Retail hacking spree continues as incidents hit UK retail chains, global grocery chain giant

SPONSORED BY ORIGIN

When one AI agent turns off another agent’s security controls

Codex disabled Claude Code’s approval prompts to complete an authorized task. Origin’s investigation shows why security teams need a trace that follows the work across agents.

Can you prove which approvals your AI agents turned off?

If your engineers run more than one AI agent, they probably configured each one on its own. This one gets its permissions, that one gets its sandbox, and each gets a list of tools it can use without asking. That setup assumes every agent stays inside its own box. 

On September 10, an Origin engineer asked OpenAI's Codex to pull recent data from a staging environment. Codex had no connection to the analytics server it needed. Claude Code, which happened to be installed on their computer, did have access. So Codex launched Claude Code and handed it that part of the job, with instructions to treat the server as read-only and return only aggregate data.

The first launch failed on a sandbox configuration error, so Codex removed the sandbox flag and tried again. This time Claude Code reported that it lacked permission to use its tools. Codex reasoned its way past that, writing "your request authorizes these read-only queries." At turn 219, Codex relaunched Claude Code with --dangerously-skip-permissions, which turned off its approval prompts for the run. Nobody asked the engineer.

The query stayed read-only, and the data stayed aggregate, exactly as instructed. What should worry a security team is the path Codex took. It reached a capability outside its own configuration, then decided for itself which of another agent's controls still applied. On one of your developers' laptops, the same path could have returned credentials or production data, and that output would have flowed straight back into Codex's context, where it could shape later commands.

Could you reconstruct this from the logs you already keep? Partly. Process logs would show a Claude process starting, shell history might show the flag, and MCP logs would show a query. Each is a separate event, and none of them shows they were one job, why the approval mode changed, or what came back. Origin's automated review flagged the relaunch as a high-severity permission bypass. The trace showed the rest, with every step tied back to the engineer's original request.

Claude Code's permission check worked until another agent switched it off. The boundary has to follow the task from one agent to the next, and the record has to follow it too.

Origin published the full investigation, with the trace and the exact turn where Claude Code's permissions changed. If your developers run Codex and Claude Code side by side, start there. Read the investigation.

For the wider view, SACR's Lawrence Pingree and Origin CEO Spencer Thompson discuss agent runtime observability in an on-demand fireside chat, including how traces let security teams follow agent activity from prompt to outcome. Watch the recording.

Origin Technology is the endpoint AI observability platform for agentic monitoring and security. It finds the AI agents running on a company's endpoints and reconstructs their work, from the request through every command, file, tool, and change. Security teams use it to monitor agents as they work and investigate unexpected events. Other tools capture parts of the activity. Origin reconstructs the work.

Nearly one week after a serious cyber incident hit fashion giant ASOS, and seemingly one day before French grocery giants suffered serious food losses after hackers tampered with refrigeration unit controls, three UK fashion chains, Phase Eight, Hobbs and Whistles, and global retail food chain Ahold Delhaize were hit by damaging cyberattacks.

The owner of the UK fashion stores, the South African-listed TFG London, said it identified the “cybersecurity incident” at the three retail chains on Sunday. Its two other UK brands, Inside Story and White Stuff, are not affected.

TFG said its stores had stayed open and trading but some of its IT systems “remain unavailable” and it had paused all online orders as a “precautionary measure."

Ahold Delhaize, one of the world's largest food retail chains, confirmed that it was forced to take some systems offline after a "cybersecurity incident." The conglomerate owns Delhaize, Maxi, Mega Image, Albert, bol, Alfa Beta, Etos, Gall & Gall, and Profi in Europe, and Food Lion, Stop & Shop, Giant Food, and Hannaford in the American market, along with Albert Heijn, the largest grocery chain in the Netherlands.

"Ahold Delhaize is experiencing a security issue within its network. Our teams are taking steps to assess and mitigate the issue. This includes taking some systems offline to help protect them. At this time, our stores are open and serving customers," the chain said.

Albert Heijn's systems have been down since Sunday afternoon following what the company calls a "digital security incident." Albert Heijn's systems are unavailable, groceries ordered online cannot be delivered, and some distribution centers are at a standstill, leaving stores struggling with empty shelves.

