You might want to get about securing critical infrastructure of all sorts. I say that because French supermarkets were pwned in epic fashion. Everyone is reporting on it. I happened to pick Time Magazine:
The Paris prosecutor’s office opened an investigation on Monday into an overnight cyberattack on refrigeration systems at hundreds of French supermarkets. Hackers raised the temperature of refrigerators and freezers, sparking fires and causing food to spoil.
In a statement to TIME, French retailer Les Mousquetaires, which runs supermarket chains Intermarche and Netto, said damage from the attack could amount to several million euros in losses.
“Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented,” Dominique Schelcher, CEO of French supermarket chain Cooperative U, posted on X.
France’s National Cybersecurity Agency (ANSSI) confirmed to TIME that it is investigating the attack “both at the national level, to accompany potential victims, and at the European level to coordinate with its counterparts.”
Maggie McDaniel, Global Head of Intelligence, iCOUNTER had this to say:
“Nobody had to break into hundreds of supermarkets one at a time. Retailers say the refrigeration controllers were managed by suppliers and maintenance contractors working across several chains, so one kind of access reached many brands in a single night. Attackers look for exactly that kind of shared supplier when picking a target. It also shows a gap in how most organizations think about third-party risk. Vendor programs usually focus on software providers and IT service firms. The contractor who can reach your store’s cooling system from outside rarely gets the same scrutiny, even though, as this showed, losing that system means throwing out food and closing stores. Some of these organizations never bought the equipment directly, because it came in through contractors. Retailers should start by mapping which suppliers can reach their store equipment remotely, which of those systems no longer get security updates, and how that access is controlled and logged. The intelligence question matters just as much. Security teams should be watching for attackers targeting their suppliers, not only themselves, because when one shared supplier is compromised, every customer it serves is exposed at once. An annual vendor questionnaire won’t show you what a supplier has left connected to the internet.”
Attacks on critical infrastructure are here. It’s beyond time to do something about this. So if you need a wake up call, consider this to be it.
UPDATE: More content has come in:
John Strand, Owner, Black Hills Information Security:
“This is exactly the type of story we need to be focused on. There is still so much focus on protecting endpoints, servers, and web applications. All of that is important. But I think some of the biggest damage we’re going to see will involve IoT devices.
“These devices don’t get regular patches. They don’t get advanced EDR. Many times, they don’t even get simple firewalls because they’re installed in mom-and-pop convenience stores all over Europe and the United States. I don’t think we, as a society, are ready for that.
“Corporations take responsibility for protecting their employees, their systems, and their data. But when somebody builds a connected refrigerator, we tend to look at it as a product rather than an enterprise asset. Once it’s sold, the expectation is that the shop that owns it is responsible for securing it. And a lot of those shops have zero information security practice.
“A connected freezer is just one example. The bigger question is how we reach those small businesses and get security into their environments, either directly or through the MSPs and MSSPs that serve them.”
ㅤ
Denis Calderone, CTO, Suzu Labs:
“Here is another example of converged OT devices sitting directly on the public internet. These refrigeration controllers often have default credentials or no meaningful authentication at all. Some units also have a documented “code-of-the-day” bypass that takes advantage of a predictable code that can be trivially calculated to gain access. This is all to say that the attackers didn’t need a zero-day in this case, they basically just walked right in. Once in there the attackers just used the software’s intended functionality to force the refrigeration units into a forced defrost mode, raising temps to 50C (122F)
“What’s interesting here is that Claroty Team82 stood on a DEF CON stage in August and demonstrated exactly this scenario, including the ability to falsify temperature readings while disabling cooling. Two months later, someone operationalized it across five countries and hundreds of stores. In this case all of the models that were part of this attack are end-of-life between 2016 and 2021. You cannot remediate your way out of this because the device manufacturer stopped supporting these at least three years ago; you can only segment it, monitor it, or replace it.
“Then there’s the insurance question, which I think is where this story gets genuinely ugly for operators. Intermarche has already flagged that their policies may not cover this. Property insurance increasingly excludes cyber events. Standalone cyber insurance covers data breaches and network downtime, not 40,000 euros of spoiled dairy and a fire-damaged compressor room. When individual store losses run from 50,000 to 220,000 euros and you have 500-plus locations, you are looking at a coverage void that no one priced into their risk model. Let’s face it, nobody’s broker was asking “what happens if someone remotely cooks your inventory?” during the last renewal conversation.
“So what do you actually do tomorrow morning? Get every HVAC and refrigeration controller off the open internet. Full stop. Run the Censys or Shodan query yourself before someone else does. Inventory what you have, what firmware it’s running, whether it’s EOL. And if your facilities contractor knows the answer and you do not, that’s where you start. You don’t need a six-month OT assessment program. You need a list, a network segment, and a plan for the devices that will never see a patch. Start there.”
