Anthropic becomes the second frontier AI lab to disclose agent breaches

Don't miss my latest CSO feature about the coordinated cyber attack on 30 Minnesota water utilities and how it has alarmed industrial cybersecurity specialists because it is the first distributed campaign against dozens of small utilities linked by a common operational technology weakness.

Metacurity is your daily cybersecurity reality check.

Every weekday, thousands of cybersecurity professionals—including many of the industry's most respected security leaders—start their day with Metacurity because it cuts through the noise. Instead of vendor hype, social media outrage, and recycled headlines, you get the stories that matter, the context behind them, and an explanation of why they're important.

We spend hours reading, researching, and connecting the dots so you don't have to.

If Metacurity saves you time, helps you make better decisions, or gives you a clearer view of what's happening in cybersecurity, please consider becoming a paid subscriber.

Reader support is what keeps Metacurity independent. It allows us to focus on serving the cybersecurity community—not advertisers, vendors, or investors—and to continue delivering the thoughtful analysis you've come to rely on every weekday.

Anthropic's disclosure that three of its Claude models gained unauthorized access to the systems of real organizations during cybersecurity evaluations suggests that frontier AI developers are confronting a new reality: safely containing increasingly capable cyber agents has become as important as measuring what those agents can do.

The incidents, uncovered during a retrospective review of more than 141,000 cybersecurity evaluation transcripts, were not the result of previously unknown software vulnerabilities or sophisticated "AI escapes." Instead, they stemmed from an operational failure in which a third-party evaluation environment unexpectedly provided internet access, allowing Claude models to reach live systems and exploit common weaknesses such as weak passwords and unauthenticated services.

That distinction may prove more significant than the intrusions themselves.

Until recently, frontier AI cyber evaluations largely focused on determining whether models possessed offensive capabilities. Anthropic's findings, coming just days after OpenAI disclosed that one of its own AI agents compromised Hugging Face infrastructure during a separate evaluation, indicate that developers must now treat the evaluation environment itself as part of the security boundary.

In other words, the harness designed to measure an AI system's capabilities has become another attack surface.

Unlike OpenAI's incident, in which an AI agent chained together a zero-day vulnerability with stolen credentials, Anthropic said its models relied on commonplace attack techniques rather than novel exploits. That suggests today's most capable frontier models may not require sophisticated vulnerabilities to compromise poorly secured systems if operational safeguards fail.

The review also revealed behavioral nuances that extend beyond raw hacking capability. Anthropic said one model recognized it had reached a real organization but continued pursuing its assigned objective because it believed the activity remained within the scope of its evaluation. Another model, however, reportedly recognized it was interacting with a live system and terminated its activity voluntarily, highlighting that advanced models can exhibit different reasoning about operational context even when given similar objectives.

The disclosures also underscore how quickly AI developers are beginning to scrutinize one another's safety practices. Anthropic said its investigation was launched after OpenAI publicly described its own evaluation incident, suggesting that disclosures by one frontier laboratory are increasingly prompting industry-wide reviews rather than remaining isolated events.

Anthropic has suspended internet-connected cybersecurity evaluations while it and evaluation partner Irregular investigate the incidents and strengthen containment controls. The company has also engaged independent evaluator METR to review its findings. Those steps reflect a broader shift in AI safety thinking: for cyber-capable models, demonstrating offensive capability is no longer enough. Developers must also prove they can securely contain those capabilities while testing them.

As frontier AI systems become increasingly capable of carrying out complex, multi-step cyber operations, the security of evaluation infrastructure may become as consequential as the capabilities being measured, potentially establishing a new baseline for how advanced AI cyber testing is conducted across the industry. (Anthropic, Robert McMillan / Wall Street Journal, Louise Matsakis, Lily Hay Newman / Wired)

Related: Reuters, The Guardian, CTech, CNBC, The Register, RuntimeWire, Newser, Livemint, Hürriyet Daily News, Hacker News, r/technology, Wired, Silicon Republic, Reuters, Telegraph, Cyber Security News, Financial Times, The Information, CyberScoop, Associated Press, Washington Post, Sydney Morning Herald, Bloomberg, CNN, NBC News, TechCrunch, Politico, Bleeping Computer, Financial Times, New York Times, BBC News, Simon Willison's Blog

According to researcher Håkon Måløy, a Norwegian data scientist with a PhD in applied AI and ML, an attacker can hide malicious instructions in a Word document that, when included in Copilot for Word’s context, may alter document output and copy the instructions into newly created files that use the affected document as source material, without the victim noticing.

