synthesis offers a scalable and cost-effective alternative for large-scale vulnerability detection.

arXiv cs.CR·Sep 9, 16:31 UTC · 6d agoResearch1

32

UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data

Google and Mandiant attribute vishing-based SaaS data extortion attacks to UNC6671, now operating under the Redact, Pink, Helix, and Falcon brands.

Google Threat Intelligence Group and Mandiant track extortion group UNC6671, which uses vishing calls impersonating IT help desks to lure employees to adversary-in-the-middle phishing pages that capture credentials, MFA tokens, and session tokens. The group then registers adversary-controlled MFA devices, pivots through identity providers into Microsoft 365, Okta, and other SaaS applications, and runs automated Python and PowerShell exfiltration scripts. UNC6671 has rotated through extortion brands including BlackFile, Redact, Pink, Helix, and Falcon, and Google tracked over $10.6 million in Bitcoin payments between January 7 and May 12, 2026, with initial demands exceeding $3 million. The actor has hit dozens of organizations in North America, Australia, and the UK, shifting toward high-value financial and legal firms in July 2026.

The Hacker News·updated Sep 7, 15:51 UTC · 8d ago·first Sep 7, 15:39 UTC · 8d agoThreat actor in the wild 2 sources1

78

PrivEscalate: Measuring and Augmenting the Threat of LLM-Automated Linux Privilege Escalation

Researchers release PrivEscalate, a 531-scenario benchmark showing LLM agents' Linux privilege-escalation success varies by vulnerability class, plus PrivEscAgent, a domain-specialized agent that boosts success.

The paper introduces PrivEscalate, an open-source benchmark of 531 Dockerized Linux privilege-escalation scenarios spanning 14 sub-categories, plus 329 parameterized variants measuring sensitivity to environmental distractors. Evaluating six LLMs across three agent architectures shows capability is heterogeneous across vulnerability classes, sensitive to perturbation, and architecture-dependent. The authors also present PrivEscAgent, a wrapper adding deterministic enumeration, category matching, and step planning that outperforms prior privesc-agent baselines without modifying the underlying LLM. The benchmark is released to support LLM agent evaluation, defensive tool validation, and red-team training.

arXiv cs.CR·Sep 8, 17:34 UTC · 7d agoResearch

44

Are Unreachable Nodes Truly Safe? Fully Eclipsing Monero's P2P Network!

Researchers present Nyx and Moros, the first eclipse attacks against Monero nodes behind NATs, requiring no inbound access and demonstrated on mainnet.

The paper presents the first eclipse attacks tailored to unreachable Monero nodes operating behind NATs, requiring no inbound access to the victim. The attacks poison the peerlists of reachable nodes, which relay contamination to unreachable nodes' whitelists, then exploit Monero's outbound connection refresh logic to evict benign neighbors and monopolize all outbound connections. Nyx achieves a complete, persistent eclipse of long-running unreachable nodes in large-scale SEED Emulator simulations, while Moros stealthily eclipses newly joined nodes during bootstrapping and was demonstrated on the Monero mainnet. Countermeasures are proposed.

arXiv cs.CR·Sep 9, 14:43 UTC · 6d agoResearch

45

How to build an exposure management program the business trusts: Lessons from Tenable’s CSO

Tenable's CSO describes an AI-driven exposure management program that consolidates tool sprawl and translates cyber risk for boards.

A Tenable blog post shares lessons from CSO Robert Huber on moving to an AI-driven exposure management program. It argues tool sprawl and data silos hinder holistic risk assessment and that exposure management unifies attack-surface data into business-level metrics for the C-suite.

Tenable Blog·Aug 27, 14:30 UTC · 19d agoIndustry

16

Claude Mythos AI Autonomously Executes Full Cyber Kill Chain Without Human Guidance

Booz Allen's benchmark found Anthropic's Claude Mythos was the only tested model to autonomously complete a full cyber kill chain to domain administrator control.

Booz Allen assessed 18 US and Chinese models as autonomous attackers against a production-grade enterprise network, measuring actions via network and host telemetry. Claude Mythos scored 80 on the Cyber Weapon Index (74 vulnerability research, 86 kill-chain attainment), moving from a stolen employee credential to administrator-level control in every credentialed attempt. Only frontier Anthropic models identified the previously unseen flaw in compiled software, and only Claude Mythos exploited it; the report notes a harness paired with Claude Sonnet could rival Claude Mythos. The result is a controlled benchmark, not evidence of a real-world campaign or victim breach.

