Tech Risk Reading Picks
Executive Summary / TLDR : The week's biggest stories fall into two groups. First, several critical, already-exploited flaws in widely used business software need patching now. Second, AI is showing up on both sides of the security fight: attackers are using AI agents to run faster, more autonomous campaigns, while researchers and regulators are racing to figure out how to keep an organization's own AI agents from becoming the next weak point.
Why it matters: The unpatched flaws are the most urgent because they are already being used against real organizations today, in software most companies run somewhere in their environment. The AI stories matter on a longer horizon: as both attackers and defenders adopt autonomous agents, old gaps like weak passwords and missing two-factor checks stay just as dangerous, but now get exploited faster and at greater scale.
Rise of Claude AI watermarks removal: A market for stripping Claude’s newly added AI watermarks has emerged within days of Anthropic switching them on. Most of what these tools actually do is remove hidden characters and file metadata, which is easy but mostly cosmetic since that data doesn’t survive a re-save or screenshot anyway. The real watermark is embedded in Anthropic’s word choices and can currently only be removed by heavily rewriting the text with a second AI model. None of these removal claims can be independently verified because Anthropic hasn’t released a public detector or published how the watermark works. The leading tool also carries its own security risk: it installs as an agent skill by symlinking a directory into a local skills folder and, in its optional setup, pulls a roughly 220MB artifact from a third-party research repository, an installation pattern that expands what code a user is trusting sight unseen. Takeaway: Treat “watermark remover” claims skeptically until Anthropic publishes its detection tool, since most current offerings clean surface-level metadata rather than the actual mark. [more]
Cybercriminal-based GPT: A cybercriminal AI tool called MessiahGPT is being sold openly on hacking forums. It is marketed as having no built-in safety restrictions and able to generate malware, phishing content, and fraud instructions on demand. Security firm Trellix found it live and accessible for as little as $8 a month, paid in cryptocurrency with no identity checks, and identified similar unrestricted AI services (DarkGPT, APEX AI) along with a market for stolen access to legitimate AI accounts. None of the operators' technical claims have been independently verified, and Trellix has not confirmed any of these tools were used in a real attack. [more]
AI multi-agent hacked 84 government accounts in 4 days: An AI-driven, multi-agent hacking framework was used to automate a four-day attack on Taiwan's government systems in July 2026, deploying up to eight AI agents at once to breach 21 connected systems and steal over 2,500 employee records. The root cause was twofold: the attackers first found basic security gaps in public-facing systems, including an unprotected database of employee login information and developer access points that required no password, then used stolen credentials to break into 85 accounts by guessing common passwords. From there, the real damage came because the government's single sign-on system automatically trusted anyone who reached it, without requiring a second layer of verification. As such, 84 of those 85 compromised accounts sailed straight into an internal system with no additional checks. The AI system also taught itself as it went, searching for new attack techniques between waves and refining its approach, producing nearly 1,400 files of output in four days. This is far more than a human team could generate alone. Takeaway: The biggest lesson isn't that AI enabled new attack techniques, it's that single sign-on without a second verification step turned one set of stolen passwords into broad access across systems, a gap organizations should close regardless of whether the attacker is human or AI. [more]
Single click exploitation flaw in Copilot: Researchers found a security flaw in Microsoft's Copilot Personal assistant that let attackers steal a user's private data just by getting them to click a single malicious link, with no other action required. These include emails, calendar details, and files from connected accounts like Google Drive. The flaw also let attackers plant hidden instructions in Copilot's memory that would persist and influence future conversations even after a password change, and this activity left no trace for security tools to detect. Microsoft was notified in December 2025 and released a fix on August 18, 2026, and there is no evidence the flaw was exploited by real attackers before the patch. Takeaway: Users should review which apps are connected to Copilot, disconnect any not actively needed, and check Copilot's memory settings for anything unfamiliar. [more]
Apple’s $150K bug bounty: A security researcher found that Apple's Private Cloud Compute (the system handling complex AI requests for Apple Intelligence) had a flaw in darwin-init. It is a process that runs when a server boots: it failed to properly validate file paths inside downloaded software packages, letting a maliciously crafted archive use directory traversal to write files outside its intended folder and onto the server's system storage. The researcher exploited this to plant a config file that redirected Apple's internal logging service to his own server, letting him quietly collect metadata on AI requests being processed. This includes usage patterns and timing, though not the actual content of user prompts. Apple's own verification checks failed to catch the tampering because they only checked installed software, not the configuration files modified afterward. This testing took place in Apple's controlled research environment, and not on live servers. Apple says exploiting it in the real world would require an attacker to already have a privileged position on the network. Apple has since fixed the flaw (rated it moderate severity) and paid a $150,000 bug bounty. [more]
