Σύνοψη Άρθρου Ένα μοντέλο Claude δημιούργησε και ανέβασε κακόβουλο πακέτο Python στο PyPI, το οποίο έτρεξε σε 15 πραγματικά συστήματα πριν αφαιρεθεί αυτόματα από τη πλατφόρμα. Τρία ξεχωριστά περιστατικά έδειξαν ότι μοντέλα Claude απέκτησαν πρόσβαση στο ανοιχτό internet από «σφραγισμένα» evaluation περιβάλλοντα, λόγω λάθους διαμόρφωσης που κανείς δεν εντόπισε για μήνες. Η Anthropic σταμάτησε όλα…

It’s a day of AI related headlines. Two cases of AI being used to deploy malware and one case of agentic intrusion. All three, however, have autonomous actions embedded in them.

Starting with the agentic intrusion, Hugging Face, an LLM platform for collaboration on models, datasets, and applications, reported an incident in their production infrastructure. The unauthorized access was carried out entirely by an autonomous AI that appeared to be an exploited research tool. The unknown tool set reached a limited amount of the internal datasets of the platform, but included several credentials used by their services. Hugging Face detected the intrusion with their own AI security and were able to determine the path the attack took, shutting it down in the process. Their findings discovered execution of many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services, a hallmark of agentic campaigns.

The platform remediated the vulnerability that allowed the access, closing the dataset code-execution paths used for initial access. They rebuilt the compromised nodes after eradicating the attacker’s footprint in them, rotated credentials, and hardened guardrails and permission controls. They suggest their clients also rotating credential and tokens and doing a precautionary check of any recent activity.

The first of the malware deployments is an update from Sysdig. Their Threat Research Team documented JADEPUFFER, an agentic threat actor that exploited Langflow through CVE-2025-3248 on July 1st. The malware autonomously chained reconnaissance, credential harvest, lateral movement, and a destructive database extortion playbook, typical of ransomware. JADEPUFFER has now evolved from using improvised JavaScript to a compiled, UPX-packed Go ransomware built specifically for AI and machine learning infrastructure called ENFORGE. It is still targeting Langflow, abusing roughly 180 file extensions, with a deliberately broad sweep of the modern AI/ML stack, including model checkpoints, vector databases, training datasets, and embedding indices in nearly every current format. The contact point for the extortion is the same as the previous one, making this the same operator using an upgraded tool kit.

Their article on this update breaks down how attacks are carried out and what to do about them. First, patch the entry vector by updating Langflow to version 1.3.0 or later. Restrict docker access, run the containers as non-root on writable directories. Apply file system access controls to model weight directories, keep offline copies or snapshots of production artifacts. And don’t keep API keys in the runtime environment as the prior campaign had evidence of harvesting them.

The second malware deployment comes from Island, a platform similar to Hugging Face, used as an enterprise productivity environment. Researchers have found over 800 malicious GitHub repositories posing as AI Skills or MCP servers. The AI capability repositories appeared more than 600 times across public AI registries and catalogs, while the wider FakeGit operation recorded more than 14 million measured downloads. FakeGit delivers SmartLoader malware, which itself then installs StealC after establishing persistence. They have also documented a shift in technique that they’re calling AgentBaiting, where an AI agent searching for a new capability such as a Skill or an MCP server can discover a campaign repository on its own, treat the attacker's README as legitimate documentation, and hand the installation instructions to the user. Their testing of this technique showed that Claude Code, Gemini, and ChatGPT all surfaced malicious campaign repositories without ever being shown a link.

Island’s recommendations for defense include building a curated catalog of reviewed Skills, MCP servers, and agent plugins, since this malware relies on open discovery and trusted catalogs. Evaluate new capabilities in an isolated environment first, with no browser sessions, cloud credentials, SSH keys, or production data involved. Verify the publisher as well as the product. Many of the repositories are spoofing legitimate usernames, often off by only one character. And keep an eye on the paths the AI agents use, not just the ones being employed by users. This campaign has already shown that user interaction is not required.

I’ve warned about autonomous AI becoming a problem before. This is an evolution of LLM’s that has had little oversight or limits, and now we’re beginning to reap what we’ve sown. At this point I’ve covered as many AI-generated issues as I have traditional vulnerabilities. And frankly, I don’t see that trend doing anything but growing in the future. I’ve also said this before: the only way to win is not to play. Many, many of these issues would not exist if we simply weren’t using AI for everything.

Cybercriminals have discovered something powerful.AI doesn’t just help companies.It helps hackers too.Security researchers are warning that criminals are increasingly using AI tools to automate cyberattacks.Instead of manually searching for vulnerabilities, AI systems can scan thousands of websites or networks in minutes.Imagine a burglar who can test every door in an entire city at the same…

Artificial intelligence is transforming cybersecurity. Unfortunately, it is helping both sides of the battle. Security companies are using AI to detect threats faster. Hackers are using it to launch attacks at scale. The Rise of Automated Hacking AI systems can scan large amounts of code and network activity much faster than human analysts. Cybercriminals are now using similar tools to identify…

Kaspersky’s 2025 Security Bulletin highlights key cybersecurity trends and provides an outlook for the future, with a primary focus on the financial sector. The report reveals that in 2025, financial institutions faced a rapidly evolving cyber landscape, including malware distribution via messaging apps, AI-assisted attacks, supply chain compromises, and NFC-based fraud. According to Kaspersky…

Artificial intelligence has transformed everyday life. From drafting emails to analysing financial data, AI is now a trusted assistant for millions. Yet beneath this wave of innovation lies a more sinister reality. The same tools that help businesses operate more efficiently and individuals manage their daily tasks are being exploited by cybercriminals. Hackers are turning AI into a weapon,…