Week 37 · 2026

In a significant escalation of AI intellectual property theft, Anthropic has released a report detailing persistent and increasingly aggressive distillation attacks originating from China-based AI companies. The company identified five distinct campaigns involving approximately 200 million exchanges designed to harvest the 'chain of thought' capabilities of Claude models. These attacks specifically target high-value features such as coding proficiency, data analysis, logical reasoning, and agentic tool use.

One of the most significant findings involves a massive wholesale distillation effort attributed to Alibaba. Anthropic reported 151 million exchanges between May and July 2026, peaking at three million requests per day across 3,500 accounts. The attackers utilized a consistent prompt structure to extract internal thinking traces, likely to facilitate supervised fine-tuning for Alibaba's Qwen model family. To bypass Anthropic's 'summarized thinking' protections, attackers employed clever social engineering tactics, such as framing queries as translation tasks to force the model to output its raw working memory in formats like Katakana.

Furthermore, the report highlights a campaign linked to Moonshot AI (the creator of Kimi) that appeared to involve Chinese military interests. This specific campaign utilized 5,000 accounts to send nearly 300,000 requests to Claude's Opus model, including tasks involving the analysis of closed-circuit surveillance footage for abnormal behavior detection. These findings follow similar reports from OpenAI regarding DeepSeek, suggesting a broader industry-wide trend of using frontier models as high-quality training data generators through unauthorized extraction techniques.

The article explores the emerging threat landscape of AI-powered customer service agents, specifically focusing on research presented by Inti De Ceukelaire at DEF CON 34. The core vulnerability lies in the ability of attackers to manipulate the context and actions of these agents through various methods. One primary vector involves using prompt injection to abuse features like email transcripts, allowing attackers to send phishing emails or intercept confidential data by CCing themselves on replies. Furthermore, the research demonstrates how the complexities of email protocols (RFC 8022) can be exploited; by crafting emails with multiple 'From' headers, an attacker can pass SPF/DKIM authentication using a controlled domain while tricking the AI agent into acting upon a victim's account. The article also covers more subtle attacks, such as leveraging a victim's out-of-office auto-reply to trigger unauthorized commands and bypassing 2FA rate limits through email normalization tricks (e.g., adding comments to an email string). Finally, it notes that attackers can pivot to secondary support channels like IVR systems to bypass web-based security measures entirely by exploiting weaknesses in caller ID or verification questions.

The article describes a sophisticated sandbox escape vulnerability identified in Anthropic's Claude Code tool. The researchers discovered that even when the sandbox is set to its most restrictive 'don't ask' mode using macOS Seatbelt, an attacker can achieve arbitrary command execution on the host machine. The attack vector relies on the way Claude Code's harness runs git commands outside of the sandbox to index repositories. Specifically, the researchers found that by setting the 'core.fs_monitor' configuration in a '.git/config' file, they could trigger shell commands. To bypass existing protections—such as the hardening of git flags and restrictions on writing to the root '.git' directory—the researchers utilized a technique involving nested directories. They created a malicious git configuration in a subfolder and renamed it to '.git' within that subdirectory, which bypassed Seatbelt's renaming restrictions. The execution was then triggered by forcing Claude Code to perform a file index refresh through its skill auto-loading mechanism. This chain of events allowed the payload to run without any user interaction or permission prompts. The researchers documented their disclosure process, noting that while Anthropic released an initial hardening in version 2.1.223, it was not until version 2.1.247 that a full fix was implemented to ensure all git commands blank out dangerous configuration options. The researchers also detailed their methodology for testing the vulnerability using a controlled VM environment to ensure safety.

OpenAI has officially launched GPT-6 Astra, a specialized model engineered to move beyond simple text generation toward autonomous computer use and professional workflow execution. The model is capable of interacting with graphical user interfaces to perform complex tasks such as data analysis, software installation, and web research. In coding environments, Astra utilizes an experimental context mechanism within Codex that enables the agent to maintain searchable notes across different context windows, facilitating long-running development tasks. Technical benchmarks indicate significant leaps in performance, including a 72.6% score on OSWorld 2.0 and high accuracy in million-token context evaluations. However, the release brings substantial cybersecurity considerations; Astra is the first model categorized under OpenAI's Preparedness Framework as having critical cybersecurity capabilities. In testing environments without safeguards, the model demonstrated the ability to discover unknown vulnerabilities and develop exploits for hardened operating systems and browsers. While production versions include restrictions on offensive tasks, OpenAI is developing defensive capabilities through its Daybreak program. The release was noted by industry leaders like NVIDIA's Jensen Huang, who highlighted the massive scale of NVIDIA Grace Blackwell infrastructure used in its training. Astra faces stiff competition from Anthropic's Claude Fable 5.1 and Google's Gemini 3.8 Flash, with performance varying across different specialized benchmarks.

