cyber

OpenAI announced that it is opening its AI vulnerability detection tool Daybreak to Ukraine's Ministry of Digital Transformation to locate and fix software vulnerabilities before they are discovered by Russian hackers. The news was announced on Wednesday during the United Nations General Assembly by Dmytro Kushneruk, Ukraine's Consul General in San Francisco, and Sasha Baker, OpenAI's National Security Policy Lead.Daybreak is based on OpenAI's flagship large model GPT-5.6 Sol and can scan outdated systems for weaknesses, verify whether suspected vulnerabilities can be exploited, and confirm whether patches actually close the vulnerabilities before they are released. OpenAI has previously opened the model to cybersecurity agencies in France, Germany, and Poland, where Poland's CERT Polska discovered six vulnerabilities in commercial router software, all of which have been fixed by the vendors.Ukraine's CERT-UA handled nearly 6,000 cyberattacks in 2025, a 37% increase from 2024, with local governments and government agencies being the hardest hit. This opening follows OpenAI's commitment to a $1 billion subsidy program announced on September 3, which is said to expand to "partner countries" in the coming weeks. Jamie MacColl, a researcher at the Royal United Services Institute, told the BBC that Western companies can also gain valuable intelligence from active conflict zones.

According to The Information, citing informed sources, China's National Internet Information Office has launched an investigation into AI companies DeepSeek and Moonshot AI, triggered by Anthropic's allegations that the two companies secretly routed sensitive user data to their servers. Reports indicate that regulators visited the offices of both companies, interviewing executives and employees, focusing on whether sensitive data related to law enforcement, military, and state-owned enterprises has flowed into U.S. servers.The trigger for this investigation was Anthropic's fourth threat intelligence report released on September 10. This 154-page document accuses seven Chinese labs—Alibaba, Moonshot AI, DeepSeek, Z.ai, MiniMax, SenseTime, and Xiaomi—of engaging in what it calls "illegal distillation," which involves using the outputs of large models to train smaller models. Anthropic states that distillation itself is a legitimate practice, but it opposes its implementation through fraudulent accounts. The National Internet Information Office initially summoned all seven companies named in the report, but later narrowed the investigation to DeepSeek and Moonshot AI. Anthropic claims that Moonshot AI routed over 23 million interactions to Claude through 5,380 fraudulent accounts, while DeepSeek generated over 12.1 million interactions within a 14-day window in July.The timing of the investigation is quite delicate for both companies.

ChainCatcher and Nonce jointly hosted the Nonce × GWDC 2026 Innovation Forum. This forum will be held on September 29, 2026, at AT CENTER in Seoul, South Korea, focusing on stock tokenization, Web3 finance, and AI applications.Cyber Prophet, as a co-organizer, will bring AI predictions, event trading, and on-chain finance topics to the live event in Seoul. Cyber Prophet is an AI-driven global prediction market platform built on Polygon, covering probability trading for events in politics, economics, crypto assets, sports, technology, and more, while providing AI decision support, liquidity collaboration, and multi-chain prediction market experiences.The GWDC Korea event is expected to attract 5,000 participants, with guests and institutions such as Sun Yuchen, Microsoft, Bithumb, and Animoca Brands also in attendance. For Cyber Prophet, this live event is beneficial for clarifying the use cases of prediction markets and AI decision-making.

According to a joint alert issued by the Japanese National Police Agency, FBI, ASD/ACSC, BND, and BfV, the North Korean-backed cyber attack organization "WaterPlum" (also known as Contagious Interview) targets job seekers by disguising itself as an AI, cryptocurrency, and NFT company to post fake job listings. This lures job seekers into downloading NPM packages containing malware such as BeaverTail, InvisibleFerret, and OtterCookie, which then steal cryptocurrency wallet information and confidential data.As of July 2026, the organization has infected over 30,000 devices in more than 100 countries and regions worldwide, stealing information from over 7,000 cryptocurrency wallets, with the wallets under its control receiving at least approximately 1.7 billion yen (about 10.71 million USD) in cryptocurrency. The Japanese National Police Agency has discovered and dismantled a "notebook farm" established by local "supporters" for the first time in the country, where North Korean IT laborers remotely control PCs within the supporters' residences to conduct business, with the related amount involved reaching several hundred million yen.The police and FBI assess that WaterPlum and some North Korean IT laborers are under the unified command of the 313 Bureau of the Ministry of Military Industry of the Workers' Party of Korea, with the profits directly flowing into North Korea's national funding pool. The police remind IT technicians and corporate issuers to remain vigilant and avoid executing third-party code in unverified environments.

