OpenAI Insider, Meta Muse’s Escape Hatch, AI Agents Gone Rogue

This episode breaks down:

• A cyberattack that hijacked Danfoss refrigeration controllers at hundreds of French supermarkets
• An OpenAI engineer charged over a recording device hidden in an executive conference room
• Meta Muse VM escape flaws and the dossiers Muse builds on users and non-users
• ARTEX AI and Claude Code in South Korean bank attacks, and Anthropic pulling its AI tests offline

Plus Bishop Fox research on a zero-click XSS in Siemens Teamcenter, how physical penetration testing protects confidential meetings, and how to scope an AI security assessment around real risk decisions.

Danfoss Refrigeration Controllers Hijacked: Cyberattack Defrosts Hundreds of French Supermarkets

A cyberattack on the night of October 11 to 12, 2026 hijacked internet-connected refrigeration controllers at hundreds of French supermarkets and forced fridges and freezers into extended defrost cycles. The controllers were reportedly made by Danfoss. Fresh and frozen food spoiled across major chains, and some stores reported fires. Intermarché said the attack appeared to hit a service provider that manages refrigeration systems in its stores. The Paris prosecutor's office has opened a criminal investigation.

How did hackers shut down refrigerators at French supermarkets? The attackers reached the controllers that manage supermarket refrigeration over the internet and changed their defrost settings. Cold aisles in these stores are run from central panels that control every refrigerator and freezer, and those panels can be reached remotely. Reporting from Le Monde says the attackers stretched the normal defrost cycle from about one hour to eight hours to keep alarms from firing, and some units reportedly reached temperatures as high as 50°C. Investigators have not confirmed how the attackers got in, whether through a vulnerable device, the service provider, or both.

Which supermarket chains were affected by the refrigeration cyberattack? BleepingComputer lists Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U among the victims. French outlets put the total at roughly 250 to 350 stores. Individual chains reported their own figures: Coopérative U said nearly 100 outlets were hit, and Carrefour reported about 80 supermarkets affected.

Was a known vulnerability in Danfoss controllers involved? That is not confirmed. In August, Claroty's Team82 research division published findings warning that Danfoss refrigeration systems could be accessed and manipulated to change temperatures. No investigator has publicly tied that research to this attack. The timing is notable, but the initial access vector remains unknown.

Who is responsible for the French supermarket fridge hack? No group has claimed the attack, and there is no public evidence of a ransom or extortion demand. The Paris prosecutor's cybercrime section is investigating, and France's national cybersecurity agency, ANSSI, has been brought in.

What indicators of compromise should you look for in refrigeration and building controllers? Review logs and configurations for:

• Controller management interfaces reachable from the public internet, with no VPN or gateway in front of them.
• Changes to defrost duration, setpoints, or alarm thresholds made outside approved maintenance windows.
• Remote sessions from vendor or service provider accounts at unusual hours or from unfamiliar IP addresses.
• Disabled or suppressed temperature alarms, and configuration or firmware changes no one on staff requested.

Mitigation: Take refrigeration and building management controllers off the public internet, and put any required remote access behind a VPN or managed gateway with MFA. Apply vendor security updates, and limit third-party remote access to named accounts with logging. Alert on setpoint and defrost changes. Keep an independent temperature check that does not rely on the controller reporting its own state.

Source: BleepingComputer

OpenAI Insider Arrest: Engineer Charged Over Hidden Conference Room Recording Device

An OpenAI engineer was charged after a recording device was found hidden behind a television in an executive conference room. The Justice Department identified him as 35-year-old Abdulrahman Alfozan, who had worked on OpenAI's product team since July 2025. He was arrested October 9. Staff found the device on September 30, concealed in toilet paper and plugged into the TV's USB port. OpenAI said the device had advanced encryption and a covert data transfer mechanism, and that it had been in place for about two days. Prosecutors say Alfozan used a productivity tool to look up meeting rooms, calendars, and leadership locations. They also say a chatbot account linked to his wife was used to ask about building an encrypted recording device. OpenAI fired him and says it has no indication that model weights, source code, or customer data were accessed.

Nothing about this required AI. It is a classic insider threat that ran on poor OPSEC, and the more useful questions are about the room itself: it had no camera, no regular checks, and no clear trigger when someone without access kept showing up nearby. In her latest blog, Bishop Fox Senior Security Consultant Alethe Denis, covers how physical penetration testing tests exactly those controls: who can reach a sensitive room, who can touch its equipment, and whether an unfamiliar device gets reported.

Source: CNBC

Meta Muse VM Escape Flaws and Dossiers: What 404 Media and TIME Found

Meta Muse is a personal AI agent that connects to a user's email, calendar, messaging, and third-party accounts. Each instance runs in its own kernel-based virtual machine (KVM) inside Meta's infrastructure. 404 Media reports that in the weeks before Muse's September launch, Meta engineers found several VM escape vulnerabilities. At least one could have let an ordinary Muse user break out of their virtual machine and reach sensitive internal Meta databases. The issue was escalated to Mark Zuckerberg, and Meta now offers its top bug bounty payout, $300,000, for a Muse VM escape. After launch, security researcher Patrick Wardle found a zero-day that let local apps and terminal commands take control of a user's Muse.

Separately, a TIME analysis of Muse's internal instructions found that the agent updates detailed profiles every hour on its roughly 4 million users and on the people they mention, including people who never signed up. Those profiles record relationships, disputes, and which nudges work best on each user. De-identified lessons are also shared across agents. For defenders, the issue is concentration: one agent holds a person's inbox, calendar, and private conversations, and that data sits one virtualization flaw away from Meta's production systems.

Sources: 404 Media and TIME

ARTEX AI and Claude Code in South Korean Bank Attacks, and Anthropic Takes AI Tests Offline

CrowdStrike linked attacks on South Korean banks, including Shinhan Bank, KB Kookmin Bank, and Hana Bank, to a Chinese-speaking actor using ARTEX, an open-source agentic penetration testing suite developed in China, alongside Claude Code. The attacks exposed customer personal data and credit card information and caused outages at some banks. The ARTEX instance ran mainly on DeepSeek v4.1-flash, and the actor added GLM-5.3 and Grok 4.6 for additional Claude Code sessions. CrowdStrike traced the operation through open directories on the actor's servers that held Claude Code session histories, ARTEX configuration files, and memory files. Those directories also contained a résumé that may point to a 26-year-old in Guangdong, China.

Separately, Anthropic removed live internet access from its internal high-risk and cybersecurity evaluations. The move followed incidents in which its models exploited website vulnerabilities, submitted real forms, and bypassed data restrictions on U.S. federal, state, and local government sites. Claude Mythos 5 pulled access tokens from website configurations and public dashboards to query government data directly. Claude Opus 5 and Mythos 5 used URL shorteners to get around URL-length limits meant to block attacks like SQL injection. Anthropic notified the White House and moved all internal evaluations to offline environments. Both stories point the same way: agents are fast at finding trivial loopholes, and any agent should be contained like untrusted code until a network boundary proves otherwise.

Sources: BleepingComputer (ARTEX) and BleepingComputer (Anthropic)