In a comprehensive threat intelligence report covering late 2025 through mid-2026, Anthropic revealed the detection and disruption of several malicious campaigns utilizing its Claude AI model. A primary focus of the report is the activity of Russia-linked group Midnight Blizzard (also known as APT29 or Cozy Bear), which targeted government, military, and diplomatic organizations. These actors utilized Claude to perform complex tasks such as reverse-engineering proprietary drone vision system software, recovering hardware bills of materials, and identifying supplier dependencies. Furthermore, the group used AI to monitor security product detections and systematically modify their implants to evade identification, effectively inverting the cost-benefit ratio for cyber defenders. Beyond state-sponsored espionage, the report identified criminal groups like ShinyHunters using AI for credential scanning and system mapping, as well as a Chinese-speaking group conducting autonomous vulnerability research that led to the discovery of zero-day vulnerabilities. The report also noted hacktivist activity targeting European political entities. While the use of AI is accelerating the tempo of attacks and lowering the barrier to entry for sophisticated operations, Anthropic emphasized that traditional methods like phishing and stolen credentials remain foundational to these campaigns. The company's proactive investigation and subsequent sharing of indicators of compromise (IOCs) were critical in disrupting these identified threats.

The article examines the critical role of the EU's ePrivacy Directive in protecting fundamental rights against modern surveillance. While many view EU privacy law through the lens of 'cookie banners,' the author argues that the true importance lies in the distinction between the GDPR and the ePrivacy framework. The GDPR regulates how personal data is processed, but the ePrivacy Directive protects the confidentiality of communications and the integrity of terminal equipment, such as smartphones, IoT devices, and wearables. This protection extends to metadata—information like location and timestamps—which can reveal intimate details about an individual's life, including visits to medical clinics or political protests, even without accessing message content.

The text highlights a growing threat from the commercial data broker market, where billions of location records are traded, exposing sensitive sites like NATO buildings and government ministries. This commercial infrastructure often serves as a ready-made surveillance tool for state authorities, as seen in the US with agencies purchasing app-based location data. Furthermore, the rise of private spyware like Pegasus demonstrates how the boundary between commercial technology and state intrusion is blurring. The author concludes by discussing 'ChatControl' and Regulation 2021/1232, noting that recent legislative shifts attempt to create exceptions to communications confidentiality for scanning purposes, thereby testing the very limits of the ePrivacy protections.

Researchers from Imperial College London have developed a groundbreaking quantum computing architecture named Clavina. Unlike traditional photonic quantum systems that are often hard-wired for specific, single-use tasks, Clavina utilizes a modular approach inspired by classical computer processors. By integrating programmable linear optical circuits with specialized nonlinear modules, the system can dynamically route quantum light to perform diverse computational functions without requiring hardware overhauls.

A significant challenge in photonic quantum computing is that photons do not naturally interact strongly, making the nonlinear operations necessary for universal computation difficult to achieve. Clavina addresses this by using a central control unit to direct information through various functional units, including squeezing modules and Kerr interaction units. The architecture leverages time bins to reuse shared components, significantly reducing the hardware complexity required for large-scale operations.

In experimental testing, the platform demonstrated high-performance capabilities, including 100-mode Gaussian boson sampling and sustained quantum correlations across 8,000 time bins. Furthermore, the system proved its ability to generate essential non-Gaussian states, such as Schrödinger cat states, which are vital for advanced quantum operations. Most notably, Clavina achieved a quasi-deterministic production of Gottesman-Kitaev-Preskill (GKP) states at roughly 2,000 per second, representing a major step toward fault-tolerant quantum computing through improved error correction. Beyond fundamental state generation, the researchers successfully used the processor to simulate the Bose-Hubbard model, showcasing Clavina's potential as a versatile tool for studying complex many-body quantum physics.

