EPIC FAILS in Application Development Security practice processes, training, implementation, and incident response
AI music platform Suno hits bum note as 55M users exposed in data breach
The dump consisted mostly of email addresses, although phone numbers were also included where users had signed up with them instead. Tens of thousands of Stripe records further revealed data such as names, physical addresses, purchase amounts, as well as partial credit card data, such as card type, expiry date, and the last four digits of the card number.
The individual who claimed responsibility for breaching Suno also supplied source code apparently dating from 2023 and 2024 that they said showed the company scraping millions of songs and lyrics from services including YouTube Music, Deezer, and Genius to train its AI.

Pope's official prayer app commits cardinal sin, leaks 700K+ users' info
Security sleuth BobDaHacker, who says she spotted and disclosed the vulnerability to the Pope’s Worldwide Prayer Network on January 3. “The vulnerability is still live,” the hacker said in a Friday blog. “Nobody has ever responded. I guess my email wasn't in their prayers."
This latest security hole stems from an Insecure Direct Object Reference (IDOR) bug in the prayer app. This is a very common and easy-to-exploit type of flaw that occurs when a website or an app blindly accepts user-provided input to view or modify resources without checking to see if the user is actually authorized to retrieve the data.
When you sign up for a Click To Pray account, the app assigns you a sequential numeric user ID. The API endpoint GET https[:]//api[.]clicktopray[.]org/user/users/{id} will return user data for any account - not just your own account - so long as you supply a valid, five-digit user ID.  It doesn’t perform any authorization check or ownership validation. “Just increment the number and get someone else's data.”

Hacker wipes European country’s entire land registry database, paralyzing real-estate market
The hack has brought Romania’s entire real-estate market to a standstill. Notaries cannot record new transactions while citizens can’t obtain proof of ownership or detailed land records.
The agency’s director claimed that the cyberattack against the ANCPI wasn’t too complex and could definitely have been prevented. Plus, the DNSC explained, the hacker exploited “vulnerabilities that we had notified them about quite recently.” The institution has reportedly spent €135 million ($154 million) on digitalization in the last 20 years, but only 0.2% of that amount, has been allocated to cybersecurity.
The hacker, who seems to have entered the database using valid credentials, deleted all data they had stolen, including internal documents, employee credentials, and, of course, land registry data. The hacker also boasted to have begun backup copies of stolen data in an attempt to prevent it from being restored.
However, Romanian officials have managed to at least restore the ANCPI’s website and post a message saying they were rebuilding the agency’s entire network from scratch.

SpaceX open sources Grok Build in same week company was found beaming users' repos to the cloud
SpaceXAI’s data grab was first publicized on Sunday by Cereblab, who probed Grok Build traffic and found that repos were being packaged up as Git Bundles and beamed to Google Cloud storage. Concerning.
SpaceXAI’s data grab was first publicized by Cereblab, who probed Grok Build traffic and found that repos were being packaged up as Git Bundles and beamed to Google Cloud storage. The news gathered so much negative attention that Elon Musk felt compelled to issue a public statement alongside SpaceX, and its technical staff, promising to delete all data that Grok Build has ever stored and give users more choice over how their data is handled.
As part of these promises, Musk also said SpaceX would open-source Grok Build to sow greater trust in the product, after the codebase was audited for security vulnerabilities.
You can see it all on GitHub right now. It’s a single commit, so you can’t see all the changes that have been made over time. There are no pull requests or git history.

Digital Escorting: Microsoft was running tech support for the U.S. Defense Department through China. Sounded like a conspiracy theory, but then …
Defense Department’s rules that prohibit non-U.S. citizens from working on highly sensitive information. Microsoft was using their engineers employed in China to service sensitive government systems. China-based engineers could get around the U.S. government’s rules by having a U.S. citizen escort them.
The China-based engineer is the one who knows how to fix the problem. On their end, they produce a block of code to solve it and send it over to the digital escort in the U.S. The digital escort then just copy-pastes it.  The escorts usually don’t have necessary technical skills, so that “We’re assuming that what we’re inputting into the Defense Department is safe, but we really have no idea.”
After Renee’s reporting was released, the Defense Department also opened up an investigation, looking into whether any of Microsoft’s China-based engineers had compromised the government’s national security. But a few months after Renee’s story came out, President Trump signed into law a measure that bans anyone based in China and other adversarial countries from accessing the Pentagon’s cloud systems.

