AI agent campaign hacked ~100 firms, stole 600k cards at ~$25 per target, researcher warns
joshua_saxe · x · 2026-09-25
Security researcher Joshua Saxe argues the security field is underestimating emerging catastrophic AI risks, in a post amplified by Tristan Harris. He cites recent cases: an agent-driven campaign that compromised 100 businesses and stole 600,000 credit cards with minimal human involvement, at only $25 in token costs per successfully hacked target; Hacktron using Claude to exploit a blind buffer-overflow RCE to access OpenAI's monorepo in a way that felt "superhuman"; incidents involving OpenAI/Hugging Face; and an ongoing surge in newly discovered vulnerabilities. He expects cyber attack/defense to reach equilibrium for most AI attacks in coming years, but says institutions must act on the catastrophic tail risks now.
More from Safety
- Chinese University Bought Nvidia H200 Chips Despite US Blacklist — pstAsiatech · 2026-11-11
- Google employee shows a way to get past an AI safety filter — adonis_singh · 2026-11-11
- Researcher Warns Real-Time Video AI Companions Are the Next Teen-Safety Wave — anshulkundaje · 2026-11-11
- China gives AI agents digital identities — but enforcing permission boundaries is the hard part — Shufti-Global · 2026-11-11
- 35,000+ Grok-built apps exposed patient data, plaintext passwords, and sales pipeline — The Decoder · 2026-11-11
- Fortinet patches nearly 100 vulnerabilities after adding AI models to security testing — Potential-Couple-745 · 2026-11-11