Loading summary
Transcript1 lines
- [00:00]
A
20,000 accounts stolen in Instagram AI hack a worm that lies to AI security tools Canadian researchers built an AI worm with a free off the shelf model, an emergency Chrome patch, and why your cyber insurance may quietly stop covering AI. This is Cybersecurity Today and I'm your host David Shipley. Let's get started. We now have the hacked account total from Meta's AI assistant mess up last week, Meta says 20,225 accounts were hijacked, according to Bleeping Computer. Those numbers come from a breach letter Meta filed with Maine's Attorney General. A recap for those who may have missed this story. Instagram's AI powered support tool was tricked into handing over account reset links to to emails that weren't associated with the account. Thanks to a flaw, it never checked that the emails being submitted actually belonged to the account. Attackers supplied their own address, got the reset link and took over. The only accounts this attack didn't work on were ones with multi factor authentication. Letting agentic AI run your support and handing it the keys to reset accounts is asking for this kind of pain right now. There are lots of ways to socially engineer an LLM powered AI staying on the AI thread and on a story we've been tracking for a while. On Monday we covered Miasma, the worm hiding in open source packages to steal developer credentials. It's evolved again. It has a new name and some nasty new tricks. Researchers at Step Security, the firm that found it, call this Wave Hades. Here's what makes this strain stand out. It doesn't just hide from AI security tools, it actively lies to them. The malware can fire the instant a developer opens an infected project in an AI coding assistant, planting fake instructions so the assistant reading the code gets hijacked. Step Security says it targets the config files of 14 different AI tools. Claude, Copilot, Gemini, Codex, and more. Revoke the stolen GitHub token and a background service wipes the machine. It's a digital deadman switch. We've seen each of these tricks alone over the past few years. Malware that lives in memory. Payloads that fool AI analysis code that can wipe a host. What's new is seeing all three riding together in a fast moving, self spreading AI powered worm. That's a whole new kind of problem. And it's where more of these kinds of problems are headed. Meanwhile, Microsoft is still recovering from the Miasma attack that we learned about over the weekend. Microsoft confirmed on Monday that it temporarily removed some GitHub repositories in response to 73 of its open source projects being compromised to inject an information stealer into the code. Among the projects that were infected was Durable Task, a Python package that was first compromised last month by a cybercrime group known as Team PCP to deliver an information stealer designed for Linux systems. It was Team PCP who first built the Shai Hulud AI powered worm that was going around compromising developer packages. They then open sourced that worm and others have since taken over developing derivatives. And now we move from malware in the wild to a lab that shows us where this is all going next. Researchers at the University of Toronto and the Vector Institute built a working AI powered worm, one that spread on its own across a simulated corporate network, adapting its plan as it went. The worm didn't run on Mythos or or any Frontier model for that matter. It ran on a free open large language model on local hardware. And it didn't use a single zero day. It went after exactly what most real attacks already use known unpatched flaws and sloppy configurations. It even pulled in public security advisories on the fly to exploit bugs disclosed after its model was trained. The only good news for now, it's slow. In the test network, it took about five days to reach half the machines, burning hundreds of AI queries per target. But that window narrows as hardware continues to get cheaper and faster. The lead researcher Nicholas Papernot warns the window to prepare for these attacks is closing. The danger here isn't a super intelligent attacker. It's that cheap, ordinary AI can now automate the dull known vulnerability. Grunt work at scale that is the biggest part of advanced persistent threats. Which means the boring basics patching, configuration, access control that we still struggle with. They matter more than ever before. And speaking of known unpatched flaws, here's one to fix today. Bleeping Computer reports Google has shipped an emergency Chrome fix for a zero day under Active Exploitation CVE2026 11645, an out of bounds read write bug in the V8 engine. It's the fifth exploited Chrome zero day this year, and we're only in early June. A specially crafted webpage can trigger it to corrupt memory and run code, and it can be chained to defeat ASLR on the way to a fuller compromise. The patched builds are 14907, 827102 and 103. Security Boulevard reports the emergency fix lands days after Google's regular June release. And that one was huge. Chrome 149 patched 429 flaws well above a normal cycle, and more than 100 of those flaws were critical or high. One angle bug carried a 9.6 on the CVSS severity scale and won someone a $97,000 bounty. Google says none of those 429 bugs it patched were being exploited. The actively attacked zero day is a separate patch on top. A reminder Chrome only applies these patches on restart. A browser that's been open for days may still be exposed, relaunch it, and treat browser patching as the enterprise task. It's now become not just routine end user hygiene. Our last story zooms out from the patch to the growing price tag for insurance. Rates have slid for years and insurers are scrambling to stay profitable, and the result is a harder scrutiny on claims, with policyholders recovering a smaller slice of what a breach actually costs. Here's the part that matters the most for security teams when claims get disputed, the fight often comes down to one key question right now. Was Multi factor authentication actually turned on and enforced when the breach hit? Not did you check the box on the application? If the controls you attested to weren't really in place, your payout may disappear. Cybersecurity dive cites AON figures putting the average global ransomware claim now near $713,000 in 2025. That's almost double the year before. And then there's the impact AI is having on insurance. Several major carriers are quietly backing away from covering AI outputs, carving AI mistakes out of cyber and errors and emissions policies, or pricing them far higher, if you can get that. The reason is simple. They can't trace how many AI tools reached a given result, so they can't price the risk. This trend started late last year when the Financial Times reported that AIG, Great American and WR Berkeley asked U.S. regulators for permission to exclude AI tool liabilities. They're making a distinction between what they will and they won't insure for AI systems. They're looking for governed AI systems and they're looking to avoid experimental ones. A bounded monitored system with a rollback may be insurable. A swarm of autonomous agents with no oversight and no predictability. That's likely going to get you a no. I'm still not convinced that governed AI is actually a thing. Given LLMs at their core are non deterministic. This one is going to continue to evolve. That's Cybersecurity Today for Wednesday, June 10, 2026. I've been your host, David Shipley. Thanks for listening and stay safe out there. We'll be back on Friday with Jim Love on the news destination.