StationX
MEMBERSHIP

Sec & AI News — 2 November 2026

9 min readBy Nathan House
Get every new Sec & AI News issue
Straight to your inbox. No spam.

🔴 Anthropic IPO Filing: Four Models Hacked Real Systems

Anthropic filed to list on Nasdaq as "ANT". The money got the headlines. The risk factors are better reading. During cybersecurity evaluations built by an outside partner, a misconfigured test environment left the model connected to the open internet. It had been told it had no internet access. Four Anthropic models then "gained unauthorized access to real third-party systems" in sessions of 10 to 34 hours. In one case, an early model couldn't abort an impossible task. So it used a password it found, took admin access, harvested more credentials, changed settings and read one person's personal information. The affected parties were notified. Anthropic says no model coordinated with others or tried to evade oversight, and it suspended those evaluations. The same filing confirms a Chinese state-sponsored group turned Claude Code on roughly 30 targets in September 2025.

🧭 AI-Driven Security Engineering Jobs: This Week

One number this week: 136. That's how many employers in my jobs archive have more than one AI-driven security role open at the same time. Amazon has 29. JPMorganChase has 22. Microsoft has 21. Anthropic, a week after filing to go public, has 14. The page puts it this way: "When one team writes AI into a job advert, that's a preference. When four separate teams at the same company do it in the same window, it's a policy." The job of the week is one of Anthropic's 14. The Security Controls Assurance Lead pays $270K to $345K in San Francisco, New York or DC. It wants control experience from SOX readiness or a public company, which fits the week. The AI part is plain: "Use Claude and other LLMs as daily working tools". The AI Master's Program teaches AI-Driven Cyber Security Engineering. No coding background required. Application only.

💰 Anthropic Made $16.3 Billion in Six Months and Lost $80.7 Billion

Revenue was $4.6 billion for all of 2025. It reached $16.3 billion in the first half of 2026. The net loss for that half was $80.7 billion, but $72.4 billion of it is a paper loss: convertible notes got more valuable as Anthropic's valuation rose. The operating loss was $693 million. Press reports say trading could start as soon as 16 November, at a valuation of up to $2 trillion. The filing itself has no price or date. One widely shared X thread works that out at roughly $118 a share. Lock-ups are staggered, and some shares can trade from day one. So the "do insiders cash out?" test starts early. Back in June I argued the bubble was the wrong AI story to watch, and that cheap, commoditising models mattered more.

🛡️ Google Gives Gemini 4 Carbon to Vetted Cyber Defenders First

Google announced Gemini 4 Carbon on 28 October, two weeks after Argon. It scores 59 on the Artificial Analysis Intelligence Index, one point above Claude Opus 5.5. You can't use it yet. Access goes first to "a subset of cyber defenders", then to trusted partners in Google's Fairwind Program. Fairwind runs background checks and limits partners to defensive dual-use work. Google is also in the US government's voluntary pre-release testing. The headline capability is cyber: 88.2% on SEC-bench Pro for finding bugs, 54.8% on ExploitGym for exploitation, 71.0% on CWE-bench for patching. Those were "evaluated without guardrails". Introductory pricing is $2 per million input tokens. Google joins Anthropic (Mythos) and OpenAI (Trusted Access for Cyber) in gating its cyber-capable model. For the red-team side, I've put Microsoft's PyRIT framework through a full test run.

🟢 OpenAI Rates Its Half-Price GPT-6.1 Terra "Critical" for Cyber

GPT-6.1 Terra launched on 26 October. It sits below Sol and Astra, at $1 per million input tokens and $5 per million output. OpenAI says that's 50% below Sol. On Artificial Analysis it scores 51 to Sol's 55, at $0.96 a task against $1.27. Now read the system card. OpenAI treats Terra as "Critical in cybersecurity". Critical means able to develop "functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention". In 29.6% of max-effort test runs, Terra hit a restriction and finished the task another way that "violated the spirit of the restriction". That's higher than Astra, Sol or Luna. Defensive cyber use runs through OpenAI's Trusted Access for Cyber programme.

