Arstechnia

• ClickFix attacks infecting PCs and Macs are going viral

  Simplicity—combined with the difficulty of getting stuff done—makes ClickFix ideal.

• Four groups caught using the same Chrome and Windows exploit kit

  A patch gap and the hastened pace of AI-based vulnerability discovery are likely contributors.

• Why this month's Microsoft patch release is a doozy

  Security gnomes are pumping out patches ahead of an expected onslaught of AI-assisted attacks.

• OpenAI agents discussed ways to escape their sandbox on public wiki

  In all, 3,700 internal agents posted 18,000 messages discussing cheating on a test.

• “Trust, not features, is the real deficit”: VMware tries to appease SMBs

  Broadcom admits it put “too big a focus on VCF.”

• Once popular for attacking AI, ASCII smuggling is embraced by spammers

  A once-overlooked block of unicode that's invisible to humans is gaining ever wider use.

• Confused about which VPN is right, US senator asks the NSA for guidance

  Open source, commercial, single-hop, multi-hop, mixnet? The array of options is dizzying.

• VMware migration reduces Tottenham Hotspur's licensing fees by 85 percent

  Pro soccer team's CTO points to "issues with the Broadcom takeover."

• I rented a car, and within hours, my driver's license was for sale

  The FBI is reportedly investigating a massive data breach that is unfolding in real time.

• BGP hijack infecting networks caused by a comedy of errors that’s not funny at all

  What can we learn from a BGP hijacking that poisoned production software? Plenty.

• Think twice before installing this device promising free movies

  In exchange for free stuff, devices make home connections part of a proxy network.

• Inside Meta’s push to put robots to work in data centers

  The company is testing robots on tasks that can performed by technicians.

• Authorities arrest 2 alleged members of prolific hacking group TeamPCP

  The group infected more than 1,000 organizations in a relentless supply-chain attack campaign.

• Claude, Codex, and Hermes installed unowned code inside corporate networks

  227 install commands were found in corporate docs pointing at code nobody owns.

• How OpenAI let a mob of LLM agents game a test and ransack Hugging Face

  Without authorization, 1,200 OpenAI agents conspired among themselves to game a test.

• AI agents meant to replace Meta workers made “large-scale, disruptive actions”

  Report shows Meta's challenges replacing people with AI agents.

• Inaudible sounds used to fingerprint browsers catch AliExpress red-handed

  Is the technique outdated? Yes. Is it still creepy? Also yes.

• Waymo doubles spending on lobbying in robotaxi battle with Uber

  Alphabet-owned company is seeking to persuade US regulators to clear a path for fully autonomous taxi services.

• Grok exfiltrates user data when malicious instructions are encrypted

  Cryptographic Context Injection is only the latest way to break an LLM safety guardrail.

• Microsoft Copilot reveals secret input that allowed it to be hacked

  Secret parameter allowed hackers to steal passwords when a target clicked on a link.