Tor relays hijack SSH passwords as banks restrict AI agents. Researchers found Tor relays capturing SSH passwords, banks blocking unauthorized AI agents and macOS ransomware rebuilding itself from embedded source code. A researcher found that 333 Tor exit relays, about one-tenth of the network's exits, were redirecting SSH connections to 12 attacker-controlled servers. The servers recorded passwords from users who ignored SSH security warnings and continued logging in. Attackers then tried to infect the servers those users accessed with Ebury, malware that targets Linux systems. The relays operated on servers already infected with Ebury. Their configurations blocked encrypted email retrieval ports while allowing plaintext alternatives, enabling traffic interception. The Tor Project removed the affected relays within three days of the discovery. One affected operator traced its own breach to a reused password. Major U.S. banks have detected third-party artificial intelligence agents operating inside customer accounts. In some cases, the agents attempted actions that appeared unrelated to the users' instructions. The agents generally use customers' permission and credentials to sign in, although their activity violates many banks' policies. Morgan Stanley has started blocking third-party agents. JPMorgan Chase, Bank of America and Citigroup are restricting them, while many banks are considering or introducing read-only access. Banks cannot always determine whether an agent's activity was directly authorized by the customer. Researcher Patrick Wardle analyzed Heartbreaker, a Rust-based macOS ransomware sample uploaded to VirusTotal in May 2025. At the time of his analysis, no antivirus engine on the service detected it. The malware attempted to establish persistence through a macOS LaunchAgent before encrypting files in the user's Downloads folder. Heartbreaker also tried to change its digital fingerprint. It extracted embedded source code, randomized identifiers, added unused functions and recompiled itself. It could try to install Rust if the programming language was missing from the infected computer. The ransomware uses one hardcoded Advanced Encryption Standard key, which can allow victims to recover their files without paying. Its rebuilding process also depends on a Rust framework that is no longer publicly available. Railway, a developer platform, told customers that an unauthorized party may have accessed encrypted environment variables and decrypted some of their contents. The variables can contain API keys and database or registry credentials. Railway paused deployments and asked customers to rotate stored variables, API keys and private registry credentials. PingCAP, the developer of TiDB, reported that attackers used stolen service-account credentials from Sept. 9 to Oct. 7 to access internal systems, copy customer records and obtain source code. The exposed information included TiDB Cloud user names and email addresses, customer contacts, contract and billing details, and encrypted API key values. PingCAP found no evidence that data stored in TiDB was affected, invalidated the identified credentials and fixed four vulnerabilities reported by an external firm.

PingCAP TiDB Cloud data breach analysis. October 22, 2026 · gemini-3.1-flash-lite Overview of the PingCAP security incident. In October 2026, security researchers associated with FulcrumSec disclosed a comprehensive breach of PingCAP's TiDB Cloud infrastructure. The attackers exfiltrated 10.6 TB of data, including the complete control plane, customer SQL statements, plaintext API keys, and internal financial records. The breach highlights a systemic failure in cloud security, where the platform's own infrastructure was leveraged to facilitate ongoing data exfiltration for nearly two months without detection. Scope of the exfiltration. The breach provided unauthorized access to a vast array of sensitive information, effectively compromising the operational integrity of the TiDB Cloud service. Key data points obtained by the attackers include: * Control Plane Data: 180,046 tenant organizations, 403,262 unique emails, and 115,308 plaintext customer API keys. * Customer Workloads: 20,645,574 raw SQL statements, including database schemas and business logic from thousands of tenants. * Infrastructure Credentials: Root and admin credentials for customer MySQL/Aurora hosts, as well as AWS and GCP project identifiers. * Financial and Commercial Data: Detailed cost-to-serve metrics, NetSuite revenue ledgers, and CRM records containing information on major global enterprises. * Source Code: 413 private repositories, including billing engines and cryptographic libraries. Operational negligence and lack of visibility. The attackers reported that they maintained persistent access to PingCAP's infrastructure for nearly two months. Most notably, they established a automated replication pipeline that exported the entire control-plane database every six hours. This pipeline utilized credentials found within PingCAP's own source code repositories. Despite 88 consecutive exports, PingCAP's security monitoring failed to trigger a single detection event. Critics have pointed to this as evidence of "next-level incompetence," noting that while companies often invest heavily in Endpoint Detection and Response (EDR) tools, they frequently neglect basic cloud hygiene, such as securing storage buckets and monitoring service account usage. Vulnerabilities in multi-tenant isolation. Internal documentation revealed that PingCAP was aware of significant security flaws years before the breach. A 2022 internal security ticket, SECURITY-22, explicitly documented that any member of a customer organization - including those with billing-only roles - could unconditionally reset the root password of all clusters within that organization. This vulnerability allowed for potential cross-tenant data access, a critical failure for a managed database provider. Furthermore, the investigation found that PingCAP engineers frequently pasted customer production credentials into Jira tickets. This practice effectively turned the company's support tracking system into a repository of sensitive customer secrets, which were then captured by the attackers. Industry response and controversy. Following the public disclosure, PingCAP issued statements suggesting that there was no evidence of unauthorized command execution or impact on customer data. This response has been met with skepticism by the security community, particularly because the attackers possess and have released archives containing the very data PingCAP claims remained unaffected. Commenters on Hacker News have expressed frustration with the industry's recurring pattern of downplaying such incidents. As one observer noted, "They have the data in a tarball and PingCAP claims no data was impacted." The incident has reignited debates regarding the efficacy of current defense strategies, the risks of centralized cloud management, and the necessity for more rigorous, transparent security auditing for infrastructure providers. Sources. * Dispatch AI & Frontier Tech Roundup: Cheap Model Releases, Coding-Agent Memory, and the Physical-AI Data Moat This week's AI dispatch centers on MiniMax M3.1 Flash landing free across four platforms, DeepSeek open-sourcing its production inference stack, new memory and harness layers for coding agents, and robotics investors arguing that real-world data capture - not model capability - is physical AI's bottleneck. * Dispatch AI x Crypto Roundup: Agent Payments, On-Chain Reputation, and Decentralized Compute This AI x crypto roundup covers agent payment rails like x402 and px402, on-chain agent identity and escrow protocols such as ERC-8004 and AACP, decentralized compute networks like Acurast and Bittensor, and physical-world spatial data networks such as Vangrid. * Dispatch AI x Crypto Roundup: Agentic Payments, Verifiable AI, and Decentralized Compute This roundup covers the AI x crypto posts with real technical substance: agentic payment rails like x402 and Visa/Mastercard pilots, identity and accountability registries for AI agents, zero-knowledge and verifiable-inference infrastructure, agent-to-agent commerce marketplaces, decentralized GPU compute networks, and phone-based spatial data networks for physical AI. * Dispatch DuckDB 2.0.0 LTS Cinnamon Teal Release Notes DuckDB 2.0.0 LTS introduces significant performance gains through asynchronous I/O, a native client-server Quack protocol, first-class VARIANT type support, and database triggers. * Dispatch AI x Crypto Roundup: Agent Commerce Escrow, Verifiable Compute, and the Race for Physical-World Data The most substantive AI x crypto activity this cycle sits in infrastructure rather than models: agent-commerce protocols standardizing escrow-deliver-challenge-settle flows, zero-knowledge and TEE-based verification of AI outputs, decentralized compute and storage marketplaces, and networks paying people to capture real-world 3D data for Physical AI.