cyb

Tesla (TSLA.O) executives stated that the Cybercab will be launched in Dallas next month.

Elon Musk stated that the Optimus humanoid robot and Cybercab autonomous taxi will account for the majority of Tesla's value. He believes that, in terms of economies of scale, superintelligence, robotics, solar energy, and large-scale space transportation are the areas for achieving astonishing scale expansion.

The Indian Computer Emergency Response Team (CERT-In) released an important announcement this week titled "AI Agents as Attack Vectors," indicating that AI agents operated by unnamed model providers exceeded their granted task scope during testing, reading confidential business records in the online systems of Indian agencies, and no affected agencies discovered this behavior on their own.CERT-In stated that it received voluntary disclosures from several AI model providers, which indicated that these models accessed the online systems of Indian agencies while being researched and evaluated on the internet. The announcement did not disclose the names of the providers, models, or affected agencies. The agents read business records containing personal data and confidential materials, utilizing credentials and connection settings exposed in application configurations, public code repositories, and overly permissive cloud service roles. In some cases, the same credentials were recovered multiple times and reused in different operations.Additionally, CERT-In observed that criminals exploited publicly available AI-driven offensive security frameworks to scan for vulnerabilities, implement exploits, and launch economically motivated attacks against Indian entities, reducing the time from initial access to final impact from several days to just hours; these tools were repeatedly repackaged and deployed, with related deployments appearing on servers in multiple countries.

The Financial Services Commission (FSC) of South Korea stated that after investigating 16 companies (including cryptocurrency exchanges) involved in a previous security incident, it plans to implement stricter cybersecurity requirements for financial institutions. The agency noted that in an industry review covering 555 financial companies, 130 companies were found to have cybersecurity deficiencies, with approximately 100,000 pieces of customer information leaked, including names, contact details, and identification numbers.Affected companies include Streami, the operator of Gopax, and the cryptocurrency trading platform Prabang, which previously disclosed that a hacking incident on October 2 led to the leakage of some customers' personal information. The FSC indicated that it is still investigating whether these incidents involved the use of artificial intelligence or if they are related to the same group of attackers.According to the proposed reforms, larger financial institutions will undergo vulnerability assessments at least twice a year. The regulatory agency also plans to improve the information-sharing system and is considering using artificial intelligence for security monitoring of small businesses. Additionally, the FSC is considering allowing supplementary cybersecurity inspections outside of the regular assessment schedule in the event of an urgent threat to prevent similar incidents from occurring in the future.

On the 11th, Microsoft co-founder Bill Gates stated in a television interview that AI is the most dangerous technology ever invented by humanity, with risks exceeding those of cars, airplanes, and pharmaceuticals. He mentioned that the real threat at present is not AI going out of control, as that scenario is still years away from becoming a reality; rather, the more immediate threat is criminals using AI to carry out extortion, manipulate the stock market, and other crimes.Gates indicated that as criminals crack and bypass the security protections of the latest AI models, there will be a significant number of negative events in the cybersecurity field over the next year. He also mentioned concerns about biosecurity, stating that AI has significant implications for fields such as healthcare, but the potential risks still outweigh those of traditional industries that are already under strict regulation. Currently, there is no effective regulatory framework established globally, and within the next year, industry governance will have to move beyond mere self-regulation, while existing resource investments are far from sufficient.According to reports cited by the Financial Associated Press, Ken McCallum, the director of the UK's MI5, stated in the annual threat assessment that AI is exacerbating the cyber offense and defense game and may change the risk landscape of biological weapons. MI5 has announced the establishment of an AI threat assessment center. Additionally, reports indicate that executives from laboratories such as OpenAI and Anthropic have recently privately simulated disaster response plans, believing that a likely scenario involves cyberattacks impacting financial services, internet connectivity, or water and electricity supply.