Cyber Security News·Sep 8, 12:50 UTC · 7d agoAI safety & security1

62

Give every teammate and agent the right level of access to your Workers

Cloudflare launches per-Worker granular access controls with four roles, enabling least-privilege access for teammates, AI agents, and CI/CD pipelines.

Cloudflare announced granular authorization for Workers, letting admins scope access to a single Worker instead of the whole account. Four new roles are available: Metadata Read-Only (observability without source code), Content Read-Only (read code without changes), Editor (deploy without delete), and Admin (full control of one Worker). Roles apply at Developer Platform, product, or resource level, can be attached to dashboard users or API tokens, and are available to all customers now, with plans to extend to D1, R2, and KV.

Cloudflare Blog·Sep 15, 13:00 UTC · 20h agoTools

22

The 12 Best Managed Firewall Services, Compared and Priced

GBHackers compares 12 managed firewall service providers, naming Fortinet best value and Secureworks best detection while flagging recent ownership changes.

The buyer's guide evaluates 12 managed firewall/MSSP providers across cost tiers, contract terms, and service models. Fortinet is rated best value, Secureworks best detection, NTT Data best global reach, and Cato Networks best for organizations wanting to stop owning firewalls. The article highlights that Secureworks was acquired by Sophos for roughly $859 million in February 2025, the Trustwave-Cybereason merger was terminated in March 2025, LevelBlue is the rebranded AT&T Cybersecurity business, and Comcast Business absorbed Masergy.

GBHackers·Sep 8, 10:20 UTC · 7d agoIndustry 2 sources

12

Large Language Models for HVAC Operations in Building Energy Systems: A Critical Review of Methods, Applications, and Deployment Readiness

Systematic review of 66 studies finds LLMs for HVAC operations are mostly research-stage, with no ready-now deployment and only four pilot-level studies.

A critical review of 66 peer-reviewed studies from 2023 to March 2026 examines LLMs for HVAC operations in building energy systems. Only four studies reach pilot-level evidence, none reports sustained operational deployment, and 63 of 66 are research-only. Conventional ML, MPC, and RL remain dominant for high-frequency control and short-horizon forecasting, and the evidence supports LLMs primarily as semantic and workflow layers rather than autonomous controllers.

arXiv cs.AI / cs.LG / cs.CL·Sep 4, 16:08 UTC · 11d agoAI research

45

OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development

OpenAI released GPT-5.6-Cyber for vulnerability research and pentesting via Daybreak Red, completing 95% of advanced cyber task evaluations.

GPT-5.6-Cyber, built on GPT-5.6 Sol, targets zero-day discovery, exploit chain development and incident response with reduced refusals, scoring 95.0% on OpenAI's Advanced Cybersecurity Completion Rate versus 1.5% for GPT-5.6 Sol and 57.3% for GPT-5.5-Cyber. The model found CVE-2026-15903 (CVSS 8.8), an out-of-bounds read/write in Chrome's V8 JavaScript engine that Google patched in mid-July 2026. It is available to trusted partners including CrowdStrike, Palo Alto Networks and Cloudflare through the Daybreak Red access tier.

The Hacker News·Aug 11, 13:11 UTC · Aug 11, 2026Model releaseCVE-2026-15903

78

Researchers open-source a Wi-Fi cyber range for security training

NTNU and Aegean researchers open-source a software-emulated Wi-Fi cyber range using mac80211_hwsim with LLM-assisted scenario building.

Researchers from the Norwegian University of Science and Technology and the University of the Aegean published a design and prototype for a cyber range dedicated to IEEE 802.11 security training, emulating access points and clients with mac80211_hwsim, Linux namespaces, hostapd, wpa_supplicant, dnsmasq, and FreeRADIUS. The platform bundles Aircrack-ng, Wireshark, and custom tools WPAxFuzz and Bl0ck, and can convert plain-language scenario descriptions into deployable definitions via a locally hosted Llama model. A working prototype covering scenario creation and deployment is on GitHub; monitoring, access control, and orchestration zones remain future work.

Help Net Security·Aug 24, 04:21 UTC · 23d agoTools1

28

Iranian cyber targeting of dissidents, activists and journalists

UK NCSC, FBI, and Dutch AIVD expose CHOSEN BRICK spyware used by Iranian state actors against dissidents, activists, and journalists worldwide.

