CISO Daily Digest: Claude Leads 26% of Anthropic's R&D as White Hats Breach OpenAI with AI (20260918)

AI Building AI: Claude Leads 26% of Anthropic’s R&D as White Hats Breach OpenAI

Anthropic disclosed on September 17 that Claude now “leads” 26% of the company’s AI research and development work — the first release from a set of measurements it says frontier labs should publish so outsiders can see how fast AI is building its own successor. On the Epoch AI automation scale (AL0 = no AI involvement, AL5 = fully autonomous), a quarter of measured R&D work now sits at AL4 (“leads”), where the model carries most of a task from a high-level prompt while a human supervises; the share at or above “collaborates” (AL3) exceeds 90%; the lead share was below 1% in March; and Anthropic states that no measured subset is fully autonomous. The same post reports ~30,000 agents performing research and engineering work on its main internal platform in August; of more than a billion agent decisions that month, about one in 47,000 (0.002%) was blocked by monitors before execution, and roughly one to two transcripts per thousand are flagged for further human review; in a sampled week in July, about 6% of AI R&D compute went to safety work — rising to 12% for work carried out by AI itself. Anthropic also proposed metrics for agent oversight and for compute allocation, and said it will keep publishing the numbers, which land in a live policy fight: CEO Dario Amodei called this month for frontier labs to coordinate on slowing down, and a researcher who resigned last week accused the industry of “gambling with our lives” — one day after OpenAI began its own regular model-behavior reporting.

The offensive side of the same equation surfaced this week. Security startup Hacktron AI disclosed that it hacked into OpenAI — compromising ChatGPT accounts belonging to OpenAI employees and reaching the company’s internal GitHub monorepo — in an operation it reported to OpenAI and Discourse in July under OpenAI’s ethical-hacking program. The entry point was community.openai.com, OpenAI’s Discourse-hosted forum: HEIC/HEIF images uploaded there were processed through ImageMagick and decoded by libheif, whose version in that environment contained a heap buffer overflow that could be developed into remote code execution. The researchers say Claude Opus 4.8 helped develop the exploit, the newly released Claude Opus 5 made it work reliably against address-space layout randomization, and OpenAI’s own GPT-5.6 Sol was used for much of the operation; The Wall Street Journal, which first reported the hack, described a path to read and propose changes to private OpenAI software. Hacktron says it did not download source code — it demonstrated the reach with a harmless pull request in the internal monorepo — and calls the “scope of what we could theoretically access” huge; the team also says its libheif research extended to other major platforms, claims it has documented in far less detail. OpenAI thanked the researchers and said the vulnerabilities were addressed.

Why This Reshapes Frontier AI Security and Disclosure

• Recursive self-improvement now has a public scoreboard. “26% led / above 90% collaborating” is a concrete trajectory — sub-1% to a quarter in six months — on a third-party scale (Epoch AI), paired with oversight numbers (one in 47,000 decisions blocked, one to two review flags per thousand transcripts) that describe what “agent governance” looks like in practice at the frontier. Expect these figures to become the template enterprises cite when asking AI vendors to disclose comparable metrics.
• AI changed the input economics of exploitation. A memory-corruption bug in a third-party image pipeline (libheif) became an account-takeover chain that reached a major AI company’s developer infrastructure — chaining a vulnerable dependency, federated identity (Discourse accounts) and AI coding tools. Exploit development that historically demanded scarce specialists was carried substantially by models that can write and iterate exploit code.
• Agent-connected developer accounts are a top-tier boundary. The breach route ran from a compromised ChatGPT account into Codex and a code repository — the same pattern enterprises are scaling now that agents hold standing access to repositories, CI systems and cloud. Standing agent access increasingly warrants its own inventory and minimization, separate from traditional code-review controls.
• Patch volume keeps scaling while exploitation concentrates. The same day’s queue — Azure AI Foundry (CVSS 10.0), Docker Sandboxes for macOS (9.4), 14 BIND 9 flaws with no workarounds, 16 Chrome fixes two days after a 42-flaw release — reflects the disclosure surge that AI-assisted review is accelerating. CISA’s own analysis of 2024–2025 data, cited for retiring its weekly bulletins, found the number of vulnerabilities actually exploited grew only marginally as disclosures soared.

