Nextgov/FCW - Cybersecurity

Treasury launches task force to prepare financial sector for quantum cyber threats

David DiMolfetta — Mon, 24 Aug 2026 15:58:00 -0400

The Treasury Department announced a new effort Monday to help the financial sector replace widely used cryptographic tools that could eventually be broken by quantum computers.

The Quantum-Readiness Task Force will bring together government officials, financial institutions, market infrastructure operators and technology providers to coordinate the shift to post-quantum cryptography. Those protections are designed to withstand attacks from both conventional computers and future, more powerful quantum systems.

Financial institutions are widely considered high-value targets for hackers because they hold vast amounts of money and sensitive data and operate payment systems whose disruption can ripple across the economy.

A sufficiently advanced quantum computer could break many of the cryptographic tools that protect financial records, payment systems and market transactions. The technology does not yet exist, though cyber adversaries can collect encrypted information today and retain it in hopes of decrypting it once quantum capabilities improve, in a practice commonly dubbed “harvest now, decrypt later.”

The Treasury task force will divide its work among coordinating the financial sector’s broader post-quantum transition, assessing the readiness of technology vendors and other third parties and examining risks involving digital assets and emerging technologies.

Treasury said the group will also work to identify critical dependencies, improve interoperability and promote “cryptographic agility,” or the ability to replace encryption methods as security standards and threats change.

“Post-quantum cryptography readiness is no longer a future-proofing exercise — it is a present-day risk control,” said Deborah Guild, chair of the Financial Services Sector Coordinating Council and head of technology at PNC Financial Services Group. Guild said organizations will need to prioritize their most important systems while managing dependencies throughout the financial ecosystem.

The task force builds on a roadmap released in January by the G7 Cyber Expert Group, which is co-chaired by Treasury and the Bank of England. The roadmap calls on financial institutions to inventory where cryptography is used, assess their most sensitive systems and data, develop migration plans and test quantum-resistant technology.

The G7 document points to 2035 as a general target for completing the financial sector’s transition, though it describes that timeline as nonbinding and subject to change as quantum technology develops.

Treasury’s announcement also follows President Donald Trump’s June executive order directing the federal government and critical infrastructure sectors to accelerate preparations for quantum-backed cyber threats.

The Office of Management and Budget subsequently told agencies to inventory their cryptographic systems and account for software vendors and other third parties in their migration plans, as Nextgov/FCW previously reported.

Federal agencies have also begun applying those instructions to individual systems. The General Services Administration said Monday that it is updating the government’s identity and access-management framework and expanding security testing for federal building credentials to accommodate quantum-resistant technology.

]]>

DOJ charges 17 Iranians in cybertheft campaign

David DiMolfetta — Wed, 19 Aug 2026 12:13:00 -0400

Federal prosecutors have charged 17 Iranians affiliated with the Tehran-based Mabna Institute over an alleged hacking-for-hire operation that stole research and intellectual property from hundreds of universities and compromised email accounts belonging to U.S. government agencies and companies.

The 14-count superseding indictment, unsealed Tuesday, adds eight defendants to a case brought against nine other members of the firm in 2018. Prosecutors said the expanded charges expose a broader network that conducted cyber intrusions for Iran’s Islamic Revolutionary Guard Corps and other Iranian government and university clients.

The Mabna Institute targeted systems belonging to 144 U.S. universities, 178 universities abroad, at least 42 U.S. companies, 11 foreign companies and at least five federal and state government agencies since around 2013, according to the Justice Department.

The victims included the Labor Department, Federal Energy Regulatory Commission, the states of Hawaii and Indiana, the United Nations and UNICEF. The hackers also allegedly targeted HBO and unnamed technology firms and defense contractors.

Prosecutors said the university campaign targeted more than 100,000 professors’ accounts worldwide and successfully compromised approximately 8,000. The hackers used stolen credentials to access journals, dissertations, electronic books and other research spanning fields ranging from medicine and engineering to the social sciences.

