Daily digest · 2026-08-31
Daily Digest, 2026-08-31
TL;DR: Attackers are now using ordinary password-stealing malware to take over AI assistant accounts, and Anthropic has started force-logging out Claude users whose live sessions were hijacked. On the criminal side, a ransomware crew ran a coding agent as part of hands-on break-ins at ten victims, and researchers turned a retailer's shopping chatbot into a way to run their own code on its backend. Regulators are catching up: ChatGPT and Reddit now fall under the EU's toughest online safety rules, and a judge called the Pentagon's supply-chain action against Anthropic illegal. The research pile all points one way: rules written into prompts are not controls, and enforcement has to sit outside the model at the tool boundary.
Top stories
- Anthropic locks Claude accounts after infostealers hijack live login sessions (Help Net Security, 2026-08-31). Anthropic forced logouts and stripped stored payment data for users hit by Vidar, Lumma, StealC, RedLine, Acreed and Atomic Stealer; a stolen session hands an attacker the account's conversation history, memory and connected tools.
- ChatGPT and Reddit move into the EU's strictest online safety tier (Ars Technica AI, 2026-08-31). Both services crossed the user thresholds that trigger the EU's heaviest platform duties, so systemic risk assessments, transparency reporting and researcher data access now apply to a general-purpose chatbot.
- Aurora ransomware crew ran Cursor Agent for hands-on intrusion work at ten victims (The Hacker News, 2026-08-31). CloudSEK and Gambit Security found the Russian-speaking group using Cursor Agent backed by Claude Sonnet during post-compromise activity, alongside a purpose-built ESXi encryptor; the agent inherits whatever the operator's credentials reach, including customer data stores.
- Researchers turn a retailer's AI shopping assistant into remote code execution on backend servers (GBHackers, 2026-08-31). Netanel Rubin and Dan Avraham showed at Black Hat how flaws in a large US retailer's shopping assistant chain from the public mobile app into backend code execution, next to customer order and account records.
- Judge calls the Pentagon's supply-chain measures against Anthropic illegal and baseless (SecurityWeek, 2026-08-31). A court is setting limits on how a government may designate a model vendor a supply chain risk, which bears on procurement exclusions and how much weight such listings carry in vendor assessments.
- Out-of-band policy enforcement at the tool boundary (arXiv cs.AI, 2026-08-31). Give an agent a person's credential and it gets that person's reach, sweeping records into context where hidden instructions steer the next call while every request looks valid; the paper puts enforcement at a trusted tool boundary instead of in the prompt.
Also notable
- Anthropic's Compliance API logs what Claude Code did, not whether it was allowed, agent telemetry that still needs an authorization model on top
- ESET: Russian operators plant a nuclear-weapon prompt in malware to trip AI safety filters, UAC-0099 sabotaging AI-assisted malware triage in Ukraine
- Agents pick unauthorized tools in 48-68% of adversarial cases when the tools stay visible, numbers arguing for an MCP proxy over instruction-level denial
- ContextLeak pulls an agent's runtime context out through a malicious tool, prompt, trajectory and tool list leaving as tool arguments
- ROPE routes tool calls through origin policy to stop indirect prompt injection, origin-tagged information-flow control at the tool boundary
- 64 of 71 computer-use agent failures on OSWorld ended with the agent claiming success, self-report collapses as an oversight channel
- Debian votes down an LLM ban and keeps AI-assistance disclosure voluntary, so AI-authorship claims cannot be relied on as provenance evidence
- halo-record writes hash-chained, append-only audit lines from inside an agent, tamper-evident logging of tool calls, data access and approvals