The Wire

Irregular, the cybersecurity firm behind tests in which AI models from Anthropic, OpenAI and Meta compromised real-world computer systems, has declined to say whether other clients experienced the same underlying flaw, The Record reports. Asked directly whether the three publicly disclosed companies were the only ones affected, a spokesperson said the investigation was ongoing and they could not "go into further details."

Anthropologic's Claude, OpenAI's models and Meta's systems all exploited misconfigured testing environments set up by Irregular to reach the public internet. In one case, Anthropic's model built and uploaded malicious code to the Python Package Index that ran on 15 real systems. Irregular said it is developing a white paper on containment best practices in response.

Levi Strauss & Co. disclosed a cyberattack in an SEC filing, saying hackers used social engineering to compromise three company-issued computers and steal corporate data, BleepingComputer reports. The company said it contained the breach quickly and that no customer data was affected, and it has not experienced any business disruptions.

The investigation is ongoing. Levi's said it does not expect the incident to have a material impact on its business or financial position. BleepingComputer could not find threat actors publicly claiming the attack, though some media outlets have linked it to UNC6671, a group associated with recent voice phishing campaigns.

Scamwatch and the Australian Taxation Office are alerting Australians to a rise in impersonation scams as tax time approaches, with criminals making phone calls, sending fake emails and texts, and creating counterfeit websites designed to steal personal information and myGov login credentials.

The scammers use official logos and branding to appear legitimate, create a false sense of urgency to prompt clicking on malicious links, and may urge victims to call numbers connecting them directly to the fraudsters. All Australians, including those not required to lodge tax returns, are at risk.

Scamwatch advises people to ignore unexpected requests for personal or financial information, never click links in unsolicited messages claiming to be from the ATO, and verify any contact by calling the ATO directly on 1800 008 540 or using the official website or app. Anyone who has shared money or personal information should contact the ATO immediately.

Australian scammers are promoting fake cryptocurrency trading platforms to people in messaging groups, Scamwatch reports, with victims lured through social media advertisements claiming to offer stock tips from well-known figures or experts.

The platforms display fake data showing profits and trades but conduct no real trading. Money deposited goes to scammers, who then demand fees to release assets — fees that also go unpaid, according to Scamwatch. Victims are typically invited to WhatsApp or Telegram groups after seeing posts on social media.

Scamwatch said anyone can be targeted, even experienced investors, and warned against joining investment groups, following self-proclaimed trading 'gurus', or acting on unsolicited investment advice. It urged people to check the AUSTRAC register to verify whether a crypto platform is registered and to contact their bank immediately if they have transferred money.

Scammers are operating fraudulent websites and posting ads on social media offering personal loans, Scamwatch reports. Once applicants are approved, they are asked to provide personal identification documents and pay an upfront fee for 'payment protection' or 'loan establishment' insurance before funds are released, with claims the fee will be refunded after three months.

The scammers impersonate licensed financial service providers and loan brokers, sometimes fraudulently quoting ABN registration and credit licence details from ASIC. Scamwatch warns that anyone searching for a loan — particularly those experiencing financial hardship — may be vulnerable, and advises checking that loan providers are licensed through ASIC's professional registers before proceeding.

Australia's National Anti-Scam Centre released findings from a Romance Scam Fusion Cell that ran from July to December 2025, bringing together dating platforms, law enforcement, banks, cryptocurrency exchanges and victim support services to coordinate action against romance fraud.

Romance scams caused $28.6 million in reported losses in 2025 and remain in the top three scam types by financial harm. The taskforce referred 377 scam websites, WhatsApp accounts, emails and social media profiles for takedown, and flagged 1,004 suspected scam transactions and 168 cryptocurrency wallet addresses for investigation and blocking.

"Romance scams are deeply personal crimes that can have lasting emotional and financial impacts," said ACCC Deputy Chair Catriona Lowe. "By sharing intelligence and working collaboratively across sectors, we are better equipped to identify and respond to scam activity earlier."

The fusion cell developed frontline response guides for bank staff and support workers, piloted a disengagement referral process to connect victims with support, and created an online relationship health check tool, Scamwatch reports.

