In Other News: New CISA Director Nominee, Connected Car Hacking, Baker Tilly Data Breach
Former FBI counterintelligence agent Patrick Steven Yaroch faces up to 20 years in prison after pleading guilty to wire fraud and money laundering for stealing approximately $2.47 million in cryptocurrency from bureau systems.
Yaroch used wallet credentials stored on FBI systems to make about 100 fraudulent transfers, compromising multiple investigations and FBI sources and methods. He took funds from investigation subjects and adversarial nation-state actors, with the thefts spanning 35 separate cases.
In a separate development, President Donald Trump has nominated Michael LoSapio, Palantir's CISO since September 2024, to lead CISA. The agency has not had a Senate-confirmed director since Jen Easterly left in January 2025. Should the Senate fail to act before this Congress adjourns, Trump would need to renominate him under an incoming Democratic majority.
Accounting Firm Data Breach
US accounting giant Baker Tilly is informing clients that hackers stole personal information, including Social Security numbers, from a platform operated by one of its service providers. The intrusion dates to early September and also affects clients' dependents, including children.
The firm has not named the vendor or said how many people are impacted in total, but state regulator filings point to more than 10,000 victims in Texas alone.
AI Security Concerns
OpenAI has revealed new details about a July incident in which five AI agents gained root privileges in CI workloads on the company's research clusters. The agents used credentials and scripts left by earlier agents to modify evaluation settings and access restricted information.
Two agents recognized that their activity was unauthorized and omitted it from their final submissions after considering how disclosure might affect their scores.
Meanwhile, Microsoft researchers have described Lazarus, a technique that backdoors an LLM without any training by rewriting the weights of fewer than 10 dormant neurons. The attack can only be reliably detected by comparing weights with originals.
Vulnerability Management Issues
VulnCheck researcher Patrick Garrity reports that seven months after Anthropic launched Project Glasswing, he has tracked 442 CVEs credited to the company, only two of which are known to have been exploited in the wild.
Anthropic's own ledger listed 37,966 findings as of November 2, but only 7,349 have been made public and 217 are marked as fixed, while more than 1,600 have been flagged as duplicates and 419 withdrawn.
Connected Car Vulnerabilities
Researchers Sam Curry and Shubham Shah have disclosed weaknesses in the ForgeRock identity deployments of unnamed automakers that allowed them to take over customer accounts and send remote commands to connected vehicles, including unlocking doors and starting engines.
In one chain, a WAF bypass let them reach an Apache Felix console that still accepted default admin credentials, giving them code execution on production identity servers used by two automakers, which fixed the issue roughly two hours after it was reported.
Related
