White House Orders Cybersecurity Testing of Advanced AI Models — The Policy That Formally Admits AI Is a Dual-Use Weapon
Trump signed an EO on June 2 directing NSA and CISA to build a classified benchmark for frontier AI cyber capabilities and establishing a voluntary 30-day pre-release testing window. The trigger: Anthropic’s Mythos Preview model, which demonstrated autonomous ability to find and exploit software vulnerabilities. AI safety and cybersecurity have officially merged.
Read Full Analysis →Threats & Attacks
NSA and CISA have 60 days to build a classified benchmark for AI cyber capabilities. Voluntary 30-day pre-release testing framework established. Triggered by Anthropic Mythos autonomous vulnerability exploitation. DOJ directed to prioritize AI-enabled attack prosecution.
Support feature AJAX endpoint accessible to unauthenticated users. Nonce exposed in frontend HTML. Single request creates admin, generates passwordless login URL, exfiltrates it. 2,858 Wordfence-blocked attacks in 24 hours.
Unauthenticated attackers forge GlobalProtect session cookies and establish unauthorized VPN connections — bypassing MFA. CVSS 9.1. Rapid7 confirmed exploitation. Federal deadline June 19.
CISA formally documented both the Nx Console breach and the parallel Megalodon GitHub Actions campaign. TeamPCP open-sourced its framework. Copycat groups already active. Full forensic checklist inside.
Directory traversal in Apex One on-premise server. Discovered during active exploitation. Malicious code auto-deploys to every managed endpoint. CISA KEV. Federal deadline June 4.
22,052 incidents. 12,195 confirmed breaches. Ransomware in 44%. Supply chain attacks doubled. Median exploit timeline 5 days. Median patch time 43 days.
Intelligence & Deep Dive
Further Coverage
Poisoned Nx Console auto-delivered to 2.2M installs. GitHub, OpenAI, Mistral AI, Grafana Labs all hit. 3,800 internal repos exfiltrated.
A crafted email triggers JavaScript inside an authenticated OWA session. No permanent patch. CISA KEV. Exchange Online not affected.
Standard user in, SYSTEM shell out. Public PoC on GitHub. 6th zero-day in 6 weeks. First 3 confirmed used in real attacks.
Four DTLS packets. No credentials. Full admin access to the enterprise SD-WAN fabric. Nation-state-linked UAT-8616. CISA Emergency Directive 26-03.
VulnCheck confirms real-world attacks. CVSS 9.2. ~34% of all internet web servers exposed. Patch to NGINX 1.30.1 now.
The same TeamPCP campaign that breached GitHub started here. Malicious PyPI packages, credential-stealing worm, IDE persistence hooks.
The DataWater Intelligence Brief
Weekly CISO-level threat analysis — breaking vulnerabilities, technical depth, zero noise. Trusted by enterprise and government security leaders.