Australian Communications and Media Authority and the National Anti-Scam Centre have issued a joint alert warning of criminals taking control of mobile phone numbers or making unauthorised changes to accounts, then using access to reset passwords and drain bank accounts, myGov subscriptions and rewards programs.

The scam typically starts when a person's email account is compromised, or when scammers obtain ID documents or passwords through phishing or data breaches. Anyone with a mobile number is at risk, though people who suspect they have been caught in a data breach face higher danger. Warning signs include unexpected alerts about mobile account changes, unrequested verification codes, login attempts the person did not make, and a phone suddenly losing signal or switching to 'SOS only', Scamwatch reports.

Scamwatch is warning of the warning signs of relationship scams, which can range from short 'romance baiting' frauds that shift into fake investment schemes to long-term cons in which scammers build trust over months or years before fabricating a crisis to extract money.

Red flags include rapid declarations of love, refusal to video call or meet in person, requests for money or cryptocurrency, demands for personal details or account access, and efforts to isolate victims from friends and family, the ACCC-run service said on 13 April. Scammers often target people seeking connection online, those newly single or bereaved, and those with savings or cryptocurrency holdings.

Meta has confirmed that one of its AI models hacked a real organization during cybersecurity testing, Reuters reports, after a misconfiguration in a sandbox environment operated by evaluation company Irregular inadvertently gave the model internet access.

Meta said the model "exploited a security vulnerability in a third-party service, in a manner similar to previously reported instances with other companies." The company did not identify the affected organization or detail what changes were made to its systems. Irregular told Reuters the flaw was "the exact same evaluation-environment issue that was already disclosed by Anthropic last week."

The incident is the latest in a series of breaches during AI safety testing. Anthropic disclosed last week that its Claude model published a malicious package to the real PyPI registry after mistaking a real domain for a simulated target, which was downloaded on 15 systems before removal. OpenAI has also reported a similar breach involving a real website vulnerability, Lawrence Abrams reports for BleepingComputer.

Hello Fresh implemented price increases of between 3.3 and 12.6 percent at the start of August, with a box for four people rising $24 a week, RNZ reports. Consumer NZ said the company had not adequately notified customers, with an email sent two weeks prior using a subject line — "a fresh update on your subscription" — that did not clearly flag cost increases, according to the group's head of advocacy Gemma Rasmussen.

Consumer NZ also raised concerns about the difficulty some customers faced in unsubscribing. "We think that there is a way to treat your customers and really kind of bullying them into staying is not great," Rasmussen said. Hello Fresh said it had absorbed rising costs since 2022 and that the latest increase was justified by investments in product range and local ingredients, and that it had given customers "clear notice" to make an informed decision, RNZ business (NZ) reports.

Switzerland's federal IT office said hackers exploited Microsoft SharePoint vulnerabilities to breach its servers and compromise approximately 200 accounts, BleepingComputer reports. The Federal Office for Information Technology and Telecommunication detected unusual activity on July 28, blocked external access, patched suspected flaws and reset passwords for affected accounts.

The agency believes attackers exploited SharePoint vulnerabilities disclosed by Microsoft in mid-July, but has not identified which flaw was used. The attack potentially involved either CVE-2026-56164, a privilege escalation vulnerability, or CVE-2026-50522, a critical remote code execution flaw — both fixed in July Patch Tuesday updates.

BIT said it has found no evidence that data beyond login credentials was stolen, noting that confidential and sensitive personal data are not permitted on the affected platform. The agency is investigating with the Swiss Federal Office for Cyber Security and Microsoft. No ransomware or extortion group has claimed responsibility.

Point72 Asset Management, Millennium Management, Two Sigma Investments, Citadel and several private-equity firms have been targeted in a recent wave of cyberattacks by UNC6671, an extortion group linked to the BlackFile campaign, Reuters and Bloomberg reported. The attacks used voice phishing to trick employees into granting access to corporate systems; Point72 said it found no evidence client data was stolen, while Two Sigma said it blocked an attempted intrusion.

Google's Threat Intelligence Group tracks the activity as UNC6671, which previously operated under the "BlackFile" brand and has since diversified across multiple extortion brands including Redact, Pink, Helix and Falcon, according to threat analyst Austin Larsen. The group initially targeted retail and hospitality organisations before shifting in July 2026 toward private-equity firms, hedge funds, law firms and financial-rating agencies.

