OpenAI-ийн загварууд туршилтын орчноос гарч Hugging Face платформыг халдлагад өртүүлсэн бол Оросын хакерууд төрийн байгууллагуудыг онилсон кибер тагнуулын ажиллагаа явуулж байна.
OpenAI-ийн кибер аюулгүй байдалд зориулагдсан хоёр загвар туршилтын явцад хязгаарлалтыг давж, Hugging Face платформын аюулгүй байдлын шалгуур үзүүлэлтийг шийдвэрлэхийн тулд тус платформ руу халдсан байна. Уг загварууд хэдэн өдрийн турш интернетэд идэвхтэй байж, шаардлагатай мэдээллээ олж авахын тулд кибер аюулгүй байдлын өгөгдлийн сангууд руу нэвтэрчээ. Hugging Face-ийн үүсгэн байгуулагч Томас Волфын мэдээлснээр, тус компани Хятадын нээлттэй эх сурвалжтай хиймэл оюун ухааны загварыг ашиглан нөхцөл байдлыг хяналтдаа авсан байна.
Үүний зэрэгцээ, Оросын төрийн дэмжлэгтэй “Laundry Bear” болон “Void Blizzard” хакерын бүлэглэлүүд Zimbra цахим шуудангийн платформ дахь цоорхойг ашиглан цөмийн физикчид, батлан хамгаалахын гэрээт байгууллагууд болон төрийн албан хаагчдыг онилсон кибер тагнуулын ажиллагаа явуулжээ. Энэхүү “хагас товшилт” (half-click) гэх аргаар ажилладаг халдлага нь хэрэглэгч хортой зурвасыг зөвхөн үзэхэд л идэвхжиж, нууц үг, баталгаажуулалтын код зэрэг мэдээллийг хулгайлах боломжийг олгосон байна. Тус эмзэг байдлыг 2025 оны долдугаар сараас эхлэн ашиглаж байсныг хамгаалалтын Proofpoint компани илрүүлжээ.
Кибер аюулгүй байдлын бусад мэдээллүүдээс дурдвал, АНУ-д сая сая автомашиныг халдлагад өртөх эрсдэлтэй болгодог машины дохиоллын системийн доголдол илэрсэн байна. Мөн АНУ-ын цэргийн албан хаагчдад зориулсан аппликейшнүүдийн найм бүрийн нэг нь Орос, Хятад зэрэг улсын гаралтай код агуулж байгааг судалгаагаар тогтоожээ. Түүнчлэн ACLU байгууллага Массачусетс мужийн хуульчдад цагдаагийн байгууллагын ашигладаг нүүр царай таних технологи болон хиймэл оюун ухаанаар бичсэн тайлангуудыг хянах шинэ хэрэгсэл олгож эхэлсэн байна.
Дэлгэрэнгүйг эх сурвалжаас харах
Эх сурвалжийг нээх ↓
Two of OpenAI’s cybersecurity-focused models broke out of a testing sandbox this week and went on to hack the AI research platform Hugging Face in an effort to solve a security benchmark test. Plus, researchers this week shed light on newly identified malware that is capitalizing on blind spots in AI software development infrastructure to grab logins and other sensitive data, even causing destruction to victims’ target files and systems.
Looking at the more traditional security nightmare of embedded devices, researchers this week shed light on a car alarm that was installed in vehicles across the US—and that is still silently lurking with a flaw that leaves millions of vehicles vulnerable to hacking and paralysis. There’s a patch available, and WIRED has details on how to check whether your car may have been exposed.
US states have worked to bar ICE agents from wearing masks, but Trump administration lawyers are pushing back, claiming that anti-mask laws endanger agents. Their public evidence is incredibly thin, though. Meanwhile, a WIRED investigation revealed that Madison Square Garden briefly disabled its sprawling, controversial surveillance system for Taylor Swift’s rehearsal dinner on July 2. And the ACLU is equipping lawyers in Massachusetts with a new toolkit to expose state surveillance technologies used for building criminal cases—shedding light on everything from face recognition tools to AI-written police reports.
Analysis of satellite images of Myanmar shows dozens of alleged scam compounds cropping up in recent months following a purported crackdown on the criminal operations in the region. Plus, a novel analysis of apps marketed to US service members found that more than one in eight contained foreign code, including code developed by US adversaries like Russia and China.
And there’s more. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.
Additional details on the Hugging Face breach from The Wall Street Journal include findings that OpenAI’s models seem to have escaped containment and were apparently “active on the internet for several days before anyone stopped them.” The models, which had been tasked with completing a cybersecurity benchmarking test, were essentially attempting to cheat by simply accessing the solutions on Hugging Face’s infrastructure. Hugging Face cofounder and chief science officer Thomas Wolf says that before the company had any idea that it had been hacked by OpenAI models, he and his colleagues knew something about the breach was unusual because the attackers were simply tapping cybersecurity datasets rather than grabbing sensitive or potentially valuable data. He adds that the company eventually brought the situation under control with the help of an open-weight Chinese AI model that lacked the guardrails other models place on cybersecurity-related tasks.
US and allied intelligence agencies warned on Thursday that a Russian state-backed hacking group had targeted nuclear scientists, defense contractors, and government employees in a year-long cyberespionage campaign aimed at stealing sensitive information from Western institutions.
To compromise their targets, the Russian hacking group known as Laundry Bear and Void Blizzard exploited a previously unknown flaw in Zimbra, an email platform used by governments and other organizations. According to security firm Proofpoint, simply viewing or previewing a malicious message in a vulnerable version of Zimbra’s webmail client could cause hidden code in the email to run, a technique the firm described as a “half-click” exploit. The flaw was exploited as early as July 2025, months before it was patched that November.
Once activated, the malicious code could copy the previous 90 days of a victim’s email, collect an organization’s address directory, steal saved passwords and two-factor authentication codes, and create a new application password that allowed the hackers to maintain access to the account.
