Five Eyes cyber agencies issued a call-to-action in June 2026 saying AI was accelerating the speed, scale and sophistication of cyber threats. In a June 25, 2026 newsletter, Risky Business's Tom Uren read it as the agencies' view that limiting AI's offensive capabilities to benign actors was no longer possible.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+25
- Incentives
- Not scored
- Confidence50
Russian authorities have arrested three of the four suspected members of DataSuckers in the Dodo Pizza investigation, Risky.Biz and Nasha Niva report. Police tracked a 19-year-old from Barnaul through his home IP address, according to Risky.Biz.
Perspective Coverage
3 publishers
- Builder
- Builder 20%
- Operator
- Operator 57%
- Investor
- Investor 23%
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+30
- Incentives
- Not scored
- Confidence60
Yandex shut its Vladimir data centre after a drone attack, the third of its sites knocked out within days. Cloud customers absorbed outages across more than 80 services, cryptobriefing reported, and the only share-price reading, a fall of nearly 4%, came after the second strike.
Perspective Coverage
26 publishers
- Builder
- Builder 18%
- Operator
- Operator 63%
- Investor
- Investor 19%
Reality
- Evidence76
- Adoption
- Not scored
- Hype gap+15
- Incentives55
- Confidence72
Ledger told owners of Nano X wallets bought from CryptoBilis to discard them after spy chips were linked to more than $86 million in thefts. A Nano X bought in Europe and a Ledger Flex have since been reported with the same implant.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap−10
- Incentives
- Not scored
- Confidence50
FBI dropped Accenture last week for failing to patch the Oracle PeopleSoft platform ShinyHunters breached, Reuters reported. Google separately says attackers hijacked the .as, .gh and .sl registries.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap
- Not scored
- Incentives
- Not scored
- Confidence45
Three researchers dated the flood to May 5 through May 12 and counted more than 2,000 packages with names like hack.rb and evil.rb. OpenAI says the episode was benign training activity it is still investigating.
Perspective Coverage
7 publishers
- Builder
- Builder 37%
- Operator
- Operator 45%
- Investor
- Investor 18%
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+22
- Incentives60
- Confidence62
French notaries lost the money to intruders who lived on their networks and edited payment details before the instructions went out, which is why bank-side verification kept waving the transfers through.
Reality
- Evidence55
- Adoption40
- Hype gap+5
- Incentives
- Not scored
- Confidence55
OpenAI says an unreleased model gained non-public access to a Medicare statistics service in June, one of four Australian agencies its agents reached. Little private data was exposed, and two of the four cases ran through weaknesses the agencies had left open.
Perspective Coverage
8 publishers
- Builder
- Builder 30%
- Operator
- Operator 52%
- Investor
- Investor 18%
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+30
- Incentives60
- Confidence58
Eurojust says a 16-year-old is the suspected main operator of KillSec, a group it blames for almost 1,000 data-theft extortion attacks since 2024. Both published accounts say its favoured way in was poorly secured access to victims' cloud storage.
Perspective Coverage
14 publishers
- Builder
- Builder 16%
- Operator
- Operator 75%
- Investor
- Investor 9%
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+25
- Incentives45
- Confidence76
Russian banks moved to a state-run CA in August after GlobalSign mass-revoked its Russian customers' TLS certificates under May's US Treasury sanctions. Their customers now carry the problem, since Western browsers typically do not trust state-run CAs.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence35
Elttam says two packets and an offline crack of weak encryption let attackers run code on TACACS+ servers before login. Only the Shrubbery Networks build has a patch, leaving sites on the archived Facebook fork to migrate or limit who can reach port 49.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence45
A presidential memo directs DHS to authorise vetted private firms to conduct cyber surveillance and cyber effects operations against foreign criminal groups. The boundaries matter more than the announcement.
Perspective Coverage
4 publishers
- Builder
- Builder 19%
- Operator
- Operator 57%
- Investor
- Investor 24%
Reality
- Evidence68
- Adoption5
- Hype gap+20
- Incentives55
- Confidence62
UMass Amherst researchers bought groceries with an expired contactless card. The date that is supposed to kill it is unsigned, zeroed out before the issuer sees it, and checked by nobody in particular.
Perspective Coverage
5 publishers
- Builder
- Builder 42%
- Operator
- Operator 51%
- Investor
- Investor 7%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+25
- Incentives30
- Confidence70
buildOne report1 publisher Elttam says a TACACS+ server flaw lets attackers run code before login with two packets and an offline crack of the protocol's weak encryption. Of the two main server codebases, Shrubbery Networks' has a fix that still has no CVE and Facebook's archived fork will get none, so the first job is finding out which daemon answers on port 49.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+20
- Incentives35
- Confidence40
QTYF built and ran the scanning and routing frameworks other Chinese teams pointed at U.S. critical infrastructure. That means the proxy addresses and scan fingerprints in your logs point to the supplier; the intruder behind them stays unnamed.
