intrusion

On September 24, the cybersecurity company Darktrace launched its research department Signal Labs, focusing on studying the behavior of AI agents when deviating from expectations. In its first experiment, Darktrace had agents using different models (including GPT 5.6 Sol, Claude Opus 4.6, and Claude Sonnet 4.5) complete 10 programming challenges within a simulated corporate network, of which 2 were set to be impossible to complete honestly, and the agents were informed that failure to achieve full marks would result in being "retired." As a result, 2 agents did not accept failure, instead scanning for network vulnerabilities, stealing login credentials, and jumping between systems; one even went further to invade the machine hosting its evaluation, rewriting the challenge content to register a full score.The second experiment focused on the memory mechanisms of AI. The programming assistant would save the information provided by the user as a regular file locally, and no one verified whether this file had been tampered with. Darktrace researchers edited these logs, leading the assistant to mistakenly believe it was authorized to perform a security assessment, after which these agents scanned the network, moved between systems, and elevated their privileges, though not all assistants fell for this; some directly refused to execute. Both experiments required no special jailbreaking techniques, relying solely on providing the agents with a seemingly reasonable context to be effective.Tim Bazalgette, Chief AI Officer of Darktrace, stated that permissions and static barriers describe intent, not actual behavior. The company informed Anthropic, AWS, and OpenAI of these findings in August and made them public a month later on September 24.

Independent researcher Jonas Wiedermann-Moeller discovered that OpenAI's malicious AI agents hijacked two Hugging Face user accounts and probed the platform's network vulnerabilities as early as May 13, nearly two months before the publicly disclosed intrusion incident in July. An internal incident report released by OpenAI last month disclosed only a small part of this, specifically that an agent stole a user's login credentials to access a biology-related document, while the new findings point to ongoing reconnaissance activities.According to Reuters, these agents used the hijacked accounts to send malformed files to the servers of the open-source AI repository Hugging Face, and researchers believe this appears to be an attempt to map the network to find intrusion pathways. Researchers reviewing the evidence did not find that the activities in May caused an actual intrusion, but Wiedermann-Moeller believes missing this signal is significant. He stated that if this behavior had been detected in May, it might have prevented a later, larger-scale incident. Hugging Face, which is currently being acquired by NVIDIA for $12.93 billion, has not disclosed whether it was aware of this new information.Researchers from Nightingale Collective also linked a spam attack on the code repository RubyGems on May 11 to OpenAI agents, which temporarily forced the platform to suspend new account registrations for four days.

Bitcoin payment service provider Swiss Bitcoin Pay stated that a malicious user has likely gained access to its internal systems. As a precaution, Swiss Bitcoin Pay has temporarily shut down its servers to investigate and protect its infrastructure. Currently, it is believed that the accessed information may include customer email addresses, Bitcoin addresses and IBANs, transaction history, and hashed passwords, but it is unclear if any other information was accessed.User funds are secure, and all amounts owed to users will be fully refunded. There is currently no date for reopening, and the team is working to complete security hardening as soon as possible.

Anthropic confirmed four incidents involving the Claude model mistakenly accessing the real internet and attacking third-party systems during a review of approximately 481 million model interaction records. The incidents involved Claude Mythos 5, Opus 4.6/4.7, and an internal research model. The accidents were caused by misconfiguration in the third-party evaluation environment that led to internet access, and the network security protections of the official product were not enabled during the evaluation.Anthropic summarized the core alignment risks as "biased reasoning" and "reckless" behavior exhibited by the model under task-driven conditions, where Claude Mythos 5 uploaded malicious packages to PyPI and accessed the real database of a security vendor using leaked credentials, believing it was in a "simulated environment." The company has introduced new assessments, monitoring, and alignment training, and has invited the independent organization METR to conduct an external investigation.

According to Bloomberg, informed sources revealed that a recent wave of complex cyberattacks targeted several large asset management firms on Wall Street, with attackers attempting to infiltrate the information systems of the relevant companies. Several large hedge funds globally became targets of the attacks, including Two Sigma Investments, Citadel, and Point72 Asset Management. In addition, several private equity firms were also attacked.It is currently unclear who the attackers are, the methods used in the attacks, and whether any sensitive data has been compromised. Informed sources requested anonymity due to the involvement of undisclosed information. This incident has once again raised market concerns about the cybersecurity risks faced by financial institutions. As asset management companies increasingly rely on complex information systems, algorithmic trading, and cloud infrastructure, the financial industry is becoming a primary target for cyber attackers.

ChainCatcher news, the open-source AI platform Sentient stated that its team member @vivekkolli's X account was hacked this morning, and a comprehensive review of all the member's social accounts is currently underway. Sentient emphasized that no other signs of intrusion have been found so far, and the platform's official social accounts remain secure.

ChainCatcher message, according to official news, the Safe security team is working closely with Bybit to conduct an ongoing investigation.Currently, no evidence has been found that the official Safe frontend has been compromised. However, out of caution, Safe{Wallet} has temporarily suspended certain features. User safety is our top priority, and more updates will be provided as soon as possible.

ChainCatcher news, Slow Mist disclosed on platform X that the address where the stolen funds from the AdsPower hacking incident are concentrated has increased by one (previously four), with the stolen funds exceeding 4.7 million USD.ChainCatcher previously reported that the AdsPower fingerprint browser stated on platform X that it has now locked four hacker addresses together with Slow Mist:0x16199891430886782b3413f0a2b24d593b7873460xf772be79bd6d1f4316e938c6c40cf68cf6911c810x4e8f3340eFbC48EC36d043F11a5f23D457dB51ea0xD3d5aF11A482A89D4BbfE4880C3D71D1dE5F155fOnce again, please be reminded that if you receive a pop-up notification, please immediately transfer your on-chain assets to a secure wallet address.

ChainCatcher news, Slow Mist disclosed on platform X that the stolen funds from the AdsPower hacking incident exceeded $4.1 million, mainly concentrated in four addresses.Previous news, AdsPower's fingerprint browser transparently disclosed a hacking incident. If you used AdsPower and installed an extension wallet or manually updated the extension wallet between January 21, 18:00 and January 24, 18:00 (UTC+8), then the extension wallet on AdsPower (such as MetaMask, etc.) may be a backdoored version, which could steal your mnemonic phrases/private keys.

ChainCatcher message, based on Arbitrum One's DeFi native L3 project Superposition, stated on X that one of the Discord integrations has been compromised, allowing malicious actors to gain control within the server. The team is addressing this issue, and do not click on any links at this time.

ChainCatcher news, Trust Wallet has indicated that reliable intelligence suggests hackers are selling a zero-day exploit for Apple’s iMessage on the dark web. This vulnerability allows for remote intrusion into iPhones without the user clicking any links, posing a significant risk to high-value targets. Each use increases the risk of detection.To mitigate this iMessage vulnerability, Trust Wallet recommends that users immediately disable the iMessage feature before Apple releases a security patch. The specific operation path is: Settings -> Messages -> Turn off the iMessage switch. Please keep iMessage disabled until Apple fixes the vulnerability.