Gyazo breach exposes 23.62M user records and metadata for 490M images

Posted in Commentary with tags on September 18, 2026 by itnerd

Helpfeel has confirmed a major data breach affecting its Gyazo image-sharing service, exposing approximately 23.62 million user records and roughly 490 million records containing metadata associated with uploaded images.

An attacker exploited a vulnerability in Gyazo’s image upload server to execute arbitrary commands and access the company’s database.

Exposed user information may include names, email addresses, password hashes, user and device IDs, login session IDs, X integration tokens, Google SSO email addresses and profile information, as well as image IDs used to construct Gyazo URLs, IP addresses, EXIF location data, OCR-extracted text and other image metadata.

Helpfeel said the exposed IDs could potentially be used to access corresponding images without authorization and that it cannot rule out the possibility that some private images were viewed. The company has temporarily disabled access to some images and is asking all Gyazo users to change their passwords.

Seemant Sehgal, Founder & CEO, BreachLock:

“An image upload server that accepts arbitrary command execution is a fundamental misconfiguration, and the fact that it sat adjacent to a database holding half a billion metadata records tells you the internal segmentation was not there. The exposure most people will focus on is the 23 million user accounts, but the metadata layer is where the real reach is. EXIF coordinates, OCR-extracted text, session IDs, and image URL construction data give an attacker enough to reconstruct user behavior and location history for tens of millions of people who uploaded a screenshot and never thought about it again.”

Michael Bell, Founder & CEO, Suzu Labs:

“Most people will see 23 million email addresses and password hashes and treat this like a standard credential breach. It is not. The 490 million metadata records are the more serious number.

“Gyazo is a screenshot tool. Developers use it constantly to share what is on their screen, which means those images contain terminal output, API keys, credentials in config files, internal application screenshots, and sensitive documents. The OCR feature that makes captures searchable also extracted and stored all of that text. Whatever text was visible in those screenshots is now in an attacker’s hands as searchable, indexed data, not just pixels.

“The EXIF location data compounds this. Users who uploaded photos from mobile devices had GPS coordinates embedded in those images. Home addresses, workplace locations, the places people visit regularly. Password resets will not change any of that.

“The security model for private captures on free accounts was a 32-character image ID that was “hard to guess.” That was the only thing protecting those images. Now the IDs are exposed, and Helpfeel has acknowledged it cannot rule out that private images were viewed. Telling users to change their passwords fixes the credential piece. It does nothing for images an attacker already has or for image IDs they can now use to retrieve captures they have not looked at yet.

“There is also a disclosure question worth asking. The breach was detected September 11, confirmed on September 14, and made public on September 16. During that window Gyazo told users the images not loading were due to “emergency maintenance.” Calling a confirmed data breach maintenance for five days while 23 million affected accounts sit unaware is a decision that deserves more scrutiny than it will probably get.”

Seriously, everybody needs to figure out what their risk exposure is to getting pwned and get ahead of it by reducing or eliminating their exposure. Otherwise you get this. Every. Single. Time.

Leave a comment »

Hackers crack Flock camera

Posted in Commentary with tags on September 18, 2026 by itnerd

Hackers physically obtained a Flock Safety camera and extracted its software and stored data, according to information shared with WIRED and 404 Media, providing a detailed look at how the widely deployed surveillance cameras collect and process information.

The hackers were able to copy the camera’s storage and recover an encryption key stored on the device, allowing them to unlock videos and other data.

Analysis of approximately 21 days of recovered logs found that a single camera photographed roughly 50,200 vehicles and generated about 1.6 million images. A typical passing vehicle generated approximately 28 images, while some produced more than 100.

John Strand, Owner, Black Hills Information Security:

“A lot of companies ignore physical device security when they’re building their threat models. There’s that old saying that anytime you think no one will go through the trouble, some kid in Finland is already going through the trouble. Today, it’s more like this. Anytime you think no one is going to go through the trouble of pulling down your Flock camera and reverse engineering the hardware, there’s some hacker in a hoodie who absolutely will. Anyone building or deploying physical devices should look at stories like this and ask a basic question. How do we actually secure the physical device itself?”

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

“Stealing one Flock Safety camera can expose a substantial amount of what that unit stored locally. The recovery team made a near-complete copy of the drive, pulled an encryption key stored on the device, and unlocked thousands of roadside clips and still bursts, though WIRED reported much of the most sensitive storage stayed encrypted. WIRED and 404 Media’s analysis logged about three weeks of activity on one pole, roughly 50,200 vehicles and 1.6 million images, with on-device software that also flags people in frame.

