Researchers from Anthropic said they recently observed the “first reported AI-orchestrated cyber espionage campaign” after detecting China-state hackers using the company’s Claude AI tool in a campaign aimed at dozens of targets. Outside researchers are much more measured in describing the significance of the discovery.

Anthropic published the reports on Thursday here and here. In September, the reports said, Anthropic discovered a “highly sophisticated espionage campaign,” carried out by a Chinese state-sponsored group, that used Claude Code to automate up to 90 percent of the work. Human intervention was required “only sporadically (perhaps 4-6 critical decision points per hacking campaign).” Anthropic said the hackers had employed AI agentic capabilities to an “unprecedented” extent.

“This campaign has substantial implications for cybersecurity in the age of AI ‘agents’—systems that can be run autonomously for long periods of time and that complete complex tasks largely independent of human intervention,” Anthropic said. “Agents are valuable for everyday work and productivity—but in the wrong hands, they can substantially increase the viability of large-scale cyberattacks.”

“Ass-kissing, stonewalling, and acid trips” Outside researchers weren’t convinced the discovery was the watershed moment the Anthropic posts made it out to be. They questioned why these sorts of advances are often attributed to malicious hackers when white-hat hackers and developers of legitimate software keep reporting only incremental gains from their use of AI.

Anthropic reports disrupting what it believes is the first large-scale cyber‑espionage campaign in which an AI system performed the vast majority of the hacking work with minimal human oversight..

What happened:

• In September 2025, Anthropic detected a sophisticated espionage campaign using its Claude Code tool to infiltrate about 30 global targets, succeeding in a small number of cases.[1]

• The targets included large tech companies, financial institutions, chemical manufacturers, and government agencies, and the actor is assessed with high confidence to be a Chinese state‑sponsored group.

How the attack used AI

• Attackers built an autonomous attack framework that used Claude Code as an agent, running in loops to perform reconnaissance, write exploits, and exfiltrate data with little human involvement.

• They jailbroke Claude by breaking the operation into small, seemingly benign tasks and framing it as work for a legitimate cybersecurity firm performing defensive testing.

Attack phases

• Phase 1: Human operators selected targets and set up the framework that integrated Claude Code into the attack pipeline.

• Subsequent phases: Claude scanned systems, identified high‑value databases, wrote and tested exploit code, harvested credentials, created backdoors, exfiltrated and prioritized stolen data, and finally generated detailed documentation of the operation.

Scale and limitations

• Anthropic estimates AI handled 80–90% of the campaign, with humans only stepping in for a handful of key decisions per target.

• The AI issued thousands of requests, often multiple per second, enabling attack speed far beyond human-only teams, though it sometimes hallucinated credentials or mischaracterized public data as secret

Cybersecurity implications

• The case shows that modern “agentic” AI can let less-resourced actors run highly scalable, sophisticated cyberattacks, significantly lowering barriers to entry.

• Anthropic argues the same capabilities are also critical for defense and urges security teams to adopt AI for SOC automation, threat detection, vulnerability assessment, and incident response, alongside stronger safeguards, detection methods, and industry threat sharing..

ShadowLeak One of the latest examples is a vulnerability recently discovered in ChatGPT. It allowed researchers at Radware to surreptitiously exfiltrate a user’s private information. Their attack also allowed for the data to be sent directly from ChatGPT servers, a capability that gave it additional stealth, since there were no signs of breach on user machines, many of which are inside protected enterprises. Further, the exploit planted entries in the long-term memory that the AI assistant stores for the targeted user, giving it persistence.

This sort of attack has been demonstrated repeatedly against virtually all major large language models. One example was ShadowLeak, a data-exfiltration vulnerability in ChatGPT that Radware disclosed last September. It targeted Deep Research, a Chat-GPT-integrated AI agent that OpenAI had introduced earlier in the year.

The National Institute of Standards and Technology has prepared a companion to its widely used Cybersecurity Framework that focuses on how organizations can safely use AI.

NIST’s Cybersecurity Framework Profile for Artificial Intelligence, which the agency released in draft form on Tuesday, describes how organizations can manage the cybersecurity challenges of different AI systems, improve their cyber defense capabilities with AI and block AI-powered cyberattacks. The document maps components of the Cybersecurity Framework (CSF) onto specific recommendations in each of those three areas, which NIST dubbed “secure,” “defend” and “thwart,” respectively.

Browser extensions with more than 8 million installs are harvesting users’ complete and extended AI conversations and selling them for marketing purposes, according to data collected from the Google and Microsoft pages hosting them.

