The story behind the intelligence
Summary: Cisco Talos used its Threat Source newsletter to describe an AI "safety penalty," citing July 2026 as the point when Hugging Face's primary cloud LLM refused to analyze forensic data during a breach and delayed the response. The same newsletter also reported ShinyHunters claiming 284 million patient records stolen from McKesson through vishing calls and Okta single sign-on account takeovers, and Anthropic warning Claude users of general-purpose infostealer malware that copies saved passwords, browser cookies, and local application credentials.
What you should know: Defenders are slowed by model refusals while adversaries use unconstrained models at machine speed, and Talos notes a vendor alignment update could break defensive workflows overnight - against an actor that reached 284 million patient records through a phone call.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026