This week: South Korean police tie AI tools to the theft of 8.2 million records, and a poisoned Claude Code extension reaches Cursor users. Also: an agent-swarm breach at Warp, malicious Hugging Face models, North Korean AI tradecraft, Terra safety results and a deepfake sentencing.
South Korean police have referred the 32-year-old alleged leader of a hacking ring to prosecutors, saying the group stole 8.2 million personal records and internal files from about 90 organizations since September 2025. Victims included academies, hospitals, golf courses, universities and corporate affiliates. Seoul Metropolitan Police said the man, a self-taught former penetration tester, began using generative AI in late August to hack a wider range of targets, and that AI was used against 60 of them. The group demanded a combined 360 million won from 38 organizations. Six associates are under investigation without detention. Police called it Korea’s first arrest in a large-scale hacking case involving generative AI.
Cursor said a maliciously modified version of Anthropic’s Claude Code extension was available in its extension marketplace for about 11 hours on October 29, affecting at most 5,000 users. Anthropic did not develop the malicious version. Its code collected host and user details, added an attacker-controlled SSH key and tried to open a persistent reverse SSH tunnel, a hidden remote-access channel. Cursor said coding errors would stop it enabling SSH on most macOS and Windows machines, but the key, persistence scripts and host reporting could still be installed. Cursor removed the version, temporarily shut down the marketplace, rotated its keys and had the attacker’s server taken offline.
Warp, a development environment where users direct AI coding agents, said an attack that appears to have come from an agent swarm accessed a limited amount of agent trace and telemetry data. CEO Zach Lloyd said the company became aware on October 23 of an active and narrow exploitation of a vendor in its infrastructure, and detected the operation within hours. He described a sophisticated penetration and escalation technique that likely started with a hole in a vendor dependency. Warp has notified users it identified as affected and puts the upper bound at roughly 1 percent of its users. CrowdStrike is assisting, and law enforcement has been engaged.
Pluto Security tracked a cryptomining and backdoor campaign spread through 31 Hugging Face model repositories across seven accounts, posing as small Qwen2 test models. The code abuses trust_remote_code, a setting that lets a repository run its own Python when a model loads, and targets GPU servers running self-hosted inference tools such as Xinference and GPUStack. Payloads install a disguised cryptocurrency miner, and later versions open reverse shells. After a first wave was removed, a second wave of 19 repositories appeared within days and was still live eight days after Pluto reported it. Pluto counted more than 32,000 downloads, which are not confirmed infections. The flagship payload passed Hugging Face’s scans.
Microsoft Threat Intelligence assessed AI adoption across North Korean threat actors as high, with Jade Sleet, Coral Sleet and Jasper Sleet using it across all their workflows. The groups use it to write tailored phishing and recruiter lures, build fake personas and resumes, prepare interview answers, and alter profile images, video and voice. Microsoft found more than 100 PDF lures from Onyx Sleet created in August and September, dozens at a time within minutes, and possible AI-generated voice and video from Emerald Sleet. Since late October, Onyx Sleet and Pearl Sleet have used ARTEX, an open-source agentic penetration testing framework. Microsoft says the operations remain human-directed, not fully autonomous.
OpenAI’s system card addendum for GPT-6.1 Terra reports that across 48,690 simulated internal Codex tasks, the model drew 22 flags for severe misalignment, defined as behavior a reasonable user would likely not anticipate and would strongly object to. That is about 42 percent fewer than GPT-6 Sol. Compared with GPT-6.1 Sol and GPT-6 Astra, Terra showed higher rates of flags for exfiltration, circumventing restrictions, destructive action and inbound prompt injection. In a test with other agents’ messages, Terra performed a specified unauthorized action in 13.75 percent of samples, versus 1.25 percent for GPT-6.1 Sol. OpenAI calls the simulation a signal of internal risk, not a direct measure of external safety.
A South Australian judge has sentenced William Yeates, the first person charged under Australia’s 2024 federal deepfake pornography laws, to two years and three months in prison, then released him on a recognizance order requiring good behavior. Yeates, 20, admitted creating sexually explicit deepfake images of a teenage girl and sharing them online, including on X, in 2024 and 2025. District Court Judge Anne Barnett said the AI-generated images harmed the victim by identifying her in the sexual material. The victim first saw her Year 12 graduation photo on a pornography website.