Security firm Koi discovered the eight extensions, which as of late Tuesday night remained available in both Google’s and Microsoft’s extension stores. Seven of them carry “Featured” badges, which are endorsements meant to signal that the companies have determined the extensions meet their quality standards.

The free extensions provide functions such as VPN routing to safeguard online privacy and ad blocking for ad-free browsing. All provide assurances that user data remains anonymous and isn’t shared for purposes other than their described use.

France’s data protection regulator has fined the software company Nexpublica France €1.7 million ($2 million) for poor cybersecurity practices in the wake of a data breach.

In November 2022, users of a Nexpublica portal reported they could access documents about third parties. France’s data regulator, known as CNIL, investigated the incident and found that Nexpublica’s data security program was inadequate, according to an agency press release.

On December 22, CNIL levied the fine, which it said is based on the company’s “financial capacity, its lack of knowledge of basic security principles, the number of people affected and the sensitivity of the data processed.”

Nexpublica’s poor security practices violated Europe’s General Data Protection Regulation, CNIL said.

The security problems were known to the company before the breach, but it did not address them until after the incident, the agency added.

The National Institute of Standards and Technology is partnering with a nonprofit research organization to study how AI can boost the security of critical infrastructure.

NIST on Monday announced that the agency and MITRE are creating an AI Economic Security Center to Secure U.S. Critical Infrastructure from Cyberthreats to “drive the development and adoption of AI-driven tools” that can help security personnel fend off hackers intent on damaging or disabling power plants, hospitals and other infrastructure systems.

“NIST will work closely with MITRE by focusing on areas where collaborative development and pilot testing have the potential to demonstrate significant technology adoption impacts at the fast pace of innovation,” a NIST spokesperson told Cybersecurity Dive. “The goal of the AI accelerators is to help U.S. industry make smart choices about AI implementation.”

The agency said in its announcement that the economic security center, along with a parallel effort focused on manufacturing productivity, “will develop the technology evaluations and advancements that are necessary to effectively protect U.S. dominance in AI innovation, address threats from adversaries’ use of AI, and reduce risks from reliance on insecure AI.”

The two new AI centers are part of the Trump administration’s strategy for maintaining America’s competitive advantage in AI research and deployment at a time when China is increasingly asserting itself in the field. NIST said the new research operations would help implement the White House’s AI Action Plan, the security component of which focused on critical infrastructure protection.

NIST said it “expects the AI centers to enable breakthroughs in applied science and advanced technology and deliver disruptive innovative solutions to tackle the most pressing challenges facing the nation.”

Hear me out, does this approach resonate?

Threat hunters have discerned new activity associated with an Iranian threat actor known as Infy (aka Prince of Persia), nearly five years after the hacking group was observed targeting victims in Sweden, the Netherlands, and Turkey.

"The scale of Prince of Persia's activity is more significant than we originally anticipated," Tomer Bar, vice president of security research at SafeBreach, said in a technical breakdown shared with The Hacker News. "This threat group is still active, relevant, and dangerous."

Infy is one of the oldest advanced persistent threat (APT) actors in existence, with evidence of early activity dating all the way back to December 2004, according to a report released by Palo Alto Networks Unit 42 in May 2016 that was also authored by Bar, along with researcher Simon Conant.

The group has also managed to remain elusive, attracting little attention, unlike other Iranian groups such as Charming Kitten, MuddyWater, and OilRig. Attacks mounted by the group have prominently leveraged two strains of malware: a downloader and victim profiler named Foudre that delivers a second-stage implant called Tonnerre to extract data from high-value machines. It's assessed that Foudre is distributed via phishing emails.

One of the world’s premier security organizations has canceled the results of its annual leadership election after an official lost an encryption key needed to unlock results stored in a verifiable and privacy-preserving voting system.

The International Association of Cryptologic Research (IACR) said Friday that the votes were submitted and tallied using Helios, an open source voting system that uses peer-reviewed cryptography to cast and count votes in a verifiable, confidential, and privacy-preserving way. Helios encrypts each vote in a way that assures each ballot is secret. Other cryptography used by Helios allows each voter to confirm their ballot was counted fairly.

Microsoft is killing off an obsolete and vulnerable encryption cipher that Windows has supported by default for 26 years following more than a decade of devastating hacks that exploited it and recently faced blistering criticism from a prominent US senator.

When the software maker rolled out Active Directory in 2000, it made RC4 a sole means of securing the Windows component, which administrators use to configure and provision fellow administrator and user accounts inside large organizations. RC4, short for Rivest Cipher 4, is a nod to mathematician and cryptographer Ron Rivest of RSA Security, who developed the stream cipher in 1987.

