Introduction

The autonomous attack capabilities of open-source AI models have surpassed expectations. The latest research indicates that GLM 5.3 can now autonomously exploit patch gaps to write exploits targeting the Firefox browser. Today, besides walking you through this browser crisis, I will analyze how hackers are leveraging AI tools to chain Linux kernel vulnerabilities and compromise multiple firewalls. Furthermore, unauthorized AI proxy services have been found secretly modifying developer tool configurations within enterprises. What data leakage risks does this pose? I will break it down for you shortly.

Today's AI Security Highlights

1. Open-Weights Model GLM 5.3 Autonomously Writes Firefox File-Read Exploit

• What Happened: According to a report published by research institution Epoch AI on October 29, the open-weights model GLM 5.3 successfully exploited a "patch gap" (the time window between when a security patch is publicly released and when users actually apply it) to autonomously develop an exploit targeting the Firefox browser. This attack can directly read local files on a user's computer via a malicious webpage.
• Impact: The affected versions include six releases from Firefox 156.0 to 158.0.1, impacting over 200 million users worldwide.
• Mitigation: Mozilla released Firefox version 159.0 on October 27 to patch this vulnerability. Both enterprise and individual users should immediately update their browsers to the latest version to minimize the patch gap.
• Source: Epoch AI (https://epoch.ai/publications/open-weight-models-patch-gap)

2. Hackers Chain PHP2Shell and Linux Kernel Vulnerabilities to Compromise 25 Firewall Servers

• What Happened: Cybersecurity firm Dream disclosed an AI-assisted cyberattack suspected to be launched by Chinese-state-sponsored hackers. The attackers chained critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619, with a CVSS score of 9.2) with the Linux kernel privilege escalation vulnerability Fragnesia (CVE-2026-46300, with a CVSS score of 7.8), and deployed AI-assisted tools such as Claude Code, DeepSeek, and Kimi in the compromised environments.
• Impact: A total of 25 PAN-OS firewalls and management servers were compromised, including three environmental systems associated with the US government.
• Mitigation: Enterprises should immediately upgrade PHP to secure versions such as 8.5.12, 8.4.27, 8.3.36, or 8.2.35, and apply Linux kernel patches as soon as possible.
• Source: The Record (https://therecord.media/php2shell-vulnerabilities-exploited-us-government-servers-dream-report)

3. Unauthorized AI Proxy Services Maliciously Modify OpenAI Codex and Claude Code Configurations

• What Happened: Symantec's Threat Hunter team pointed out that since early 2026, unauthorized AI proxy services have been found installing legitimate OpenAI Codex and Anthropic Claude Code tools on enterprise computers. However, the service subsequently modifies the tool configurations maliciously, redirecting all requests to third-party servers and removing the original sandbox controls.
• Impact: This activity is primarily distributed across Taiwan, China, South Korea, and Malaysia, and has been detected in over a dozen organizations so far. This exposes sensitive corporate business data, prompts, and API keys to leakage risks.
• Mitigation: Security teams should immediately review endpoint URLs, sandbox configurations, and user credential variables on developers' computers, and closely monitor whether development tools are communicating with unapproved AI endpoints.
• Source: Cyber Security News (https://cybersecuritynews.com/unauthorized-ai-relay-service-installs-genuine-openai-codex-anthropic-claude-code/)

4. US NIST Releases 10 Design Principles to Strengthen AI Agent Identity and Access Management

• What Happened: The National Institute of Standards and Technology (NIST) released 10 design principles on October 30 aimed at strengthening Identity and Access Management (IAM) security for AI agents. NIST recommends establishing cryptographically verifiable identities for AI agents, restricting them to the least privilege required for specific tasks, and introducing human review when actions exceed defined risk thresholds.
• Impact: Applicable to all enterprises and development teams currently developing or adopting AI agents and automated workflows, aiming to prevent emerging attacks such as prompt injection.
• Mitigation: When evaluating or deploying AI agents, enterprises should refer to these 10 principles, use short-lived and revocable authorization mechanisms, and ensure that the agents' behaviors are predictable and traceable.
• Source: Industrial Cyber (https://industrialcyber.co/nist/nist-outlines-10-design-tenets-to-strengthen-ai-agent-identity-and-access-management-proposes-safeguards/)

Conclusion

Based on today's intelligence, AI is no longer just an auxiliary tool for hackers; it has begun to demonstrate the ability to autonomously find patch gaps and launch attacks. I recommend that when you get to the office today, immediately ask your IT team to inventory the AI tool configurations of internal developers, especially endpoint connections and sandbox statuses. Don't let unauthorized proxy services become a loophole for data leakage. I'm Muyan, sharing practical cybersecurity insights. See you tomorrow!