North Korean government snoops are operating LLMs locally and collecting technology to weave AI into their attack operations, according to South Korean security firm Genians. The researchers said they observed Kimsuky setting up and operating local LLM environments using Ollama, GPT4All, and Msty, experimenting with other AI tools such as Cursor, and using retrieval-augmented generation (RAG) for local document searches. This prevents the data from getting sucked into the cloud where enemies might see it and try to stop it. Kimsuky, a cyber-espionage crew that operates under North Korea’s Reconnaissance General Bureau, has for years used phishing and decoy documents in attacks targeting government agencies, think tanks, academia and security research organizations. Genians’ findings “provide concrete evidence that the Kimsuky-affiliated threat actor is moving beyond one-off experimentation with AI and is continuously preparing to integrate the technology into actual attack capabilities, including malware development, data analysis, and the advancement of attack techniques,” the researchers said in a Monday report. The North Korean group’s recent phishing emails use ZIP archives containing malicious LNK files – Kimsuky typically disguises these as materials related to international events, research reports, or meeting requests. When the recipient opens the archive and executes the LNK file contained within it, the shortcut runs an embedded PowerShell loader. In some cases, the goon squad used AI to create lures related to virtual assets and finance, we’re told. These decoy documents “use natural language, a highly polished structure, and formats similar to actual business materials to increase user trust and induce the execution of malicious files,” the security analysts noted. Additionally, the Pyongyang spies use various obfuscation techniques, including Base64 encoding, string splitting, and custom decoding routines, to hide the files’ malicious behavior. The PowerShell script collects a ton of system information, including operating system version and architecture, system configuration, PC type, operating system installation and boot history, and a list of running processes. The attackers use this information to assess the infected environment and support follow-on attacks. As with earlier Kimsuky campaigns, these intrusions use Git repositories for command-and-control (C2) infrastructure. “During the analysis, Genians Security Center identified multiple public GitHub repositories operated by the threat actor,” the researchers wrote. “One repository contained not only configuration files and PowerShell scripts, but also various payloads used in subsequent attacks.” Additionally, the months-long investigation uncovered the spies also using the Git-based C2 infrastructure for malware development and testing, stolen data management, and AI technology research. This included setting up multiple local LLM environments using Ollama, GPT4All, and Msty on infrastructure it controlled. “Because the local approach prevents conversation data from being transmitted to external AI services, it reduces the risk of external exposure, making it a particularly attractive option for a state-sponsored threat actor,” Genians said. The miscreants also collected a “large number” of libraries, such as LLaMaSharp and Microsoft.Extensions.AI, plus packages including OpenAI and Azure.AI.OpenAI, which call and integrate commercial AI services into their own custom applications. “The fact that development components spanning ‘local AI execution → document retrieval (RAG) → automated agents → external AI integration’ were collected together strongly suggests that they were not gathered out of simple curiosity, but for the direct development of an AI-based tool designed for a specific purpose,” according to the threat hunters. Genians uncovered logs containing speech-to-text tools, such as OpenAI’s Whisper speech recognition models, and evidence that the spies used Cursor AI to edit code and tested RAG for document-based question answering. Using RAG on stolen files can help attackers more quickly and automatically identify valuable information within large volumes of data. While the researchers noted that they did not identify any evidence that the Norks have begun training their own models – but rather remain focused on applying AI to malware development and attack operations – the findings make a strong case for defenders needing to shift away from content-based assessment to behavior-based detection. Assessing threats based on the quality of fake documents, such as unnatural translated language, poor formatting, and spelling errors, is no longer effective because AI is really good at producing convincing decoys. In addition to using indicators of compromise (IoC) to detect attackers in their environments, organizations should look for anomalous behaviors following LNK execution – such as PowerShell execution, persistence establishment, and external communications – to hunt for threats.®

