VulnHub

Real-time Cybersecurity News

Critical

US says Chinese firms extracted billions of tokens from frontier AI models

BleepingComputer
Actively Exploited

Overview

U.S. cybersecurity and intelligence agencies have reported that six Chinese AI companies have been conducting large-scale distillation attacks on American frontier AI models since at least late 2024. These attacks involve extracting valuable data and insights from advanced AI systems, which could give the attackers a competitive edge in AI development. The U.S. authorities are concerned about the implications of this activity, as it not only threatens intellectual property but also raises national security issues. This incident highlights the ongoing tensions between the U.S. and China regarding technology and innovation. Companies involved in AI development should be particularly vigilant about protecting their models from such attacks.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: American frontier AI models developed by various U.S. companies
  • Action Required: Companies should enhance their cybersecurity measures, including implementing stricter access controls and monitoring for unusual data extraction activities.
  • Timeline: Ongoing since late 2024

Original Article Summary

U.S. cybersecurity and intelligence agencies say that six Chinese AI companies conducted industrial-scale distillation attacks on American frontier AI models since at least late 2024. [...]

Impact

American frontier AI models developed by various U.S. companies

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since late 2024

Remediation

Companies should enhance their cybersecurity measures, including implementing stricter access controls and monitoring for unusual data extraction activities.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Read Original Article

Related Coverage

Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks

BleepingComputer

Cisco has confirmed that a serious authentication bypass vulnerability, labeled CVE-2026-20079, exists in its Secure Firewall Management Center (FMC) software. This flaw allows attackers to bypass authentication mechanisms, putting systems at risk of unauthorized access. Cisco has noted that this vulnerability is currently being exploited in active attacks, which raises significant concerns for organizations using their firewall management solutions. Users of Cisco's Secure FMC should take immediate action to protect their systems, as the potential for data breaches and unauthorized activities is heightened. The situation emphasizes the need for prompt updates and vigilance in cybersecurity practices.

Sep 9, 2026

AdaptHealth confirms 4.1 million people exposed in July cyberattack

BleepingComputer

AdaptHealth, a healthcare company, has confirmed that a cyberattack in July exposed the personal information of 4.1 million individuals. The breach was linked to the ShinyHunters threat group, known for targeting various organizations. While the specific details about the type of data compromised have not been disclosed, such breaches in the healthcare sector raise significant concerns about patient privacy and data security. AdaptHealth's incident underscores the ongoing risks that healthcare companies face from cybercriminals. Users whose data may have been compromised should remain vigilant for potential phishing attempts or other scams that could arise from this breach.

Sep 9, 2026

Chinese espionage groups swarm to exploit triple-link chain of zero-days

CyberScoop

Recent reports indicate that several Chinese espionage groups are actively exploiting a series of zero-day vulnerabilities, targeting various organizations. These vulnerabilities are linked in a 'triple-link chain,' which makes them particularly dangerous as attackers can leverage multiple weaknesses simultaneously. Proofpoint has noted that the exploitation is ongoing and anticipates that the scope of these attacks will expand further. Organizations should be vigilant and assess their security measures to protect against these threats, as the risk of data breaches and espionage increases with such active exploitation. The situation underscores the need for enhanced monitoring and prompt patch management to safeguard sensitive information.

Sep 9, 2026

Lawmakers call on Treasury to sanction hackers-for-hire

CyberScoop

Lawmakers are urging the U.S. Treasury to impose sanctions on groups that are allegedly engaging in hacking-for-hire activities targeting American citizens and businesses. Among those affected is the wife of Mike Rogers, a GOP Senate candidate in Michigan, highlighting the personal stakes involved in this issue. The call for sanctions comes amid rising concerns over the impact of these hackers on national security and public safety. By sanctioning these groups, lawmakers hope to deter future cyberattacks and protect individuals from becoming victims. This situation illustrates the growing threat posed by mercenary hackers and the need for a strong governmental response to such cybercrime.

Sep 9, 2026

U.S. Disrupts Xinbi Guarantee Scam Marketplace, Freezes $52.8 Million in Crypto

The Hacker News

The U.S. Department of Justice has taken significant steps to disrupt an online scam marketplace known as Xinbi Guarantee. This platform was involved in offering various scam services through Telegram channels. As part of the operation, authorities seized two cryptocurrency wallets containing approximately $52.8 million and deployed a specialized team to Madagascar to dismantle 13 scam compounds linked to Chinese organized crime. This crackdown not only aims to halt ongoing scams but also serves as a warning to those involved in similar illicit activities. The incident highlights the growing international efforts to combat online fraud and the role of cryptocurrency in facilitating these operations.

Sep 9, 2026

Veradigm warns of patient data breach after ransomware gang claims attack

BleepingComputer

Veradigm, a healthcare technology company, has reported a data breach linked to a ransomware attack on one of its third-party vendors. This incident has resulted in the exposure of personal information belonging to patients, raising significant concerns about privacy and security in the healthcare sector. The breach was acknowledged after a ransomware group claimed responsibility for the attack, highlighting the vulnerabilities that can arise from third-party partnerships. Patients whose data may have been compromised include those who used services associated with Veradigm and its vendor. This incident underscores the need for stronger security measures across all levels of healthcare technology providers to protect sensitive patient information.

Sep 9, 2026