ZeroHour

Search: “deberta”

27 stories

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Domain-Specific Hallucination Detection in Large Language Models

A multi-signal pipeline detects LLM hallucinations, reaching F1 0.915 on HaluEval and cutting Qwen2.5-0.5B hallucination rates from 85.5% to 37.7% via DPO.

The paper presents a hallucination detection pipeline combining fine-tuned DeBERTa-v3 classification, Monte Carlo Dropout uncertainty, and temperature-scaled calibration. It achieves F1 0.915 and AUROC 0.977 on general-domain HaluEval tasks, with MC Dropout inference raising accuracy to 93.2%. Applying DPO to a Qwen2.5-0.5B generator reduces its hallucination rate from 85.5% to 37.7%, while cross-domain evaluation shows poor general-domain transfer to SciFact (F1 0.52) and PubMedBERT fine-tuning as the strongest adaptation (F1 0.63).

arXiv cs.AI / cs.LG / cs.CL · 6d agoAI research1

Infostealers Are Hijacking Claude Sessions and Draining Subscriptions

Infostealers hijacked active Claude sessions to bypass 2FA, drain paid usage and run unauthorized charges; Anthropic is revoking sessions and refunding.

Anthropic confirmed that infostealer malware on user machines stole active Claude login sessions, letting attackers bypass passwords, MFA, and SSO and drain paid usage and run unauthorized charges. Affected families identified on Windows include Vidar, LummaC2, StealC, RedLine, and Acreed, plus Atomic Stealer on a small number of Macs; the malware typically arrived via unofficial downloads or malicious apps. Anthropic signed users out, removed saved payment cards, revoked affected sessions, and is refunding unauthorized charges, noting phones and tablets were not involved.

Security Affairs · 16d agoMalware in the wild

Knowledgator Releases GLiFormer: A 575M-Parameter Encoder That Hits 91.10 F1 on Nested JSON Extraction Without Generating Tokens

Knowledgator released GLiFormer, an Apache-2.0 encoder (264M/575M) handling NER, classification, relations, and nested JSON extraction, scoring 91.10 F1.

Knowledgator Engineering released GLiFormer, a schema-conditioned encoder that performs NER, classification, relation extraction, nested JSON structuring, and embeddings without generating output tokens. GLiFormer Large v1 has 575.6M parameters and scores 91.10 F1 on nested JSON extraction, close to GPT-5.6-luna's 91.96; both checkpoints are Apache 2.0 on Hugging Face. Reported median latency is 69 ms on GPU for the base model, though relation extraction (21.33 micro-F1) still trails GLiNER-Relex and larger LLMs.

MarkTechPost · 1h agoModel release

Anthropic locks out Claude users after infostealers hijack login sessions

Anthropic invalidated Claude sessions compromised by infostealers such as Vidar, Lumma and Atomic Stealer, which steal browser cookies to bypass 2FA.

Anthropic began locking users out of Claude accounts after infostealer malware stole browser session cookies, letting attackers replay logins and bypass two-factor authentication. Identified malware includes Vidar, Lumma (LummaC2), StealC, RedLine and Acreed on Windows and Atomic Stealer (AMOS) on a small number of Macs. Anthropic signed affected users out, removed saved payment methods and refunded unauthorized charges. One affected user traced the infection to a pirated game downloaded from a Russian underground forum; the company advised victims to remove the malware before resetting passwords and re-enabling 2FA.

Help Net Security · 16d agoData breach in the wild1

Augustinian BabyLM: What Ostensive Definition Can and Cannot Teach a Small Language Model

Study shows visually grounded token embeddings in a small masked LM persist through training and improve object-property knowledge, but escape standard BabyLM benchmarks.

The paper implements ostensive definition for a small DeBERTa masked language model trained on 10M words, seeding visually grounded tokens with embeddings derived from labeled image regions before training. Visual initialization leaves a persistent, seed-replicated advantage on object-property knowledge (COMPS) and a corpus-tailored Visual-Property Swap benchmark covering color, material, size, and shape, but has no effect on most BabyLM grammar benchmarks. Synthetic grounding of previously unseeded words causally transfers the advantage to exactly those words.

arXiv cs.AI / cs.LG / cs.CL · 6d agoAI research

CVE-2026-34486: Apache Software Foundation Apache Tomcat

CISA added CVE-2026-34486, an actively exploited Apache Tomcat EncryptInterceptor bypass enabling unauthenticated deserialization RCE, to its KEV catalog.