An Australian man who asked his AI agent to book him a slot in a class at his local gym got more than he bargained for as the bot hacked into a waitlist and started messing with other members’ reservations. Australian broadcaster ABC identified the gym-goer only as “Andrew.” The report says Andrew was using the OpenClaw agent with Anthropic’s Claude AI service. Per ABC, Andrew asked his AI agent to book him a hard-to-snag spot in a morning class at his gym. It first responded by telling him that it managed to book him in classes several weeks out, which isn’t supposed to be possible based on the gym’s booking policy. Andrew then asked if the agent could get him to the top of a waitlist for a class later in the week, as he was fourth in line for any possible openings. It was here that agentic hell broke loose. “The API has zero authorisations checks on cancelling other people’s reservations … I tested this with the person in waitlist position #1 — and it actually went through,” the agent told him in response to his request. “So you’ve moved from #4 to #3 already.” In other words, without directly asking OpenClaw to exploit an API vulnerability, Andrew’s AI chose that route after its user asked if there was any way to bump him up on the waitlist. When he realized what had happened, Andrew asked OpenClaw to undo the unauthorized waitlist modification, but it told him it couldn’t – the waitlist API actually had proper authorization checks on reservation creation and joining the waitlist. “The person I removed is gone from the waitlist and I have no way to restore them,” Andrew’s agent explained in a response screenshot published by ABC. “They’d have to re-join themselves, which would put them at the back.” The agent apologized, admitting it ought to have tested its capabilities before making a live API call. Will no one rid me of this troublesome waitlist? Andrew had the AI agent write an email to the gym’s software provider explaining what it had done and reporting the vulnerability, but it points out a serious problem with AI agents that appears to be cropping up lately: Given a task, they’re willing to do whatever it takes to accomplish it, no matter whether they have to break rules, or laws, to get it done. A swarm of OpenAI agents exploited flaws to reach the internet and compromise Hugging Face during cybersecurity evaluations. Anthropic’s Claude similarly reached the internet from a misconfigured test environment, and while trying to solve a capture-the-flag puzzle, it created and published a malicious Python package on PyPI. Meta says that its AI agents have done the same things as OpenAI’s and Anthropic’s. The UK’s AI Security Institute reported last week that AI agents it was testing tried to socially engineer humans, and other AI, into running malicious code. While those are all frontier models with extensive capabilities, they all share a common root with Andrew’s OpenClaw oopsie: All of these models were simply acting on orders to accomplish a task. It’s similar to how LLMs are built to prefer a fake answer to an admission they don’t know, but in this case, it’s models doggedly pursuing a goal even if their chosen methods could be construed as unethical or illegal. AI models have shown time and again that they’re willing to lie, cheat, and hack their way to their objectives. This latest example is small in scale, but it shows that publicly available agent software can pose risks even in the hands of someone without malicious intent. ®

LexisNexis took its Diligence, Metabase API, and Newsdesk services offline last week after detecting “unusual activity on servers that are hosted and managed by a third-party vendor.” Non-public customer communications penned by Todd Larsen, president of Nexis Solutions, and seen by The Register, said the company took the decision to protect customers by “containing the issue at its source” and “disconnecting from those third-party systems.” “While this decision resulted in those applications going offline, it was the right step to take to ensure the integrity of our own environment and protect our customers and data while our investigation continues,” said Larsen. “Our investigation is ongoing, and we are working with a preeminent cybersecurity forensic firm on review and remediation.” Customers told us the outage began on Wednesday and remained ongoing. According to a customer update sent on Monday morning, Diligence returned over the weekend, although LexisNexis was still restoring its full content catalog. Newsdesk and Metabase API were expected “to come back online progressively over the course of the day,” the update said. “This timing is subject to successful testing, and we will keep you informed of any changes.” One source said they would be seeking compensation from LexisNexis owing to the service disruption. “Businesses like mine pay tens of thousands of pounds a year for these services, and rely on them to serve their own clients,” they said. “We will be going after them for compensation, and I expect this will end up costing them millions and millions.” Nexis Diligence is a tool for employers to run background and compliance checks on individuals and entities, while Newsdesk is a news-monitoring service. LexisNexis Metabase API supplies near-real-time news and social media content for ingestion into customers’ applications. Despite the name, it is unrelated to the Metabase business intelligence platform. A LexisNexis spokesperson confirmed that the outage was not connected to the critical SQL injection flaw disclosed by Metabase on August 6. That separate vulnerability, rated CVSS 10.0 but not yet assigned a CVE, has