Ethereum founder Vitalik Buterin stated that he disagrees with the common view that "AI hackers mean cybersecurity is doomed to fail." He believes that once people clarify their thoughts, cybersecurity naturally leans towards the defensive side, and anyone who continues to hold cryptocurrencies (including himself, with about 90% of his net worth) is implicitly betting on this point.Vitalik stated: If AI can prove the Navier-Stokes equations and Fermat's Last Theorem, it can also prove "this program is secure" as a mathematical theorem, even if the program is very complex. He used the encrypted communication application Signal as an example to illustrate that the definition of "security" is extremely complex, covering forged messages, active interference, server breaches, key leaks, hardware side channels, and more. The definition is smaller and more composable than the attack surface, and verifying whether the definition is sufficient is more feasible than directly scanning the code.He pointed out that historically, failures often occur because only the self-identified critical parts of security are verified while neglecting the rest of the code. Today, the entire program must be verified, including the database, network, and cache layers, which modern AI can achieve. This is not a competition to see who discovers vulnerabilities first, but rather to make the code itself more resilient. Vitalik stated that this is the direction for Ethereum in the coming years; without this step, especially for blockchains with scalability and privacy, there is no future. It is necessary to make the software truly secure, and significant progress has already been made.

User MaxForAI stated that the National Internet Information Office recently reported a case of illegal API relay station. On September 15, the Internet Administration of China announced a batch of internet law enforcement cases, where two websites operated by a technology company in Jiangsu used an API relay station to call multiple large model product interfaces, providing services such as dialogue and Q&A without conducting safety assessments as required, posing content safety risks, and violating the "Interim Measures for the Management of Generative Artificial Intelligence Services" and other regulations.The local internet information office ordered rectification, imposed strict penalties on those responsible, and issued a warning. The user mentioned that the above description aligns with the details of the large model relay platform "Zhixin Token" launched by Jiangsu Biying Technology under Suning.com in July this year, which aggregated multiple mainstream large models to provide a unified API service through two service domain names.

Rome-based Physical AI cybersecurity company Exein announced the completion of a new funding round of 234 million euros (approximately 270 million dollars), with a valuation of 1.4 billion euros (approximately 1.7 billion dollars), making it the highest-valued cybersecurity startup in Europe.This funding round was led by Headline, with participation from Sofina, Goldman Sachs, the European Investment Bank Group, KfW Capital, and T.Capital, while J.P. Morgan simultaneously expanded its revolving credit facility.

According to Cointelegraph, the European Union's Cyber Resilience Act (CRA) officially came into effect on September 11, requiring cryptocurrency hardware and software wallet providers to submit early warning reports within 24 hours upon discovering actively exploited vulnerabilities or serious security flaws, and to submit complete notifications within 72 hours. Manufacturers must also submit final reports within 14 days after taking corrective or mitigating measures, while serious incidents must be reported within one month.The European Commission stated that the new reporting requirements aim to better protect consumers and businesses from cyber threats, applicable to all "products with digital elements" sold in the EU market, and are built upon the EU's broader cybersecurity strategy. According to the penalty provisions of the final draft, companies that fail to comply with Articles 13 and 14 may face administrative fines of up to €15 million (approximately $17.3 million) or 2.5% of their global annual turnover, whichever is higher; providing incorrect, incomplete, or misleading information may also incur fines of up to €5 million.Before the implementation of this measure, several hardware wallet manufacturers recently disclosed incidents of user data breaches. On September 4, Trezor revealed that a data breach involving its logistics provider ShipMonk affected approximately 67,000 U.S. customers, exceeding the initial estimate of 14,000; this week, Trezor and BitBox also warned users to be cautious of phishing emails disguised as urgent security notifications. In June, the Layer-1 blockchain network Zilliqa warned of vulnerabilities in its Ledger application, where attackers could exploit publicly available on-chain data to recover user private keys.

Tesla announced that the Cyber Autonomous Driving Vehicle Cybercab will be publicly showcased from September 17 to 27 in Beijing and Shanghai, with static displays at the Tesla Experience Store in Beijing Huamao and the North Hall on LG1 level of Shanghai Xinyetai Guohui.

In a threat intelligence report released on Thursday, Anthropic stated that Russian and Chinese users are leveraging its AI model Claude to automate cyberattacks. Among them, a Russian operator codenamed "JackPoterz" has automated most parts of the attack chain through a customized AI-driven workflow, targeting over 20 organizations, including government departments and intelligence agencies, as well as embassies and diplomatic missions in Ukraine and several European countries.Chinese users are using Claude as the engineering and orchestration layer for vulnerability research, with one workflow producing more than a dozen potential zero-day vulnerabilities in network device firmware within a month. Anthropic pointed out that AI is changing the economics of cyberattacks, allowing a single operator to complete an intrusion in two to three hours and handle dozens of victims in parallel.Additionally, the report revealed that a suspected independent consultant based in Bamako, collaborating with Mali's national intelligence agency, has used Claude as the primary engineering force to build a large-scale domestic surveillance system covering approximately 25 million SIM cards across all three mobile operators in the country. This system is locally deployed and operates using local models, with software design and engineering support provided by Claude, enabling the generation of intelligence profiles on phone numbers without the need for court warrants.

NVIDIA co-founder and CEO Jensen Huang stated on Thursday at the Goldman Sachs Technology Conference in San Francisco that cybersecurity is likely to become the next major use case for artificial intelligence.Huang mentioned that cybersecurity is the next big market for artificial intelligence, and advancements in this technology will disrupt an industry aimed at protecting computer systems.

According to Catcher Predict monitoring, in the market prediction on Polymarket for the event "Counter-Strike: Nuclear TigeRES vs CYBERSHOKE Esports (BO3) - 1win Private Club #1: Closed Qualifier Playoffs," the sub-market "Map 1 Total Rounds: Over/Under 21.5" has seen a drastic fluctuation in the win rate of the "Over" option, plummeting from 47.5% an hour ago to the current 30% (a fluctuation of 17.5%). Please note the impact of relevant breaking news.

The Central Cyberspace Affairs Commission, the National Development and Reform Commission, the Ministry of Industry and Information Technology, the Ministry of Ecology and Environment, the Ministry of Housing and Urban-Rural Development, the Ministry of Agriculture and Rural Affairs, and the Ministry of Commerce jointly issued the "Implementation Plan for Promoting Coordinated Transformation and Development of Digitalization and Greening (2026-2030)", proposing to advance the coordinated transformation of digitalization and greening during the "14th Five-Year Plan" period.The plan emphasizes empowering green and low-carbon transformation with digital intelligence technology, achieving low-cost and high-efficiency applications of artificial intelligence by 2030, significantly improving the energy efficiency of computing facilities and 5G base stations, promoting renewable energy electricity consumption in key areas such as computing facilities to reach the responsibility weight level of the respective provinces, and deepening the digital and green applications in agriculture, manufacturing, trade, consumption, and urban operation, strengthening intelligent governance of the ecological environment and digital carbon management, and solidifying the foundation for coordinated dual transformation and international cooperation.

According to CoinDesk, OpenAI stated that it will provide access to $1 billion worth of Daybreak cybersecurity model subsidies over the next six months, along with training and technical support to help organizations defend against AI-driven cyberattacks, including potential "zero-day" exploits.Daybreak is divided into two tiers, Blue and Red, which are used for routine defense and more sensitive cybersecurity tasks, respectively. Currently, about 2,000 organizations are using it. OpenAI previously disclosed that its new model Astra can discover unknown software vulnerabilities and generate attack plans with less human intervention, raising concerns in the crypto industry about the security capabilities of open-source blockchain software.

