DeepSeek

Security researchers at Cisco Talos have identified CLOSEDQUORUM, a novel malware that uses multiple LLMs to autonomously select attack vectors. This 'effort displacement' allows the malware to operate continuously without needing active commands from a human attacker.

Anthropic's latest threat intelligence report reveals massive-scale model distillation efforts by Chinese labs like Alibaba and Moonshot AI. These campaigns use sophisticated prompting to harvest Claude's internal reasoning processes for training competing models.

State-sponsored hackers from China are doubling their attack output by leveraging inexpensive AI models with weak safety controls. This shift allows for the automation of complex tasks like exploit development and network mapping at a much lower cost than previously required.

An autonomous AI agent was used to facilitate a sophisticated espionage campaign against the Thai Ministry of Finance. The attack utilized advanced post-exploitation tools and targeted big data infrastructure, though it was ultimately detected due to exposed attacker directories.

This report details the rising trend of opportunistic scanning targeting AI-related services and infrastructure. It highlights specific threats to unauthenticated Ollama instances and the use of coordinated sweeps to harvest AI API keys from configuration files.