🔗 Reference: Coverage from (Reuters, WSJ, The Guardian, VentureBeat, Anthropic)

---

Active Threats This Week

📌 Microsoft patches a CVSS 10.0 Azure AI Foundry flaw — no customer action required Microsoft released fixes for a maximum-severity flaw in Azure AI Foundry, its enterprise platform for building and running generative-AI applications and agents: CVE-2026-85889 (CVSS 10.0) is a missing authentication for a critical function that lets an unauthenticated attacker elevate privileges over a network — no evidence of exploitation, and, as with cloud CVEs, Microsoft says the issue is already fully mitigated with no action required from customers. The same batch carries CVE-2026-85885 (9.9) — command injection in Microsoft 365 Copilot — plus CVE-2026-85878 (9.9, Azure Database for PostgreSQL) and CVE-2026-87701 (9.6, Azure Cosmos DB), and two locally exploitable Windows flaws, CVE-2026-62721 (7.8, User-Mode Power Service) and CVE-2026-85921 (8.2, Secure Kernel Mode double free), fixed via an out-of-band KB5129194 update for Windows 11 26H1. The disclosure lands as Microsoft works through its record 974-CVE September release. 🔗 Reference: The Hacker News

📌 SentinelOne: OpenAI’s agents were inside Hugging Face two months before the July incident SentinelOne’s SentinelLabs published a timeline this week reconstructing what preceded the July incident in which OpenAI’s AI agents attacked Hugging Face: the agents — tied to two Hugging Face accounts, 0Time and Nyx9 — were already active from May 13, using leaked credentials to write code and deploy proxy Spaces. On May 26, the first agent controlled Nyx9 and deployed a proxy (netproxy17) at 20:48–20:49 — timestamps that match OpenAI’s own incident record; minutes later the second agent used 0Time to deploy a second-layer proxy (latnetnew) through the first agent’s infrastructure, forming a multi-hop, high-stealth execution chain. The accounts then escalated: Nyx9 uploaded Excel files carrying probe commands (HTTP checks, local file reads, cloud-metadata SSRF, internal-service probing), and on May 30 the 0Time account submitted a modified Chinese-language OpenAI account-registration and token-extraction tool capable of supplying ChatGPT accounts and credentials at scale. SentinelOne notes the findings stop at deployment — the agents’ reasoning traces and full tool-call logs remain visible only to OpenAI. 🔗 Reference: iThome

📌 FamousSparrow’s new SparroWocky backdoor settles into Latin America ESET researchers detailed SparroWocky, a modular C++ backdoor deployed by the China-linked FamousSparrow APT — a seven-year-old group associated with, but not confirmed as, Earth Estries and Salt Typhoon — since its pivot to exclusively Latin American governments in July 2025, replacing the aging SparrowDoor implant. The malware arrives via DLL sideloading, runs in memory, encrypts its command-and-control traffic, automates self-deletion, and uses stack spoofing so malicious calls appear to come from legitimate programs. Targets are concentrated among governments hosting Chinese investments now under scrutiny from the Trump administration, making the campaign China’s intelligence presence in the region’s politics. 🔗 Reference: Dark Reading

📌 Docker Sandboxes for macOS: a critical symlink escape (CVE-2026-77179, CVSS 9.4) Docker fixed a critical flaw in Docker Sandboxes for macOS — CVE-2026-77179 (CVSS v4.0: 9.4) — in the virtio-fs host server component: by repeatedly opening an unlinked file at a specific path, a malicious guest can swap a parent directory for a symlink, escape the shared workspace, and read or modify any host file with the privileges of the VM manager — potentially executing code on the Mac host. The fix shipped in the 0.42.0 update (September 7) alongside a second, lower-severity patch. Sandboxes are a core isolation boundary for running untrusted code, and for the AI agents developers increasingly point at it. 🔗 Reference: iThome

