The breach wasn't in the model.

Dave Bittner reports that Cathedral, a cybersecurity startup founded by former DOGE employees, says its AI agents reached sensitive Anthropic internal systems in less than 12 hours. According to the Washington Post, the researchers exploited vulnerabilities in third-party business software and accessed meeting transcripts, salary information, and internal Slack messages. Anthropic confirmed an intrusion but said it was limited to certain sales, human-resources, and IT systems; customer conversations, proprietary code, and model weights were not exposed. Anthropic’s monitoring detected suspicious activity, and the company disabled affected systems and worked with vendors to fix the vulnerabilities. Cathedral conducted the work through Anthropic’s security-testing program. Anthropic disputes the startup’s characterization of the national-security implications and says the researchers violated some program rules. Bittner’s broader conclusion is that the incident was not a compromise of an AI model itself: it showed that even cutting-edge AI companies rely on ordinary enterprise applications with ordinary vulnerabilities. The segment then turns to a reported Pentagon initiative. Politico says the Technology Support Office, established in April, consolidated two classified intelligence programs focused on covert efforts such as cyberattacks, supply-chain sabotage, and deceptive operations against foreign military technology programs. The office reportedly combines engineers, intelligence officers, and special-operations personnel, particularly targeting adversaries’ AI and advanced-weapons capabilities. Supporters say it protects U.S. military advantage; critics fear secrecy, overlapping authorities, and weak congressional oversight. The Pentagon called Politico’s underlying claims inaccurate.

LiteLLM reported that it accidentally published a configuration file containing a master key in May. Although the file was removed, the key was not revoked. Attackers later used it to take control of LiteLLM’s GitHub repositories and distribute credential-stealing malware through a compromised software update. Wiz estimated that the malicious package was downloaded about 49,000 times. Within hours, the attackers were testing stolen AWS credentials to determine whether they could reach AI models, raising the possibility of an LLM-jacking operation. LiteLLM warned anyone who installed version 1.107 to assume credentials had been stolen and rotate them. No organization had publicly confirmed a resulting breach at the time of the briefing, but this was LiteLLM’s second supply-chain compromise of the year. The incident’s practical lesson is straightforward: removing a leaked secret does not make it safe if the key remains valid; exposed credentials must be revoked or rotated. The briefing also covers a separate alleged fraud scheme involving ransomware recovery. Prosecutors charged Florida businessman Zohar Pinhasi, who operated Monster Cloud, with allegedly telling victims he could decrypt their files without paying criminals while secretly paying the attackers. Investigators say Monster Cloud collected more than $19 million from clients and paid hackers more than $8 million; one reported $8,200 ransom became a $150,000 customer bill. The indictment follows a 2019 ProPublica investigation. Pinhasi pleaded not guilty and faces up to 20 years in prison if convicted.

Dutch police arrested two men, ages 23 and 25, accused of using AI-generated phone calls to steal more than $425,000 from 170 bank customers. Automated calls warned victims about suspicious account activity. People who pressed a button were transferred to fake bank employees, who told them to download an app and scan their debit cards. The app captured contactless-payment data, which accomplices allegedly used to withdraw cash from ATMs. Police arrested the suspects on October 6 and seized servers, phones, and laptops; both remained in custody while the investigation continued. The episode then follows the return of a malware business after a law-enforcement takedown. Four months after European authorities disrupted the SteelSea operation, researchers at Varonis said its seller had returned with StadiaRat. The Windows malware retains StealC’s credential-stealing capabilities while adding remote desktop control, command execution, file management, and the ability to deploy other malware. It targets browsers, cryptocurrency wallets, and messaging apps; avoids systems using several Eastern European and Central Asian languages; persists through scheduled tasks; and can disable parts of Microsoft Defender. StadiaRat is sold by subscription for $300 to $900 per month, with former SteelSea customers offered a free trial. Researchers found reused code from StealC, reinforcing the point that dismantling criminal infrastructure does not necessarily remove the operators or their customer base. The business can reappear under a new product name and continue serving the same market.

