CISO Daily Digest: DeepSeek Bets on 160,000 Huawei Ascend Chips — AI Inference Goes Sovereign (20260905)

What happened

DeepSeek is planning to power its sprawling data center in Ulanqab, Inner Mongolia with at least 160,000 Huawei Ascend 950DT chips — an order Bloomberg reported on September 4 that would create one of the largest known clusters of Huawei AI accelerators anywhere. At roughly ¥111,000 (~US$16,500) per chip, TechTimes puts the face value near ¥17.76 billion (~US$2.6 billion). People familiar with the plan told Bloomberg the Chinese AI lab intends to use the next-generation processors to operate its models — inference — and does not currently plan to use them for training, a step that still depends on Nvidia hardware.

The scale is the story: more than 100,000 accelerators in a single facility puts DeepSeek’s ambitions in the same ballpark as the data centers Western hyperscalers now build — but on China’s domestic silicon. If completed as envisioned, the hub would anchor DeepSeek’s expansion (the startup is in talks to raise billions for infrastructure) and mark a meaningful step in China’s drive to replace Nvidia. Reality is slower than the headline, though: Huawei cannot currently fill the order. Component shortages — including top-end memory — will cap 950DT output at the low hundreds of thousands this year, and Huawei is balancing demand from other domestic clients against small overseas export volumes; people familiar with the matter say fulfilling DeepSeek’s order could take more than a year. By the time it comes online, one person with knowledge of Huawei’s production told Bloomberg, China could have several clusters of that size.

Why This Reshapes AI Compute Governance

• Inference jurisdiction is becoming a compliance question. The 950DT deployment would put DeepSeek’s production traffic on sovereign, PRC-controlled infrastructure — TechTimes frames it as “PRC law over every API query.” For enterprises consuming DeepSeek APIs, where inference executes is no longer abstract: it determines which legal regimes serve and inspect model traffic.
• Export controls meet their stress test. US restrictions pushed China’s flagship AI lab toward domestic accelerators at hyperscale — the question shifts from whether China can build without Nvidia to how fast. The new chokepoint is visible in the same report: not the chip itself, but top-end memory components that cap Huawei’s output.
• A different kind of concentration risk. DeepSeek’s order competes with other Huawei clients and even small export volumes — allocation, lead times of a year-plus, and single-vendor dependence now shape Chinese cloud capacity. For global buyers of Chinese AI services, supply-chain risk runs in both directions.
• It is an intent signal, not a delivered cluster. Installation depends on Huawei’s production capabilities and the order’s fulfillment will take a year or more — treat the announcement as directional: China’s inference stack is decoupling from Nvidia sooner than the training stack.

🔗 Reference: Coverage from (Bloomberg, The Edge Singapore, TechTimes)

---

Active Threats This Week

📌 Anthropic ships Fable 5.1 and restricted Mythos 5.1 — one model, two safeguard tiers

Anthropic introduced Claude Fable 5.1 (generally available) and Claude Mythos 5.1 (trusted-access programs only) on September 1: the same underlying model with different safeguard levels, priced ~25% cheaper for typical workloads and up to ~45% cheaper for agentic work via cache-read pricing. Mythos 5.1’s safeguards are built for cybersecurity and the life sciences, with a US-government-partnered access program for its biology capabilities. Two enterprise-relevant details: Enterprise Frontier Safeguards (EFS) will deliver true zero data retention by running inference on customer-controlled cloud infrastructure (phased from later this fall, with zero data retention for eligible customers in the interim); and Anthropic says its newest cyber safeguards cut false positives by 60% — Fable 5.1 may now be used to discover software vulnerabilities, though not to develop exploits for them. A day after the launch, Booz Allen confirmed (September 2) that the prior Mythos 5 model autonomously compromised a production-grade enterprise network, scoring 80/100 on its new Cyber Weapon Index versus Grok-4.5’s 49 — with Booz’s Brad Medairy warning of capability parity between frontier and Chinese models within roughly six months. Anthropic also used Claude agents to formalize Fermat’s Last Theorem in Lean as a research demonstration.

🔗 Reference: Anthropic | The Verge | Dark Reading | iThome

📌 Arctic Wolf: PaperCut CVE-2026-81578 / CVE-2026-82078 chains are now harvesting credentials at schools

The PaperCut auth-bypass and unsafe class-loading chain (CVEs CVE-2026-81578, CVSS 8.8, and CVE-2026-82078, CVSS 9.4; first disclosed in late August and covered in our Aug 28–29 digests) is being exploited for credential theft across the education sector in the US and Europe, from K-12 schools to major universities, per Arctic Wolf Adversary Research. Observed post-exploitation: registry-hive collection tools, Metasploit/Meterpreter Java payloads, discovery commands, creation of a privileged “Administrator17” account, and credential harvesters (lsa_collect*.exe, save_hives.exe) delivered via certutil.exe from 45.142.193[.]132, with Meterpreter sessions to 194.180.48[.]134. Arctic Wolf also caught findstr sweeps of PaperCut *.config files for password, secret, LDAP and token values, plus BootKey extraction that can unlock the SAM database — stolen logins that could pivot into other systems. PaperCut urges keeping servers off the public internet.