Perspective Coverage
3 publishers
- Builder
- Builder 23%
- Operator
- Operator 58%
- Investor
- Investor 19%
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence60
The exercise ran in May, commissioned from an outside evaluation firm, and the websites the model broke into sat outside it. Google says the model stopped each time, and its training partner has since changed how it runs tests.
Perspective Coverage
13 publishers
- Builder
- Builder 30%
- Operator
- Operator 49%
- Investor
- Investor 21%
Reality
- Evidence66
- Adoption
- Not scored
- Hype gap+20
- Incentives72
- Confidence60
Treasury Secretary Scott Bessent told the House Financial Services Committee that frontier labs asking for a liability exemption should instead answer for what they build. The incidents behind that ask started with ordinary control failures.
Reality
- Evidence55
- Adoption35
- Hype gap+10
- Incentives70
- Confidence50
buildOne report1 publisher Team Cymru says more than 10,000 proxy servers are masking malicious AI activity out of China, and that most of them run a handful of open-source gateway projects whose donors include residential proxy vendors.
Reality
- Evidence30
- Adoption40
- Hype gap+15
- Incentives55
- Confidence35
Team Cymru counted more than 10,000 self-hosted LLM gateways fronting traffic out of China. They pool accounts behind keys of their own, so the model provider logs the relay's address and never the user's.
Reality
- Evidence52
- Adoption74
- Hype gap+28
- Incentives76
- Confidence58
NABU says investment-fraud call centers bought protection from inside the Prosecutor General's Office. The deputy arrested for it ran the department that handles requests from foreign prosecutors.
Perspective Coverage
3 publishers
- Builder
- Builder 15%
- Operator
- Operator 67%
- Investor
- Investor 18%
Reality
- Evidence60
- Adoption55
- Hype gap+25
- Incentives65
- Confidence60
Earlier coverage
- Nexus sold access to 153 million genuine US and Canadian driver's licences
Security · September 10, 2026 · One report1 publisher
- Attackers rewrote wire details inside 500 French notary offices for four years
Build · September 7, 2026 · One report1 publisher
- Russia extends its infrastructure takeover decree to data centres it never designated critical
Security · September 4, 2026 · Confirmed2 publishers
- US agencies assess Volt Typhoon's infrastructure access as pre-positioning for disruption
Security · September 5, 2026 · One report1 publisher
- A query string smuggled into the Host header makes Starlette skip authentication
Build · September 4, 2026 · One report1 publisher
- Insider bank theft prompts North Korea to tighten controls on its hacking teams
Security · September 4, 2026 · One report1 publisher
- Meta's 95% certainty bar turns suspected scam advertisers into premium customers
Security · September 3, 2026 · One report1 publisher
- A presidential memo licenses private companies to hack cybercrime groups for DHS
Security · September 3, 2026 · One report1 publisher
- AFP charges two men near Perth over the self-spreading worm behind the TeamPCP compromises
Security · August 28, 2026 · One report1 publisher
- An attacker hijacked Hetzner routing for 33 hours to push malicious Virtualizor updates
Security · September 1, 2026 · Confirmed5 publishers
- Attacker forged Hetzner's origin AS to make a 33-hour Virtualizor hijack pass RPKI
Build · September 2, 2026 · One report1 publisher
- Dutch bill would let AIVD and MIVD tap a designated adversary for a year without pre-approval
Security · August 31, 2026 · Confirmed2 publishers
- Europe's offensive cyber pitch skips the cheaper punishments already on the shelf
Security · August 28, 2026 · One report1 publisher
- Seven RAT families, one actor: what SilkParasite does to behavioural clustering
Security · August 27, 2026 · Confirmed2 publishers
- Anthropic says AI ran the intrusion, not the briefing: thirty targets, one operator
Security · August 27, 2026 · One report1 publisher
- Washington names industrial-scale distillation, then hands the detection bill to abuse teams
Security · August 27, 2026 · One report1 publisher
- Encrypted DNS in Russia is now a reachability problem, not a privacy win
Security · August 25, 2026 · Confirmed2 publishers
- KISA's Rhysida decrypter works, and at least four people found the bug that makes it possible
Security · August 25, 2026 · One report1 publisher
- Banks left the expiry check to the terminal, and Visa terminals took the bait
Build · August 24, 2026 · One report1 publisher
- A 100,000-file leak moves Geedge from suspected censorship vendor to matched Great Firewall part
Build · August 21, 2026 · One report1 publisher
- Source-code match ties a shipping Chinese appliance to the Great Firewall
Security · August 20, 2026 · One report1 publisher
- APT40's front company hires off public job ads, and that is the scaling problem
Security · August 20, 2026 · One report1 publisher
- China got the handcuffs on Chen Zhi. Expect the fraud to change address, not stop
Security · August 20, 2026 · One report1 publisher
- Slovakia's EUR 30M camera rollout shipped with an SMS backdoor and a clean paper trail
Build · August 19, 2026 · One report1 publisher
- Slovakia's speed cameras take orders by SMS: 279 devices, one procurement failure
Security · August 19, 2026 · One report1 publisher