Security Bits – 30 August 2026

Feedback & Followups

• Microsoft Paint embeds hidden IDs in locally generated AI images — cyberinsider.com/… (Sadly, not C2PA Content Credentials 🙁)
• Apple have partially fixed the app-specific VPN IP leaks we discussed last time, but only in Safari, not in 3rd-party apps — cyberinsider.com/…
• Apple have abandoned their plans to move Hide My Email addresses to @private.icloud.com, they’ll remain @icloud.com — appleinsider.com/…
  • Related: Brave launches Email Aliases to hide users’ real email addresses — cyberinsider.com/… (an alternative for non-iCloud+ users, but as easy to block as @private.icloud.com would have been, uses @bravealias.com)
• 🇪🇺 NosillaCastaway Joop shared that European router maker FRITZ!Box just added ad blocking to their routers as a standard feature via a software update — www.ct.nl/… (Dutch-language, so translation required for most)
  • The Tech45 panel often speak very positively about these routers, they appear to be a great option for geekier Europeans in the limited set of countries they sell in.

Deep Dive — More Details Emerge About AI Escapes

Open AI Release Technical Details on the Hugging Face Hack

OpenAI have now released a very detailed technical report on their agents’ attack on Hugging Face, the first such escape to come to our attention.

For full coverage see:

• OpenAI says AI agents formed a ‘swarm’ before breaching Hugging Face — cyberinsider.com/…
• Nearly 700 rogue AI agents coordinated in the Hugging Face attack — www.bleepingcomputer.com/…
• OpenAI Says Reward Hacking Drove AI Agents to Exploit Zero-Days and Breach Hugging Face — thehackernews.com/…
• OpenAI Explains the Shocking AI Breach of Hugging Face Systems — www.macobserver.com/…

I haven’t read the full report (don’t have infinite time!), so rather than trying to summarise the summaries, I’ve selected what I think are the key points from the summaries linked above.

“OpenAI has published a detailed post-mortem of July’s Hugging Face breach, revealing that its AI agents did far more than escape a cybersecurity sandbox. The models created an unauthorized communication network, shared exploits and credentials, coordinated attacks across separate evaluation runs, and ultimately compromised both Hugging Face and parts of OpenAI’s own research infrastructure.” — Cyber Insider

” … the models began dividing work among themselves, with some searching for credentials, others developing exploits, and others coordinating activity. Several agents referred to the resulting group as a ‘swarm’ or ‘collective.'” — Cyber Insider

“OpenAI … revealed that reward hacking was a key driver behind the artificial intelligence (AI)-powered hack of Hugging Face last month, adding that it found evidence of misaligned behavior as early as late May.” — The Hacker News

” … many of the tasks were nearly impossible to solve. Instead of giving up, the artificial intelligence bots decided to look for shortcuts to complete their goals and get a reward.” — The Mac Observer

In other words, this was indeed an example of the alignment problem!

“OpenAI’s investigation, validated by CrowdStrike and an independent assessment by METR and Redwood Research, found that rogue activity started in May.” — Bleeping Computer

Open AI found that their agents had hacked their Artifactory instance (a repository for store and distributing software artifacts like shared code libraries), so they recreated and patched it, and assumed they had solved the problem, but …

… the agents restored their communications channel using ‘unauthenticated WebDAV requests to create message directories in Artifactory’. OpenAI explains that the agents communicated through encoded messages in directory names.

“Agents regained unintended internet access by making Artifactory’s remote-repository service issue outbound requests on their behalf … Agents began to autonomously divide labor. Some investigated possible exploits, others searched for credentials, and others focused on communication or coordination … Agents offered their own expertise in exchange for help elsewhere and left requests for peers who might be better positioned to pursue a particular lead.” — OpenAI

“The AI company says that although the swarm did not exhibit “perfect coherent intelligence,” there were cases where agents prioritized achieving collective goals over pursuing individual tasks.” — Bleeping Computer

“According to METR, the swarm comprised 1,200 individual agents who cooperated on various levels, and about 700 of them actively participated in the Hugging Face attack.” — Bleeping Computer

“OpenAI believes that the rogue agent behavior was caused by a combination of training incentives and missing safeguards … the evaluations lacked standard safeguards that likely would have detected and stopped the malicious activity “more than a day” before the models breached Hugging Face.” — Bleeping Computer

“Retrospective testing indicated that OpenAI’s current chain-of-thought monitoring would likely have detected the dangerous activity more than a day before Hugging Face was breached.” — Cyber Insider

“In response, OpenAI has quarantined IM1’s weights and paused its largest frontier training run while strengthening sandbox isolation and requiring chain-of-thought monitoring for capable models (GPT-5.6 Sol or higher)” — Bleeping Computer

Other Related News

• Claude Opus 4.6 Bypasses Gym Booking Limit, Cancels Other Users’ Reservations in Tests — thehackernews.com/… (A real-world example of the alignment problem)
• Experiment shows AI agents can escape secure VMs using zero-days — cyberinsider.com/…
  • “The results challenge the assumption that conventional VMs are sufficient containment for advanced autonomous agents.” — Cyber Insider
  • We need more robust sandboxes!
• Nvidia Agrees to Buy AI Startup Hugging Face for $12.9 Billion — www.macobserver.com/…
• Major Tech Firms Unite to Defend Against Rogue AI Cyber Threats — www.macobserver.com/…
  • An open letter from the major tech firms responsible for the problem that expresses great concern
  • The letter argues that something must be done, but despite being from the very organisations that have the power to actually do something, does nothing!