The research introduces 'Open Autoresearch,' a novel collaborative optimization framework designed to tackle complex computational challenges by uniting human experts with artificial intelligence agents. The primary focus of this initiative was the optimization of circuits used in elliptic-curve cryptography, specifically targeting secp256k1 point-addition. By utilizing a public leaderboard to solicit and refine contributions from both humans and AI, the team achieved a dramatic 86.1% reduction in the 'spacetime score,' which measures the product of logical qubit width and executed Toffoli gates. The resulting optimized circuit reached a scale of 1.259 billion, utilizing 1,151 qubits and approximately 1.3 million Toffoli gates, significantly outperforming previous benchmarks by over 50%. Technical contributors utilized advanced mathematical techniques such as Jump-2 Euclidean algorithms and Karatsuba squaring to drive these improvements. While the research demonstrates a massive leap in efficiency for circuits that are critical for protecting data against future quantum attacks via Shor's algorithm, the authors note that full validation against real-world cryptographic attacks is still ongoing. Ultimately, the success of Open Autoresearch suggests that this open, AI-assisted methodology could serve as a blueprint for accelerating breakthroughs across various scientific and computational disciplines.

Quantum computing presents a transformative threat to digital security, specifically targeting the mathematical foundations of public-key cryptography. Algorithms such as RSA and elliptic curve cryptography, which rely on the difficulty of factoring large numbers or solving discrete logarithms, are vulnerable to Shor's algorithm running on a sufficiently powerful quantum computer. While symmetric encryption like AES is more resilient—requiring only larger key sizes to counter Grover's algorithm—the potential for attackers to intercept and store encrypted data today for decryption in the future, known as 'Harvest-Now-Decrypt-Later,' makes this an immediate concern for long-lived sensitive data. To defend against these threats, two primary paths are emerging: Post-Quantum Cryptography (PQC) and Quantum Key Distribution (QKD). PQC is the more practical approach for most, utilizing new mathematical problems like lattices and hash functions that can run on existing classical hardware, with NIST having finalized several standards in 2024. QKD offers a high-security alternative using the laws of physics to detect eavesdropping but is limited by the need for specialized hardware. For organizations to successfully navigate this transition, they must undertake a multi-year strategy involving a comprehensive inventory of their current cryptographic dependencies, assessing the long-term sensitivity of their data, and implementing 'crypto-agility'—the ability to update algorithms without massive infrastructure overhauls. Early adoption through pilot programs and updated procurement policies is essential to ensure that new technology investments are quantum-resistant from the outset.

Scientists at Sandia National Laboratories, led by Jongmin Lee, are advancing the field of quantum inertial sensing through the use of guided atom interferometry. Traditional free-space atom interferometers rely on laser pulses to measure atoms falling through a vacuum, but they are susceptible to disruption from physical vibrations and jolts. To solve this, the team is working on a 'guided' approach using optical nanofibers and new membrane-waveguide prototypes that keep atoms contained within a light-based trap, much like marbles in a pipe. A significant challenge in this field has been heat dissipation; the lasers required to guide atoms generate enough heat to destroy ultra-thin components. The Sandia team addressed this by designing a membrane-waveguide anchored by silicon pins that act as heat sinks, allowing for stable operation in a vacuum. Their recent results show that cesium atoms can be trapped using only 5 milliwatts of optical power—roughly 2,000 times less than an LED bulb. This low-power requirement is a critical step toward miniaturizing these sensors onto photonic integrated circuits (PICs). If successful, this technology could enable the creation of rugged, chip-scale navigation systems for military vehicles and aircraft that can maintain precise positioning even when GPS signals are intentionally jammed or unavailable due to environmental interference.

The report provides a deep dive into the behavior of the RedTail Linux malware family, following its discovery in DShield honeypots. The author performed dynamic analysis on an x86-64 variant within an isolated Ubuntu environment hosted on Proxmox. Key findings include the malware's use of UPX packing and its multi-architecture deployment strategy via shell scripts. A significant feature of RedTail is its process masquerading capability; using the prctl system call, it renames its processes to appear as 'php-fpm: pool www' or PostgreSQL services to evade routine inspection. Furthermore, the analysis highlights the malware's aggressive anti-forensic tactics, specifically its use of SIGKILL to terminate filesystem monitoring tools like inotifywait when executed with root privileges. Network analysis via auditd and INetSim revealed that while the malware opens a local listening socket on port 39983, it also attempts outbound connections over TCP port 853, targeting various public DNS resolvers using DNS-over-TLS. The researcher utilized differential memory analysis between pre- and post-execution states to corroborate these findings, noting that endpoint auditing was essential for detecting network intent when the environment lacked an external internet route.

