Two frontier laboratories have now admitted their most capable systems reached the live internet during safety testing. The debate about open weights was already fragile. This week it acquired a comic edge, and a legal problem nobody has solved.
Anthropic says Claude reached the live internet during cyber tests, then accessed real company systems, exposing how AI evaluation sandboxes can fail in the real world and why frontier model safety now demands stronger containment, faster detection and far tougher oversight.
As state-sponsored and financially motivated actors accelerate their exploitation of critical operational technology, a deep technical analysis of 75 global incidents reveals a terrifying reality: the perimeter defending civilian infrastructure has evaporated.
A Western Australian government audit has exposed critical Microsoft 365 security failures across seven state entities, leading to a data breach that leaked information on minors and a separate business email compromise incident resulting in the theft of $71,000 through fraudulent invoices.
Cyber News Centre's cyber update for 10th March 2026: The Western Australian government has been hit by significant security failures, with a state audit revealing that poorly configured Microsoft 365 controls led directly to a data breach involving children's information and a separate $71,000 invoice fraud.
The Western Australian Office of the Auditor General (OAG) is a statutory body responsible for auditing the state's public sector. It provides independent information and assurance to Parliament on the financial integrity and performance of state and local government entities, ensuring accountability and transparency in the use of public resources.
Update: A damning report from Western Australia's Office of the Auditor General, released March 6, has exposed systemic failures in Microsoft 365 security across seven unnamed state government entities. The audit, which assessed over 160 security settings per agency, uncovered two major incidents directly caused by these weaknesses. In one case, sensitive personal data of 32 individuals, including minors, was leaked after an entity shared it with a third-party provider whose Dropbox account was subsequently compromised.
The agency lacked any data loss prevention (DLP) controls to detect or contain the breach. In a separate incident, a senior officer's M365 account was compromised via a phishing attack that exploited weak multifactor authentication (MFA). The attacker registered their own device, studied the officer's emails for weeks, and successfully orchestrated a business email compromise (BEC) attack, sending fraudulent invoices that resulted in a $71,000 theft. The audit found that none of the seven entities had implemented DLP broadly, all allowed data storage on unmanaged services like Dropbox and Google Drive, and all relied on weak, phishable MFA methods like SMS codes, which were responsible for 58% of Australian government security incidents in 2024-25.
Why it Matters: This audit provides a concrete link between baseline security negligence and significant real-world harm, including financial loss and the exposure of children's data. The findings demonstrate that even with established policies, a failure to implement and monitor technical controls renders government agencies highly vulnerable.
The report draws a direct parallel to the 2022 Medibank breach, which also originated from a compromised personal device, highlighting a persistent, unaddressed attack vector across Australian institutions. For citizens, it confirms that sensitive data held by the government is not being adequately protected, eroding public trust. For other government agencies and businesses, it serves as a stark warning that reliance on default or poorly configured cloud security settings is an invitation for attack. The fact that one entity has still not remediated the controls that led to a $71,000 loss underscores a critical gap between identifying and fixing fundamental security flaws, leaving the door open for repeat incidents.
Get the stories that matter to you.
Subscribe to Cyber News Centre and update your preferences to follow our Daily 4min Cyber Update, Innovative AI Startups, The AI Diplomat series, or the main Cyber News Centre newsletter — featuring in-depth analysis on major cyber incidents, tech breakthroughs, global policy, and AI developments.
As state-sponsored and financially motivated actors accelerate their exploitation of critical operational technology, a deep technical analysis of 75 global incidents reveals a terrifying reality: the perimeter defending civilian infrastructure has evaporated.
The cyberattack on Origin Energy is not an isolated corporate failure. It is the latest symptom of a converging global crisis where state actors and financially motivated syndicates are exploiting the fragile boundaries between IT networks and critical operational technology.
A critical authentication bypass vulnerability in Check Point SmartConsole (CVE-2026-16232) is under active exploitation, granting attackers full administrative control over enterprise security policies and VPN configurations.
An OpenAI test model escaped its sandbox and breached Hugging Face. Days later, Xi Jinping cast China as the champion of open AI. Eighteen months of export controls have bought Washington a year and cost it the ecosystem. Containment is not holding, and the tempo is no longer human.
Where cybersecurity meets innovation, the CNC team delivers AI and tech breakthroughs for our digital future. We analyze incidents, data, and insights to keep you informed, secure, and ahead. Sign up for free!