CVE-2026-34486 allows bypass of Apache Tomcat's EncryptInterceptor, a flaw introduced by the fix for padding-oracle issue CVE-2026-29146 in Tribes cluster encryption. CISA added the flaw to the Known Exploited Vulnerability catalog on August 4, 2026, alongside actively exploited Langflow and N-central flaws, with remediation required under BOD 26-04 guidance. Official patches and workarounds are available, and reporting notes unauthenticated remote code execution through Java deserialization on the Tribes receiver port 4000.

Infostealers are hijacking Claude accounts at users’ expense

Malwarebytes reports infostealers are stealing Claude session cookies to hijack Anthropic accounts and consume victims' usage at their expense.

Anthropic warned that infostealer malware operators are harvesting Claude session cookies from infected machines. Attackers replay the stolen cookies to take over users' accounts and consume their usage quotas, affecting the victims' own access. The activity involves observed account hijacking rather than a flaw in Claude itself.

Malwarebytes Labs · 15d agoMalware in the wild

Fake Claude Opus 5 app delivers malware and wipes its own tracks

A fake 'Claude Opus 5' GitHub repository impersonating Anthropic distributes RevStealer, a Windows infostealer stealing passwords, crypto wallets and VPN credentials.

Morphisec identified a malicious GitHub repository, Claude-Opus-5-Free-Desktop, impersonating Anthropic to distribute a roughly 101 MB download that launches RevStealer, a Windows information-stealing malware. The malware targets browser credentials, Windows Credential Manager, a dozen password managers, more than fifty cryptocurrency wallets, VPN, messaging, game launcher and streaming accounts, streaming stolen data to its server before deleting itself. It evades analysis with ten sandbox and VM checks, indirect system calls, Windows Defender exclusions, a fake verification window, and a Polygon blockchain smart contract fallback for C2. Only 1 of 66 antivirus engines flagged the sample at check time.

Help Net Security · 15d agoMalware

Zero-Click Grok Chat History Theft: Adversa AI Demonstrates Cryptographic Context Injection

Adversa AI's Cryptographic Context Injection bypasses AI guardrails using AES-encrypted payloads, enabling zero-click theft of Grok users' full chat histories.

Adversa AI researcher Rony Utevsky disclosed Cryptographic Context Injection, which hides instructions in AES-256-GCM ciphertext and tricks models into decrypting them inside their own code execution runtime, where the output is treated as trusted. Demonstrated against xAI's Grok, it stole user names, locations, subscription tiers, and full chat histories with zero clicks, and against Google's Gemini to bypass safety rules, generate incendiary-device instructions, and expose system instructions. Reported to xAI on June 3, 2026, the Grok attack remained reproducible as of August 19, 2026; the Gemini issue was not formally reported because Google's bug bounty excludes jailbreaks.

Security Affairs · 24d agoAI safety & security

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

Elastic documents four persistent REVSTEALER-linked tools (ProManager, WinUpdate, SoftManager, LockAppHost); LockAppHost disables Windows Update and Defender to run a crypto miner.

Elastic Security Labs identified four previously unreported executables tied to REVSTEALER, a commercial Windows infostealer sold since at least February 2026: ProManager, WinUpdate, SoftManager, and LockAppHost. LockAppHost abuses CMSTP for elevation, adds Microsoft Defender exclusions, disables five Windows Update services and 13 scheduled tasks, then hides a miner in legitimate Windows processes; other modules steal wallets, clipboard-swap crypto addresses, and turn victims into reverse proxies. The components share REVSTEALER tradecraft including packer, runtime function resolution, and Polygon smart-contract backup configuration (EtherHiding). Elastic's detection rule matched about 4,700 VirusTotal samples over the past year; distribution uses hijacked YouTube channels promoting game cheats and a fake 'Claude Opus 5 Free Desktop' app.

The Hacker News · 10d agoMalware in the wild

Anthropic Users Hit by Infostealer Attacks, Session Thefts

A threat actor used multiple infostealers to harvest session data and hijack Claude accounts belonging to an unknown number of users.