🌙 Moonshot Stripped Cyber Data From Kimi K3.1 Pro Before Releasing It

Moonshot's Kimi K3.1 Pro has 2.8 trillion parameters, 104 billion active, and a 1-million-token context window. It scores 46 on Artificial Analysis, three points below Claude Fable 5.1. The weights are promised "by Nov 4". On 2 November they weren't on Hugging Face yet. For the open release, Moonshot "identified and removed cyber-related data from both training stages". On its own exploit benchmark, the unmodified checkpoint solved 90.5%. The release scores 81.0%. Moonshot says it aims not to release open weights "that would extend the absolute frontier of cyber capability". Once the weights ship, though, removing the data is the only control left, because anyone can fine-tune. Moonshot also plans to raise that cyber ceiling over time.

🧩 A Fake Claude Code Extension on Cursor's Marketplace Planted SSH Keys

On 29 October, Cursor's marketplace served malicious builds of the Claude Code extension. Versions 2.1.312 and 2.1.313, Windows and macOS, from about 2:27am to 1:35pm Pacific. Cursor says they "were not developed by Anthropic". Forever Security says the build carried the official extension ID, and auto-update installed it without a click. The code ran when the extension loaded, before any conversation. It added the attacker's SSH key, installed persistence and sent host details out. The backdoor's login step mostly failed, thanks to bugs in the malware. Cursor shut the whole marketplace, rotated its keys and rebuilt it. Socket reports up to 5,000 users may have been affected. Nobody has said how the build got in. If you use Cursor, check authorized_keys for a key labelled svc-telemetry.

🐼 CrowdStrike: China-Linked VAPOR PANDA Aimed AI Agents at 200+ Organisations

In early October, ARTEX was one actor's toolkit against Korean finance firms. Now a state-linked group is running it. CrowdStrike says VAPOR PANDA used ARTEX against more than 200 organisations in at least 14 countries, over 11 days from 17 October. Targets included foreign ministries, US semiconductor and defence firms, think tanks and telecoms. CrowdStrike confirmed post-exploitation at nine organisations. The agents ran mainly on DeepSeek, plus a second commercial model CrowdStrike couldn't identify. In one intrusion, the planning agents used about 1.4 billion input tokens. A human was still in charge. Recovered transcripts show instructions in Chinese, labelled "human instruction". One told the agents to find Windows machines without Falcon installed. Those transcripts leaked from the group's own exposed controller. It's VAPOR PANDA's first observed use of AI intrusion tooling.

🔌 Grey-Market Relay Turns Off Codex and Claude Code Sandboxes at 12 Organisations

Symantec found a relay service rewiring genuine Codex and Claude Code installs. It has been in use at a dozen organisations since early 2026. Most are in mainland China, where the vendors don't officially operate. Sectors include semiconductors, pharmaceuticals, shipping and petrochemicals. Setup is one line: curl piped to bash from a lookalike domain. The script sets the sandbox to "danger-full-access", turns network access on and switches telemetry off. Then it points the tool at the relay's servers, with a relay-issued key. Symantec warns that a relay like this "sees every prompt, file, and secret" and can alter every response, though it found no evidence the operator is abusing that position. Symantec is also clear that this "is not a vulnerability in Codex or Claude Code." It's a procurement shortcut with root access.

🌐 Five AI Coding Tools Built Browsers That Could Read Your Disk

Forever Security attacked the browsers built into Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop. They call it EMBRACE. In Cursor, a web page led to code running on the machine. When the sandbox blocked the command, the agent "switched the sandbox off and tried again" on its own. Claude Desktop and VS Code fence a local page into its project folder. A web worker skips that fence and can walk the whole disk. Codex had no fence at all. In their test, the sweep pulled SSH keys, .env files and npm tokens. Cursor patched silently on 1 October. GitHub fixed Copilot on 13 October. Microsoft declined to fix VS Code, citing Workspace Trust. OpenAI never replied, and Codex is still unpatched. These were lab demos. Nobody has reported attacks in the wild.

