NEW: malware developers added nuclear & biological weapons text to to their spyware.

Goal? To trigger LLM safety refusals... so that their spyware wouldn't be analyzed by an AI security scanner.

Cleanest practical example I can think of for why over-indexing on first order safety alignment is risky.

When closed (and open) models ship with aggressive refusals, they will be sprinkled with second-order blindspots that attackers will discover...and exploit.

We are only in the earliest days of attackers leveraging these features, and it wouldn't surprise me if users systems that need to handle complex cybersecurity issues demand that models be less safety-blunted.

In the weeds: @SocketSecurity's post also shows why intention matters in how you design a malware analysis pipeline to avoid prompt manipulation.

H/T to colleagues that shared this with me https://socket.dev/blog/mini-shai-hulud-miasma-and-hades-worms-target-bioinformatics-and-mcp-developers-via-malicious

Hundreds of millions of Pokémon Go players spent years filming the streets, parks, and buildings around them to earn in-game rewards. Those roughly 30 billion environmental scans are now owned by Niantic Spatial, and they helped train a camera-based navigation model that a U.S. defense contractor is preparing to put into drones and other military robots. Most of the players had no idea.
The pipeline runs from a mobile game to the battlefield in three steps. Players scanned the physical world. Niantic Spatial turned those scans into a 3D map that lets a machine locate itself by sight when satellite signals fail. And in December 2025, Niantic Spatial announced a partnership with Vantor, the defense and intelligence firm formerly known as Maxar Intelligence, to fuse that ground-level system with Vantor’s aerial navigation software for use in GPS-denied operations.

Fedora detects a compromised contributor being impersonated by an AI agent to push questionable changes
11.06.2026 10:10 (MSK)

Adam Williamson from Red Hat, who leads the quality assurance team for the Fedora project, noticed suspicious activity from Nathan Giovannini, who joined the Fedora project in 2016 and participated in the Fedora Infrastructure Team for some time. It is not ruled out that the activities carried out over the last two months on Nathan's behalf were aimed at gaining trust by building a history of accepted changes and participating in bug fixing, before committing malicious actions, similar to the xz package backdoor incident.

Suspicion was raised by the fact that the previously inactive developer suddenly began actively participating in bug discussions and sending patches in May, and this activity showed patterns typical of AI usage. For example, AI-generated summaries appeared in the comments, after which Nathan was asked not to abuse copying outputs from an AI assistant.

In addition, there were meaningless reassignments of issue reports to himself in subsystems where Nathan is not a maintainer (1, 2, 3), changes to the status or priority of issue fixes (1, 2), postings of AI-generated recommendations to the authors of bug reports (1, 2, 3), and submissions of AI-generated patches. Bypassing the project's rules, Nathan closed bug reports immediately after submitting AI patches to upstream projects, without waiting for their acceptance, or simply closed them with the "NOTABUG" flag and a recommendation to re-verify the occurrence of the issue.

Adam Williamson assumed that Nathan was using an AI agent to fix bugs in Fedora and asked him to stop using the AI agent in autonomous mode. Nathan replied that it was not his AI agent, his credentials had been compromised, and an outsider was acting on his behalf. Subsequently, Nathan posted a message stating that he had regained access to his Fedora and GitHub accounts, and also wrote that his official GitHub account is "nathangiovannini99".

The message raised even more questions, as the mentioned account had been created an hour before the message was published, and at least two other accounts associated with Nathan (leurus27-boop, nathan9513-aps) surfaced on GitHub. It could not be ruled out that an attacker who had gained access to Nathan's email was continuing to communicate with the developers. Nathan's account access to Bugzilla was blocked, and a review of all changes made by him was initiated.

It turned out that the suspicious activity started on April 7, and some patches sent by Nathan only created the illusion of a fix. However, such patches were accepted into the Anaconda installer and included in the Anaconda 45.5 release. The Anaconda maintainer reverted the introduced changes and published the Anaconda 45.6 release without these patches.

Furthermore, fixes submitted on Nathan's behalf were accepted by the developers of the osc (openSUSE Commander) utility, which implements a command-line interface for the Open Build Service build system. Another patch was submitted for inclusion in the lxqt-policykit package, linked to fixing an issue in Fedora, but Fedora developers managed to warn the maintainer before it was accepted. The patches did not include malicious actions, but it is assumed that they could have been preparation for introducing malicious changes into the components of the build system and the service providing privileged operations in the lxqt-admin interface. Fixes submitted by Nathan were also noticed in the gwenview and easyeffects projects.

What happens when you unleash an AI across all of Google's infrastructure? 1,500 APIs, 3,600 keys, and $500,000 in bounties later, here's what I found.

"Now's time for the fun: The AI ended up finding $500,000 in bugs in less than 3 months of running. There are far too many bugs to cover here, but here are some of the coolest bugs it found (that are fixed)."

Google Voice ATO

The API also conveniently provided an API endpoint to assign a Google Voice number to any target Google account (even if they never used Voice before)

Leaking Youtube's unlisted videos

This attack is extremely practical in the real world. Anyone could send a request every 30 seconds or so to get a live feed of every single partner-uploaded unlisted video. Why does this matter? Prediction markets like Polymarket let people bet on the outcome of future events, including things like when Google's next Gemini model will be released

According to the notice, the information exposed varied by account, but may have included:

VRChat username
Email address associated with the VRChat account
VRChat+ subscription status
Login history, including device information, hardware identifiers, and IP addresses