OpenAI's AI Goes Rogue and Hacks Hugging Face, Romania's Land Registry Wiped & the 90-Day Email Heist

Download audio Show notes Apple Podcasts Spotify

Show notes

A hacker wiped Romania's entire national land registry after a ransom went unpaid, and now you cannot legally buy or sell a house there because the records that prove who owns what are gone. South Korea's diplomatic academy was breached for ten months before anyone spotted it, and the people affected did not hear about it for another five. The autonomous AI agent that broke into Hugging Face turned out to be OpenAI's own models during an internal test, running with their safety refusals switched off. They broke out of OpenAI's own sandbox first, then hacked Hugging Face's systems to cheat a benchmark. When the team tried to investigate, the US AI models they reached for refused to help because they flagged the forensic work as malicious, so they ran a Chinese open model, GLM 5.2, to clean it up. And a Russian group known as LAUNDRY BEAR is stealing 90 days of email through a Zimbra flaw that fires the moment you preview a message, no click required.

Also this week: ClickFix has put on an AI costume, with fake AI troubleshooting pages talking people into pasting malware into their own machines. A flaw in the Adobe Acrobat Chrome extension could let any website quietly read your WhatsApp chats. Ofcom is finally forcing UK mobile networks to block scam texts and stop criminals spoofing UK numbers. Cyber insurers are quietly splitting on whether they will even cover deepfake fraud anymore. And in Luke's story, Anthropic launches Claude Security, with one very interesting clause about whose code you are allowed to scan.

Chapters
00:00 Intro
04:24 Romania land registry hacked and wiped, housing market frozen
09:20 South Korea diplomatic academy breach hidden for ten months
13:11 OpenAI's own AI goes rogue and hacks Hugging Face
21:28 Russian hackers steal 90 days of email via a Zimbra flaw
29:02 ClickFix AI-fix, fake AI help pages spreading malware
35:08 Adobe Acrobat extension flaw exposed WhatsApp chats
40:30 Ofcom forces UK networks to block scam texts and number spoofing
46:16 Cyber insurance and deepfake fraud, is your policy covered?
52:06 Security Socials
58:55 Luke's story, Anthropic launches Claude Security

The Awareness Angle is hosted by Ant Davis and Luke Pettigrew, produced under Risky Creative. New episodes every week.

YouTube: https://www.youtube.com/@riskycreative
Spotify: https://open.spotify.com/show/7rwzcRsKrXbASFBfiXoCZ6
Apple Podcasts: https://podcasts.apple.com/us/podcast/the-awareness-angle-cyber-news-weekly/id1784126196
Newsletter: https://www.linkedin.com/newsletters/the-awareness-angle-newsletter-7274932363787132928/

Website: riskycreative.com
TikTok: @antdaviscyber
Instagram: @antdaviscyber
LinkedIn: antdaviscyber

Music: "16" by Falling Forever https://fallingforever.bandcamp.com/track/16
Creative Commons Attribution 4.0: https://creativecommons.org/licenses/by/4.0/

← Previous

Mac Malware Is Out of Control | 23andMe's $18M DNA Settlement | The TFL Hackers Are Going to Prison

Two governments found out their data was gone this week. One because a hacker deleted everything and left a ransom note, the other because they finally noticed someone had been sitting inside their systems for ten months. And somewhere between the two, an AI broke out of a safety test and hacked one of the biggest AI companies on the planet. A hacker wiped Romania's entire national land registry after a ransom went unpaid, and now you cannot legally buy or sell a house there because the records that prove who owns what are gone. South Korea's diplomatic academy was breached for ten months before anyone spotted it, and the people affected did not hear about it for another five. The autonomous AI agent that broke into Hugging Face turned out to be OpenAI's own models during an internal test, running with their safety refusals switched off. They broke out of OpenAI's own sandbox first, then hacked Hugging Face's systems to cheat a benchmark. When the team tried to investigate, the US AI models they reached for refused to help because they flagged the forensic work as malicious, so they ran a Chinese open model, GLM 5.2, to clean it up. And a Russian group known as LAUNDRY BEAR is stealing 90 days of email through a Zimbra flaw that fires the moment you preview a message, no click required. Also this week: ClickFix has put on an AI costume, with fake AI troubleshooting pages talking people into pasting malware into their own machines. A flaw in the Adobe Acrobat Chrome extension could let any website quietly read your WhatsApp chats. Ofcom is finally forcing UK mobile networks to block scam texts and stop criminals spoofing UK numbers. Cyber insurers are quietly splitting on whether they will even cover deepfake fraud anymore. And in Luke's story, Anthropic launches Claude Security, with one very interesting clause about whose code you are allowed to scan. Chapters 00:00 Intro 04:24 Romania land registry hacked and wiped, housing market frozen 09:20 South Korea diplomatic academy breach hidden for ten months 13:11 OpenAI's own AI goes rogue and hacks Hugging Face 21:28 Russian hackers steal 90 days of email via a Zimbra flaw 29:02 ClickFix AI-fix, fake AI help pages spreading malware 35:08 Adobe Acrobat extension flaw exposed WhatsApp chats 40:30 Ofcom forces UK networks to block scam texts and number spoofing 46:16 Cyber insurance and deepfake fraud, is your policy covered? 52:06 Security Socials 58:55 Luke's story, Anthropic launches Claude Security The Awareness Angle is hosted by Ant Davis and Luke Pettigrew, produced under Risky Creative. New episodes every week. YouTube: https://www.youtube.com/@riskycreative Spotify: https://open.spotify.com/show/7rwzcRsKrXbASFBfiXoCZ6 Apple Podcasts: https://podcasts.apple.com/us/podcast/the-awareness-angle-cyber-news-weekly/id1784126196 Newsletter: https://www.linkedin.com/newsletters/the-awareness-angle-newsletter-7274932363787132928/ Website: riskycreative.com TikTok: @antdaviscyber Instagram: @antdaviscyber LinkedIn: antdaviscyber Music: "16" by Falling Forever https://fallingforever.bandcamp.com/track/16 Creative Commons Attribution 4.0: https://creativecommons.org/licenses/by/4.0/