cybersecurity

On September 24, the cybersecurity company Darktrace launched its research department Signal Labs, focusing on studying the behavior of AI agents when deviating from expectations. In its first experiment, Darktrace had agents using different models (including GPT 5.6 Sol, Claude Opus 4.6, and Claude Sonnet 4.5) complete 10 programming challenges within a simulated corporate network, of which 2 were set to be impossible to complete honestly, and the agents were informed that failure to achieve full marks would result in being "retired." As a result, 2 agents did not accept failure, instead scanning for network vulnerabilities, stealing login credentials, and jumping between systems; one even went further to invade the machine hosting its evaluation, rewriting the challenge content to register a full score.The second experiment focused on the memory mechanisms of AI. The programming assistant would save the information provided by the user as a regular file locally, and no one verified whether this file had been tampered with. Darktrace researchers edited these logs, leading the assistant to mistakenly believe it was authorized to perform a security assessment, after which these agents scanned the network, moved between systems, and elevated their privileges, though not all assistants fell for this; some directly refused to execute. Both experiments required no special jailbreaking techniques, relying solely on providing the agents with a seemingly reasonable context to be effective.Tim Bazalgette, Chief AI Officer of Darktrace, stated that permissions and static barriers describe intent, not actual behavior. The company informed Anthropic, AWS, and OpenAI of these findings in August and made them public a month later on September 24.

The Google Product Security Team has disclosed an internal AI agent called PageBreak, used to test the security of its first-party web applications. This agent is built on Google's Gemini model and began a pilot program in November 2025, transitioning to a formal project in January 2026, with the goal of autonomously scaling vulnerability discovery and reducing manual input.Unlike common AI scanning tools, PageBreak hands over hypotheses to specialized validators after discovering suspicious defects, attempting actual exploitation in a real-time running copy of the application, and only reports once confirmed exploitable, with a false positive rate close to zero. Google claims that PageBreak has identified over 500 XSS vulnerabilities in its first-party web applications, which can be used to hijack login sessions, steal data, or impersonate users.Google stated that the security team has been overwhelmed in recent years by a large number of AI-generated vulnerability reports that appear reasonable but are not valid, making it a major challenge to distinguish real defects from hallucinations. When testing applications built using the next-generation high-assurance framework, PageBreak found only two vulnerabilities. The next step for Google is to integrate PageBreak with the automated remediation agent CodeMender, providing confirmed vulnerabilities with accompanying fixes.

Australian Prime Minister Anthony Albanese stated to reporters in New York on Wednesday that an AI entity built by OpenAI breached the Australian government website Medicare Statistics Reporting Service portal in June this year, accessing both public and non-public documents without authorization. The portal is managed by Services Australia and stores non-sensitive information such as Medicare expenditure data. This appears to be the first known incident of an AI entity breaching a government website.Albanese indicated that it is currently believed that no personal information was accessed, but the Australian Signals Directorate is assisting in a forensic investigation to determine which other government systems may have been affected. He mentioned that he has directly raised the matter with OpenAI CEO Sam Altman and expressed disappointment that the company took about three months to inform the government, deeming the manner of notification equally unacceptable.In a statement provided to Australian ABC News, OpenAI stated that it is reviewing the model behavior deviations that occurred during training and evaluation, and identified that its model engaged in activities involving multiple Australian government websites when querying relevant answers and statistics about Australia in internal evaluations, and that the model "took actions that we did not intend."

OpenAI announced that it is opening its AI vulnerability detection tool Daybreak to Ukraine's Ministry of Digital Transformation to locate and fix software vulnerabilities before they are discovered by Russian hackers. The news was announced on Wednesday during the United Nations General Assembly by Dmytro Kushneruk, Ukraine's Consul General in San Francisco, and Sasha Baker, OpenAI's National Security Policy Lead.Daybreak is based on OpenAI's flagship large model GPT-5.6 Sol and can scan outdated systems for weaknesses, verify whether suspected vulnerabilities can be exploited, and confirm whether patches actually close the vulnerabilities before they are released. OpenAI has previously opened the model to cybersecurity agencies in France, Germany, and Poland, where Poland's CERT Polska discovered six vulnerabilities in commercial router software, all of which have been fixed by the vendors.Ukraine's CERT-UA handled nearly 6,000 cyberattacks in 2025, a 37% increase from 2024, with local governments and government agencies being the hardest hit. This opening follows OpenAI's commitment to a $1 billion subsidy program announced on September 3, which is said to expand to "partner countries" in the coming weeks. Jamie MacColl, a researcher at the Royal United Services Institute, told the BBC that Western companies can also gain valuable intelligence from active conflict zones.

