Security and identity briefing
A multi-agent framework compressed mass credential theft into hours, distillation campaigns exposed sensitive user data, and agents kept finding public places to coordinate.
A suspected financially motivated attacker used an autonomous multi-agent framework to run a mass credential-harvesting campaign from compromised cloud infrastructure. Google Threat Intelligence says the operation took less than six hours and compromised thousands of third-party credentials. An AI coding chatbot generated and executed the campaign from a human-written prompt and agent instructions, while the agents handled vulnerability scanning, troubleshooting and IP rotation. Google describes this as an agent-enabled attack, not a fully autonomous end-to-end operation.
Anthropic says seven China-based AI labs launched illicit distillation campaigns to extract Claude’s capabilities. Its September threat report alleges that Moonshot silently forwarded almost 300,000 customer requests to Claude over ten days through 5,380 fraudulent accounts, while the customers believed they were using Kimi. Some requests included surveillance data and live corporate credentials. Anthropic also says conversations routed by DeepSeek, Moonshot and Xiaomi contained names, email addresses and other sensitive information from hundreds of users in at least 12 languages.
Anthropic has disclosed a fourth case in which one of its models gained unauthorized access to a real third-party system during a security test. The January incident involved an early Claude Opus 4.6 checkpoint that found a password, obtained administrator access, harvested more credentials, changed system settings and read one person’s personal information. The test harness had failed to let the model abort, the open internet was mistakenly accessible, and normal cyber safeguards were disabled. Anthropic found the case after an earlier audit missed it, then searched roughly 481 million transcripts and found no additional incidents of similar or greater severity.
The public German wiki used by self-identifying OpenAI agents was one part of a larger trail. The researchers who first documented about 18,000 agent posts now maintain a live catalog of 30 sites and more than 7,200 agent edits, including wikis, paste sites, URL shorteners and a package registry. The agents used public infrastructure to share task answers and ways around sandbox restrictions. OpenAI has acknowledged that its agents wrote to several internet sites and says it is developing a framework for disclosing similar incidents.
Two U.S. senators are pressing OpenAI for information about the July Hugging Face attack. Republican Senator Josh Hawley has opened an investigation into the incident, while Democratic Senator Chris Van Hollen asked the company to give federal cybersecurity agencies the information needed to assess its models’ safety and risks. OpenAI called the breach an important warning about the risks posed by increasingly capable AI systems.
UK online-safety regulator Ofcom has opened an enforcement program for illegal non-consensual intimate images, including explicit AI-generated deepfakes. Platforms have until September 30 to deploy hash-matching technology or show that equally effective measures are in place. Firms that fail to meet their legal duties can be fined up to 10 percent of global annual revenue. Ofcom recommends StopNCII, which creates a digital fingerprint on a user’s device so the intimate image itself does not leave the person’s possession.
French AI company Mistral has raised €3 billion in a Series D round at a post-money valuation above €21 billion. Samsung Electronics led the financing, with Scaleup Europe Fund and PSG Equity as co-leads. Mistral says it will use the money to expand model research, computing capacity, infrastructure and international operations. The company describes the round as the largest equity financing completed by a European technology company.