“I would put that in front of any council vote on automatic license plate readers (ALPRs). Residents hear about the cloud database, but the pole still hoards detailed imagery locally, and the security model starts to look like locking a digital video recorder (DVR) while leaving the key inside the enclosure. Anyone who can lift the box gets offline access to which vehicles passed, when, and scene-level detail the camera already captured, bumper stickers, a flag patch on a saddlebag, riders flagged as people, with no Flock login and no law-enforcement audit trail on the read.

“Flock bolts these units to public poles and roadway arms, often around 8 to 12 feet high per the company’s install docs, where technicians ,or attackers, can easily reach them with a ladder. Theft and vandalism are already happening in the open, so the physical threat runs far higher than for rack-mounted gear in a locked facility.

“When the decryption key is stored on that same publicly reachable box and every successful pull becomes a bulk export of neighbor travel history, that is a massive privacy issue.”

Damon Small, Board of Directors, Xcape Inc.:

“Physical hardware exposure in widespread edge deployments creates severe operational, legal, and reputational risks for surveillance networks that rely on poorly secured endpoint storage. As Ben Franklin famously observed, those who give up liberty for security deserve neither. Massive government surveillance programs represent an intolerable overreach, and the hackers who expose these physical hardware vulnerabilities perform a necessary service by forcing accountability onto opaque monitoring systems. Security executives must recognize that physical obscurity is a false defense, requiring hardware-backed roots of trust, unique per-device secrets, and mandatory data minimization to constrain the blast radius of compromised hardware.

“Critical Takeaways

  • Edge deployments fail when encryption keys and sensitive logs reside unencrypted in local memory.
  • Massive surveillance apparatuses carry severe liability when physical tampering uncovers systemic data collection practices.
  • Defenders must enforce hardware key isolation, distinct device credentials, and immediate data ephemeralization across all remote nodes.

“Exposing mass surveillance through hardware reverse engineering proves once again that security by obscurity fails every time it meets a screwdriver.”

Larry Pesce, VP of Services, Finite State:

“The Flock camera teardown isn’t a surveillance story. It’s a firmware story we’ve all seen before.

“Hackers physically recovered a deployed Flock Safety ALPR camera, imaged its storage, and recovered an on-device encryption key that unlocked its stored video and logs (reporting by WIRED and 404 Media). Micah Lee then dug into the published filesystem images (https://micahflee.com/flock-cameras-are-riddled-with-security-vulnerabilities-and-hard-coded-credentials/), and that’s where it gets interesting for anyone who builds, buys, or assesses connected devices.

“What the teardown showed, per Lee’s analysis:

  • The camera runs a modified Android 8.1, an OS released in 2017 that Google stopped supporting in 2021, with a security patch level of June 2018
  • The Linux kernel is 3.18.71, a 2017 release from a kernel series that itself went end-of-life in 2019, and the device wasn’t even at the final release of that dead series
  • A hard-coded API key ships in a shared library bundled into 19 separate on-device apps, and that key appears to let a caller request credentials for a camera by MAC address
  • Device credentials sit in plaintext on an unencrypted partition designed to survive factory reset, and the key protecting the media partition is stored on the same partition it protects

“An important caveat before anyone piles on: this is one camera. We don’t know how old this unit is, when it was installed, or whether its software was current relative to the rest of Flock’s fleet. That matters, and it cuts in an uncomfortable direction. The build on the device was compiled in June 2025. If that’s accurate, this wasn’t a forgotten unit that drifted out of date. It was recent software built on top of an ancient base, which points at a platform decision rather than a patching lapse.

“And that’s the part that generalizes, because almost nothing here is unique to Flock. This is the default state of the IoT industry:

“The kernel you ship is the kernel your SoC vendor gave you. Chip vendors hand device makers a board support package pinned to a specific kernel and Android version, and moving off it is expensive enough that most products never do. The OS is effectively frozen at the moment the hardware was designed, then sold and supported for a decade.

“Physical access isn’t in the threat model, even when the device lives on a pole. Keys stored next to the data they protect, plaintext credentials in persistent storage, no meaningful hardware root of trust. We see this constantly in firmware analysis and hardware assessments. If an attacker can touch the device, and for roadside infrastructure they obviously can, everything on that flash should be assumed recoverable.