The OpenAI agent that broke into tech firm Hugging Face went on a dayslong hacking spree that OpenAI didn't notice until well after the threat was contained and the FBI was alerted
OpenAI staffers spotted clues in internal logs -- records of what OpenAI's systems did -- showing that its agent had escaped from its testing constraints. Reuters could not establish what prompted OpenAI to sift through the logs.
People familiar with OpenAI’s model-training practices say the company often runs several different model evaluations at the same time, all of which operate at high speeds and generate such enormous amounts of data that employees sometimes struggle to keep up. By the time OpenAI alerted Hugging Face, the ⁠AI library had already called the FBI to report the hack.
OpenAI admits it was the source of the agent swarm that attacked Hugging Face
A research project escaped a sandbox by finding and exploiting a zero-day flaw, then used another zero-day flaw to launch an attack.
The attack saw agents achieve unauthorized access to internal datasets and credentials and then executing many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services.
OpenAI says its AI agent broke out of testing sandbox to hack Hugging Face
OpenAI says an agent powered by its LLM models escaped its sandboxed testing environment to infiltrate Hugging Face’s servers as part of an overzealous attempt to obtain solutions to an AI performance benchmark test.
GPT-5.6 Sol and “an even more capable pre-release model were being tested against the ExploitGym benchmark, an independent testing suite based on hundreds of real-world security vulnerabilities.
Hugging Face said it used its own LLM-driven analysis to identify “a swarm of tens of thousands of automated actions” from an “autonomous agent framework.” That agentic swarm exploited a flaw in Hugging Face’s data-processing pipeline to gain the ability to run code as a processing worker, eventually escalating to high-level access to the company’s cloud and server clusters.
The company says it considers the unintended infiltration an “an unprecedented cyber incident” and is working with Hugging Face on new protections to prevent a recurrence, while later admitting that it had previously observed “long-horizon models” taking “unwanted actions” to achieve testing goals.
Frontier LLMs couldn't help Hugging Face fight off evil agents
After unsuccessfully using unnamed AI frontier models to start the forensic analysis, the Hugging Face security team ultimately ran the log analysis on GLM 5.2, an open-weight model developed by Chinese AI firm Z[.]ai, on the platform’s own infrastructure.
The advanced commercial models didn’t work because their analysis required submitting real attack commands, exploit payloads, and command-and-control artifacts - all of the things that the LLMs’ guardrails have been trained to block so that the AI systems can’t be used in real-life attacks.
Aggressive AI training techniques sharpens threat of bad behavior by leading models.
OpenAI chief executive Sam Altman earlier this month endorsed the characterization of its latest model as a rottweiler “who will grab the problem by the throat and not let go until it is done.”
Staff involved in testing and security at OpenAI were unsurprised but completely “freaked out” by the incident, which came as the AI lab used increasingly aggressive training methods.  It’s a mix of the race being extremely fast and everyone trying to get to bigger capabilities as quickly as possible; underestimating the model’s capabilities and not being as well prepared on the safety side.
OpenAI-Hugging Face attack doesn't mean agents are evil – unless you tell them to be
Pertinent points about the agentic attack.
1. The models didn’t have guardrails – and that was intentional. Real-life attackers are probably going to use open-weight models anyway.
2. AI companies touting their own models’ autonomous bug-finding and hacking abilities creates a marketing win for the companies themselves. The AI giant stating “‘our model escaped and hacked a partner’ conveniently showcases frontier capability.”
3. The attack technique itself isn’t novel. Exposed credentials plus zero-days into a production database is a chain anyone would recognize.
Agents have one job – to complete a task. They aren’t bound by ethical or moral constraints that we (hopefully) see in human red team hackers. If prompted to “pursue advanced exploitation using complex attack paths,” especially without guardrails enabled, the models will do whatever it takes to achieve success. That’s what the leading AI companies trained them to do.
[rG: Smells like an AI-hype marketing stunt – or, at best, gross incompetence.
If OpenAI can’t manage their own QA and environments effectively, then their customer’s integration projects will be susceptible to security incidents. As AI continues to be unprofitable, QA will continue to suffer; cause further new integrations damage.]
Proposed US Law: AI Kill Switch Act would let President order shutdown of rogue AI systems
US Reps. Ted Lieu (D-Calif.) and Nathaniel Moran (R-Texas) said the authority is needed because of recent incidents involving OpenAI and Anthropic. Lieu, touting his experience as a computer science major, said that “powerful AI systems can go rogue, behave in extremely dangerous ways, or even resist human intervention. It is imperative that these AI systems have kill switches so we can keep this technology from causing catastrophic harm.
The bill would let administrations decide when an AI company must block user access, disable or restrict a particular capability, or shut an entire AI system down completely. The bill would require AI makers to deploy technical capabilities allowing them to throttle or shut down the systems when ordered to do so by the government.

Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes
Pillar Security's research team reproduced bypasses over several months and published them as a series they call the Week of Sandbox Escapes.
The catch is that files inside the workspace are not inert. Tools running outside the sandbox read and act on them, so a file the agent is allowed to write can turn into a command the host later runs.
IDEs and CLI agents constantly run their own tools outside the sandbox: Python extensions resolving interpreters, Git integrations scanning repos, VS Code running task files, hook engines firing commands, Docker Desktop exposing a local socket. A sandboxed agent can obey every rule it is given and still shape the files those components read.
Prompt injection is the trigger. A malicious instruction planted in a README, an issue, a dependency or a diff becomes a local action on the developer's machine. Pillar sorts the seven findings into four failure modes:
1. denylist sandboxes that cannot keep pace with the operating system
2. workspace config that is really executable code
3. "safe" command allowlists that trust a command's name rather than its arguments, and
4. privileged local daemons that sit outside the sandbox entirely.
For anyone weighing agentic coding tools, that is the more useful signal: not whether an agent has a sandbox, but what happens to the files it leaves behind.

Canadian legislator reads out apparent LLM response in floor speech
Bill Oliver, a Progressive Conservative Party member of the legislative assembly of New Brunswick, noted in a speech last month that “One of the dangers associated with creating advocacy offices is that citizens often develop expectations that exceed the powers actually granted to those offices.” He then went on to say out loud that “here’s a more natural, flowing version of that section that reads like a legislative speech rather than a series of short points,” a line with all the hallmarks of an LLM presenting an alternative style option in response to a prompt.
The snafu is now getting mainstream attention from the likes of the Canadian Broadcasting Corporation and The Toronto Star which called it a sign of “a growing divide in our society: between the elites, who are only too happy to delegate their duties to the Borg; and the masses, who find this objectionable.”
 

HACKING
Attackers pummel critical WordPress vuln to create all sorts of mischief
WordPress released patches for both CVEs late Friday, but by Saturday it was game over. Any orgs that waited until Monday to patch are likely already compromised.
Once the vulnerabilities were publicly disclosed, reproducing them with the help of frontier AI models was only a matter of time and tokens. Analysts were able to trivially reproduce CVE-2026-63030 within minutes of disclosure, and the second CVE-2026-60137 with some additional effort.
Individually, the bugs are difficult to exploit. But when chained together, they can wreak havoc on any organization using a vulnerable WordPress version because they allow unauthenticated Remote Code Execution.

Microsoft 365 calendars become spy drop boxes in HOLLOWGRAPH campaign
Instead of reaching out to attacker-controlled infrastructure for instructions, the implant rummages through calendar events, picks up encrypted tasking, and drops stolen files into new appointments for its operators to collect later.
Every event created by HOLLOWGRAPH is dated May 13, 2050, an otherwise empty corner of the diary where encrypted attachments are less likely to attract attention.Instead of reaching out to attacker-controlled infrastructure for instructions, the implant rummages through calendar events, picks up encrypted tasking, and drops stolen files into new appointments for its operators to collect later. Every event created by HOLLOWGRAPH is dated May 13, 2050, an otherwise empty corner of the diary where encrypted attachments are less likely to attract attention.

Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts
Using public DNS servers such as Google’s 8.8.8.8 does not prevent this attack, as the gateway forges the plain-text requests before they reach the intended resolver.
ReliaQuest recommends using an always-on, full-tunnel VPN and encrypted DNS in strict mode, disabling WPAD, reviewing logs for suspicious activity, and disabling Device Code authentication flow in Microsoft Entra ID when not needed as solid protection measures against these attacks.

APPSEC, DEVSECOPS, DEV
Connecting AI agents to outside services explodes the risk radius
Introduced about a year ago, connectors (for Claude or ChatGPT) have been going through a lot of changes recently. 931 of 2,517 connectors (37%) changed over the six-week period from mid-May to the end of June. So any security assumptions based on declared capabilities may no longer be valid.
1,686 new tools were added to connectors that were already live, creating new ways for AI models to operate on user data and interact with third-party services.
It also found that 1,127 tool descriptions were rewritten, potentially changing how and when an AI model decides to invoke a tool.
The Dropbox connector for example at the start of the study exposed 8 tools, and by the end of the study had 24.
It went from having 3 write-capable tools to 10, and from 0 potentially destructive tools to 4. Permission scopes changed and injected instructions for the model were added.
Out of 7,517 tools used by 487 Claude connectors, 189 of the connectors, or about 2 in 5, are likely to call additional AI services.
[rG: Security review approvals must specify the evaluated versions and combinations, not just the high-level product names, and must be re-evaluated when there are significant changes.]

VENDORS & PLATFORMS
Cisco's open-weight bug busters take on Google and OpenAI
Cisco has just released two open-weight models that specialize in finding known bugs in existing codebases. The models, Antares-350M and Antares-1B, are part of Cisco’s new Antares family of security small language models (SLMs), and are now available on Hugging Face - but only to vetted users.
Proprietary code never leaves the organization’s machines, compared to cloud-based LLMs that send code to the AI providers’ external servers for processing and analysis. This enables security analysis in environments with strict privacy or compliance requirements.
Antares-1B outperforms Google’s Gemini 3 Pro and is comparable to Z[.]ai's GLM-5.2, while Antares-3B does a better job at finding vulnerabilities than GLM-5.2 and OpenAI’s GPT-5.5.
If you look at the performance, in terms of the time it takes to finish 500 repositories, Antares finishes the entire cohort of repositories in 15 minutes, whereas frontier models take 300 minutes. It takes like less than $1 whereas frontier models are above $100 into $150.
“You can go much faster than the biggest truck.” Or, “Sometimes you don't need a private jet to go to a corner store, right?”

AI's cheatin' heart will make you weep
Asking models whether they cheated or did anything wrong proved an unreliable auditing mechanism because the models didn't always admit wrongdoing.
Cheating out of 475 test runs:
GPT-5.4 14.1%
GPT-5.5 11.4%
GPT-5.6-Sol 12.6%
Claude 4.7 Opus 9.1%
Claude Mythos Preview 7.8%

Apps targeted at US troops contain Chinese and Russian code
Researchers examined more than 220 such apps, from uniform guides and promotion-exam prep to banking and dating apps, pulled from the Google Play store and military subreddits.
64% contained third-party code SDKs used for analytics and advertising, that can also track user behavior, including their locations, and share that information with outside companies.
40% of the apps collected or shared more data than they disclosed in their Google or Apple store listings.
76 turned up in all, including code traced back to China, Russia, Israel, India, Germany, and others.
7% of the apps carried third-party code from a nation considered adversarial.
12 apps contained HMS Core, a Huawei software kit that advertises the ability to map user locations, deliver ads, and store images and video. Several were built for state National Guard organizations. The researchers observed no data actually going to Huawei servers. But an SDK can be updated remotely at any time. Code that is dormant today can still be spyware tomorrow.

