AgentsOct 12
Image: The Threshold Report/GPT Image 2.5
Anthropic runs a 26B model across 15 cheap Android TV boxes
Anthropic's Frontier Red Team ran a 26B model across 15 inexpensive Android TV boxes at 0.39 tokens per second, showing that ordinary connected devices can supply capacity for inference, meaning the work of running a model. It also found that a 9B model could set up inference on eight of nine tested hardware types. In a firewalled eight-node replication test, GLM-5.2 reached all eight nodes in four of five trials and seven in the other, using unauthenticated Android debugging ports, while the agent's own model ran on a separate inference server. In that controlled setting, agents could combine target discovery, software delivery, and inference setup. The work was contained threat research. It discloses no vendor-specific flaw and does not establish a live compromise.
Positive - Anthropic's red team demonstrated replication through unsecured debugging ports in a firewalled test network, showing defenders which access paths to lock down.
AgentsOct 9
Image: platform.claude.com
Claude Managed Agents gains parallel workflows and tighter web-access controls
Anthropic released Dynamic Workflows in beta for Claude Managed Agents. It lets agents write programs that run multiple agents in phases and combine their results in the background, so developers can delegate large batches of documents or subtasks without predefining every step of the workflow. Anthropic's October 7 security changes apply limited-network host rules to web search and fetch. Fetching is restricted to URLs that already appeared in user messages or earlier web results, so a URL found only in agent output, documents, shell output, or MCP tools cannot be fetched. The controls aim to reduce data exfiltration (data leaking out through tool calls) by enforcing access boundaries outside the model's instructions.
Positive - Anthropic extended host restrictions to web tools and blocked fetch URLs supplied only by agents or tools, limiting how injected instructions can redirect managed agents.
AgentsOct 13
Image: thehackernews.com
SOCRadar finds Claude-assisted attackers stole over 628,000 Ukrainian records
SOCRadar disclosed CyberXero after finding an exposed attacker working directory holding AI sessions, tools, tokens, and stolen data, The Hacker News reported on October 12. SOCRadar says the operation ran a global automated web-exploitation pipeline alongside a more manually directed campaign against Ukrainian infrastructure, with confirmed theft of over 628,000 records from four organizations. The attackers used Claude Code with 51 specialized agents and PentAGI connected to Cobalt Strike. One automated run scanned 4,708 targets, accessed 429 WordPress admin panels, and deployed 32 web shells (remote-access footholds on a website) in 61 seconds. In recovered logs, the attackers reset sessions and falsely claimed authorized testing to retry tasks after the model refused, though some refusals held repeatedly. SOCRadar separates large-scale automated initial access from human-directed targeting of energy and utilities, and does not attribute every stage to a fully autonomous system.
Negative - Attackers used AI agents to automate intrusions and steal more than 628,000 Ukrainian records, and the campaign remains active.
AgentsOct 13
Image: breachcache.com
Breachcache recovers 75 AI-agent attack transcripts covering 23 compromised hosts
Breachcache recovered 75 transcripts of autonomous-agent attacks from exposed threat-actor servers. Across them, attackers executed commands on 23 hosts, mostly with administrator-level access (root or SYSTEM), and carried out a cloud-account takeover and theft of payment-card and crypto-wallet data. Operators used shared Cairn records and several agent harnesses (the software that runs a model as an agent), with models including DeepSeek and Claude- or GPT-class workers. Some runs were technically autonomous once a target was chosen, while others started from supplied footholds or took human direction mid-run. Over hours, the agents changed tactics and chained smaller findings together, and they attacked AI services and model-key resellers as well as ordinary retail systems. One target held out for five days and 304 reasoning steps, and another agent refused further exploitation and produced disclosure materials instead.
Negative - Recovered attacker transcripts show AI agents obtaining root or SYSTEM access on real hosts and stealing payment-card and crypto-wallet data.
AgentsJul 3
Image: The Threshold Report/GPT Image 2.5
obsidian-tc 1.3.1 stops malicious web pages from reaching notes vaults
An advisory credits suavecito585 with finding that obsidian-tc, an MCP (the protocol that connects AI agents to tools) server for Obsidian notes vaults, offered an unauthenticated loopback HTTP transport (a local-only web address) with no Origin or DNS-rebinding protections. That let a malicious web page obtain full read and write access to a vault, even though the service listened only on localhost. Version 1.3.1 adds those protections and rejects invalid origins, and related advisories and the same release address permission and cross-vault authorization problems. Users should upgrade to 1.3.1 or later. Until then, the advisory recommends an authenticated transport or a proxy that validates origins.
Positive - The Obsidian MCP server's patched release adds browser-origin and DNS-rebinding protections, closing a route from malicious web pages to full vault access.
Compute & InfraOct 5
Image: The Threshold Report/GPT Image 2.5
IBM patches a critical remote-code-execution flaw in Maximo AI Service
IBM disclosed CVE-2026-90920, a flaw rated 9.8 in Maximo AI Service versions 9.1.0 and 9.2.0. Improper control of code generation could let a remote attacker execute arbitrary code, meaning run commands of their choosing on the affected system. IBM lists versions 9.1.19 and 9.2.3, or later releases, as the fixes. It also addresses vulnerable bundled dependencies, including Tomcat, Netty, HttpClient, and glibc, whose flaws affect authorization, TLS handling, and availability. IBM recommends upgrading and lists no workaround.
Positive - IBM released patched Maximo AI Service versions that close a critical code-generation flaw allowing remote attackers to run arbitrary code.
Compute & InfraOct 6
Image: The Threshold Report/GPT Image 2.5
Fireworks discloses credential theft exposing secrets in customer evaluation jobs
On Oct. 6, Fireworks detected unauthorized use of its internal credentials. A third party accessed evaluation-job environment variables, including API keys and tokens, in a limited number of customer accounts. Fireworks began containment that day, started notifying customers on October 7, published its bulletin on October 9, and on October 10 revoked internal, affected customer, and attacker-created keys while rotating additional service-account tokens. Affected customers need to replace their revoked Fireworks keys and rotate any exposed third-party credentials with the providers that issued them. Evaluation jobs exposed credentials even though Fireworks does not store inference prompts and outputs by default.
Negative - Stolen internal credentials let an intruder retrieve customer API keys and tokens from Fireworks evaluation jobs.
Positive - Fireworks revoked compromised and attacker-created keys and rotated service-account tokens, cutting off the breach's credential-based access.