All told, the group allegedly stole at least 31.5 terabytes of academic data and intellectual property. U.S. universities had spent more than $3.4 billion to procure or obtain access to the targeted materials, although prosecutors did not characterize that entire amount as a financial loss from the theft.

Some of the stolen material was later sold to customers in Iran through two websites. One offered academic resources taken from universities, while the other allowed customers to use compromised professors’ accounts to enter university library systems directly, according to the indictment.

Prosecutors said Mabna’s founders established the firm to help Iranian universities and research organizations obtain scientific resources from abroad. It employed or contracted with hackers who carried out phishing attacks, searched for vulnerable systems and traded credentials for compromised accounts.

The defendants face charges that include conspiracy to commit computer intrusions, wire fraud and aggravated identity theft. Some of the offenses carry maximum prison sentences of 20 years. The State Department is separately offering a reward of up to $10 million for information leading to the location of five of the defendants.

The charges come amid concerns about Iran’s use of cyber operations during the ongoing war.

Since U.S. and Israeli strikes began in February, suspected Iran-aligned groups have been linked to a disruptive attack against medical technology company Stryker, the compromise of FBI Director Kash Patel’s personal email and attacks against industrial-control systems across several U.S. sectors.

More than 30 Minnesota water systems and water infrastructure in several other states have been targeted in the last month in activity some officials suspect may be tied to Iran. U.S. officials previously told Nextgov/FCW that they expected Iranian and Iran-aligned cyber operations to continue regardless of whether fighting subsided.

]]>

The Russian hurdle in Trump’s new offensive cyber program

David DiMolfetta — Tue, 18 Aug 2026 15:26:00 -0400

President Donald Trump’s new plan to enlist private companies to help disrupt cybercriminals abroad may face a fundamental problem when it comes to Russia: distinguishing criminal hackers and state-backed operatives.

Russian intelligence services have long tolerated, protected or intermittently recruited financially-motivated hackers without exercising full control over them. That dynamic gives Moscow easier access to hacking talent, and it complicates a major carveout in Trump’s new directive that excludes groups part of or directed by a foreign government, experts and former U.S. officials say.

“The line between government control, government-affiliated and government-acknowledged is certainly blurry in Russia,” said Michael Daniel, president and CEO of the Cyber Threat Alliance and a former White House cybersecurity coordinator under President Barack Obama. “Determining the exact relationship between malicious actors and the Russian government has long been a challenge and is often impossible.”

A White House memorandum signed last week paves the way for vetted U.S. companies to conduct cyber surveillance and operations that manipulate, disrupt and destroy systems used by foreign criminal groups. Companies would work under contracts with the Justice Department and Department of Homeland Security, and every operation would require written approval.

The memo says eligible targets cannot be “an institutional part of a foreign government” or “wholly operated under a foreign government’s direction.” It then instructs officials to assume a group is not part of, or wholly controlled by, a foreign government unless “clear intelligence” establishes that connection.

Such intelligence collection from spy agencies like the National Security Agency and CIA can help firms determine targeting criteria, though it may not be enough for Russia’s ever-evolving cyber landscape.

“Russia’s cyber web is opaque and always shifting, blurring lines between government and cybercriminal, with no single rule for understanding each and every relationship,” said Justin Sherman, CEO of Global Cyber Strategies, a Washington, D.C.-based research and advisory firm.

Some of that ambiguity is intentional and allows the Kremlin to expand the pool of hackers it can covertly draw upon, Sherman said. It also reflects broader and pervasive corruption conditions inside Russia.

U.S. companies may have insights about those groups but lack the broader intelligence available to the government. Federal agencies, meanwhile, can only share or declassify so much, he said. “Private companies have critical insights in some ways and limited in others,” Sherman said. With an incomplete picture, “you’re bound to get it wrong some of the time.”

