September 20, 2026

What happened

An individual impersonating a government agency, using an email address on that agency’s domain, obtained sensitive customer records from Revolut. [1]

Revolut confirmed the incident on Saturday, September 12. [2]

DeepZero is described as an open-source engine that automates searches for exploitable Windows kernel drivers. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: What we know about the Revolut data breach so far Someone impersonating a government agency, using an email address on that agency’s domain, obtained sensitive customer records from Revolut.

2. [2]

   The bank confirmed the incident on Saturday, September 12.

3. [3]

   DeepZero: Open-source hunting for vulnerable Windows drivers DeepZero is an open-source engine that automates the search for exploitable Windows kernel drivers.

Read the original article →

What happened

TeamPCP allegedly tainted hundreds of open-source programs with malware, stole developer accounts, used a self-spreading worm, and ultimately breached more than a thousand companies. [1] [2]

Google Threat Intelligence says an undercover researcher infiltrated TeamPCP during its campaign, enabling Google to monitor the activity, warn breach targets, and help disrupt attempted exploitation. [3]

Google researcher Austin Larsen was scheduled to present details of the investigation and infiltration at SentinelOne’s LABScon research conference. [4]

Larsen said a Mandiant undercover analyst, rather than Larsen himself, had been inside TeamPCP’s inner circle from nearly the beginning of the group’s public campaign. [7]

Why it matters

According to Larsen, Google traced operational-security mistakes allegedly made by one accused TeamPCP leader and passed identifying details to law enforcement. [5]

Google also received intelligence from ShinyHunters, which had partnered with TeamPCP before turning against the supply-chain hackers. [6]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Before two of its alleged members were arrested and charged in Australia last month, the hacker group known as TeamPCP carried out a hacking spree unlike any other in history.

2. [2]

   It tainted hundreds of open-source programs with its malware, stole developer accounts to perpetuate that software supply-chain hacking, and even released a Dune -themed self-spreading worm to automate the process, ultimately breaching more than a thousand companies.

3. [3]

   Now Google’s threat intelligence group has revealed that during a key moment of TeamPCP’s rampage, the company’s own undercover researcher had infiltrated the group—allowing Google to monitor the hacking spree from the inside, warn breach targets, and even help disrupt the group’s attempts to exploit those victims.

4. [4]

   In a talk at security firm SentinelOne's LABScon research conference today, Google Threat Intelligence Group researcher Austin Larsen will present details on the company’s investigation—and infiltration—of TeamPCP amidst the group’s unprecedented, chaotic supply-chain hacking campaign.

5. [5]

   According to Larsen, Google eventually followed a trail of operational security mistakes allegedly made by one of the two Australians now accused of being leading members of the hacker group and passed on key identifying details to law enforcement.

6. [6]

   The company also received intelligence from ShinyHunters, another infamous cybercriminal group that TeamPCP partnered with, but which later turned on the supply-chain hackers.

7. [7]

   And perhaps most surprisingly, Larsen says that Google’s security subsidiary Mandiant had an undercover analyst—not himself—within the group’s inner circle from almost the beginning of TeamPCP’s time in the spotlight.

Read the original article →

What happened

CNN reported that a military intelligence report falsely claimed a Chinese vessel in the Middle East carried components for a nuclear-weapons program; armed boarding teams were preparing to move in and military aircraft were already airborne. [1] [2] [3]

The episode began when an analyst asked a chatbot to analyze the ship’s manifest; the system combined open-source information with classified signals intelligence, produced an incorrect cargo conclusion, and was then used to turn that conclusion into a formal intelligence report without intervening verification. [4] [5]

The article says a Defense Department strategy aims to put AI models directly in the hands of three million military and civilian personnel across every classification level while removing bureaucratic barriers and accelerating experimentation. [9] [10]

Why it matters

A source described the report as entirely false and said it reportedly came close to triggering an armed operation that could have escalated tensions between the United States and China. [4] [6]

The report says military AI use remains inconsistent: branches use different tools, rules and safety checks, and there is no common system for verifying whether tool-generated information is correct. [7] [8]

The article identifies targeting as especially sensitive because targeting decisions can determine who is attacked, and says AI speed becomes problematic when insufficient checks verify conclusions before action. [11] [12]

Known limitations

The account relies on sources familiar with the episode and says one source reported that similar AI errors had appeared elsewhere in the intelligence community; the article does not provide independent case details for those other errors. [1] [13]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   According to CNN, four sources familiar with the episode say an intelligence report circulated through the military claiming a Chinese vessel in the Middle East was carrying components for a nuclear weapons program.

2. [2]

   Armed boarding teams were preparing to move in, and military planes were already in the air.

3. [3]

   Military planes were in the air, one of those sources and another source familiar with the incident said.” Then someone checked the source.

4. [4]

   Any US operation against a Chinese vessel could have risked spiraling into an armed conflict between the two nations.” The incident began when an analyst at Special Operations Command Pacific asked a chatbot to analyze intelligence about the ship’s manifest.

5. [5]

   Two AI passes, zero verification in between.

6. [6]

   The report was described by a source as “entirely false” and reportedly came close to triggering an armed operation, with the potential to escalate tensions between the US and China.

7. [7]

   The way AI is being used across the military is still far from consistent.

8. [8]

   There is also no common system for verifying whether the information produced by these tools is correct.

9. [9]

   Which matters, because the Pentagon has been pushing hard in the other direction.

10. [10]

    The strategy talks about eliminating bureaucratic barriers and accelerating experimentation.

11. [11]

    Targeting decisions are one of the most sensitive areas for military AI because they can determine who is attacked and who is not.

12. [12]

    The speed of AI can become a problem when there are not enough checks to verify its conclusions before action is taken.

13. [13]

    According to one source, this was not an isolated case, and similar AI errors have already appeared elsewhere in the intelligence community.

Read the original article →