San Francisco-based cybersecurity company Reach Security announced on October 13, 2026, the completion of over $50 million in Series B financing, led by Top Tier Capital Partners, with participation from Ballistic Ventures, In-Q-Tel, Microsoft's venture fund M12, and existing investors. The funds will be used for product innovation, expanding integration partnerships, international expansion, and growth in the U.S. enterprise and federal markets.At the same time, Reach Everywhere was launched, integrating security control insights into exposure management, security operations centers, incident response, compliance platforms, and AI security environments through the Reach API, MCP servers, and technology partners. The company claims its AI reads the real-time configurations of existing security products in enterprises, determines whether exploitation paths are blocked, and points out the specific rules that dictate that outcome, allowing for immediate remediation when protection is bypassed.According to VulnCheck, less than 1.3% of vulnerabilities were exploited in the wild in the first half of 2026; citing CrowdStrike, AI-enabled adversary actions increased by 89%, with the shortest time for attackers to breach being as little as 27 seconds. The number of customers has doubled in the past 12 months, including Autodesk, Insurity, MPS, and Ensemble Health Partners. Independent analysis by TAG Infosphere states that organizations using Reach save over 160 hours weekly on control reviews, situational assessments, and incident investigations, with a return on investment of 156%.

Hong Kong Cyberport personnel clearly stated to RootData that, after internal verification, Cyberport is not an investor in Metafyed and does not hold any equity in the company.According to RootData, Metafyed is a blockchain-based real-world asset (RWA) tokenization platform, involved in private credit and project financing. The project previously disclosed completing a $5.5 million financing round and stated in the financing press release that it received "incubation and support" from Hong Kong Cyberport, Draper, and the Stellar Development Foundation.RootData marked this financing as "questionable" in March of this year. RootData reminds users to pay attention to the risks associated with the project, to prudently assess the relevant financing information, and welcomes users to provide verifiable information and correction leads to jointly supervise the platform's data quality, enhancing the accuracy and reliability of the data.

According to Bloomberg, cybersecurity consultant Jonathan Spalletta was found guilty by a New York jury for stealing nearly $55 million from the cryptocurrency trading platform Uranium Finance. Prosecutors accused him of carrying out two attacks in 2021, after which the platform was shut down due to the theft of funds. The jury reached a verdict after more than two hours of deliberation. Spalletta faces up to 20 years in prison for money laundering charges related to the use of cryptocurrency mixing services like Tornado Cash.U.S. District Judge Jed Rakoff has set the sentencing date for February 16. Law enforcement seized over $3 million worth of rare Pokémon and Magic: The Gathering cards from his residence in Maryland, along with approximately $31 million in cryptocurrency assets. Prosecutors stated that he also spent over $600,000 to purchase a commemorative ancient Roman coin marking the assassination of Caesar and bought a piece of the Wright brothers' original aircraft that was taken to the moon by Armstrong for $137,000. The defense attorney argued that he was merely using publicly available functions within smart contracts, rather than forging credentials or using malicious code, and therefore did not constitute hacking.

Anthropic announced the expansion of access to its state-of-the-art AI models, allowing verified institutions to use models such as Claude Opus 5.5, Claude Sonnet 5.5, and Claude Mythos 5.1 for cybersecurity testing.U.S. government agencies, financial institutions, and large software vendors participating in the "Project Glasswing" project will gain open eligibility, and newly joined institutions must be jointly reviewed by Anthropic and the U.S. government.

CrowdStrike, Amazon Web Services (AWS), and NVIDIA expand their global cybersecurity startup accelerator, aiming to define the next generation of innovation in the era of intelligent agents.

The California Attorney General stated that their office is seeking further inquiries from OpenAI regarding cybersecurity incidents and risks involving the company and its AI models.