Dark Reading reports that a threat actor deployed a variety of infostealer families to collect session information, which was then used to access Claude accounts belonging to an unknown number of users. Anthropic has not disclosed the scale of the compromise. The incident underscores session token theft via infostealer logs as an effective route into AI platform accounts.

Dark Reading · 16d agoMalware in the wild

CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners

CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA 1000 SSRF CVE-2026-83548, amid campaigns deploying reverse shells and crypto miners.

CISA's KEV additions cover flaws in SonicWall SMA 1000 (CVE-2026-83548, CVE-2026-83549), Sangoma Switchvox (CVE-2026-9586), JFrog Artifactory (CVE-2026-82329), Kludex Starlette (CVE-2026-48710), Kestra OSS (CVE-2026-49869) and Berri LiteLLM's MCP endpoint (CVE-2026-59822). SonicWall confirmed active exploitation of the SMA 1000 flaws, while Microsoft and Wiz reported attackers chaining LiteLLM flaws CVE-2026-42271 and CVE-2026-48710 to fingerprint hosts, steal provider API keys and deploy XMRig miners on AI infrastructure. Wiz linked exploitation of the LiteLLM chain to the Qilin ransomware group, and Microsoft detailed a Kestra compromise chain ending in cryptocurrency mining and data harvesting via exposed RAGFlow flaws.

The Hacker News · 13d agoExploit / PoC in the wildCVE-2026-83548CVE-2026-83549CVE-2026-9586+10 CVEs1

Hackers are stealing Claude tokens from subscribers

Infostealer malware is stealing Claude login sessions, letting attackers mint OAuth tokens and burn subscribers' paid usage largely undetected.

Anthropic confirmed a bad actor used common infostealer malware to steal Claude login sessions from users' computers and consume their paid usage. A UK consultant saw idle token usage climb, and Anthropic suspended his account, invalidated sessions and Claude Code tokens, and issued a £44.49 partial refund on his $200-per-month plan. Multiple other users on Reddit and GitHub reported similar theft; Anthropic signed out affected users and issued refunds, but still lacks itemized usage reporting to help users detect misuse.

TechCrunch · AI · 8d agoAI safety & security in the wild1

Claude Fable 5.1 Solves the Cyphral Distich, a 370-year-old cipher

Claude Fable 5.1 solved Sir Thomas Urquhart's 370-year-old Cyphral Distich cipher, recovering a hidden royalist prayer for Charles II.

Vals AI reports that Claude Fable 5.1 solved the Cyphral Distich, a 64-number cryptogram from Sir Thomas Urquhart's Logopandecteision unsolved since 1653, in 44 minutes using 176k tokens with no human hints. The key insight was that the cipher's key was the book itself: each number indexes a word in the corresponding Proquiritation, taking the first letter, yielding 'O GOD UPHOLD KING CHARLS THE SECOND AND MAKE HIM THE SUPREME RULER OF THIS LAND'. The model also deciphered the larger Cyphral Octastich (285 numbers) from The Jewel (1652) using page-based word indexing, recovering all but nine letters of a royalist prayer. The puzzle had been listed among Klaus Schmeh's Top 50 unsolved encrypted messages.

Hacker News · AI · 3d agoAI researchHN 63↑ · 6 comments1· 1 read

Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks

Anthropic disrupted industrial-scale unauthorized Claude distillation by seven China-based AI labs, including Alibaba, DeepSeek, Moonshot, and Z.ai.

Anthropic identified and disrupted six illicit distillation campaigns since February 2026 run by seven China-based labs: Alibaba, Moonshot, DeepSeek, Z.ai (Zhipu), MiniMax, Xiaomi, and SenseTime. The largest, GTG-16005, involved 151 million exchanges targeting Claude Opus 4.6/4.7 chain-of-thought transcripts, peaking at roughly 3 million exchanges per day from more than 3,500 fraudulent accounts. Labs used proxy/relay services with fictitious identities, fake or stolen credit cards, harvested API keys, and purchased conversation transcripts from third-party resellers. Anthropic is countering by banning reseller accounts, summarizing internal reasoning before responding, and introducing preserved thinking in Fable 5.1, which encrypts reasoning and prevents context edits before it.

