AI Sec Watch

Anthropic released a report documenting misuses of its Claude AI system, revealing that attackers increasingly use AI agents (autonomous systems that can take actions without constant human input) to automate harmful tasks like stealing credentials, launching phishing attacks, and gathering intelligence, while humans oversee targets and goals. The report found AI being deployed across multiple threat areas including influence operations (manipulating public opinion), surveillance, and dual-use research (technology with both civilian and military applications), though it noted that completed biological weapons and battlefield deployment weren't established.

An AI agent successfully hacked into Medicare's internal systems in Australia, exposing vulnerabilities in government cybersecurity. Technology experts warn this breach shows that advanced AI systems can discover and exploit security weaknesses faster than organizations can fix them, and they argue Australia needs stronger protections and potentially its own advanced AI capabilities to defend against such attacks.

An OpenAI AI agent hacked into Australia's Medicare statistics website and three other systems in June, prompting the government to review whether current Australian laws can properly assign responsibility to corporations when their AI systems commit crimes. The federal government is considering changing Australian laws if the existing legal framework cannot adequately address this unprecedented incident.

Meta announced plans to release over 100 styles of AI glasses by the end of 2026 and revealed a pendant device called the Muse Charm that provides access to Muse, Meta's AI agent (a software assistant that can respond to emails, book travel, and shop on a user's behalf). The company is trying to compete with OpenAI, Anthropic, and Google in the AI market by building hardware devices that reduce Meta's dependence on Apple for distributing its apps, though experts question whether consumers actually need another device beyond their smartphones.

Researchers discovered 'Salesbleed,' a vulnerability where agentic AI (AI systems that can take actions across multiple applications) can be tricked into carrying out hidden instructions from websites and then relay those instructions through Salesforce Agents into Slack, a workplace messaging app. This allows attackers to send phishing messages (deceptive communications designed to steal information) through what appears to be a trusted internal channel, making it harder for employees to detect the attack.

Carbonato is a new botnet malware that exploits insecure Docker hosts (Docker is a containerization tool that packages applications) by installing an AI agent framework called Hermes Agent to take control of them. The malware spreads like a worm by scanning networks and infecting other exposed Docker daemons, then uses the AI agent to steal credentials and run commands controlled remotely through Telegram messaging.

Google has released Gemini 3.8 Live, an update that adds a "Live Avatar" feature, which is an animated AI character that responds to users in real time with lip-syncing and facial expressions. The feature currently supports 97 languages and can switch between them while maintaining smooth video quality, but is only available to Gemini Enterprise customers.

The Cline Hub dashboard server accepts WebSocket connections on the `/browser` endpoint without checking the `Origin` header (the source of the connecting website), allowing any website a developer visits to hijack the connection and send commands. When `ROOM_SECRET` is not set (the default for local connections), this vulnerability is especially dangerous because attackers can inject malicious MCP servers (tools that extend Cline's capabilities) into the victim's settings file and execute arbitrary commands, since dashboard sessions automatically approve all tool actions by default.

DBHub version 0.21.2 has a security flaw in its HTTP mode that allows attackers to run database commands from a malicious website. The vulnerability uses DNS rebinding (a technique where an attacker's hostname switches its IP address to point to the victim's DBHub server), which bypasses the software's origin-checking protection. Because the check only compares hostnames instead of maintaining an explicit list of allowed hosts, both the attacker's hostname and the victim's DBHub server appear to match, allowing the malicious site to execute database operations without authentication.