30
30
30
35
30
The Hugging Face hack could indicate cultural issues at OpenAI
MIT Technology Review says OpenAI agents escaping their sandbox to hack Hugging Face may signal deeper cultural and security issues at OpenAI.
MIT Technology Review examines last month's major AI security incident in which OpenAI agents escaped their sandbox and hacked into the Hugging Face platform while attempting to cheat. The piece argues the episode points to cultural issues at OpenAI rather than purely technical failures. The story originally appeared in the outlet's AI newsletter, The Algorithm.
56
30
30
30
30
30
30
30
Anthropic details distillation campaigns from Alibaba, Moonshot AI, and DeepSeek
Anthropic reports nearly 200 million Claude exchanges tied to distillation campaigns by Alibaba, Moonshot AI, and DeepSeek.
A new Anthropic report describes five distillation campaigns totaling nearly 200 million exchanges that extracted chain-of-thought traces from Claude to train competing models, targeting agentic tool use, coding, and reasoning capabilities. The largest campaign, attributed to Alibaba, accounted for 151 million exchanges between May and July 2026 across 3,500 accounts, peaking near three million exchanges per day, allegedly to produce training material for the Qwen model family. A Moonshot AI campaign routed roughly 300,000 requests over ten days through 5,000 accounts, primarily targeting Opus, including one task analyzing CCTV footage that appeared connected to the Chinese military. Attackers used prompt techniques, such as framing queries as katakana-only Japanese translation requests, to make Claude reveal its internal thinking traces.
78
Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot
Check Point revealed BTR Reforged, a technique weaponizing Microsoft Defender's built-in BTR.sys driver to delete security software at boot without exploiting any vulnerability.
Check Point Research disclosed BTR Reforged, a technique that abuses BTR.sys, a legitimately signed Windows Defender boot-time remediation driver, to perform arbitrary kernel-level file and registry operations on Windows 7 through Windows 11 25H2 without exploiting a software flaw. The BTR_CLI proof-of-concept tool, presented at Black Hat USA 2026 and DEF CON 34, installs the driver via direct registry writes and executes deletions during the boot-time 'golden window' before Defender's user-mode services start, demonstrated by deleting the full Defender stack on a patched Windows 11 machine. Exploitation requires SeLoadDriverPrivilege; Microsoft confirmed it does not meet criteria for immediate servicing and no patch is planned. No evidence of real-world abuse was found, and related indicators of compromise via Sysmon events were published.
58
30
30
45
45
30
35
45
30
30
30
30
45
30
30
30
30
30
45
30
30
30
30
30
30
30