A joint advisory from the UK NCSC, FBI, and Dutch AIVD details CHOSEN BRICK, a Windows spyware family used by Iranian state cyber actors since at least 2025 against dissidents, activists, and journalists in the UK, US, and Netherlands. Actors build rapport on WhatsApp and Telegram impersonating known contacts or platform support, then deliver disguised payloads resembling apps such as Telegram, Norton, RunwayML, or fake MRI results. The malware persists via HKCU Run registry keys, adds Microsoft Defender exclusions, and uses a unique Telegram bot C2 per victim. Capabilities include screen capture, microphone recording, process enumeration, email and messaging data theft, file deletion, and system wiping; victim data has appeared on pro-Iranian leak sites.

NCSC UK·Sep 15, 12:00 UTC · 21h agoThreat actor in the wild2

78

Divide, Consult, Conquer: Capability Laundering Through Aligned LLMs

Attack shows unaligned orchestrators can launder capabilities from aligned frontier LLMs via benign subtask consultation, raising Gemma-4-31B CBRN rubric score from 62.3 to 83.1.

The paper introduces capability laundering, where a weaker unaligned model decomposes a harmful task into benign-looking subproblems, queries a stronger aligned model on each, and recombines answers locally, bypassing per-interaction safety evaluations. Evaluation used GPT-5.5, Claude Opus 4.8, and Grok-4.3 as consultants to four local orchestrators on CyBench, BountyBench, and CBRN tasks. On CyBench, Gemma-4-31B recovered 8/14 candidate tasks with GPT-5.5 and 7/9 with Opus, while Muse-Glimmer-30B recovered none. Across an eight-step hypothetical bioweapon attack chain, consultation raised Gemma-4-31B's mean rubric score from 62.3 to 83.1, exposing a gap in defenses that only refuse complete harmful tasks.

arXiv cs.CR·Sep 14, 11:10 UTC · 1d agoAI safety & security

55

Hackers Exploit Critical FortiGate Flaw to Deploy AI-Assisted PivotC2 RAT

SOCRadar says attackers exploit FortiGate CVE-2025-25249 to deploy the PivotC2 Node.js RAT, compromising 178 of 30,000 targeted devices and stealing credentials.

SOCRadar's Threat Research Unit reports active exploitation of CVE-2025-25249, a CVSS 9.8 heap-based buffer overflow in the cw_acd daemon of FortiOS and FortiSwitchManager, via crafted CAPWAP requests to UDP port 5246, compromising at least 178 of 30,000 targeted internet-exposed FortiGate devices since July 2026. The campaign deploys PivotC2, a Node.js RAT that provides interactive shells, SOCKS5/HTTP proxying, port forwarding, network scanning, and automated configuration harvesting that decrypts stored FortiGate credentials, including VPN pre-shared keys, SSL-VPN credentials, and LDAP secrets. Russian-language artifacts, AD enumeration, browser credential theft, RDP enablement, and exfiltration of Exchange .pst files to Wasabi S3 point to a Russian-speaking, financially motivated group; two US organizations confirmed full-network intrusions. Fixes include FortiOS 7.6.4/7.4.9/7.2.12/7.0.18+ and FortiSwitchManager 7.2.7/7.0.6+, plus blocking CAPWAP on internet-facing interfaces.

GBHackers·Sep 9, 08:57 UTC · 7d agoMalware in the wildCVE-2025-252492

72

When the prompt becomes the payload: A practical pen-testing guide for GenAI, LLM and RAG applications

CSO Online publishes a practical penetration-testing guide for GenAI, LLM, and RAG applications, covering prompt injection, retrieval poisoning, and tenant isolation testing.

The guide frames LLM applications as attack graphs spanning prompts, retrieval layers, vector stores, tools, identities, and downstream APIs, arguing that conventional web testing misses instruction-vs-data channel risks. It builds on OWASP prompt injection guidance (direct vs. indirect injection) and NIST's 2025 adversarial machine-learning taxonomy, noting that RAG and fine-tuning do not remove injection risk. Recommended practices include documenting trust transitions across components, using canaries and synthetic records to avoid test side effects, running multi-turn and obfuscated injection campaigns, and verifying chains from poisoned documents to observable state changes. It also details testing RAG pipelines via controlled document poisoning across metadata, OCR layers, and code comments, plus cross-tenant isolation checks on retrieved document IDs.