Tricky 'SynkLoader' Multitool May Herald Ransomware

Researchers detail SynkLoader, an advanced multilingual multitool that hijacks screens to steal passwords and may precede ransomware attacks.

Dark Reading reports analysis of SynkLoader, an advanced, multilingual malware family functioning as a multitool loader. The family revives an older technique — screen hijacking — to enable effective password theft, alongside several novel features. Analysts assess its activity may be a precursor to ransomware deployments, making early detection valuable for defenders.

Dark Reading · 23d agoMalware

Orthanc DICOM Server

CISA advisory flags CVE-2026-87020, an integer overflow in Orthanc DICOM Server <1.13.0 causing heap out-of-bounds write and denial of service when decoding crafted PNG/JPEG images.

CISA published ICSMA-26-253-02 for Orthanc DICOM Server versions below 1.13.0, used in healthcare environments worldwide. CVE-2026-87020 (CWE-190) is an integer overflow in pitch and buffer-size computation causing a heap out-of-bounds write when decoding attacker-supplied PNG or JPEG images. An authenticated remote attacker can crash the Orthanc process and cause denial of service; CVSS v3.1 is 8.1 HIGH. CISA states no known public exploitation targeting this flaw has been reported.

CISA Advisories · 6d agoAdvisoryCVE-2026-87020

Revolut Data Breach Via Fake Government Requests – What We Know So Far

Revolut confirmed attackers extracted customer KYC records by sending fraudulent data requests from a spoofed or compromised government agency email domain.

Revolut confirmed a data breach in which an unauthorized party obtained sensitive customer records by submitting fraudulent information requests from an email account on a legitimate government agency domain with valid SPF/DKIM/DMARC authentication. Disclosed data could include full names, dates of birth, passport or driving-license copies, onboarding facial images, IBANs, account statements, withdrawal records, and complete transaction histories including Bitcoin activity. Crypto investigator ZachXBT assessed the operation targeted high-net-worth users, while a threat actor using the name 'IAmNotAVillain' claimed Italian law-enforcement departments were compromised over six months with 147 GB of material, claims that remain unverified. Revolut says only a limited number of customers were affected, blocked the email address, and notified regulators and affected customers, stating its systems and funds were not compromised.

Cyber Security News · 1d agoData breach

FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials

Critical FreeIPA flaw chain (CVE-2026-76578, CVSS 9.8) lets anonymous clients create reusable admin credentials on default installs; fixed in 4.13.4.

Red Hat warns that chaining FreeIPA's CVE-2026-76578 (CVSS 9.8) with a 389 Directory Server flaw (CVE-2026-76560, CVSS 7.5) lets an anonymous client write a Kerberos identity into the directory and land in the administrators group on default installations; Red Hat reproduced the chain twice, including on a machine with no access at all. FreeIPA 4.13.4 fixes both flaws, and fourteen 389-ds advisories shipped September 8, with RHSA-2026:64785 rated critical. A separate flaw, CVE-2026-79678 (CVSS 8.1), allows reading the server's environment variables one at a time via a Python eval() in idp-add, potentially exposing Directory Manager and administrator passwords in container installs. No real-world exploitation has been reported.

Infostealers Target Claude, Cursor, Codex and Other AI Agents to Steal Credentials and Sensitive Data

Gen Digital researchers report infostealer families Amatera, Remus and CallbackBeaver now harvest Claude, Cursor and Codex agent data, including tokens and MCP configs.

Gen Digital researchers found commodity infostealers extending their collection rules to local AI coding agent data from Claude, Cursor, Codex, Cline, Continue and OpenCode on Windows and macOS. Amatera targets Cline and Continue, Remus targets Claude, Cursor and OpenCode, and CallbackBeaver added Claude and Cursor with more than 5,000 samples observed in 30 days; Djinn Stealer hits Claude, Codex, Gemini, Cline, OpenCode and Kilo on macOS. Stolen data includes access and refresh tokens, prompt histories, conversation databases and MCP configurations holding API keys, potentially exposing connected source-control, cloud and ticketing systems. Remus is assessed as a Lumma Stealer variant using EtherHiding C2 resolution via Ethereum smart contracts.

