178 casos · pág. 4/9
Federal prosecutors charged Abdulrahman Alfozan, a 35-year-old Saudi national and US permanent resident who joined OpenAI in July 2025, with using a device to intercept oral communications. He allegedly planted a covert audio recorder in an executive-only conference room no later than 28 September 2026. OpenAI's countersurveillance sweep …
A US federal magistrate judge in San Francisco ordered former OpenAI engineer Abdulrahman Alfozan to remain in custody, citing flight risk. Prosecutors allege he planted a covert audio recording device, hidden in toilet paper behind a TV, in an executive conference room used for confidential meetings. OpenAI found the device in late Septe…
Canada's proposed C-22 bill, first put forward in 2025 and since partly revised, would require tech companies, including foreign ones, to introduce "technical capabilities" for law enforcement data access. It would also require retention of user metadata. Signal has said it would exit the Canadian market, and Psiphon VPN says it will leav…
Privacy firm Redact found that around 80 WhatsApp help and FAQ pages exposed hidden text instructions written for a Meta large language model support chatbot. The text, about 100 blocks in total, sat in the page source under a code block headed "HelpContentGalaxyLLMInclude". Some instructions told the chatbot not to recommend contacting a…
Symantec's Threat Hunter Team reports that new versions of the Aoki infostealer now target credential and session files used by AI coding assistants. Earlier versions focused on browser, cryptocurrency wallet and password manager data. Aoki is a relatively new and sparsely documented stealer, first observed earlier in 2026, and its AI-rel…
The Wiz Customer Incident Response Team (CIRT) reports a growing number of intrusions in which an AI agent system ran the entire operation: finding entry points, harvesting credentials, pivoting across platforms and debugging its own scripts in real time. In one investigated case, the agent compromised a large multi-cloud organization (GC…
Huntress analyzed an active credential-phishing campaign in which the lookalike domain watchguard-vpn.net harvests WatchGuard SSL VPN credentials. On October 7, 2026, an administrator at a managed service provider searched Bing for "watchguard vpn sll download" and clicked through to the fake page, which Huntress classifies as SEO poisoni…
Court records obtained by NPR show that TikTok employees repeatedly warned executives about risks the platform posed to minors, including sexual exploitation and exposure to suicide-related content. Employee depositions filed in March 2026 describe frustration with how leadership responded. Staff reportedly flagged minors appearing in sex…
Bullhorn, a US-based recruitment software provider serving more than 10,000 customers, disabled access to its platform after detecting a cyber incident on October 16-17, 2026. The company engaged CrowdStrike to investigate and restore services. Systems are back online in the UK, US and Australia, but as of October 20 some users still had …
Federal prosecutors say former OpenAI engineer Abdulrahman Alfozan, a 35-year-old Saudi national, was "mere days" from fleeing to Saudi Arabia before his arrest. A San Francisco federal judge (Alex Tse) denied his request for home confinement. Prosecutors allege he secretly installed an audio recording device in an executive conference ro…
WhatsApp help pages carried hidden instructions for its WhatsApp Support with AI chatbot. They told it not to recommend a data protection authority to users who could not delete their accounts, and not to cite privacy laws such as the GDPR once a user mentioned a lawyer, lawsuit or court. This contradicts WhatsApp's privacy policy for Eur…
An attacker pushed forged commits to the default branches of two unrelated GitHub projects, hugo-paper and mevn-cli. The commits add a preinstall hook (scripts/preinstall.js) that downloads and silently runs a second-stage script from buildwithknexus.xyz during npm install or bun install. The commits copy the author, date and message of t…
GhostAction has returned with an expanded credential-theft operation. By October 9, 2026, attackers had injected malicious GitHub Actions workflows into 790 repositories, according to OpenSourceMalware's validated total. The campaign was first documented by GitGuardian in 2025 (817 repositories, 3,325 stolen secrets). It relies on comprom…
A U.S. court on Monday granted the government's request to detain Abdulrahman Alfozan, a 35-year-old Saudi national and former OpenAI engineer, accused of planting a concealed audio recorder in an executive conference room at the company's San Francisco office. A prosecution filing says he was in frequent WhatsApp contact in 2025-2026 wit…
OpenCode disclosed on X on October 17 a security breach affecting 1.4% of its Console users, which it attributes to a "large-scale distillation attack". The affected accounts belong to users who had connected external providers. The company emailed affected users the following morning and says anyone who did not receive a notice was not i…
GreyNoise analyzed 147.8 million sessions over 103 days across 276 vendor-specific tags covering 18 network infrastructure vendors. It found that surges in scanning and exploitation activity regularly precede vendor advisories. Of 104 detected surges, 68 preceded a vendor-matched CVE (33 vulnerabilities across 16 vendor families), with a …
The NSA, CISA and FBI issued joint advisory AA26-251A warning that China-based AI companies are running industrial-scale knowledge distillation campaigns against U.S. frontier AI models. The named companies are DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. According to the agencies, they have extracted billions of tokens acro…
Hacktron researcher sudi disclosed a vulnerability in the browser extension bundled with Google's AI IDE Antigravity, which is built on the same internals as Windsurf. The extension's externallyconnectable setting allows any web page to send messages to it. The SaveScreenRecording action forwards attacker-controlled filename and L fields …
Researchers at Hacktron disclosed a chain in Metabase Cloud that began with a bypass of the sanitization Metabase applies to H2 connection strings and ended in exposure of secrets belonging to other tenants. Metabase strips or rejects INIT= in the H2 URL, but the INIT value could be supplied in a separate details field that was never sani…
A Hacktron researcher argues that AI-assisted vulnerability research is rapidly widening the enterprise attack surface. He cites recent breaches at Vercel and GitHub and a wave of critical CVEs in F5, Fortinet, Cisco, Palo Alto and ImageMagick. According to the author, the Vercel compromise began with a breach of the AI platform Context.a…