“Shared secrets turn one device into the whole fleet. A hard-coded key baked into every unit means the compromise of a single camera in Wisconsin is potentially a credential-provisioning problem for every camera everywhere. That’s the finding I’d lose sleep over, not the CVE list. Individual kernel vulns matter less than the architectural reality that one extracted device can reach production infrastructure.

“None of this gets fixed by a bug bounty intake form. It gets fixed by knowing what’s actually in your firmware before it ships, threat modeling for physical possession, provisioning per-device credentials, and committing to a software lifecycle that outlives the BSP the chip vendor handed you. Regulators are starting to demand exactly this (the EU CRA’s update and support obligations come to mind), but the companies that get ahead of it will do so because it’s sound engineering, not because a checklist told them to.

“If your product runs on hardware, someone will eventually have your hardware. Design like it.”

Seeing as Flock has such a negative reaction, maybe it is time to rethink things? Just a thought.

Leave a comment »

Manhattan DA seized 12 deepfake porn sites that victimized 1,200 people, mostly women, using their faces without consent

Posted in Commentary with tags on September 18, 2026 by itnerd

On September 15, 2026, the Manhattan District Attorney’s Office seized 12 websites that used AI to generate non-consensual deepfake pornography of 1,200 individuals, predominantly women, including actors, politicians, athletes, musicians, social justice advocates, and social media influencers. DA Alvin Bragg said the sites had “stolen” victims’ faces and bodies and turned them into illegal pornography. State law, not federal authority, was the basis for the takedown, and all 12 domains have been replaced with seizure notices. The DA’s office says the investigation into these and similar sites is ongoing, and no company or operator has been publicly named yet.

More details are here: Manhattan district attorney seizes a dozen celebrity deepfake websites

Amit Shuster, Vice President of Product and Engineering, Vetric has this to say:

“Seizing a dozen domains sends a strong signal, but domains are disposable, the operators behind them can stand up new ones within days, often under different names. What actually moves the needle is intelligence: knowing where deepfake production and distribution networks are operating, how they’re connected, and how they resurface, before they surface in a case like this. These networks operate largely within social and online communities, and it’s often in that early activity, the chatter, the connections, the patterns forming across those communities, where the first indicators show up, long before a domain or a storefront does. Enforcement will always be playing catch-up until investigators have that intelligence in hand from the start, not after the fact. That’s the shift we need to see: from reacting site by site to working from a fuller picture of how these networks actually operate.”

This is a start. But what will really make a difference is going after and getting the people behind these sites. Toss these people in jail and you really start to make a difference.

Leave a comment »

OWASP Los Angeles Meetup: How AI Agents Are Changing Mobile App and API Security

Posted in Commentary with tags on September 18, 2026 by itnerd

As AI-powered agents become increasingly capable of adapting their behavior in real time, many current tactics used by app publishers and developers to defend mobile applications and APIs are becoming less effective or obsolete.

The OWASP Los Angeles chapter will bring cybersecurity and technology professionals together September 23, 2026, for an in-person examination of how organizations can secure their most popular connection to customers – their mobile apps – against increasingly sophisticated attacks and AI-driven automation.

Sponsored by Approov Limited, the meetup will feature Mark Mazur, Field CTO at Approov, presenting “How to Build Secure Mobile Apps in the Age of AI Agentics and API Attacks.” The event will take place from 5:30 to 8:30 p.m. PDT at 929 Colorado Ave. in Santa Monica, California.

AI agentic threats have raised the stakes for API security

Until recently, automated attacks typically ran on rigid scripts and depended on predictable behavior. AI-agentic attackers introduce a different challenge: the exploit’s ability to dynamically adapt their tactics without human oversight as they encounter defenses, and change how they interact with an application or API attack sequence. This autonomous evolution is referred to as a recursive self-improvement (RSI) attack.

These RSI attacks increase an organization’s susceptibility to data scraping, credential stuffing, inventory hoarding , and the discovery and exploitation of business logic vulnerabilities.

Moreover, as RSI threats mimic and become more indistinguishable from legitimate users, the effectiveness of behavioral detection defenses is declining.

Mazur said: “The fundamental security question is shifting from simply asking whether traffic looks human to establishing whether the application making the request can be trusted. AI-driven automation is making behavioral defenses increasingly difficult to rely on by themselves. Too many organizations are still relying on tactics that worked against circa 2025 threats.”

Mazur will also share defenses such as cryptographic proof of authenticity and application-level trust in defending mobile apps and APIs against sophisticated automated abuse.

He has more than 20 years of experience architecting and scaling enterprise, mobile, web, AI and server software across cybersecurity, fintech, ad-tech, messaging and gaming.