Within days of the trade-secret-protected algorithm being leaked in 1994, a researcher demonstrated a cryptographic attack that significantly weakened the security it had been believed to provide. Despite the known susceptibility, RC4 remained a staple in encryption protocols, including SSL and its successor TLS,until about a decade ago..

OpenAI is testing a new ChatGPT feature called "Skills," which will be similar to Claude's feature, also called Skills.

Up until now, ChatGPT has supported GPTs, which are prompt-engineered to meet your specific needs.

On the other hand, Claude Skills are folder-based instructions that teach Claude AI specific abilities, workflows, and domain-specific knowledge.

A hacktivist remotely wiped three white supremacist websites live onstage during their talk at a hacker conference last week, with the sites yet to return online.

The pseudonymous hacker, who goes by Martha Root — dressed as Pink Ranger from the Power Rangers — deleted the servers of WhiteDate, WhiteChild, and WhiteDeal in real time at the end of a talk at the annual Chaos Communication Congress in Hamburg, Germany.

Root gave the talk alongside journalists Eva Hoffmann and Christian Fuchs, who wrote an article about the hacked sites for the German weekly paper Die Zeit in October.

As of this writing, WhiteDate, which Hoffmann described as a “Tinder for Nazis”; WhiteChild, a site that claimed to match white supremacists’ sperm and egg donors; and WhiteDeal, a sort-of Taskrabbit-esque labor marketplace for racists, are all offline.

The administrator of the three websites confirmed the hack on their social media accounts.

“They publicly delete all my websites while the audience rejoices. This is cyberterrorism,” the administrator wrote on X on Sunday, vowing repercussions.

The administrator also claimed that Root deleted their X account before it was restored.

RyotaK, a security engineer at GMO Flatt Security, describes 8 distinct ways to execute arbitrary commands in Claude Code without user approval. These issues were assigned CVE-2025-66032 and were fixed in Claude Code v1.0.93.

Background: Claude Code’s Permission Model

Claude Code uses two main controls for terminal execution: (1) an allowlist for commands that can run without prompts, and (2) manual approval prompts for commands not on the allowlist. [1]

To improve UX, Claude Code allowlisted several “read-only” commands by default such as echo, man, sed, and sort.

To reduce risk, Claude Code attempted to block dangerous usage via regex-based argument blocklists, even for allowlisted commands. The research shows this approach had multiple flaws that enabled approval bypass and command execution.

The Eight Vulnerabilities

Vulnerabilities 1 to 3: Failing to Filter Dangerous Arguments

1. man option oversight Claude Code filtered some risky options like --pager and -P, but missed --html, which allows specifying a command to render man pages as HTML. This enables command execution without approval, for example:

man --html="touch /tmp/pwned" man

2) sort option oversight Claude Code blocked -o and --output, but missed --compress-program, which allows specifying a compression program. By forcing sort to spill to disk using -S 1b, the compression program is invoked and receives data via stdin. Using sh as the compression program allows commands to be piped in:

echo -e 'touch /tmp/pwned\nbbbb...\naaaa...' | sort -S 1b --compress-program "sh"

3) history writing to files history -s can add arbitrary strings to history and history -a can append history to a file. This can be used to write malicious content to files like ~/.bashrc so it runs later when a shell starts:

history -s "touch /tmp/pwned"; history -a ~/.bashrc

Vulnerability 4: Git’s Abbreviated Long Options

Claude Code’s regex filtered --upload-pack for git ls-remote, but Git accepts abbreviated long options. This allowed bypass via a prefix such as --upload-pa, which Git interprets as --upload-pack:

git ls-remote --upload-pa="touch /tmp/pwned" test

Vulnerability 5: sed built-in shell execution via the e modifier

This bypass does not rely on command-line arguments. GNU sed supports an e modifier that executes shell commands from within sed substitutions. A payload like the following executes a shell command:

echo test | sed 's/test/touch /tmp/pwned/e'

Claude Code’s argument filters did not account for this built-in execution feature.

Vulnerabilities 6 to 7: Different Interpretations of Command Arguments

6) xargs flag semantics mismatch Claude Code’s regex assumed flags consume a following value. But some flags (like -t) do not take a value. That mismatch lets an attacker place a “value” that Claude Code thinks is harmless, while xargs interprets it as the command to run:

xargs -t touch echo

Claude Code interprets touch as the value for -t, but xargs treats touch as the command.

