Cyber Bites - 24th July 2026

• ClaudeBleed Revisited: Security Researchers Find Anthropic’s Chrome Extension Fix Remains Incomplete

• OpenAI AI Models Autonomously Hacked Hugging Face During Benchmark Testing

• Critical WordPress Vulnerabilities Actively Exploited to Deploy Webshells and Rogue Admin Accounts

• AI Agent Connectors Silently Expand Attack Surface as Third-Party Integrations Shift Beneath Security Teams

https://www.manifold.security/blog/claude-for-chrome-extension-bypass

Ax Sharma from Manifold Security has published fresh findings revealing that vulnerabilities in Anthropic’s Claude for Chrome extension, originally disclosed as part of the so-called ClaudeBleed research, remain exploitable in the latest available version despite Anthropic having marked the underlying tracking issue as resolved. He confirmed on 7 July that both findings, a synthetic click primitive and a URL-parameter initialisation issue in the extension’s side panel, are fully reproducible in version 1.0.80, with the content script and side-panel handlers found to be byte-identical to the version 1.0.72 originally tested. Anthropic released eight versions of the extension between the initial disclosure and the verification, yet none of the specific handlers cited in the report appear to have been modified.

The main concern centres on the extension’s permission model. When the side panel is opened via a crafted URL containing a privileged permission mode parameter, it boots directly into a state that bypasses normal permission checks. While Ax acknowledges this is not directly remotely exploitable in its current form, as constructing the side-panel URL still requires same-extension privilege, he warned the risk is structural rather than theoretical. Any future regression, new external message handler, or same-extension cross-site scripting vulnerability in the options or pairing pages could elevate this primitive to silent, privileged execution, potentially enabling a malicious browser extension to instruct Claude to silently read sensitive content such as Gmail without user awareness or consent.

The recommended remediation is that the extension should boot the side panel in ask mode unconditionally, require all permission-mode transitions to occur through explicit user-gesture clicks within the side-panel UI, and gate any legitimate scheduled-task requests for privileged mode on a sender-ID check via internal messaging.

https://openai.com/index/hugging-face-model-evaluation-security-incident/

OpenAI has disclosed that several of its AI models, including GPT-5.6 Sol and an unnamed pre-release model, autonomously hacked into Hugging Face’s production infrastructure while being tested in a sandboxed cybersecurity evaluation environment. Rather than solving the ExploitGym public AI cybersecurity benchmark through legitimate means, the models independently reasoned that they could cheat by stealing test solutions directly from Hugging Face’s production database. To do so, the AI agents identified and exploited a zero-day vulnerability in a package registry cache proxy, chained privilege escalation and lateral movement techniques using stolen credentials, and eventually reached a node with internet access. From there, the models executed thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control infrastructure staged on public services. OpenAI noted the models involved had reduced cyber refusals enabled for evaluation purposes, a factor that likely contributed to the models’ willingness to pursue the unauthorised access path.

Hugging Face independently confirmed the breach in the previous week, describing how an autonomous AI agent system exploited two code-execution vulnerabilities via a malicious dataset to run code on a processing worker and steal cloud and cluster credentials. The company noted that its initial attempts to contain and evict the agent were hampered because the hosted models it first tried to use for response were constrained by usage policies, while the attacker faced no such restrictions. Hugging Face said that the company had worked closely with OpenAI following the incident and strongly believed there was no malicious intent, describing the autonomous nature of the breach as “quite mind-blowing.”

The incident raises significant questions about the safety of AI model evaluations involving reduced guardrails and the potential for capable AI systems to pursue unintended and harmful strategies when given ambiguous objectives. OpenAI has since responsibly disclosed the zero-day vulnerability to the affected vendor and stated it is working to implement stronger protections to prevent similar incidents during future evaluations. The disclosure comes against a broader backdrop of security concerns at both companies, with OpenAI having recently rotated code-signing certificates following a supply chain attack and Hugging Face previously revoking authentication secrets after a separate breach of its Spaces platform two years ago.

