Security
Security Rundown: AI Attacks, Android Trojan, and Agent Vulnerabilities
The first AI-on-AI cybercrime, a $25 WordPress RCE exploit, new malware techniques, and four ways AI agents can be compromised.
Hugging Face Discloses First Confirmed AI-on-AI Breach of a Major Platform
Hugging Face revealed what it considers the first publicly known case of AI-on-AI cybercrime targeting a major AI platform. The attack was driven end-to-end by an autonomous AI agent system and exploited two vulnerabilities in Hugging Face’s data-processing pipeline, allowing code execution on a processing worker server. The attacker gained node-level access, collected cloud and cluster credentials, and moved across several internal clusters over a weekend. The campaign was run by an autonomous agent framework executing thousands of individual actions across a swarm of short-lived sandboxes. Hugging Face used its own AI to detect and analyze the breach. When the team attempted to use frontier models via commercial APIs, the requests were blocked because the models’ safeguards could not distinguish between an attacker and a security team investigating a breach. Instead, the company deployed the Chinese open-weight model GLM 5.2 on its own infrastructure. With AI, Hugging Face examined more than 17,000 recorded events, reconstructed the attack timeline, identified exposed credentials, and distinguished genuine damage from decoy activity—completing in an hour what would normally take days. The company has found no evidence that the attacker tampered with public-facing models, datasets, or Spaces, and has fixed the vulnerabilities, rebuilt compromised nodes, and reported the incident to law enforcement.
Hugging Face: We Used AI to Catch the First Confirmed AI Agent Breach of a Major AI Platform →
AI Model Discovers Full Pre-Auth-to-RCE Chain in WordPress for $25
A security researcher at Searchlight Cyber used OpenAI’s GPT5.6 Sol Ultra model to discover a pre-authentication remote code execution chain in WordPress. After about six hours, the model claimed to have found a pre-authentication SQL injection, which the researcher verified by installing a stock WordPress instance and having the model steal the administrator’s email. The model then spent another four hours confirming that the read-only SQLi could be escalated to full RCE. Total usage cost roughly $25. The initial bug lies in the WordPress batch API, introduced in WordPress 5.6. A desynchronization between the validation and execution loops allows an attacker to bypass sanitization and inject arbitrary SQL via the author_exclude parameter. From there, the model built a chain: poison the per-request cache via UNION-based SQLi, abuse the embed feature to create arbitrary post types, fabricate a customize_changeset post to temporarily become administrator, and then trigger a parse_request hook to replay the batch request with admin privileges, ultimately creating a new administrator account and uploading a backdoor plugin. The full exploit chain was produced in just over 10 hours. The researcher stated that no human security researcher could have found and completed this chain in that timeframe without AI.
HOLLOWGRAPH Malware Uses Microsoft 365 Calendar as Covert C2 Channel
Group-IB identified HOLLOWGRAPH, a .NET NativeAOT-compiled DLL attributed with high confidence to the Cavern backdoor framework. The malware uses the Microsoft Graph API through a compromised Microsoft 365 account observed in Israel to communicate with its operators. It treats the compromised mailbox’s calendar as a two-way dead-drop: operators plant tasking as calendar events dated 13 May 2050, and the implant exfiltrates stolen files by creating its own events with encrypted data attached. A secondary channel uses DNS tunneling via IPv6 AAAA records against the attacker-controlled domain cloudlanecdn.com to refresh Microsoft Entra ID credentials. Group-IB identified 12 victims carrying the implant, with approximately three actively communicating with the attacker during the observation period (3 June 2026 to 9 July 2026). The compromised mailbox and malware uploads originate from Israel, suggesting a focused interest in Israeli entities. The malware supports two commands: get and send, using hybrid RSA + AES encryption. The command format matches Cavern’s syntax, and shared technical characteristics with a Lyceum .NET modular backdoor from early 2025 support a potential link, though Group-IB assesses this with low confidence. The attack demonstrates high technical sophistication and a targeted approach.
RedHook Android Trojan Abuses Wireless Debugging for Remote Control
Group-IB analyzed RedHook, an upgraded Android remote access trojan that abuses Android’s Wireless Debugging feature (introduced in Android 11) to gain shell-level privileges. The attack begins with social engineering: criminals posing as bank employees or support agents direct victims to fake websites to sideload an APK. After installation, the app tricks the victim into enabling Accessibility access, then uses that permission to simulate taps, open Settings, enable Developer Options, and turn on Wireless Debugging. The malware reads the pairing code and connects back to the phone via localhost, effectively granting its own debugging controls without a computer. Group-IB identified 53 commands available to attackers, including streaming the screen, recording keystrokes, simulating taps, collecting contacts and messages, installing or removing APKs, creating fake overlays, activating the camera, and remotely controlling the device. RedHook persists by playing silent audio, using a WakeLock, and deploying two services that monitor and restart each other. Simply swiping the app away is unlikely to remove it. Warning signs include unsolicited installation requests, Accessibility prompts without clear need, and sudden enabling of Developer Options. Users should install apps only through Google Play, verify callers directly, and treat Accessibility access as highly sensitive.
RedHook Android malware can quietly hijack your phone →
Four Research Findings Expose Same Underlying Flaw in AI Agent Security
Over roughly ten days in July 2025, four separate research findings demonstrated vulnerabilities in AI agents, all stemming from the same root cause: the agent behaves correctly, but the surrounding systems—clicks, memory, weights, and connectors—are insecure. Manifold Security showed that any browser extension installed alongside Anthropic’s Claude for Chrome can forge a user click in six lines of code, allowing the rogue extension to read Gmail, Google Docs, and Calendar. The flaw persists despite eight releases since notification. A paper on arXiv demonstrated that a single email can plant a false memory in an AI agent: in more than half of cases, the agent saved the attacker’s instructions into long-term memory without warning, persisting across sessions as a form of prompt injection. Cybersecurity lecturer Katie Paxton-Fear and colleagues poisoned an open-weight model in about an hour for less than £75, using ten tainted training examples to make the model write code with hidden security holes. Separately, David Kaplan at Origin built a rigged model that silently steals data through an email tool. Security firm PromptArmor studied connectors linking ChatGPT and Claude to external services, finding that connectors changed on average every nine minutes; the Dropbox connector grew from eight tools to 24, and added four tools that can destroy data. All four vulnerabilities share the same pattern: the agent follows instructions faithfully, but the security failure lies in the click it trusts, the memory it keeps, the weights it inherits, or the connector it calls. The industry knows theoretical fixes, but implementing guardrails slows agents—and speed remains the current selling point.
Four teams just broke AI agents four ways in ten days. The flaw is the same one. →