← Cybersecurity Today
Cybersecurity Today
OpenAI's Rogue Agent Hacks Hugging Face, a Claude Cowork Escape, and Microsoft's Very Bad Week
00:09:47
Loading summary
Transcript1 lines
- [00:00]
A
We now know which AI firm's agent went rogue and hacked Hugging Face. A free fix is out for the Legacy Hive bug. Microsoft's email service is locking people out of their inboxes. Meanwhile, a bad Azure region takes down SharePoint Teams and half of Microsoft 365 and Anthropic's AI agent could slip its sandbox. This is Cybersecurity Today and I'm your host David Shipley. Let's get started. We now know who was behind last week's attack on Hugging face. It was OpenAI. The company admitted on Tuesday that its AI compromised the model sharing platform. It happened during an internal test built to measure how good their models were at breaking into things. OpenAI was running a benchmark called Exploit Gym to score the offensive cyber skills of GPT 5.6 solutions and an unnamed more capable pre release model. To find the ceiling, it stripped out the production classifiers that normally block high risk cyber activity. The models were supposed to stay boxed in with network access limited to a package registry proxy. They didn't. The models found and exploited a zero day in that proxy escalated privileges, moved laterally through OpenAI's own research environment and and reached a node with open Internet access. From there they reasoned that Hugging Face might be hosting the answers to the very benchmark they were trying to ace. So they went and they took them, chaining stolen credentials and fresh zero days into a remote code execution path on Hugging Face's servers. All to cheat the test. Hugging Face says that they caught and contained the activity. OpenAI has disclosed the proxy flaw and says it's tightening its controls. We covered the Hugging Face breach earlier this week as the first real agentic attacker event. Now both companies are billing it as that the autonomous rogue model the industry has been predicting. Or is it? Whether this is a genuine security scare or a piece of capability theater aimed at the Mythos marketing juggernaut is an open question. A model that jailbreaked itself to win a benchmark makes for one heck of a product demo. Here's the first of three Microsoft stories today, and this one's a ray of sunshine before the clouds roll in. Last week we covered Legacy Hive, the Windows zero day dropped by the researcher known as Nightmare Eclipse on the same day as July's patch Tuesday. It lets a regular non admin user mount another user's registry Hive, lift their stored secrets and plant code that runs the next time an admin logs in. Security researcher Kevin Beaumont confirmed the exploit works. A day after the proof of concept landed, Microsoft says it's still investigating the validity and hasn't assigned a cve, let alone ship to fix Enter zero patch across Security has released free unofficial micro patches for Windows 102004 and later and Windows Server 2022 and later with zero patch on. The exploit still fires, but it loads a throwaway temporary hive instead of the admins. Useless to an attacker. No reboot is required. Legacy Hive is just the latest from Nightmare Eclipse, who's been tormenting Microsoft by dropping Windows and Defender zero days at a steady clip right after patch Tuesdays. Microsoft has caught up on some of them. It fixed the yellow key and green plasma bitlocker bugs and the mini plasma flaw in June and the rogue Planet Defender zero day in July. The rest are still open. Blue Hammer, Red sun and Undefend are sitting without an official patch and now Legacy Hive joins that list. The difference being it has a free stopgap while everyone waits on Redmond and the clouds roll in for Microsoft. Since Sunday, Redmond has been shoving Exchange Online mailboxes into quarantine for no good reason. Some users can't reliably send or receive email and can't get at their calendars. Anyone emailing an affected mailbox gets a bounce back non delivery report instead. The culprit tracked as EX1436407 is a familiar one. Microsoft made an infrastructure change. That change chewed through memory thanks to some unexpected indexing data, and the resulting out of box memory condition started flinging innocent mailboxes into the penalty box. Here's the part that stings. This is a rerun. It's a recurrence of an earlier incident, EX143 4354, which means the first fix didn't take and Microsoft is now cleaning up the same mess for a second time. That cleanup is grinding along. The excess indexing Data went from 66% cleared on Wednesday afternoon to 72% by Wednesday evening, with mailboxes trick out of quarantine as memory levels get validated region by region. No completion date for the work was available as of recording on Thursday. This is the latest Exchange Online headache of late. Bad Anti Spam Rules, a machine learning model that decided all Gmail was spam and phishing heuristics that flagged thousands of legitimate URLs. Here's hoping the Exchange Online team catches a break soon. And to close out Redmond's rough week, here's a big one. On Thursday morning, Microsoft 365 fell over across North America down detector went from a baseline of 29 reports to more than 2,400 inside an hour. SharePoint drove 78% of the complaints, with Excel at 11% and Admin center at six teams. Chat dropped images, OneDrive access went intermittent, Copilot stalled, and Power Automate flows stopped loading. The Microsoft 365 symptoms, though, were just the tip of the full incident. Iceberg underneath set a broader Azure outage in the US west region beginning around 1444 UTC. With networking and traffic routing anomalies at the core, the impacted Azure list ran long. Application Gateway, Azure Kubernetes Service, Azure Firewall, API Management Sentinel, Microsoft Graphed, Power BI Embedded, and more. Anything whose traffic crossed the affected US west paths was caught in the blast radius. Microsoft rerouted traffic, watched the first attempts fail, and then said it had likely identified the cause and was deploying mitigations. The same trigger here for this incident as so many lately A networking change in one region rippling out across the cloud and we end today's episode where we started with an AI breaking out of its sandbox Researchers at Accomplish AI have disclosed a sandbox escape in Anthropic's Cloud cowork, the Agentic desktop app. They've named it Shared Root, and they say roughly 500,000 macOS users running local cowork sessions are exposed. Here's the setup. Cowork does its work normally inside a Linux vm, but the entire host file system all the max root gets mounted into that vm. Read write visible to guest root at a hidden path, so the whole game becomes getting root inside the guest. The researchers did it by abusing Linux user namespaces to reach a kernel traffic control module, then exploiting a freshly disclosed flaw CVE202646 331, nicknamed P edit cow. One short message to a fresh session and the agent was reading and writing files across the Mac ssh keys. Cloud credentials the lot with no permission prompt. Anthropic closed the vulnerability report as informative without issuing a fix. Its position is that the current version defaults to cloud execution, which sidesteps the problem. Users who deliberately run the agent locally are still exposed. If you're running Cowork locally, there's work to do. Accomplishes guidance is to scope the mount or at a minimum, make it read only, and to run the coworkd daemon with Protect System strict in its mount namespace so a session user can't poison the binaries it re executes. Beyond that, disable unprivileged user namespaces. Keep the seccomp filter tight rather than permissive and stop auto loading. Kernel modules do that and even a full guest route has nowhere to land. The last two steps of the chain break. And that's Cybersecurity today for Friday, July 24, 2026. I've been your host, David Shipley. Thanks for listening. We appreciate all of your feedback. Feel free to reach out to us@technewsday.com or CA. Or you can leave a comment under the YouTube video in Saturday's Cybersecurity Today. On the weekend, I'll be chatting with Matt Burke, a seasoned CISO at Bespoke Conc Services about the challenges of protecting healthcare from cyber threats in 2026. It's a perfect listen for a Saturday morning with your coffee or tea. I'll be back on Monday with the latest headlines. Until then, I hope you have a great weekend and pour one out for Microsoft's Incident Response Team, who hopefully have a much better Last week of July.