Security | The Verge

Canvas owner reaches ‘agreement’ with hackers to secure stolen data

2026-05-12T09:26:52-04:00

Instructure, the company behind the Canvas learning management platform, says it has "reached an agreement" with hackers that breached its systems last week to prevent stolen data from being leaked online.

The ShinyHunters hacking group claimed responsibility for the attack before Canvas was briefly taken offline. The group threatened to publish 3.5 terabytes of student data if ransom demands for a "settlement" weren't met. Now, Instructure says the stolen data has been returned as part of its unspecified "agreement" with the hackers, alongside a promise that "no Instructure customers will be extorted as a result of this incident."

"We un …

Read the full story at The Verge.

OpenAI just released its answer to Claude Mythos

2026-05-11T19:05:51-04:00

OpenAI is launching Daybreak, an AI initiative focused on detecting and patching vulnerabilities before attackers find them. Daybreak uses the Codex Security AI agent that launched in March to create a threat model based on an organization's code and focus on possible attack paths, validate likely vulnerabilities, and then automate the detection of the higher risk ones.

Its launch comes just over a month after rival Anthropic announced Claude Mythos, a security-focused AI model it claimed was too dangerous to publicly release and only shared privately as a part of its own initiative, dubbed Project Glasswing. Still, that didn't stop at leas …

Read the full story at The Verge.

Google stopped a zero-day hack that it says was developed with AI

2026-05-11T12:28:15-04:00

For the first time, Google says it has spotted and stopped a zero-day exploit developed with AI. According to a report from Google Threat Intelligence Group (GTIG), "prominent cyber crime threat actors" were planning to use the vulnerability for a "mass exploitation event" that would have allowed them to bypass two-factor authentication on an unnamed "open-source, web-based system administration tool."

Google's researchers found hints in the Python script used for the exploit that indicated help from AI, like a "hallucinated CVSS score" and "structured, textbook" formatting consistent with LLM training data. The exploit takes advantage of …

Read the full story at The Verge.

A million baby monitors and security cameras were easily viewable by hackers

2026-05-11T21:44:40-04:00

If your baby monitor looks something like this, it’s probably a Meari. | Image: Meari

A baby's eyes peer directly into the camera lens. A kid with a striped shirt looks up, then away. A boy in a policeman's costume, a gold star on his chest. A messy bedroom that reminds me of my own daughters, with an unmade bunk bed, a little girl's hat and headband, and Hello Kitty plastered on the wall.

One thought repeats in my mind: I shouldn't be seeing this. No stranger should.

But bad actors could've easily spied on all these locations - and a million more - because many of Meari Technology's Wi-Fi baby monitors and security cameras were absurdly insecure. If you had access to one of those cameras, you theoretically had access to t …

Read the full story at The Verge.

Canvas is online again after ShinyHunters threaten to leak schools’ data

2026-05-08T06:42:54-04:00

The Instructure-owned learning management platform, Canvas, is now online again after it went down following a massive data breach that impacted student names, email addresses, ID numbers, and messages. Before systems were restored, students who attempted to access the system on Thursday saw a message from the hacking group ShinyHunters, which claimed responsibility for the attack:

ShinyHunters has breached Instructure (again). Instead of contacting us to resolve it they ignored us and did some "security patches." If any of the schools in the affected list are interested in preventing the release of their data, please consult with a cyber …

Read the full story at The Verge.

A hacker ran me over with a robot lawn mower

2026-05-11T18:40:45-04:00

A Yarbo lawnmower with a trimmer attachment. | Image: Yarbo

I'm lying in the dirt. It's coming for me. Then, with a lurch, it's climbing up my chest. If Andreas Makris doesn't stop the 200-pound robot lawn mower in time, it could drag its blades across my body.

Makris certainly can't reach over and hit the emergency stop button - he's nearly 6,000 miles away, having hacked this robot from the other side of the planet, to demonstrate the gaping security holes in Yarbo's robot lawn mowers. And I've made the questionable decision of lying down in the mower's path - to see just how far Makris, the security researcher who discovered those flaws, is able to push the mower.

Yep, that's me. | Animation by Sean Hollister / The Verge" data-portal-copyright="Animation by Sean Hollister / The Verge">

By the time the mower touches m …

Read the full story at The Verge.

Researchers gaslit Claude into giving instructions to build explosives

2026-05-05T17:21:36-04:00

Anthropic has spent years building itself up as the safe AI company. But new security research shared with The Verge suggests Claude's carefully crafted helpful personality may itself be a vulnerability.

Researchers at AI red-teaming company Mindgard say they got Claude to offer up erotica, malicious code, and instructions for building explosives, and other prohibited material they hadn't even asked for. All it took was respect, flattery, and a little bit of gaslighting. Anthropic did not immediately respond to The Verge's request for comment.

The researchers say they exploited "psychological" quirks of Claude stemming from its ability …

Read the full story at The Verge.

Severe Linux Copy Fail security flaw uncovered using AI scanning help

2026-05-01T12:55:16-04:00

Nearly every Linux distribution released since 2017 is currently vulnerable to a security bug called "Copy Fail" that allows any user to give themselves administrator privileges. The exploit, publicly disclosed as CVE-2026-31431 on Wednesday, uses a Python script that works across all of the vulnerable Linux distributions, requiring "no per-distro offsets, no version checks, no recompilation," according to Theori, the security firm that uncovered it.

Ars Technica points out this blog post where DevOps engineer Jorijn Schrijvershof explains that what makes Copy Fail "unusually nasty" is the likelihood for it to go unnoticed by monitoring t …

Read the full story at The Verge.

GitHub rushed to fix a critical vulnerability in less than six hours

2026-04-29T06:15:23-04:00

GitHub employees fixed a critical remote code execution vulnerability in less than six hours last month. Wiz Research used AI models to uncover a vulnerability in GitHub's internal git infrastructure that could have allowed attackers to access millions of public and private code repositories.

"Our security team immediately began validating the bug bounty report. Within 40 minutes, we had reproduced the vulnerability internally and confirmed the severity," explains Alexis Wales, GitHub chief information security officer. "This was a critical issue that required immediate action."

GitHub's engineering team developed a fix and deployed it jus …

Read the full story at The Verge.

Attack of the killer script kiddies

2026-04-28T08:29:07-04:00

Last August, some of the best cybersecurity teams in the business gathered in Las Vegas to demonstrate the strength of their AI bug-finding systems at DARPA's Artificial Intelligence Cyber Challenge (AIxCC). The tools had scanned 54 million lines of actual software code that DARPA had injected with artificial flaws. The teams were capable enough to identify most of the artificial bugs, but their automated tools went beyond that - they found more than a dozen bugs that DARPA hadn't inserted at all.

Even before the security earthquake that Anthropic delivered this month with Claude Mythos - the new AI model that seems to find vulnerabilities …

Read the full story at The Verge.