AI-driven vulnerability research accelerates mass exploitation

Automated vulnerability discovery. OpenAI’s GPT-6 Cyber model identified 81 high-severity vulnerabilities in Firefox and generated working local privilege-escalation exploits for 948 Linux kernel bugs during a single research campaign (Rod Trent from Rod’s Blog). The model performed this analysis at a cost of $1.2 million, significantly outpacing the 166 exploits achieved by its predecessor, GPT-5.6 Sol, under identical test parameters (Ken Huang from Agentic AI). Mozilla has since released patches for the Firefox flaws, while Linux maintainers received 304 critical findings and candidate patches from the research output.

Targeted social engineering. Attackers stole approximately $6.3 billion from Binance through a multi-month campaign that utilized fake job interviews and malicious coding assignments to gain endpoint access (Rod Trent from Rod’s Blog). The threat actors leveraged a compromised host and internal AI tools to pivot to systems managed by wallet-team personnel, eventually executing unauthorized transfers in late October. Chainalysis also confirmed an October incident where offensive agentic techniques exposed live authentication tokens and password hashes for its entire user base, forcing a total credential reset for all clients.

Industrial control exploitation. Cyberattacks against internet-exposed refrigeration controllers impacted supermarkets across Belgium, Sweden, Ireland, Luxembourg, Estonia, Finland, and the Netherlands in early November. Attackers remotely elevated temperature thresholds to 50 °C, following a similar campaign in October that targeted French blood-bank plasma storage sites. These incidents demonstrate the vulnerability of end-of-life industrial controllers that lack update channels and often operate without active security oversight (a16z).

Appliance configuration risks. Barracuda patched two vulnerabilities in its Email Security Gateway that allow unauthenticated attackers to gain root access by chaining a configuration-restore bypass and a timezone-based command injection. Alpine Linux users face a decade-old authentication bypass in OpenSSH that permits remote login without a password if the system account is configured with a wildcard in the shadow file (Dan Goodin from Ars Technica). Security researchers emphasize that these flaws require immediate patching and strict restriction of administrative interface exposure to prevent unauthorized system control.

• Chainguard now provides a hardened catalog of over 1,000 drop-in replacements for GitHub Actions to mitigate supply-chain pipeline compromises (TLDR Devops).
• Apple will begin scanning files and photos shared via iCloud links for harmful content, removing end-to-end encryption for these public items (TLDR Infosec).