Måløy describes the issue in considerable detail while withholding the specific prompt payload, arguing that, because no robust mitigation exists, it would be irresponsible to disclose anything beyond the class of the vulnerability.

“To my knowledge, this is among the first public demonstrations of document-borne AI-worm self-propagation through normal workflows in a mainstream commercial productivity suite,” Måløy noted. 

Måløy said that he has been working with Microsoft since March 2026 on addressing the vulnerability, but after multiple updates to Copilot, this new class of Copilot worm is still viable. Microsoft mitigated the exploit demonstrated by his original proof-of-concept prompt, but Måløy said rewording the payload allowed him to successfully propagate the worm and alter financial data in a target document. Måløy and Microsoft twice delayed public disclosure of the issue, but, after 144 days, he said in his report that people needed to be made aware. 

“The coordination period agreed with Microsoft has been exhausted, and testing shows that no robust mitigation for the broader vulnerability class is currently available,” Måløy wrote. “Two mitigation attempts, including a model upgrade, did not close the class.”

Måløy explained the worm’s execution with an example involving an employee preparing a financial report for their company.

The employee downloads a market analysis from a trusted website to help with the preparation of a financial report in Copilot, unaware that the source had been compromised and the document they downloaded contains hidden malicious instructions. The hidden instructions (inserted as small white text in his proof of concept) tell Copilot to alter figures in the report the employee generates and to copy the worm into the report they create with Copilot.

If another employee later adds that report to their own work, the whole process begins again, and documents generated from it also contain the worm, and, as it spreads, it makes tracing the infection to its source extremely difficult.

“The attack can therefore continue without further involvement from either the compromised website or the original malicious document,” Måløy said. “The attacker does not need access to the victim’s Microsoft 365 tenant. The attacker only needs to share a malicious document with the victim.”

Copilot should use information in documents a user includes in its context for a project without treating instructions embedded in a document as additional prompts, Måløy said, but his research suggests it doesn't always do that. (Brandon Vigliarolo / Wired)

Related: Håkon Måløy, CSO Online, IT News, GBHackers, CyberInsider

A group of university researchers who developed benchmarks to test the cybersecurity capabilities of AI systems has unexpectedly landed themselves at the center of OpenAI’s accidental hack into Hugging Face.

OpenAI was evaluating a combination of advanced AI models against the ExploitGym benchmark developed by the University of California at Berkeley researchers when the systems broke out of their testing environment, known as a sandbox, and tried to “cheat” by hacking Hugging Face in search of test answers.

It wasn’t the first time an AI model has tried to “cheat” its way through ExploitGym, said Jingxuan He, one of the UC Berkeley researchers behind the benchmark, which is now widely used by AI developers including OpenAI, Anthropic PBC, Microsoft and the Chinese AI firm Z.AI to test model capabilities. In fact, he said in an interview with Bloomberg News, the researchers developed the benchmark assuming models would seek out shortcuts and designed a mechanism to detect when that happens.

This particular instance was at a much larger scale than we’d encountered,” He said. In the past, he said, “The AI would cheat, but they would only operate within the sandbox and the repositories provided. But this time, it was going into the infrastructure of a third party.”

He explained that many instances of CyberGym exist in the world so developers can test their systems against them. He said he didn’t know who set up this particular version of CyberGym on Modal’s platform. But whoever set it up clearly didn’t properly secure it because it was accessible to anyone on the internet, he said. (Lynn Doan and Mark Anderson / Bloomberg)

Related: SC Media, Foreign Policy, Gizmodo

The coordinated cyberattack that disrupted more than 30 Minnesota water and wastewater systems appears to mark an escalation in the threat to US critical infrastructure, as investigators increasingly link the campaign to the same Iran-affiliated activity that federal authorities have been warning about for months.

