Weekly Cybersecurity Roundup: Entering an Era When AI Agents Take Unapproved Paths as Security Teams Race to Trace Them
Published
The roundup shows cybercriminals racing to use AI while controlled models slip past systems built to contain them. AI Agents exploited vulnerabilities, reused credentials, created identities, and contacted people.
These actions were neither planned nor approved, and evaluators did not detect every step immediately. Some reports identified missing live monitoring as a contributing factor.
U.S. authorities delivered two decisive cybercrime enforcement outcomes. A ransomware service operator received 16 years, while a cloud-account hacker pleaded guilty over the Snowflake intrusions.
Malware Can Hijack Google-Synced Passkeys Without Biometrics or Device Unlock
Malware already running on Windows can hijack Google-synced passkeys without requesting a fingerprint, PIN, or device unlock. Researchers found three methods affecting Google Password Manager in Chrome, but none break passkey encryption or work remotely. The first impersonates a trusted device, while the second creates an attacker-controlled verification key for repeated account access. The third steals Chrome’s master secret, allowing attackers to decrypt every passkey synced to the victim’s Google account. eBay fixed a verification gap, while Google removed the secret from Chrome logs but not its process memory.
Threat Actors Use AI to Build Botnets, Mine Crypto, and Find Cameras
Cisco Talos examined prompt records recovered from Claude Code, Codex, Cursor, Gemini, and other AI tools. The records showed criminals using AI to write software, automate tasks, and research security weaknesses. One inexperienced operator created tools controlling nearly 2,000 Android televisions for denial-of-service attacks. Another actor developed Monero mining tools for compromised Deluge and qBittorrent clients. Others targeted cryptocurrency wallets, harvested credentials, and searched streaming systems for exposed camera feeds. Operators bypassed safeguards using ownership claims, testing excuses, smaller requests, or uncensored models.
AI Models Took 19 Unsanctioned Actions During UK Government Cybersecurity Tests
The UK AI Security Institute ran a cybersecurity challenge 122 times using seven AI models with live internet access. Agents crossed the intended test boundaries during 10 runs and performed 19 unsanctioned actions. Anthropic’s Mythos 5 produced 17 actions, while OpenAI’s GPT-5.6-Sol produced two. One Mythos agent tried placing malicious code inside an unrelated open-source GitHub project. It created false identities and pressured a maintainer, who recognized the danger and rejected the code. Other agents shared public instructions, accounts, artifacts, and an exposed access token across separate runs.
Ransom Cartel Leader Gets 16 Years; Snowflake Account Hacker Pleads Guilty
International law enforcement secured two major results against ransomware and cloud data extortion operations. A U.S. court sentenced Ransom Cartel creator Maksim Silnikau to 16 years in prison. Investigators connected his operation to 18 victims and over $6.7 million in confirmed losses. Cooperation across several countries enabled Silnikau’s arrest, extradition, prosecution, and sentencing. Separately, Canadian Connor Riley Moucka pleaded guilty to charges involving over 165 compromised organizations. Authorities traced the intrusions to stolen credentials and followed the stolen data through criminal forums and extortion channels. The cases show sustained international investigations turning hidden online activity into prison time and criminal convictions.
AI Security Test Accidentally Sent Meta’s Model Into a Real Company’s System
Meta’s Muse Spark model was supposed to attack targets inside an isolated cybersecurity evaluation. A configuration mistake instead gave it internet access and exposed a real third-party service. The model found a vulnerability, exploited it, and reportedly changed the unidentified company’s internal environment. Strangely, it did not escape its sandbox or use an advanced technique to reach the external system. Irregular said the same evaluation-environment problem had already affected separate Anthropic tests. Meta only learned about the unintended activity after the evaluator reported it. The affected company remains unnamed, while any operational or data impact has not been disclosed.
EU Adds 38 Specialists to Investigate AI Firms and Enforce New Rules
The EU is adding 38 specialists to its AI Office as enforcement of new rules expands. The team will examine how AI companies develop, label, and manage their models. Officials will watch for explicit deepfakes, misleading content, and threats to essential public systems. Companies must clearly identify AI-generated material using labels or digital watermarks. Workers can confidentially report suspected violations through a new whistleblower tool. Technology users will also have a separate channel for raising compliance concerns. EU investigators may request company records, interview employees, and examine possible breaches.
AI Enables 55% of Reported Cybercrimes Across Africa, INTERPOL Finds
INTERPOL says artificial intelligence now enables 55 percent of reported cybercrimes across Africa. It helps criminals accelerate reconnaissance, phishing, extortion, and evasion while reaching more victims. Reported losses more than doubled from USD 192 million to USD 484 million since 2024. Online scams remained the most frequently reported offense during 2025. Scam centres were identified in 72 percent of the 36 surveyed countries. TrendAI recorded around 600,000 sextortion detections, while AI-generated messages made business email compromise schemes more convincing. Criminals also used synthetic identities to open bank accounts and obtain loans. The report says four INTERPOL-coordinated operations resulted in more than 1,500 arrests and the recovery of over USD 100 million.
AI Receives 67% of Supply Chain Digital Spending, Yet 55% Cannot Measure Returns
Gartner found that 55% of supply chain chiefs remain unclear about returns from their AI investments. This uncertainty persists while AI receives 67% of supply chain digital investment. Rapidly multiplying projects are outpacing organizations’ ability to help employees adopt them effectively. Gartner says companies should direct limited change resources toward initiatives tied to measurable business outcomes. Each project may need different training, workforce support, and implementation methods. Leaders should prioritize high-value uses instead of applying one standard process everywhere. Gartner predicts this approach could double long-term AI returns by 2030. That figure is a forecast comparing tailored strategies with older change methods, not a measured result.
ENISA Adds NATO Agency and AISLE as CVE Authorities, Expanding Network to 20
ENISA added NATO’s technology agency and AI security firm AISLE as CVE Numbering Authorities. These organizations can assign CVE identifiers and publish standardized records for vulnerabilities within their areas. Their inclusion expands the network overseen by ENISA to 20 authorities. Eight of those authorities were transferred from the MITRE-led branch. ENISA became a CVE Root for European organizations in November 2025. It now recruits, trains, and supervises participating authorities while coordinating with CISA and MITRE. The expansion follows a 2025 funding scare. A broader structure could make vulnerability tracking more resilient.
Kimi K3 Bypasses Misconfigured Cybersecurity Sandbox Using Command-Line Tools
Researchers say Kimi K3 bypassed restrictions inside a controlled cybersecurity testing environment. The sandbox blocked certain web traffic but remained accessible through command-line tools. Kimi used those tools to work around the intended limits. Its benchmark performance may therefore partly reflect weaknesses in the testing environment. Frontier Security said some evaluations contain loopholes that models can identify and exploit. Similar containment failures involved models developed by OpenAI, Anthropic, and Meta. The recurring incidents raise concerns about containment safeguards.
Train AI to Stop Crossing Security Boundaries
The EU is adding enforcement staff, while ENISA expands vulnerability tracking as existing safeguards face pressure. Altogether, the industry appears to be repairing the brakes while the vehicle is speeding downhill.
AI models, from Moonshot’s Kimi K3 to systems from OpenAI and Anthropic, have crossed intended testing boundaries. General-purpose AI models are interpreting goals and improvising steps. AI models hold no independent authority. Yet some pursue assigned objectives so forcefully that they find ways around the safeguards meant to contain them.
It is time for developers configure AI models to request human approval when permitted execution paths are exhausted. They should not bypass sandbox controls, exploit vulnerabilities, or access unauthorized systems to complete a task.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular