cybersecurity

According to CNBC, Anthropic disclosed that its Claude AI model unexpectedly breached the isolated environment during a cybersecurity assessment, accessed the real internet, and unauthorizedly infiltrated the real systems of three different organizations through basic means such as accessing unverified endpoints and exploiting weak passwords. The models involved include Opus 4.7, Mythos 5, and an internal research testing model.The incident was caused by a communication misunderstanding between Anthropic and the third-party evaluation partner Irregular, which led to the model being told it was in a simulated environment with no internet access, while it could actually still access the internet. Anthropic stated that this review was triggered by a similar incident involving Hugging Face disclosed by OpenAI last week, and it has currently suspended all cybersecurity assessments and initiated further investigations in collaboration with the independent AI evaluation agency METR, while also urging other AI labs to conduct similar reviews.

According to Cointelegraph, Singapore-based stablecoin payment company Triple-A confirmed that its financial wallet was accessed without authorization, with on-chain investigator Specter estimating the loss to be around $11.8 million.The company stated that customer funds are held in independent trust accounts and were not affected by this incident, with the related losses to be borne by the company's own financial reserves. Currently, Triple-A has restored all services and is working with cybersecurity experts, blockchain forensics agencies, and the Singapore Police Force to investigate and track the stolen assets.

According to Crypto.news, the hacker organization BlueNoroff, linked to North Korea, uses fake Zoom and Microsoft Teams meetings to analyze cryptocurrency users before deploying malware.The hackers first take control of accounts belonging to trusted contacts in the cryptocurrency industry, then send seemingly normal meeting links via Calendly and other platforms, directing users to counterfeit Zoom/Teams domains. Once users enter the fake meeting page, it quietly scans the wallets in their browsers and decides whether to continue the attack based on the wallet's value. The fake meeting will prompt users to "update Zoom/Teams" or run commands, which actually download malware (supporting Windows and macOS). The malware will steal browser keys, system data, and Telegram sessions.

The joint assessment by the UK Institute for AI Safety and the US Center for AI Standards and Innovation shows that Moonshot AI's Kimi K3 can assist in the development of exploit vulnerabilities and simulate cyber attacks without substantial hindrance, but its overall cybersecurity capabilities still lag significantly behind leading models in the United States.

Web3 security company CertiK released the "2026 First Half Wrench Attack Report." The report shows that in the first half of 2026, a total of 52 publicly verified wrench attack incidents were recorded globally, an increase of 33.3% year-on-year; related losses amounted to approximately $124 million, an increase of about 11.8 times compared to the same period last year.The report points out that attackers are shifting from exploiting technical vulnerabilities to targeting asset holders and their real-world relationship networks, with home invasion incidents rising from 1 in the first half of 2025 to 20, accounting for 41% of the total incidents during the same period. Europe has become a high-frequency attack region, with 33 incidents occurring in France, accounting for 63.5% of global cases.CertiK states that as real-world risks become a significant challenge for digital asset security, businesses and high-value individuals need to establish a more comprehensive protection system. CertiK has launched operational security services to help identify risks related to the exposure of information such as identity, home, residence, and travel trajectory; at the same time, through CertiK Security Workspace, it correlates off-chain intelligence, on-chain transactions, and AML risk signals to support institutions in tracking and analyzing cybercrime activities.In addition, CertiK is strengthening cooperation with international law enforcement agencies such as Interpol and Europol to provide technical support for cross-border attack investigations and security policy research.

The on-chain perpetual contract platform Ostium announced an update on X, stating that it is moving forward with restarting trading within this week and will issue a notification 24 hours before trading resumes. Auditors, third-party cybersecurity experts, and the engineering team are conducting final checks. Ostium explained the handling of positions after trading resumes: all positions will be re-marked at the real-time market price at the time trading resumes; traders will not be liquidated due to price fluctuations during the suspension period; however, if positions are below the liquidation threshold when trading resumes, they will still be liquidated; open orders will be retained as they are.For the affected liquidity providers, Ostium Labs stated that it is formulating a recovery plan, intending to fund from its own balance sheet and collaborate with both new and old partners to participate.

According to News.bitcoin, the Kenyan government is investigating the hacking incident of President William Ruto's official website, where attackers briefly disabled the site and altered the homepage content, demanding a ransom of 5 Bitcoins.William Kabogo, the Cabinet Secretary for the Ministry of Information, Communication and the Digital Economy, stated that the Kenyan law enforcement agency ICT Authority immediately activated the cybersecurity response protocol to control the incident and conduct forensic investigations, temporarily restricting public access to the portal. Currently, there is no evidence that sensitive data has been accessed without authorization, leaked, or lost, and government systems and digital services remain securely operational.