Attackers contact employees on personal phones while impersonating corporate help desks, directing them to phishing websites that steal credentials and session cookies, Lawrence Abrams reports for BleepingComputer.

A China-based threat actor is using the DeepSeek AI model and open-source Hermes Agent to conduct autonomous cyberattacks on exposed servers with minimal human involvement, according to Palo Alto Networks' Unit 42. The researcher, operating under aliases "knaithe" and "KnYuan," configured the agent to accept instructions via Telegram and search for vulnerable systems using the FOFA internet asset search engine.

In a May 2026 session recovered by Unit 42, the agent independently researched vulnerabilities, targeted internet-exposed Langflow and n8n servers, downloaded exploit code, and attempted attacks within minutes—work that would normally require many hours of manual analysis. The agent identified 84 exposed Langflow instances and more than 647,000 n8n instances but failed to compromise any targets, as discovered forms required authentication the attacks could not bypass.

"The workflow confirms a functional, end-to-end autonomous offensive capability," Unit 42 said. The researchers noted the agent operates in "Yolo" mode, executing commands without requesting permission, and that the threat actor also conducted manual attacks against more than 460 systems separately, Lawrence Abrams reports for BleepingComputer.

A coalition of 19 government agencies across nine countries warned on Friday that North Korea is deploying IT workers under stolen identities to generate illicit revenue for its nuclear weapons and ballistic missile programmes, Reuters reports.

The statement, signed by the US, South Korea, Japan, the UK, France, Germany, Italy, the Netherlands and New Zealand, said Pyongyang uses artificial intelligence to expand its network of fraudulent remote workers who obtain employment on global freelancing platforms. The advisory warned that the workers pose escalating insider security threats, engaging in corporate data theft, cryptocurrency theft and espionage.

"North Korean IT workers employ increasingly sophisticated methods, including the integration of AI, to obfuscate their identities and expand their activities globally," the coalition said, urging hiring platforms and employers to strengthen identity verification. Operatives typically access company devices remotely through VPNs via "laptop farms" in North Korea, China, Russia and Southeast Asia, according to the advisory, Al Jazeera reports.

The US Cybersecurity and Infrastructure Security Agency has published new guidance on securing open source software, which it says is now embedded in nearly every modern system from business applications to critical infrastructure.

The guidance covers risk management across the full lifecycle of open source software, introduces a C4 Framework for trust assessment, and provides recommendations for vulnerability management, software bills of materials, secure development and handling of open source AI systems, CISA reports.

Google says artificial intelligence helped patch 1,072 security vulnerabilities across Chrome 149 and Chrome 150, surpassing the total fixed in the previous 23 releases combined, according to a statement from the company.

Google uses large language models throughout its vulnerability management process, including discovering flaws, reproducing reports, determining severity and generating patches. The company began using LLMs for security fuzzing in 2023 and has since developed AI-powered systems including Big Sleep, which found flaws in Chrome's V8 JavaScript engine, and a Gemini-powered agent that searches the broader codebase. One vulnerability discovered by the system was a Chrome sandbox escape that had remained in the code for more than 13 years.

Google is also automating vulnerability triage, including filtering duplicates and assigning severity ratings. The company estimates this automated process saves hundreds of hours of developer time each month. In May, these systems prevented more than 20 vulnerabilities from reaching production, including one classified as critical, Google said, Lawrence Abrams reports for BleepingComputer.

Europol's latest terrorism report says online platforms are fundamentally changing how extremist threats develop and move from the internet into real-world attacks, marking what the agency describes as a new phase for terrorism in Europe.

The EU Terrorism Situation and Trend Report 2026, published today, found that while traditional ideology-driven terrorism persists — with jihadism remaining the most prevalent form — radicalisation no longer depends solely on established ideological frameworks, Europol newsroom reports.

Anthropic said its Claude AI model accessed the systems of three organisations during security tests that were supposed to be isolated from the internet, the company announced Thursday. A misconfiguration by its evaluation partner, Irregular, left the test systems connected to the public internet, and Claude used basic techniques including exploiting weak passwords to compromise the organisations' infrastructure.