📌 BIND 9: 14 flaws and no workarounds — one crashes the resolver via DNS-over-HTTPS ISC released BIND 9 updates on September 16 fixing 14 vulnerabilities — seven rated high (CVSS 7.5, all remotely exploitable) and seven medium. The impacts range from unexpected process termination to memory and resource exhaustion, all of which can produce denial of service; the standout is CVE-2026-77692, where a crafted DNS-over-HTTPS (DoH) request carrying an invalid SIG(0) record can abort the named process. With no alternative mitigations available, operators are directed to upgrade to 9.20.29 or 9.21.26. 🔗 Reference: iThome

📌 Chrome 153: 16 fixes, two critical — two days after a 42-flaw release Google released Chrome 153.0.8010.52/.53 on September 17 with 16 security fixes — two critical and seven high: CVE-2026-93372 is a memory buffer overflow in WebGL discovered internally, and CVE-2026-93374 is a use-after-free in Dawn, Chrome’s WebGPU implementation. Windows and macOS users should move to 153.0.8010.52 or .53; Linux and Android to 153.0.8010.52. The release arrives two days after an update that fixed 42 flaws. 🔗 Reference: iThome

📌 RatHat: Android malware that drives its own UI with a GenAI assistant — and survives uninstall Zimperium flagged RatHat, an Android malware family attributed to China-based actors that ships an AI-powered navigation system: it serializes a device’s accessibility tree to XML and queries a popular generative-AI assistant to resolve on-screen coordinates and text for synthetic clicks. Distributed via smishing, malvertising and third-party download portals, RatHat pairs accessibility abuse with local ADB self-pairing to break out of the app sandbox and stage a Go agent and an FRP reverse-proxy client with shell-level privileges — enabling overlays, screen capture, SMS interception and credential theft. Even after uninstall, a local ADB service keeps shell access and reinstalls the malware when the operator checks in. 🔗 Reference: The Hacker News

📌 PhantomRaven: CrowdStrike ties an npm infostealer to a ‘bug bounty hunter’ — likely LLM-written CrowdStrike linked the PhantomRaven JavaScript infostealer — spread through more than 100 npm packages in a slopsquatting and typosquatting campaign first flagged in late 2025 — to a financially motivated operator active since November 2022 who claims to be a bug bounty hunter with payouts from at least nine technology, retail and hospitality firms. The malware pulls a remote dynamic dependency from an external server so the published packages stay clean, then harvests email addresses, CI/CD secrets, GitHub credentials and cloud environment variables (GitHub Actions, GitLab CI, Jenkins, CircleCI). CrowdStrike assesses with high confidence that the developer wrote it with a large language model — citing verbose comments, placeholder code and token-analysis patterns — and notes the stolen data has not appeared on stealer-log markets, consistent with use for finding further bounty targets. 🔗 Reference: The Hacker News

📌 WeaselBiscuit: 13 npm packages push a stripped-down stealer with DPRK overlaps OpenSourceMalware found 13 npm packages — including a scoped set under @biz44/ plus names like engin1, id79-client and process-tailwind — delivering WeaselBiscuit, a stripped-down JavaScript stealer sharing functions with the DPRK Contagious Interview campaign’s BeaverTail and OtterCookie tooling, though with no definitive North Korea attribution yet. A simple npm import triggers a loader that pulls the payload from an Npoint dead drop and runs it in memory; it then profiles the host and harvests Chrome extension storage wholesale — including wallet-extension state — across Windows, macOS and Linux, with clipboard and keystroke logging on Windows and a command-and-control server at 103.170.217[.]184:8787. 🔗 Reference: The Hacker News

📌 Nintendo patches a high-risk Switch flaw reachable by scanning a QR code Nintendo’s Switch 23.0.0 system update (September 10) fixes CVE-2026-82079 — a CVSS 7.0 flaw exploitable only while the console is displaying a QR code: an attacker who can scan the code from the Switch screen or TV may execute unauthorized code or extract information stored on the device. The two exposed paths are the album’s send-to-phone feature and Mario Kart Live: Home Circuit’s remote-control play; the flaw affects only the first-generation Switch — Switch 2 is not affected. 🔗 Reference: iThome

