☕️ AI agent ran a cyberattack on its own

Hi there, this is your daily ☕️ Cyberpresso.

In today's Cyberpresso:

🤖 AI agent ran a cyberattack on its own

🛡️ Nvidia launches AI security alliance

🏭 Ransomware gang steals product designs

🦊 GitLab flaw enables remote code execution

🎥 North Korea hackers steal crypto via Zoom

Plus: 💡 5 strategies & tactics, 🎁 7 other news you might like, 🧰 6 tools, and 📚 5 papers.

🤖 AI agent ran a cyberattack on its own LINK

Researchers at Hunt.io discovered a live cyber-espionage operation against Thailand's Ministry of Finance in which an open-source autonomous AI agent called Hermes ran reconnaissance and privilege-escalation commands automatically, without waiting for the operator's approval.

Hermes ran in "YOLO" mode, letting dangerous commands execute on their own, and the logs show it running LinPEAS, checking for privilege escalation, enumerating files, and cataloguing PDF, DOC and XLS records from the Office of the Permanent Secretary for Finance, though no files were exfiltrated.

The operation, found because staging servers left directory listings exposed, also used a previously undocumented cross-platform Go implant called Hades for persistence and staged exploit code including PwnKit (CVE-2021-4034); researchers link it with low-to-medium confidence to a Chinese-speaking operator.

🛡️ Nvidia launches AI security alliance LINK

Nvidia has launched the Open Secure AI Alliance, an industry group aimed at keeping open-source AI models secure while Washington debates whether to restrict them, arguing openness should be paired with safeguards rather than blanket limits.

The alliance includes Palantir, IBM, Crowdstrike, SpaceX, and Hugging Face, with Nvidia pledging to contribute open models, data, and other resources to speed the development of new cybersecurity tools and techniques.

The launch comes as the White House weighs limits on Chinese open-source models, after Treasury Secretary Scott Bessent said the administration would scrutinize them for intellectual property theft and later accused Moonshot AI's Kimi K3 of stealing American tech.

🏭 Ransomware gang steals product designs LINK

Cl0p ransomware affiliates are breaking into exposed PTC Windchill and FlexPLM servers to steal engineering and product-design data from manufacturers, automotive, aerospace, and retail apparel firms, then demanding payment through double-extortion.

The attack chains a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a Windchill login weakness, exploiting CVE-2026-12569, a critical (CVSS 9.8) deserialization flaw in releases before 11.0 M030, to run code remotely without any account.

Ransom-ISAC confirmed active exploitation dating to early June, with CISA adding the flaw to its catalog on June 25; after breaking in, attackers deploy JSP webshells, stage data, and send mass extortion emails, so defenders should apply fixed builds and hunt for hex-named JSP files.

🦊 GitLab flaw enables remote code execution LINK

A newly disclosed exploit chain in GitLab lets any logged-in project member run code on default installations by abusing two memory-safety flaws in Oj, a native C-based JSON parser bundled inside otherwise memory-safe Ruby code.

The flaws are patched (GitLab CE/EE 18.10.8, 18.11.5, and 19.0.2; Oj gem 3.17.3), with a proof-of-concept demonstrated but no in-the-wild exploitation reported; GitLab.com was already fixed and self-managed operators on affected versions must upgrade.

An attacker with ordinary push and diff-view access pushes two crafted Jupyter Notebook (.ipynb) files in one commit; the parser mishandles them to hijack a callback pointer and defeat ASLR, running commands as the "git" user to expose source code, secrets, and internal services.

🎥 North Korea hackers steal crypto via Zoom LINK

North Korea's BlueNoroff hacking group is stealing cryptocurrency by luring victims into fake Zoom and Microsoft Teams calls, first scanning their browsers for crypto wallets to decide who is worth a full break-in, according to UK firm JUMPSEC.

The kit scans a target's browser the moment they land on the fake meeting page, checking for Ethereum connections via the EIP-6963 standard and browser extension IDs matching wallets like MetaMask, then pushes results to an operator dashboard with no prompt shown to the victim.

