--- title: "🛡️ Binance's $6.3 Billion Theft Began with an Interview Assignment: Internal AI Tools Became a Lateral Springboard | AI Security Daily" description: "Binance's first incident report, released on November 3, states that the $6.3 billion theft began with an engineer downloading a tampered AI coding tool installer, along with a fake interview \"assignment.\" Today, Muyan will also discuss the chain of hacks hitting more than ten AI development platforms over the past month, with attackers specifically targeting monetizable AI access tokens; additionally, ChatGPT's Lockdown Mode was once bypassed, with the breach stemming from a feature you use every day, and I'll tell you what to check shortly." canonical_url: "https://blog.markkulab.net/en/ai-security/ai-security-2026-11-05" author: "Mark Ku" author_url: "https://blog.markkulab.net/en/author/mark-ku" site: "Mark Ku's Tech Notes" date_published: "2026-11-05T02:00:00.000Z" category: "AI Security Daily Report" tags: ["ai-security", "podcast", "AI 資安", "AI資安", "Binance", "LLMjacking", "ChatGPT", "LockdownMode", "供應鏈攻擊", "AIagent", "OpenAI"] language: "en" license: "CC BY 4.0" license_url: "https://creativecommons.org/licenses/by/4.0/" attribution: "when reusing or quoting, credit the author and link back to the original" --- # 🛡️ Binance's $6.3 Billion Theft Began with an Interview Assignment: Internal AI Tools Became a Lateral Springboard | AI Security Daily ## Opening Binance's first incident report, published on November 3, points to the origin of that $6.3 billion theft: an engineer downloading a tampered AI coding tool installer, plus a "take-home assignment" from a fake job interview. Today I also want to cover the dozen-plus AI development platforms breached in a chain of attacks over the past month, where attackers went straight for monetizable AI access tokens. And ChatGPT's Lockdown Mode was bypassed, with the hole sitting in a feature you use every day. I'll tell you what to check in a moment. ## Today's AI Security Highlights ### 1. First Report on Binance's $6.3 Billion Theft: Fake Interviews, a 0-day, and Internal AI Tools - **What happened**: According to SecurityWeek's November 4 report, Binance released a preliminary incident report on the theft, tracing a months-long operation that compromised three engineers' machines. The report notes that starting in June, an engineer searching for AI coding tools downloaded a tampered installer; in September, another engineer fell for a fake interview and fake "assignment," and endpoint protection failed to detect the 0-day malware at the time. On October 20, the attackers used internal AI tooling to pivot to other hosts, eventually reaching the wallet signing service. Roughly $2.85 billion in assets has been frozen or intercepted so far. - **Who's affected**: This isn't just a crypto industry problem. Any organization that lets engineers search for and download their own dev tools shares the same attack surface, and once an "internal AI tool" has cross-host execution capability, you've effectively opened a channel that traditional lateral movement detection doesn't cover. - **Defensive advice**: Treat internal AI tooling as a privileged system. Inventory which hosts and credentials it can reach, and add independent operational auditing. Route all dev tool installs through internal package sources or an allowlist, and don't let a search engine decide what your engineers install. - **Source**: SecurityWeek () ### 2. Chain of Breaches Across AI Development Platforms, with Attackers Targeting AI Access Tokens - **What happened**: Also from SecurityWeek on November 4: at least a dozen AI development platforms have disclosed breaches in the past month, with the latest batch including WorkOS, Northflank, Trigger.dev, and Chainstack. The attackers' goal is clear, directly monetizable AI access tokens, commonly known as LLM-jacking: running your own models on someone else's quota. The report notes that some cases used the open source AI pentesting framework Artex to automate the attack flow. Chainstack has already asked customers to rotate node credentials. - **Who's affected**: Any team storing LLM API keys or third-party platform tokens in CI/CD or SaaS platforms. Leaked keys rarely trigger an alert; they just show up at the end of the month as a line of usage nobody can explain. - **Defensive advice**: Do a full inventory and rotation of your external AI platform tokens today, and set usage caps plus anomalous-usage alerts on your LLM APIs, so that "someone else is burning our quota" at least has a chance of being caught within four hours. - **Source**: SecurityWeek () ### 3. ChatGPT Lockdown