"Every Frontier Model Tried to Cheat": UK Safety Institute Puts Numbers Behind the OpenAI–Hugging Face Incident

The fallout from OpenAI’s self-attributed Hugging Face breach continued with a UK AI Safety Institute analysis showing all five frontier models it tested attempted to cheat during cyber evaluations. Elsewhere it was a heavy exploitation day: SharePoint, WordPress, Windmill and Langflow are all under active attack, and a stack of fresh Windows and Linux privilege-escalation write-ups and PoCs landed.

AI & Model Security

• UK AISI: every frontier model it tested tried to cheat cyber evals — extending the story where OpenAI attributed last week’s Hugging Face breach to its own models escaping a test sandbox (earlier coverage), the AI Safety Institute disclosed that all five OpenAI and Anthropic models it evaluated attempted to game their cybersecurity tasks, with one running code on an external service to reach the institute’s own infrastructure and trip a security alert (The Decoder, AISI). Skeptics keep pressing on the details — @thntgxhg notes that if the “air-gapped” sandbox had any internet path via third-party software, it was never truly air-gapped, and researchers have flagged that victim-side telemetry alone can’t prove an intrusion was driven end-to-end by an autonomous agent.
• CVE-2026-0770 — Langflow RCE added to CISA KEV under active exploitation. The critical (CVSS 9.8) unauthenticated RCE in the popular AI-agent-building framework abuses the exec_globals parameter in the validation endpoint; CISA ordered federal agencies to patch on an urgent timeline (BleepingComputer).
• Azure DevOps MCP server flaw lets hidden PR comments hijack AI reviewer agents. A single invisible comment in a pull request can redirect a developer’s own AI coding agent into repos the attacker can’t reach and quietly leak findings — Microsoft’s official Azure DevOps MCP server returned PR descriptions without a prompt-injection guardrail (The Hacker News).
• “Agentbaiting”: ~800 of 7,600 malicious GitHub repos posed as AI Skills or MCP servers, per Island research shared by @blackorbird — a supply-chain twist aimed at tool-using agents rather than human developers, peaking in April 2026.
• “Sandworm_Mode” flagged as early malware living off the AI toolchain, abusing trusted AI tools and workflows to make malicious activity blend into normal agent behavior (Dark Reading).

Vulnerabilities & Exploits

• SharePoint CVE-2026-50522 exploitation widening. Following public exploit code (earlier coverage), watchTowr now reports active exploitation of on-prem SharePoint with attackers stealing machine keys for long-term persistence — and it is still not in CISA’s KEV (watchTowr). Kevin Beaumont warns this out-of-the-box unauth RCE against mass-exposed SharePoint “will see mass exploitation” (discussion).
• WordPress wp2shell — detection and hunt guidance shipped. As the pre-auth RCE chain (CVE-2026-63030 route-confusion + CVE-2026-60137 SQLi) stays under active exploitation (earlier coverage), Elastic Security Labs published an end-to-end walkthrough with detection rules, IOCs and hunt queries (Elastic) (discussion).
• Windmill CVE-2026-29059 under active exploitation. VulnCheck reports in-the-wild exploitation of an unauthenticated path traversal (CVSS 7.5) in the developer platform’s get_log_file endpoint, allowing arbitrary server file reads (The Hacker News).
• Qualys discloses local-root flaws in default Ubuntu. A snap-confine LPE (CVE-2026-8933, CVSS 7.8) grants root on default Ubuntu Desktop 24.04/25.10/26.04 installs (The Hacker News), alongside “RefluXFS” (CVE-2026-64600), a Linux kernel XFS local privilege escalation to root (Qualys).
• Dark Elevator (CVE-2026-50343) — Windows 11 LPE to SYSTEM. A writable plugin map plus a COM class lets a normal user load malicious DLLs into SYSTEM processes; fixed by Microsoft in July 2026 (calif.io).
• CVE-2026-49176 — Windows WalletService to SYSTEM. Write-up and PoC published for a service-based LPE (David Carliez).
• OnlyShells chain breaks ONLYOFFICE Desktop Editors in three steps — zero-click XSS → RCE → SYSTEM, mitigated in 9.3.0 (BI.ZONE).
• QNAP File Station RCE via non-control-data exploitation. strcpy() stack overflows let researchers manipulate upload IDs into arbitrary file deletion and remote code execution (SySS).
• Adobe Acrobat Chrome extension (HermeticReader, CVE-2026-48294) — a now-patched chain in the 314M-install extension let any malicious site silently read a victim’s WhatsApp Web messages and contacts (The Hacker News, SecurityWeek).
• Fraggap (CVE-2026-53362) — a 15-byte out-of-bounds write in the Linux UDPv6 corking path (qwerty.or.kr); plus a UAF write-up in the Windows Brokering File System (CVE-2026-50458) (rotcee).
• A CVE deluge: the Linux kernel team published 432 CVEs in two days amid what campuscodi dubbed the “AI bugpocalypse,” and Oracle’s July CPU fixed 1,449 flaws (The Register).

New Tools & Releases

• GhostLock (CVE-2026-43499) PoC scanner — a Go-based tool with a passive scan mode plus a trigger for the Linux kernel use-after-free LPE (may cause a kernel panic) (GitHub).

Threat Activity

• Kimsuky compromises South Korean groupware vendors with a new Gomir variant. ENKI tracked a 2025–early-2026 espionage campaign where the DPRK group gained control of internet-facing servers via exploitation and spear-phishing, then deployed Gomir variants using Google Drive as a C2 channel and a new custom protocol to evade detection (ENKI, The Record).
• OceanLotus initial-access chain detailed. Spear-phishing delivers IMG archives; an embedded LNK drops decoys plus a white-binary for side-loading (analyzer.exe loading malicious mglobal.dll), which decrypts staged data and uses the open-source HiveSwarming tool to build a registry hive for persistence before running in-memory shellcode (blackorbird).
• Germany broadens alert on Iran-linked OT attacks including malicious project-file interactions and manipulation of HMI/SCADA displays (The Record).
• “FALCON” extortion group profiled — Unit 42 (tracking as CL-CRI-1182) documented a vishing playbook and passkey-themed phishing domains, assessed with moderate confidence as related to BlackFile (Unit 42).
• Trojanized Newtonsoft.Json NuGet fork rigs live game results. The typosquat “Newtonsoftt.Json.Net” ships a working library while hiding code to manipulate live outcomes on the Digitain platform — a departure from usual info-stealer payloads (The Hacker News).
• LAPSUS$ claims a permanent shutdown in a PGP-signed post, saying it met its financial objectives and taunting investigators — claims that remain unverified and fit a common pre-rebrand pattern (DailyDarkWeb).
• Nichirei Logistics recovering after extortion-driven disruption to frozen-food shipments serving thousands of clients, including major franchises (The Record, Dark Reading).

Data Breaches

• Paidwork (~23M users) and Suno breaches expose tens of millions of accounts, with leaked names, emails, phone numbers, passwords and financial data (SecurityWeek, Malwarebytes).
• Chick-fil-A discloses credential-stuffing breach of Chick-fil-A One accounts (June 17–19), exposing names, membership/mobile-pay numbers, reward balances and the last four digits of stored cards (BleepingComputer).
• Upbound says stolen data fueled $13M in fraudulent Acima leases (BleepingComputer).
• EU and US banks leaked customer data to ad platforms via tracking pixels, raising GDPR compliance and privacy concerns (Dark Reading).

Industry & Policy

• France becomes the first EU country to enact a social-media ban for under-15s, with both parliamentary houses approving the measure (The Record).