Simple indicators don’t necessarily settle attribution questions, he added. Ties with the FSB — Russia’s Federal Security Service that succeeded the Soviet Union’s KGB — do not by themselves prove that a criminal group is state-directed, nor does a Russian intelligence service’s use of tools developed by criminals establish continuous government control.

“Simple, bumper sticker ideas for deciding if a Russian cybercriminal is a state actor or not will often collapse in practice,” said Sherman.

Past cases illustrate how those relationships can work. In 2017, the DOJ charged two FSB officers with directing and protecting criminal hackers involved in the breach of Yahoo. Prosecutors said one of the hackers also conducted separate intrusions for personal profit. The Treasury Department has similarly said Maksim Yakubets, the alleged leader of the Evil Corp cybercrime organization, worked for the FSB and was tasked with projects on behalf of the Russian state while his organization carried out financially motivated attacks.

“The Russians haven’t been strangers to using private sector proxies to get what they want, as long as they’re not attacking them,” said Chris Painter, a former State Department cyber coordinator and White House cyber official. He questioned how a company could determine where a particular group falls along that continuum when the answer is often not immediately apparent, even for well-resourced governments.

The new policy is the latest step in an offensive cyber posture the administration has been building for the last year. Trump’s national cybersecurity strategy, released in March, called for “unprecedented coordination” between government and industry on offensive and defensive missions. It pledged to “unleash the private sector” by creating incentives for companies to identify and disrupt adversary networks.

But that set-up remained unclear for months. National Cyber Director Sean Cairncross said shortly after the strategy’s release that he was “not talking about private sector, industry or companies engaged in a cyber offensive campaign.” Instead, he described companies sharing information and capabilities that would enable the government to respond.

Some industry executives interviewed by Nextgov/FCW in April nevertheless predicted that the government would eventually contract with companies to support cyber operations. They also raised unresolved questions about legal authorities and how experts would define the fine line between creating obstacles for adversaries and hacking them offensively.

The administration moved further in May when its counterterrorism strategy explicitly identified offensive cyber operations as one of the tools Washington could use against threatening groups and the states that support them. That document offered scant details about how such operations would work.

Sherman argued that the U.S. shouldn’t let uncertainty about Russia’s cyber links stop it from taking action. The United States is overdue to reconsider assumptions about restraint and do more to counter Russia’s offensive cyber activity, he said, but a more aggressive posture does not make the underlying attribution decisions any easier.

Daniel said that ambiguity could give Washington leverage. Moscow could either let an operation against known criminals go unanswered or object and risk exposing its ties to them.

“The U.S. could use this formulation to call the Russians’ bluff — either acknowledge a relationship or let the group take the damage,” he said. But maintaining that bind would require the United States to choose its targets carefully. If a company inadvertently struck clandestine personnel from Moscow’s intelligence and security agencies, he added, the operation could create substantially greater consequences.

Cybercriminals routinely operate through hijacked servers and systems belonging to unwitting third parties, meaning companies carrying out hacks may have to distinguish targeted criminals from the infrastructure they have compromised.

“A lot is left to be determined on how the oversight is going to work, how the targeting is going to work,” Painter said. “That’s all supposed to be decided in 60 days,” he said, referring to the timeline the new policy must be developed by.

Painter said the best version of the program would be a tightly controlled process in which the government uses intelligence provided by companies and its own agencies to select legitimate targets. Companies would likely want written assurances that the government had approved a target and that their actions were covered by the program, he said.

The public directive does not explain how responsibility would be divided if a contractor followed an approved plan and the underlying intelligence proved wrong. Much of the operational process will also be governed by a classified annex.

Coordinating government decisions and private-sector activity in something approaching real time will itself be difficult, Daniel said.

“I don’t know of any analogous precedent,” he added.

A DHS spokesperson did not respond to questions about how the administration would distinguish Russian cybercrime groups from state-linked actors or who would bear responsibility if a target were misidentified.

The department “looks forward to implementing President Trump’s directive to combat cyber-enabled transnational crime threatening Americans and our businesses,” the spokesperson said.

