In this episode of the podcast, host Paul Roberts interviews Nishawn Smagh of the firm GreyNoise Intelligence about the findings of their State of the Edge report, an analysis of GreyNoise data on risks stemming from compromised edge devices such as broadband routers, VPN gateways, smart home devices and more. Shawn and Paul talk about how attackers are turning edge devices into their favorite entry point, and strategies for organizations to counter the growing risk of compromised edge devices.
The post Edge Devices Are Your Cyber Underbelly. Here’s Why. appeared first on The Security Ledger with Paul F. Roberts.
On June 12, the Trump administration directed Anthropic to restrict access to Fable 5 and Mythos 5, its two most capable models, exclusively to US citizens. Because verifying every user’s nationality in real time isn’t practically possible, Anthropic’s only option was to shut both models down for everyone. Allies included. No warning.
The U.S. government ordered Anthropic to limit access to its Fable 5 and Mythos 5 AI models to U.S. citizens after a jailbreak was discovered.
That includes Five Eyes partners, Australia, the UK, Canada, and New Zealand, and it blocked the UK AI Security Institute, the main international body for testing frontier AI models, from accessing systems it was actively evaluating.
Then came the Senate testimony. According to a report by The Economist citing a Senate Intelligence Committee hearing, Anthropic’s Mythos model had penetrated nearly all classified systems managed by the NSA and US Cyber Command. Senator Mark Warner stated on June 11 that General Joshua Rudd, who leads both agencies, told him directly that Mythos had done it, and not in weeks.
“Encryption was a potent technology, but narrow in its application. AI is far more powerful and versatile. On June 11th Mark Warner, the vice-chair of the Senate Intelligence Committee, said that General Joshua Rudd, who leads the National Security Agency and the Pentagon’s Cyber Command, had told him that Mythos “broke into almost all of our classified systems, not in weeks, but in hours”.”reported The Economist.
“Advanced AI differs from encryption in another respect, too. Whereas cryptography eventually became widely available abroad, America today enjoys a clear lead in AI. China, hobbled by American chip controls, is probably about a year behind. That advantage could become unassailable if Anthropic or other American labs crack recursive self-improvement (RSI), whereby models write better versions of themselves and thereby accelerate progress. Many insiders think that is entirely possible.”
These are unverified claims reported through Senate testimony, not independently confirmed facts, and the story is still developing.
Whether or not the NSA account holds up, Mythos is real and its capabilities aren’t in dispute. Anthropic refused to release it publicly, instead giving access to roughly 200 selected partners under an initiative called Project Glasswing. Amazon, Apple, Google, Microsoft, Nvidia, JPMorgan, and the Linux Foundation are among the participants.
Anthropic says Mythos Preview has already uncovered thousands of vulnerabilities, including a 27-year-old flaw in OpenBSD, one of the most security-hardened operating systems ever developed. That’s more than a marketing claim—it is a strong indication of the model’s real-world capability to identify complex and previously undiscovered security weaknesses.”
For people who’d been using Fable 5 before the ban, the loss was tangible. Unlike previous models that required constant hand-holding, Fable 5 ran complex coding tasks for up to 20 minutes autonomously, caught its own logic errors, wrote its own tests, and delivered working software on the first run. It sat above the Opus line in Anthropic’s lineup and used the same underlying architecture as Mythos, with additional safeguards added for general use. It came with a mandatory 30-day data retention policy and premium pricing, and there was a planned shift to usage-based credits set for June 23. Fable didn’t survive long enough to see it.
The broader context makes the shutdown harder to read as a clean security decision. For months, the Trump administration had been dismantling AI regulations from the previous administration, approved advanced chip sales to China, and on June 2 issued an executive order asking AI labs to voluntarily share new models with the government before public release.
Then, ten days later, access was cut without notice, and the government body responsible for evaluating dangerous AI capabilities was ordered to stop publishing its reports. That’s a sharp reversal in a very short window. Europe is already paying attention, with concern growing that the same scenario could play out with Azure, AWS, Google, and every other US-based cloud provider.
The debate sparked by this decision has divided the cybersecurity community. On one hand, restricting access to offensive AI capabilities reduces the risk that cybercriminals, ransomware groups, or state actors could automate highly dangerous activities. On the other hand, the same constraints can hinder defenders, red teams, and security researchers who rely on such tools for testing and analysis.
Advanced AI models and geopolitics add another layer of complexity. Safety guardrails are not perfect: researchers have repeatedly shown that even robust systems can be bypassed through advanced prompt engineering. Security is therefore not static but an ongoing cycle between control mechanisms and attempts to circumvent them.
Beyond the technical dimension, the geopolitical aspect is even more significant. Project Glasswing illustrates how access to advanced AI-driven cybersecurity capabilities is becoming a strategic asset. Early participants were mainly US-based companies such as Microsoft, Google, Apple, Cisco, CrowdStrike, and NVIDIA, with European and other international actors included only later.
