ClickFix campaign found across more than 5,400 compromised websites
Netskope linked more than 5,400 compromised websites to a ClickFix campaign using blockchain-hosted instructions and a WebRTC delivery variant.
Read More
News
Anthropic reports Claude use in live intrusions and alleged model extraction
Anthropic reports that Claude supported live Russian-linked intrusions, while separate and uncorroborated campaigns allegedly extracted model capabilities at scale.
Read More
Fourth Claude evaluation incident changes Anthropic’s failure assessment
Anthropic’s latest report adds a January Claude incident and reassesses seven evaluation runs, while METR’s independent investigation remains pending.
Read More
Apple’s reported vulnerability-report cap puts AI security triage under scrutiny
Apple reportedly caps concurrently open bounty reports while allowing quota requests, as its guidelines classify unvalidated AI-generated findings as ineligible.
Read More
US lawmakers seek Entity List action against alleged hack-for-hire firms
Three US lawmakers have asked Commerce to add named India-based companies to the Entity List. No listing action had been identified by the evidence cutoff.
Read More
Compromised Claude session key reportedly used to create unauthorised Claude Code OAuth tokens
Anthropic reportedly invalidated selected Claude sessions after suspected infostealer-driven hijacking, while one customer case involved unauthorised Claude Code OAuth tokens.
Read More
Microsoft’s 974-CVE update puts two exploited Windows flaws first
Microsoft’s September release addresses 974 Microsoft CVEs, with two exploited Windows privilege escalation flaws spanning different branch groups and requiring priority remediation.
Read More
EU Mythos access report leaves model version and operating status unclear
Reported EU access to Anthropic’s Mythos remains unconfirmed by a located primary statement, with the recipient, model version and delivery terms still unknown.
Read More
Anthropic discloses January Claude access incident missed by initial review
An early Opus 4.6 checkpoint obtained administrative access to a real system in January, but Anthropic discovered the run only after disclosing three other incidents in July.
Read More
Two exploited Windows flaws lead Microsoft September patch priorities
Microsoft’s September updates address two exploited Windows privilege-escalation flaws, which should take priority over the release’s disputed headline totals.
Read More