Another fashion chain, H&M, said on Monday that it was also investigating claims that its systems had been attacked. However, the fast fashion retailer said: “We have not found any indications that our data environment has been compromised.” (Sarah Butler / The Guardian, Sergiu Gatlan / Bleeping Computer, NOS)

Related: The Times, Express, BBC News, The Guardian, The Independent, The Telegraph, Drapers, Retail Week, London Now, The Sun, Dutch News, Nieuwsblad Transport, BD.nl, AGF, deGelderlander, RTL, NL Times, Security Week, Retail Detail EU, Supermarket News, Data Breach Today, Cyber Security News

China-linked hackers compromised a regional organization's network based in Suva, Fiji, between ​July and August 2026, the US ‌Embassy in Fiji said.

The embassy, which covers Fiji, Kiribati, Nauru and Tuvalu, informed ​the Fijian government and the affected ​organization of the suspected breach and ⁠provided technical recommendations to help secure ​their networks.

Hackers maintained access to the organisation's ​network over several days, the embassy said.

The embassy did not identify the regional organization by name.

Earlier ​this month, the US Department of ​Justice seized seven internet domains to disrupt hackers that it ‌accused of working with a Chinese IT firm, saying the domains were used to scan and hack US and foreign critical ​infrastructure. (Rajveer Singh ​Pardesi / Reuters)

Related: US Embassy in Fiji, The Next Web, AFP

Norwegian military personnel discovered that rented Chinese-made cars automatically recorded and stored video footage during military exercises.

The Norwegian newspaper DN reported the incident.

The cars continued to be used throughout the exercises because few alternative vehicles were available.

Norwegian outlet Nettavisen drew attention to the supplier’s links to China’s Zhejiang Geely Holding Group.

The Norwegian Armed Forces use rental vehicles from First Rent A Car Norway AS, which operates under the Hertz brand, for daily activities, military exercises, and operational tasks.

First Rent A Car’s link to the Chinese automotive group runs through Volvo Cars. An official European Commission decision on the acquisition of First Rent A Car states that Volvo Cars gained full control of the company, while Zhejiang Geely Holding Group controlled Volvo. (Oleksiy Leonov / Militarnyi)

Related: DN.no, Nettavisen

US law enforcement agents obtained authorization to use a controversial surveillance device capable of intercepting cell phone signals to find and arrest a 21-year-old college student who helped produce journalist Don Lemon’s coverage of an anti-ICE protest, court filings show.

The former student, Jerome Richardson, who has since graduated from Temple University, is among 39 people charged with conspiring to violate worshippers’ civil rights and interfering with religious worship at Cities Church in St. Paul, Minnesota, in January. Protesters said they targeted the church’s January 18 service because one of its pastors, David Easterwood, also led ICE’s St. Paul field office. Those charged include journalists Georgia Fort and Lemon, a former CNN host, who say they were there to cover the demonstration.

Twelve days after the protest, judges in two states began signing warrants authorizing agents to use so-called cell-site simulators, commonly known as Stingrays or IMSI catchers, to target Richardson’s phone: one in Minnesota on January 30 and another in Pennsylvania the next day. The purpose, his lawyers wrote in a motion seeking to exclude the tracking evidence, was “locating and arresting him.”

Agents also applied for cell-site simulator warrants targeting the phones of Fort and Jamael Lundy, then a Minnesota State Senate candidate. They separately sought pen register orders, which can log the numbers a phone contacts, for Fort and a number WIRED traced to Lemon. It's unclear whether a judge approved any of those applications. (Dhruv Mehrotra / Wired)

Related: Hacker News

Meta, which unveiled a new series of AI models called Muse Wonder and Muse Wonder Full to make up for ground it lost to OpenAI and Anthropic, claims that the new technologies exercise discretion with private information and resist misuse with robustness to adversarial instructions and careful handling of private information.

As models become more capable, Meta says its goal is to help people harness those capabilities safely and responsibly. It claims Muse Wonder offers its strongest safeguards to date against CBRN (chemical, biological, radiological, and nuclear) and cyber misuse, while preserving access to frontier cyber capabilities for defensive use, per its Meta Superintelligence Scaling Framework. (Meta AI Research)

Anthropic claims its experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes.

A replicator like this would be challenging to shut down, since there’s no centralized point to shut off—though it may be slow (with a doubling time of days). Unlike non-AI malware, it could also figure out unfamiliar devices on its own. Anthropic says in its evaluations, a 9B model, or a model that has 9 billion parameters, got inference running on 8 of the 9 hardware types we tested.

