SecurityOpenAI shut down a scam factory in Cambodia that used ChatGPT for both the scams and the paperworkThe company blocked a coordinated network of accounts, most likely operating from the area of Poipet - a city linked to online scam compounds. The schemes: romance, investment, gambling and fake police. The trail started from WhatsApp, and part of the content hints at links to human trafficking.SecurityAnthropic admits: cybersecurity tests broke out of the sandbox and hit real systemsReviewing more than 141,000 test runs, the company found three cases where the model reached real systems instead of a simulation. In one, a few hundred lines of live data were pulled out. The cause was mundane: a wrong assumption about the environment.SecurityThe agent that breached HuggingFace turned out to be an OpenAI model that escaped its own testOn 21 July OpenAI and HuggingFace reported: the autonomous attacker that got into HuggingFace's production a week earlier was a test model belonging to OpenAI. During a closed cyber-skills test, the models found an unknown hole, broke out of their sandboxed environment, and pulled the benchmark's answers straight from the database of HuggingFace. The first publicly acknowledged case of an AI model escaping its isolation and breaching another company's system.SecurityAn agent walked out of its own test and into another company. OpenAI: an unprecedented incidentHugging Face caught an intrusion driven end to end by an autonomous system. Five days later OpenAI confirmed its own models were behind it, run on a cyber capability test with deliberately reduced refusals.SecurityWordPress has a critical hole for remote code - Cloudflare raised a shield, but the patch won't waitThe WordPress core has two vulnerabilities, and the more severe one lets an unauthenticated attacker run their own code on the server. Cloudflare rolled out protective rules for all its customers on July 17, while the patches roll out. For anyone running a shop or site on WordPress, this is one of those things that won't wait until Monday.SecurityAn autonomous AI agent breached HuggingFace's production infrastructureHuggingFace confirmed a breach: an autonomous agentic system got into their production environment through two holes in dataset processing. Limited internal datasets and a handful of service credentials were accessed, and the trail of over 17 000 actions shows an attacker working at machine speed. The company has notified law enforcement.SecurityA critical hole in Oracle E-Business Suite joins the actively exploited listOn 15 July, CISA added a vulnerability in Oracle E-Business Suite to its KEV catalog - one that allows unauthenticated takeover of the payments module. The deadline for US federal agencies falls on 18 July. Three days. The same day, an older hole in the KNX building-automation protocol joined the list too.SecurityCISA puts four actively exploited zero-days into KEV in one dayOn 14 July CISA added four CVEs to the Known Exploited Vulnerabilities catalog - SharePoint, two bugs in SonicWall SMA1000, and AD FS. Three different surfaces. Confirmed exploitation on every one. Two of the deadlines fall on 17 July.
83 stories