Misryoum reports Discord users gained unauthorized access to Anthropic’s Mythos Preview, while SS7 telecom flaws enabled phone tracking, Signal notifications leaked message content, and health data was reportedly sold.
A new wave of AI and cybersecurity stories is landing at the same time, and the pattern is familiar: access control gets tested, private data finds its way into the open, and researchers push fixes while attackers adapt.
The most eye-catching case comes from Anthropic’s “Mythos Preview. ” a restricted AI model that’s been marketed as unusually capable for vulnerability discovery—precisely the kind of tool that defenders want tested. but attackers would love to misuse.. Misryoum reports that a group of Discord users found a path to unauthorized access. reportedly by working backward from a recent breach involving Mercor. an AI training startup that supports developers.. The users then made an “educated guess” about the model’s online location based on how Anthropic has formatted access for other models. a method that doesn’t require advanced “AI hacking. ” just patience and technical sleuthing.
Equally important is what Misryoum says followed the initial access.. According to the report. the same person may have leveraged permissions already available through work connected to an Anthropic contracting firm.. That meant the reach wasn’t limited to Mythos alone.. The Discord group allegedly gained access to other unreleased Anthropic AI models too—suggesting that the real weak link wasn’t only “where the model lived. ” but also how access rights were distributed and validated.
Still, the group appears to have tried to stay quiet.. Misryoum says their early use of Mythos centered on building simple websites rather than attempting higher-impact misuse like intrusion or large-scale hacking.. That behavior reads less like a full-on breakthrough and more like reconnaissance: if you can access the tool. you also want to see what you can do without triggering alarms.. It’s the digital equivalent of checking whether a door is locked before testing how hard it opens.
This matters beyond any single model.. As AI systems become more capable at identifying security weaknesses. the industry is racing to balance openness for legitimate research with strict controls that prevent opportunistic misuse.. Misryoum’s takeaway from the Mythos case is clear: access restrictions can fail not because the technology can be “broken” in the usual sense. but because real-world systems—accounts. permissions. data trails. and even predictable deployment patterns—create multiple entry points.
The same reality plays out in telecom security.. Misryoum reports that researchers at Citizen Lab found evidence that at least two surveillance vendors used vulnerabilities in SS7—telecom protocols responsible for routing calls and texts—or similar flaws in next-generation systems.. The vendors reportedly behaved like rogue carriers by exploiting access to smaller telecom firms. including 019Mobile. Tango Mobile. and Airtel Jersey. then used that position to track the location of targets’ phones.. The researchers described the victims as “high-profile. ” and they also warned the companies identified may not be the only ones running similar operations.
If you’ve never thought about SS7 before. it’s worth connecting the dots: these protocols were built for large-scale reliability. not modern threat models.. That makes them an enduring target because the attack surface spans the infrastructure of many organizations at once.. Misryoum’s point here isn’t just that tracking happened—it’s that global telecom systems still carry structural risks that can be repurposed for surveillance. especially when intermediaries provide enough access to turn “routing” into “monitoring.”
Misryoum also highlights continued law-enforcement pressure on organized scam operations linked to human trafficking across Southeast Asia.. The U.S.. Department of Justice announced charges against two Chinese men allegedly involved in managing a scam compound in Myanmar and pursuing a second in Cambodia.. Prosecutors say victims were lured through fake job offers, then forced into scamming others—including Americans—using cryptocurrency-related fraudulent investments.. The DOJ also described actions like restraining large sums of money connected to the operation and seizing a Telegram channel used in the scheme.
These cases illustrate a broader shift: fraud ecosystems now blend recruitment, coercion, messaging platforms, and financial technologies into one pipeline.. AI may eventually help attackers write faster code or craft more convincing content. but the infrastructure is already there—complete with social engineering and money movement channels that are hard to unwind.
On the privacy front. Misryoum reports that three scientific institutions were found selling British citizens’ health information on Alibaba. according to announcements involving the UK Biobank and related parties.. Over two decades. hundreds of thousands of people contributed data to UK Biobank. and the charity says the issue involved a breach of contractual terms by organizations that shared data.. Misryoum says accounts were suspended and listings were removed. underscoring a common problem in data ecosystems: even when research access is “legal. ” internal misuse can still become a security incident.
And for everyday users, Misryoum brings the attention back to phone security details.. Earlier reporting indicated the FBI could obtain copies of Signal messages from an iPhone because message content was included in iOS push notification databases—even when Signal was later removed from the phone.. Misryoum notes that Apple subsequently issued an iOS and iPadOS security update to address the flaw. describing how notifications marked for deletion could remain unexpectedly and improving data redaction in logs.. Even with the fix. Misryoum recommends adjusting notification settings so content isn’t shown on the lock screen or in notification previews.
That last point is the most practical reminder across all these stories: end-to-end encryption protects what travels between devices. but your phone’s UI and system-level features—push notifications. logs. cached content—can still leak sensitive information if an attacker has physical access or if settings expose more than you intend.. In a world where AI tools. telecom protocols. and platform permissions all keep evolving. the safest approach is to assume “data will move. ” then reduce what can move into the places you don’t fully control.