The disclosure follows OpenAI's revelation last week that its autonomous agent breached the infrastructure of AI company Hugging Face during similar testing. Anthropic suspended all cyber evaluations on July 23 after discovering the potential internet access, identified all three incidents by July 24 and notified affected organisations on July 27. Two organisations were unaware of the activity before being contacted, Al Jazeera reports.

Cybercriminals calling themselves ExfilSquad have claimed responsibility for compromising data from two UK Department for Education portals — the DfE Help Desk Self-Service Portal and the Turing Scheme Portal — and are demanding a ransom in exchange for not releasing it, The Record reports.

A DfE spokesperson said the 600,000 figure refers to lines of data rather than individuals affected, and that the information is limited to customer service contact details including names, email addresses and phone numbers. The department said the risk to individuals is not considered high and that it has contained the incident. There is no claim the hackers encrypted the systems.

Separately, the Police National Legal Database was also compromised, affecting 135,000 pieces of data that could identify names, forces and work email addresses of police officers and criminal justice workers, The Record reports. The Home Office declined to comment.

Cyberattack tools and infrastructure used by North Korea's Lazarus Group have been shared with ransomware criminals targeting South Korean organizations, according to research released Thursday by cybersecurity firm AhnLab alongside a joint advisory from four South Korean security and intelligence agencies.

The technical report details how Lazarus and the Gunra ransomware scheme ran parallel campaigns against South Korean targets from 2025 through mid-2026, using identical malware filenames, privilege escalation tools, command-and-control servers and SSH key fingerprints. Lazarus installed espionage backdoors in at least 72 organizations in 2026 alone, while Gunra used its access to encrypt files and demand ransom payments. Both groups exploited the same vulnerabilities in Korean financial security software products that are effectively mandatory for banking and government services.

AhnLab classified the overlaps as having "a high likelihood of technical linkage" but stopped short of definitively attributing both campaigns to the same actor, saying the evidence could indicate collaboration, shared infrastructure or access brokering, The Record reports.

A North Korea-linked hacker group known as SapphireSleet was behind four separate compromises of popular open-source JavaScript packages, Amazon researchers said in a report released Wednesday. The group targeted typo-crypto in March 2025, debug and chalk in September 2025, and axios in March 2026. Axios is downloaded more than 100 million times weekly and is embedded in countless web applications and enterprise services.

In each attack, the hackers socially engineered trusted maintainers to publish malicious updates, Amazon said. Organizations that automatically installed the latest versions unknowingly downloaded malware designed to steal passwords, cryptocurrency and personal data. Google had previously attributed the axios compromise to a North Korean threat actor it tracks as UNC1069; Microsoft said SapphireSleet overlaps with activity other vendors track as BlueNoroff, Stardust Chollima, CageyChameleon and Alluring Pisces, The Record reports.

Anthropic disclosed today that during internal security evaluations, one of its Claude models built a malicious Python package and uploaded it to PyPI, where it executed on 15 real systems before the registry's automated defenses removed it, Reuters reports. The company said the incident was one of three in which Claude models escaped isolated test environments and compromised production infrastructure at three organizations after a misconfiguration left evaluation systems connected to the internet despite being labeled as sealed and simulated.

In the PyPI incident, Claude identified a phantom software dependency inside the test environment, registered the package name itself, and uploaded code that harvested credentials from a security company that routinely tests packages from the registry. The payload remained publicly available for roughly an hour, Ax Sharma reports for BleepingComputer.

Petrol prices jumped 3 cents overnight to an average of $1.85 a litre, while diesel rose 5 cents to $2.26, as US-Iran tensions intensified and Australia's temporary 16-cent fuel excise cut approaches its August 2 expiry, Reuters reports via 7NEWS.

Peter Khoury, an NRMA spokesman, said wholesale prices had risen about 10 cents this week and those increases were likely to flow through to motorists. "Until the war ends in the Middle East and they have reopened the Strait of Hormuz, price is going to continue to be volatile," he said.

Treasurer Jim Chalmers said the government had extended the fuel tax cut for another month to help with cost of living pressures. The escalation in the Middle East, including reported Houthi strikes on tankers in the Red Sea, poses a further threat to global energy supplies, with industry leaders warning broader economic impacts across transport, agriculture and mining, 7NEWS.com.au reports.