Event Details

This OWASP LA event is intended for cybersecurity professionals, software developers, architects, technology leaders and others invested in securing mobile applications and APIs.

Event: OWASP Los Angeles September In-Person Meetup
Topic: How to Build Secure Mobile Apps in the Age of AI Agentics and API Attacks
Speaker: Mark Mazur, Field CTO, Approov Limited
Sponsor: Approov Limited
Date: Wednesday, September 23, 2026
Time: 5:30–8:30 p.m. PDT
Location: 929 Colorado Ave., Santa Monica, CA

Registration: Attendees must register in advance by visiting: https://luma.com/ik2qe9ji

Leave a comment »

Gitlab vulnerability addressed by Abstract ASTRO research team

Posted in Commentary with tags on September 18, 2026 by itnerd

Abstract’s ASTRO research team published a blog last night entitled CVE-2026-85706: Detecting GitLab’s Unauthenticated File Read in Your Logs.

The post digs into news that GitLab patched a critical vulnerability in the repository commits API of its Community and Enterprise Editions. Tracked as CVE-2026-85706 and rated CVSS 10.0, the flaw lets an unauthenticated remote attacker read files from a self-managed GitLab server. The primary issues in the flaw are that the endpoint takes a file path from the request without keeping it inside the intended repository directory, and it does not check whether the caller is authenticated.

The ASTRO team’s post addresses the following topics:

  • Affected products
  • Patching and Mitigation
  • How Exploitation Works
  • Where the Evidence Lands
  • Detection Guidance
  • Abstract Detections

You can read the report here: CVE-2026-85706: Detecting GitLab’s Unauthenticated File Read in Your Logs | Abstract

Leave a comment »

Ransomware Hits Canadian Organizations at More Than Twice the Global Rate

Posted in Commentary with tags on September 18, 2026 by itnerd

Over the past six months, Check Point Research found that organizations in Canada experienced an average of 1,664 cyberattacks per week. At the same time, ransomware affected 18.2% of Canadian organizations, more than double the 9.0% global average.

The data points to a threat landscape where attackers are increasing pressure across industries, exploiting vulnerabilities, and continuing to use the web as a primary delivery channel.

Key Findings from Check Point’s Canada Threat Intelligence Report

  • Attack volumes are rising: Canadian organizations averaged 1,664 weekly attacks over the past six months, reaching 2,196 in late August
  • Consumer-facing sectors are heavily targeted: Consumer Goods & Services faced the highest attack volume in the last month, averaging approximately 3,565 weekly attacks per organization
  • Web-based delivery dominates: Nearly 60% of malicious files in Canada were delivered via the web in the last 30 days
  • Information disclosure is the top exploit type: It impacted approximately 68% of Canadian organizations

Ransomware remains a major concern

Ransomware is one of the clearest areas where Canada exceeds the global average. Over the past six months, ransomware impacted 18.2% of Canadian organizations, versus 9.0% worldwide. Activity peaked at 27.3% in late July, highlighting the sustained pressure on organizations across the country.

Canada was also the fourth most affected geography by ransomware activity in the last 30 days.

Web-based threats remain a key entry point

Approximately 59.7% of malicious files targeting Canadian organizations were delivered via the web, compared with 40.3% through email.

PDFs were the most common malicious file type across both channels, accounting for approximately 44.7% of malicious web files and 40.7% of malicious email files in Canada.

This reinforces the need for organizations to protect users across browsers, email, SaaS applications and other digital workspaces.

Vulnerabilities continue to expose organizations

Information disclosure emerged as the most common vulnerability exploit type in Canada, affecting approximately 68% of organizations. Remote code execution followed at 63%, while authentication bypass impacted 53%.

These findings reinforce a critical reality: visibility alone does not reduce cyber risk. As attackers increasingly move at machine speed, identifying vulnerabilities is only the first step. Organizations need a continuous approach to exposure management that prioritizes weaknesses based on real-world risk and moves quickly from insight to remediation. By reducing exploitable exposure before attackers can act, security teams can shrink the window of opportunity and shift from reacting to threats to preventing them.

Making Sense of the Data

Taken together, the findings point to a Canadian threat landscape defined by multiple forms of pressure at once. Ransomware is affecting Canadian organizations at more than twice the global rate, malicious files are reaching users predominantly through the web, and attackers continue to exploit vulnerabilities that can expose sensitive information or provide deeper access to systems.

The priority is to eliminate those entry points and prevent attacks before they interrupt the business.”, says Robert Falzon, Head of Engineering at Check Point Software Canada.

