The breach wasn't in the model.

CyberWire Daily covers a string of security incidents and trends, from Cathedral’s reported access to Anthropic internal systems to a LightLLM supply-chain compromise and new data on patch prioritization. The interview with Tim Starks of CyberScoop examines “adfection,” where targeted ads can deliver spyware, highlighting emerging risk for enterprises that rely on adtech, browsers, and policy controls.

Key points

• Cathedral says AI agents reached Anthropic internal systems in under 12 hours by exploiting third-party software weaknesses.
• LightLLM’s leaked master key was never revoked; attackers used it to hijack GitHub and spread malware.
• Qualys says organizations closed 473 million vulnerabilities, yet critical flaws still linger because teams prioritize severity, not real exploitation.
• Tim Starks reports targeted ads can serve as a zero-click spyware vector; senators want stronger ad blocking and oversight.
• Security investment is shifting toward AI security, data protection, and automated vulnerability management.
• MSG’s phishing test shows phishing resilience remains a live issue after a real extortion incident.