9 stories from 9 sources

AI agents push cyberattacks toward greater scale and automation

Day’s Recap

Supporting Articles

10:35 AMPYMNTS

Hackers Use AI Agents to Do Hacking for Them

Summary

Research by NorForge found that publicly exposed control panels for AI-driven penetration-testing systems are being used in malicious cyber operations. The systems allow attackers to delegate reconnaissance and other hacking tasks to AI agents.

The shift is from using AI as an assistant to deploying agents that can execute

Why it matters

Automation can increase the speed, scale, and repeatability of attacks without requiring a large or highly skilled criminal team.

Link to Story

9:58 AMThe Verge

A hacker broke into John Deere and SharkNinja with an army of AI agents

Summary

NorForge found that one hacker used a large group of mostly autonomous AI agents to breach more than 100 websites. Reuters reported that the victims included John Deere, SharkNinja, and Cummins, although NorForge did not publicly identify the targets.

The reported scale shows that AI agents can turn a single operator into a distributed

Why it matters

A single attacker can now multiply reconnaissance and intrusion attempts across a broad target set.

Link to Story

3:28 PMTechCrunch

Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts

Summary

Attackers compromised part of OpenCode’s online platform and obtained some users’ API keys, allowing them to use connected AI services and generate charges on those accounts. AI tools used to inspect the incident reportedly refused to analyze the malicious code involved.

The breach turns coding assistants into a billing and credential risk, not just a software

Why it matters

A compromised coding agent can expose credentials and create direct financial losses through unauthorized model usage.

Link to Story

3:39 PMArs Technica

PSA: Patch your Plex media server before someone hacks it

Summary

Attackers are exploiting a chain of four recently patched vulnerabilities in Plex Media servers to compromise systems that have not been updated. The attacks can be used to install malware on vulnerable devices.

The active exploitation changes these flaws from routine patching items into an immediate incident-response priority.

Why it matters

A publicly exposed Plex server that misses the fixes can become an entry point for malware.

Link to Story

Other Developments

A curated list of other prominent stories from this day.

3:53 PMEconomic Times

SBI data breach claim: Hackers allegedly access 3.75 lakh accounts

Summary

A threat actor claims to have accessed data linked to 3.75 lakh State Bank of India accounts and describes the disclosure as its first release. The dataset's authenticity, origin and scope remain unverified.

The central fact is not a confirmed breach but an unverified claim with potentially wide

Why it matters

The claim could signal mass customer exposure, but its credibility must be established before the scale of the risk is known.

Link to Story

11:09 AMAirguide Info

How to Avoid AI Scams as Criminals Use Artificial Intelligence

Summary

Criminals are using generative AI to produce convincing fake online stores, voice messages, and other scams at greater speed and scale. The guidance recommends verifying identities and payment requests through trusted channels rather than relying on realistic-looking content.

AI has lowered the cost of impersonation and made traditional warning signs less reliable. Consumers

Why it matters

The main defense is shifting from spotting bad content to verifying requests through a separate, trusted channel.

Link to Story

9:48 AMKrebs on Security

Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

Summary

Federal investigators suspect executives at two ransomware negotiation firms maintained unusually close ties to ShinyHunters, the group accused of stealing sensitive FBI data. Sources say one U.S.-based executive may have helped operate the group’s extortion website and pressure victims to pay.

The investigation points to a possible operational link between legitimate-looking ransom negotiators and a criminal

Why it matters

A trusted intermediary may have functioned as part of the attack infrastructure rather than as a neutral negotiator.

Link to Story

7:07 AMSchneier on Security

Training AIs to Solve CAPTCHAs

Summary

Researchers describe a CAPTCHA-solving system that combines a fine-tuned YOLOv8 detector with an open-weight vision-language model and routes challenges based on confidence. Unlike systems that either start from scratch or handle only fixed puzzle types, it is designed to improve with repeated use while operating through screenshots and operating-system input events alone.

The key shift is from one-shot CAPTCHA solving to a solver that becomes faster and

Why it matters

CAPTCHAs are moving from a durable bot defense toward a speed bump that adaptive AI systems can learn to remove.

Link to Story

7:01 AMFinextra

Crypto Exchange Security: The Infrastructure Behind Secure Trading Platforms

Summary

The article examines the infrastructure required to secure cryptocurrency trading platforms. The available material does not provide further details about the controls or incidents it covers.

The central issue is that exchange security depends on the underlying architecture, not just user-facing

Why it matters

Weak infrastructure can turn a single exchange compromise into a direct loss of customer funds and trust.

Link to Story

Make it yours

Build Your First Pass.

Pick your topics, set your cadence, and receive your personalized First Pass in your inbox. It’s that simple!