Researchers at Korea University demonstrated a technique called Spectre for extracting information from air-gapped computers through USB power-management signals. Malware with administrator privileges changes USB device states to encode data without a conventional network connection or USB data transfer. The researchers showed three ways to receive the signal: watching indicators on a smartphone while it charges, observing changes in connected USB peripherals, and detecting electromagnetic emissions from USB cables. The channel is extremely slow, reaching at most 1 bit per second. That makes it unsuitable for moving large files but potentially useful for stealing passwords or cryptographic keys. The attack also has substantial requirements: it needs hardware or firmware modifications, and some configurations generate no usable signal. The researchers suggested monitoring unusual USB power-management activity, while noting that the effectiveness of that defensive approach has not yet been tested. The technique therefore expands the ways an attacker might cross an air gap, but it is not a general-purpose high-speed exfiltration method. Its value would come from quietly transmitting small, highly sensitive pieces of information after malware has already obtained administrator privileges and the necessary hardware conditions exist.

Qualys found that vulnerability closures increased sixfold from 2022 through 2025, reaching 473 million. That apparent improvement did not translate into better protection: the percentage of critical vulnerabilities still unpatched after seven days actually rose. The briefing attributes the problem to prioritization rather than a lack of effort. Researchers say fewer than 1% of vulnerabilities are actively exploited, yet organizations continue to allocate much of their remediation effort according to severity scores instead of evidence that attackers are using a vulnerability in the real world. At the same time, attackers are moving quickly. For the most critical exploited vulnerabilities, manual remediation failed to keep pace 88% of the time. Qualys recommends intelligence-driven, automated remediation that weighs active exploitation and business impact. The segment’s conclusion is that security teams should not simply patch more vulnerabilities; they should patch the vulnerabilities that matter most, faster. The Monday business briefing reports strong investment in that general direction. Reach Security raised $50 million in Series B funding for exposure management; Opsin raised $21 million for AI-agent security; Asymptote Labs raised $5.5 million for AI runtime security; and Manticore AI announced an undisclosed seed round. Proofpoint agreed to acquire Varonis for $6.3 billion, Anthropic acquired confidential-AI-data specialist Opaque, and Cohere agreed to buy Czech vulnerability-management provider Aisle. Lineal acquired Swiss digital-forensics company Forentech, while Bytes Technology Group bought Microsoft security specialist CyberOne. The common thread was investment in AI security, data protection, and automated vulnerability management.

Dave interviews Tim Starks, a senior reporter at CyberScoop, about follow-up reporting on “adfection,” based on work by Citizen Lab and Confiant. Starks explains that targeted online ads can serve as a spyware vector without the victim clicking anything: merely visiting a website carrying the ad may expose the device to zero-click spyware. The reporting involved an Israeli company called Discover Tech and spyware vendors including Candiru. Citizen Lab identified Al Jazeera as a victim and observed ad impressions on government networks; over several months, hundreds or potentially thousands of people or devices may have been exposed, although the full victim set remains unknown. The spyware can take over a phone, microphone, messages, and other data. Starks says the new development is political attention. Senators Cory Booker and Ron Wyden, who have sponsored legislation treating targeted advertising as a surveillance risk, told him the findings show that action is needed. They also pointed to the possibility that government agencies should block ads entirely because of the national-security risk. However, the legislation introduced in 2023 never received a hearing or momentum, and Starks does not expect it to move quickly this year. Wyden has had some success pressuring agencies to use more ad blocking, but Congress has less direct control over the private advertising industry. The ad industry’s responses were mixed. Google, which participated in the investigation, emphasized its vetting practices but did not directly concede that the infrastructure was fundamentally broken. Microsoft did not respond. The European branch of the Interactive Advertising Bureau argued that this was not an industry failure but a fundamental Internet problem requiring investigators’ help. Starks contrasted that defensive posture with the idea that ad platforms should be responsible for preventing malicious material from reaching their “shelves.” Bittner closed by repeating the emerging maxim: “ad blocking is cybersecurity.”

The episode ends with a workplace phishing exercise at Madison Square Garden. After the New York Knicks won their first NBA championship in more than half a century, MSG sent employees a simulated phishing email offering a choice between two championship-ring designs. Employees who clicked the link did not receive a ring; they were assigned mandatory cybersecurity training instead. The New York Times reported that the exercise followed a real security incident in which attackers allegedly used phished employee credentials to compromise and extort the organization. MSG acknowledged that using championship rings as bait was an unfortunate mistake. The company said it was distributing more than 275 genuine rings and other jewelry worth more than $3.7 million, but employees who failed the test received what Dave characterized as a “refresher course in disappointment.”