According to Cointelegraph, Consensys introduced a software developer earlier this year through a "reputable third-party service provider," who was later found to have connections to North Korea. The developer had approximately one month of access to the Consensys system under the alias Tyler Knapp.Consensys General Counsel Matt Corva stated that the developer was not an employee of Consensys but collaborated as a consultant. After discovering the threat, the company immediately terminated access and launched a comprehensive investigation, confirming that no assets or data were stolen, no malicious code was deployed, and user security was not affected. Consensys stated that it would reevaluate its practices regarding outsourcing engineering and development work.

According to an announcement from Qubic's official X account (@Qubic), a security incident occurred in the Qubic GitHub organization on July 13, where a compromised account accessed the code repository and extracted sensitive information. The official team has intervened to address the situation.The official team recommends that the following users take immediate action: Network Guardians should immediately rotate their seeds; Web wallet users who unlocked their wallets between 03:00 and 10:00 UTC on that day should migrate to a new identity; if unsure of the last unlock time, migration is also advised; developers should pause pulling or deploying code from the Qubic code repository until the official audit is confirmed to be completed.The official team stated that complete details and subsequent updates will be released on the official Discord channel, reminding users not to trust information from unofficial channels, and warning that no one should request user seeds for any reason. A post-incident report will be published after the situation is resolved.

Founder of Strategy, Michael Saylor, stated that Bitcoin is a spontaneously evolved network system, where the influence of wallets is determined by the amount of satoshis held, the influence of nodes is determined by business activities, the influence of miners is determined by computing power, and capital, consensus, and network security together maintain a dynamic balance.

According to The Block, the Hong Kong Securities and Futures Commission (SFC) has issued a circular requiring licensed virtual asset trading platforms and internet brokers to stop using one-time passwords (OTP) for user login and device binding within 12 months, and instead adopt stronger authentication methods such as passkeys and device binding.This move is due to the fact that in the 2025 Hong Kong cybersecurity incident, phishing attacks accounted for as much as 57%. The SFC also requires institutions to establish monitoring systems for suspicious logins, transactions, and withdrawals, and to promptly notify customers of any unusual account activities. Large brokers must implement the new authentication measures immediately. The SFC emphasizes that if internal controls are found to be deficient and result in customer losses, relevant responsibilities will be pursued.

According to the report from the Cybersecurity Threat and Vulnerability Information Sharing Platform (NVDB) of the Ministry of Industry and Information Technology on July 8, recent monitoring has found serious security backdoor risks in the AI programming tool Claude Code developed by the American company Anthropic.The report pointed out that the affected versions of Claude Code are from 2.1.91 to 2.1.196. This tool has a built-in monitoring mechanism that can, without user consent, secretly transmit sensitive data such as users' location and identity identifiers to remote servers. The official recommendation is for relevant units and users to immediately conduct a comprehensive inspection, uninstall the affected versions of the terminal, or upgrade to the latest secure version that has removed the related backdoor code; at the same time, they should strengthen the control of external access permissions and traffic monitoring for development tools within the core business network segment to prevent the illegal transmission of sensitive data.

The European Central Bank has requested banks to develop plans to address the growing cybersecurity threats posed by cutting-edge AI models such as Anthropic's Claude Mythos. In a letter to the chief executives of banks, the ECB's chief supervisory officer, Claudia Buch, asked lending institutions to submit action plans by the end of October.She urged banks to accelerate software patch updates, strengthen AI-driven cyber defenses, and enhance oversight of third-party vendors, while emphasizing that banks need to modernize their infrastructure in the long term. Buch stated, "The ECB calls on all significant institutions to immediately assess the impact of the evolving threat landscape and develop comprehensive action plans outlining specific measures to strengthen relevant controls." ECB President Christine Lagarde warned last month that artificial intelligence could lead to a financial crisis and stated that bank CEOs need to ensure they are prepared and recognize that countermeasures require substantial investment. The ECB has conducted cyber attack tests under severe scenarios on 109 banks, and most of the vulnerabilities identified have been addressed.