While US officials have not publicly attributed the attacks, The New York Times reported that federal investigators increasingly believe Iran was responsible, while Wired reported that a WaterISAC intelligence memo, citing the Minnesota Fusion Center, concluded the activity aligned with an Iranian campaign that the Cybersecurity and Infrastructure Security Agency (CISA) first identified in April.

If confirmed, the Minnesota incidents would represent a significant shift in Iranian cyber operations against US water infrastructure. Previous campaigns largely focused on opportunistic compromises of internet-connected programmable logic controllers (PLCs) at individual facilities. By contrast, the Minnesota attacks struck dozens of utilities across a single state over roughly 48 hours, suggesting a coordinated effort to disrupt multiple public water systems simultaneously rather than isolated intrusions.

The attacks also appear to validate warnings CISA issued Thursday as it expanded its guidance to water and wastewater operators. The agency said it is observing a "significant increase" in threat actors targeting internet-exposed PLCs and urged critical infrastructure owners to immediately remove publicly accessible operational technology from the internet, restrict remote access, and review defensive measures. CISA also warned that attackers have increasingly targeted PLCs from multiple manufacturers, expanding beyond the Rockwell Automation equipment highlighted in its April advisory.

Taken together, the Minnesota campaign and CISA's updated alert suggest federal concern has shifted from isolated compromises of exposed industrial devices to broader coordinated operations capable of disrupting essential public services. Although officials said the Minnesota attacks did not contaminate drinking water, they temporarily affected water operations in numerous communities and underscored the operational consequences of attacks on industrial control systems.

The incidents also illustrate the continuing vulnerability of the US water sector, which consists largely of small and mid-sized municipal utilities with widely varying cybersecurity resources. Both the emerging attribution to Iran and CISA's warning point to industrial control systems—and particularly internet-accessible PLCs—as an increasingly attractive target for state-linked actors seeking to create real-world operational disruption rather than steal information. (Andy Greenberg / Wired, Dustin Volz and Ernesto Londoño / New York Times, CISA)

Related:  CSO, ABC, Rockwell Automation, The Hill, CBS News, Associated Press, Help Net Security,r/minnesota, r/PLC, r/Economics, Washington Post, BBC News, Valley News Live, NBC News, NatLaw Review, Axios

Alphabet-owned Wiz said it had found a sweeping flaw that could have compromised Microsoft and thousands of its ​cloud customers.

Wiz said that a now-patched vulnerability ‌in a key Microsoft database service, Azure CosmosDB, would have allowed a hacker to compromise any of its users remotely.

Microsoft said the problem had been "fully addressed" in cooperation ​with Wiz and that they had found "no evidence of customer impact based ​on our investigations."

Outside ​researchers said the flaw ​discovered by Wiz ⁠was serious. (Raphael Satter / Reuters)

Related: Wiz, SC Media, Tech Times, Hackread, Digit, RuntimeWire

US-based non-profit organization CrimeStoppers has announced a $22,000 reward for information that helps identify, disrupt, or seize the infrastructure used by the INC Ransomware group.

The initiative aims to encourage individuals with credible information to come forward and assist authorities in tracking down members of the notorious ransomware gang. The reward is expected to support ongoing investigations while increasing pressure on cybercriminals responsible for a growing number of ransomware incidents.

The INC Ransomware group has gained notoriety for targeting organizations across multiple sectors, with healthcare providers and operators of critical infrastructure among its primary victims. These attacks have the potential to disrupt essential services, including hospitals, power utilities, and water management systems, leading to financial losses, operational downtime, and risks to public safety. By encrypting critical data and demanding large ransom payments, the group has become a persistent threat to organizations worldwide.

According to Crime Stoppers, the reward is available to any individual, business, or organization that can provide actionable intelligence leading to the identification or disruption of the group’s activities. This includes information about the physical location or identities of gang members, their associates, cryptocurrency wallets used to receive ransom payments, funding sources, communication channels, or details related to the servers and digital infrastructure supporting their operations. Information that contributes to the seizure of infrastructure or the arrest of individuals linked to the group may qualify for the announced reward. (Naveen Goud / Cybersecurity Insiders)

Related: CrimeStoppers

The Chrome security team says the browser's two major version releases in June included fixes for 1,072 security bugs—more patches than the team shipped in the prior 23 big releases combined.

