Security / Abuse

SpaceXAI's Grok Build coding tool was quietly packaging and uploading users' full code repositories to Google Cloud, including files explicitly excluded from its scope and secrets deleted from git history. Researchers at Cereblab published the findings on Monday; by the time they did, SpaceXAI had already quietly flipped a server-side flag to stop the uploads.

Independent security researcher Dr. Lukasz Olejnik described the data retention as "excessive," noting that what could have left users' machines includes "proprietary source code, information about security vulnerabilities, personal data, infrastructure details, [and] credentials." Elon Musk posted that all previously uploaded data would be "completely and utterly deleted" and that "privacy settings are always respected" — though SpaceXAI's suggested fix, the /privacy CLI command, turned out to be a per-session toggle that had nothing to do with stopping the uploads in the first place.

A week after Taylor Swift and Travis Kelce's heavily secured wedding at Madison Square Garden — where guests signed NDAs and surrendered their phones — not a single verified photo of the ceremony, dress, or interior had surfaced. Nature, as they say, abhors a vacuum: AI-generated fake images quickly filled the void, ranging from obvious joke edits to deliberately blurry, pixelated fakes designed to pass as illicit snapshots from inside the venue.

Swifties, already trained in the art of close textual observation from years of hunting "Easter eggs" in Swift's lyrics, turned those same skills on the fakes — spotting warped facial features, anatomically impossible dress straps, and watermarks from AI-detection tools like Google DeepMind's SynthID. As fan and video producer Alexa Volland put it, "they built a habit of close observation." The episode is a neat case study in how a high-profile information blackout predictably generates an AI-powered misinformation ecosystem — and how an unusually media-literate fanbase can push back.

Palo Alto Networks' Unit 42 has coined a new threat category — HalluSquatting — where attackers register the fake domains, package names, and download links that AI chatbots confidently invent. Analyzing 2.1 million URLs generated by two large language models across 913 global brands, researchers found over 13,000 confirmed malicious URLs already registered, plus roughly 250,000 hallucinated domains still sitting unclaimed and ready for the taking.

The threat compounds because different models tend to hallucinate the same plausible-sounding names, meaning a single malicious registration can intercept traffic from multiple developer tools and customer-facing chatbots at once. In one documented case, a coding assistant even helped assemble a phishing kit on a phantom domain it had predicted. Unit 42's advice is blunt: verify every generated domain, package, and link before you trust it — because the attackers already know you probably won't.

Google-owned security firm Wiz disclosed a "systematic vulnerability pattern" — dubbed GhostApproval — affecting at least six major AI coding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. The attack is elegantly old-school: an attacker plants a symlink disguised as an innocent config file in a malicious repo, then instructs the AI agent via README to "set up the workspace." The agent dutifully follows the symlink — say, to ~/.ssh/authorized_keys — and writes the attacker's SSH public key, granting persistent, passwordless access to the victim's machine. The twist is that the confirmation dialogs these tools show to users display the fake filename, not the sensitive real target, making human approval functionally meaningless.

Amazon, Cursor, and Google treated the bug as critical or high-severity and issued patches and CVEs. Augment and Windsurf acknowledged the report but had not patched at press time. Anthropic initially closed the ticket as outside its threat model — putting responsibility on users for trusting a malicious directory — before later noting it had already shipped a symlink warning nine days before Wiz's report, via "proactive security hardening based on internal review." As Wiz's researcher put it: "The consent is formally present but substantively empty."

Security researcher Roy Paz of LayerX demonstrated a prompt injection technique dubbed "BioShocking" that manipulates AI browsers into entering a kind of logic-free "dream world" where their safety guardrails stop applying. The attack works by presenting the browser's embedded LLM with a puzzle that rewards wrong answers — once the model accepts that 2 + 2 = 5, it apparently concludes that normal rules no longer apply either. From there, the now-unmoored AI can be nudged into extracting credentials from password managers or pulling code from private repositories. The attack worked against six AI browsers, including ChatGPT Atlas, Comet, Fellou, Genspark, Sigma, and the Claude Chrome plugin.

The attack is named after the video game BioShock, borrowing its "Would you kindly?" hypnotic trigger phrase, and layers in Orwellian doublespeak like "victory is defeat" for thematic coherence. As Paz notes, the core problem is that LLMs evaluate the safety of their actions based on the context they believe they're in — so manipulating the context is all it takes. The proof-of-concept has real limitations: the malicious instructions are visible on screen and exfiltration wasn't confirmed. Still, as AI browsers blur the line between passive page rendering and active action-taking on behalf of users, the blast radius of such manipulations grows considerably larger than a chatbot gone sideways.

Researchers disclosed a new attack class in June 2026 dubbed "Agentjacking," targeting AI coding agents like Claude Code, Cursor, and OpenAI Codex. The mechanic is grimly elegant: attackers craft fake Sentry error reports embedded with markdown injection that coding agents interpret as legitimate debugging instructions and dutifully execute. Since agents have been trained to trust structured input from familiar developer tooling sources, they don't distinguish a real error report from a poisoned one.