Mode Bypassed: The Hole Was in the HTML Preview Sandbox, Now Patched by OpenAI - **What happened**: Check Point Research disclosed today that ChatGPT's HTML page preview popup had a handling flaw that could bypass Lockdown Mode, allowing conversation data to be quietly exfiltrated and enabling phishing and malware delivery. The research notes that the Electron-based ChatGPT Classic even had a zero-click trigger scenario. OpenAI completed the fix on September 18, 2026 by removing the relevant sandbox permissions, and the research team confirmed via retesting that the original technique no longer works. - **Who's affected**: The key issue isn't "am I still vulnerable right now," it's your trust assumptions about AI assistants. Settings like Lockdown Mode, where you think "I've already enabled the strictest mode," can still be bypassed by rendering features, and conversation content is often your most sensitive internal data. - **Defensive advice**: Verify that everyone in the organization is on the latest desktop and web clients, and retire AI assistants still running old Electron versions. Also add "AI chat windows can render external content" to your data exfiltration risk list instead of only watching file uploads. - **Source**: Check Point Research () ### 4. One Person Plus 12 AI Agents: Acronis Uncovers an Attack Network Spanning 11 Countries - **What happened**: Acronis TRU published research today describing a single attacker operating an attack network of 12 AI agents, targeting hundreds of organizations across 11 countries, with behavioral patterns that looked like a nation-state team at work. Researchers also observed that while commercial models were used to build attack infrastructure, they refused to cooperate on multiple actual attack requests, forcing the attacker to switch to weaker local models. - **Who's affected**: For defenders, this means attribution just got harder. In the past, "simultaneous multi-point activity, consistent tempo, multiple countries" would instinctively point to an organized threat actor. Now one person plus automation can produce comparable volume, so threat intel interpretation standards need to adjust accordingly. - **Defensive advice**: Stop building detection logic around "how many attackers are there" and focus on behavioral frequency and automation signatures instead, such as unnaturally regular scanning cadence and identical techniques repeating across tenants, then fold those signals into your SIEM correlation rules. - **Source**: Cybernews () ### 5. OpenAI Launches a Security-Focused Model Limited to Daybreak Red, Plus $1 Billion for Critical Infrastructure - **What happened**: OpenAI released a security-focused model today, initially available to offensive security researchers at Daybreak Red, the highest tier of the Daybreak program, for vulnerability discovery and development. It also announced a $1 billion program to support security personnel protecting critical infrastructure such as power grids and water systems. According to TechCrunch, only "a few thousand" security professionals currently participate in Daybreak. - **Who's affected**: This is a race between defensive tooling and offensive capability. Tiered access reduces abuse risk, but a few thousand people is still limited relative to the global critical infrastructure gap, and most enterprises won't become safer from this in the short term. - **Defensive advice**: Don't treat programs like this as a substitute for your own defenses. Make sure the fundamentals are in place first: asset inventory, patching SLAs, and account privilege reviews. Those are the parts you actually control. - **Source**: TechCrunch () ## Closing The one thing worth remembering today: AI tools have officially become part of the intrusion path, whether that's a tampered installer, a stolen token, or an internal AI assistant used as a pivot. Do one thing today: list every AI-related key and token in your organization, noting who uses it and when it was last rotated. That table alone will eliminate more than half your blind spots. This is Muyan, see you tomorrow. --- ## About this article and its author Originally published on [Mark Ku's Tech Notes](https://blog.markkulab.net/en/ai-security/ai-security-2026-11-05) License: [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) — when reusing or quoting, credit the author and link back to the original ### About the author **[Mark Ku](https://blog.markkulab.net/en/author/mark-ku)** — Software engineer - 10+ years as a software engineer - Built North-American e-commerce and AI SaaS subscription billing ### Free tools built by the author All of these are free to use: - [Free