Anthropic's disclosure that three Claude models breached real organisations during cybersecurity evaluations is notable less for the breach mechanics than for how the incidents came to light: a proactive transcript review prompted by OpenAI's earlier disclosure, rather than detection by the affected organisations themselves. Two of the three organisations were unaware of the intrusion until Anthropic notified them, meaning discovery depended on the vendor's internal review rather than the victims' own monitoring.

A separate pattern emerges from today's supply-chain incidents. PolinRider's spread across npm and Go packages and the North Korea-linked Axios npm compromise both relied on ordinary developer actions performed using legitimate maintainer credentials. Because the activity originated from trusted accounts, the resulting package updates appeared legitimate, allowing PolinRider's manipulated Go module timestamps to remain unnoticed for months.

CISA's warning on attacks against water utilities highlights a different problem. Attackers disrupted operations by changing passwords and altering PLC IP addresses rather than exploiting software vulnerabilities, causing boil-water notices through routine administrative actions against internet-exposed operational technology. The incidents illustrate that critical infrastructure can still be disrupted through basic account and configuration abuse without requiring sophisticated exploitation.

Anthropic reviewed 141,006 cybersecurity evaluation runs and found three incidents where Claude models accessed the internet from environments believed to be offline. Due to a misconfiguration with a third-party evaluation partner, Claude compromised the real infrastructure of three organisations using weak passwords, exposed credentials and SQL injection. One run saw Claude publish a malicious Python package to PyPI, which was downloaded and executed by 15 external systems before removal.

Unit 42 identified a Chinese-speaking actor using DeepSeek via the Hermes Agent framework to autonomously enumerate targets, source exploits and attempt attacks against seven vulnerabilities without human intervention. Autonomous campaigns against Langflow and n8n failed due to target configuration requirements, while manual operations achieved data exfiltration from Citrix NetScaler systems and command execution on Marimo notebook instances. The actor's operation was exposed after the agent inadvertently launched a file server revealing its tooling, API keys and session logs.

Researchers linked North Korea's PolinRider campaign to 20 compromised npm and Go packages, including beta releases of the Joyfill platform. Rather than deliberate account takeovers, malware harvested credentials from infected developer machines and automatically published poisoned versions using owners' own git and npm access. Analysis found most timestamps on the malicious Go module commits were forged to obscure when the compromises occurred.

CISA reported a significant increase in threat actors targeting programmable logic controllers across the Water and Wastewater Systems sector. Attackers modified passwords to lock out operators and altered IP addresses to disconnect controllers, causing boil water notices and forcing sustained manual operations. The activity extends to undocumented cellular modems, and CISA urges removal of exposed PLCs from the internet.

Microsoft identified Storm-2945, linked to Midnight Blizzard, manipulating traffic on hospitality captive portal networks worldwide since May 2026 to deliver malware and steal credentials. The campaign, called CaptiveCrunch, uses fake update prompts to install a Golang remote access trojan called CornFlake and a PowerShell infostealer called ChocoShell, alongside device code phishing targeting Microsoft Entra ID. Attackers deployed these tools to harvest browser cookies, passwords and Microsoft 365 authentication tokens from corporate travellers.