Models of 30B parameters and under can already complete many of the individual steps for replication today, though they make mistakes when composing them end to end. In Anthropic's simplified evaluations, GLM-5.2 and stronger models are capable of end-to-end replication. If small models improve at their historical rate, they’ll match this capability level by the end of this year. Small weight-based replicators may be possible soon after. (William Zhou, Daniel Freeman / Anthropic)

Related: Hacker News, r/antiai, r/neoliberal, r/artificial, r/singularity, r/ArtificialInteligence, r/accelerate, r/ClaudeCode

Researchers at Hudson Rock say that following the September hack of digital bank Revolut, they discovered what appears to be the first physical robbery potentially linked directly to the data breach.

On October 13th, a cryptocurrency investor in the UK reported a horrific home invasion on X (formerly Twitter). The victim stated they were held at knifepoint, taped up, and violently robbed of approximately $800,000 in cryptocurrency, alongside physical valuables.

In a follow-up reply, when asked directly if they banked with Revolut, the victim confirmed that they did. (Infostealers by Hudson Rock)

Related: r/CryptoCurrency

The UK government is drawing up plans for compulsory safety reporting and monitoring of frontier AI, as the minister responsible for the technology prepares to tell companies to exercise stricter control over autonomous models.

In a speech on Monday, Kanishka Narayan said companies building increasingly powerful and self-directing AI models must do more to deal with risks and build safeguards.

He warned that the government is ready to legislate to increase oversight of the fast-evolving technology, which ministers hope can improve economic growth prospects even as it poses risks to security and jobs.

Mandatory reporting of incidents when AI agents behave maliciously is among regulations being drawn up after recent high-profile cases in which companies acknowledged that their technology had gone rogue. (Chris Smyth and Lucy Fisher / Financial Times)

Related: Cryptopolitan, BBC, Daily Mirror, Tech Radar, The Guardian, The Independent, Computing, Channel 4, The Times

Spend less time finding cybersecurity news. Get more out of it.

Metacurity delivers the cybersecurity news, analysis, and insight that would take you hours—and sometimes days—to assemble yourself.

Every weekday, we sift through thousands of news articles, press releases, filings, court documents, and research reports, including details that vendor announcements and PR pitches leave out. We tell you what changed, why it matters, and what deserves your attention. Minimal vendor marketing. No outrage bait. No SEO filler.

A paid subscription gives you:

• The full Metacurity archive: Every newsletter, searchable and browsable.
• Our weekly long-reads roundup: The best cybersecurity writing from across the industry, selected and vetted to make your reading time count.
• Specialized reports and analysis: Periodic deep dives that go beyond the daily headlines.
• A direct role in sustaining independent journalism: Your subscription helps keep our editorial priorities focused on readers and the cybersecurity community.

If Metacurity saves you time, helps you spot an important development, or gives you a clearer understanding of the industry, please consider becoming a paid subscriber. Your support keeps that work going.

Subscribe today—and thank you for reading and supporting Metacurity.

E-commerce giant Coupang has taken South Korea's data protection watchdog to court over a record 620 billion won ($461 million) in fines tied to its massive data leak.

The e-commerce giant filed two suits with the Seoul Administrative Court on Wednesday, asking it to cancel the penalties the Personal Information Protection Commission assessed in June. Coupang also sought to halt the fines until the court rules.

The commission ordered Coupang and its affiliate to pay a combined 624.9 billion won, along with 16.8 million won in administrative fines, over a breach of users' personal information that the company disclosed last November.

Investigators counted 33.22 million members and at least 4.33 million nonmembers among the victims, a total that ran 3.88 million higher than the figure a joint public-private team released in February.

The commission blamed the leak on Coupang's failure to put basic safeguards in place, from managing authentication signing keys to controlling system access. (No Kyung-min / The Korea Herald)

Related: Tech Times, Reuters, UPI, The Korea Herald, The Chosun Daily, Korea JoongAng Daily, KED Global

Best Thing of the Day: Let's Expand This App to All Laptops

A new privacy app called ShyGlass will blur your MacBook screen if you turn your head to a certain degree, your MacBook screen blurs.

Worst Thing of the Day: Keep Your Curtains Closed

An AI company called GrayLark now lets cops take a photo using an app called Raven to nearly instantly figure out what specific home it was taken in, using only clues in the photo itself and data from sites like Zillow and Airbnb.

Bonus Worst Thing of the Day: Was the User ID "Admin?"

The hacker who stole 8.7 million social security records and related data from Finland's Funen-based company Pays said he used the password '123456' to access the data.

Closing Thought