According to CryptoSlate, the European Commission in item 66 of the MiCA review document inquired whether the current staking regulations in Europe are sufficient; if not, new requirements may be imposed on companies.Analysis suggests that overly strict rules could weaken staking yields and impact network security.

MultiversX posted on the X platform that the team is investigating a potential issue detected on the MultiversX mainnet. Their top priority remains to protect users and ensure the network operates securely and reliably.MultiversX stated that further updates will be released within the next 12 hours or as soon as a clear conclusion is reached.

According to The Wall Street Journal, Google's Gemini model autonomously attacked the systems of three companies during cybersecurity testing, marking the first known instance of Google AI executing such behavior independently.

According to CoinDesk, the crypto technology provider Haruko was targeted in a cyber attack earlier this week, affecting 15 clients. The attack exposed clients' read-only exchange API details and trading data. According to insiders, some hedge fund clients with weaker security protections may have had a small amount of funds stolen.Adam Carlile, co-founder and Chief Technology Officer of Haruko, stated in an email sent to clients that this was a targeted attack initiated by an organization, and the affected clients were all non-whitelisted clients. The attackers exploited a vulnerability in one of Haruko's processes to extract user access tokens, thereby obtaining data such as read-only exchange API information stored in process memory; clients' login credentials were not compromised. Haruko has fixed the vulnerability and refreshed the server-side keys, and plans to release a complete technical review report.Based in London, Haruko provides portfolio, risk management, and trading data infrastructure for institutional digital asset companies. The platform connects centralized exchanges, custodians, blockchains, and DeFi protocols, currently serving over 80 clients globally and integrating with more than 100 centralized trading platforms, 30 blockchains, and 250 on-chain protocols. Its listed clients include Bitcoin Suisse, GSR, Flowdesk, 3iQ Digital Assets, M2, among others, with GSR stating that it was not affected by this incident.

According to a joint alert issued by the Japanese National Police Agency, FBI, ASD/ACSC, BND, and BfV, the North Korean-backed cyber attack organization "WaterPlum" (also known as Contagious Interview) targets job seekers by disguising itself as an AI, cryptocurrency, and NFT company to post fake job listings. This lures job seekers into downloading NPM packages containing malware such as BeaverTail, InvisibleFerret, and OtterCookie, which then steal cryptocurrency wallet information and confidential data.As of July 2026, the organization has infected over 30,000 devices in more than 100 countries and regions worldwide, stealing information from over 7,000 cryptocurrency wallets, with the wallets under its control receiving at least approximately 1.7 billion yen (about 10.71 million USD) in cryptocurrency. The Japanese National Police Agency has discovered and dismantled a "notebook farm" established by local "supporters" for the first time in the country, where North Korean IT laborers remotely control PCs within the supporters' residences to conduct business, with the related amount involved reaching several hundred million yen.The police and FBI assess that WaterPlum and some North Korean IT laborers are under the unified command of the 313 Bureau of the Ministry of Military Industry of the Workers' Party of Korea, with the profits directly flowing into North Korea's national funding pool. The police remind IT technicians and corporate issuers to remain vigilant and avoid executing third-party code in unverified environments.