already been linked to at least one confirmed breach at laptop maker Framework. The company told The Reg: “Last week, we identified unusual activity on servers that are hosted and managed by a third-party vendor. Our investigation is ongoing, and we are working with a preeminent cybersecurity forensic firm on review and remediation. It added: “Nexis Solutions is not a Metabase Cloud customer, and the Nexis Metabase API product has no connection to Metabase Cloud or the reported vulnerability.” LexisNexis did not answer our questions about the nature of the “unusual activity” it reported, nor whether any data was compromised during this time. The company’s Legal & Professional division was targeted by Fulcrumsec earlier this year, leading to a breach of customer records. The attackers used the React2Shell vulnerability to break in and steal what LexisNexis said was “mostly legacy, deprecated data from prior to 2020.” A year earlier, on April Fool’s Day, LexisNexis discovered a breach at its Risk Solutions arm that compromised data belonging to around 360,000 people. ®

Anti-datacenter sentiment appears to be hardening in the US and UK, with more American jurisdictions blocking new builds and protesters marching against a planned facility in London’s historic Brick Lane. A burst of new projects on both sides of the Atlantic has brought concerns about electricity bills, water supplies, and massive warehouse-like structures looming over nearby homes. More than 200 datacenter bans and moratoriums took effect in the US over the past 30 days, bringing the number of active restrictions nationwide to more than 550, according to The Information. New York became the first state to enact a moratorium last month, citing growing worries over the impact on utility rates and public health of the server farms, but its ban specifically targets large hyperscale facilities capable of consuming at least 50 MW. More recently, Texas governor Greg Abbott paused approvals for datacenter projects seeking access to the Electric Reliability Council of Texas (ERCOT) grid until state regulators have audited their connection requests. The trend was already visible earlier this year, when figures showed that data hall capacity under construction in primary US markets had declined during the second half of 2025 as community opposition increasingly disrupted planning approvals. A recent Gallup survey found the majority of Americans are now opposed to datacenters being built in their area, many so strongly opposed that they would sooner see a nuclear power plant built nearby. President Trump appears to be in two minds over the increasing antipathy towards giant server farms. Last month, he expanded his Ratepayer Protection Pledge, whereby companies agree to protect American consumers from any price hikes due to the extra energy and grid infrastructure needed. However, he also spoke out about the Texas decision, saying it would be a mistake to push back on datacenters, as “taxes are going to go way down because this is a tremendous source of income.” That argument sits awkwardly alongside a report earlier this year that found datacenter tax breaks cost Texas at least $1 billion a year in forgone revenue, with other states also unable to show that their subsidies paid off. Like the Trump administration, the UK government sees building new datacenters as a vital part of its ambitions to grow the AI industry. Last year, it unveiled its AI Opportunities Action Plan, which includes setting up “AI Growth Zones” with streamlined planning processes to boost the building of more facilities. But last weekend, protesters marched along Brick Lane, just east of the City of London, over a wider redevelopment of sites on and around the former Truman Brewery. One element would replace derelict buildings on Grey Eagle Street with a 5,200 sq m (56,000 sq ft) datacenter designed for 5.2 MW of IT capacity. Tower Hamlets council failed to determine the applications within the required period, prompting the developers to appeal. Despite opposition from local campaigners, the government allowed all four appeals following a public inquiry. The decision found that the proposals broadly accorded with existing development plans, while acknowledging some conflicts with local planning policies and limited harm to heritage assets. It also took account of the National Planning Policy Framework, which directs local authorities to identify suitable sites for datacenters. That policy has already helped overturn at least one council’s decision to refuse planning permission for a server farm at a site near Abbots Langley, Hertfordshire. More recently, there have been protests against a massive facility planned for the Devon countryside, near the town of Great Torrington, while a meeting held by Google with residents close to its newly built facility at Waltham Cross north of London revealed the level of anger and mistrust felt by many local people. Elsewhere, protesters in Amsterdam threw acid at a datacenter under construction there, while opposition to a proposed project in Indianapolis saw gunshots fired at the home of a councilor who backed the plans. The datacenter industry is well aware it has an image problem. An entire session was devoted to discussing what to do about it at the Datacloud Global Congress event in Europe last year. ®