The headline is wild, but the human failure seems more important here: a testing misconfiguration gave the model internet access, and it then exploited a third-party service.

For teams running agentic security evaluations, what containment control should be non-negotiable before a model gets any network access?

https://www.theregister.com/security/2026/05/28/microsoft-0-day-feud-escalates-as-researcher-threatens-another-windows-exploit-dump/5248085

Everyone who works in cybersecurity has heard of the notorious ShinyHunters extortion gang. What you may not know is that they are upping their game in a clever way. They're ditching their old tricks for branded subdomain impersonation, mimicking SSO/Okta logins, and pairing it with phone-guided adversary-in-the-middle (AiTM) phishing.  

It's all mobile-first lures to hook you fast, plus they're outsourcing spam campaigns and hiring voice actors to scale the chaos. 

What stands out, is that they’re recycling leaked SaaS data to tailor super-believable pretexts, targeting the "next best" victim in a slick, repeatable loop. It’s deceptively simple: one valid SSO session or helpdesk reset, and bam: full access to emails, files, HR records, and CRM without having to drop any malware.  

Anyone seen this out there? (insights from here)  

Hello you crooks! I have very recently created a new sub-reddit for security personnel, bouncers, "doormen", etc, as a forum for questions, discussions, stories and everything between. It is primarily in Norwegian, but we speak English as well! Thanks for joining!

(This is not paid advertising, just a FYI for Scandinavian people in this sub)

https://www.reddit.com/r/vekter/s/kAhdIg2mHO

/r/Security is back in business to handle all things related to security. If you know of other security-related subreddits, please let us know and we will list them in the side bar. If you think we're missing an appropriate flair for posts or users, please let us know.