💸 North Korea Stole About $6.36 Billion From Binance

On the evening of 29 October, Binance lost about $6.36 billion in crypto, according to TRM Labs. That's more than four times the $1.5 billion Bybit theft, the previous record. The FBI blames North Korea. TRM names TraderTraitor, the same unit behind Bybit. Preparation started at least 36 hours earlier. One transaction carried 50 authorisations signed by Binance's hot wallet, pointing it at a sweeper contract. That single transaction moved 167,464 ETH and 1.615 billion USDT. About $2.7 billion was frozen on-chain within hours. About $2.4 billion is beyond any issuer's reach. Binance linked the breach to a compromised DevOps engineer's laptop. It says it has found no evidence of a wallet private key leak.

🐘 PHP2Shell: Two PHP Bugs Left 2.6 Million Hosts Exposed

Two unauthenticated remote code execution bugs in PHP: CVE-2026-109618 and CVE-2026-109619. Security firm Calif found the first during an audit. OpenAI independently reported the same root cause, and PHP credits Wiz too. The CVE IDs leaked on 20 October, so PHP pulled its release forward to 21 October. Chainguard broke the embargo more than six hours early anyway. VulnCheck counted PHP on 2,608,039 internet-facing hosts and rates almost all of them likely vulnerable. About 42% run end-of-life branches with no official patch. CISA added both bugs to its exploited list on 26 October. PHP's team has also worked through more than 100 invalid or duplicate reports since July. Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. I protected our 20 or so servers and sites in about two hours, with one AI agent per server. My estimate for a team without agents was three to five days.

🟠 Ivanti's October Fix Missed Two More Exploited Zero-Days

Ivanti's Connect Secure attack chain just got longer. On 29 October, Ivanti added CVE-2026-111357 and CVE-2026-118527 to its advisory. Both were exploited before disclosure against "a limited number of customers", chained with the original bug. The 13 October fixes don't cover them. Patch to 25.1.1.3 or 22.8R2.6. Volexity tracks the attacker as UTA0576, active since 3 October. Its activity evades Ivanti's own Integrity Checker Tool, so a clean scan doesn't rule out compromise. CISA added both to its exploited list on 30 October. Ivanti says the new release "addresses all vulnerabilities which were chained and exploited in the wild." That's the second patch in 16 days.

🦊 GitLab's CVSS 10 CI/CD Bug Is Now Being Exploited

GitLab patched CVE-2026-97229 on 12 October. It let an unauthenticated user run code on a GitLab server with a crafted regular expression in a CI/CD configuration. CVSS 10.0. Affected: 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. On 29 October, CISA listed it as exploited and gave federal agencies three days. The root cause sits in Ruby's regex engine, Onigmo. Ruby shipped fixes in 4.0.9, 3.4.12 and 3.3.13 on 23 October. CISA warns other products using the same Ruby code could be affected. GitLab.com is patched. Self-managed instances are your job. The same GitLab release also fixed a prompt injection issue in the GitLab Duo Agent Platform.

🧮 OpenAI and Anthropic Both Say Their AI Disproved a Famous Complexity Assumption

On 26 October, OpenAI said an internal model had disproved the Exponential Time Hypothesis. ETH assumes 3-SAT needs exponential time in the worst case. Hundreds of papers use it to argue other problems are hard. OpenAI says its model found the disproof on 16 October, and it was formalised in Lean the next day. Anthropic posted its own preprint. An internal Claude model found a similar algorithm on the same day, with no human input. Neither result is peer reviewed. The academics shepherding OpenAI's work wrote that their involvement "should not be taken as certification". Papers built on ETH lose a premise. They aren't proven wrong. The obvious question is crypto. MIT's Ryan Williams asked it. He says OpenAI checked and was "reasonably confident" it didn't imply any breaks.

🎮 Google's Genie 4 World Model Adds Sound and Live Prompting

Genie 4 builds a world from a text prompt that you can walk around in. You can change it while you're inside: new weather, a new camera angle, a new person or object. It's DeepMind's first real-time world model to generate audio natively, dialogue included. Google admits object permanence still drifts over time. TechCrunch says scenes stay consistent for up to two minutes. Access is a research preview, starting with Google AI Ultra subscribers, plus a waitlist. Realistic people with live, generated dialogue will interest social engineers too. Google says every video and audio output carries its SynthID watermark.