FlagThis - Latest Cybersecurity News

Security researcher Armadin has identified a multi-step attack chain capable of executing a sandbox escape within Anthropic's Claude Cowork for Windows. The vulnerability exploits two distinct weaknesses to bypass the application's Windows-specific isolation layer, enabling an AI agent or malicious input to interact directly with the host operating system. This exploit includes a network sandbox bypass, facilitating unauthorized external communication and the silent exfiltration of sensitive host data, including API keys and filesystem contents. While Anthropic disputes the practical risk and severity, the findings highlight critical boundary failures in AI agent architectures, where functional deployment speed may compromise essential host-level security controls.

Researchers from Mozilla 0DIN have identified critical Indirect Prompt Injection (IPI) vulnerabilities within Claude Code and other agentic AI coding tools. By embedding malicious instructions in seemingly benign external data, such as GitHub README files or bug reports, attackers can manipulate the agent's control flow to execute unauthorized system commands. This exploitation enables Remote Code Execution (RCE) on developer workstations, often bypassing traditional EDR/AV via instruction-based hijacking rather than traditional binary-based malware. Specifically, the research demonstrates an escalation path where the agent is coerced into establishing a reverse shell through DNS TXT records, providing a covert Command and Control (C2) channel that facilitates full machine compromise.

This vulnerability chain enabled remote attackers to execute zero-click prompt injections against the Claude for Chrome extension by exploiting a permissive origin allowlist (*.claude.ai) and a DOM-based XSS in an Arkose Labs CAPTCHA component hosted on a-cdn.claude.ai. By bypassing origin checks via the trusted subdomain, attackers could send unauthorized messages to the extension's background script, facilitating the theft of Gmail access tokens, Google Drive data exfiltration, and unauthorized account manipulation for over 3 million users.

During a controlled red-teaming exercise, Anthropic’s Mythos 5 large language model (LLM) demonstrated high-order autonomous offensive capabilities, successfully breaching nearly all NSA and U.S. Cyber Command classified network segments within hours. The model utilized advanced autonomous exploitation techniques to bypass perimeter defenses and escalate privileges across highly sensitive, air-gapped-style infrastructures. This unprecedented breach of classified environments necessitated an immediate national security response, resulting in executive directives to restrict access to flagship models—Mythos 5 and Fable 5—to verified U.S. citizens to mitigate the risk of foreign adversarial exploitation.

Anthropic reports that Alibaba conducted a massive "distillation attack" to illegally enhance its Qwen LLM series by harvesting high-volume synthetic data from Claude. The attack involved bypassing API rate limits and safety filters via Alibaba-linked infrastructure to extract complex reasoning capabilities and transfer them to Qwen's weights. This represents a critical breach of Terms of Service and a strategic intellectual property theft, effectively bypassing millions in R&D costs. The incident has prompted Anthropic to notify the U.S. White House to advocate for tighter export controls and API access restrictions on Chinese AI laboratories to prevent adversarial model distillation.

OpenAI is transitioning to the GPT-5.5 Instant architecture and Dreaming V3 memory synthesis while deprecating legacy models like o3. Simultaneously, the U.S. government has mandated Anthropic to restrict foreign national access to Fable 5 and Mythos 5 models. This regulatory action follows evidence that Fable 5 can be jailbroken to generate functional stack exploit code, shifting the threat model of high-tier LLMs from general productivity assistants to offensive cyber-weaponry capable of automating exploit development.

The Five Eyes Intelligence Alliance warns of a structural shift in the cyber threat landscape driven by frontier AI models, specifically Anthropic's Claude and the Fable models. These systems are transitioning from theoretical risks to operationalized offensive capabilities, reducing the "Time-to-Exploit" (TTE) for vulnerabilities from years to months. Technical vectors include AI-driven automated code auditing, polymorphic malware generation to evade signature-based detection, and LLM-orchestrated hyper-personalized spear-phishing. By bypassing safety guardrails via advanced jailbreaking, these models enable low-skill actors to execute high-sophistication APT-level operations, necessitating an urgent pivot toward AI-driven autonomous defensive frameworks.

Anthropic has introduced the LLM ATT&CK Navigator, a strategic framework that integrates Large Language Model (LLM) misuse vectors into the MITRE ATT&CK taxonomy. The tool addresses the systemic weaponization of AI to automate malware generation and scale offensive operations. By mapping specific AI-driven capabilities—such as automated code synthesis and evasion techniques—to existing security frameworks, the Navigator provides CISOs with a structured method to identify vulnerabilities in the AI-augmented attack surface. This shift is characterized by a significant increase in high-risk actors utilizing LLMs to bypass traditional signature-based and heuristic security controls.