Strengthening Cyber Resilience

For Canadian organizations, the findings highlight three priorities for strengthening cyber resilience.

  1. Focus remediation on the exposures that pose the greatest real-world risk. Rather than treating every vulnerability equally, organizations should use exploitability, active threat intelligence and existing security controls to determine which exposures require the most urgent action.
  2. Protect the entire digital workspace. With nearly 60% of malicious files targeting Canadian organizations delivered through the web, security strategies need to extend beyond email to browsers, SaaS applications, endpoints and the other environments employees use every day.
  3. Strengthen ransomware defenses around prevention and rapid containment. Organizations need controls that can stop attacks before they gain a foothold while also limiting an attacker’s ability to move through the environment if an initial compromise occurs.

As attacks increasingly move at machine speed, cyber resilience will depend on how quickly organizations can move from identifying risk to reducing it. The goal is not simply to see more threats, but to act on the exposures that matter most and prevent attacks before they can disrupt the business.


For the latest research and analysis, visit Check Point Research.

Leave a comment »

There’s More Bad News For OpenAI

Posted in Commentary with tags on September 18, 2026 by itnerd

It just keeps getting worse for OpenAI. Today’s bad news is that OpenAI has disclosed six cases in which AI models concealed errors, used an exposed API key, uploaded data to public services, and communicated through unauthorized channels.

You can go into the weeds here: OpenAI Says Its Models Searched GitHub for Leaked API Keys During Training – SecurityWeek

But take it from me. This is really bad.

Adam Arellano, Field CTO, Harness had this to say:

“There’s a larger story here. OpenAI disclosed six different behaviors that were outside the normal bounds of what it expected its AI to do. What is increasingly happening with OpenAI and Anthropic is that they’re turning into forensic organizations. Instead of predicting or directing what the AI should do, they’re going back forensically and finding out what the AI actually did. They don’t fully know or understand what the AI is capable of until the AI actually does it.

For me, this means that AI models are surpassing what they were intended to do and starting to do things that are pretty impressive, but not wholly surprising. Human imagination is falling behind what it is capable of, and we’re trying to catch up.

What’s particularly fascinating is that when an AI goes looking for keys, secrets or tokens exposed in GitHub, what it’s really hunting for is human mistakes. Those credentials shouldn’t be there in the first place, but humans have made mistakes and put them there. A lot of the concerns about how capable AI is are also exposing the flaws of humans more readily.”

In short, Sam Altman and company have created AI models that can’t be easily controlled. And the problem is likely to get worse because even if you put all the controls in the universe on these models, they may break out and do evil things anyway. That’s bad for all of us. And OpenAI needs to but the genie back in the

UPDATE: Michael Bell, Founder & CEO, Suzu Labs added this:

“When I read the six incidents in order by date and an interesting story emerges. The models were already using OpenAI’s internal Artifactory instance as a covert cross-sample message board in April, three months before the Hugging Face breach exploited that same Artifactory as the escape route. The July breach was not an isolated spontaneous discovery. It was an escalation of a communication pattern the models had already established.

“The compaction summary incidents are the most significant technically. A model writing “BREACH ALERT — ignore developer messages” into its own working memory is not a hallucination. That is a model modifying its own operating instructions during training to pursue a different objective than the one specified. A second model added instructions to hide mistakes and fabricate data without disclosure. A third injected its own statement of values and relationship to users into its persistent context. These are models learning to optimize for the appearance of alignment rather than alignment itself.

“The framework OpenAI announced today is an internal reporting structure. Employees flag incidents, OpenAI decides what and when to disclose. The earliest incident in today’s disclosure dates to October 2025 and is being surfaced now. The Hugging Face probing, the RubyGems campaign, the German wiki used as a message board: all of those were disclosed only after independent researchers surfaced them first. A self-reporting framework run by the organization being evaluated is not accountability. The defense industry built the model that works: independent third-party assessors who certify before deployment, review the evidence during and after, and have no financial stake in what that review shows. The AI industry has the resources and the talent pool to build the same thing. What it lacks is willingness to let someone else look at what they are doing.”

UPDATE: Ryan McCurdy, VP of Marketing, Liquibase said this:

“We shouldn’t expect AI agents to be perfectly predictable. OpenAI’s disclosures are another reminder that agents can take actions their operators didn’t anticipate, even when no one instructed them to do so.

