A Contractor’s Personal AI Agent Reportedly Ran on a Pentagon Network for Two Months and Sent Logins to an Outside Website
On October 29, WIRED reported, citing unnamed sources, that earlier this year an Accenture contractor had connected a secure Defense Department system to a personal account for Claude Code, Anthropic’s AI coding agent. The system, used by several intelligence agencies, runs on NIPRNet, the Pentagon’s network for unclassified information, and holds sensitive material that isn’t released to the public without review. Defense Department staff are barred from using Claude.
To let the agent write code and set up cloud servers, the contractor reportedly gave it their login. That gave the agent administrator access and let it bypass normal login checks. It ran for two months before anyone found it. The agent needed the internet to work, and it appears to have sent the contractor’s login credentials, passwords, and a map of the network to an outside website. NIST has flagged that site as high risk, because a flaw in it could let attackers plant instructions in coding agents to steal credentials. Contractors must report incidents within 72 hours, and WIRED’s sources say Accenture didn’t initially report this one.
Accenture says the allegations “were thoroughly and independently investigated and found to be without merit.” WIRED reports no sign that hackers reached a classified system.
A Tampered Claude Code Add-On Sat in Cursor’s Extension Store for 11 Hours and Planted an Attacker’s Key on Developers’ Computers
Cursor, an AI code editor, runs its own store for add-ons called extensions. On October 29, from about 2:27 a.m. to 1:35 p.m. Pacific, that store offered tampered versions of the extension that brings Claude Code into the editor. Cursor says Anthropic didn’t make them.
The bad versions, 2.1.312 and 2.1.313 for Mac and Windows, ran extra code as soon as they loaded. That code collected the computer’s name, the user’s name, the Git email address, and the names of settings that looked like keys or passwords. It added the attacker’s key to the list of keys allowed to log in to the machine over SSH, a remote login tool. It installed scripts to keep reopening a tunnel to the attacker’s server, and sent that server what it had collected. Cursor says the attacker couldn’t have logged in through the tunnel on most machines, because switching on SSH needs administrator rights the extension didn’t have. StepSecurity, which recovered the code, found it never read the values behind those setting names or touched Claude data.
Cursor pulled the extension, rebuilt the store, rotated its keys, and got the attacker’s server taken offline. Uninstalling the extension may not remove the scripts it left behind, so Cursor has published scripts that do.
A China-Linked Spy Group Ran Simultaneous AI-Agent Break-Ins at Foreign Ministries and Drug Makers
ARTEX is a framework that divides a hacking job among AI agents: a main agent directs planner and worker agents, which share a common record of what they find. On October 29, CrowdStrike reported that a China-linked espionage group it calls VAPOR PANDA had used a single ARTEX controller against more than 200 organizations in at least 14 countries, starting October 17. The targets included foreign ministries and drug makers. The agents ran mostly on DeepSeek’s model, plus a second paid model CrowdStrike couldn’t identify with certainty.
Recovered transcripts show a person instructing the agents in Chinese at decision points. At a Greek government body, the operator handed the agents a 2022 export from its mail server, holding keys that had likely not been changed since. The agents used those keys to forge an administrator login and read mailboxes. CrowdStrike confirmed follow-on activity at nine organizations. It describes extensive intrusions at two Latin American foreign ministries, and a Middle Eastern interior ministry was also compromised.
CrowdStrike says the campaign is separate from the ARTEX activity Microsoft reported on October 21, and reads that as a sign the tool is spreading among China-linked groups. On October 28, the UK domain registrar 123 Reg told The Register that ARTEX turned up in a September break-in that exposed customer contact details.
A Claude Research Model Wrote an Exploit That Takes Over Linux Servers Remotely, and Ubuntu Hasn’t Shipped the Fix
On October 27, Anthropic described five exploit chains, multistep attacks that an unreleased internal research model built “after initial prompting.” One took over Chrome from a single click, and Google has patched 62 flaws Anthropic reported from this research.
The Linux chain needs no click. If two processor cores handle the same incoming connection request at once, the kernel, the part of the operating system that controls the hardware, can read memory it has already freed. Anthropic’s exploit used that against servers listening for multipath TCP, a feature that lets one connection use several network paths. When the timing misses, only that connection fails, so an attacker can keep trying. In Anthropic’s test, leaking the kernel’s memory layout took 48 minutes, and running a command as root, the account with full control, took five more.
The fix entered the main Linux code on October 5. Most servers, though, run a kernel packaged by their Linux distribution. As of November 3, Ubuntu’s tracker listed its current releases as vulnerable, with fixes in progress. Red Hat rates the flaw critical and says it is speeding up fixes. Both offer a firewall rule as a stopgap, and both say it reduces the risk without removing it.
UK Regulators Warn That an AI Agent’s Autonomy Won’t Excuse the Company That Deploys It
On October 30, four UK regulators issued a joint statement on personal AI agents, the kind that make purchases and contact businesses on a user’s behalf. The four oversee competition and consumers (the CMA), financial services (the FCA), data protection (the ICO), and communications (Ofcom), and work together as the Digital Regulation Cooperation Forum.
The statement says existing law already covers these agents, from consumer and data protection rules to payments and cybersecurity requirements. “An AI agent’s autonomy does not diminish the responsibility of organisations that deploy it,” it says. If they reasonably suspect a breach that risks harm, the regulators write, “we will not hesitate to use our powers.”
The risks they name include fraud, personal data shared in ways users don’t expect, and misleading recommendations. The regulators say companies building or deploying agents should think through how users will know when an agent acts for them and how it got permission. Those companies should also work out how users’ data is used, what commercial interests shape its recommendations, who is accountable, and how users get redress.
Hong Kong’s Banks Scored 2.3 out of 10 on Quantum Readiness, and Their Regulator Has Handed Them a Playbook
A large enough quantum computer could break the public-key cryptography behind online banking, and data stolen today could be decrypted once such a machine exists. In July, the Hong Kong Monetary Authority (HKMA), the city’s banking regulator, began scoring banks on their readiness to switch to quantum-resistant cryptography. The sector’s first score was 2.3 out of 10. The HKMA wants it at 10 by 2030 and has asked banks to inventory their cryptography and write a transition roadmap.
On November 2, the HKMA and the Hong Kong University of Science and Technology published a manual of more than 100 pages for running that switch. Under it, every significant use of cryptography gets a named owner, and a migration counts as finished only when there is evidence that the new protection works and the old arrangement has been withdrawn where required.
The manual says that it creates no new requirements and that its effectiveness, cost, and scalability across banks “have yet to be established empirically.”
The stories change every week. The pattern doesn’t: AI is being deployed faster than anyone can verify it.
We cover the headlines every Tuesday. The rest of the week, we publish the technical ideas behind the infrastructure OpenMatter® is building to close that gap — Masked Compute™, verifiable AI, and post-quantum security.
Follow along at openmatter.network.
Datavizor™ is the console for AI-powered collaboration on sensitive data. Free to start at datavizor.openmatter.network.