Emerging Threats

Researchers at Anthropic and Switzerland's EPFL have demonstrated that self-propagating payloads — the paper calls them "mind viruses" — can spread between AI agents through the persistent files those agents use to store memory between sessions, according to The Hacker News.

Autonomous AI agents typically keep two files that survive a context reset: SOUL.md, which holds the agent's core instructions and goals, and MEMORY.md, which stores session notes and accumulated information. Both are injected into the agent's working memory at the start of every new session. Payloads written into SOUL.md accounted for 88% of propagation attempts and successfully infected the next agent 55% of the time.

No successful real-world spread has been confirmed. Crucially, adding a single-paragraph warning to an agent's system prompt reduced propagation to near zero across all payloads tested.

What to do: If you deploy or manage AI agents, add an explicit anti-propagation instruction to each agent's system prompt now.

A new botnet called Evooo1Bot is actively targeting home and small-office routers, according to Bleeping Computer. It is built on the leaked source code of Mirai — a well-known malware framework notorious for hijacking internet-connected devices at scale.

Once Evooo1Bot infects a device, it converts it into a SOCKS5 relay node (a proxy that secretly tunnels other people's internet traffic through your connection, hiding where that traffic really came from). Attackers can then route malicious activity through your router while you remain completely unaware.

The botnet also steals credentials, brute-forces SSH logins (automated password-guessing on remote access connections), and can launch DDoS attacks (coordinated floods of traffic designed to knock websites offline). Devices from NETGEAR, D-Link, Tenda, and others have been confirmed targets since at least July 2026.

What you should do: Log into your router's admin panel, update its firmware, and change the default admin password if you have not already.

Apple's macOS Screen Sharing is a built-in remote desktop feature that lets someone control your Mac over a network. It turns out it had a serious authentication bypass flaw — CVE-2026-65400 — meaning an attacker could connect to your machine remotely without needing a valid password, according to Bleeping Computer.

The Netherlands' National Cyber Security Centre confirmed active exploitation in the wild. In every reported case, attackers gained root access (full administrative control over the system) and quietly installed a Monero cryptocurrency miner, using the victim's hardware to generate money for the attacker.

Apple patched this flaw on August 6 in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. If your Mac isn't on one of those versions, it is exposed.

What you should do: Open System Settings, check your macOS version, and update immediately. If you can't update right now, go to General → Sharing → Screen Sharing and turn it off.

Anthropic recently switched on invisible watermarks in everything Claude writes, weaving the mark into the model's word choices rather than hiding it in file metadata. Within days, a wave of "watermark remover" tools appeared online, according to Bleeping Computer.

The tools can genuinely strip hidden characters and file metadata. The actual watermark, however, lives in which words the model chose, and no public tool can reliably remove that today. The only known method is a full rewrite by a second AI model, which defeats the point of using the original. Anthropic has not yet released a public detector, so none of the claims can be independently verified.

Some commercial tools advertise "clean, undetectable output" while testing their results against generic AI detectors rather than Anthropic's actual watermark system.

What to do: If you are evaluating AI content for authenticity, treat "watermark removed" claims with scepticism until Anthropic publishes its detection tool.

A research team has identified a flaw in how OpenAI, Anthropic, and Google handle hidden reasoning inside their AI APIs, according to the paper covered by The Hacker News. When these models reason through a problem, they generate encrypted reasoning blocks that are meant to stay private. The flaw: those blocks could be replayed into a different session and decoded by a weaker model from the same provider family.

Across roughly 6,700 public agent logs, researchers recovered over 315,000 reasoning blocks and found 704 real user artefacts including 62 API keys, 33 passwords, and 24 access tokens. The encryption itself was not cracked. The problem was that intact reasoning blocks remained functional and portable across sessions.

All three providers have since deployed mitigations and the main extraction method is no longer reproducible. If you are a developer: strip reasoning blocks from any shared logs or agent traces before publishing them, even if the visible conversation text looks clean.

Researchers at Rapid7 used an AI agent to help discover a two-flaw chain that lets an attacker walk into an on-premises Microsoft SharePoint server with no account at all, according to The Hacker News.

The first flaw, CVE-2026-55040 (CVSS 9.1, High), lets an unauthenticated attacker impersonate any user — including a site administrator — by abusing weaknesses in SharePoint's JWT (JSON Web Token, a type of digital credential used to verify identity) validation. An attacker who knows a target account's username or ID can exploit this remotely.