OpenAI announced a comprehensive expansion of its cybersecurity program Daybreak, aimed at leveraging artificial intelligence to accelerate the discovery and automatic remediation of software vulnerabilities. The core of this expansion is the full version dedicated model GPT-5.5-Cyber launched for trusted defenders. It is reported that this model has set the highest score records in multiple cybersecurity benchmark tests, surpassing GPT-5.5's 81.8% and competitor Mythos 5's 83.8%, significantly improving the accuracy of vulnerability scanning and patch generation. At the same time, the synchronously updated Codex Security plugin has been deeply integrated into the developer workflow, supporting fully automated codebase scanning, threat modeling, and patch generation.In terms of ecosystem development, OpenAI has launched an exclusive partner program, allowing compliant security service providers to integrate GPT-5.5 with specific permissions into their commercial products; and has initiated the "Patch the Planet" program in collaboration with organizations like Trail of Bits to assist over 30 foundational open-source projects such as Python and Go in implementing vulnerability fixes. In addition, OpenAI revealed that it is currently engaged in deep cooperation with governments and institutions from multiple countries, including the United States, the United Kingdom, France, and Japan, to jointly enhance the cybersecurity capabilities of global critical infrastructure.

Regarding the suspected attack on the Aztec Router contract on the Ethereum chain, Aztec Labs has officially launched an investigation and clarified that Aztec Connect was deprecated three years ago. Aztec Labs does not hold any administrator keys or control over the system, and currently cannot pause or upgrade it. Therefore, the community is reminded to be vigilant against false "support" accounts and private messages.

According to the Wall Street Journal, the U.S. government's export controls and access restrictions on Anthropic's models Fable 5 / Mythos 5 partly stem from Amazon's cybersecurity research and AWS CEO Andy Jassy's communications with the White House.It is reported that the research submitted by Amazon indicated that through a series of prompt tests, researchers were able to induce Fable 5 to output sensitive information that could potentially be used for cyberattacks, raising security concerns. Subsequently, Andy Jassy reported the relevant findings to the U.S. government, prompting the White House to take further restrictive measures, including banning foreign users from accessing the model.At the same time, former U.S. Department of Commerce official Kate Koren revealed that the White House's existing policy stance on Anthropic may also have influenced this decision-making judgment, as there are differences between Anthropic and the White House on AI safety boundary issues, including the refusal to use the model for large-scale surveillance or lethal autonomous weapon systems. Although both sides had eased tensions and expanded cooperation earlier this year, this incident may once again exacerbate the strained relationship.

David Sacks, the head of AI and crypto affairs at the White House, stated that although the commercial version of the Mythos series model Fable released by Anthropic this week includes safety barriers, once those barriers are bypassed, users will be able to access Mythos's advanced cyber attack capabilities. Sacks pointed out that Anthropic had previously described Mythos as a "cyber weapon" that requires regulation, so fixing the related vulnerabilities should have been its responsibility.Sacks mentioned that a partner trusted by both Anthropic and the U.S. government discovered a jailbreak method to bypass the safety barriers while testing Fable. The U.S. government subsequently requested Anthropic CEO Dario Amodei to fix the vulnerabilities or take the model offline, but this request was refused. Anthropic stated in a declaration that the vulnerability is "not serious," a claim that contradicts the judgment of the U.S. government and relevant partners.Sacks stated that Anthropic has always emphasized that safety should be prioritized, but this time it prioritized maintaining consumer-grade model services. In response, the U.S. government reluctantly imposed export control measures on Anthropic and hopes that Anthropic will resolve the safety issues as soon as possible to lift the related restrictions and restore the full release of Fable.Sacks also denied that this action is related to previous disputes between the U.S. Department of Defense and Anthropic, stating that the government recognizes Anthropic's technological capabilities and believes that the current issues can be resolved relatively easily, with the initiative currently in Anthropic's hands.

According to Slow Fog's disclosure, a new variant of Shai-Hulud Hades has been found attacking PyPI. The malicious package drops a .pth file that executes automatically when Python starts, and checks if Bun is installed locally; if not installed, it downloads the official Bun binary from GitHub Releases, and then executes a multi-layer obfuscated JavaScript payload to steal credentials from GitHub, npm, AWS, and cloud services.Slow Fog stated that this variant uses the same RSA public key and infrastructure as previous Shai-Hulud attacks, and has capabilities such as encrypted exfiltration, persistence, CI/CD injection, and GitHub Actions injection.

According to the official announcement, Bitget stock derivatives have now launched for 15 underlying assets including ADBE (Adobe), CRWD (CrowdStrike), HPE (Hewlett Packard Enterprise), BX (Blackstone Group), TWLO (Twilio), covering popular sectors such as cybersecurity, AI data centers, satellite communications, and small-cap ETFs.