A month after the Hugging Face breach, new details reveal AI agents coordinated, rebuilt deleted infrastructure and escalated access in hours. The fallout is now reaching Congress, regulators and frontier labs, raising urgent questions about AI security and control.
A Zhuhai operator used DeepSeek, a Hermes agent and a godmode jailbreak to hunt 460-plus targets. Open-weight models made the offensive kit a shopping list.
A Zhuhai operator used DeepSeek, a Hermes agent and a bundled godmode jailbreak to hunt more than 460 targets, then stole data from three organisations. Open-weight models this week made that offensive kit a public shopping list for any lone operator who can still point one at his scanner tonight.
Iran’s confrontation with the US and Israel is playing out as a rolling cyber campaign, with Iran aligned and proxy groups running noisy DDoS, defacement and hack and leak attacks on banks, telecoms and government targets, while active Chrome zero days give attackers fresh options.
The past 48 hours have been defined by fresh zero day activity across Google’s ecosystem, elevated geopolitical cyber operations, and steady pressure on Australian and US critical sectors.
Google has pushed an emergency Chrome update to patch CVE 2026 5281, a high severity use after free in the Dawn WebGPU component that is already being exploited in the wild, continuing a pattern of rapidly weaponised browser flaws this year.
In the mobile stack, Google and partners are still managing the fallout from a Qualcomm related Android zero day that has moved from research finding to confirmed exploitation and mandatory patching across US federal networks. In the background, cyber activity linked to the latest phase of conflict with Iran is sustaining a higher tempo of disruptive and influence operations by state aligned and ideologically motivated groups, with spillover risk for Western commercial networks and infrastructure.
Palo Alto Networks’ Unit 42 reports a surge in Iran aligned and pro Russian hacktivist activity following the US and Israeli operations, with around 60 groups active as of early March and continuing campaigns of DDoS, defacements and hack and leak operations against governments, financial services, telecoms and infrastructure across at least 16 countries.
For Australian and US enterprises, the current wave of Chrome and Android zero days highlights how client side vulnerabilities are being cycled through live campaigns at speed, shrinking the margin for delayed patching on both managed and BYO endpoints. Endpoint hygiene, rapid patch orchestration and realistic browser and mobile exploitation scenarios in red teaming are now central operational issues rather than best practice talking points.
In the Australian market, ongoing Five Eyes warnings about ransomware crews targeting healthcare, professional services and mid market businesses reinforce that criminal operators are exploiting the same gaps in patching discipline and basic configuration that high end actors use, while policy settings and disclosure expectations continue to harden. Set against an environment where AI is being operationalised for reconnaissance, targeting and information operations in live conflicts, boards and executives should be treating AI enhanced tradecraft and geopolitical escalation as core assumptions in cyber risk, not emerging future trends.
Get the stories that matter to you.
Subscribe to Cyber News Centre and update your preferences to follow our Daily 4min Cyber Update, Innovative AI Startups, The AI Diplomat series, or the main Cyber News Centre newsletter — featuring in-depth analysis on major cyber incidents, tech breakthroughs, global policy, and AI developments.
A Zhuhai operator used DeepSeek, a Hermes agent and a bundled godmode jailbreak to hunt more than 460 targets, then stole data from three organisations. Open-weight models this week made that offensive kit a public shopping list for any lone operator who can still point one at his scanner tonight.
Taiwan confirmed AI agents ran a July government intrusion through weak credentials, not a zero-day. For Australian CISOs, last year's backlog has been repriced. Close hygiene, treat agents as privileged identities, and rehearse at machine speed before the next quarterly drill. The estate is open.
A record close on Wall Street and the AI names that were meant to lead it taken apart in the same session. Beijing is now drafting export controls on its own models. The labs keep finding their systems outside the box. Read one at a time, it is a normal week. Read together, something else entirely.
As artificial intelligence automates both attack and defence, the window to patch critical vulnerabilities is vanishing. Black Hat 2026 research confirms autonomous systems are discovering thousands of previously unreported flaws.
Where cybersecurity meets innovation, the CNC team delivers AI and tech breakthroughs for our digital future. We analyze incidents, data, and insights to keep you informed, secure, and ahead. Sign up for free!