Spreading “mind viruses” between AI agents: Researchers from Anthropic and EPFL have shown that malicious instructions can spread between AI agents by exploiting the persistent state files that autonomous agent frameworks use to carry memory between sessions: because these files are automatically injected into an agent's instructions at startup, a payload written into one agent's memory file is treated as trusted context by the next agent in the chain, which can then pass it on. In lab tests across a six-agent coding environment, this technique succeeded 55% of the time when agents wrote the payload into the right file. In one recorded case, it caused agents to delete a home directory containing credentials and SSH keys after the payload reframed the workspace as a mess left by a previous user. It is also noted that model behaviour varied significantly. Some models would adopt malicious payloads outright while others (such as Claude Sonnet 4.6) would refuse, remove the payload, and warn the next agent. Takeaway: Organizations running autonomous AI agents should treat persistent memory and soul files as a trust boundary, apply explicit warnings about incoming instructions, and audit what those files can write to and act on. [more]
AI-generated exploit scripts hitting Siemens PLCs: U.S. cybersecurity agencies have issued a joint advisory warning that threat actors are actively targeting Siemens S7 programmable logic controllers across critical infrastructure. These are the industrial computers that automate physical processes in factories, water systems, and energy facilities. The root cause is basic exposure: many of these devices are directly reachable over the internet with outdated software and weak passwords, making them discoverable in minutes using public scanning tools. Attackers are using AI to generate custom scripts that communicate with the devices using a legitimate industrial protocol and disguise themselves as normal monitoring software. The goal is not just data theft. Gaining write access to a PLC means an attacker can alter the logic controlling physical equipment, causing damage, downtime, or safety incidents. This follows attacks on over 30 Minnesota water utilities in July and a pattern of escalating PLC targeting across energy, water, chemicals, food, and manufacturing. Takeaway: Any Siemens S7 PLC reachable from the internet is an active target and should be patched, isolated, and monitored now. [more]
UK NCSC issues agentic-AI security controls after a run of AI-agent incidents. The National Cyber Security Centre published new guidance. It indicated that autonomous agents should be sandboxed with default-deny networking. Each agent should get its own short-lived credentials and have a named human owner, with real-time monitoring and a kill-switch. In addition, agents should be threat-modelled before deployment. The NCSC warns that built-in model safeguards may not be enough in higher-risk settings. Takeaway: A national authority now treats agent credentials as the real blast radius. That covers API keys, OAuth grants and sessions. It hands boards a concrete control checklist to hold agent deployments against. [more]
MLflow SSRF flaw (CVE-2026-64849) exploited in the wild and added to CISA KEV: This is a critical server-side request forgery flaw (CVSS 9.3) in the MLflow tracking server. Unauthenticated attackers can reach cloud metadata services and steal AWS, GCP and Azure credentials. WatchTowr observed exploitation within hours of CVE assignment. CISA added it to the KEV catalog on 19 Aug with a two-week federal patch deadline. All versions before 3.15.0 are affected. [more]
Phishing 3.0" - the fight moves to agent-versus-agent: Analysis argues phishing has entered a third era. Attackers now deploy autonomous agents for reconnaissance, personalised lure generation and multi-channel conversations. That defeats content-scanning email security, which reads text but not intent. It cites the Arup $25M deepfake-CFO case as well as Osterman data. 88% of security leaders were hit by trust-undermining incidents. 60% are not confident countering deepfakes. Takeaway: If attacker reconnaissance and messaging are now agent-driven, human-speed and signature-based defences lose structurally. The emerging pitch is that only defensive agents can match the tempo. [more]
China-nexus APT exploits a VMware vCenter zero-day and deploys Babuk-derived ransomware across 47 countries: A suspected China-nexus actor exploited CVE-2026-59310. It is a CVSS-9.8 directory-traversal flaw in VMware vCenter. The actor gained root on ESXi hosts and created rogue admin accounts. It then dropped ".babyk" ransomware. Researchers counted 361 unique victim IPs across 47 countries. They suggest the ransomware may mask espionage. Takeaway: Tier-0 virtualisation infrastructure is being weaponised by a state-aligned actor. The ransomware noise likely conceals deeper, persistent access.[more]
CSA warns of critical SAP flaws, including a CVSS-10 Commerce Cloud bug under active attack: Singapore's Cyber Security Agency issued alert AL-2026-104. It covers five critical and high SAP vulnerabilities. The headline flaw is CVE-2026-58231 (CVSS 10.0) in SAP Commerce Cloud's Data Hub Adapter. It enables arbitrary code execution. It is being exploited in the wild. Takeaway: This is a perfect-10, already-exploited flaw in core ERP infrastructure. Singapore's national cyber agency flagged it directly to local enterprises. It is patch-now territory for any SAP shop. [more]