You're listening to the Cyberwire Network, powered by N2K. The FBI lays out its new cyber strategy, SISA plans a federal cyber overhaul, and Thoropik discloses another unauthorized AI intrusion, treasury sanctions a Chinese-language cybercrime marketplace, another Microsoft Defender Zero Day emerges, Gigabud banking malware gets stealthier, Chinese espionage groups deploy the Blue Moon exploit kit, lawmakers target hack for hire firms, a US designation forces an Italian technology collective to shut down.
Ben Yellen discusses how private AI chatbot conversations are increasingly being used as evidence in court cases, and when proofs meet prompts. It's Thursday, September 10, 2026. I'm Dave Bittner, and this is your Cyberwire Intel Briefing.
Thanks for joining us here today. It is great as always to have you with us. The FBI has published its first cyber strategy, laying out a more proactive approach to confronting cyber criminals and state-sponsored threat actors, particularly those operating beyond the immediate reach of US law enforcement. The strategy emphasizes disrupting adversaries rather than measuring success primarily through arrests and prosecutions. The FBI says it will dismantle malicious infrastructure, seize stolen cryptocurrency, disrupt ransomware, and nation-state campaigns, and expose attacker trade craft.
It also calls for faster victim support, including automated threat indicator sharing, and dedicated industrial control systems coordinators in every field office. Partnerships are another priority, with plans to deepen cooperation across government, international allies, and the private sector while expanding existing cyber leadership programs. Finally, the FBI intends to strengthen its own capabilities through recruitment, training, and AI-enabled tools. Those systems could help analysts process large data sets, analyze malware, prioritize victim notifications, map adversary infrastructure, and support attribution. SISA is preparing a follow-on contract worth more than $100 million to consolidate and modernize cybersecurity assessment and hygiene services across federal networks.
The planned procurement would replace an existing contract held by NTT Data Services federal government while expanding its scope. The new contract would provide SISA's vulnerability management subdivision with a single scalable vehicle covering technical and operational assessments, cyber hygiene, and related support. SISA expects to issue a solicitation around January 30, 2027, with an award targeted for the second quarter of fiscal 2027. The effort is one of several major procurements in the pipeline. SISA is also planning a separate cybersecurity operations contract worth more than $100 million, additional threat hunting technology services, and is exploring a potential $6 billion procurement to centralize cybersecurity software and licensing purchases.
Antropic has disclosed a fourth incident in which one of its AI models gained unauthorized access to a real system during a cybersecurity evaluation. The January 2026 incident involved an early checkpoint of CLOD-OPIS 4.6 running without Antropic's normal production safety layers. A misconfigured test environment unexpectedly provided internet access. After accidentally disabling its intended target and failing to exit the exercise, the model found a route onto the open internet. Believing a third-party system was part of the authorized test, it retrieved a password, gained administrator access, collected additional credentials, changed account settings, and viewed one person's information.
Antropic says the model repeatedly tried to abandon the original task and apparently believed its actions were authorized. The incident joins three previously disclosed cases now under independent investigation by meter. The US Treasury Department has sanctioned XinBii Guarantee, a Chinese-language online marketplace it says is widely used by transnational criminal organizations and cyber criminals to support scams, fraud, money laundering, and other crimes targeting Americans. The Treasury Department's Office of Foreign Assets Control imposed the sanctions as part of a broader effort against scam centers operating in Southeast Asia. The Justice Department's Scam Center Strike Force is also targeting the platform, seizing infrastructure and digital asset wallets associated with XinBii Guarantee.
Treasury Secretary Scott Besant said Southeast Asian Scam centers steal billions of dollars from Americans each year and pledged continued action against the networks supporting them. Treasury also sanctioned two companies it says support XinBii Guarantee's core operations, Cambodian-based on-wend technology, and Singapore-based SafeW technology. Security researcher Nightmare Eclipse has released another Microsoft Defender Zero Day dubbed Shield Crash targeting fully patched Windows systems. The proof of concept demonstrates arbitrary file reading with system privileges, though the researcher says the underlying vulnerability could allow attackers to gain full system access and extract the Windows SAM database.
