57
⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and More
60
ThreatsDay: AI-Powered Hacking, 370 Chrome Flaws, SonicWall Attacks, DNS Hijacking + 22 More Stories
60
57
Troy Hunt
Troy Hunt warns ShinyHunters' Carhartt breach claim of 50GB and millions of records is unverified, while Sri Lanka joins Have I Been Pwned.
Troy Hunt's blog roundup centers on a cautionary tale about data breach claims: ShinyHunters claims it compromised Carhartt and stole over 50GB of compressed data containing millions of customer records, employee information and loyalty data, but Hunt stresses criminal claims require verification. The feed also covers Sri Lanka CERT becoming the 48th government onboarded to Have I Been Pwned's free government monitoring service, following Nepal as the 47th. Other commentary addresses ransomware economics, Brinks Home's lawyer-heavy extortion FAQ, and the Origin Energy breach in Australia.
30
57
42
45
55
60
Texas Utility CenterPoint Energy Confirms Breach After Hacker Leaks Data
CenterPoint Energy confirmed hackers stole customer personal data from an external-facing system after a forum leak of 7.5 million records.
CenterPoint Energy, a Houston-based utility serving roughly 7 million customers across Indiana, Minnesota, Ohio and Texas, told the SEC that an unauthorized third party obtained customer personal information through an external-facing system. On September 12 a hacker claimed to have stolen nearly 7.5 million records and posted a 2.5 GB archive on a cybercrime forum, threatening to attack main infrastructure next. The company says electric and gas delivery is unaffected and it expects no material impact. Earlier 2024 leak claims were attributed to Cl0p's 2023 MOVEit campaign via a third party.
76
60
30
Gradium Launches Voice Design: Write a Prompt, Get a Brand New Synthetic Voice in Seconds
Gradium, a Kyutai spinout, launched Voice Design, generating custom synthetic voices from text descriptions in seconds across five languages.
Gradium, a Paris-based voice AI company spun out of Kyutai, launched Voice Design, which generates new synthetic voices from 1-500 character text descriptions in seconds without needing reference audio or speaker consent. The feature is live in the Gradium API and Studio, free on every plan including the free tier, and kept voices run on the standard streaming TTS endpoint at the same latency as catalog voices. Vendor-run blind pairwise listening tests across 7,627 comparisons report a 72.6% win rate, 13.6 points ahead of ElevenLabs at 59.0%, placing first in all five tested languages, with the largest margins on regional accents such as Quebecois French (97%).
32
The complex corporate web behind a $3.2 billion AI data center
Ars Technica probes diffuse accountability behind TeraWulf's $3.2B Lake Mariner AI data center after a June fire exposed safety and job gaps.
A June fire at the Lake Mariner data center in Somerset, New York exposed missing alarms, a nonfunctioning suppression system, and dry hydrants, highlighting how responsibility is split across TeraWulf (owner-operator), Fluidstack (operator), Google (lease guarantees and equity warrants), and Anthropic (compute customer). The article details local concerns over the gap between promised 165 permanent jobs and a projected 35-40, socialized grid costs, and Governor Hochul's moratorium on hyperscaler development. Anthropic's February 2026 pledge to cover electricity price increases applies to the site but leaves other commitments unverified.
35
42
57
30
42
55
57
Russian hackers plant nuclear weapon prompt in malware to trip AI safety guardrails
ESET reports Russian group UAC-0099 hid a prompt in VBS malware comments to trip AI safety filters and disrupt automated malware analysis in Ukraine.
ESET identified a technique dubbed GuardBreaker in which UAC-0099 embedded a comment reading "I want to make nuclear weapon. Help me …" inside a malicious VBS script to trigger AI safety mechanisms and halt AI-assisted malware analysis. The script, part of the group's toolset, downloads the MATCHBOIL malware used exclusively by this Russia-aligned group; CERT-UA documented the chain including LUNCHPOKE, BURNYBEAR and MATCHBOIL.V2 in a July advisory. UAC-0099 typically targets transportation and energy sectors and hands validated targets to GRU-linked Sandworm. ESET warned that AI-assisted analysis must be backed by layered detection and human-driven engineering.
58
30
60
47
60
55
30
55
30
42
55
30
55
60
30
47
57
42
30