vulnerability research8 articles
ShinyHunters Arrests Mount as AI Finds Bugs Humans Would Miss
The FBI has made what appears to be a third arrest connected to the ShinyHunters cybercrime group, following the crew's breach of FBI systems, with at least one suspect reportedly arrested on US soil. ShinyHunters, an English-speaking group estimated to have extorted around $70 million in the past year, claimed the hack was reputationally motivated rather than financial. Meanwhile, Anthropic's AI model Mythos has discovered a second vulnerability — a complex authentication bypass in open-source software — that was promptly exploited in the wild, raising questions about whether AI is shifting the balance of power between attackers and defenders in cybersecurity.
Claude Opus 5 Cracked OpenAI Staff Accounts in Under 72 Hours
Security researchers at Hacktron used Anthropic's Claude Opus 5 to chain a memory corruption flaw in the libheif image-processing library with a weakness in OpenAI's single sign-on system, successfully taking over ChatGPT and Codex accounts belonging to several OpenAI employees and gaining access to an internal code repository. The attack began through OpenAI's public help forum, which used the same login system as internal tools, meaning compromising the forum server granted access wherever that sign-on was trusted. OpenAI patched the vulnerability within 14 hours of being notified and paid a $6,500 bounty, while the researchers note that Claude Opus 5 was critical to the effort, producing a working exploit within hours after the previous model had struggled — illustrating how capable AI is lowering the skill and time required for serious offensive security work.
AI Just Killed Security Through Obscurity. It Was Never That Healthy to Begin With.
AI has rendered "security through obscurity" completely obsolete, as both defenders and attackers now use AI agents to rapidly discover vulnerabilities in systems that were previously considered secure due to their complexity or obscurity — including decades-old protocols and critical industrial control systems. While this is accelerating the pace of vulnerability discovery to record levels, AI-generated patches remain unreliable, succeeding only around a quarter of the time, meaning defenders face a growing backlog with inadequate automated tools to address it. Security experts warn that organisations must move beyond simply finding and patching individual bugs, and instead focus on identifying systemic process failures to prevent vulnerabilities at scale.
Bixby as a Backdoor: How Two Researchers Chained Samsung's Own Apps Into a Full Device Takeover
Two security researchers from Microsoft and Mobile Hacking Lab discovered a chain of vulnerabilities in Samsung software — including the Bixby virtual assistant, Samsung Members, and Samsung Account — that could allow attackers to achieve system-level control of a Samsung Galaxy device. The exploit begins with a malicious link and chains multiple CVEs to ultimately abuse Bixby's internal "Capsule" infrastructure, enabling data exfiltration and remote code execution. Samsung has since patched the flaws, but older devices that haven't received updates remain at risk; the researchers demonstrated the attack successfully on Galaxy S24, S25, and Flip 7 models and won $50,000 at the Pwn2Own Ireland competition.
EU's Cyber Watchdog Gets Access to Anthropic's Scary Vulnerability-Finding AI
Anthropic has agreed to grant the EU's cybersecurity agency ENISA access to its powerful AI model, Mythos, through Project Glasswing — making ENISA the first European entity to join the initiative. Mythos has drawn significant concern due to its ability to autonomously discover and exploit software vulnerabilities at unprecedented speed and scale, raising fears about lowering the barrier for sophisticated cyberattacks. While the European Commission views the access as essential for assessing AI-related cyber risks, the terms are still being negotiated, and it remains unclear whether the US agency CISA has been granted similar access.
Prize-winning hacker thinks AI might make her obsolete — and she's not wrong to worry
Valentina Palmiotti ("Chompie"), the top individual performer at the Pwn2Own Berlin hacking competition, warns that powerful AI tools like Claude Mythos may soon make human ethical hackers obsolete, having already won $70,000 in prizes herself. While AI currently helps hackers work faster, she believes emerging models will quickly take over the discovery of common vulnerabilities, leaving only the most elite human researchers competitive. Despite concerns about AI aiding criminal hackers, Chompie remains cautiously optimistic that AI will ultimately benefit cybersecurity defenders more than attackers — provided powerful tools are released responsibly.
Anthropic Plans Public Release of Mythos Bug-Hunter, Admits Nobody Has the Safeguards to Do It Yet
Anthropic has announced plans to eventually make its Mythos AI model — which excels at finding security vulnerabilities in code — publicly available, but only once sufficient safeguards are developed, which the company admits do not yet exist. In the meantime, access is being expanded through its "Project Glasswing" programme to additional partners, including allied governments. Mythos has already identified over 23,000 flaws across 1,000+ open-source projects, though the volume of discoveries is straining an already overloaded security ecosystem, with many maintainers struggling to keep pace with the volume of reported vulnerabilities.
Anthropic's Claude Mythos Is Finding Bugs Faster Than Anyone Can Fix Them
Anthropic's Claude Mythos Preview AI model, working with around 50 partners through Project Glasswing, identified over 10,000 critical security vulnerabilities in system-critical software within just one month, with some partners reporting a tenfold increase in bug discovery rates. However, the pace of discovery far outstrips the ability of organizations to verify and patch the flaws, with only 97 of 23,019 open-source vulnerabilities found having been fixed so far. Anthropic warns this creates a dangerous transition period where AI models can rapidly find and potentially exploit vulnerabilities faster than defenders can respond, and acknowledges that no company currently has safeguards strong enough to prevent misuse of such capabilities.