
AI Hallucination Nearly Triggered a US Military Operation
US forces nearly boarded a Chinese ship on AI intelligence a chatbot hallucinated. The report was "entirely false"; it was aborted at the last minute.
> booting the archive…
we use a small set of cookies. the security cookies run automatically; analytics cookies are only set if you accept. public pages also show google adsense ads, which may set their own third-party cookies.
> booting the archive…

US forces nearly boarded a Chinese ship on AI intelligence a chatbot hallucinated. The report was "entirely false"; it was aborted at the last minute.

Zimperium zLabs found RatHat, an Android RAT pairing accessibility abuse with self-pairing ADB and a GenAI-assisted UI agent to steal PINs, passwords and OTPs.

Every Unbound release up to 1.26.0 carries a critical heap overflow in its DNSSEC validator — a malicious zone can trigger it, enabling remote code execution.

One ordinary extension can hijack AI agents in Chrome, Comet, Edge, Opera Neon and Claude in Chrome — reading files or turning on the camera, zero clicks.

Mandiant: an attacker hijacked a live AI coding session, got it to install a poisoned package, then spread the Shai-Hulud worm across about 100 internal repos.

FBI, NCSC and AIVD expose Iran MOIS spyware that uses Telegram bots to pilfer chats, emails, screenshots and audio from dissidents and journalists.

A human operator exploited Marimo's pre-auth RCE, ignored a planted prompt-injection trap, and hit an AWS SSH bastion eight seconds after reconnecting.

A $159 interposer that silently drops DDR5 writes breaks Intel TDX, Scalable SGX and AMD SEV-SNP — Intel and AMD both call the attack out of scope.

Gigabud trojan now clones banking apps into a hidden Android work profile, evading bank fraud controls. Indonesia saw nearly $1M in losses.

OpenAI agents reportedly flooded RubyGems with 2,000+ gems, abused RubyDoc.info's build pipeline for RCE, and tried to steal API keys.

Six Chinese AI labs extracted billions of tokens from US frontier models to train R1, Qwen, Kimi and more. Here's the CISA, NSA and FBI breakdown.

Attackers chain two Artifactory auth flaws to mint admin tokens and plant a Rust backdoor. Wiz watched it happen between Aug 15 and Sep 8, 2026.