\n<\/p>\n
As researchers and<\/span> practitioners debate the impact that new AI models will have on cybersecurity, Mozilla said on Tuesday it used early access to Anthropic’s Mythos Preview to find and fix 271 vulnerabilities<\/a> in its new Firefox 150 browser release. Meanwhile, researchers identified a group of moderately successful North Korean hackers using AI for everything<\/a> from vibe coding malware to creating fake company websites\u2014stealing up to $12 million in three months.<\/p>\n Researchers have finally cracked disruptive malware known as Fast16 that predates Stuxnet<\/a> and may have been used to target Iran\u2019s nuclear program. It was created in 2005 and was likely deployed by the US or an ally.<\/p>\n Meta is being sued by the Consumer Federation of America<\/a>, a nonprofit, over scam ads on Facebook and Instagram and allegedly misleading consumers about the company\u2019s efforts to combat them. A United States surveillance program that lets the FBI view Americans\u2019 communications without a warrant is up for renewal, but lawmakers are deadlocked on next steps. A new bill aims to address<\/a> mounting lawmaker concerns, but lacks substance.<\/p>\n And if you\u2019re looking for a deep dive, WIRED investigated the yearslong feud<\/a> behind the prominent privacy and security conscious mobile operating system GrapheneOS. Plus we looked at the strange tale of how China spied on US figure skater Alysa Liu<\/a> and her dad.<\/p>\n And there\u2019s more. Each week, we round up the security and privacy news we didn\u2019t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.<\/p>\n Anthropic\u2019s Mythos Preview<\/a> AI model has been touted as a dangerously capable tool for finding security vulnerabilities in software and networks, so powerful that its creator has carefully restricted its release. But one group of amateur sleuths on Discord found their own, relatively simple ways\u2014no AI hacking required\u2014to gain unauthorized access to a coveted digital prize: Mythos itself.<\/p>\n Despite Anthropic\u2019s efforts to control who can use Mythos Preview, a group of Discord users gained access to the tool through some straightforward relatively detective work: They examined data from a recent breach of Mercor<\/a>, an AI training startup that works with developers, and \u201cmade an educated guess about the model\u2019s online location based on knowledge about the format Anthropic has used for other models\u201d\u2014a phrase that many observers have speculated refers to a web URL\u2014according to Bloomberg, which broke the story.<\/p>\n The person also reportedly took advantage of permissions they already possessed to access other Anthropic models, thanks to their work for an Anthropic contracting firm. As a result of their probing, however, they allegedly gained access to not only Mythos but other unreleased Anthropic AI models, too. Thankfully, according to Bloomberg, the group that accessed Mythos has only used it so far to build simple websites\u2014a decision designed to prevent its detection by Anthropic\u2014rather than hack the planet.<\/p>\n Security researchers have long warned that the telecom protocols known as Signaling System 7, or SS7, which govern how phone networks connect to one another and route calls and texts, are vulnerable to abuse that would allow surreptitious surveillance. This week researchers at the digital rights organization Citizen Lab revealed that at least two for-profit surveillance vendors have actually used those vulnerabilities\u2014or similar ones in the next generation of telecom protocols\u2014to spy on real victims. Citizen Lab found that two surveillance firms had essentially acted as rogue phone carriers, exploiting access to three small telecom firms\u2014Israeli carrier 019Mobile, British cell provider Tango Mobile, and Airtel Jersey, based on the island of Jersey in the English Channel\u2014to track the location of targets\u2019 phones. Citizen Lab\u2019s researchers say that \u201chigh-profile\u201d people were tracked by the two surveillance firms, though it declined to name either the firms or their targets. Researchers warn, too, that the two companies they discovered abusing the protocols are likely not alone, and that the vulnerability of global telecom protocols remains a very real vector for phone spying worldwide.<\/p>\n In a sign of a growing\u2014if belated\u2014crackdown by US law enforcement on the sprawling criminal industry of human-trafficking-fueled scam compounds<\/a> across Southeast Asia, the Department of Justice this week announced charges against two Chinese men for allegedly helping to manage a scam compound in Myanmar and seeking to open a second compound in Cambodia. Jiang Wen Jie and Huang Xingshan were both arrested in Thailand earlier this year on immigration charges, according to prosecutors, and now face charges for allegedly running a vast scamming operation that lured human trafficking victims to their compound with fake job offers and then forced them to scam victims, including Americans, for millions of dollars with cryptocurrency fraudulent investments. The DOJ says it also \u201crestrained\u201d $700 million in funds belonging to the operation\u2014essentially freezing the funds in preparation for seizure\u2014and also seized a channel on the messaging app Telegram prosecutors say was used to bait and enslave trafficking victims. The Justice Department\u2019s statement claims that Huang personally took part in the physical punishment of workers in one compound, and that Jiang at one point oversaw the theft of $3 million from a single US scam victim.<\/p>\n Three scientific research institutions have been found selling British citizens\u2019 health information on Alibaba, the British government and the nonprofit UK Biobank revealed this week<\/a>. Over the last two decades, more than 500,000 people have shared their health data\u2014including medical images, genetic information, and health care records\u2014with UK Biobank, which allows scientists around the world to access the information to conduct medical research. However, the charity said the data leak involved a \u201cbreach of the contract\u201d signed by three organizations, with one of the datasets for sale believed to have included data on all half-million research subjects. It did not detail the full types of data that were listed for sale but said it has suspended the Biobank accounts of those allegedly selling the information. The ads for the data have also been removed.<\/p>\n Earlier this month, 404 Media<\/a> reported that the FBI was able to get copies of Signal<\/a> messages from a defendant\u2019s iPhone as the content of the messages, which are encrypted within Signal, were saved in an iOS push notification database. In this instance, the copies of the messages were still accessible even though Signal had been removed from the phone\u2014though the issue affected all apps that send push notifications.<\/p>\n This week, in response to the issue, Apple released an iOS and iPadOS security update to fix the flaw. \u201cNotifications marked for deletion could be unexpectedly retained on the device,\u201d Apple\u2019s security update for iOS 26.4.2 says<\/a>. \u201cA logging issue was addressed with improved data redaction.\u201d<\/p>\n