Risky Bulletin: Anthropic models also did the hacky-hacky

0:30In today's top story, Anthropic says its clawed AI models also escaped test environments and hacked three organisations. In two cases, clawed exploited vulnerabilities in internet-facing systems, and in the third, one of the company's models published a malicious library on PyPI. The victim of the third incident was a cyber security firm. Anthropic says it reviewed clawed activity after OpenAI admitted its models hacked Hugging Face earlier this month. In other news, a hacker has stolen$70 million in Bitcoin from cold card hardware wallets. The attacker exploited a vulnerability in the private keys generated by the wallet's firmware.

1:12The wallet's maker, CoinKite, has patched the bug and urged cold card owners to update and generate new wallet seeds. Hackers have stolen$6.2 million worth of crypto from South Korean blockchain gaming platform WeMix. The attackers allegedly compromised a smart contract that allowed them to mint and exfiltrate new tokens. The company lost the exact same amount in a separate hack in March 2025. South Korea's consumer agency has ordered online retailer Kupang to compensate users affected by a data breach last year. More than 37 million South Koreans had their data stolen in the breach. Affected users will each receive$70 in cash or store credit.

1:58The Democratic National Committee was scammed out of$29 ,000 last February. The fraud posed as Ken Martin, who'd been elected DNC chairman, three days earlier. The party caught the error within minutes but only managed to recover$7 ,000. U.S. Cyber Command will open a Silicon Valley office to build relationships with the local tech sector and take advantage of its innovations. According to The Record, the branch's main goal will be to accelerate the command's cyberweapons and online operations. It will have its own director, but Cybercom has not named anyone yet. The US government is investigating Iranian hacks of public water utility systems.

2:43Seven states were hit with the hacks last week, and CISA says water authorities have had to issue boil water notices and revert to manual operations. Initial breaches were reported across 30 Minnesota communities last week. Michigan officials said they were also targeted, but systems remained operational. An attack was also reported in Rapid City, South Dakota. Meanwhile, the Water ISAC group has denied leaking a report to the media about Iran hacking Minnesota water treatment facilities. The group acknowledged the report is authentic, but denied sharing it with Wired, as the news site's article suggested.

3:21The report confirmed for the first time that the hacks were the work of Iranian hackers. It contradicted a public statement from President Donald Trump, who played down the role of Iranian hackers and blamed state authorities. Russian state-backed hackers are behind recent hacks targeting hotel Wi-Fi networks globally. Microsoft linked the so-called captive crunch attacks to Storm 2945, a cyber unit connected to Russia's foreign intelligence service. The campaign began in May. The hackers modified Wi-Fi gateway captive portals to redirect users to device code and OAuth phishing sites, as well as to drop malware on them.

4:03Microsoft says the hacks weren't limited to hotels and targeted any organisations with a Wi-Fi captive portal system. AI was used for the operation, but Microsoft didn't provide further details. Malaysian authorities have arrested a 23-year-old over SMS blasting. The suspect was detained in Johor Bahru, a city that borders Singapore. Malaysian telcos have been required to block SMS messages that contain links since 2023. Officials suspected an SMS blaster operation after residents reported receiving messages with links. The Inc. ransomware group is breaking into corporate networks using two recent SonicWall Zero days.

4:45Both bugs were initially exploited by an espionage group in June. They allow attackers to bypass authentication and elevate privileges on compromised devices. SonicWall patched both vulnerabilities on July 14. At least eight threat actors are now using the DarkSword iOS hacking framework in the wild. DarkSword is one of two iOS hacking kits discovered this year. It leaked online in March and has been adopted by Chinese e-crime groups. According to security firm Census, most of the Darksword servers are hosted in Hong Kong. More than 120 ,000 Android TV boxes are part of a new advertising fraud botnet called Fuyau.

5:30The boxes ship with pre-installed apps that use common smartphone user agent strings when they load ads behind users' backs. Security company BitSight estimates the botnet is making around$150 ,000 a day. Apple has restricted the number of reports that security researchers can file in its bug bounty program. The company is allegedly struggling to keep up following a deluge of AI-assisted bug reports. Researchers who hit their cap will have to wait 30 days before they can file new bugs. Vetted researchers can request a higher limit. The Ruffalo AI agent harness has patched a bug that allowed attackers to gain root access on the underlying AI servers.

6:15The bug is in Ruffalo's MCP bridge, which ships without authentication. Any attacker can query it to run commands on Ruffalo's container. The bug has a severity rating of 10 out of 10, a patch shipped last month. A newly disclosed vulnerability in the Ruby on Rails framework can allow attackers to steal a web app's secrets and credentials. The bug impacts apps that use active storage, a component for interfacing with databases and cloud services. Codenamed Kinder Rails 2 Shell, the vulnerability doesn't require authentication and can be exploited against default configurations. The Rails project released a patch last week.

6:57Google has paused a new AI feature that allowed Google Earth users to generate fake satellite images. The company removed the feature after people generated fake images of missile strikes and spread disinformation. Who could have seen that coming? Iran's military has carried out a missile attack on an AWS data centre in Bahrain. In March, Iran hit three AWS data centres in Bahrain and the UAE. Iranian officials said they targeted the company due to its role in supporting the US military in the region. In March, Iran threatened to target US tech giants in the region if the war continued. And finally, the GitHub security team will now scan all packages published on the NPM portal for malware.

7:44Packages with dual-use code that perform actions that could be interpreted as malicious will also have to declare their intentions through a new metadata field. GitHub is also removing features from NPM granular access tokens, also known as GATs. If the tokens are configured to bypass 2FA, they can't perform any sensitive actions against an account and its repositories. And that is all for this podcast edition. Today's show was brought to you by Permiso Security. Find them at permiso.io. Thanks for your company.