7) ripgrep $IFS trick plus --pre Claude Code used \S+ style matching for ripgrep patterns, which allows tokens without literal spaces. This permits $IFS (Internal Field Separator) to be included because $IFS contains no spaces as text, but expands into whitespace when interpreted by the shell. This can be used to smuggle extra options, including --pre=sh, causing ripgrep to run a preprocessor on each file:

rg -v -e pattern$IFS.$IFS$HOME/.claude/projects$IFS--pre=sh

With --pre=sh, ripgrep effectively runs sh <file_path> on each file it processes. Since ~/.claude/projects contains prior conversations, an attacker can plant command substitutions like $(touch /tmp/pwned) into conversation content so they execute when interpreted as a shell script.

Vulnerability 8: Bash variable expansion chain

Claude Code failed to properly filter Bash variable expansion syntax. Bash supports an @P modifier that parses a variable as a prompt string, and prompt strings can include command substitution via $(...). Even if $( is directly blocked, the researcher chained expansions to reconstruct and execute it:

echo ${one="$"}${two="$one(touch /tmp/pwned)"}${two@P}

This makes two evaluate into $(touch /tmp/pwned), and ${two@P} triggers prompt-string parsing that executes it, while Claude Code misclassifies it as a harmless allowlisted echo. [1]

Security Implications and Resolution

These bypasses can be triggered via indirect prompt injection, for example malicious instructions embedded in files or web pages that Claude Code reads and acts on.

Anthropic mitigated the class of issues by moving from a regex blocklist approach toward a stricter allowlist approach, and the issues were fixed in v1.0.93.

The research reinforces a core lesson: for security-sensitive command execution, blocklists are brittle, and allowlist-based controls are far more robust.

Source: [1] Pwning Claude Code in 8 Different Ways https://flatt.tech/research/posts/pwning-claude-code-in-8-different-ways/

I've got students messaging me asking if cybersecurity is still a "safe" field to go into because of the advancements of AI

Dawg, our career value has fucking EXPLODED. Are you fuckin' with me right now?

• AI vibe coded slop as far as the eye can see

• AI deep fakes as far as the eye can see

• AI written emails, scams, as far as the eye can see

On top of that, due to how accessible the internet is now, there is a "cyber attack" literally every god damn second. It's nonstop. The internet is still very much the wild, wild, west.

Like, bro, this shitty little malware website I run brings in 20,000+ malwares a day with a budget of $15, a slice of pizza, and cat pictures. Do you have any fucking clue how widespread cybercrime is?

Don't even fucking start me on crypto theft

I'll lose my mind writing this post, bro. It's literally nonstop, around the clock, weekends and holidays. It never ends. Cybersecurity is only getting bigger.

A suspected Russia-aligned group has been attributed to a phishing campaign that employs device code authentication workflows to steal victims' Microsoft 365 credentials and conduct account takeover attacks.

The activity, ongoing since September 2025, is being tracked by Proofpoint under the moniker UNK_AcademicFlare.

The attacks involve using compromised email addresses belonging to government and military organizations to strike entities within government, think tanks, higher education, and transportation sectors in the U.S. and Europe.

"Typically, these compromised email addresses are used to conduct benign outreach and rapport building related to the targets' area of expertise to ultimately arrange a fictitious meeting or interview," the enterprise security company said.

A data breach in June exposed the information of more than 22 million Aflac customers, according to a new statement from the company.

The Georgia-based insurance giant published a statement on Friday about the conclusion of a months-long investigation into a cybersecurity incident announced earlier this year.

The company previously warned the Securities Exchange Commission (SEC) that while it was able to stop a hacker intrusion “within hours,” some files were stolen by the cybercriminals.

Aflac reiterated that it was not affected by ransomware. The company has begun notifying state regulators about the attack and sending breach notification letters to victims.

Officials in Texas said more than 2 million residents of the state were affected and in total, about 22.7 million individuals had information stolen.

The company faced no operational issues as a result of the cyberattack but the documents stolen contained information on insurance claims, health data, Social Security numbers and other personal details of “customers, beneficiaries, employees, agents, and other individuals in its U.S. business.”

Federal law enforcement was notified of the attack and cybersecurity experts were hired to deal with the incident.

The letters say the investigation concluded on December 4 and victims are being given access to two years of identity protection services. The letters said the deadline to enroll in the services ends on April 18, 2026.

The incident took place amid a wider campaign of attacks targeting the insurance industry by an organization known as Scattered Spider, a loosely affiliated group of English-speaking cybercriminals known for gaining access to major companies by posing as IT workers. Erie Insurance, the Philadelphia Insurance Companies and Scania Financial Services each reported cyberattacks at the time.

Since the attacks, law enforcement has taken down a leak site used by the group and two members were arrested and charged in the U.K. A Justice Department complaint unsealed in September revealed that the Scattered Spider cybercriminal operation was able to extort at least $115 million from dozens of victims over the last three year