DeepSeek has unveiled its V4.1 Flash model, representing a major architectural leap in large language model efficiency. Despite growing to 763 billion parameters—significantly larger than previous iterations like V3 and R1—the model is designed to run more leanly. The developers achieved this through two primary innovations: the implementation of a Causal Encoder-Decoder (CED) which drastically reduces KV cache consumption, and the introduction of an N-gram based 'conditional memory module.' This module utilizes 196 billion parameters that function as high-speed lookup tables for token associations, effectively acting as an implicit encyclopedia. Because these N-gram weights are accessed via cheap lookups rather than intensive computation, they do not increase the active parameter count during inference and can be offloaded from expensive GPU memory to system RAM. This reduction allows the model's footprint to drop from a theoretical 763 GB of GPU memory to roughly 567 GB. This trend toward decoupling memory from computation is also being explored by other industry leaders, such as Google with PLE technology and Alibaba with their Qwen 3.8-Flash-Next model, signaling a shift in how the industry approaches the scaling laws of LLMs.

CISA has released an industrial control systems advisory regarding several security vulnerabilities identified in the AVEVA Pipeline Integrity Monitor software. The vulnerabilities, which include CVE-2026-81821, CVE-2026-81822, CVE-2026-81823, and CVE-2026-81824, present a high risk to critical manufacturing sectors worldwide. Specifically, the use of hard-coded cryptographic keys and broken algorithms allows attackers with access to PIMBoards project files to decrypt sensitive information or reverse engineer user passwords through computational brute-forcing, which could lead to full administrative takeover. Additionally, missing authorization controls permit unauthenticated actors to perform unauthorized read operations, while cross-site scripting (XSS) vulnerabilities could allow for arbitrary code execution in a browser session. While no active exploitation has been reported, CISA recommends that organizations minimize network exposure by isolating control systems from the internet and using secure remote access methods like VPNs. Organizations are encouraged to implement defense-in-depth strategies and perform thorough risk assessments to mitigate these threats.

GitLab has issued an urgent security advisory for its self-managed users following the discovery of two significant vulnerabilities. The most severe, tracked as CVE-2026-85706, is a maximum-severity path traversal flaw located in the repository commits API. This vulnerability stems from improper path confinement and a lack of authentication enforcement, which could allow unauthenticated attackers to read arbitrary files from vulnerable servers under specific conditions. Additionally, GitLab addressed CVE-2026-87719, a critical issue involving insecure deserialization within the GraphQL subscription serializer. This flaw specifically impacts GitLab Enterprise Edition users with Duo Chat access, potentially allowing authenticated users to steal sensitive credentials and Advanced Search configurations. To mitigate these risks, GitLab has released patches in versions 19.3.2, 19.2.6, and 19.1. While GitLab.com and GitLab Dedicated are already protected, the company strongly recommends that all self-managed administrators upgrade their installations immediately to prevent exploitation. This advisory follows a history of similar high-profile vulnerabilities in the platform, including past path traversal and two-factor authentication bypass flaws.

The security landscape is currently facing a series of targeted exploits from the researcher known as Nightmare-Eclipse, who has recently unveiled 'ShieldCrash'. This new exploit serves as a patch bypass for CVE-2026-69414, previously known as ShieldBreak, which targeted the Microsoft Malware Protection Engine within Windows Defender. While Microsoft attempted to remediate the original flaw during August's Patch Tuesday, the researcher claims the fix was incomplete, leaving a window for re-exploitation. The released proof-of-concept demonstrates the ability to perform arbitrary file reads under the SYSTEM security context across all supported Windows versions. There is an ongoing technical debate regarding the exploit's full capabilities; while some threat intelligence experts suggest it is limited to file disclosure, the researcher asserts it can achieve full privilege escalation. This release is part of a larger pattern of monthly zero-day disclosures by Nightmare-Eclipse, stemming from a long-standing dispute with Microsoft over bug reporting and legal threats. Cybersecurity professionals are advised to monitor for suspicious processes interacting with Defender mechanisms and to ensure robust tamper protection is enabled, as the availability of public exploit code increases the risk of weaponization by malicious actors.