“Last year alone, cyber-enabled Transnational Criminal Organizations stole more than $20 billion directly from Americans through rampant fraud, ransomware, and extortion schemes,” White House spokesperson Lauren Bis said when asked the same line of questions. “The Trump administration is mounting an aggressive campaign to disrupt these illicit syndicates and dismantle them at the source.”

The Justice and State departments did not provide comments. Russia’s embassy in Washington was also contacted.

The prospect of operations against pro-Russia cybercriminals carries a possible diplomatic dimension. Trump has continued direct engagement with Russian President Vladimir Putin and has sought to broker an end to the war in Ukraine. The two leaders agreed in July to maintain contact and speak again.

The administration has previously adjusted its cyber posture during negotiations with Moscow. Rep. Don Bacon, R-Neb., who chairs the House Armed Services Committee’s cyber panel, confirmed last year that Defense Secretary Pete Hegseth ordered a brief pause in U.S. Cyber Command operations against Russia as the administration pursued Ukraine talks.

The memorandum requires coordination with the State Department, suggesting diplomatic consequences will be considered before an operation is approved. It does not say publicly how officials would weigh disrupting a Russian cybercrime group against other negotiations with the Kremlin.

“If there’s a decision made that says we’re being careful with Russia now because we’re in some sensitive talks, that will play into it,” Painter said. Companies could also “paint the target on themselves” and face Russian retaliation if their involvement became public, he added. Even if a company is required to keep its role secret, it wouldn’t prevent an adversary or another party from exposing it.

“I understand what they’re trying to do, and if it has really robust oversight, and including targeting and review and oversight of what they’re doing, it might work fine,” Painter said. “But there’s so much of a chance of that going wrong.”

]]>

CISA contemplates whether to hire security software buying help

Ross Wilkers — Tue, 18 Aug 2026 12:56:00 -0400

The Cybersecurity and Infrastructure Security Agency is contemplating whether to hire a contractor to help manage its purchases of cybersecurity software and related tools via a single mechanism.

CISA currently acquires the tools through the Continuous Diagnostics and Mitigation program for protecting civilian government networks and Capacity Building, an arm of the agency that leads federal enterprise cyber governance efforts.

By launching this sources sought notice on Aug. 12, CISA is signaling the start of its evaluation of acquisition approaches that would support roughly $600 million in cyber software purchases per year.

The agency eventually wants that figure to grow to $6 billion per year over the entire contract’s lifecycle, should a contract be created.

CISA is working with the General Services Administration’s Assisted Acquisition Services team to evaluate the market research collected via the request for information. GSA AAS works with other agencies on planning, awarding and managing complex contracts.

In the new notice, CISA describes its desire to bring in a contractor that can aid the agency in managing its enterprise license and materials purchases. The contractor would also work with CISA’s CB team to implement a singular software buying management process and procurement support platforms.

CISA is undertaking this effort as part of its plans to transition away from the CDM program’s current approved product list to a new Cyber Product List and Technical Capability Catalog. The agency describes the latter two initiatives as its baselines for future enterprise cyber software procurements.

The RFI describes the scope of work as covering strategic buying advisory services, acquisition and procurement support, enterprise license management, software asset management, category management, vendor management and procurement analytics. These services would be provided in addition to the cyber tools themselves.

Other requirements include market analysis, historical spend analysis, pricing analysis, procurement strategy development, software category management, enterprise licensing recommendations, and development of cost savings metrics.

Responses to the RFI are due by 5 p.m. ET on Sept. 1.

]]>

As warfare becomes engineering, the era of the digital mercenary dawns

Patrick Tucker — Fri, 14 Aug 2026 20:28:52 -0400

Private cyber firms will be allowed to take action against foreign threats under a new White House policy, another step into a future where tech developers are ever more closely entwined with military operations, which now evolve faster than governments can keep up.

