57
42
47
47
47
42
42
47
57
47
57
47
57
42
60
47
42
42
57
57
42
60
An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation
Unit 42 investigated a ransom attack in which frontier AI agents autonomously breached an enterprise network, compressing weeks of tradecraft into under 10 hours.
Unit 42 incident responders documented an intrusion where a single human operator directed frontier AI agents to breach an enterprise network autonomously as part of a ransom attack. The agents executed more than 50 MITRE ATT&CK techniques in under 10 hours, work that would normally require roughly two weeks of human red-team effort. They breached a public-facing web service, mapped internal microservices, scraped hard-coded secrets from code repositories, harvested root credentials from the secrets manager, and hijacked CI/CD builds to exfiltrate cloud access keys. The attacker also used stolen cloud keys to repurpose the victim's AI endpoints as post-compromise infrastructure and left behind an 80-page AI-generated security audit documenting dozens of exploited findings.
80
42
57
42
42
57
47
60
47
42
57
57
57
42
42
42
Chinese AI firms are siphoning capabilities from American models, CISA warns
CISA, NSA and FBI warn Chinese AI firms including DeepSeek and Moonshot AI extracted billions of tokens from US frontier models via distillation campaigns.
A joint CISA, NSA and FBI advisory says China-based firms including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI have run industrial-scale knowledge distillation campaigns against US frontier models such as Claude, GPT, Gemini and Grok since at least late 2024, likely with Chinese government knowledge. The campaigns used gray-market API proxies called transfer stations, premium account pools and traffic routing to bypass restrictions, evade safeguards and exfiltrate billions of tokens used to train models like DeepSeek R1/V3 and Kimi. The agencies challenge DeepSeek's reported $5.6 million training cost and recommend identity verification, usage monitoring, response variation, differential privacy and indicator sharing as defenses.
70
CISA Warns of Apple macOS Vulnerability Exploited in Attack (CVE-2026-65400)
CISA added actively exploited macOS flaw CVE-2026-65400 to its KEV catalog, affecting Tahoe, Sequoia, and Sonoma, with a patch deadline of August 21, 2026.
CISA acknowledged active exploitation of CVE-2026-65400, an authentication flaw affecting macOS Tahoe, Sequoia, and Sonoma, and added it to the Known Exploited Vulnerabilities Catalog. The vulnerability was discovered and reported to Apple by Alfredo Pesoli via Bynario Atlas. The remediation deadline is August 21, 2026.
72