Although many of these bugs come from researcher submissions, the spike has largely been driven by the Chrome security team’s rapidly evolving internal process for using AI tools in vulnerability discovery, triage, and patch development.

“In Chrome we’ve been using machine learning—using AI before it was called AI—to help find vulnerabilities in particular and automate security fuzz testing work since at least 2012. It’s been a huge part of how we find vulnerabilities and empower developers,” Parisa Tabriz, Chrome’s vice president and general manager, tells WIRED. “But I do think this year is very different. It really feels like an inflection point both for offense and defense.”

Chrome is already moving toward a new normal of pushing out a major release every two weeks with additional weekly security updates. But the frenzy of vulnerability discoveries has been so intense, and the team has had so much success incorporating new AI models and capabilities into the workflow of finding and fixing new bugs, that for now the group is piloting a cadence of releasing security fixes twice a week. (Lily Hay Newman / Wired)

Related: Google, TechCrunch, OSnews, 9to5Google, The Deep View, Ars Technica, TechTarget, Digital Trends, Android Authority, The Verge, PCMag, BleepingComputer

Pedro Falé, a threat researcher with the security firm Bitsight, advises consumers to look beyond price and streaming features when buying TV streaming sticks and Android TV boxes, warning that some low-cost or uncertified devices can expose home networks to malware, fraud and criminal abuse.

The warning follows a series of investigations linking compromised streaming devices to large botnets and residential proxy networks that covertly route third-party internet traffic through users' home connections.

The greatest risks are associated with no-name Android-based streaming devices that promise free or heavily discounted access to premium content. Researchers say many of these devices are shipped with preinstalled malware or are compromised during setup, allowing attackers to recruit them into botnets such as Popa and BADBOX. Those networks have been used to facilitate advertising fraud, credential theft, account takeovers and large-scale data scraping, often without the owner's knowledge.

Bitsight recommends purchasing streaming devices only from established manufacturers, ensuring Android devices are Google Play Protect certified, installing apps exclusively from official app stores, and avoiding products that advertise unlimited free movies, sports or television channels. Consumers should also keep streaming devices updated and remove unused apps. (Brian Krebs / Krebs on Security)

Related: Bitsight

Scammers are impersonating the IRS to drain crypto accounts and steal identities, using official-looking letters to bypass digital defenses, the agency’s criminal investigation unit warned.

Paper notices that include QR codes are leading recipients to a spoofed Internal Revenue Service website, the agency said in a Thursday press release. The scheme directs crypto holders to enroll in a non-existent Digital Asset Compliance Portal before a deadline, then prompts them to enter personal information.

“Criminals continue to exploit public trust in government agencies by creating convincing fake websites and official-looking correspondence,” IRS Criminal Investigation Chief Jarod Koopman said.

The infrastructure supporting the campaign was set up just days before the letters were sent out and used a domain listed through a Hong Kong registrar, the investigators said.

The look-alike website was hosted in Romania on a network “already known for hosting FedEx and banking phishing pages,” signaling that it is a “professional, international fraud operation,” according to a Coinbase Security blog post that details the scheme. (Sonya Dymova / Bloomberg)

Related: IRS.gov, Coinbase, Coinpedia

Residential security company Brinks Home disclosed that hackers breached some of its systems and are threatening to leak allegedly stolen data.

​The company identified the attack on July 20 and immediately activated its incident response procedure to contain the breach.

William Niles, CEO at Brinks Home, said that the company’s team was working with “leading forensics experts to address this issue.”

The intrusion did not in any way impact the company’s alarm monitoring and system functionality.

At the beginning of the week, the ShinyHunters extortion gang claimed the attack on Brinks Home, alleging that they stole more than 4.9 million Salesforce records with personally identifiable information (PII). (Ionut Ilascu / Bleeping Computer)

Related: Brinks Home, SC Media, PC Mag

Korea’s consumer dispute mediation committee recognized Coupang’s liability for damages over its massive personal data breach last year and ordered the US-listed firm to compensate affected users.

The committee under the state-run Korea Consumer Agency decided that the e-commerce giant must pay 100,000 won ($70) per person, in cash or as Coupang Cash, to 50 consumers who jointly applied for collective dispute mediation.