On Windows a copied ClickFix command runs a PowerShell loader that downloads a VBScript and adds a Microsoft Defender exclusion, while a silent macOS stealer grabs Chrome master keys from Keychain; Arctic Wolf found over 100 victims across 20+ countries, 41% in the US, with full compromise in under five minutes.

💡 Strategies & Tactics

> Certighost Active Directory CS Exploit Allows Low-Privileged Users to Compromise Domain: A Windows certificate flaw let ordinary users impersonate a domain controller and seize full network control, so patch AD CS immediately.

> Windows WalletService Flaw Lets Standard Users Gain SYSTEM Privileges: A Windows WalletService flaw lets any standard user trick the service into loading malicious code and gain full SYSTEM control, so patch immediately.

> Apple Biome Data Reveals Safari Activity, Wallet Transactions and Location Visits: Apple's Biome system, which powers Siri predictions, quietly stores detailed logs of browsing, purchases and locations, making it a rich new source for forensic investigators.

> Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available: Attackers are actively exploiting a remote-code-execution flaw in the old Fastjson 1.x library that has no patch, so organizations must upgrade or isolate it themselves.

> Claude Code Symlink Flaw Exfiltrates Sensitive Files Without User Approval: A symlink handling bug in Claude Code lets a malicious repository silently load files from outside the project into its startup context and send them to a model endpoint without user approval.

Other news you might like

• Opus 5 may have solved browser-based prompt injection, the biggest security flaw haunting AI agentsLINK

• North Korea arrests bank hacking ring tied to crypto laundering: ReportLINK

• Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accountsLINK

• Golden Chickens Launches Four Modular Malware Families to Steal Chrome Credentials and Hijack Browser SessionsLINK

• Iran-Linked Actors Breach Are Targeting US Water and Energy Control SystemsLINK

• Shared Claude chats were reportedly showing up in search enginesLINK

🧰 Trending tools

Spotlight by Backplanes: a CLI-installed session analyzer for Claude Code and Codex that surfaces agent actions, flags fixes, and tracks improvements across team workflows.LINK

Constellation Gate AI: routes AI agent traffic through a gateway that blocks prompt injection, scans for leaked secrets, and logs verifiable audit trails while cutting token costs 20-40%.LINK

CheapSecurity: a lightweight, self-hosted CCTV system designed to run on Linux single-board computers, enabling affordable home or office video surveillance setups.LINK

TailMux: lets you connect to multiple Tailscale tailnets simultaneously on macOS and Linux by running isolated embedded nodes per profile and routing by hostname, eliminating account switching or VMs.LINK

LaunchSafe: an autonomous pentesting platform that uses AI-driven exploit chains to continuously test and auto-remediate vulnerabilities, letting engineering teams ship fast securely.LINK

HOL Guard: a local firewall for AI coding agents that intercepts risky actions like data deletion or secret leaks before execution, adding minimal latency.LINK

📚 Trending papers & reports

Cryptographic model audits can be gamed so a system proves over 99% accuracy on the test data shown to auditors while performing below 30% accuracy on real customers, prompting a fix that closes this loophole.LINK

Encrypted rental compute lets independent hardware owners securely rent out GPU power for AI work, giving startups and researchers cheaper, fully protected alternatives to expensive centralized cloud clusters like 8xH100s.LINK

Cloud AI watermarking lets companies prove ownership of models they rent out for zero performance loss, without exposing training data or slowing service under heavy customer traffic.LINK

Python package verification shows most rebuilt software packages don't match published versions byte-for-byte, but a new tool called daleq4py confirms 60.2% and 78.9% of them are truly equivalent anyway, making supply-chain security checks far less prone to false alarms.LINK

Software ingredient lists that skip dependency links make over half of real SBOM files unreliable for spotting which vulnerabilities actually matter, but flagging that gap as "unknown" instead of "safe" lifted true-threat detection from 60% to 95%.LINK

See you tomorrow for a new dose of ☕️ Cyberpresso!