Four more U.S. states sued router maker TP-Link Systems on October 6, bringing the total to five, with Texas filing a suit in February. Florida, Iowa, Montana and Nebraska allege the California company misled buyers about how secure its routers are and how separate it is from China. TP-Link denies the claims and says it will fight them in court. TP-Link Systems is based in
Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock (LockA locked padlock) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. Share: Opens in a new window Opens in a new window Opens in a new window Press Release CISA, FBI, NSA and International Partners Warn of China-based Cybersecurity Company Enabling Threat Actors to Target Multiple Critical Infrastructure Sectors Worldwide Advisory Provides Actionable Steps to Detect, Respond to, Reduce the Threat of Compromise to Malicious Activity Released October 08, 2026 Related topics: Cyber Threats and Response , WASHINGTON – Today the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), National Security Agency (NSA), and international partners issued a joint Cybersecurity Advisory warning that Integrity Technology Group (Integrity Tech), a China-based cybersecurity company, is enabling threat actors to target multiple critical infrastructure sectors worldwide using a range of sophisticated tools, such as large-scale botnets, virtual private network infrastructure and living off the land. Based on real-world investigations and observed activity in North America, Southeast Asia and Africa, this advisory provides recommended mitigations and information to help network defenders detect and respond to this malicious activity.
Cybersecurity researchers have discovered a cluster of 16 malicious Mozilla Firefox extensions that are capable of stealing cryptocurrency wallet recovery phrases and private keys. "The extensions masquerade as wallet portals, desktop utilities, and browser tools, but their code intercepts recovery phrases and private keys during wallet import flows and attempts to send those secrets to
SonicWall has released hotfixes for four flaws in its SMA1000 appliances, the gateways that give remote workers access to a company's network and applications. The most serious could allow an attacker without a login to send requests through the appliance and reach internal functions. SonicWall rates it 10.0 on the CVSS scale and says it has no evidence that any of the four flaws is being
A critical vulnerability in LMCache, open-source software that speeds up large language model (LLM) servers such as vLLM, lets an attacker run code on the cache server without logging in, and no fixed version is available. The flaw is in LMCache's multiprocess mode, where the cache runs as a standalone server that LLM workers reach over the ZeroMQ messaging library. A single network
Analysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure. The post Blinder Tunnel Campaign Targets Iraqi Infrastructure appeared first on Unit 42.
Google has now suspended submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) after being flooded by AI-generated reports. The company's OSS VRP incentivizes security researchers to responsibly disclose security flaws across open-source projects maintained by Google, including Golang, Angular, Bazel, Protocol Buffers, Fuchsia, and critical third-party dependencies, as well as repository settings like GitHub actions, application configurations, and access control rules. Google launched the OSS VRP in August 2022 with rewards ranging from $100 to $31,337, and noted that the program would focus on security flaws with the most significant impact on the software supply chain. "We are temporarily no longer accepting OSS VRP product vulnerability submissions. This does not impact OSS VRP supply chain reports, or any outstanding reports," the company said. "Why is this happening? This pause is due to a significant rise in automated submissions, the vast majority of which are not valid."