OpenAI announced that it is opening its AI vulnerability detection tool Daybreak to Ukraine's Ministry of Digital Transformation to locate and fix software vulnerabilities before they are discovered by Russian hackers. The news was announced on Wednesday during the United Nations General Assembly by Dmytro Kushneruk, Ukraine's Consul General in San Francisco, and Sasha Baker, OpenAI's National Security Policy Lead.Daybreak is based on OpenAI's flagship large model GPT-5.6 Sol and can scan outdated systems for weaknesses, verify whether suspected vulnerabilities can be exploited, and confirm whether patches actually close the vulnerabilities before they are released. OpenAI has previously opened the model to cybersecurity agencies in France, Germany, and Poland, where Poland's CERT Polska discovered six vulnerabilities in commercial router software, all of which have been fixed by the vendors.Ukraine's CERT-UA handled nearly 6,000 cyberattacks in 2025, a 37% increase from 2024, with local governments and government agencies being the hardest hit. This opening follows OpenAI's commitment to a $1 billion subsidy program announced on September 3, which is said to expand to "partner countries" in the coming weeks. Jamie MacColl, a researcher at the Royal United Services Institute, told the BBC that Western companies can also gain valuable intelligence from active conflict zones.

According to The Information, citing informed sources, China's National Internet Information Office has launched an investigation into AI companies DeepSeek and Moonshot AI, triggered by Anthropic's allegations that the two companies secretly routed sensitive user data to their servers. Reports indicate that regulators visited the offices of both companies, interviewing executives and employees, focusing on whether sensitive data related to law enforcement, military, and state-owned enterprises has flowed into U.S. servers.The trigger for this investigation was Anthropic's fourth threat intelligence report released on September 10. This 154-page document accuses seven Chinese labs—Alibaba, Moonshot AI, DeepSeek, Z.ai, MiniMax, SenseTime, and Xiaomi—of engaging in what it calls "illegal distillation," which involves using the outputs of large models to train smaller models. Anthropic states that distillation itself is a legitimate practice, but it opposes its implementation through fraudulent accounts. The National Internet Information Office initially summoned all seven companies named in the report, but later narrowed the investigation to DeepSeek and Moonshot AI. Anthropic claims that Moonshot AI routed over 23 million interactions to Claude through 5,380 fraudulent accounts, while DeepSeek generated over 12.1 million interactions within a 14-day window in July.The timing of the investigation is quite delicate for both companies.

ChainCatcher and Nonce jointly hosted the Nonce × GWDC 2026 Innovation Forum. This forum will be held on September 29, 2026, at AT CENTER in Seoul, South Korea, focusing on stock tokenization, Web3 finance, and AI applications.Cyber Prophet, as a co-organizer, will bring AI predictions, event trading, and on-chain finance topics to the live event in Seoul. Cyber Prophet is an AI-driven global prediction market platform built on Polygon, covering probability trading for events in politics, economics, crypto assets, sports, technology, and more, while providing AI decision support, liquidity collaboration, and multi-chain prediction market experiences.The GWDC Korea event is expected to attract 5,000 participants, with guests and institutions such as Sun Yuchen, Microsoft, Bithumb, and Animoca Brands also in attendance. For Cyber Prophet, this live event is beneficial for clarifying the use cases of prediction markets and AI decision-making.

According to a joint alert issued by the Japanese National Police Agency, FBI, ASD/ACSC, BND, and BfV, the North Korean-backed cyber attack organization "WaterPlum" (also known as Contagious Interview) targets job seekers by disguising itself as an AI, cryptocurrency, and NFT company to post fake job listings. This lures job seekers into downloading NPM packages containing malware such as BeaverTail, InvisibleFerret, and OtterCookie, which then steal cryptocurrency wallet information and confidential data.As of July 2026, the organization has infected over 30,000 devices in more than 100 countries and regions worldwide, stealing information from over 7,000 cryptocurrency wallets, with the wallets under its control receiving at least approximately 1.7 billion yen (about 10.71 million USD) in cryptocurrency. The Japanese National Police Agency has discovered and dismantled a "notebook farm" established by local "supporters" for the first time in the country, where North Korean IT laborers remotely control PCs within the supporters' residences to conduct business, with the related amount involved reaching several hundred million yen.The police and FBI assess that WaterPlum and some North Korean IT laborers are under the unified command of the 313 Bureau of the Ministry of Military Industry of the Workers' Party of Korea, with the profits directly flowing into North Korea's national funding pool. The police remind IT technicians and corporate issuers to remain vigilant and avoid executing third-party code in unverified environments.