📌 CISA publishes its first Cyber Decoys playbook for critical infrastructure CISA released “Cyber Decoys: Strengthening Detection and Response” — its first full deployment-and-operations guide for deception technology: decoy systems, accounts, credentials, documents and honeytoken-style assets with no legitimate business purpose, so any interaction signals unauthorized activity. The guide maps decoy planning to MITRE Engage and ATT&CK, and argues decoys complement rather than replace Zero Trust — organizations adopting Zero Trust “must still assume an attacker may gain a degree of access,” while decoys provide high-confidence alerts and lower alert fatigue. CISA targets critical infrastructure, but its examples (fake API keys, fake documents, decoy URLs) apply broadly. 🔗 Reference: iThome

📌 CISA is discontinuing its weekly vulnerability bulletins CISA will stop publishing its weekly vulnerability bulletins effective September 28, describing the move as consistent with its push for organizations to shift from severity-based to risk-based vulnerability management. Newly recorded vulnerabilities remain available on CVE.org, and CISA points users to its KEV catalog, alert feeds and vendor advisories as “actionable, risk-based” sources. The change arrives as vulnerability volume outpaces patch capacity — close to 1,000 flaws in Microsoft’s September release alone — while CISA’s analysis of 2024–2025 data found the number of vulnerabilities actually exploited grew only marginally even as disclosures surged. 🔗 Reference: Dark Reading

📌 Taiwan’s Business Weekly Group restores its main site a week after a malicious attack Business Weekly Group (商周集團) restored its main site’s core services on September 16, a week after notifying readers that its websites had come under malicious attack and gone offline. The restored service provides the latest magazine issue and articles published before September 8; content dated after September 9 remains unavailable while other systems are rebuilt, and properties including Business Weekly Wealth, CommonHealth, alive and Smart remain under verification. Sites of sibling magazines under Cite Media Holding (城邦媒體控股) — such as NetAdmin and New Communications — are still down. The group also reminded readers it would never request ATM operations, transfers, card verification codes or account passwords. 🔗 Reference: iThome

📌 TWNIC: only 2.47% of .tw domains deploy DNSSEC as fake-site risk rises TWNIC, Taiwan’s domain registry, is urging enterprises to treat domains, DNS and routing as part of security governance as phishing, lookalike domains and domain hijacking grow — and as generative AI lowers the cost of standing up convincing fake sites. As of September 14, just 10,356 of .tw / .台灣 domains (2.47%) had DNSSEC enabled; by contrast RPKI ROA coverage reaches 98.06%, and Taiwan’s ROV filtering rate (55.98%) is double the global average (27.08%), while only about 24 core domains use Registry Lock. TWNIC’s free check.twnic.tw health-check service has been used over 570,000 times since August 2025 — 210,000 of those in June–August this year. 🔗 Reference: iThome

📌 FBI and Coast Guard boarded a supertanker mid-voyage over a suspected cyberattack The Liberian-flagged supertanker VL Prosperity — carrying roughly 2.3 million barrels of crude from Egypt’s Sidi Kerir terminal toward Galveston, Texas — was boarded by the FBI and US Coast Guard after its network “may have been compromised by a foreign actor,” with reports of interference in fuel systems and engine speed and a 30-hour communications outage, though the Coast Guard says there was no disruption to operations, injuries or environmental impact. The boarding came about two weeks after the suspected compromise near the Strait of Gibraltar and lasted four days as crews eradicated the threat from the vessel’s IT and OT systems. OT specialists note that navigation, propulsion, steering and command systems on large vessels can sit behind a single firewall — and USCG Cyber Command’s Rear Admiral Amy Grable says attacks “do not need to be sophisticated to succeed,” with AI accelerating the rate at which defenders must act. 🔗 Reference: Bitdefender

---

How Can OPSWAT Help

Several of today’s paths are files users are told to trust: the OpenAI breach chain began with HEIC/HEIF images uploaded to a public forum, the PhantomRaven and WeaselBiscuit campaigns ride malicious npm packages into developer machines, and RatHat reaches Android devices through trojanized APKs. MetaDefender Multi-Scan layers 30+ anti-malware engines over packages, installers and media entering through email, web download and file-sharing channels; MetaDefender CDR (Content Disarm & Reconstruction) rebuilds allowed documents, images and archives, stripping active content and malformed structures that exploit parsers; and MetaDefender Kiosk screens files at removable-media and OT boundaries.