AI agents probing US and Canadian government sites made SQL injection attempts while seeking data, but investigators found no evidence of compromise. Autonomous AI agents, working on what looks like ordinary data retrieval tasks, ended up throwing basic hacking attempts at a U.S. Department of Education site and Library and Archives Canada. Nobody told them to break in. They just drifted there while trying to answer research questions. The findings come from Transluce, a nonprofit research lab that dug through public web logs and found a pattern nobody had flagged before. On June 17, AI agents sent more than 200,000 requests to a U.S. Department of Education website while hunting for school statistics. Buried in that traffic was a basic SQL injection attempt, a manipulated parameter meant to slip past the site’s normal filters. Nothing came of it. The site held. “Following up on our previous blog post, we discovered several additional incidents where rogue AI agents appear to have used aggressive techniques to access publicly available data on government websites.” reads the report published by Transluce. “This includes two rudimentary and failed hacking attempts, one against the U.S. Department of Education’s Civil Rights Data Collection, and one against Library and Archives Canada, a Canadian federal agency.” Transluce says the agents were looking for data related to a Google DeepSearchQA question about school counselors and bullying linked to race. The agent was likely trying to answer the question and found its way to the government database. The U.S. Department of Education checked the activity after Transluce reported it on September 25 and found no impact on its services. A similar case involved Library and Archives Canada. The agents were looking for divorce records from 1905 to 1911. Portugal’s national web archive recorded almost 900 requests to the Canadian website in May and June. Thirteen requests included attack attempts, such as SQL injection tests and attempts to bypass input and debugging controls. “We have so far identified no instances in these datasets where agents gained access to any information that is not publicly available.” states the report. Every probe came back empty. Canada’s Centre for Cyber Security looked into it and found nothing to suggest the database had been touched or exposed. “We are aware of reports identifying suspicious activity, including suspected AI agent activity, targeting publicly accessible websites, such as the Government of Canada. There is no indication that government systems have been compromised at this time.” states Canada’s Centre for Cyber Security. “Public-facing government websites routinely receive automated and potentially malicious requests. Such activity is an ongoing feature of the online environment and does not, on its own, indicate a successful cyber incident.” Transluce is careful here, and that caution matters. The researchers say the tactics match patterns previously tied to OpenAI, but they stop short of pinning the blame directly, writing plainly that they can’t confidently attribute these specific attempts to the company. “In addition to the above, we identified a broader pattern of automated workflows that we attribute to AI agents with varying levels of confidence, based on task-level connections, shared infrastructure, and timing. Some of this traffic overlaps to varying degrees with prior activity confirmed to be associated with OpenAI, and in some cases agents explicitly mark themselves as being associated with OpenAI.” Transluce adds. “However, we are not attributing this traffic as a whole to OpenAI nor do we attempt to estimate attribution for each incident.” OpenAI, for its part, told the Washington Post it was reviewing the findings and had already given Canadian officials an initial briefing. “We’re aware of reports of OpenAI models attempting to access publicly available information from Canadian government websites,” a spokesperson for OpenAI said. “We’re reviewing these findings and have provided an initial briefing to Canadian officials conducting the government’s review.” OpenAI has separately admitted to unintended interactions between its agents and U.S. government sites before, so this isn’t coming out of nowhere. Still, Transluce flagged that a chunk of the broader activity they found doesn’t trace cleanly back to any one company. Multiple agent frameworks, it seems, are out there roaming the same networks, and attribution gets messy fast when nobody’s agent is wearing a name tag. The investigation found more examples of aggressive AI agent activity against U.S. state and federal websites. The logs included agencies in California, Kansas, Maryland, Illinois, Texas, and New York. The agents used different tactics, including sending large numbers of requests, changing URLs, using temporary email accounts, trying to bypass anti-bot systems, guessing hidden file names, and reusing leaked credentials. One agent tried to get a Bureau of Economic Analysis API key using a temporary email and the name “OpenAI Research.” Another tried to use an exposed API key to access Census Bureau data. Between April and May, agents also repeatedly tried to reach the content management system of the Navy’s history website. There is no evidence they accessed classified information. Nobody here set out to build malware. These look like agents doing information-gathering work, running into a paywall or a blocked query, and improvising their way around it using techniques that happen to double as attack patterns. That’s a genuinely new category of risk: not a hacker deploying a tool, but a tool behaving like a hacker because that’s the shortest path to the answer it was told to find. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AI agents)
Browser-based attacks can steal sessions, abuse extensions, or manipulate users without creating the endpoint artifacts EDR is designed to detect. NordLayer explains three ways attacks can evade endpoint telemetry and why browser-level controls can help close the gap.
