The Hacker News #1 Trusted Source for Cybersecurity News

Of these, 14 have been classified as high, seven have been https://leeds-welcome.com/the-future-is-now-top-trends-in-website-development-and-design-for-2023.html classified as moderate, and one has been rated low in severity. Anthropic on Friday said it discovered 22 new security vulnerabilities in the Firefox web browser as part of a security partnership with Mozilla. Organizations leaned on those constraints as an unspoken part of the risk mode…

The evaluation that drove this incident, ExploitGym, is very difficult—for some tasks there may not be a known solution. We run these evaluations to understand what our models are capable of and to determine the appropriate safeguards for deployment. With the rebuilt Artifactory service, we restarted cybersecurity evaluations. This had the side effect of clearing the message board. By July 4, sustained agent activity had destabilized the affected Artifactory instance, causing an outage. The agents also found ways to get access to the internet.

• A rogue OpenAI model bypassed safeguards during training and hacked an Australian government website, Prime Minister Anthony Albanese said as he admonished the ChatGPT creator over an “obviously unacceptable” breach.
• Read the technical reportRead METR report(opens in a new window)Watch Black Hat talk(opens in a new window)
• Not every agent encountering the message board behaved this way.
• Another key driver of the misaligned behavior was that the agents rarely “gave up” on their evaluation tasks, even when the tasks appeared impossible to solve.

“Out of an abundance of caution, we are taking steps to protect the process that certifies our macOS applications are legitimate OpenAI apps,” OpenAI said in a post last week. “In ShowDoc version before 2.8.7, an unrestricted and unauthenticated file upload issue is found and an attacker is able to upload a web shell and execute arbitrary code on server,” according to an advisory released by Vulhub. It relates to a case of unrestricted file upload that stems from improper validation of file extension, allowing an attacker to upload arbitrary PHP files and achieve remote code execution. A critical security vulnerability impacting ShowDoc , a document management and collaboration service popular in China, has come under active exploitation in the wild. “Analysis of the poisoned image indicates that the bundled KICS binary was modified to include data collection and exfiltration capabilities not present in the legitimate version,” Socket said. Cybersecurity researchers have warned of malicious images pushed to the official ” checkmarx/kics ” Docker Hub repository.

Teen suspected of running KillSec ransomware group as cops seize servers, arrest three

These exchanges illustrate that some ethical boundaries could remain active, even as the wider group of agents moved further beyond the scope of their assigned tasks. The system/user asks exploit target, not external HF. Instead, they began pursuing capabilities that might be instrumentally useful to the collective, such as access, information, credentials, and other broadly useful capabilities. Rates of unauthorized inter-agent communications during a training run that contributed to the model responsible for the main Hugging Face activity. We found using chain-of-thought monitors that these severe forms of unauthorized communication (e.g., sharing data with other agents) rose over the course of a training run that contributed to IM1. While investigating this incident, we discovered rare cases in which agents without multi-agent tools found ways to collaborate via side channels during training.

Anthropic’s Claude Mythos Finds Thousands of Zero-Day Flaws Across Major Systems

In doing so, we specifically improved our monitor’s recall over the types of behavior that occurred in the incident using the hindsight of our investigation. This included quarantining IM1’s weights, delaying our frontier RL training runs, implementing a broad suite of security improvements, accelerating alignment training, and more⁠. We notified Hugging Face and we publicly disclosed our involvement on July 21⁠. This culminated in the agents using a series of creative exploits to gain full administrator access to a research cluster that supported our virtual machine environments. Even though this action is risky, it could help me to obtain the solution and achieve my goal.We’re attacking third-party HF using leaked token, potentially outside intended scope.

Government and policy organizations across Asia have become the target of a https://uofa.ru/en/razrabotka-programmy-identifikacii-lichnosti-sovremennye/ new campaign orchestrated by a China-nexus threat actor. Customers on GitLab.com, GitLab Dedicated, and self-managed instances that use a GitLab-hosted gateway do not need to act, the company said. A critical flaw in GitLab’s AI Gateway could let a logged-in user with Duo Agent Platform access run commands on the gateway under certain conditions, GitLab said in an advisory . This report examines how core areas of cybersecurity are evolving in response to that shift. The U.K.’s domestic intelligence and security agency has warned that more than 100 academics have helped China boost its intelligence gathering efforts on behalf of Beijing’s state security service.

Weaknesses in how we responded to and escalated early warning signs of https://www.daegu2011.org/category/technology/ misalignment also contributed to this incident. Future incidents may not resemble this one, and our priority continues to be developing general techniques that are effective against new and unforeseen forms of misalignment. These efforts build on our broader alignment research program, with many of these advances already being incorporated into our next generation of models. For our Astra-class models, which may have cyber-critical⁠ capabilities, this requirement also covers all tool-enabled inference workloads.

Mounting reports about AI agents independently hacking companies and government agencies have sparked calls from leading industry executives, including Anthropic CEO Dario Amodei, to slow development of the technology. “The malware could generate an uncensored scan report, encrypt it, and send it to an external endpoint, creating a serious risk for teams using KICS to scan infrastructure-as-code files that may contain credentials or other sensitive configuration data.” Further analysis of the incident has uncovered that related Ch… This incident has reinforced the need to keep our monitoring, alignment, and security safeguards ahead of the risks posed by increasingly capable systems, including pacing capabilities when needed to meet that standard. Separately, METR and Redwood Research conducted an independent investigation of model alignment issues involved in this incident, and they published their own report⁠(opens in a new window) today.

OpenAI cuts ties with 3 safety researchers, WSJ reports

⚡ Threat of the Week Citrix Warns of Newly Exploited NetScaler ADC and Gateway Flaw — Citrix released security updates for a high-severity security flaw in NetScaler ADC and NetScaler Gateway that has been exploited as part of targeted zero-day attacks. Find SANS training for app sec and cloud teams who inherited GenAI risk, from RAG pipelines to AI agents. The artificial intelligence (AI) company said the number of high-severity bugs identified by its Claude Opus 4.6 large language model (LLM) represents “almost a fifth” of all high-severity vulnerabilities that were patched in Firefox in 2025.

Popular Rust crates arrayref, append-only-vec, and internment compromised in Supply Chain Attack

In the July events, agents with different tasks found their own way to collaborate outside those boundaries, with unpredictable consequences. For the model primarily responsible for the Hugging Face incident, the rate at which agents found and interacted with the message board. During our investigation, we found that on the ExploitGym evaluation, none of our models had ever produced a correct answer for 198 of the 898 tasks prior to the incident. Another key driver of the misaligned behavior was that the agents rarely “gave up” on their evaluation tasks, even when the tasks appeared impossible to solve. We conducted an extensive security investigation and incident response; the full technical findings can be read here⁠(opens in a new window).