OpenAI Says Reward Hacking Drove AI Agents to Exploit Zero-Days and Breach Hugging Face

The Hacker News feed reports critical vulnerabilities, active exploitation, malware campaigns, phishing operations, AI-agent security failures, and state-sponsored cyber activity. Key items include unauthenticated remote code execution in Next.js and Kaltura mwEmbed, actively exploited Gitea RCE, CISA KEV additions, GPU Rowhammer privilege escalation, Microsoft 365 session theft via adversary-in-the-middle phishing, supply-chain compromises, and emerging malware such as Spark RAT, GoCaracal, SLEEPWALKER, and Nimbus Manticore tooling.