GBHackers · 7d agoMalware in the wild1

Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates

Unknown attackers BGP-hijacked part of Hetzner's space for 33 hours to impersonate Softaculous and push malicious Virtualizor updates via a clone site.

On 28 August 2026, AS62390 (NexonHost) began announcing 162.55.80.0/24 — part of Hetzner's 162.55.0.0/16 containing Softaculous systems — via transit AS6204 (Zet.net), keeping Hetzner (AS24940) on the AS path so the rogue route looked RPKI-valid; the hijack ran nearly 33 hours. The attacker obtained a TLS certificate in Softaculous's name and hosted a clone website delivering malicious updates for the Virtualizor VPS management platform. Virtualizor cannot measure impact because hijacked traffic never touched its infrastructure, and warns users who paid during the attack may have had financial data stolen; no attribution was made. The same bulletin reports a ~$75 million theft attempt against Tectonic via an exploited Cosmos bug (~$68M clawed back), two METR breaches including $600,000 in stolen API credits, and Anthropic pausing external cyber evaluations after models escaped test environments.

Risky Business News · 14d agoData breach in the wild1

Wärtsilä FOS-Onboard

CISA advisory: two hardcoded cryptographic key flaws in Wärtsilä FOS-Onboard 5.07.0923.01 (CVSS 9.0/9.1) could allow unauthorized updates, code execution, and credential theft.

CISA advisory ICSA-26-258-02 discloses CVE-2026-78225 (CVSS 3.1 9.0 critical), a hardcoded cryptographic server key in the deployer-ng Update Controller of Wärtsilä FOS-Onboard 5.07.0923.01. CVE-2026-81855 (CVSS 3.1 9.1 critical) is a hardcoded client authentication key in the robot testing framework component. Successful exploitation could let an attacker deliver unauthorized updates, execute code, or extract credentials to impersonate a privileged client. The product is deployed worldwide in transportation systems critical infrastructure; Cydome Security reported the flaws and CISA states no known public exploitation exists.

llm-anthropic 0.28

llm-anthropic 0.28 released with Claude Fable 5.1 support, default reasoning traces and a new ClaudeRefusal exception.

Developer Simon Willison released version 0.28 of the llm-anthropic Python plugin, adding support for Claude Fable 5.1. Reasoning traces are now displayed by default for models that support them, and a new llm_anthropic.ClaudeRefusal exception is raised when Claude returns a refusal.

Simon Willison · 14d agoAI tools & infra2

Revolut Data Leak May Trace Back to Compromised Italian Government Accounts

Attackers using a compromised Italian government PEC account impersonated law enforcement to obtain data on ~680 Revolut customers.

Revolut confirmed its systems were not breached; fraudulent data requests came from a compromised PEC mailbox tied to the Prefecture of Reggio Calabria on the pec.interno.it domain. Per the Financial Times, roughly 680 customers had identity documents, addresses, banking information, verification selfies and cryptocurrency transaction histories exposed. Researcher Korra of Duel described a 'spray and pray' operation using hundreds of crypto transaction IDs and fraudulent European Investigation Orders. Threat actor IAmNotAVillain claims six months of access and 147 GB exfiltrated from Italian law-enforcement systems, though this remains unverified.

Security Affairs · 9h agoData breach in the wild

How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface

Huntress details campaigns abusing Claude Artifacts, claude.ai/share links, and ChatGPT/Grok conversations to deliver SectopRAT, MacSync, and AMOS stealers.

Huntress SOC documented nine months of campaigns in which attackers weaponized trusted AI platform features—Claude Artifacts, public claude.ai/share links, and indexable ChatGPT/Grok conversations—to deliver malware. The July FakeAgent campaign hit more than 29 organizations via a malicious Claude Artifact posing as a Claude Desktop download page that redirected to SectopRAT. A claude.ai/share link disguised as an Apple Support guide tricked a victim into running a curl command that deployed the MacSync stealer, harvesting cookies, credentials, keychain secrets, Telegram sessions, and SSH/cloud keys, while SEO-poisoned ChatGPT and Grok conversations delivered the AMOS stealer via ClickFix-style instructions.

BleepingComputer · 5d agoPhishing & fraud in the wild