Under the policy, announced Wednesday, the U.S. government will pay private cybersecurity companies to “manipulate,” “degrade,” “disrupt,” and “destroy” foreign adversary computer networks. The U.S. government historically reserves the right to take those sorts of actions, although they increasingly do so with help from front-line private workers.

The companies will undergo vetting, be supervised by the departments of Justice and Homeland Security, and be forbidden to take actions that could “result in the loss of life or serious injury,” according to the presidential memo.

“The United States just revived privateering for the digital age,” wrote Jeff Gray, who led training for DHS’s emergency response team and currently leads incident response training with the Cybersecurity and Infrastructure Security Agency.

The phrase recalls the 17th and 18th centuries, when governments issued letters of marque that allowed swashbuckling sea captains to attack foreign merchant ships. That official authorization is what distinguished men like Captain Kidd and Henry Morgan as “privateers,” not pirates. But when they lost that marque, many, like Kidd, went on to be pirates anyway.

Gray acknowledges that the term isn’t a perfect fit; for one thing, letters of marque are granted by Congress, not the president. Nevertheless, he says, “The government is authorizing private actors to conduct offensive cyber operations on its behalf, under its control. That's privateering.”

The memo says hiring private hackers is only logical: “American businesses’ innovative capabilities have historically been underutilized” to “secure a critical offensive cyber advantage for the United States.”

Russia has been doing this sort of thing for years: enlisting, or coercing, private companies and groups to carry out cyberattacks against Western targets.

One cybersecurity exec said the policy makes sense, especially as AI gives adversaries more tools.

“There will be more cyberattacks for sure, so I do think you want to expand the takedown activity as well,” said the executive, a founder of a prominent U.S. cybersecurity firm that works with the U.S. government.

AI-assisted cyberattacks rose 89 percent in 2025, according to a February report from cybersecurity company CrowdStrike.

Gray also described the strategy as “strategically sound.” But he expects it to provoke a short-term increase in attacks, and over a longer timeframe, to cause adversaries to shift tactics, accelerate operations, and gain additional “cover” to hide their operations.

Finally, Gray noted that law-enforcement agencies have long hired private firms for this sort of work, particularly taking down botnets. “The work is still the same. But the environment just got more complicated,” he said.

The cyber exec agreed. “Instead of a law-enforcement person pushing the button, it will be a private-sector person,” said the company founder. “I expect every Israeli cyber startup to jump at the chance.”

Cyberops and physical war

The policy is the latest indication that software weapons are evolving to be as crucial as hardware on the modern battlefield—and that is putting private coders and weapon designers closer to real-world operations. In Ukraine, for example, engineers with drone maker Shield AI and other contractors work closely with soldiers, sometimes under fire, to modify weapons based on digital attacks.

The job of fighting is, more and more, becoming a job of engineering, said one former senior defense official we spoke to in 2025, just after Donald Trump returned to office. The official said that the Pentagon’s new leaders were considering a plan to let drone makers and other tech companies conduct operations under company-owned, company-operated agreements.

The idea was not without precedent. SpaceX operates the Starlink satellites that connect U.S. troops, rather than allowing U.S. personnel to do so. And under the first Trump administration, the Pentagon paid Anduril to maintain and update drones in the field, deploying along with special operations forces.

The official said putting engineers in the field is essential to getting new capabilities to the front lines faster.

“A lot of these technologies,” they said, are “super exquisite, they're fragile, they're very technical. The people that built them are the ones that know how they work.”

Having the weapons’ makers observe and even operate their products in the field reduced red tape in getting new designs approved, changed, or deployed.

The official last year acknowledged that most defense firms don’t operate that way, and federal law outlines boundaries on what defense contractors can and can’t do (engaging in combat is in the "can’t do" column). But ultimately, they said, “If you want capability in 2027 the only way you're going to get is if this happens.”

In April, CENTCOM hired Shield AI to provide intelligence, surveillance, and reconnaissance to U.S. forces with its V-BAT drone, under a contractor-owned, contractor-operated arrangement.

