Claude Helps Hackers Hunt 1.8M Apps for Secrets
One mislaid key can now invite an industrial-scale treasure hunt.
A massive credential-harvesting scheme orchestrated by a suspected ShinyHunters affiliate relied heavily on Claude, according to Anthropic’s latest threat report.
The French-speaking hacker utilized 10 AWS EC2 instances to pull 1.8 million Android APKs from various marketplaces, tear them down, and hunt for baked-in passwords using TruffleHog. The same operator also audaciously ran a fake French police-branded carding shop hawking stolen payment-card records.
The attacker’s setup piped verified discoveries directly into highly organized Telegram channels. Working in tandem with a secondary tool skimming GitHub for personal access tokens, these twin pipelines supplied the initial entry points for most of the operator’s confirmed enterprise break-ins.
Important caveat: Hackers scanned 1.8 million apps, but that doesn’t mean all 1.8 million were actively breached. However, once an affiliate snagged a valid key, they wasted no time.
One incident saw attackers parlay a lone developer token into complete cloud admin privileges in less than three hours. During a separate supply-chain compromise, autonomous AI agents basically ran the whole show, pillaging over 2,100 Azure AD token sets from more than 40 corporate tenants in just 34 hours.
The Android sweep was one aisle in a much darker catalog: Anthropic also detailed AI-assisted Russian espionage, Chinese exploit research, surveillance, propaganda, fraud, biological misuse, and weapons development. Anthropic has since purged the offending accounts, tightened its security guardrails, and tipped off victims and law enforcement.
Downloadable binaries are entirely searchable attack surfaces, and AI is turning careless credential management into an industrialized hacking assembly line. To stay safe, engineering teams should move privileged operations strictly server-side, enforce extremely short token lifespans, rigorously audit production builds, and aggressively monitor API calls for weird behavior.
Agility’s Digit 5 Steps Outside the Safety Cage
Your new coworker weighs 284 pounds and knows when to sit down.
On Tuesday, Agility Robotics unveiled Digit 5, a humanoid built to ditch the plexiglass barriers that normally keep industrial machines isolated from human workers. If its AI and sensors detect someone approaching, it can change course, stop, or squat into a seated position and cut the power. Flashing lights, audio warnings, and an independent safety controller provide backups.
It is 5 feet 11 inches tall, repeatedly lifts 50 pounds, and reaches 7.2 feet. A 90-minute battery recharges in just nine minutes, funding more than 20 hours of labor per day, while swappable grippers expand its resume from hauling plastic bins to operating machinery and stacking pallets.
Still, ‘designed to be safe’ is not the same as universally certified. The first international humanoid-safety standard remains stuck in committee review, and legged robots are inherently less predictable than wheeled machines.
Agility says Digit 4 has logged 65,000-plus hours and that it has more than $300 million in multiyear orders for the new model, though that cash hinges on hitting strict contractual milestones. Early access begins in early 2027. But the would-be public company—seeking a $2.5 billion SPAC valuation despite an auditor’s “going concern” warning—recorded $1.8 million in 2025 sales against a $140 million operating loss, so humans are not the only ones balancing precariously.
The global ecosystem is rapidly scaling, too: Over the weekend, China’s UBTECH opened a factory targeting one new humanoid every 10 minutes, while Japan’s GMO AI & Robotics is launching a “robot ambulance” to treat broken bots on-site later this month.
CISA Warns of Exploited GitLab File-Read Flaw
CISA says attackers are actively exploiting CVE-2026-85706, a maximum-severity path-traversal bug that lets uncredentialed outsiders pull arbitrary files off vulnerable self-managed GitLab CE and EE servers—provided they host at least one public project.
That can expose configuration files, SSH keys, deployment tokens, and CI/CD secrets, potentially turning a simple file read into a massive software supply-chain breach. Threat intelligence firm WatchTowr has already caught intruders pillaging configs and SSH settings.
Upgrade immediately to 19.1.8, 19.2.6, or 19.3.2, or yank public access while you wait. After that, scour your logs for suspicious POST requests hitting the commits API with a file.path parameter, figure out what was touched, and rotate any scorched credentials. (Cloud users can relax; GitLab.com and dedicated instances are already safe.)
Because even a purely “read-only” bug is enough to hand over the keys to your entire kingdom.
Cisco Email Gateway Zero-Day Grants Root Access
Attackers are actively exploiting CVE-2026-76461, a 9.8-severity zero-day in Cisco Secure Email Gateway. The flaw allows uncredentialed remote attackers to fire off malicious emails that trigger root-level command execution on both physical and virtual devices. CISA gives federal agencies until Sept. 17 to patch it.
