Security news weekly round-up - 24th July 2026

#security

All the articles that we are going to cover today have an element of Artificial Intelligence in them. You should not be surprised; AI is almost everywhere. Now, we'll take a look at what, without reading it, will look like it came out of a Sci-Fi movie, the dangers of searching for your favorite applications using a search engine, and AI going rogue, among others.

To think of it, when we talk about the popularity of AI, we are just in its infancy.

How a Stranger Used One Text Message to Steal My Entire Digital Life

Please, if you are going to read any article from start to finish in today's edition, it should be this. Reading through it will make it seem like a movie, but I bet you not. This is someone's life where they lost their identity and lots of money. The AI connection in it, the author turned to Anthropic's Claude to assist with something that the author was initially told was impossible.

Here is an excerpt from the article:

When I asked the caller to prove he was who he claimed to be, he did something that turned my stomach: he read my entire Social Security number and my date of birth back to me. That was the moment I knew my identity had been stolen. No honest caller needed to recite my full Social Security number to me; the only reason he had it was that he already had everything.

Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes

When you read the term "sandbox" and you read an article like this, you just wonder: how did it happen? Well, it happened. This just shows you that if humans designed something to be locked down, we eventually find a way to unlock it for fun, or research purposes.

From the article:

The underlying class is not new. In April, Cymulate documented the same pattern, which it named "Configuration-Based Sandbox Escape," across Claude Code, Gemini CLI and Codex CLI, where a file written inside the sandbox runs on the host at the next launch.

What is new is the breadth. The same failure shows up across four tools from three vendors.

Denying the Worm: Detecting SANDWORM_MODE and the Emerging Class of AI Toolchain Supply Chain Attacks

When I read an article like this, I ask myself one question: Given the effort that the attackers (in this case, the creator of the worm) put into developing this malware, why not use it to build a meaningful application? Because, read the following excerpt and tell me if you will not ask the same question:

SANDWORM_MODE spreads through three independent vectors, each exploiting a different credential type. With stolen npm tokens, it calls whoami to identify the compromised identity, enumerates all packages published under that account, injects the Stage 0 loader shim into each, and then runs npm publish to distribute infected versions to downstream consumers

When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover

What to take away from this article: when the so-called customer service calls you, disconnect and call their number. Why, it can be a spoofed call.

From the article:

The most important lesson from this incident is not that SIM swaps remain dangerous. It is that attackers increasingly chain together multiple identity attacks during a single engagement. Social engineering, credential theft, session hijacking, account manipulation, and recovery abuse are no longer isolated techniques. They are coordinated stages of a single identity attack campaign.

How OpenAI’s human mistake led to the AI-powered hack on Hugging Face

We all thought that it was impossible or that it could only happen in movies, in reality, we are seeing it play out.

ICYMI: An OpenAI model went rogue and attacked Hugging Face. This is the aftermath of that attack. I mean, it was not meant to happen. This article explains that human mistakes made the impossible possible.

From the article:

Daniel Card, a cybersecurity consultant, agreed that OpenAI “didn’t put adequate effort into the design of the sandbox nor its controls” by giving the sandbox or some part of it “an unfiltered route to the internet.” Setting up the sandbox, even with limited network access as OpenAI described it, was not a “reasonable” decision, according to Card.

How attackers hosted a fake Claude download page on the claude.ai domain

If you need that software, go to the official website by typing the URL in your web browser's address bar. Don't search it.

From the article:

A threat actor abused Anthropic’s Claude Artifacts feature to funnel users toward malware, Huntress researchers have disclosed.

In this particular case, the artifact to which potential victims were directed rendered a fully functional page that looked like a legitimate Claude download page, and the fact that it was hosted on the Claude.ai domain completed the illusion.

Clicking on the “Download” button redirected victims to an external domain, first claude.ai.download-app[.]us and subsequently downloading-api.it[.]com/html/claude/win, from which they downloaded a bundle.