AgentsOct 15
Image: The Threshold Report/GPT Image 2.5
Recovered PaperCut attack files expose AI-assisted credential theft
Hunt.io recovered an AI-assisted PaperCut attack setup containing AI-agent instructions, code for exploiting flaws, credential-stealing tools and reusable packages for maintaining network access. Investigators also identified a second way to run code through XML-RPC (a protocol for sending software requests) when API access controls were weak. PaperCut had disclosed the original two flaws and issued an emergency patch; Hunt.io shared its new findings and victim data with national incident-response teams for victim notification before publishing on Oct. 15. The files listed 1,005 reconnaissance targets across at least 45 countries. Separate execution logs showed 2,165 attempts, with only five confirmed interactive sessions. Packaged victim data included 46 distinct Active Directory domains (groups of centrally managed computers) and 45 targets with active tunnels into their internal networks when captured.
Negative - AI-assisted attackers held victim data and active tunnels into 45 targets, maintaining access inside compromised networks.
ScienceOct 16
Image: anthropic.com
Claude helps reconstruct the origins of cryptographic settings
An internal Claude research model took under half an hour to trace starting values for five NIST prime elliptic curves (mathematical structures used in cryptography), Anthropic says. Those values came from a random-number generator in a C programming library initialized with Unix timestamps (a numerical way to record time). Anthropic also reconstructed five ANSI example-curve starting values, four NIST binary-curve starting values and the starting points for six curves, with code to reproduce the results. The company argues that reconstructing these recipes makes deliberately chosen backdoors less plausible. On Oct. 16, Anthropic said users need not change anything: the findings reveal no break of ECDSA (a digital-signature method) or new weakness.
Positive - Claude helped reconstruct cryptographic curve origins, and public reproduction code lets others independently check how the parameters were generated.
TextOct 18
Image: The Threshold Report/GPT Image 2.5
Aoki malware adds credential theft from AI coding assistants
Newer Aoki malware samples steal credential and session files from AI coding tools, a capability older samples lacked, Symantec's Threat Hunter team found. Targets include Claude, Codex, Cursor, Codeium, Gemini and other AI assistants, plus AWS credentials and Cursor's local state database, which can contain chat context and code snippets. Stolen keys and tokens can use up victims' AI quotas and potentially give attackers access to connected code repositories, cloud services and software-deployment systems under the victims' identities. Today, Symantec published indicators to help identify infections and said its device-security products detect the family as Infostealer.Aoki and block known malicious files.
Negative - Aoki malware now targets AI-assistant credentials and sessions, giving attackers another route into developers’ accounts and sensitive code context.
