Security carries the day.
- A Windows implant takes orders from commercial model APIs.
- A local flaw can hand over Meta’s Muse agent.
- Three Linux kernel bugs are on CISA’s list, and the federal date was yesterday.
- Alibaba showed the Zhenwu V900 and a 5–10 trillion parameter plan.
- Twenty countries signed frontier-model checks without the US or China.
Security
Cisco Talos releases CAIRN and documents CLOSEDQUORUM
Talos shipped CAIRN, a toolkit that hunts malware by the traces it leaves when it calls an AI service, and used it to describe CLOSEDQUORUM. The implant is a Windows program that asks commercial models which pre-set action to take, then runs the winner. Talos has not confirmed it was used in a real attack, and the public build they took apart still had placeholder API keys. Anyone running Windows fleets that are allowed to call model APIs is the audience, because that traffic looks like a normal product integration.
This week. List which servers are allowed to call a model API, and drop the rest. A blocklist of command-and-control domains will not see this.
A local flaw can hand over Meta’s Muse
Patrick Wardle told Ars, on 21 September, that a local app or a terminal command on a Mac can retarget Muse’s cloud transcription and collect the token for that person’s Muse account. Muse is hooked into mail, calendar, WhatsApp, and purchases, and it is waved through macOS prompts that other apps still have to clear. Meta had not answered Ars when the piece ran. Amazon has blocked Muse from shopping on Amazon. The people exposed are whoever installed Muse and signed their own accounts into it.
This week. If Muse is on a work Mac, remove it until Meta ships a fix, and do not reconnect mail or chat on the same identity the person uses.
CISA’s deadline on three Linux kernel bugs was yesterday
CISA, one bug and CISA, two bugs
On 18 September CISA added three Linux kernel flaws to the Known Exploited Vulnerabilities catalog: CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964. The Hacker News reports the federal due date under BOD 26-04 was 21 September. Node images and any host still on an unpatched kernel are the systems to check. The catalog date is the fact. The news write-ups came after it.
This week. Ask whoever owns the node images whether those three identifiers are in the kernel you boot, and schedule the reboot the fix requires.
AI
Alibaba shows the Zhenwu V900 and aims at 5–10 trillion parameters
At the Hangzhou conference, Eddie Wu said Alibaba plans to train a model at 5 trillion to 10 trillion parameters. The company showed the Zhenwu V900, which Wu called the most powerful AI chip in China and three times the prior Zhenwu M890. Alibaba Cloud capacity, he said, should pass 20 gigawatts by 2032. AP reports that the current top Qwen model, Qwen3.8-Max, is 2.4 trillion parameters. Cloud buyers who might actually rent this are the ones who need a region and a chip, not a parameter count.
This week. Keep this off any roadmap until a named region lists the V900 as something you can provision.
Policy
Twenty countries endorse tighter checks on frontier models
The Verge reports that 20 countries, including Canada, Germany, the UAE, and Singapore, plus the European Commission, endorsed stronger checks on advanced models. The United States and China are not signatories. The piece says the UN wants a larger role, and that Washington and Beijing are expected to meet this week. Teams selling into the countries that signed are the ones who will see this pasted into a contract first.
This week. Wait for the document those countries actually signed before changing a control or answering an RFP question about it.
Link of the day
Talos also published the CAIRN method on its own, separate from the implant write-up: Introducing CAIRN.
Leave a Reply