For Europe, this raises a critical issue. While it has developed strong regulatory frameworks through the AI Act, NIS2, and the Cyber Resilience Act, the most advanced AI systems are still built elsewhere. The continent regulates AI but does not yet control comparable frontier models within its own ecosystem.
Even participation by ENISA and other European bodies does not fully resolve dependency on external providers. The concern is no longer only data sovereignty, but also analytical sovereignty: advanced AI systems generate highly sensitive intelligence about critical infrastructure vulnerabilities.
For countries like Italy, this creates practical questions about where such data is stored, who can access it, and how it might be used. Since providers like Anthropic also collaborate with US government entities on national security issues, governance of this information becomes even more sensitive.
Ultimately, AI is reshaping cybersecurity from a human-driven discipline into a model-driven one. Competitive advantage will depend less on discovering vulnerabilities and more on managing them at scale. Those who master these systems early will gain a lasting strategic edge, while others risk increasing dependency on external technologies that are rapidly becoming central to global digital security.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, NSA)
Wired writes (alternate source):
Security researchers at Google on Tuesday released a report describing what they’re calling “Coruna,” a highly sophisticated iPhone hacking toolkit that includes five complete hacking techniques capable of bypassing all the defenses of an iPhone to silently install malware on a device when it visits a website containing the exploitation code. In total, Coruna takes advantage of 23 distinct vulnerabilities in iOS, a rare collection of hacking components that suggests it was created by a well-resourced, likely state-sponsored group of hackers...
The post Possible US Government iPhone Hacking Tool Leaked appeared first on Security Boulevard.
Sen. Ron Wyden is warning us of an abuse of Section 702:
Wyden took to the Senate floor to deliver a lengthy speech, ostensibly about the since approved (with support of many Democrats) nomination of Joshua Rudd to lead the NSA. Wyden was protesting that nomination, but in the context of Rudd being unwilling to agree to basic constitutional limitations on NSA surveillance. But that’s just a jumping off point ahead of Section 702’s upcoming reauthorization deadline. Buried in the speech is a passage that should set off every alarm bell:
There’s another example of secret law related to Section 702, one that directly affects the privacy rights of Americans. For years, I have asked various administrations to declassify this matter. Thus far they have all refused, although I am still waiting for a response from DNI Gabbard. I strongly believe that this matter can and should be declassified and that Congress needs to debate it openly before Section 702 is reauthorized. In fact, ...
The post Sen. Wyden Warns of Another Section 702 Abuse appeared first on Security Boulevard.
Em uma onda crescente de ameaças cibernéticas sofisticadas contra o setor industrial, os ataques de ransomware aumentaram 46% do quarto trimestre de 2024 para o primeiro trimestre de 2025, de acordo com o novo Relatório de Ameaças à Segurança Cibernética de 2025 da Honeywell (Nasdaq: HON). A pesquisa também constatou que tanto malware quanto ransomware aumentaram significativamente nesse período, incluindo um aumento de 3.000% no uso de um trojan projetado para roubar credenciais de operadores industriais.
“Operações industriais em setores críticos como energia e manufatura devem evitar, tanto quanto possível, paradas não planejadas – e é exatamente por isso que são alvos tão atraentes para ransomware”, disse Paul Smith, diretor de Engenharia de Cibersegurança da Honeywell Operational Technology (OT), autor do relatório. “Esses invasores estão evoluindo rapidamente, utilizando kits de ransomware como serviço para comprometer as operações industriais que mantêm nossa economia em movimento.”
A Agência de Segurança Cibernética e de Infraestrutura (CISA) dos Estados Unidos define incidentes como substanciais se eles permitirem acesso não autorizado, levando a paradas ou prejuízos operacionais significativos. Relatórios do setor mostram que paradas não planejadas, causadas por ataques de segurança cibernética e outros problemas, como falhas de equipamentos, custam às empresas da Fortune 500 aproximadamente US$ 1,5 trilhão anualmente, o que representa 11% de sua receita.
Para desenvolver o relatório, os pesquisadores da Honeywell analisaram mais de 250 bilhões de logs, 79 milhões de arquivos e 4.600 eventos de incidentes bloqueados em toda a base global de instalações da empresa, descobrindo:
O relatório expandiu sua análise para incluir ameaças transmitidas por meio de hardware plug-in adicional – conhecido como Dispositivo de Interface Humana (HID) – incluindo mouses, cabos de carregamento para dispositivos móveis, laptops e outros periféricos frequentemente usados na atualização ou aplicação de patches de software para sistemas locais.
“Com ameaças cada vez mais significativas e regulamentações de relatórios da SEC atualizadas exigindo a divulgação de incidentes materiais de segurança cibernética, os operadores industriais devem agir de forma decisiva para mitigar o tempo de inatividade não planejado e os riscos dispendiosos, incluindo aqueles relacionados à segurança”, disse Smith. “Aproveitar a arquitetura Zero Trust e a IA para análise de segurança pode acelerar a detecção e permitir uma tomada de decisão mais inteligente e uma defesa proativa em um cenário digital cada vez mais complexo.”
Entrar