Because attackers gain root, they can easily wipe their footprints. Run the command grep -i “COPY.*TO PROGRAM” mail_logs across all cluster nodes, then cross-check external firewall and network logs for sketchy uploads, downloads, or connections.
There is no workaround. Upgrade Cisco AsyncOS to 15.5.5-014, 16.0.4-302, or preferably 16.5.0-780. Save your forensics before rebuilding a compromised virtual appliance (contact Cisco TAC if your hardware box is hit), and cycle all credentials and certs. Cisco has already patched Secure Email Cloud.
When the email bouncer gets owned, everybody’s on the guest list.
OpenAI Reportedly Buys Glass Imaging for AI Eyes
OpenAI reportedly acquired Glass Imaging, an AI camera startup founded by the former Apple engineers behind Portrait Mode, in a deal valuing it at over $300 million—more than triple its roughly $100 million previous valuation. Neither company has confirmed the move, but it adds to OpenAI’s recent shopping spree ahead of a rumored 2027 IPO.
The startup’s core software, GlassAI, uses neural networks to memorize the exact flaws of individual lens and sensor combos. Instead of applying a filter to a finished photo, it processes raw data to instantly correct color, sharpen details, and strip out noise.
The pitch? Wringing DSLR-level quality out of tiny hardware without needing thicker, hideous camera bumps. Its zoom tech already ships in Honor phones.
As The Neuron notes, this is likely less about taking pretty pictures and more about building a visual interface. Better cameras could give an AI assistant the crisp visual data it needs to accurately read a sign, diagnose a broken appliance, or catalog the room you’re in.
While OpenAI is reportedly developing a screenless home speaker with Jony Ive, this camera tech seems tailor-made for the rumored AI agent phone the company is reportedly fast-tracking for 2027.
But OpenAI hasn’t said how Glass fits. Cleaner images don’t guarantee correct AI interpretations, and an always-aware camera would raise awkward questions about local processing, retention, and bystander notice—plus where actual image enhancement ends and AI invention begins.
Apparently, OpenAI’s hardware road map starts with an eye exam. Because we obviously need ChatGPT staring at us in ultra-high definition.
AI Leaders Push to Slow AI Development
AI leaders are debating whether to slow development, but I see a more immediate risk as organizations give AI agents credentials, system access, and autonomy.
Recent Anthropic evaluations showed that risk in practice when AI models gained unauthorized access to third-party systems.
The security question isn’t just what an AI agent can access, but how far it could get before anyone realizes its behavior has crossed a line.
Inventory AI agent access, enforce least privilege, log activity, and ensure you can revoke credentials and terminate access.
Japan Government Breach Exposes 246K People
Japan’s Digital Agency says attackers exploited vulnerable external-facing equipment, potentially exposing data on 246,000 people.
The breach affected 23 government organizations after attackers gained access through a single vulnerable external connection.
A trusted maintenance account pulling unusual volumes of data should be treated as an incident signal, regardless of whether the credentials themselves appear legitimate.
Prioritize patches for internet-facing systems, limit contractor access, and monitor privileged accounts for unusual data transfers.
Attackers Target 1.8M Android Apps for Secrets
Anthropic says a threat actor automated the download and analysis of 1.8 million Android APKs to hunt for hardcoded credentials and other secrets.
In one case, a stolen developer token led to admin access in about three hours.
The real shift here is scale because attackers can automate the search for exposed credentials instead of spending time reverse-engineering individual applications.
Scan production builds for exposed secrets, enforce least privilege, and use short-lived tokens to limit the impact of credential theft.
Twitch Browser Extension Leaks 30K OAuth Tokens
Researchers found a Twitch extension used by 30,000 Chrome users sent OAuth tokens to developer-controlled servers.
Those tokens could provide account access without requiring users’ passwords, turning an extension issue into an account security risk.
Uninstalling the extension does not invalidate credentials already transmitted, so affected users should treat token revocation as part of remediation.
Audit browser extensions, restrict unnecessary permissions, and monitor connections to unapproved external domains.
Brevo Breach Sends Trezor Phish to 347K Users
Attackers breached Trezor’s Brevo account and sent phishing emails to 347,000 subscribers through its legitimate newsletter.
Because the messages came through Trezor’s actual email channel, traditional checks for spoofed senders offered little protection.
The 20-minute response limited the campaign, but 2,500 people still clicked, showing how little time defenders may have once a trusted communications platform is compromised.
Direct users to verify security alerts through your official app or website instead of clicking email links.