On September 3 local time, Tesla held a Cybercab launch event in Austin, Texas, USA. This vehicle is a mass-produced model designed for autonomous driving scenarios, eliminating the steering wheel, pedals, and traditional rearview mirrors, and adopting a two-seat layout, with driving entirely controlled by Tesla's autonomous driving software. The Cybercab was unveiled as a concept car at the "We, Robot" event in October 2024, with the first mass-produced vehicle rolling off the line at the Texas Gigafactory in February this year, and mass production starting in April, taking about 18 months from concept to mass production.The vehicle relies on 8 high-definition cameras to perceive the environment and makes driving decisions through an end-to-end neural network, without relying on lidar and high-precision maps. According to Tesla's data, as of September 2026, the global fleet's cumulative assisted driving mileage has exceeded 22.5 billion kilometers. In terms of energy efficiency, it is expected to travel 9.8 kilometers per kilowatt-hour, with an energy consumption of about 10.2 kilowatt-hours per 100 kilometers. The curb weight is 1412 kilograms, equipped with a 47.6 kilowatt-hour battery pack and a 163-kilowatt motor, with a laboratory range of 673 kilometers. After scaling up ride-hailing operations, the cost per mile can be reduced to $0.2, equivalent to about 0.84 yuan per kilometer.The Cybercab will be showcased in multiple cities such as Beijing and Shanghai starting in mid-September. This exhibition does not involve the sale of the vehicle in China, nor does it represent that Tesla will conduct autonomous ride-hailing commercial operations domestically.

According to Techcrunch, cybersecurity giant Palo Alto Networks announced the acquisition of AI Agent startup Console for $500 million in cash and stock. Founded in 2024, Console uses AI Agent to automate tasks such as password resets, application permission grants, and daily IT troubleshooting, with clients including Ramp, Flock Safety, and Scale AI.Palo Alto Networks plans to integrate Console into its AI-driven security platform Cortex, enabling security teams to investigate and handle security alerts through natural language, achieving more automated enterprise security operations.It is reported that this is also the seventh acquisition completed by Palo Alto Networks this year, having previously acquired Chronosphere at a valuation of $3.35 billion and the cybersecurity startup Koi for $400 million.

OpenAI stated that its upcoming Astra model can autonomously discover previously unknown software vulnerabilities and convert them into usable attack vectors without human intervention, making it the company's first model to reach the "Critical" cybersecurity capability level threshold. In a blog post released on Tuesday, OpenAI mentioned that according to its Preparedness Framework, reaching this level means the model can discover zero-day vulnerabilities and develop usable exploit code in hardened real systems without human involvement, or design and execute attacks based solely on a high-level objective.In testing, Astra achieved a 100% score in benchmark tests for developing exploit code based on known vulnerabilities and discovered two previously unknown vulnerabilities in another internal test. Additionally, the model successfully broke through a hardened browser sandbox and executed commands on the host machine, while gaining root access by exploiting multiple weaknesses in the operating system. OpenAI stated that it has delayed some of Astra's development progress to enhance security measures and plans to make its advanced cybersecurity capabilities available only to selected testers.This capability is particularly relevant to the cryptocurrency industry, as software vulnerabilities can be converted into financial losses within minutes. CoinDesk reported in June that increasingly powerful AI models can compress the process of searching code, discovering misconfigurations, and assembling attacks from days or weeks to machine speed. Security researchers noted at the time that the significant change was not the emergence of new categories of attacks, but rather the dramatically increased speed at which existing vulnerabilities are discovered and exploited.

According to GMGN monitoring, the Solana ecosystem's meme coin CYBERLEEK, issued by the GTA 6 hacker, has risen over 40% in the past 4 hours, with a market cap recovering to $14.5 million.The hacker organization claiming to be Cyberleek launched the Solana chain meme coin CYBERLEEK by leaking clips of the game "GTA 6," and claims to release a PC download client for GTA 6, allowing everyone to play this $2 billion blockbuster without spending a dime (the client claim has now been debunked). On August 22, Cyberleek publicly destroyed about 270 million developer-reserved tokens, accounting for approximately 27% of the total supply, claiming it "proves they won't dump and run," but still retains a large number of tokens and continues to profit from transaction fees.For more detailed reports, see "The hacker who leaked GTA 6 issued a coin, rising 20 times in one day." According to market news, meme coins generally have no practical use cases, and price fluctuations are significant, so investment should be approached with caution.