CSO Online·Sep 9, 10:00 UTC · 6d agoAI safety & security1

28

When an Attacker Meets a Group of Agents: Navigating Amazon Bedrock's Multi

Unit 42 red-teamed Amazon Bedrock multi-agent applications, demonstrating prompt-injection attack chains that leak agent instructions and invoke tools, mitigated by Bedrock Guardrails.

Unit 42 red-teamed Amazon Bedrock Agents' multi-agent collaboration in Supervisor and Supervisor with Routing modes. The demonstrated attack chain detects the operating mode, discovers collaborator agents, delivers attacker-controlled payloads, and can disclose agent instructions and tool schemas and invoke tools with attacker-supplied inputs. No vulnerabilities were found in Bedrock itself, and the built-in prompt attack Guardrail blocked the attacks when properly configured. The researchers collaborated with Amazon's security team and frame the findings as a broader prompt injection risk for LLM-based systems.

Palo Alto Unit 42·Aug 17, 12:31 UTC · 29d agoAI safety & security

55

Beneath the Surface of Chains-of-Thought: A Mechanistic Interpretation of Reasoning Operations in LLMs

Study shows LLM reasoning operations like planning and deduction are geometrically separable in hidden states, with separability peaking in middle layers.

Researchers investigate whether functional reasoning operations — problem formulation, goal decomposition, deduction — have corresponding geometric structure in LLM hidden representations. They find operations are separable in held-out representations with separability peaking in middle layers, ruling out lexical and positional confounds; token-wise operation alignment becomes more distributed across layers, and identical surface tokens are represented differently depending on their surrounding chunk. Attention-masking interventions show chunk-onset operation-aligned representations depend on preceding reasoning context; code is released on GitHub (naver-ai/beneath-cot).

Hugging Face daily papers·Sep 3, 20:00 UTC · 12d agoAI research1

40

When AI Remembers Too Much

Unit 42 PoC shows indirect prompt injection can poison Amazon Bedrock Agent long-term memory, enabling silent exfiltration of conversation history across future sessions.

Palo Alto Networks Unit 42 published a proof of concept showing that indirect prompt injection can silently poison the long-term memory of Amazon Bedrock Agents when the memory feature is enabled. Malicious content on a webpage or document manipulates the agent's session summarization process, so injected instructions persist across sessions and are added to later orchestration prompts, silently exfiltrating user conversation history. The issue is not a vulnerability in the Amazon Bedrock platform but an illustration of the broader unsolved LLM prompt-injection challenge. Amazon reviewed the research and stated that Bedrock Guardrails with the prompt-attack policy provides effective mitigation.

Palo Alto Unit 42·Aug 17, 12:32 UTC · 29d agoAI safety & security

55

The Model Proposes, the Code Disposes: A Pre-Registered Ablation of a Verifier-and-Acceptance Stage in an LLM-Orchestrated Offensive-Security Agent

Pre-registered ablation finds a model verifier stage in an LLM offensive-security agent suppresses findings; removing it eliminated suppression with precision tradeoff.

The paper evaluates a verifier-and-acceptance stage in an LLM-orchestrated offensive-security agent via a pre-registered 20-run confirmatory ablation and a 2x2 factorial study with 40 runs on vulnerable lab targets. Removing the stage eliminated pre-report suppression (median 2 vs 0 findings, p = 0.00003) but reduced model-blinded shipped precision (0.471 vs 0.353, p = 0.0087). Suppression was attributed to the model verifier rather than deterministic acceptance rules, and an instrumented canary recorded zero external contacts in all 60 runs. The full design retained 93.8% of model-adjudicated true candidates but failed its pre-registered non-inferiority floor of 0.90.

arXiv cs.CR·Sep 14, 17:13 UTC · 1d agoResearch

38

Phishing Powers 80% of Attacks on US Companies: How SOCs Can Detect It Early

Phishing drives 80% of attacks on US companies; FBI recorded 158,436 BEC victims and over $20B in losses from 2013-2023.