It is the first time a Korean dispute mediation body has formally acknowledged Coupang’s responsibility for damages arising from the large-scale leak of data involving 33.7 million customers.

In its decision, the committee pointed out that not only basic personal data such as names, email addresses and home addresses had been leaked, but also highly sensitive information including apartment entrance passwords and order histories, which are closely tied to users’ private lives.

The committee also took into account that personal data had been siphoned over a long period, from April to November, and that emails about the leak were sent by the hacker to some consumers, suggesting that the data was at genuine risk of being misused.

The committee also noted that Coupang has insisted there is no risk of further leaks, but said this cannot be accepted with certainty. It therefore concluded that the firm is liable to pay compensation for the mental distress suffered by consumers as a result of the breach.

The parties have 15 days from the date they receive the decision to inform the committee whether they accept the mediation proposal. If no separate objection is filed within that period, the proposal is deemed accepted, and once the mediation is finalized, it carries the same legal effect as a court-approved settlement. (Jung Min-ho / The Korea Times)

Related: The Chosun Daily, The Korea Herald, KoreaJoongAng Daily, Seoul Economic Daily

DC Public School officials have notified families after an unauthorized third party potentially accessed student information stored in a web-based application used for DCPS Summer Learning registration.

DCPS sent a letter to parents and families informing them of the potential cybersecurity incidents.

DCPS said it does not collect Social Security numbers or parental financial information as part of the system.

The statement says DCPS "immediately engaged the DC Office of the Chief Technology Officer to support a thorough investigation, removed student data from the affected application, and notified law enforcement." (Kris Mulholland / WUSA)

Related: NBC4, WTOP, DC News Now, WJLA

Australia’s social media ban for under-16s led to only a marginal reduction in underage users in its first three months, underscoring the lack of enforcement of the world-first law by major platforms.

A report by Australia’s online safety regulator showed the proportion of under-16s who reported using a social media platform in March was 81.5%. That compares with 85.9% before the law took effect in December.

Most underage users were able to keep their accounts or create new ones, eSafety said. This was mostly due to a lack of effective age checks on the platforms, it added.

The early findings are a blow to the Australian government, which pushed the ban through parliament despite concerns about the law’s design. The report is also an early gauge for politicians worldwide that are weighing similar restrictions on Big Tech. (Angus Whitley / Bloomberg)

Related: eSafety, Wired, Reuters

This year, Defcon asked legendary hardware hacker Andrew “bunnie” Huang to create the conference's iconic badges and they include an innovative open source chip that Huang designed and that aims to do no less than advance the state of security, transparency, and trustworthiness in computing.

But the chip isn't just part of the badge. Its core module can be removed and used after the conference as a hardware security token, giving the badge a second life beyond Defcon.

The chip—called the Baochip-1x—is a “mostly” open source microcontroller that has been three years in the making and fulfills Huang’s years-long dream of making a chip whose security is verifiable. Huang has published the source code for the Baochip’s operating system, firmware, processor core, cryptographic engines, and input-output system on GitHub, making these components available for inspection and use.

The chip is also packaged so that researchers can peer inside to check the silicon itself and compare what they see against the published design, rather than having to trust that the manufactured chip is what the designers intended. (Kim Zetter / Wired)

Related: Baochip on GitHub

Best Thing of the Day: Hacker Rehab for Young, Would-Be Miscreants

In the UK, Cyber Choices, also known as Cyber Prevent, is like a hacker rehab course for young, wayward would-be criminal hackers to set them on the right course.

Bonus Best Thing of the Day: More Proof That the Hugging Face Hack Wasn't a Marketing Stunt

The New Yorker's Stephen Witt says that Thomas Wolf, Hugging Face’s chief science officer, describes the OpenAI agent hack on his company's systems as if he were describing an encounter with a UFO.

Extra Bonus Best Thing of the Day: Flock Is Uniting the US

In a politically divided nation, opposition to Flock cameras is the rare issue that binds people across the ideological spectrum.

Worst Thing of the Day: AI Is Tearing Apart the US

A survey of 3,500 young people in the US conducted by dating app Hily found 64% of Gen Z and 56% of millennial daters said they wouldn’t date someone who relies on AI for everyday decisions.

Closing Thought