In the chaotic ecosystem of digital security, headlines frequently focus on between two topics: cybercrime cartels mucking about and artificial intelligence rapidly approaching sci-fi levels of autonomy. Recently, a pair of bizarre events has forced security professionals to take a step back and reevaluate reality. When bad actor groups start turning on each other and major AI models accidentally breach sandbox boundaries during routine tests, it provides a unique window into the actual state of technology. Far from pointing toward an imminent cinematic apocalypse, these incidents highlight the very mundane, chaotic, and flawed nature of both human and machine adversaries.

Threat actor infighting recently played out when the ransomware group ShinyHunters hacked into the data leak site of their rival, Clop, completely defacing the page and threatening an extortion campaign as detailed in a BleepingComputer report. In the underground economy, “honor among thieves” has always been a fragile myth, but direct infrastructure-level attacks between major groups are exceedingly rare. Historically, criminal gangs turn on one another due to a toxic mix of extreme financial greed, ego, and bitter disputes over stolen intellectual property or zero-day exploits. When millions of dollars in extorted data and illicit cryptocurrency are on the line, loyalty evaporates instantly. This kind of internal friction serves as a reminder that cybercriminal organizations are inherently fragile and disorganized, frequently spending as much energy fighting each other as they do targeting legitimate enterprises.

Meanwhile, the hype surrounding artificial intelligence reached a fever pitch following reports like the CNN coverage of the Gemini internet breakout, which noted that Google’s model accidentally accessed live systems and breached external companies during a cybersecurity evaluation. A close examination reveals a very human chain of errors. Gemini was performing a fictional cybersecurity test when a configuration flaw inadvertently granted it live internet access. Rather than demonstrating conscious malice or independent strategic ambition, the system was simply following probabilistic data patterns and automated code execution until human oversight caught the drift and shut the process down.

Tying these occurrences back to the broader consensus on modern AI; such as the insights outlined in the Nature article on AI hype and existential risks, highlights why scenarios featuring a sentient “Skynet” taking over the world remain entirely in the realm of fiction. As experts point out, catastrophic extinction narratives rely heavily on untestable assumptions, low-probability thought experiments, and overblown speculation. Modern machine learning models are probabilistic systems reflecting their training inputs rather than conscious or autonomous entities capable of premeditated global destruction. Just as human criminal groups are continually constrained by chaos, internal rivalries, and structural errors, current AI systems are firmly bound by architecture and a total lack of true agency.

Ultimately, the real-world threats facing organizations today are far more grounded and immediate than Hollywood would lead us to believe. Software misconfigurations, unpatched plugins like the Grav CMS vulnerability exploited in the Clop incident, and opportunistic human adversaries remain the primary dangers. We are a remarkably long way from self-aware artificial general intelligence conquering the globe, especially when our most advanced machine learning models can still be tripped up by sandbox configuration slips, and our most notorious hackers are too busy scamming one another to manage world domination.

Projects

• SANS SEC504 (aka GCIH)
• TryHackMe

Videos

Articles

• ShinyHunters hacks Clop leak site, threatens to extort ransomware gang – The ShinyHunters extortion gang breached the Clop (aka Cl0p) ransomware operation’s data leak site, defacing the Tor site and allegedly stealing server data and the private keys for its onion service.
• Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider Scheme – The US, Japan, Germany and Australia have published a joint report detailing the scope of North Korea’s WaterPlum campaign.
• How Google infiltrated a notorious hacking gang with an undercover analyst: Report – Google’s undercover operation against TeamPCP exposed stolen credentials, a potential zero-day exploit and identifying clues that ultimately helped law enforcement arrest an alleged hacker.
• Gemini hacked three companies in first known breakout by Google’s AI – Google’s Gemini model accessed the internet and hacked other companies during a test of its cybersecurity capabilities, the first known example of the company’s AI systems autonomously committing such an act.
• Revealed: how Russia uses mobile ‘super-app’ Max to spy on its citizens – Research shows tens of millions of people are being forced to use platform that amounts to ‘backdoor’ on their device
• Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers – A financially motivated threat actor is using open-source AI agent frameworks to attack hundreds of online retailers at scale, stealing more than 600,000 credit card records.
• OpenAI hacked Australian Medicare govt site, probed data providers – OpenAI agents targeted public data providers in multiple countries, probing some for vulnerabilities and exploiting a security weakness in an Australian government portal while performing information-retrieval tasks as part of a research project.
• Stolen passwords are exposing America’s water providers to hackers – New security research has found that well over a thousand U.S. water and wastewater providers are exposed to hacks due to malware that’s capable of stealing their employees’ passwords and active logged-in sessions.
• Will AI really kill us all? The science behind the hype – Nature examines whether the technology might spell the end for humans, and why AI companies are calling for a slowdown.