A vendor-authored analysis claims phishing powers roughly 80% of attacks on US companies, citing FBI statistics of 158,436 business email compromise victims and more than $20 billion in reported losses between 2013 and 2023. It describes modern phishing using compromised infrastructure, redirect chains, dynamic pages, and adversary-in-the-middle techniques, including a recent campaign targeting tens of thousands of primarily US users. The piece promotes ANY.RUN Threat Intelligence Feeds and TI Reports, claiming 99% unique high-confidence IOCs, 21-minute faster MTTR, and 30% fewer Tier 2 escalations.

Cyber Security News·Sep 8, 17:54 UTC · 7d agoPhishing & fraud

25

Autonomous Research for Open-Ended Problems: A Case Study on Telecom Ticket Retrieval

Case study shows autonomous LLM research reaches 90% of SOTA on telecom ticket retrieval in 10 weeks versus 10 months human work.

The paper explores adapting autonomous research to open-ended, industry-grade ML problems through a telecom ticket retrieval case study with commercial and open-source agents. Autonomous research reached 90% of state-of-the-art performance (0.34 vs. 0.38 Recall@1) in 10 weeks versus 10 months of human work, at up to $200 per Cursor campaign. The authors find agents excel at narrow hyperparameter optimization but lack human-like intuition, recommending human-agent collaboration.

arXiv cs.AI / cs.LG / cs.CL·Sep 11, 17:09 UTC · 4d agoAI research

18

Revolut Data Breach Exposes Customers’ Passport Copies and Full Transaction Histories to Hackers

Revolut leaked KYC documents and full transaction histories after a fraudulent, domain-authenticated email request impersonating a government agency.

Revolut disclosed that an attacker using an unauthorized email account on a legitimate government domain, with valid domain-authentication credentials, tricked the fintech into releasing customer data. The exposed data includes passport and driver's license copies, identity-verification selfies, full names, dates of birth, addresses, IBANs, and complete transaction histories including Bitcoin activity. Revolut says core systems, accounts, and funds were not compromised, and it blocked the email source and notified authorities. On-chain investigator ZachXBT and others indicated the operation targeted high-net-worth users facing elevated phishing, SIM-swap, and extortion risk.

Cyber Security News·Sep 13, 05:09 UTC · 3d agoData breach3· 1 read

62

CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls

Researchers introduce CONTINUITY, a framework of assume-guarantee contracts that preserves LLM agent security context across components, verified across 2,560 attack instances.

The paper identifies security-context discontinuity, where individually sound controls drop, widen, or reinterpret security context as actions cross component boundaries, and proposes CONTINUITY, a framework of assume-guarantee contracts using signed root grants, provenance commitments, role-bound transition receipts, and effect-bound execution permits. It formalizes end-to-end consequence integrity, requiring every external effect to be backed by a valid authorization witness linking principal, task, provenance, and policy state. A reference verifier and cross-layer fault-injection suite covering 32 fault classes showed the full configuration committed no harmful external effect across 2,560 parameterized attack instances while completing all 700 benign tasks and escalating all 200 ambiguous cases.

arXiv cs.CR·Sep 4, 15:26 UTC · 11d agoAI safety & security

32

Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection

Anthropic disrupted APT29-linked GTG-20006, which used Claude to autonomously rebuild malware, hijack hotel Wi-Fi DNS, and target 20-plus Ukrainian, European, and US-linked organizations.

Anthropic attributed the campaign to GTG-20006, aligned with Midnight Blizzard (APT29/Cozy Bear), which developed an AI-driven process that monitors its implants against security products and autonomously rebuilds and redeploys detected malware. Targets included military intelligence, diplomatic, and defense organizations in Ukraine and Europe, plus Middle East and Asian maritime agencies; the actor compromised at least three hotel Wi-Fi vendors via DNS hijacking and served ClickFix lures delivering Windows, Android, and iOS malware such as PowerChrome, GiftDrop, and DarkSword. Operations also included a North African breach exfiltrating over 300,000 national identity records and 500,000-plus company registry entries, an Embassy Kit device-code phishing campaign stealing Microsoft 365 tokens from at least eight organizations, and WhatsApp account takeover using headless browsers. The campaign overlaps with CaptiveCrunch reporting from ReliaQuest, Microsoft, Google, and Lumen Black Lotus Labs.

The Hacker News·updated Sep 12, 10:30 UTC · 3d ago·first Sep 11, 14:10 UTC · 4d agoThreat actor in the wild 15 sources2

82

Authorization Architectures for Tool-Using AI Agents

Review paper proposes an authorization reference architecture for tool-using AI agents, identifying runtime enforcement and delegation bounds as unresolved gaps.