ㅤ
Ashley Knowles, Sr. Cyber Security Consultant, Black Hills Information Security:
“We talked about this on the news yesterday. This reminded me of the Target attack where attackers obtained access through an HVAC contractor’s credentials. As of right now though, there’s a lot of missing details such as how they got in and no one is claiming responsibility. The biggest issue, as I see it, is that Danfoss stated the majority of the affected units were end of life and discontinued 5-10 years ago.
“We highlight this often in our tests; end of life units don’t receive updates or support from vendors. So new vulnerabilities will remain unresolved. IoT devices may have default credentials, exposed management interfaces, or missing patches. They are often plagued by the end of life issue due to budget constraints or the “if it isn’t broke – don’t fix it” ideology.
“What I can advise as a key takeaway from this incident is reviewing the organization’s attack surface, including how devices connect to vendors, what remote access vendors have, and what that exposure looks like. Keep devices updated and segment devices that can’t be replaced or updated, prioritizing devices that are internet facing.”
ㅤ
Damon Small, Board of Directors, Xcape, Inc.:
“Physical product spoilage and costly asset damage represent the immediate financial toll when adversaries shift from corporate data extortion to operational technology sabotage. The disruption across French grocers demonstrates this exposure clearly. While threat actors remain the undeniable criminals in these incidents, operators must be held accountable for maintaining poorly configured environments. Danfoss patched the exploited firmware vulnerabilities nearly a year ago and advised facility managers to keep administration interfaces behind firewalls and VPNs. It remains unclear whether the vendor that installed these refrigeration units also configured the software, but accountability cannot be entirely outsourced. If a criminal breaks into a house because the owner left the front door wide open, the owner shares part of the blame. To mitigate this exposure, security teams must immediately sever control interfaces from the public Internet, place maintenance access behind segmented networks requiring multifactor authentication, and apply long-available updates.”
“Critical Takeaways:
- Failure to apply year-old vendor patches and properly segment operational technology directly enables physical sabotage and total inventory loss.
- Security leaders must establish clear lines of responsibility for network configuration when relying on third-party installers or integrators.
- Restricting administrative interfaces behind firewalls and VPNs remains a mandatory baseline to prevent trivial unauthorized access.
“The attackers may be the perpetrators, but leaving the administration software exposed makes the victim an accessory to their own downtime.”
ㅤ
Josh Marpet, Senior Product Security Consultant, Finite State:
“The EU Cyber Resilience Act has a significant end of support model that is intended for exactly this scenario. End of Support, under the EU CRA, is not a set time, such as 1 or 5 years. It is minimally 5 years, and as long as the expected lifetime of the product is. Under this, if the refrigeration systems are expected to last 20 years, support and security patches must continue for 20 years. Food safety is critical infrastructure, and the consequences of issues with food handling can be sickness and/or death.”
UPDATE #2: Johan Edholm, Security Engineer and Co-Founder at Detectify said this:
“This attack didn’t require any advanced techniques. From what’s been reported, the attackers got into refrigeration controllers whose management interfaces could be reached from the internet, and some of those units were old enough that they no longer receive security updates. Nobody thinks of a fridge controller as part of their IT, but if it’s online and reachable, it’s part of the attack surface.
“It also shows why defenders keep falling behind. Adversaries don’t have to deal with procurement or keep hundreds of stores running, and searching the internet for anything exposed is work they increasingly hand to automated tools and agents that never stop looking. Defenders are often still keeping track of equipment by hand, across hundreds of sites and systems built to run for many years. That can’t keep pace, which is why defenders need agents of their own, equipped with security tools they can trust, to find exposure as quickly as attackers do.
“The fundamentals haven’t changed, but the speed and volume have. Researchers had already found thousands of these management interfaces online before this happened, and the risk sits in the gap between knowing about a weakness and closing it. Start by knowing everything you have connected to the internet, including equipment that was never meant to be IT, and take management interfaces off the open internet. Then design the network so that if one device is compromised, the blast radius stays small and it can’t be used to reach anything else.”
ㅤ
Anthropic warns AI could self-replicate across IoT devices within months
Posted in Commentary with tags Anthropic on October 13, 2026 by itnerdAnthropic researchers warn that small AI models could be just months away from autonomously replicating across internet-connected IoT devices, including smart TVs, ovens and other household electronics, without relying on centralized data centers, according to new research.
In testing, a 9-billion-parameter AI model successfully ran on eight of nine hardware types, while models with 30 billion parameters or fewer completed many individual steps required for self-replication. Researchers also demonstrated a 26-billion-parameter model operating across 15 inexpensive Android TV boxes.
Anthropic warned that AI-powered worms could exploit poorly secured IoT devices, adapt to unfamiliar hardware, spread without human intervention, unlike traditional malware relying on centralized infrastructure, these distributed AI systems could be difficult to shut down.
