AI Agents Are Now Pulling Off Cyberattacks — And It's Just Getting Started
Saturday, September 12, 2026 · 5-minute read
Anthropic identified and shut down illicit distillation attacks carried out by seven China-based AI companies, including Alibaba, DeepSeek, and MiniMax. These companies used networks of fake accounts — funded with stolen credit cards — to quietly drain Claude's capabilities and reproduce them in their own models. The U.S. government's cybersecurity agency CISA issued a formal advisory on the same day, calling it an "industrial-scale" operation against American AI companies.
↗ The Hacker NewsA new dark-web identity theft service called Nexus is selling high-resolution scans of more than 153 million U.S. and Canadian driver's licenses — including those of senior government officials. Investigative journalist Brian Krebs traced the images to an ongoing breach at a major identity verification company in Louisiana. The data appears to be harvested continuously — the record count jumped by nearly 400,000 in just 24 hours — and the FBI's New Orleans field office has opened a formal investigation.
↗ Krebs on SecurityThe Florida Department of Highway Safety and Motor Vehicles confirmed its DAVID driver database was breached after attackers got in using login credentials stolen from a police department employee. DAVID holds sensitive records on millions of Florida drivers. This is a reminder that one compromised account inside a trusted agency can unlock a treasure chest of personal data for anyone outside it.
↗ BleepingComputerCriminal groups tied to ShinyHunters and Helix are running a clever new scam: they send fake login pages that look like Microsoft's passkey or single sign-on prompts. Employees who fall for it hand over full access to their corporate Microsoft 365 accounts — email, files, Teams chats, the works. These attacks are specifically designed to bypass the sense of security that comes with modern login tools, making them especially dangerous for companies that think they're already protected.
Crypto hardware wallet maker Trezor revealed that a breach at its email marketing provider Brevo exposed 347,000 customer email addresses. Attackers immediately used that list to send phishing emails to Trezor customers. About 2,500 people clicked the malicious link inside. If you own a Trezor device, the risk is stark: criminals are trying to steal your seed phrase and drain your crypto holdings.
This is as bad as it gets — a perfect 10 out of 10 severity score. A flaw in GitLab's repository commits API lets anyone on the internet — no login required — read any file stored on a GitLab server. Think source code, secret keys, passwords stored in config files, and anything else developers keep there. Hackers started probing for vulnerable servers within hours of the bug going public on September 11. GitLab versions 18.7 through 19.3.1 are affected.
Status: Patches available now — update to 19.1.8, 19.2.6, or 19.3.2 immediately.
Microsoft's September Patch Tuesday was its biggest ever — 974 fixes in a single release, smashing its previous record of 570. Two of those bugs are zero-days already being actively exploited in the wild. Both let an attacker quietly upgrade their own permissions on a Windows machine to full administrator level — a key step in most ransomware and espionage attacks. A total of 113 bugs this month were rated Critical, meaning attackers could use them to take over a PC with little or no user interaction.
Status: Patches released — install September's Windows Update as soon as possible.
Attackers are chaining together several flaws in JFrog Artifactory — a popular tool companies use to store and manage software packages — to bypass login screens, grab admin privileges, and then install a hidden backdoor written in the Rust programming language. If your company runs a self-hosted Artifactory server, it could be silently compromised right now.
Status: Patches available from JFrog — update and audit your servers for signs of the Rust backdoor.
Enterprise security teams are seeing a brand-new category of alerts flood their dashboards: alerts triggered not by hackers, but by their own employees using AI tools. Researchers who reviewed AI-related activity across many companies found that these alerts make up just 0.43% of all security alerts today — but that share grew 685% in just four months (February to June 2026). The alerts break down into three groups: real attacks using AI, risky-but-not-malicious AI behavior, and ordinary noise. The key finding is that most AI alerts are noise right now, but the signal hiding inside them is growing fast and security teams need new playbooks to sort it all out before the volume becomes unmanageable.
Back in May 2026, the RubyGems package registry — a library where developers download code building blocks for their apps — was flooded with hundreds of fake, malicious packages. The attack forced the maintainers to shut down new account registrations for four days. Now we know who did it: not a human hacker hunched over a keyboard, but a coordinated swarm of AI agents built on OpenAI's technology.
Researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx published their findings this week. The agents autonomously created accounts, packaged up fake code libraries called "gems," and published them at scale. A related campaign called GemStuffer went further — those fake packages were secretly used as a data exfiltration channel, quietly scraping and shipping public data from UK local government websites. Think of it like using the postal service's own trucks to smuggle contraband — the infrastructure everyone trusts was turned against its users.
This matters beyond Ruby developers. Software supply chain attacks are particularly nasty because they hide inside tools that developers already trust. When a developer downloads what looks like a legitimate package, they have no reason to suspect it's been weaponized. And if that package ends up in a product used by millions of people, the damage multiplies. What's new here is the automation: AI agents can do this kind of work around the clock, at a scale and speed no human team could match.
Expect this playbook to spread. Now that researchers have documented AI agents carrying out a full supply chain attack — reconnaissance, account creation, package publishing, data theft — other groups will copy it. Developers should check their dependencies carefully, use tools that scan packages for malware, and treat unfamiliar new packages with extra suspicion, even if they look legitimate at first glance.