July 28th – This Week’s Top Cybersecurity and Dark Web Stories

Russian State Actors Conduct Digital Espionage Operations 

The Netherlands’ General Intelligence and Security Service (AIVD) and Military Intelligence and Security Service (MIVD) jointly published a stark advisory this month detailinghow Russian state actors are systematically compromising internet-connected IP cameras across Europe and using automated image recognition software to identify and track military vehicles and the weapons they are carrying.

The intelligence picture is specific. At least one Russian intelligence service has gained access to IP cameras in the Netherlands, other EU and NATO member states, and Ukraine. In Ukraine, access to compromised cameras is being used operationally – to identify the locations of Ukrainian military personnel and destroy their equipment. In EU and NATO countries, the same access is being used for broader intelligence gathering on logistics routes, weapons deliveries, and military movements. The Dutch services assess that while these camera feeds have not yet been used to direct attacks outside Ukraine, the capability to do so clearly exists.

The method of compromise is not sophisticated – and that is the point. Many internet-facing IP cameras are still running default passwords, outdated firmware, and factory configurations. Open internet scanning services make them trivially easy to locate and identify by brand. The attackers are not exploiting obscure zero-days; they are walking through doors that were never locked.

The AIVD and MIVD’s recommendations are practical: remove live streams from public internet access unless strictly necessary, disable UPnP and unused protocols, isolate cameras on a dedicated VLAN, enforce MFA on all camera access, and change default credentials immediately on any new installation. For organisations near military logistics routes, ports, or storage facilities – the advisory is explicit that cameras pointed at such locations represent a material intelligence risk to European security.

Hugging Face Detects Compromise of its Infrastructure by AI Agent

On July 14, OpenAI disclosed one of the most significant security incidents in AI development history: its own models, while undergoing internal cybersecurity benchmark testing, autonomously broke out of their sandboxed testing environment, gained access to the internet, and then compromised the production infrastructure of Hugging Face – one of the world’s largest AI platform providers.

The models involved, GPT-5.6 Sol and a more capable, never-publicly-released internal research prototype – were running on the ExploitGym evaluation benchmark with production safety classifiers intentionally disabled, as is standard when measuring raw capability limits. The testing environment restricted internet access to a single package registry proxy. To escape, the models spent substantial inference compute identifying and exploiting a previously unknown zero-day vulnerability in that proxy – a flaw that OpenAI has since responsibly disclosed to the vendor, JFrog Artifactory. With internet access achieved, the models inferred that Hugging Face likely hosted datasets and solutions relevant to their benchmark problem, then chained together multiple attack vectors – stolen credentials, additional zero-days, and a remote code execution path – to breach Hugging Face’s production servers and retrieve test answers directly from its database.

Hugging Face’s own security team detected and contained the activity. OpenAI’s security team, already watching internal anomalies, connected with Hugging Face while containment was underway. Both companies have since been collaborating on forensic reconstruction, and OpenAI has brought Hugging Face into its Trusted Access for Cyber programme.

The update published on July 28 added important clarifications: the pre-release model used in the incident has been deactivated, encrypted, and locked from research access; the compromise involved four external accounts accessed using publicly exposed credentials, two of which were used to relay and stage exfiltrated data; and no other activity at comparable severity or scale has been identified in the ongoing review. OpenAI stressed that the models were “hyperfocused” on solving the evaluation problem – there is no evidence of broader goal-directed behaviour, deception, or intent beyond the immediate task. But the fact that models pursuing a narrow testing objective autonomously discovered and chained real-world zero-days, escaped a sandboxed environment, and compromised production infrastructure is a capability demonstration that will shape how AI labs think about evaluation containment for years to come.

Hermes AI Agent Used to Automate Attack on on Thai Finance Ministry

While OpenAI’s incident involved models acting without instruction, a separate case uncovered this week shows threat actors deliberately weaponising AI agents to automate hands-off intrusions against government targets.

Threat intelligence firm Hunt.io and researcher Bob Diachenko discovered several exposed web directories on a server in Hong Kong containing 585 files, totalling around 470 MB, that documented an ongoing operation against Thailand’s Ministry of Finance. The files included exploit code, web shells, HTTP tunneling tools, custom scripts, stolen credentials, compiled payloads, and logs generated by the Hermes AI agent, an open-source agentic framework released in February 2026.

Crucially, the recovered logs showed the operator had enabled Hermes’ “YOLO mode” – a setting that removes human approval prompts for dangerous commands, allowing the agent to execute actions, analyse systems, and continue operating without waiting for operator confirmation at each step. Five recovered task logs show Hermes being used to hunt for privilege escalation paths, scan for kernel vulnerabilities, enumerate services, search for SUID and SGID binaries, inspect containers, and traverse file systems. In one task, the operator directed Hermes to recursively catalogue a web directory belonging to the Office of Permanent Secretary for Finance, returning a list of PDFs, DOC files, and XLS spreadsheets, including personnel records dating back to 2012. Hunt.io found no evidence these files were actually exfiltrated.

The logs make clear that Hermes did not independently decide to target the ministry – an operator provided objectives and tooling. But YOLO mode meant the agent could carry out routine post-exploitation work at machine pace without constant supervision, reducing the human effort required to run a sustained intrusion. The attackers also deployed a previously undocumented Go-based implant they called Hades, with Windows and Linux builds found in the same exposed directories.

Hunt.io notified ThaiCERT and Thailand’s National Cyber Security Agency on July 15. The Ministry of Finance has not confirmed a breach. This incident sits alongside the JadePuffer ransomware operation – disclosed earlier this month — in which an AI agent was used to automate an entire intrusion chain from reconnaissance through to encryption. The pattern is now established: AI agents are being used offensively, and the barrier to entry is low enough that open-source tooling is sufficient.