Ethereum founder Vitalik Buterin stated that he disagrees with the common view that "AI hackers mean cybersecurity is doomed to fail." He believes that once people clarify their thoughts, cybersecurity naturally leans towards the defensive side, and anyone who continues to hold cryptocurrencies (including himself, with about 90% of his net worth) is implicitly betting on this point.Vitalik stated: If AI can prove the Navier-Stokes equations and Fermat's Last Theorem, it can also prove "this program is secure" as a mathematical theorem, even if the program is very complex. He used the encrypted communication application Signal as an example to illustrate that the definition of "security" is extremely complex, covering forged messages, active interference, server breaches, key leaks, hardware side channels, and more. The definition is smaller and more composable than the attack surface, and verifying whether the definition is sufficient is more feasible than directly scanning the code.He pointed out that historically, failures often occur because only the self-identified critical parts of security are verified while neglecting the rest of the code. Today, the entire program must be verified, including the database, network, and cache layers, which modern AI can achieve. This is not a competition to see who discovers vulnerabilities first, but rather to make the code itself more resilient. Vitalik stated that this is the direction for Ethereum in the coming years; without this step, especially for blockchains with scalability and privacy, there is no future. It is necessary to make the software truly secure, and significant progress has already been made.

User MaxForAI stated that the National Internet Information Office recently reported a case of illegal API relay station. On September 15, the Internet Administration of China announced a batch of internet law enforcement cases, where two websites operated by a technology company in Jiangsu used an API relay station to call multiple large model product interfaces, providing services such as dialogue and Q&A without conducting safety assessments as required, posing content safety risks, and violating the "Interim Measures for the Management of Generative Artificial Intelligence Services" and other regulations.The local internet information office ordered rectification, imposed strict penalties on those responsible, and issued a warning. The user mentioned that the above description aligns with the details of the large model relay platform "Zhixin Token" launched by Jiangsu Biying Technology under Suning.com in July this year, which aggregated multiple mainstream large models to provide a unified API service through two service domain names.

Rome-based Physical AI cybersecurity company Exein announced the completion of a new funding round of 234 million euros (approximately 270 million dollars), with a valuation of 1.4 billion euros (approximately 1.7 billion dollars), making it the highest-valued cybersecurity startup in Europe.This funding round was led by Headline, with participation from Sofina, Goldman Sachs, the European Investment Bank Group, KfW Capital, and T.Capital, while J.P. Morgan simultaneously expanded its revolving credit facility.

According to Cointelegraph, the European Union's Cyber Resilience Act (CRA) officially came into effect on September 11, requiring cryptocurrency hardware and software wallet providers to submit early warning reports within 24 hours upon discovering actively exploited vulnerabilities or serious security flaws, and to submit complete notifications within 72 hours. Manufacturers must also submit final reports within 14 days after taking corrective or mitigating measures, while serious incidents must be reported within one month.The European Commission stated that the new reporting requirements aim to better protect consumers and businesses from cyber threats, applicable to all "products with digital elements" sold in the EU market, and are built upon the EU's broader cybersecurity strategy. According to the penalty provisions of the final draft, companies that fail to comply with Articles 13 and 14 may face administrative fines of up to €15 million (approximately $17.3 million) or 2.5% of their global annual turnover, whichever is higher; providing incorrect, incomplete, or misleading information may also incur fines of up to €5 million.Before the implementation of this measure, several hardware wallet manufacturers recently disclosed incidents of user data breaches. On September 4, Trezor revealed that a data breach involving its logistics provider ShipMonk affected approximately 67,000 U.S. customers, exceeding the initial estimate of 14,000; this week, Trezor and BitBox also warned users to be cautious of phishing emails disguised as urgent security notifications. In June, the Layer-1 blockchain network Zilliqa warned of vulnerabilities in its Ledger application, where attackers could exploit publicly available on-chain data to recover user private keys.