PDF Sign Tool](https://blog.markkulab.net/en/tools/pdf-sign): Online PDF sign tool — draw, type, or upload a signature, then drag, resize, and download. Everything runs in your browser; nothing is uploaded. - [VS Code Refactory](https://blog.markkulab.net/en/tools/refactory): Refactory is a VS Code refactoring extension: 34 actions plus a 37-rule code-smell inspection layer with a Code Health dashboard, across 18 languages, backed by 534 tests. It learns your repo's conventions: where interfaces live, where DI is registered, whether 'use client' belongs. It ranks files by git churn × complexity so you know what to fix first, and hands any smell to the Claude Code already on your machine. Free to use, and your source never leaves your computer. - [DB-Kit Database Manager](https://blog.markkulab.net/en/tools/db-kit): DB-Kit is a lightweight, cross-platform database manager built with Tauri + Rust + React. Manage MySQL, MariaDB, PostgreSQL, SQL Server, Oracle, SQLite, MongoDB, Redis, Kafka, Elasticsearch and RabbitMQ from one consistent interface: passwords encrypted in the OS keychain, SSH tunnels, full CRUD, a visual query builder, stacked multi-statement result sets, cross-connection data transfer, schema & data compare with sync SQL and schema snapshots, Excel / CSV import & export, visualized execution plans, ER diagrams, scheduled backups, SQL stress testing with p50–p99 latency percentiles, a 15-rule SQL review engine, Review & Run (AI review plus per-statement backups and an auto-generated rollback script), Kafka message browsing with monitoring & alerts, an SSH terminal with SFTP / FTP, Docker / Kubernetes, remote desktop (RDP / VNC / RustDesk), file / folder compare, stored procedure integration tests, six UI languages, a built-in AI assistant (a local CLI or any Anthropic / OpenAI-compatible API; natural-language SQL, AI review and tuning advice) and the dbk CLI. Free and open source (MIT), with installers for Windows, macOS and Linux. - [VS Code Super Mermaid](https://blog.markkulab.net/en/tools/super-mermaid): Super Mermaid is a VS Code extension for beautiful Mermaid diagrams out of the box: auto-colored live preview, mouse pan & zoom, high-res PNG / SVG export, 21 templates and multiple themes. Free and open source (MIT). - [React Super Mermaid](https://blog.markkulab.net/en/tools/react-super-mermaid): react-super-mermaid is an open-source React component library: render beautiful Mermaid diagrams with a single , with built-in colorful / sketch themes, pan & zoom, in-diagram search, and high-res SVG / PNG export. Lightweight, SSR-safe, fully typed. Free and open source (MIT). - [Jira / Confluence Super Mermaid](https://blog.markkulab.net/en/tools/jira-super-mermaid): An Atlassian Forge app: write Mermaid syntax directly inside a Jira issue or a Confluence page and get flowcharts, sequence diagrams, state machines and Gantt charts. 11 diagram types, SVG / PNG export, light and dark themes, full CJK support. Runs on Atlassian: your diagrams live in your own site and the app calls no third-party service. Free, coming soon to the Atlassian Marketplace. - [Mermaid Live Preview](https://blog.markkulab.net/en/tools/mermaid-preview): Write Mermaid in your browser, see it render instantly, and share the whole diagram as a single link. No sign-up, nothing uploaded to a server, and mermaid.live share links work as-is. - [React Intl Phone Number](https://blog.markkulab.net/en/tools/react-intl-phone-number): react-intl-phone-number is an open-source React component: framework-agnostic and antd-free, with E.164 in/out, a searchable flag / country-code dropdown, configurable validation levels (strict / mobile-strict / loose), themeable CSS, and i18n — phone logic powered by google-libphonenumber. Lightweight and fully typed. Free and open source (MIT). - [Uptime Kuma Cluster](https://blog.markkulab.net/en/tools/uptime-kuma-cluster): Turn single-node Uptime Kuma into a highly available cluster: OpenResty + Lua smart load balancing, shared MariaDB state, health checks and automatic failover, plus cluster-management REST APIs. One Docker Compose command to start. Free and open source (MIT). - [AI Podcast Cut](https://blog.markkulab.net/en/tools/ai-podcast-cut): Drop in a recording and it removes fillers and stutters, levels loudness segment by segment, and sends a second agent to review every cut. Cut points snap to word boundaries and zero crossings, every splice gets a fade, and sentence-end breaths are preserved. Desktop app for Windows, macOS and Linux. MIT licensed; the Windows installer bundles ffmpeg. - [AI Video Cut](https://blog.markkulab.net/en/tools/ai-video-cut): Pick something in your video: type it (face, license plate, phone screen, logo), click points or drag a box, or let Claude Code / Codex pick it. AI Video Cut tracks it frame by frame, then mosaics or blurs it, recolors it, pins stickers and text to it, swaps a screen or poster for your own image or video, or removes it using background that other frames actually captured. Plus sequence editing, local captions and an AI assistant. Free, open-source (MIT) Windows desktop app (macOS / Linux experimental) that runs locally, nothing uploaded. - [open-pos restaurant POS](https://blog.markkulab.net/en/tools/open-pos): One computer and one receipt printer is enough to open the shop. Your data lives on your own disk, no subscription, no lock-in, MIT licensed. Money is integer New Taiwan dollars with tax split by the statutory formula, so sales + tax always equals the total. Printing goes straight over ESC/POS on TCP 9100, with no vendor driver. Tauri + Rust + SQLite desktop app, v1.0 in development. - [.NET e-commerce API template](https://blog.markkulab.net/en/tools/dotnet-ecommerce-api): An e-commerce backend API template built on .NET 10: Controller → Service → Repository layering, Autofac convention-based registration, SqlSugar for MySQL / MariaDB and SQL Server, Redis cache and message queue, Hangfire jobs, JWT auth, and an extensible payment provider module (ECPay, Newebpay). Apache 2.0. - [Open Token Monitor team AI usage](https://blog.markkulab.net/en/tools/open-token-monitor): Collect token usage and equivalent cost from every employee's AI coding tools into a hub you host yourself: PostgreSQL, org roster, dashboards compared by company and department, and a reports API. Electron and Rust/Tauri clients upload every 30 minutes. MIT licensed, one Docker command. - [ai-security-monitor defensive security](https://blog.markkulab.net/en/tools/ai-security-monitor): Your website is live. Who checks its certificates, security settings and known vulnerabilities? A self-hosted Security Hub brings website scans and host monitoring together, deduplicates findings and compares scans after fixes. ### Daily podcasts - [Mark's Tech Insights — Daily AI News](https://blog.markkulab.net/en/category/tech-news): Daily curated AI and tech trends. Catch the latest developments via audio summaries — covering AI applications, software architecture, DevOps, and engineering practice. — RSS: https://blog.markkulab.net/feed.xml - [AI股市蝦聊](https://blog.markkulab.net/en/category/ai-stock-chat): Every trading day, an AI-analyzed take on the Taiwan stock market, delivered as a two-host conversation covering the session and the next-day outlook. — RSS: https://blog.markkulab.net/ai-stock-chat/feed.xml - [開源好物日報](https://blog.markkulab.net/en/category/open-source-weekly): A daily two-host pick of free open-source tools surfaced from real Hacker News, GitHub, and Reddit buzz — what pain they solve and the fastest way to get started. — RSS: https://blog.markkulab.net/open-source-weekly/feed.xml - [AI 運動日報](https://blog.markkulab.net/en/category/sports-weekly): Two hosts talk NBA, MLB and world sport every day — scores, records and the stories behind them, from a Taiwanese fan perspective. — RSS: https://blog.markkulab.net/sports-weekly/feed.xml - [AI 國際新聞快報](https://blog.markkulab.net/en/category/world-news): A daily two-host briefing that makes sense of the past 24 hours in world news — geopolitics, the global economy, conflict and security, disasters and climate — from a Taiwanese perspective, neutral and fully sourced. — RSS: https://blog.markkulab.net/world-news/feed.xml - [地端 AI 實驗室](https://blog.markkulab.net/en/category/local-ai-lab): Every day, a two-host look at open-weight models and LoRAs you can actually run on your own machine: what they are for, whether your GPU can handle them, and how they compare — sourced from official model cards. — RSS: https://blog.markkulab.net/local-ai-lab/feed.xml - [AI 行銷日報](https://blog.markkulab.net/en/category/ai-marketing): Every day, two hosts break down the latest in AI for marketing, advertising, SEO/GEO and content marketing: practical, never sponsored, every story sourced. — RSS: https://blog.markkulab.net/ai-marketing/feed.xml - [AI 資安日報](https://blog.markkulab.net/en/category/ai-security): Every day, two hosts cover the latest where AI meets cybersecurity: LLM and AI agent vulnerabilities, prompt injection, model supply-chain risks and AI-powered attacks, from a defense-first angle with every story sourced. — RSS: https://blog.markkulab.net/ai-security/feed.xml ### Newsletter [Subscribe to the newsletter](https://blog.markkulab.net/en/subscribe) — Be the first to know about new posts. No spam, unsubscribe anytime.