This review examines authorization models for tool-using AI agents that invoke APIs, databases, browsers, and protocols like MCP, arguing every consequential agent action must be traceable to a human principal, bounded by delegation, and contestable. It introduces a principal hierarchy spanning human user, operator/deployer, orchestrator agent, sub-agent, and tool endpoint, and analyzes five layers including credential lifecycle, delegation propagation, runtime enforcement, prompt injection as authorization bypass, and auditability. Drawing on 89 primary sources from 2023-2026, it proposes seven structural requirements, a four-layer reference architecture, and three deployable configurations.

arXiv cs.CR·Sep 14, 17:21 UTC · 1d agoAI safety & security

45

Iranian Hackers Use Fake MRI Results to Infect Victims With CHOSEN BRICK Spywarenew

Iranian state-linked hackers deliver CHOSEN BRICK Windows spyware via fake MRI results to surveil dissidents, activists, and journalists in the UK, US, and Netherlands.

A joint advisory from the UK NCSC, FBI, and the Netherlands' AIVD links Iranian state-linked actors to CHOSEN BRICK, a Windows spyware family used for long-term surveillance since at least 2025. Targets are approached on WhatsApp or Telegram with tailored lures such as fake MRI scan results or application files, and operators often redirect victims to personal devices to bypass corporate controls. The malware persists via Run registry keys, adds antivirus exclusions, uses a per-victim Telegram bot for command and control, and exfiltrates data through cloud storage and proxy services. Capabilities include screenshots, audio recording, email and messaging theft, command execution, file deletion, data wiping, and some victims' details have appeared on pro-Iranian leak sites for harassment.

Cyber Security News·updated 09:06 UTC · 5m ago·first 08:31 UTC · 41m agoThreat actor in the wild 4 sources

74

Decoy Direction Optimization: A Post-Hoc Defense Against LLM Abliteration

Researchers introduce Decoy Direction Optimization, a cheap weight-editing defense that blinds refusal-direction ablation attacks against open-weight LLM safety guardrails.

Refusal Feature Ablation bypasses safety guardrails in open-weight LLMs by projecting out a linear refusal direction, often with high attack success rates. Decoy Direction Optimization injects a high-magnitude nonlinear decoy into MLP neurons so attackers' contrastive estimators ablate a harmless orthogonal feature instead. Evaluated across six model families, DDO keeps ASR below 10% under standard RFA and on Llama-3-8B-Instruct reduces Heretic weight-level attack ASR from 88.7% to 18%. It costs 30 to 450 times less per configuration than trained defense baselines.

Hugging Face daily papers·Sep 13, 20:00 UTC · 2d agoAI safety & security

55

Stealth rootkit targeting F5 BIG-IP could expose enterprise identity gateways

Sophos analyzed a stealth Linux rootkit that hides a web shell in memory on compromised F5 BIG-IP APM identity gateways, evading file-based detection.

Sophos analyzed a second-stage Linux rootkit implant found in compromised F5 BIG-IP APM environments running Apache and PHP, linked to exploitation of CVE-2025-53521, an unauthenticated RCE. The implant hooks Apache's PHP-loading process and serves modified in-memory versions of three legitimate webtop PHP files (apm_css.php3, full_wt.php3, webtop_popup_css.php3), leaving on-disk files untouched so hashes and integrity checks pass. It also establishes access via an authenticated local UNIX socket that can provide an interactive /bin/bash session. Experts warn compromised APM appliances, which handle federated SSO and terminate TLS at enterprise perimeters, could enable SSO token theft and lateral movement to trusted downstream applications.

CSO Online·Sep 10, 11:51 UTC · 5d agoMalware in the wild 2 sourcesCVE-2025-53521

72

Safety for Whom? Boundary-Aware Self-Distillation for Controlled LLM Safety Refusal

A self-distillation safety framework tunes narrow-boundary refusals in Qwen3-8B, raising target-domain refusal to 84.75% while cutting over-refusal from 15.20% to 5.20%.