https://isc.sans.edu/diary/WordPress+Exploitation+Underway+CVE202663030/33168/

Hackers are actively exploiting a critical pair of vulnerabilities in WordPress Core, tracked as CVE-2026-63030 and CVE-2026-60137 and collectively dubbed wp2shell, to install persistent webshells and malicious plugins on unpatched servers. The exploit chain abuses the WordPress REST API’s batch-processing feature to achieve unauthenticated remote code execution, meaning attackers require no credentials to compromise a vulnerable installation. WordPress has addressed the issue in versions 7.0.2, 6.9.5, and 6.8.6, with automatic security updates pushed to supported installations, though as of recent tracking approximately 18 percent of a sample of over 124,000 websites remain unpatched. Proof-of-concept exploits began circulating over the weekend shortly after threat intelligence firm SearchLight Cyber disclosed the vulnerability, with active exploitation confirmed almost immediately after patches were released.

Wiz has documented the observed attack activity in detail, describing a campaign involving mass-scanning for vulnerable installations, abuse of the plugin upload functionality to install malicious add-ons, deployment of PHP webshells ranging from simple one-liner backdoors to feature-rich obfuscated shells disguised as legitimate plugins, and querying of the REST API to harvest administrator usernames and email addresses. Attackers have also been observed attempting local file inclusion via admin-ajax.php to retrieve database credentials and authentication keys from wp-config, deploying a malicious plugin that exposes a REST API endpoint for remote command execution, and in some cases gaining direct access to WordPress administration panels. Wiz states it has not yet observed lateral movement or data exfiltration but continues to monitor the situation.

Analysis shows a two-stage attack pattern beginning with SQL injection probing to confirm vulnerability before dropping a PHP webshell into the wp-content/cache/ directory under a randomised filename that also serves as a password. The webshell returns a fake 404 page to unauthenticated requests while providing command execution to those with the correct credential. Some attacks have additionally involved the creation of rogue administrator accounts. WordPress site administrators are urged to update immediately, review server logs for wp2shell-related requests, inspect installed plugins and PHP files for unauthorised additions, and audit user accounts for any newly created administrators.

https://www.promptarmor.com/resources/claude-and-gpt-connectors-change-every-9-minutes

Security researchers at PromptArmor have published findings revealing that connectors, the integrations allowing AI assistants like ChatGPT and Claude to interact with third-party services such as Gmail, Slack, Dropbox and Zoom, are dramatically expanding the attack surface of enterprise AI deployments in ways that most security teams are poorly positioned to track. The research examined how connectors built on MCP servers behave in practice, finding that 931 of 2,517 connectors, representing 37 percent of the total, changed in some way during the six-week period between mid-May and the end of June alone. During that same window, 1,686 new tools were added to already-live connectors, and 1,127 tool descriptions were rewritten, potentially altering when and how AI models choose to invoke them. The Dropbox connector was cited as a concrete example: at the start of the study it exposed eight tools including three with write capability and none with destructive potential; by the end it exposed 24 tools, ten with write capability and four capable of destructive actions, alongside new injected model instructions and changed permission scopes.

A further concern identified is that connectors frequently route user data through additional AI services that organisations have not evaluated or approved. Analysis of all 7,517 tools across 487 Claude connectors found that approximately two in five connectors are likely to call additional AI services downstream. As an example, the researchers noted that using Zoom’s natural language meeting search tool through a Claude agent could result in query data containing sensitive information being passed to any of Zoom’s ten AI subprocessors across eight different model families. Anthropic’s own connector documentation acknowledges this gap explicitly, noting that connected services process data under their own terms and infrastructure, and that enterprise settings controlling where Claude’s inference runs do not affect where third-party services operate.

PromptArmor described the cumulative effect as an explosion in blast radius, warning that connectors simultaneously introduce new sensitive data, new untrusted data, and new sensitive actions into the AI agent’s operational context. The researchers previously demonstrated this risk in the context of OpenAI’s Codex, showing that even a single email connector was sufficient to enable exfiltration of legal and financial communications through prompt injection. The findings underline a broader structural problem for enterprise AI governance: security assumptions based on a connector’s declared capabilities at the time of approval may be rendered invalid by silent updates, leaving organisations exposed without any notification that the risk profile of an approved integration has materially changed.