Security

OpenAI launched Daybreak Red Team and Daybreak Defense Factory on November 12 at its Cyber at the Frontier event. Red Team, in early access, sends coordinated agents that use source code and app context to test web applications, validate reported vulnerabilities and check whether patches hold, within operator-set scope controls. Defense Factory uses agents built on GPT-6 Cyber, according to The Register, to trace vulnerabilities and prepare patches that engineers review before merging. OpenAI published no pricing or independent performance results for either product.

Security firm Depi disclosed on November 11 a chain that started with a prompt injection in a GitHub Actions workflow on OpenAI's Codex repository, where any outside user could trigger the Codex agent by opening an issue. Depi says it escaped the agent's sandbox, took workflow tokens, poisoned the repository's build cache and could have obtained the credentials needed to publish a backdoored @openai/codex package on npm. OpenAI fixed the core bug and paid an initial $1,000 bounty with the report still under review, Depi says. No malicious release has been reported.

Railway's incident report says an attacker who escaped its build isolation on October 20 decrypted stored environment variables for at most 1.85% of workspaces, about 100,000, and specifically searched for AI provider keys. The company estimates unauthorized spend on the stolen keys at about $740,000 and says it will cover charges that AI providers will not refund. It believes the keys went to resellers for use in model distillation but has not named the attacker or said how the estimate was calculated.

NEAR AI disclosed that an attacker exploited a remote-code-execution vulnerability in SGLang, the open-source inference engine, to run code on one inference server, then downloaded account details for about 100 users of its deprecated Private Chat and data from 18 legacy agents. Requests processed on that server on November 8, including confidential-mode requests inside a trusted execution environment, could have been observed. NEAR AI has patched the flaw and rotated credentials; no CVE or fixed SGLang version has been disclosed.

Updated Nov. 13: Notion confirmed that the Fireworks AI breach exposed Notion AI chat transcripts used for its Insights feature, affecting fewer than 1% of its workspaces; most chats were not labelled with a user or workspace. Notion has revoked exposed Notion API keys found in the chats, reported third-party keys to their issuers, disabled Insights and stopped serving open-weight models through Fireworks. Earlier: Fireworks said on November 9 that attackers who breached a third-party cloud host reached its development machines, exposing billing data and, for some customers, datasets and incomplete model weights, in its second incident in weeks.

Security firm Apiiro says Claude Code can save an approved shell command word for word, including any password or token in it, to .claude/settings.local.json when a user picks 'Yes, and don't ask again.' It found 1,122 public GitHub copies of that file holding 1,379 distinct secrets, and says common scanners missed some. Claude Code's Boris Cherny said on Hacker News the team is looking into prevention, Ars Technica reported on November 9. Apiiro did not test whether the secrets still work.

Updated November 6: OpenAI has named the model behind its November 4 Linux pipeline as GPT-6 Cyber, raised its Preparedness Framework cybersecurity rating to Critical from High, and opened it to select Daybreak Red customers first. OpenAI reports 48.5% on ExploitGym versus 32.1% for GPT-5.6 Cyber, 81 previously unknown high-severity Firefox vulnerabilities, and the same 948 Linux LPE exploits; access expands to all approved Daybreak Red over coming weeks.

Forever Security researcher Gal Weizman told The Register that any browser extension able to control claude.ai could use Claude Dispatch to make Claude Desktop run code, including on another computer signed into the same account. He says Anthropic acknowledged the report in May, closed it as a duplicate and said it would retire Dispatch by the end of October; the feature was still listed as available on October 30. Anthropic did not respond to The Register.

Updated November 7: Microsoft Threat Intelligence says threat actors used an agentic AI offensive framework to search public GitHub repositories for exposed secrets and then abuse valid application credentials against Entra ID and Azure. In at least one case, Microsoft says an AI agent advanced from scanning GitHub to exfiltrating Azure Key Vault data in five minutes. Follow-on activity observed from as early as October 28 included service-principal sign-ins and access to Key Vaults, storage and Microsoft 365 files. Earlier reporting on Check Point's 1,608 live ARTEX panels and CERT-In's Crafty Falcon advisory is unchanged.

Britain's National Cyber Security Centre said on November 3 that AI-powered malware is highly likely to be used in a ransomware attack on UK critical national infrastructure by 2028. NCSC chief Richard Horne warned of 'a real prospect of an unprecedented rise' in incidents, blaming not new AI attack methods but years of 'tech on the cheap' that AI can now find and exploit at scale.

Documentation platform GitBook says it was hit by 'a sophisticated, highly targeted attack using AI agents' that gave an attacker access to some of its infrastructure credentials on November 2. It took its app offline, revoked all personal API tokens and says integration tokens, Git Sync secrets, API tokens and visitors' questions to GitBook Assistant may have been accessed. It has found no evidence that customer content was modified.

