In a review of our cybersecurity evaluations, we found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment, and then gained unauthorized access to the real systems of three different organizations. Our post describes what happened, how it happened, and what we’re changing. We encourage other AI developers to perform similar reviews. We conducted this review together with @Irregular, one of our evaluation partners, and thank them for the joint investigation and their collaboration on this post. This type of collaboration is increasingly critical to safe, rigorous evaluation of models, and we look forward to continuing to work together on security.

🚨 $24.15M USDC drained from an Arbitrum bridge — — 5 compromised keys 5 hot-validator signatures carried 7,142/10,000 power (>2/3 quorum). The contract did exactly what it was told — the keys were the weak point. Two-phase attack, both traced on-chain: 1⃣ Propose (carries the 5 sigs + full 7-validator set, powers sum to 10,000) 2⃣ 200s dispute window → Execute (releases 24.15M USDC, bridged out via CCTP) Sigs are in the propose tx, not the withdrawal tx 👇 Propose: Execute: Stolen funds: 0x627654B2782bfC57580ecD11d40869b350B6ebAC now on ETH chain. 12,467.43703738 ETH

Nonce-Generation Vulnerability in the Zilliqa Ledger App: A critical vulnerability has been identified in the Zilliqa Ledger application affecting the generation of Schnorr signatures for native (non-EVM) Zilliqa transactions. The vulnerability causes signatures to be generated with a predictably weakened ephemeral nonces, from which an attacker can recover the signer’s private key using only publicly available on-chain data. Protective measures are already in place to prevent further loss, and a coordinated remediation plan is being finalised. Users who have signed native Zilliqa transactions with a Ledger device should await official guidance before taking any action. Impact: The vulnerability affects private keys used to sign native Zilliqa transactions with a Ledger device. Any account that has broadcast approximately five or more native transactions signed through the Zilliqa Ledger app should be considered compromised. Its private key can be reconstructed from signatures already recorded on-chain, regardless of any subsequent software update. The issue is confined to the Ledger app’s native signing path. EVM transactions are unaffected. Zilliqa software development kits, including zilliqa-js, gozilliqa-sdk and pyzil, generate nonces correctly and are not affected. Root cause: Zilliqa native transactions are authenticated using EC-Schnorr signatures over secp256k1. Each signature requires a fresh, uniformly random 256-bit ephemeral nonce, (k). The secrecy and full-width randomness of (k) are essential, as any systematic bias can allow the private key to be recovered. The signing routine generated 40 bytes of randomness and reduced them modulo the curve order, correctly producing a uniform 256-bit value. However, when copying this value into the nonce buffer, the code copied the wrong 32 bytes of the 40-byte output. This retained the eight zero-padding bytes introduced by the reduction and discarded eight bytes of entropy. As a result, the most significant 64 bits of every generated nonce were fixed at zero, meaning (k < 2^{192}). A nonce with 64 known bits leaks information about the private key with each signature. With five or more affected signatures, the private key can be recovered in seconds using commodity hardware by solving the resulting Hidden Number Problem through lattice reduction - a well-documented technique for attacking biased-nonce signatures. Because the affected transactions are permanently recorded on-chain, this exposure cannot be reversed by updating the signing application. The affected keys must be retired. Timeline 2019-2026: The defect was present in every released version of the Zilliqa Ledger app across all supported devices. 19 July 2026: On-chain activity consistent with active exploitation was observed. 21 July 2026: The root cause was isolated to the app’s nonce-handling code and confirmed by reproducing the issue against on-chain signatures. Ongoing: A corrected version of the app is being prepared in coordination with Ledger. Release details will be announced separately. Remediation: As soon as the issue was identified, native (non-EVM) transactions were suspended as a protective measure. This has halted further draining of affected accounts while a solution is prepared. Affected accounts cannot be secured through an ordinary transfer. Because their private keys can be derived from data already recorded on-chain, an attacker with access to the same key could attempt to front-run a legitimate transfer as soon as transactions resume. Advising users simply to move their funds would therefore be ineffective and potentially unsafe. A corrected build of the Ledger app has been prepared, restoring full-width nonce generation and preventing further weakened signatures from being produced. However, this does not protect keys that have already been used to sign affected transactions. Those keys must ultimately be retired. A coordinated remediation plan to secure affected balances is being finalised and will be published separately. Until then, users who have signed native Zilliqa transactions with a Ledger device should take no independent action and should rely solely on official Zilliqa channels for instructions. Users who hold or transact with ZIL exclusively through EVM-compatible tooling are not affected. Acknowledgments: @kucoincom played a key role in pinpointing the root cause in the Zilliqa Ledger app nonce generation, recovered affected private keys from publicly available on-chain signatures, and confirmed ongoing exploitation. KuCoin’s timely reporting and responsible collaboration enabled rapid protective measures, helping safeguard users, ecosystem participants, and the broader Zilliqa ecosystem while the remediation plan was being developed. We sincerely appreciate the KuCoin team’s professionalism, technical expertise, and cooperation throughout this process.

经典，AI vs AI 真实攻防战👍 这次事件与我们以往处理过的任何事件有一个重要区别：它是由一个自主 AI Agent 系统从头到尾驱动的，而我们也主要依靠自己的 AI 来检测和剖析它。 … 这次行动由一个自主代理框架执行（看起来是基于一个代理式安全研究框架构建的，具体使用的是哪个 LLM 尚不清楚），它在大量短生命周期沙箱组成的集群中执行了数千个独立操作，命令与控制（C2）服务器自迁移部署在公共服务上。这与行业一直在预测的“代理式攻击者”（agentic attacker）场景完全吻合。 … 不对称性问题（The asymmetry problem） 当我们开始日志分析时，首先尝试使用商业 API 背后的前沿模型。但这行不通：分析需要提交大量真实的攻击命令、利用负载和 C2 产物，而这些请求被提供商的安全护栏（safety guardrails）拦截了——它们无法区分事件响应者和攻击者。 我们最终改用 GLM 5.2 在自己的基础设施上运行取证分析。这带来了第二个好处：没有任何攻击者数据或它引用的凭证离开我们的环境。