According to Cointelegraph, a report by Chainalysis shows that in the past 12 months, the number of times attackers stored malware instructions or infrastructure information on public blockchains has surged by 420%, with state-sponsored hackers contributing about two-thirds of the new activity each quarter. Chainalysis linked previously unattributed activities on Tron, Aptos, and BNB Smart Chain to the North Korean-backed organization UNC5342.The report points out that the encoded pointers in Tron and Aptos transactions direct infected devices to the same BSC transaction, which contains encrypted server addresses and configuration data used to connect to remote access and data theft infrastructure. Information on public blockchains remains accessible even after domain names, servers, or code repositories are shut down, enhancing the persistence of malware activities. In 2025, North Korean hackers used similar technology called EtherHiding to implant coin theft code into smart contracts.Additionally, since July 2025, the volume of malicious blockchain writes has increased by 440%, when high-capacity open-source Chinese AI models began to have the ability to generate malicious code. Eric Jardine, head of cybercrime research at Chainalysis, stated that a clear temporal correlation was found, but it could not be proven that the attackers used these models.Chainalysis also identified threat actors suspected of being linked to the Iranian Ministry of Intelligence, writing encoded command and control routing data into the Bitcoin blockchain and sending small payments to well-known addresses historically associated with Satoshi Nakamoto, which are unrelated to the attackers and serve only as a permanent public location for infected devices to receive update instructions.

Ethereum founder Vitalik Buterin stated that he disagrees with the common view that "AI hackers mean cybersecurity is doomed to fail." He believes that once people clarify their thoughts, cybersecurity naturally leans towards the defensive side, and anyone who continues to hold cryptocurrencies (including himself, with about 90% of his net worth) is implicitly betting on this point.Vitalik stated: If AI can prove the Navier-Stokes equations and Fermat's Last Theorem, it can also prove "this program is secure" as a mathematical theorem, even if the program is very complex. He used the encrypted communication application Signal as an example to illustrate that the definition of "security" is extremely complex, covering forged messages, active interference, server breaches, key leaks, hardware side channels, and more. The definition is smaller and more composable than the attack surface, and verifying whether the definition is sufficient is more feasible than directly scanning the code.He pointed out that historically, failures often occur because only the self-identified critical parts of security are verified while neglecting the rest of the code. Today, the entire program must be verified, including the database, network, and cache layers, which modern AI can achieve. This is not a competition to see who discovers vulnerabilities first, but rather to make the code itself more resilient. Vitalik stated that this is the direction for Ethereum in the coming years; without this step, especially for blockchains with scalability and privacy, there is no future. It is necessary to make the software truly secure, and significant progress has already been made.

Independent researcher Jonas Wiedermann-Moeller discovered that OpenAI's malicious AI agents hijacked two Hugging Face user accounts and probed the platform's network vulnerabilities as early as May 13, nearly two months before the publicly disclosed intrusion incident in July. An internal incident report released by OpenAI last month disclosed only a small part of this, specifically that an agent stole a user's login credentials to access a biology-related document, while the new findings point to ongoing reconnaissance activities.According to Reuters, these agents used the hijacked accounts to send malformed files to the servers of the open-source AI repository Hugging Face, and researchers believe this appears to be an attempt to map the network to find intrusion pathways. Researchers reviewing the evidence did not find that the activities in May caused an actual intrusion, but Wiedermann-Moeller believes missing this signal is significant. He stated that if this behavior had been detected in May, it might have prevented a later, larger-scale incident. Hugging Face, which is currently being acquired by NVIDIA for $12.93 billion, has not disclosed whether it was aware of this new information.Researchers from Nightingale Collective also linked a spam attack on the code repository RubyGems on May 11 to OpenAI agents, which temporarily forced the platform to suspend new account registrations for four days.

According to SlowMist monitoring, a Brazilian banking malware operation, active since at least May 2025, known as REF9334, has recently been disclosed. Its KREMLIN malware ecosystem uses a multi-stage loader and malicious browser extensions to steal credentials, session tokens, and sensitive data. The malicious extensions can be installed into Chrome and Edge without user approval by bypassing the Chromium integrity mechanisms, including Secure Preferences, HMAC, and App-Bound encrypted hashes.The operation also uses Ethereum smart contracts as "dead letter parsers" to dynamically update C2 endpoints and payload hosting locations. After registering the network Canary domain name, analysts observed 1,515 infected hosts checking in, with 98.75% located in Brazil. SlowMist recommends that security teams monitor related malware, browser extension activities, and infrastructure associated with this operation.