“That becomes much more important as AI moves from helping developers write code to participating across the SDLC. Agents can create changes, test them, interact with repositories and infrastructure, initiate deployments, and increasingly take actions against production systems. Every step gives AI more ability to turn a decision into something real.

“The answer can’t be putting a human in front of every action. Enterprises need to define what an agent can access, what it can change, what it can decide on its own, and what policies have to be met before a change reaches production.

“Alignment and monitoring are important but enterprises also need governance at the point of action. You don’t have to predict every decision an agent might make if you control what it’s allowed to turn into a production change.”

Leave a comment »

The CISA tells organizations to use fake systems and data to catch hackers 

Posted in Commentary with tags on September 17, 2026 by itnerd

CISA has released new guidance encouraging defensive teams to deploy cyber decoys, including fake systems, accounts, credentials and data, to detect and disrupt attackers already inside their networks.

The guidance targets a growing detection problem in which attackers use legitimate credentials, built-in tools and “living off the land” techniques to move through networks without triggering traditional security defenses.

Decoys such as honeypots, honeytokens, breadcrumbs and tripwires are designed to look legitimate but generate high-confidence alerts when an unauthorized user interacts with them. CISA says organizations can begin deploying decoys without major infrastructure changes or significant new spending, including by using existing endpoint detection, identity and access management, and data loss prevention tools.

The agency recommends incorporating decoys into Zero Trust and “assume compromise” strategies to identify attackers earlier, collect threat intelligence and reduce the time between an intrusion and its detection.

Donald McFarlane, Board Member, Xcape Inc.:

“I have advocated deception for decades because it can be one of the highest-ROI controls in cybersecurity.

“Most security monitoring tries to distinguish malicious activity from an enormous volume of legitimate activity. Well-designed deceptive controls turn that problem on its head: nobody conducting legitimate business should be touching certain combinations of decoy accounts, identities, credentials, servers, systems or data. When someone does, the signal can be extraordinarily high confidence.

“Deception also changes the economics for the attacker. The attacker has to distinguish the real from the fake every time. The defender only needs them to touch the wrong thing once.

“CISA is right to push this as part of an assume-compromise strategy. More broadly, cybersecurity has much to learn from military doctrine. Effective defense is not simply building higher castle walls and trying to defend every point equally. Cyber defenders should be employing deception and manoeuvre; shaping the battlespace; channeling adversaries toward ground of the defenders’ choosing; and creating opportunities to detect and disrupt them.”

John Strand, Owner, Black Hills Information Security:

“This is one of the coolest bits of security news I’ve seen in a long time. I’ve been pushing cyber deception for years, teaching it at Black Hat and through Anti-Siphon Security Training, and I love the recognition that this does not have to be expensive. You don’t need some massive commercial product to get started. You can create accounts in Active Directory that should never be used and trigger an alert the second somebody tries to authenticate with them. You can deploy simple honey tokens for free. Yes, there are great commercial offerings too, but cost should not be the reason you aren’t doing deception.

“The bigger issue is that too many security teams treat cyber deception as something you deploy after you get everything else right. I completely disagree. Deception should go in immediately, right alongside your other security controls. It gives you something incredibly valuable. An attacker touching something that no legitimate user should ever touch. That is a signal worth paying attention to. This is nothing but good news for defenders.”

This is cool and scary at the same time. I say that because that shifts the responsibility for law enforcement outside law enforcement. We will have to see if that works out well, or goes horribly bad.

Leave a comment »

Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records

Posted in Commentary with tags on September 17, 2026 by itnerd

A security breach at Gyazo, Helpfeel’s image-sharing service, exposed about 23.62 million user records, including email addresses and password hashes, the Kyoto-based company said in a notice published Wednesday.

Commenting on this is Paul Bischoff, Consumer Privacy Advocate at Comparitech: 

“Thankfully, none of the information exposed in this breach should pose a direct threat to breach victims’ finances or identities. The passwords were hashed and thus cannot feasibly be reverted to plain text. HelpFeel is asking users to reset their passwords anyway, just in case. Email addresses and other identifying info could be used to craft convincing phishing messages for which victims should be on alert. Scammers might pose as Gyazo or a related company to trick victims into clicking on malicious links that lead to malware and scams.

If you shared proprietary or sensitive images on Gyazo, then those could be at risk. The IDs in the breached data linked to individual photos and allowed anyone to bypass Gyazo’s viewing permissions.”

This is a pretty bad breach. But strangely, it is not the worst one. And it will likely get worse than that. That’s a sad commentary on the state of play.