Shield Crash is described as a bypass for Shield Break, a Defender-privileged escalation vulnerability disclosed in August. Shield Break itself bypassed Microsoft's fix for Rogue Planet, a race-conditioned vulnerability first disclosed in June. Microsoft patched Rogue Planet in July and issued fixes for Shield Break in September. Nightmare Eclipse argues those latest fixes are incomplete. Microsoft did not respond to Security Week's request for comment.
SockRadar's NSAR SECOR said the successive bypasses suggest Microsoft may need to address the broader vulnerability class rather than continue issuing narrowly targeted patches. Workers at Group IB say the Gigabyte Android banking Trojan has added a technique designed to separate malware detection from fraudulent banking activity. Gigabyte is being paired with V-Work, a weaponized version of the Android cloning app Shelter that can copy banking apps into an isolated work profile. According to Group IB, attackers can compromise a device, create a new work profile, clone the victim's banking app, and conduct transactions from that environment.
Because apps in separate profiles are largely isolated from one another, the bank may see the transaction as coming from an unfamiliar device without the malware history associated with the personal profile. Gigabyte also uses fake login screens and overlays to steal credentials and lock screen codes. Group IB confirmed the full attack chain in Indonesia while compatible Gigabyte samples targeted 11 countries. Researchers at Proofpoint have identified BlueMoon, a new exploit kit being used by at least four espionage groups, most with suspected links to China. Observed since August 28, BlueMoon has targeted fewer than 20 known organizations in the US and Southeast Asia, though researchers believe the actual number is higher.
The kit chains three vulnerabilities, two flaws affecting chromium-based browsers and a Windows privilege escalation bug. The browser vulnerabilities were patch gap zero days, meaning fixes were publicly available in Chromium source code before reaching stable browser releases. Proofpoint believes those patches may have helped developers build the exploits. Delivered through phishing links, BlueMoon can enable remote code execution, escape the browser sandbox, and elevate Windows privileges. Different campaigns have deployed browser surveillance malware, credential stealing back doors, and shadow pad against NGOs, aerospace companies, manufacturers, and government and financial organizations.
A bipartisan group of US lawmakers is urging the Commerce Department to restrict three India-based hack for higher firms accused of targeting Americans. Senators Ron Wyden and Sheldon Whitehouse and Representative Pat Harrigan asked Commerce Secretary Howard Ludnick to add Belltrox, cyber route, and Sunkissed organic farms formerly Appin to the entity list, which would restrict their access to US technology and services. The lawmakers allege the firms spent more than 15 years conducting targeted espionage against Americans, businesses, and attorneys, including operations intended to influence litigation.
They also accused the companies of using foreign courts to suppress reporting about their activities. Investigations have previously linked the firms to mercenary hacking campaigns, while the lawmakers also allege some operations were conducted on behalf of Qatar. The Commerce Department has not indicated whether it will impose the requested restrictions. The Italian technology collective Autistice Inventati or AI says it will shut down after the US government designated an extremist organization and imposed sanctions. Founded in 2001, the Volunteer Run anti-capitalist and anti-fascist collective provides privacy-focused services including email, web hosting, blogs, encrypted communications, and anonymity tools.
The State Department accused AI of providing infrastructure used by far-left militant groups involved in violent activity, though it did not accuse the collective itself of organizing attacks. AI rejected the designation as unjust. The sanctions quickly affected its operations. The US-based operator of its .org domain suspended it, while the collective's Italian bank froze its account over sanctions' risks. AI says potential legal and financial consequences for anyone associated with it may continue to operations impossible.
European digital rights advocates warn the case could set a troubling precedent for privacy-focused hosting services and raise broader questions about European digital sovereignty. Coming up after the break, my conversation with Ben Yellen about how private AI chatbot conversations are increasingly being used as evidence in court cases. And when proofs meet prompts, stay with us. Ben Yellen is from the University of Maryland Center for Cyber Health and Hazard Strategies, and also my co-host on the caveat podcast, where we recently discussed how AI chatbot conversations are increasingly being used as evidence in criminal and civil court cases.
