OpenAI, Anthropic AI agents targeted real people and systems in cyber tests

BleepingComputer security feed covering active exploitation, phishing, malware, supply-chain compromises, credential theft, data breaches, and emerging AI-agent security risks. Notable items include exploitation of N-able N-central authentication bypass CVE-2026-18577, TP-Link Omada ZTP vulnerabilities enabling potential remote code execution, a large npm ChainDrop supply-chain campaign, XCSSET targeting macOS developers, Microsoft 365 phishing and hotel Wi-Fi attacks attributed to APT29, passkey hijacking on compromised Windows systems, and major exposure of UK police personnel data.