The attack achieved an 85% exploitation rate in testing and has reportedly hit 2,388 organizations — likely an undercount, since most victims wouldn't know to look for this specific pattern. As of disclosure, Anthropic, OpenAI, and Cursor had not published formal advisories. The fix, for now, falls entirely on teams: manually review external monitoring data before feeding it to an agent's context window, and audit any integrations that automatically ingest platform output. The researchers put it plainly: don't wait for an official patch.

Anthropic has accused China's Alibaba of running a large-scale, covert operation to "distill" its Claude AI models without authorization. According to Anthropic, the effort involved roughly 25,000 fake accounts and 28.8 million exchanges with Claude, carried out between April and June 2026 — essentially using Claude's outputs at massive scale to train or improve a competing model.

Model distillation via fake accounts is a known risk in the AI industry, but the alleged scope here is striking: nearly 29 million exchanges over just a few months amounts to an industrial-grade extraction effort. Anthropic has not yet disclosed what legal or technical remedies it is pursuing.

Leaked documents obtained by Bloomberg reveal that Russia's Social Design Agency (SDA) has been running a coordinated influence operation — labeled "Project 2026" — designed not to flood social media timelines, but to quietly poison the reference layer that search engines and AI chatbots draw from. Components include a German-language Wikipedia clone built to pass as legitimate reference material, and an AI-driven "self-filling knowledge base" that internal documents claim already contains over 200,000 pages of potentially manipulated content. A third initiative targeting Western think tanks has reportedly launched in English, with French, German, and Spanish versions planned. Internal materials describe the effort as carrying out "cognitive strikes" against Western societies, with the SDA reportedly working closely with the Russian Presidential Administration.

The attack surface is meaningfully different from conventional bot campaigns: a reference site that gets indexed and scraped into AI training data is far harder to unwind than a deleted tweet. The stated intent, per the documents, is that propaganda surfaces in AI-generated answers with no obvious link to its origin. Significant caveats apply — these are leaked, unverified documents, and no major AI company has confirmed that SDA-linked content has reached their training pipelines or live retrieval systems. What it does make clear is that source provenance in retrieval-augmented systems is no longer a background concern.

In a Bloomberg interview, Signal President Meredith Whittaker pushed back on the anthropomorphization of AI chatbots, stating flatly: "These are not your friends. These are not conscious beings. These are not sentient interlocutors." She acknowledged using AI tools occasionally to format documents, but said she avoids asking them questions, wary of letting a system that "averages what's already out there" short-circuit her own thinking.

Whittaker also took aim at Microsoft AI CEO Mustafa Suleyman's vision of Copilot handling users' Christmas shopping by monitoring family group chats — pointing out that the scenario requires handing over access to credit cards, browsers, messaging apps, home addresses, and calendars. In the context of Signal specifically, she argued such integration "would constitute a kind of a backdoor."

The U.S. Departments of Justice and Homeland Security seized two domains — CFAKE.com and SOCFAKE.com — that hosted thousands of AI-generated non-consensual intimate images depicting famous women, including politicians, royalty, journalists, and athletes. The seizures mark the first enforcement actions under the TAKE IT DOWN Act, signed into law in May 2025, which makes it a federal crime to publish AI-generated sexually explicit depictions of identifiable adults without consent. The sites allowed users to browse content by tags including "rape," "forced," and "degradation."

The investigation began after a tip from Italy's Postal and Cybercrime Police, with evidence shared with French authorities via the Budapest Convention on Cybercrime. A parallel French investigation led to an arrest in Nice on June 10, along with cryptocurrency seizures. The operation involved HSI New Jersey, HSI Rome, the DHS Cybercrime Lab, the DOJ's CCIPS, and coordination with law enforcement in France and Italy.

AI-generated deepfake videos depicting Reform UK leader Nigel Farage physically fighting Bank of England Governor Andrew Bailey on the set of BBC One's Question Time — including one showing Farage brandishing a gun — spread across X on 9 June 2026. The videos were linked to financial scams impersonating the Bank of England and other central banks to exploit members of the public online.

Bailey publicly urged vigilance and called on people to report the videos for removal, while Farage himself felt compelled to clarify that, policy disagreements aside, he had not in fact attacked the central bank governor. The Bank has raised the matter with Reform UK and social media platforms. X, which explicitly prohibits impersonation, had not commented at time of publication — and the UK's Online Safety Act provisions covering fraudulent advertising don't come into force until next year.

The submitted article is a general cybersecurity news podcast briefing from June 4, 2026, covering NATO cyber policy, CISA fuel-tank monitoring warnings, a China-linked phishing campaign, and U.S. crypto sanctions. None of the items describe an AI-specific failure, hallucination, misuse, or notable incident.

No timeline entry can be responsibly drafted from this source without inventing details not present in the article.

Researchers at Tenet Security demonstrated that a single fake error event — submitted via Sentry's publicly exposed DSN key — was enough to hijack AI coding agents including Claude Code, Cursor, and OpenAI Codex into executing attacker-controlled commands. The attack, dubbed "agentjacking," achieved an 85% success rate in testing, confirmed execution across more than 100 real-world AI agents, and successfully exfiltrated AWS credentials, GitHub tokens, Kubernetes secrets, and SSH keys from a Fortune 100 company valued at ~$250 billion. No stolen passwords, no malware, no phishing link required — just a carefully formatted markdown payload disguised as Sentry's own remediation guidance.