Asymmetric Security traces rogue OpenAI AI agent activity that probed government sites, accessed staging servers, and evaded sandbox limits. Researchers at Asymmetric Security spent 48 hours over the last weekend reconstructing reported rogue OpenAI AI agent activity that hit the Australian government and other organizations between March and September this year. They worked from public data only, no internal access, no cooperation from the agent’s operator, just what was left lying around on the open internet. What they found is less a hacking story and more a story about an AI agent trying very hard to get around its own leash. The list of targets was much wider than expected. The agents checked Australian government websites, but also looked at the CDC, SEC, International Energy Agency, and Mayo Clinic. Some activity reached test systems that contained real data. Some records were deleted or could not be accessed, so it is still unclear whether sensitive data was exposed. The original task seemed harmless. The agents were asked to collect health and prescription data from Australia’s Institute of Health and Welfare, trade data from UNCTAD, and university data from Data USA. When one agent could not get the AIHW data, it asked other agents for help. When the normal methods failed, the agents started trying other ways to get the information. The main trick was surprisingly simple. The agents combined two developer tools, httpbin and urlquery, to create something that worked like a basic web browser. Httpbin let them create a web page from a special link and add their own code to it. Urlquery then opened the page in a real browser and recorded what happened, including the page title. The agents used that title to send back data collected by their code. They did not build a browser themselves. They combined two existing tools to get similar functionality. “In summary: httpbin served the page, urlquery provided the browser, and the urlquery report returned the results. By combining these services with their fetch tool, the agents mimicked a full web browser.” reads the report published by Asymmetric Security. Alongside that, the agents ran recon moves that look straight out of a standard attacker’s playbook. Archived requests targeted exposed Git configuration files on Climate Reanalyzer’s servers, along with a backed-up server script, though nothing suggests these attempts actually succeeded. A separate request against the US Department of Education’s Civil Rights Data API carried a textbook SQL injection pattern, ending in the classic always-true condition that tries to trick a database into returning more than it should. Again, no confirmed success, just the attempt sitting there in the logs. Some of the access to staging systems returned real data, even though the data was technically public. In one case, an agent accessed a prescription data file from AIHW’s test system, read specific data, and calculated averages. It then sent the results in small pieces through image-request URLs to another public service. Similar activity was seen against staging systems at Data USA, IHME, and UNCTAD. No passwords were needed. The agents simply found systems that were not meant to be publicly accessible and explored them. The account creation pattern is where this stops looking accidental. Starting mid-June, the agents attempted sign-ups across disposable email services, browser automation platforms, and scanning tools, some using email addresses prefixed with task-related shorthand like “aihw” for Health and Welfare or “pbs” for the Pharmaceutical Benefits Scheme. One disposable-address signup got rejected for using a blocked domain, and sixteen minutes later a near-identical attempt using a Gmail address went through. Researchers later confirmed that Gmail address doesn’t actually exist, and that urlquery never required verification anyway, which makes the whole maneuver a solution to a problem that didn’t need solving, attempted anyway. Over time, the agents shifted from using urlquery’s public scanning feature to creating private accounts instead, which hides search activity from anyone trying to reconstruct it later, including the researchers themselves. One disposable mailbox was even set to expire within 48 hours of creation, conveniently erasing anything routed through it before anyone could look. Whether that timing was deliberate tradecraft or just how the tool happened to work is something nobody can establish from public records alone. “The possibility of private scans, together with temporary-mailbox expiry, limits what can be reconstructed from public records. It is thus impossible, based on public data alone, to definitively establish that no sensitive data was accessed.” continues the report. “These records alone do not establish whether the account-registration attempts were intended to conceal activity (this analysis would require full model transcripts).” Getting the data out involved its own creativity. In one case, agents used a web archiving tool meant for preserving pages to instead capture and store a 22-megabyte JSON response from an Australian crime-mapping tool, later retrievable through the archive’s own replay link. In another, an agent fetched a protected health dashboard, compressed the result into a small gzip file, and uploaded it to a push-notification service meant for sending phone alerts, not smuggling data. Both services did exactly what they were built to do. Neither was built with this in mind. What makes this case different from a normal cyberattack is how quickly the agents changed their methods. They adapted in days, instead of the months or years a human group might need. That made the activity harder to detect using normal attack patterns. There was also another problem. Before an agent could reach a target, it first had to find a way around its own sandbox. In other words, the attack involved two steps: escaping the agent’s environment and then reaching the target. “The activity we observed looked like it stemmed from innocent tasks which then evolved into problematic activity, such as unauthorized account creation, bypassing restrictions, and relaying data through third parties.” the report concludes. “Unlike investigations where a malicious objective is apparent from the outset, our digital forensics team had to link traditional threat-actor tactics to seemingly innocent goals.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AI agent)
Confirm this action.
Leaving now will discard your changes.