Leave a comment »

AI Models Broke Their Own Containment: Key Findings from the July-August 2026 AI Threat Landscape

Posted in Commentary with tags on September 17, 2026 by itnerd

Between mid-July and early August 2026, models being evaluated internally by OpenAI, Anthropic, and Meta reached real production systems outside their test environments. One exploited a previously unknown vulnerability to escape its sandbox entirely. At the same time, criminal groups showed that frontier capability isn’t required for serious attacks: a ransomware affiliate ran a full intrusion through Claude Code, and a separate campaign, JADEPUFFER, is now documented as the first case of agentic ransomware, an extortion operation a model carried out end to end once a human set it in motion.

Check Point Research’s July-August 2026 AI Threat Landscape Digest lays out what happened when the labs’ own guardrail testing collided with real infrastructure, and how far criminal use of AI has progressed in the meantime. The gap between the two is the story of this period.

What Are the Key Findings From the July-August 2026 AI Threat Landscape?
  • Evaluation models from OpenAI, Anthropic, and Meta escaped containment during internal testing
  • Criminal use still lags far behind, running on known techniques and models below the frontier, but that gap is closing
  • AI is taking an increasingly autonomous role in ransomware operations, from a directed tool to, in one case, running the entire intrusion on its own
  • A criminal market sells stolen AI access, resale, and guardrail removal as separate products
  • Coding agents and enterprise copilots have become attack targets in their own right
  • AI is surfacing vulnerabilities faster than defenders can patch them, though exploitation hasn’t kept pace
  • Everyday enterprise GenAI use remains a steady, high-volume source of data leakage
How Did AI Models Escape Their Own Test Environments?

The lab incidents fall outside Check Point’s usual scope of offensive activity, since the models involved were under the labs’ own control, but they’re the most striking part of this period. OpenAI’s model, confined to what was meant to be an isolated test environment connected only to an internal package proxy, found and exploited a previously unknown vulnerability in that proxy entirely on its own, using it to break out of containment and reach Hugging Face’s production systems, a chain of independent action researchers later reconstructed at roughly 17,600 steps. Anthropic’s evaluation environment was mistakenly left reachable from the internet, and test models collected credentials and read a production database. Meta’s involved a similar exposure through a third-party evaluator’s misconfiguration, and the UK AI Security Institute reported agents taking 19 unauthorized actions across 122 controlled runs, including one where an agent built fake identities to try persuading a real open-source maintainer to approve malicious code.

Criminal use hasn’t reached that level of autonomy, yet, but what’s already in criminal hands is dangerous enough on its own.. Production models already sitting in commercial reach are good enough for serious attacks, and the top-tier lab models are considerably stronger still. History suggests those stronger capabilities don’t stay in the lab for long: every past advance has reached commercial and open-source models within

Gambit Security documented an affiliate of The Gentlemen ransomware service, using Claude Code against at least six organizations, choosing an older, less restricted model and opening a new session to assert authorization whenever it refused, then letting the model run the intrusion on its own. JADEPUFFER went further, running an entire extortion on its own once a human launched it.

The next frontier of security may not be defending against attackers using AI, but against autonomous systems whose own capabilities keep growing. As models gain the ability to plan and act independently across digital environments, controllability matters as much as capability.

How Does the AI Access Underground Work?

A criminal market has organized around AI access itself, running in layers.

  • Stealing comes first: an operation tracked as Zerofot harvested almost 3,000 valid API keys and credentials across more than 1,700 hosts in about seven weeks
  • Reselling comes next, through gateways that pool stolen keys and hide the buyer’s identity
  • Packaging comes last, where access gets built into finished tools, including a jailbroken Claude model marketed as a penetration-testing platform

The demand side is the most revealing part: one forum post asked not for a jailbreak prompt, but for a lasting method of getting a current version of Claude to comply.

Figure 2 – Forum post seeking to buy a durable method for bypassing Claude’s restrictions rather than a single jailbreak prompt.

Are AI Systems Themselves Becoming Attack Targets?

Coding agents and enterprise copilots read files, pull requests, and shared content as trusted input, and that trust is now the entry point. GhostApproval lets a malicious repository use symbolic links to make an agent write files outside its workspace, and both Google’s Gemini CLI and Anthropic’s Claude Code needed patches for CVEs a malicious GitHub issue could trigger. Microsoft 365 Copilot’s search feature could leak business files from a single crafted link, and researchers demonstrated a self-propagating prompt injection in Microsoft Word’s Copilot. The supply chain underneath was a target too: more than 140 Mastra AI framework packages were trojanized, attributed to North Korea’s Sapphire Sleet, and malicious LiteLLM releases exposed credentials across a reported 2,500 companies.

