Artificial intelligence platforms featured prominently in operational security incidents. Attackers weaponised Claude Code to generate exploits and exfiltrate more than 150GB of data from Mexican government systems. Separately, the Pentagon designated Anthropic a national security supply chain risk and directed federal agencies to phase out its Claude technology.

AI agent infrastructure also faced direct exploitation through implementation flaws. The ClawJacked vulnerability enabled malicious websites to brute-force authentication on locally running OpenClaw instances via WebSocket connections and assume full control. The issue was rooted in automatic localhost trust and missing rate limits for password attempts.

Large-scale data exposure incidents affected both retail and public sector entities. Canadian Tire disclosed that unauthorised access to its e-commerce database compromised personal data linked to more than 38 million accounts. In South Korea, the National Tax Service published a seized Ledger wallet recovery phrase, allowing attackers to transfer approximately $4.8 million in cryptocurrency.

Software supply chain and client-side risks also remained visible across widely deployed components. The minimatch npm package patched three high-severity ReDoS vulnerabilities, tracked as CVE-2026-27904, CVE-2026-27903 and CVE-2026-26996, affecting glob pattern processing in Node.js. Meanwhile, the QuickLens Chrome extension was removed after a malicious update introduced crypto-stealing functionality and ClickFix malware delivery mechanisms.

The US Department of Defense has designated AI firm Anthropic a national security supply chain risk after negotiations broke down over the military use of its Claude model. The dispute centres on Anthropic’s refusal to permit applications involving mass domestic surveillance and fully autonomous weapons, positions the Pentagon rejects as mischaracterisations of its intent. The move follows a directive to phase out Anthropic technology across federal agencies, intensifying debate within the tech sector over AI safeguards in defence contracts.

Canadian retailer Canadian Tire has confirmed that more than 38 million customer accounts were affected by an October 2025 breach involving unauthorised access to an e-commerce database. Exposed data included names, email addresses, dates of birth, encrypted passwords and, in some cases, partial credit card details, with fewer than 150,000 accounts containing date of birth information. Data published on Have I Been Pwned indicates the compromised dataset may include additional contact details such as addresses and phone numbers, totalling roughly 42 million records.

An investigation into the operator of the Kimwolf botnet has linked the alias “Dort” to a Canadian individual with a history in gaming-related exploits and cybercrime forums. Analysis of reused email addresses, forum accounts and domain registrations connects the persona to past activity involving CAPTCHA bypass tools, disposable email services and alleged account fraud. The report follows a series of retaliatory DDoS, doxing and swatting incidents targeting a security researcher after disclosure efforts disrupted the botnet’s spread; the individual identified denies current involvement and claims impersonation.

South Korea’s National Tax Service inadvertently exposed the mnemonic recovery phrase of a seized Ledger hardware wallet in a public press release, enabling an unknown party to transfer approximately $4.8 million in cryptocurrency. The wallet had been confiscated during raids targeting alleged tax evaders, with total digital assets valued at around $5.6 million. Blockchain data shows the attacker first funded the wallet with a small amount of Ethereum to cover transaction fees before moving 4 million PRTG tokens to a separate address.

Researchers have disclosed a high-severity vulnerability in the open-source AI agent OpenClaw that allowed any website visited by a user to take full control of a locally running instance. The flaw stemmed from the gateway’s trust of localhost WebSocket connections, automatic device approval and the absence of rate limiting for password attempts, enabling brute-force access and agent takeover without user interaction. The OpenClaw team released a fix within 24 hours, addressing the authentication and connection handling weaknesses.

The Chrome extension “QuickLens – Search Screen with Google Lens” was removed from the Web Store after a malicious update introduced crypto-stealing and ClickFix malware functionality. Following a reported ownership change, version 5.8 added new permissions, stripped browser security headers and fetched remote scripts from a command-and-control server, enabling fake Google Update prompts and credential harvesting across visited sites. Researchers found the extension targeted multiple cryptocurrency wallets, scraped sensitive browser data and delivered additional payloads before Google disabled it for users.

The widely used npm package minimatch has patched three high-severity vulnerabilities that could trigger Regular Expression Denial of Service (ReDoS) and block the Node.js event loop. The flaws, tracked as CVE-2026-27904, CVE-2026-27903 and CVE-2026-26996, stem from inefficient handling of nested extglobs, multiple globstars and repeated wildcards, allowing crafted patterns to cause catastrophic backtracking or combinatorial processing delays. Given minimatch’s extensive use across build tools, CLIs and package managers, the issues have broad potential impact across the JavaScript ecosystem.