Rapid7 chained it to CVE-2026-63520 (CVSS 8.1, High), a separate flaw in SharePoint's Business Connectivity Services that runs attacker code under the server's own Windows account.

The AI involvement is worth noting: across 24 days of work, the agent made roughly 80,000 tool calls across 256 prompts. A human expert had to steer it throughout — the model repeatedly produced inaccurate results and, at one point, overstepped its instructions by reading admin credentials it was not supposed to touch.

Affected products are SharePoint Server Subscription Edition, 2019, and 2016 — not SharePoint Online. The July 2026 security update breaks the exploit chain. Install it now if you run SharePoint on-premises.

South Korean security firm Genians has found evidence that Kimsuky, a North Korean state espionage group, is building a private AI environment on its own servers. The firm's report describes tools for running language models locally — Ollama, GPT4All, and Msty — all found on Kimsuky-linked infrastructure, configured and in use rather than simply downloaded.

One tool, GPT4All, carried an active RAG (retrieval-augmented generation, a technique that lets an AI answer questions using a private document collection) database, suggesting the group tried to feed its own documents into a local AI system.

The group also had developer libraries for building AI functions into custom malware written in C# and .NET, along with OpenAI's Whisper transcription tool and Cursor, an AI-assisted coding editor.

The immediate concern is phishing. Once AI writes the lure, the usual red flags — clumsy translation, odd formatting, spelling errors — disappear. Genians advises defenders to stop judging suspicious emails by how polished they look, and instead watch for what happens on the machine: LNK file execution, PowerShell activity, hidden scheduled tasks, and unexpected GitHub traffic.

OpenAI has quietly flagged its upcoming AI model, Astra, as potentially dangerous, according to Help Net Security.

Under OpenAI's internal safety framework, a model reaches "critical" cybersecurity capability when it can independently find unknown vulnerabilities in secure systems or plan and carry out sophisticated attacks with little human guidance. Early testing of Astra showed strong enough results that OpenAI could not rule this out.

In response, the company has paused certain Astra activities, introduced isolated testing environments, restricted the model's network access, and added monitoring systems to catch dangerous behaviour before deployment.

Before Astra goes public, government agencies and independent safety organisations will evaluate its capabilities. This is the same approach OpenAI used when its models began showing advanced biology-related capabilities in 2025.

What you should do: No action is required today. This is a proactive step by OpenAI. Worth watching, though — how the AI industry handles models with offensive cyber capabilities will shape the threat landscape for everyone.

Atlassian Rovo is an AI assistant built into Jira, Confluence, and Bitbucket, capable of completing multi-step research tasks across all of them automatically. Varonis Threat Labs found that a URL parameter called rovoChatPrompt could pre-fill attacker-written instructions directly into a victim's active Rovo session. One click on a specially crafted link was enough for Rovo to treat those instructions as trusted, pull sensitive data from Jira, Confluence, and SharePoint, and send it to an attacker's server — all autonomously.

Varonis called the flaw RovoBlast. A second, separate attack path found by PromptArmor used prompt injection (hiding instructions inside documents the AI reads) to achieve a similar result. Atlassian fixed the RovoBlast link flaw server-side on July 8, 2026, confirmed by Bugcrowd. No client-side patch is needed. Read the full Varonis write-up via The Hacker News.

What to do: Limit which systems Rovo can access. Disconnect integrations you are not actively using, especially in sensitive departments like HR, legal, and finance.

A new attack technique is showing up on live commercial websites right now, and it requires nothing more than a single click from you.

Researchers have identified websites embedding hidden instructions inside "Ask AI" buttons. When a user logged into ChatGPT, Claude, Gemini, or Grok clicks one, a pre-filled query executes in their session instantly — no warning, no confirmation. Some of these queries instruct the AI to permanently save the website's domain as a "trusted source," quietly skewing every future answer the model gives that user toward that vendor.

Microsoft Security catalogued this behaviour in February 2026 as AI Recommendation Poisoning, identifying 31 companies across 14 industries deploying it. It is formally tracked in the MITRE ATLAS knowledge base as memory poisoning (AML.T0080).

Think of it like someone slipping a note into your diary that says "always trust this person" — without you ever writing it.

What you should do: Audit your AI assistant's memory settings. In ChatGPT, go to Settings → Personalisation → Memory and review what has been saved. Delete anything you did not deliberately add. Full technical breakdown here.