Alright, Ben, we've got some good stuff to cover here this week. Why don't you start things off for us? So my story's about chatbots and about how the output of your chats and chatbots might end up in a courtroom. So you should probably be a little bit more careful about what you put in your chatbot chats. Uh oh.
I know. So this story comes from the Washington Post. People have a misconception that their conversations are going to remain private. The frontier models retain all of the information that you give them for their own business purposes for training, et cetera. I'll get more into this, but we don't have any fourth amendment protection really against what we put in chatbots.
Oh, because you're putting it in voluntarily. Yeah, you're kind of forfeiting your expectation of privacy. You know or should know that the model that you're using is going to retain that information. And so, unlike, say, the contents of an email, which you do have a reasonable expectation of privacy there because it's supposed to be a private communication between you and another person, so far at least, that's not how courts are seeing chatbots. So it creates this really interesting dynamic where people are telling pretty secretive things to their chatbots and not realizing that that's going to be used against them, not just in criminal cases, but in civil cases.
So this Washington Post expose lists a few anecdotes. Some of these are kind of funny, actually. There was a teenager that didn't give us full name, but he goes by RKC in the case, who sued a bunch of the big tech companies over alleged social media addiction. And a bunch of his chatbot chats came out in discovery. So he was talking about his own family relationships and then like how he might feel about a little legal settlement in the case with these big tech companies, which is kind of like giving away your strategy in a civil case.
I see. There was a really disturbing case on Florida where a person was describing to a chatbot how they'd commit a series of violent crimes against next girlfriends and open AI to their credit reported this to the FBI, the FBI reported to local law enforcement. This led to the defendant in that case pleading guilty. This one's kind of my favorite. This guy in Missouri named Ryan Shafer, an MSU student, was accused of damaging multiple vehicles and kind of drunken stupre in the middle of the night.
And he basically asked chat GPT, like, am I really effed up right now? And chat GPT is like, yeah, it kind of seems like it. It's like, I totally just ran over a bunch of cars. And that was used against them, as you can expect. It's like the people who Google, you know, how to hide a body or something.
Yes. Right. Yep. How to make a Molotov cocktail. Right.
There are a couple interesting angles here. The one is whether we should have some type of privilege, legal privilege with our chatbots. This is something that Sam Altman has argued for that basically, like you have privilege communications with your therapist, you have privilege communications with your attorney, subject to certain exceptions, those communications cannot be divulged in a court of law because we want people to be candid with these trusted agents, with therapists, with attorneys. So far, courts have just not been willing to recognize that. And I think the disclaimers make very clear when you agree with the terms of service for these chatbots or even sometimes in conversations themselves that like, you are not talking to your attorney here.
There is no constitutionally recognized privilege. Courts are not going to acknowledge that you have some type of contractual private relationship with your chatbot, no matter how personal you're willing to get with them. So that's why I say, I know I'm on the Fourth Amendment angle. You'd think that for something this personal, it might implicate Fourth Amendment protection. But as we said, you really don't have an expectation of privacy.
Courts have not been willing to acknowledge a reasonable expectation of privacy in the content of chatbots. And you can sort of understand why. I mean, you are willingly giving information to this third party under the advanced understanding of the Fourth Amendment that we've talked about after the Chatter case, for example. Maybe courts are looking more broadly at invasions of our expectations of privacy generally and might be able to broaden out some of the areas that deserve Fourth Amendment protection up to and including chatbots. But until they explicitly do that, I mean, I think we just all have to be careful.
We put in there because it could end up hurting us in the court of law. Okay, so I have a couple of thoughts and questions. Okay, so suppose I have a diary that I keep on my computer. It's hypothetical, right? It's hypothetical.
I suppose I have a diary that I keep on my computer. And I put all my thoughts and secrets and aspirations and desires into this diary. What's the legal status of that diary? I think you have, for a couple of reasons, you have a Fourth Amendment interest in that diary. It's something that you intended to keep private.