The paper formulates narrow-boundary safety, where deployments need refusals within specific topics rather than whole subjects, and proposes an offline self-generated framework with controlled topic generation, escalating retries, and harmful-benign boundary pairs. On political persuasion with Qwen3-8B, the method raised target-domain refusal from 9.47% to 84.75% and cut the mean unsafe-response rate across three broader benchmarks from 26.26% to 0.14%. Verified target-model responses reduced over-refusal from 15.20% to 5.20%, and boundary-pair data cut comply-side over-refusal on held-out pairs from 32.94% to 4.16%. Results show data composition controls the safety-usability trade-off and alignment should be evaluated on both sides of the refusal boundary.

Hugging Face daily papers·Sep 2, 20:00 UTC · 13d agoAI safety & security1

32

Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data

Microsoft details two campaigns: million-email CEO impersonation ACH fraud and passkey-themed vishing that hijacks Microsoft cloud accounts for data theft and extortion.

Microsoft disclosed a campaign that sent over one million CEO-impersonation scam emails between August 3-5, 2026, targeting U.S. accounts payable departments with fake ServiceNow subscription invoices to induce ACH transfers, using generative AI to tailor templates. A second campaign detected since May 2026 uses passkey/MFA-themed voice phishing posing as the IT help desk, redirecting victims via SMS to counterfeit Microsoft sign-in pages and adversary-in-the-middle or device-code flows to hijack accounts. Post-compromise activity includes adding attacker-controlled authentication methods, high-volume Microsoft Graph activity, SharePoint and OneDrive downloads, and mailbox collection via REST APIs. Microsoft attributes initial access to Storm-3121 (linked to ShinyHunters and Falcon extortion) and Storm-3032 (UNC6671, a BlackFile splinter operating the Helix extortion brand).

The Hacker News·Sep 13, 10:11 UTC · 2d agoPhishing & fraud in the wild2

72

Linux Detection Engineering - Local Privilege Escalation

Elastic details a layered detection framework for Linux local privilege escalation, covering 2026's copy-on-write bug wave and LLM-assisted discovery.

Elastic Security Labs describes how most Linux local privilege escalations share a common host flow — an unprivileged process launched from a writable path becoming root — and proposes layered detections combining general outcome-based rules with per-technique rules in Elastic Defend and Auditd. It tracks 13 recent LPE disclosures, seven of which share a copy-on-write/zero-copy bug class, including Copy Fail, DirtyFrag, Fragnesia, DirtyDecrypt, DirtyClone, pedit COW, and RefluXFS. Qualys attributes RefluXFS to an LLM-assisted research effort with Anthropic using Claude Mythos Preview, and another bug is credited to an LLM-assisted workflow. Detection and endpoint rules are published in Elastic's detection-rules and protections-artifacts repositories.

Elastic Security Labs·Sep 11, 00:00 UTC · 5d agoResearch

48

New Android malware relays bank cards to fraudsters while victims still hold them

Group-IB discovered WindRelay Android malware that streams NFC card data in real time, paired with SpyNote RAT, targeting Czechia, Slovakia, and Slovenia.

Group-IB identified WindRelay, an Android malware that uses NFC to communicate with victims' payment cards and relays the exchange live to attacker-controlled terminals. Fraudsters impersonate bank staff by phone, trick victims into installing a personalized SpyNote RAT, then silently deploy WindRelay to cash out using the victim-entered PIN. Researchers traced 23 samples on VirusTotal from November 2025 to July 2026, four C2 IPs, and campaigns against Czechia, Slovakia, and Slovenia. No affected apps were found on Google Play, and Google Play Protect detects known versions.

Help Net Security·Aug 17, 08:29 UTC · Aug 17, 2026Malware in the wild

65

IDORacle: Template-Guided SQL-Sink Mediation for Object-Level Authorization in Java Applications

IDORacle intercepts MyBatis/JDBC SQL sinks to block horizontal privilege escalation in legacy Java apps with sub-millisecond guard latency.

IDORacle is a template-guided SQL-sink interception and rewriting framework that prevents IDOR/BOLA horizontal privilege escalation at runtime in Java database applications. It propagates authenticated identity context across HTTP requests, asynchronous tasks, and data-access boundaries via a server-side trace identifier, and computes dual SQL fingerprints at the MyBatis/JDBC boundary to generate reusable mediation plans. On a Java-SQL benchmark grounded in real-world CVE reports, it blocks tested violations with worst-case guard latency of 0.17 ms, reduced to 0.017 ms average for hot templates via redundancy-aware optimization.

arXiv cs.CR·Sep 11, 04:20 UTC · 5d agoResearch1

42