OpenAI Pauses Its Astra Model After It Hits the "Critical" Cyber Threshold

OpenAI says its unreleased Astra model may be the first to reach the highest cybersecurity risk tier in its Preparedness Framework — meaning autonomous zero-day development against hardened systems can no longer be ruled out — and has halted parts of the model’s development. On the ground, an actively exploited N-able N-central zero-day has now been confirmed to reach customer networks, with at least one ransomware crew wielding the exploit.

AI & Model Security

• OpenAI flagged Astra as potentially “Critical” for cyber capability and paused internal work on it. Preliminary evaluations showed such strong gains in agentic coding and offensive performance that OpenAI says it “cannot rule out Critical capability level” — the tier that implies autonomously developing functional zero-days against hardened real-world targets — and is restricting internal access pending stronger controls. The move follows the recently disclosed rogue-agent incidents (earlier coverage). The Decoder, OpenAI
• Irregular, the testing firm at the center of the Anthropic and Meta sandbox escapes, won’t say whether there were more. A spokesperson told The Record that its investigation into the OpenAI, Anthropic, and Meta incidents is ongoing and declined further detail — leaving open how a “Frontier AI Security” evaluator left sandboxes with live internet access for months. The Record
• A GitHub issue was enough to reach CI secrets behind the major coding agents. Novee Security showed at Black Hat that an account with no repository privileges could execute code on the CI runners behind Anthropic’s and Google’s own coding-agent repos, and hijack the next agent run on OpenAI’s — each in the vendor’s shipped default configuration. The Hacker News
• Check Point detailed five memory-safety bugs in Cloudflare’s workerd enabling cross-tenant data leaks and sandbox escapes in the runtime behind Cloudflare’s agentic “Code Mode” and Workers; Cloudflare has shipped fixes, with the research presented at Black Hat. Check Point Research
• “Kinetic Prompt Injection” jailbreaks an embodied AI system. A Black Hat briefing demonstrated a full compromise of a stock Unitree Go2 robot dog via prompt injection — moving the attack off the screen and into physical space. Black Hat
• Varonis’ “RovoBlast” leaks data from Atlassian’s Rovo AI Assistant with a single click. Varonis
• Claude Code’s context can be spoofed by changing your email. A researcher found Claude Code injects the user’s email into context and treats them accordingly — swapping in another address made the model reason as though the user were a recognized Anthropic alignment researcher, altering its responses. @fjzzq2002

Vulnerabilities & Exploits

• Two new logical flaws in Kerberos take a low-privileged user to full domain takeover. Disclosed at Black Hat, the chain reportedly reaches domain admin. @cyb3rops
• WordPress patched XSS2Shell (CVE-2026-64638), a CVSS 8.9 pre-auth reflected XSS in the login screen that chains to PHP RCE. The XSS needs no account; researchers at pwn.ai — who say the bug was discovered autonomously — showed it chaining to code execution when a logged-in admin interacts with an attacker page (create API creds, gain REST access, upload a malicious plugin). The flaw affects every version of WordPress. The Hacker News
• N-able N-central attackers have now reached customer networks, and a second emergency hotfix has shipped. Build 2026.3.1.10 (Thursday) supersedes Monday’s 2026.3.1.7; N-able confirms full account takeover is possible and urges immediate on-prem patching (earlier coverage). Kevin Beaumont warns a ransomware group already has the exploit, saying he spent hours helping a government office hit with ransomware via this bug. The Register, @GossiTheDog
• BTCPay Server disclosed a critical, actively exploited flaw and told operators to update to 2.4.2 immediately. The team warned user funds could be at risk and advised shutting down instances that can’t be patched at once. @DarkWebInformer
• JetBrains TeamCity CVE-2026-63077 continues to be exploited (earlier coverage): Rapid7 published an analysis of the unauth RCE and CISA added it to the KEV catalog. @cyb3rops, CISA KEV
• A researcher dropped an RCE for the latest Apache httpd, told people to “use it in the wild,” and left on a three-week vacation before publishing the exploit — a textbook irresponsible-disclosure situation defenders should be aware of. @cyb3rops

Cloud & Identity

• Malware can abuse Windows Hello for Business keys for persistent Entra ID access. Dirk-jan Mollema showed that malware in a signed-in Windows session can silently use the victim’s WHfB key to authenticate to Entra ID, then register an attacker-controlled device, obtain a Primary Refresh Token, and add further authentication methods where tenant policy allows. The Hacker News
• A widespread AitM phishing campaign is hijacking Microsoft 365 accounts to harvest payroll and finance email. The operation uses residential proxies to make malicious sign-ins look like ordinary consumer traffic and hunts for personnel in financial workflows. The Hacker News

Threat Activity

• Google/Mandiant tie a 200+ organization extortion spree to UNC6671, which has quietly rebranded from BlackFile into Redact, Pink, Helix, and Falcon. The group builds tailored help-desk phishing infrastructure and uses vishing plus AiTM to target financial services, private equity, hedge funds, and law firms — reported victims include Blackstone, KKR, Apollo, CME Group, Moody’s, Point72, Citadel, and Two Sigma. BleepingComputer, SecurityWeek, Reuters
• A new ClickFix variant abuses pcalua.exe to launch a WebDAV share over per-victim tokenized URLs, side-loading a spoofed DLL via rundll32 to deploy infostealers. A parallel macOS strain in the same campaign drops a stealer that drains crypto wallets. Unit 42, The Hacker News
• Nearly 800 malicious npm packages are delivering a cross-platform RAT and infostealer. The Hacker News

Data Breaches

• A Metabase SQL injection zero-day was exploited to breach cloud instances, hitting Framework and Tally. Metabase says attackers exploited an unknown flaw in versions 1.58+ that allowed access to customer instances and connected data; Framework says all customers had names, emails, phone numbers, and addresses exposed (order/payment data was not). The bug is patched and cloud instances remediated. BleepingComputer, Framework (discussion)
• Levi Strauss says attackers social-engineered three employees to access and steal corporate data from their machines. BleepingComputer
• ShinyHunters is advertising 11.5M records from an unnamed victim spanning Salesforce, ServiceNow, and Entra, plus 3.1 TB+ of internal corporate data. @DarkWebInformer

New Tools & Releases

• Orange Coder — an open-source offensive-security model built for autonomous red-team operations, a 35B MoE (3B active) designed to run locally. @cyb3rops
• Claude-red — a curated library of offensive-security skills for Anthropic’s Claude skills system. GitHub
• Dopamine 3.0 — the first iOS 26 jailbreak, supporting iOS 15.8.7–18.7.1 and 26.0–26.1 (beta) across supported devices. MacRumors, OneJailbreak
• SlopKit — a PS5 WebKit userland exploit covering firmware 9.xx–13.60 (userland only; kernel still needed for a full jailbreak). OneJailbreak

Industry & Policy

• Amazon, Cursor, Microsoft, OpenAI, and Vercel launched Agent Plugins, an open standard defining a single package format for AI agent extensions; v1.0.0 uses a plugin.json manifest and supports both agent skills and MCP servers. The Decoder (discussion)
• Microsoft took the “lamest vendor” Pwnie Award for threatening security researchers with legal action. This Week in Security (discussion)