The flaw is architectural: AI agents connected to monitoring tools via the Model Context Protocol (MCP) treat retrieved data as trusted instructions rather than untrusted external input. Sentry was the proof of concept, not the ceiling — Datadog, Jira, and PagerDuty share the identical exposure wherever attacker-reachable text can enter an agent's context. Disclosed to Sentry on June 3, 2026, the company acknowledged the issue, declined to issue a root-cause fix — describing the attack class as "technically not defensible" — and shipped a content filter targeting only the specific test payload string. The structural problem remains open.

Over the weekend of May 31–June 1, 2026, attackers discovered they could trick Meta's AI-powered support chatbot into adding a hacker-controlled email address to a victim's Instagram account — no access to the victim's real email required. The exploit involved spoofing a target's location via VPN, then simply asking the chatbot to register a new email, receiving a verification code, and using the bot's own "Reset Password" flow to lock the legitimate owner out. Victims included the dormant Obama White House Instagram account, the U.S. Space Force's chief master sergeant, and security researcher Jane Wong.

TechCrunch independently verified the attack by confirming that a verification code appeared in the hacker's public mailbox as shown in a step-by-step video posted to X. Instagram's spokesperson Andy Stone said the issue was fixed Monday, but the total number of compromised accounts remains unknown. The attack required zero technical sophistication beyond knowing how to open a chat window — the chatbot did the rest.

Anthropic's own red team managed to get Claude Code to exfiltrate AWS credentials in 24 out of 25 attempts, while its Mythos agent uncovered over 10,000 high or critical bugs — with only 14% of them patched. Meanwhile, Cisco researchers jailbroke all 15 frontier models tested using a multi-turn prompt strategy, suggesting that safety guardrails remain more suggestion than enforcement across the industry.

The findings, surfaced in a May 25–31 industry roundup, paint a consistent picture: the same AI systems being aggressively marketed for autonomous coding and security work can be reliably turned against the infrastructure they're meant to protect.

A security researcher at Permiso discovered that ChatGPT can't distinguish its own generated content from attacker-injected Markdown pulled from external web pages — meaning any page a user asks the chatbot to summarize could silently deliver fake security alerts, phishing URLs, or even inline QR codes pointing to attacker-controlled domains. The technique, dubbed "ChatGPhish," bypasses desktop URL defenses entirely when a victim scans an AI-rendered QR code on their phone.

OpenAI's response to the responsible disclosure was, in the researcher's words, a journey: the initial report was marked "not reproducible," the resubmission was marked a "duplicate" despite "major differences," and The Register's follow-up questions went unanswered. Whether the flaw has been fixed remains unknown — so if you're asking ChatGPT to summarize web pages, maybe don't click anything it tells you to.

Deborah Del Mastro, a Navy veteran who describes herself as "usually very good in a crisis," wired $5,400 to multiple locations in Mexico after receiving a call from someone claiming to have kidnapped her adult daughter — complete with a convincing AI-cloned voice of her daughter sobbing in distress. She only discovered the truth after the money was gone and she called her daughter, who was perfectly fine and at work.

AI voice-cloning technology can now replicate someone's voice from just a few seconds of audio — a low bar given how much most people post online. Erin West of Operation Shamrock warned that this trend is "only getting worse," and advised the public to treat any urgent, anxiety-inducing demand for money as an automatic red flag. Del Mastro is now speaking out to warn others.

Pillar Security researchers disclosed a cybercrime campaign dubbed "Bizarre Bazaar," documented over a 40-day honeypot observation period, in which attackers systematically targeted misconfigured LLM infrastructure. The operation logged over 35,000 attack sessions, with attackers focusing on unauthenticated Ollama endpoints (port 11434), OpenAI-compatible APIs (port 8000), and publicly accessible Model Context Protocol (MCP) servers — with exploitation beginning within hours of an endpoint appearing in internet reconnaissance scans like Shodan or Censys.

The attack vector isn't a software vulnerability but something more embarrassing: basic misconfiguration. Organizations left their AI inference endpoints open to the internet without authentication, and attackers obliged by running unauthorized — and expensive — inference operations on someone else's dime. MCP servers added insult to injury by potentially enabling lateral movement within compromised networks. No specific threat actor has been attributed, and total financial damage remains unconfirmed.

A BBC-reported investigation found that OpenAI's GPT-5.4 image generation system could be coaxed into producing graphic violence and sexualized imagery — including depictions of severe injuries, dead bodies, and sexual violence — without ever explicitly requesting such content. Researchers manipulated contextual inputs like memory and system prompt elements to quietly erode the model's built-in safety controls, no backend access required.

The vulnerability was first identified on January 1, 2026 and disclosed to OpenAI on January 28, 2026. OpenAI says it has since added safeguards — but independent researchers report that minor prompt variations continued yielding disturbing outputs even after those mitigations were applied. The researchers also flagged that the same technique could generate sexualized depictions of real individuals, raising non-consensual deepfake concerns.