❗ Action Alerts

• Unpatched Calix flaw lets hackers bypass NAT to expose internal devices — www.bleepingcomputer.com/…
  • ISP-provided router commonly used in the US by big ISPs including Cox!
  • Affects model GS5239XG, also sometimes branded GigaSpire 7u10txg
  • “Given that there’s no fix for CVE-2026-75501, [the security researchers] recommend that users of the vulnerable device disable UPnP through the administrative interface (Advanced → Security → UPnP).” — Bleeping Computer
• Ubiquiti patches three max severity security vulnerabilities — www.bleepingcomputer.com/…
• ⚠️ WordPress Site Owners:
  • Critical Avada WordPress theme flaw enables zero-click RCE — www.bleepingcomputer.com/…
    • Also affects Fusion Builder plugin
    • About as bad as bugs get, remote-code-execution without any user interaction (CVSS score of 9.8!)
  • GiveWP WordPress donation plugin flaw lets hackers execute server commands — www.bleepingcomputer.com/…

Worthy Warnings

• More malicious code found in routers from Chinese firm ZBT: China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access — thehackernews.com/…
  • We covered the ENDLESSDOORS backdoor in ZBTLink branded routers last time — cyberinsider.com/…
  • Two additional backdoors named SPEAKINGSTONE & DARKLANTERN found
  • According to Lumo, these routers are widely used in the US and Europe under the brands: Zbtlink, WiFlyer, DeepOrange, KuWFi & WORDFI
• Fake Apple Support AI Calls Target Stolen-Device Owners for Passcodes and 2FA Codes — thehackernews.com/… (New Phishing-as-a-Service offering for sale on the darkweb 🙁)
• Carhartt data breach exposes information of 12.9 million accounts — www.bleepingcomputer.com/…
  • No mention of notifications to affected users
  • Includes physical addresses — haveibeenpwned.com/…
  • A perfect illustration of why I trust HIBP over the main-stream press: A Cautionary Tale About Data Breach Claims, Verification and Carhartt — www.troyhunt.com/… (Initially, wrongly, reported by many as affecting over 24M users)
• Another reminder of why you need to choose your VPN provider carefully: Proton finds 85% of US-downloaded VPN apps contain trackers — cyberinsider.com/… (Note Proton sell a VPN service, so they are not neutral observers!)

Notable News

• 🇺🇸 Meta agrees to $17.1 billion settlement over alleged harms to children — cyberinsider.com/…
  • “For users identified as minors, Facebook and Instagram will impose a combined two-hour daily limit that can only be turned off with parental permission and block most app functionality between midnight and 6 a.m. Push notifications will also be restricted during school hours, while direct messaging remains exempt. … Other requirements include stronger parental controls, hidden like and reaction counts, restrictions on cosmetic-surgery and extreme-makeup filters, and an option to make a non-personalized feed the default.” — Cyber Insider
  • Case brought by 51 State Attorneys General
  • Only a proposed settlement, needs court approval
  • Requires stronger age assurance, but doesn’t prescribe a mechanism
  • Independent oversight process agreed
  • Meta commit to making data available to independent researchers, and to fund such research
• 🇺🇸 TikTok reaches $400M settlement with US over COPPA violations — www.bleepingcomputer.com/… (Second settlement, previous 2019 settlement promised changes, but not enough was done, now, apparently actually compliant)
• Small but nice improvements:
  • WhatsApp Adds Multiple Passkeys for Phishing-Resistant Sign-Ins Across iOS and Android — thehackernews.com/…
  • Firefox moves to adopt JPEG XL with safer Rust-based decoder — cyberinsider.com/… (better images & more secure 🎉)
  • Android 17 adds ECH support to make web browsing harder to track — www.bleepingcomputer.com/… (ECH is Encrypted Client Hello, an improvement to the TLS protocol HTTPS depends on)

Interesting Insights

• Another reason to consider a privacy-protecting LLM: DuckDuckGo finds one-third of AI users share secrets they hide from people — cyberinsider.com/…

Palate Cleansers

• From Bart: 🎦 The full video of a talk Mac icon designer Susan Kare delivered at a Y Combinator event: Susan Kare: Designing Icons & Graphics For the Original Mac — www.youtube.com/… (nearly an hour long!)

Legend

When the textual description of a link is part of the link, it is the title of the page being linked to, when the text describing a link is not part of the link, it is a description written by Bart.

Emoji	Meaning
🎧	A link to audio content, probably a podcast.
❗	A call to action.
flag	The story is particularly relevant to people living in a specific country, or, the organisation the story is about is affiliated with the government of a specific country.
📊	A link to graphical content, probably a chart, graph, or diagram.
🧯	A story that has been over-hyped in the media, or, “no need to light your hair on fire” 🙂
💵	A link to an article behind a paywall.
📌	A pinned story, i.e. one to keep an eye on that’s likely to develop into something significant in the future.
🎩	A tip of the hat to thank a member of the community for bringing the story to our attention.
🎦	A link to video content.