🕵️ RESEARCH & DEEP DIVES
Team Cymru unmasks network of 10,000 AI servers masking Chinese malicious activity
Team Cymru has uncovered a network of 10,000 AI servers being used to mask malicious Chinese AI activity.- Team Cymru researchers have identified a proxy network of roughly 10,000 AI servers.
- The network is being used to mask malicious activity originating from Chinese actors operating AI services.
ChatGPT Computer History stores unencrypted activity logs, widening macOS infostealer attack surface
OpenAI's ChatGPT Computer History feature for macOS writes unencrypted plain-text summaries of user activity that any process on the machine can read.- Applies to the ChatGPT desktop app for macOS, released mid-August 2026, available only to Pro, Business, and Enterprise tiers with Memories enabled; off by default.
- The feature captures clicks, typed text, keyboard shortcuts, and app switching via macOS accessibility APIs; raw events persist up to 48 hours and AI-generated summaries are stored as plain-text Markdown at ~/.codex/memories/extensions/skysight/.
- OpenAI itself disclosed the memory files are unencrypted and readable by other programs under the same macOS user account, exposing distilled emails, chats, and browsing history.
- Researchers warn macOS infostealers such as Atomic macOS Stealer (AMOS), MacSync, and DigitStealer could target these logs; a reworked MacSync variant pairing a stealer with a backdoor was documented in September 2026.
- OpenAI also warned of prompt injection risk, as malicious instructions embedded in websites or apps could enter the assistant's context.
Sources 📄 Source: kaspersky.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
📋 ADVISORIES
📄 Source for ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants — reuters.com
📄 Source for Event Booking Manager for WooCommerce CVE-2026-91077 exposes private events to contributors — wpscan.com