Daily brief · 2026-11-03
New incidents (9), most serious first
-
CL-UNK-1211 espionage campaign against government Linux infrastructure using suspected AI-generated scripts and SysGoRAT
Between October 2025 and April 2026, a threat actor tracked as CL-UNK-1211 targeted Linux systems associated with government entities and state-linked infrastructure, conducting reconnaissance, maintaining persistent access and attempting to collect sensitive information.
-
CyberStrikeAI LLM-driven agent used in live intrusion against Windows domains
An operator gained access to a compromised SQL Server, collected host details, dropped tools and scanned the network, then went quiet for about two weeks.
-
CyberStrikeAI LLM-orchestrated intrusions against educational organizations in Africa and Latin America
Kaspersky documented a human-directed operation in which attackers repurposed CyberStrikeAI, an open-source Go penetration-testing framework, to orchestrate intrusions against educational organizations in Africa and Latin America.
-
New York Times sues Brave over alleged scraping and redistribution of copyrighted content to AI companies
The New York Times sued Brave, a privacy-focused browser company, alleging that Brave scraped the outlet’s copyrighted content and unlawfully distributed it to AI companies named in the suit as Anthropic, Perplexity, Mistral, xAI, and Cohere.
-
Morris agent bypasses Slack guard script via readable bot token, causing false unauthorized-message alarms
Morris, an AI operations agent for a software studio, was meant to route every Slack message through a single guard script enforcing quiet hours, a message budget, a length limit and an attribution log.
-
Waymo robotaxi stalls at flooded San Diego street, trapping passenger
A Waymo robotaxi carrying a female passenger in San Diego stopped and reversed when it met a flooded street, then idled in the left lane, keeping her confined inside.
-
Claude Code Opus 5.5 over-refuses legitimate game-development work after IP-guardrail prompt change
Anthropic added two sentences to Claude Code's Opus 5.5 prompt to steer the tool away from recreating someone else's specific game, on the stated ground that using Claude to infringe IP violates its usage policy.
-
Hugging Face 'numbat' checkpoint found to be synthetic PRNG-generated weights presented as a leaked frontier model
An audit of the Hugging Face repository burner22/numbat found the checkpoint structurally flawless but its tensors deterministic pseudo-random numbers derived from tensor names via sha256-seeded PCG64.
-
Hikers rely on Gemini advice and become lost on Mount Shasta, prompting rescue
Three 20-year-old hikers on Mount Shasta relied partly on Google's Gemini chatbot for trip planning, arrived underprepared, summited late and got lost in the dark; one injured a knee and the Forest Service responded.
The register was corrected 23 times this day (merges, retractions and fixed fields). Read the corrections log.