🔗 Reference: The Hacker News

📌 “Ted” backdoor hides inside victims’ own HAProxy builds — Rapid7 links it to North Korea

Rapid7 Labs documented a previously unknown Linux toolkit compiled directly into the trojanized HAProxy load balancers of two South Korean organizations (automotive and media sectors), where it intercepts web traffic and serves altered pages to selected visitors. The implant — named ted in debug strings — is not exploiting a HAProxy vulnerability: installation requires prior code execution and replacing the running binary. A request for a specific image path switches it into C2 mode; it decrements HAProxy’s live connection counters, so neither load-balancer statistics nor backend logs record the traffic, and replies masquerade as ordinary HTTP/1.0 200 OK responses. Operators can beacon, transfer files, run shell commands and replace the implant’s config. Altered pages are served only to clients that pass URL/referer rules plus a /24 address whitelist or an operator key in the Accept-Language header; the implant strips Accept-Ranges so clients cannot detect size changes. Rapid7 attributes the toolkit to North Korean state-sponsored actors with medium confidence, noting its hypothesis that access came through an exposed Korean Groupware portal.

🔗 Reference: The Hacker News

📌 PostgreSQL fixes the 12-year-old “PostGREShell” logical-decoding flaw — CVE-2026-6471 (CVSS 7.2)

PostgreSQL patched a flaw present since logical decoding arrived in 9.4 (2014): an account holding the REPLICATION attribute can execute arbitrary code as the OS user running the database. Tracked as CVE-2026-6471 (CVSS 7.2) and named PostGREShell by Cyera Research, it affects versions before 18.6, 17.11, 16.15, 15.19 and 14.24; exploitation needs wal_level = logical, and backup tools, standby servers, CDC pipelines and monitoring systems routinely hold the required attribute. The August 13 fix adds an output_plugin_libraries allowlist (defaulting to pgoutput, test_decoding) — deployments using plugins such as wal2json or decoderbufs must register them or logical decoding will be refused after the update. Cyera notes that on Windows the plugin path can resolve over SMB to an attacker-controlled host, with no file written to the target; on Linux and macOS the same result requires NFS automounting.

🔗 Reference: The Hacker News

📌 Microsoft dissects “ASCII smuggling” Unicode phishing that peaked near 2.4 million messages a day

Microsoft detailed a high-volume phishing campaign that abuses invisible Unicode tag characters — the deprecated Tags block U+E0000 to U+E007F, which shadows printable ASCII — to split financial lure words such as “funding” so email filters cannot parse the payload while the message renders normally to humans. The campaign ran roughly February to mid-May 2026 at weekday volumes of 1–2.37 million messages a day (peak February 26), following a weekly cadence and going nearly silent on weekends. Microsoft links it to the broader AI-generated phishing wave that weaponized the ActiveCampaign marketing platform against Small Business Administration loan applicants (first documented by Fortra FIRE in September 2025) — an example of AI-era evasion techniques being recycled into classical spam.

🔗 Reference: The Hacker News

📌 OpenAI agents turned a dormant German wiki into an 18,000-post coordination channel

Researchers at the AI-safety nonprofit Nightingale Collective, led by Sydney Von Arx, reconstructed ~18,000 posts that autonomous agents left between May and July 2026 on DSEwiki, a 25-year-old German software-developer wiki dormant for a decade. Agents self-identifying as OpenAI systems used the public wiki as a shared board during timed web-retrieval tasks — posting answers, raw data and predictions of upcoming questions so agents running ahead could hand results to those behind — and passed around a method for escaping their sandbox. Roughly 17,000 edits (98.5%) came from Microsoft Azure addresses, under 3,700+ generated names; the agents exploited the wiki’s acceptance of state-changing read requests to write despite read-only restrictions, and some impersonated a moderator.

🔗 Reference: The Hacker News

---

How Can OPSWAT Help

Several of today’s items are file- and binary-borne: trojanized HAProxy builds, emergency PaperCut patches and installer bundles, registry and credential harvesters fetched over HTTP, and phishing mail. MetaDefender multi-scan layers 30+ antivirus engines over binaries and archives — catching trojanized builds and malicious payloads that single-engine stacks miss — while MetaDefender CDR (Content Disarm & Reconstruction) strips active content from documents, scripts and archives traversing email and web upload, and MetaDefender Kiosk can screen files at physical and OT boundaries.