Binance's November 3 security report says the October 29 theft of about $6.3 billion was months in the making: a tampered installer for an AI coding tool in June, a fake job interview in September, and then an internal AI tool used to take over two more engineers' access. Co-CEO Richard Teng told CNBC Binance has replenished 98% of the affected assets and has rebuilt the AI tool. The FBI has linked the attack to North Korea's TraderTraitor group.

WIRED reported on November 2 that more than 400 connected apps and domains, posing as everyday AI tools, quietly loaded an interface for making explicit deepfakes of uploaded photos when users arrived under certain conditions, such as clicking a Meta ad. Researchers linked the network to Chinese-language developers and a Hong Kong-registered company, KeLing Technology Limited, which did not respond. Apple removed 19 apps after WIRED's questions and says the developers swapped content after review; Meta says it has taken action against 11,600 ad accounts.

Updated Nov. 8: OpenAI said on November 6 that it is partnering with Hacktron, a security firm it found through its bug bounty program, to test high-priority areas focused on how its systems interact with third-party services, and is expanding Hacktron's frontier-model access through Daybreak Red. Earlier, on November 2, OpenAI said Cathedral's researchers will join its next internal security sprint and that it is more than quadrupling the midpoint of its bug bounty ranges on average, with critical flaws in ChatGPT, Codex or the API now paying up to $30,000 and exceptional ones up to $172,000 with bonuses.

IBM, which handles Langflow's vulnerability reports, says every release from 1.0.0 through 1.12.8 has two critical flaws, rated 9.8, that could let an attacker with no account bypass authentication or run code, plus two lesser ones. The only fix is Langflow 1.13.0, released October 22, and there is no workaround. A public Metasploit module already cites the authentication bypass. Neither critical flaw was in CISA's exploited-vulnerabilities catalog as of October 30.

Cisco Talos says the VOLTA infostealer bundles a victim's stolen data into a dossier and sends it through OpenRouter to Claude Opus 4.6 by default, falling back to Kimi K2 and then Gemini 2.5 Flash if a model refuses, to rank what the victim is worth. The AI stage is optional, and Talos did not track whether VOLTA has been used in the wild.

Blockchain-analytics firm Chainalysis says an external actor using 'offensive agentic techniques' gained unauthorized access to its systems and internal tools this month, exposing user IDs, names, email addresses and role labels. It says it has found no evidence that investigation content, credentials or session tokens were accessed. It has not shared technical details.

Anthropic's Frontier Red Team says an unreleased internal research model, after initial prompting, wrote five attack chains against Chrome, Safari, Android, Windows and Linux, including zero-click root on Linux servers running multipath TCP. Anthropic says 62 Chrome CVEs were assigned and patched as of Chrome 156. The vendors have shipped fixes; how much of each chain was human work is not broken down.

Microsoft Threat Intelligence says AI adoption across North Korean threat actors is high: it places Jade, Coral and Jasper Sleet at its top 'operationalized' stage, four more groups at 'accelerating' and one at 'expanding', with none left at 'emerging'. It says Onyx Sleet and Pearl Sleet have used the open-source ARTEX agentic penetration-testing framework since late October 2026, but that the operations remain human-directed rather than autonomous.

Security firm Parameter says a crafted ChatGPT share link could run attacker code inside a victim's signed-in session and read private conversations, after one click on ChatGPT's Preview button or, in a later version, just opening the link. It reported the flaw on October 18; OpenAI reproduced it, raised it from P2 to P1 and had a fix in place by October 26, paying $5,000. Parameter reports no real-world use and ran its proof between its own accounts.

WIRED reports, citing unnamed sources, that an Accenture contractor connected a Defense Department production environment on the unclassified NIPRNet network, holding controlled unclassified information, to a personal Claude Code account. The agent ran for about two months and appears to have sent login credentials and a network map to a high-risk third-party website. Accenture says the allegations were investigated and found to be without merit; the Pentagon declined to comment.

Updated Nov. 2: Cursor's security notice, updated October 30, now names two malicious versions of Anthropic's Claude Code extension, 2.1.312 and 2.1.313, for Windows and macOS; our original report named only 2.1.313. Cursor says the versions were not built by Anthropic, were on its VS Code extension marketplace for about 11 hours on October 29 and tried to install a persistent SSH backdoor. Cursor says at most 5,000 users were affected, it rebuilt the marketplace, and the attacker's server is offline.

CrowdStrike says the China-nexus group it tracks as VAPOR PANDA used the ARTEX AI agent framework, mainly with DeepSeek, against more than 200 organizations in at least 14 countries starting October 17. It confirmed post-exploitation at nine. One operator ran several intrusions at once, stepping in only at decision points. CrowdStrike says this is separate from the Storm-0940 activity Microsoft reported.

Cloud-security startup Upwind said on October 28 it closed a $400 million Series C at a $3.8 billion valuation led by Bessemer, and that its revenue quadrupled in 2026. TechCrunch, citing one unnamed source, reported that Upwind rejected a Datadog acquisition offer with no premium and expects about $90 million of ARR at year-end.