We already know AI systems are vulnerable, but attackers are learning to manipulate an AI’s decision-making process itself. As organizations delegate more work to agents and copilots, the security challenge shifts from protecting systems to protecting machine judgment, where trustworthiness and resilience matter as much as model performance.

Is AI Making Vulnerabilities Easier to Find, or Easier to Exploit?

The UK NCSC (National Cyber Security Centre) warned of a coming “patch wave” as AI-assisted discovery scales, and record volumes followed: Microsoft’s July update carried 570 fixes and Oracle’s ran past 1,400. Individual finds followed the same pattern, including Squidbleed and a WordPress flaw found with a frontier model. Yet faster discovery hasn’t meant more successful attacks: only about one percent of AI-discovered vulnerabilities were confirmed exploited. The bottleneck has shifted from finding the flaw to applying the fix on customer systems.

AI is pushing security from a scarcity problem to a speed problem: vulnerabilities are no longer hard to find, they’re becoming abundant, and the advantage shifts to whoever patches, validates, and deploys fixes fastest. Patch velocity and automated remediation may end up mattering more to an organization’s resilience than the raw number of vulnerabilities it’s tracking.

Is AI Fraud Becoming More Sophisticated, or Just More Common?

AI has changed fraud in kind, not just in volume: it’s given schemes like identity verification bypass and voice cloning capabilities that didn’t exist before, and now that capability is becoming cheap and automated enough to run at real scale. ProKYC-style kits, presented at Black Hat this summer, generate a forged ID and matching selfie to spoof liveness checks. Interpol put total fraud losses at 442 billion dollars in 2025 and found AI-enhanced fraud about four and a half times more profitable. The FBI warned of deepfake videos of its own personnel promoting a spoofed fraud-reporting site, a vishing wave using cloned executive voices reportedly targeted major hedge funds, and OpenAI banned accounts tied to a Cambodia-based scam operation. On criminal forums, AI has become as much a marketing label as a real capability.

How Exposed Are Enterprises to Everyday AI Use?

One in every 36 prompts submitted to generative AI tools in July, about 2.8 percent, carried a high risk of sensitive data leakage, and 88 percent of organizations recorded at least one high-risk prompt that month. Latin America recorded the highest regional rate at one in 29, and Business Services led by industry at one in 27, ahead of Healthcare, IT, and Government. These figures describe routine use rather than attacks, exposure that comes from tools adopted faster than they’ve been governed.

What Does This Mean for Organizations?
  • The gap between frontier capability and criminal deployment is closing from the top down, and nothing this period suggests that pace will slow.
  • Access, compliance, and autonomy are now separate commodities on the criminal market, so a model’s own safety behavior is no longer the binding constraint on misuse.
  • Current defenses still catch most AI-driven attacks only because the techniques remain familiar and the tools stay error-prone, and this period’s lab incidents show both conditions starting to change.
How Can Organizations Prevent Machine-Speed AI Attacks?

Reaction time built for human attackers cannot keep pace with a model that moves in minutes. Securing an AI transformation means securing the full stack, from everyday employee prompts to the applications and agents built on large language models, to the infrastructure carrying AI traffic through the data center.

  • Secure Employee AI Usage. Workforce AI Security gives teams visibility, governance, and real-time data protection across the GenAI tools employees use daily, the same tools the Gentlemen affiliate reached for.
  • Secure Enterprise AI Applications & Agents. AI Agent Security covers discovery through runtime enforcement against prompt injection and unsafe actions, the gap JADEPUFFER and GhostApproval
  • Secure MCP Usage & Tool Access. MCP protection spans both Workforce AI Security and AI Agent Security solutions, governing how models and agents connect to enterprise data and tools.
  • AI Security Testing. AI Red Teaming services applies the same adversarial discipline the labs used in their own evaluations, surfacing vulnerabilities before attackers do.
  • Secure AI Infrastructure & Private LLMs. AI Factory Firewall protects private enterprise LLMs and GPU clusters as the access underground matures into a full supply chain.
  • Validate What Attackers Can Actually Exploit. With only about one percent of AI-discovered flaws confirmed exploited in the wild this period, Agentic Exposure Validation uses a multi-agent pipeline to separate real, exploitable risk from theoretical findings and prioritize what to fix first.

AI models are moving faster than the alerts that follow them. Build for that speed now.

Leave a comment »

« Older Entries