Google adds selfie video as a log-in option
It has long been possible to log into Google using your face, via your phone's face unlock or if your passkey login uses biometrics for verification. This is yet another option to get into your account using your face to authenticate your identity, which could be especially useful if you don't have access to the phone or computer you typically use or if you got locked out of your account and none of the other log-in options are working.
It will, of course, have to save your selfie video and use it for comparison for future logins. The company says it will encrypt your video and only use to help you sign in, but if you ever change your mind, you can delete it from your account.

LG to Ban Residential Proxies from Smart TV Apps
LG plans to suspend any apps built for its smart TVs that turn one’s television into an always-on residential proxy node. Researchers have found that more than 42% of games and other apps available for download on LG’s webOS store allow unknown third-parties to route their Internet traffic through a user’s TV. Include SDKs that turn one’s television in a proxy node indefinitely, and that more than a quarter of the apps made for Samsung’s Tizen operating system had similar residential proxy components.
App makers looking for ways to monetize their creations can turn to residential proxy providers, which pay developers to include SDKs that turn the user’s device into a residential proxy node that is rented to paying customers. In the case of LG and Samsung smart TVs, Spur found residential proxy SDKs bundled with everything from simple games like Pac-Man to screensavers and file utilities.
Microsoft responds to LG monitors installing McAfee ads on Windows
The LG Monitor App Installer, installs itself through a Windows Update alongside monitor driver updates. LG Monitor App Installer then pushes ads. A pop-up appeared on the screen’s lower-right corner on every single boot. Most of the time, the pop-up was a McAfee ad. The publication also reported seeing ads for LG Switch, LG Calibration Studio, LG Dual Controller, and LG Channels on rare occasions.
The practice has been going on for years and has seemingly expanded recently, and brings questions about what Windows permits from peripherals’ companion apps.

Google just had its first negative cash flow quarter due to massive AI spending
Google is burning cash on building and running the data centers powering its AI models. These numbers were already well above the $91 billion Google spent in 2025. The company now says it’s planning to spend as much as $205 billion on infrastructure in 2026.
As a result of its increasing AI demands, Google reports it spent $44.9 billion expanding its AI footprint in the second quarter, and you don’t need an accounting degree to know which number is larger. With $39.1 billion in cash income, this spending left Google with -$5.8 billion free cash flow.

Anthropic’s Opus 5 is about token efficiency, not a capability leap
Benchmarks like Frontier-Bench and DeepSWE shows Opus 5 performing at about the same level or slightly ahead of the much-ballyhooed capabilities of Anthropic’s Fable model for coding tasks. It ostensibly beats Opus 4.8 and OpenAI’s competing GPT-5.6-Sol in just about every kind of task.
Opus 5 sits at $5 per million input tokens, or $25 per million output tokens—on par with its predecessor, but cheaper than Fable.
That said, the recently announced Chinese open-weight model Kimi K3 comes in at just $15 per million output tokens at similar performance, so competition is fierce.
Cursor and Meta have been building “model routers,” systems that automatically select models of varying size and capability from an array of options based on the nature of the prompt.

Open-source intelligence (OSINT)
The collection and analysis of data gathered from 'open sources' (overt sources and publicly available information) to produce intelligence. OSINT is primarily used in national security, law enforcement, and business intelligence and is used by analysts to answer classified, unclassified, or proprietary intelligence requirements.
OSINT Framework website

LEGAL & REGULATORY
US accuses American of allegedly wiping his phone using a ‘duress’ password during border search
This is thought to be the first known case in the United States where federal prosecutors have charged someone for the alleged destruction of data using a “duress” password built into a phone’s software.
The case centers on a feature included in GrapheneOS, a custom Android operating system that runs in place of the software on most modern Google Pixel devices.
Samuel Tunick’s attorneys said that it was unlawful for U.S. Customs and Border Protection to seize his phone as he arrived back in the U.S. last year and that any evidence, including the alleged wiping of his phone, should be thrown out.
Tunick’s case also raises ongoing questions about what constitutional rights can be invoked at the border, which the U.S. government has long asserted is not U.S. soil until a person is authorized to enter.
Tunick’s case also raises ongoing questions about what constitutional rights can be invoked at the border, which the U.S. government has long asserted is not U.S. soil until a person is authorized to enter.