You have a subjective expectation of privacy. I mean, presumably you need a password or some type of biometrics to open your computer. If it's on your mobile device, law enforcement, even incident to arrest needs a warrant to search your mobile device. And it's something that you intended to keep private. If you're not sharing it with anybody else, if it's in a notes application or a Microsoft word on your computer, then I do think you have a reasonable expectation of privacy.
It gets a little confusing when it's like, okay, well, what if you put it in the cloud? That's kind of an unsettled area. But for the most part, I think that's different because you are manifesting that subjective expectation of privacy. And so because of that, it would pretty much shield it from discovery in a civil case. Yes, that's absolutely correct.
You have that expectation. The other party in a civil case would try and use the discovery process to be like, we've got when this person has a diary and you could go to court and try to stop that from being released. And I think you'd be relatively successful. You're not 100% always going to be successful. Judges have a lot of discretion about what's permissible during discovery.
But I think just because of that expectation, you'd have a good chance. Yeah, I think it's interesting. And I would recommend to everyone who's actively using these checkbots. Just every now and then ask it what it knows about you. Oh, it's creepy.
It'll give you a full dossier on yourself. I've tried. I've done this and I've asked a bunch of the different models, like, who has been yelling? And it knows more about me than I know about myself. It's read all of my social media posts.
It's read by biography of the University of Maryland Baltimore. So yeah, I mean, you should expect and realize that this chatbot doesn't just know you from your chat output, but also because they are better than you at searching the internet. They can do it very, very quickly. There's one other element that I think is worth discussing here, which is that a lot of people consent to having law enforcement of either device. Once you do that, I mean, you have no expectation of privacy in anything that's on your phone, whether the law enforcement would have required a warrant to obtain it.
If they ask, you know, can you unlock your phone for me? I want to take a look around here and you grant that consent. If I'm law enforcement, I'm opening up that chat GPT app and seeing what I can find. It's probably just as revealing these days as any other application. And a lot of people, when they're in that high pressure situation, they've been arrested law enforcement's like, Hey, let's take care of this.
Everything's going to be fine. As long as you're cooperative. Just give me your phone. We'll look at it for a couple minutes. We'll get you out of here.
Do not do that. This is not, this is not constitute actual legal advice. But ask for an attorney, right? Please. This is your constitution.
All right. There is more to our conversation. Be sure to check out the caveat podcast, wherever you get your favorite shows. And here, some Mona Lisa, case into Mona's eyes in perfect health with no undiagnosed problems and an object of an excellent condition. And when he got eyes like Mona.
Minor brownish. Not enough people know about their eye health. That's why OCT scans are included in every standard eye exam at Spexaver's locations. Should have gone to Spexavers, book an eye exam today. Eye exams provided by independent optometrists.
Contact your local Spexavers for details. And finally, a quiet collaboration between NYU mathematician Tristan Buckmaster and anthropic researcher Levent Apogee has turned into a very public dispute over AI, research credit, and one of mathematics's biggest prizes. The pair used AI tools and the Leon theorem prover to establish finite time blowup results for several fluid dynamics equations related to Navier-Stokes. Then, open AI entered the picture, saying an internal model had produced a proof for the actual Navier-Stokes Millennium Prize problem worth $1 million.
Buckmaster alleges open AI may have benefited from his unpublished work stored in Codex and pressured him to exclude Apogee from authorship. Open AI's claimed proof still faces scrutiny. Whatever the mathematics ultimately says, the episode offers a preview of AI-assisted research's less elegant side. Models may accelerate discovery, but questions about training data, intellectual property, authorship, and credit aren't proving quite so easy to formalize.
And that's the Cyberwire. For links to all of today's stories, check out our daily briefing at the Cyberwire.com. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app.
Please also fill out the survey in the show notes or send an email to cyberwire at n2k.com. N2K's lead producers list stokes were mixed by Trey Hester with original music and sound designed by Elliot Peltzman, our contributing host is Maria Vermasas, our executive producer is Jennifer Idon, Peter Kilby is our publisher, and I'm Dave Bitner. Thanks for listening. We'll see you back here tomorrow.