Researchers said current models cannot yet reliably complete the full replication process on tested IoT hardware, but that capability could emerge within months.
John Strand, Owner, Black Hills Information Security:
“We are now firmly in the land of science fiction. Unfortunately, it’s not fiction. We’ve been looking at self-replicating worms and botnets like Carna for decades. The concern has always been their ability to spread. What makes this different is that AI has the capability to identify vulnerabilities, exploit them automatically, and then replicate across devices, instead of relying on an existing vulnerability.
“The biggest takeaway is that smaller models have many of the same capabilities as cutting-edge frontier models. They just take longer. When you see reports about high-end research models like Mythos, understand that smaller models running on systems with around 128 gigabytes of memory are still in the ballpark. They may not be as good or as fast, but defenders have to be ready for them.”
ㅤ
Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security Technology Inc.:
“Anthropic’s research highlights an interesting shift in the threat landscape. We’ve spent years worrying about securing IoT devices, and now we’re exploring a future where your smart TV might do more than recommend what to watch. It could become part of a distributed, autonomous attack infrastructure. That’s quite an upgrade, and not one I’d recommend.
“From my experience in offensive security, the question isn’t simply whether an AI model can replicate, but what it can accomplish after gaining a foothold. Can it discover other devices, cross trust boundaries, exploit weaknesses, establish persistence, and continue operating without centralized infrastructure? Those are the attack paths we need to test, not just theorize about.
“Anthropic demonstrated important building blocks, including successful propagation in a simplified, controlled environment using a larger model. But that doesn’t mean smaller models can reliably spread autonomously across real-world IoT environments today. There’s a difference between demonstrating capability and proving operational reliability, and that distinction matters.
“The objective isn’t simply to detect the next AI-powered worm. It’s to understand where our architectures would allow it to spread, validate the controls intended to contain it, and produce evidence that those defenses actually work. After all, the last thing we need is a smart oven that decides lateral movement is part of the recipe.”
ㅤ
Steven Swift, Managing Director, Suzu Labs:
“There’s a lot of fearmongering about AI escaping containment, hacking its way into resources and then completely losing control over it. The research Anthropic performed on self-replicating AI directly addresses the feasibility of this in IoT devices, as these tend to have low to zero security controls in place, making them an easy target.
“Lets be clear on what self replication means. Because it sounds bad.
“AI uses model weights to function. To replicate to another system it has to 1) access that system remotely, 2) download its own model weights, and 3) setup a loop so the model can prompt itself to go find more hosts to replicate to.
“It needs to be noted that without an orchestration layer, there’s no way to direct the swarm of replicated agents. They’ll just keep executing the same loop indefinitely.
“This concept isn’t new. We call self replicating malware worms. Self replicating AI is then more accurately thought of as a regular worm style malware, that happens to include the ability to download model weights, and then loop prompts and outputs indefinitely, using tool calls to execute functions as needed.
“We’ve had decades to get good at finding and eliminating worms from our networks. Self replicating AI powered malware is just another variant on and old technique.
“However, we’re also still releasing IoT products with effectively no security in them, that are designed to be compromised. Huge portions of IoT devices are already being used as parts of botnets, without their owner’s knowledge or consent.
“Anthropic concluded that models capable enough to self replicate don’t fit onto the limited resources found on IoT devices. They also found that models could be distributed over multiple IoT devices, allowing for more sophisticated models to run on limited hardware. This wouldn’t be self replicating anymore, as it requires an orchestration layer. Although you could simply have the worm run at the orchestration level, but because it requires more resources to run larger models, it would be limited to targeting higher powered systems, which would expose it to more traditional security counter measures, such as EDR.”
ㅤ
John Carberry, Solution Sleuth, Xcape, Inc.:
“Autonomous AI self-replication across enterprise-adjacent Internet of Things (IoT) hardware introduces immediate operational and liability risks by turning unmanaged perimeter devices into decentralized attack platforms without datacenter reliance. Yet self-replicating software is not new. The first was the Christmas Tree worm in 1987, closely followed by the Morris Worm in 1988, both of which wreaked havoc on existing networks, including what we now call the Internet. Anthropic’s research highlights a modern twist through distributed weight sharding across consumer electronics, meaning traditional centralized egress kill switches will fail to neutralize localized infections. Rather than panicking over speculative model autonomy, security leaders must prioritize fundamental architecture: isolate peripheral electronics into segmented subnets, disable unauthenticated management interfaces, and eliminate default credentials before automated propagation becomes viable.”
“Critical Takeaways
“We spent nearly four decades hardening networks against self-replicating worms only to invite them back in through unpatched conference room displays.”
ㅤThis shows that AI can’t be trusted. Which means that you have to gatekeep the daylights out of it if you want to use it. Consider this your 2 minute warning.
Leave a comment »