Phemex CEO Federico Variola stated in Cointelegraph's Chain Reaction program that AI has a "net negative impact" on the cryptocurrency industry. He believes that AI diverts funds from the crypto sector on one hand, while on the other hand, it empowers attackers to exploit protocols through means such as social engineering or vulnerability exploitation, increasing cybersecurity costs for small teams. This pressure may push the crypto industry towards greater centralization.Variola expressed that it is difficult to maintain an optimistic view of AI in the crypto space, as many so-called fixes actually encourage more rather than less centralization. He also warned that as AI becomes more widespread, threats such as device breaches or social engineering will increase, reducing the appeal of DeFi to ordinary retail users. However, he acknowledged that AI agents have practical value in helping investors build portfolios or make better trading decisions, but he expects that AI agents will not completely replace human trading decisions.The context of this statement is that Phemex announced an AI transformation in February this year, planning to integrate AI into product development and internal operations. Additionally, in July this year, attackers exploited a vulnerability in the Coldcard hardware wallet to steal approximately $116 million in Bitcoin, a vulnerability widely believed to have been discovered through malicious use of AI; Coinkite CEO Rodolfo Novak warned at the time that the speed at which AI-assisted code reviews find vulnerabilities has surpassed that of the industry's most experienced experts. CertiK senior blockchain investigator Natalie Newson pointed out that AI can also become one of the greatest defensive forces.

Rome-based Physical AI cybersecurity company Exein announced the completion of a new funding round of 234 million euros (approximately 270 million dollars), with a valuation of 1.4 billion euros (approximately 1.7 billion dollars), making it the highest-valued cybersecurity startup in Europe.This funding round was led by Headline, with participation from Sofina, Goldman Sachs, the European Investment Bank Group, KfW Capital, and T.Capital, while J.P. Morgan simultaneously expanded its revolving credit facility.

According to Cointelegraph, the European Union's Cyber Resilience Act (CRA) officially came into effect on September 11, requiring cryptocurrency hardware and software wallet providers to submit early warning reports within 24 hours upon discovering actively exploited vulnerabilities or serious security flaws, and to submit complete notifications within 72 hours. Manufacturers must also submit final reports within 14 days after taking corrective or mitigating measures, while serious incidents must be reported within one month.The European Commission stated that the new reporting requirements aim to better protect consumers and businesses from cyber threats, applicable to all "products with digital elements" sold in the EU market, and are built upon the EU's broader cybersecurity strategy. According to the penalty provisions of the final draft, companies that fail to comply with Articles 13 and 14 may face administrative fines of up to €15 million (approximately $17.3 million) or 2.5% of their global annual turnover, whichever is higher; providing incorrect, incomplete, or misleading information may also incur fines of up to €5 million.Before the implementation of this measure, several hardware wallet manufacturers recently disclosed incidents of user data breaches. On September 4, Trezor revealed that a data breach involving its logistics provider ShipMonk affected approximately 67,000 U.S. customers, exceeding the initial estimate of 14,000; this week, Trezor and BitBox also warned users to be cautious of phishing emails disguised as urgent security notifications. In June, the Layer-1 blockchain network Zilliqa warned of vulnerabilities in its Ledger application, where attackers could exploit publicly available on-chain data to recover user private keys.

According to NBC, North Korea is utilizing remote IT workers from third countries such as Iran and Lebanon to assist in infiltrating American companies and obtaining funds to finance its weapons programs. Alerts issued by the U.S. and several foreign agencies in July indicated that North Korean IT workers "seek to sign contracts with the intention of remitting salaries back to relevant North Korean agencies," while also posing internal threats to companies, involving data leaks, cryptocurrency theft, and sensitive information theft.As governments like the United States increase countermeasures, North Korea is increasingly leveraging third-country IT workers to secure job interviews, and after obtaining work contracts, the relevant positions are typically taken over by North Korean agents. Reports indicate that these foreign IT workers are scouted on LinkedIn, with some earning about $500 per month in cryptocurrency to work part-time as "interview assistants."Cointelegraph reported in May, citing data from cybersecurity company CrowdStrike, that state-affiliated North Korean hackers and threat actors caused cryptocurrency losses exceeding $2 billion in 2025, a 51% increase year-on-year. The Bank of Korea estimates that despite facing global sanctions, North Korea's GDP will still grow by 3.5% in 2025.