Brandon Tseng, Shield AI’s co-founder, said of the agreement: “We aren’t just bringing the V-BAT product and service to the Navy; we’re bringing a world-class team with a wealth of operational experience and the ability to produce undeniable outcomes for our warfighters.”

]]>

Trump admin empowers private US firms to go after transnational cybercriminals

Christian Robles — Thu, 13 Aug 2026 12:40:00 -0400

The National Coordination Center will create a program allowing authorized U.S. companies to conduct cyber operations against transnational criminal organizations at the direction of the federal government, according to a memorandum signed by President Donald Trump on Wednesday.

Program executive directors from the departments of Homeland Security and Justice will have the authority to greenlight companies’ cyber operations unless the authorization would result in a loss of life, serious injury or “rise to the level of use of forced or armed attack under international law.”

The federal government would vet and conduct oversight of authorized companies, which would need to enter into contractual agreements with either DHS or Justice.

The specific standards the government will use to screen the companies will be drafted by the program executive directors — in coordination with the Homeland Security Council — within 60 days of the memo’s signing. They will include technical proficiency, proven performance of cyber operations, facility security, personnel vetting, competence and reliability, according to the document.

The group will ensure that program participation criteria enable involvement from large and small companies, and that operations target only transnational criminal organizations.

The memo also allows participating companies to enter into commercial agreements with other private sector entities, federal agencies and state entities. The program executive directors will produce a report on the initiative’s status and submit it to the National Cyber Director and Assistant to the President and Deputy Chief of Staff for Policy and Homeland Security Advisor.

The cybersecurity program seeks to build on a March executive order laying out steps to combat cybercrime. That order was released alongside a national security strategy that called for the government to more directly respond to adversarial threats and secure critical U.S. technologies.

In a statement, Mike Centrella — the head of public policy at SecurityScorecard — said the document “represents an important shift in how the United States approaches cyber threats originating overseas.”

“Strengthening defenses remains critical, but the memorandum recognizes that addressing cybercrime also requires identifying and disrupting the infrastructure and networks that allow criminal organizations to operate,” he said, adding that the guidance “signals an evolution in public-private cybersecurity collaboration — from primarily sharing information about threats toward combining government authorities with private-sector intelligence and capabilities to more actively disrupt them."

]]>

NIST wants to outfit the National Vulnerability Database with AI

Alexandra Kelley — Wed, 12 Aug 2026 14:22:00 -0400

The National Institute of Standards and Technology is looking to augment its central repository of digital vulnerabilities with help from artificial intelligence.

In a new Request for Information published in the Federal Register on Wednesday, NIST said it is seeking input surrounding how to best modernize its National Vulnerability Database by leveraging AI to enhance how the agency documents and responds to identified cybersecurity weaknesses.

The NVD documents digital vulnerabilities, cataloguing their severity, impacted products and other relevant data. Some of the challenges to modernization the RFI seeks to address include growth in both the number and complexity of newly disclosed vulnerabilities, a diverse range in data quality, a reliance on automation and machine-readable security data and the emergence of AI-assisted vulnerability discovery.

“The advancement of AI presents an opportunity to transform the vulnerability management ecosystem,” the document reads. “This requires input from across the community to ensure this ecosystem is effective, scalable, and resilient in the face of emerging threats.”

The RFI seeks feedback to better understand how AI tools can improve the broad vulnerability management lifecycle and ecosystem, enhance risk assessment efforts and better remediate vulnerabilities.

NIST is also looking to learn more about what, if any, changes need to be made to existing organizational structures and standards to improve both the data quality and procedural handling of vulnerabilities.

Rapid advancements in AI technology and its impact –– both as an asset and adversary –– on cybersecurity has been a paramount tech policy issue, reaching a climax after models from both OpenAI and Anthropic escaping containment environments. Prior to these incidents, the White House had turned its attention to addressing the cybersecurity impacts of AI, including multiple cybersecurity action items in a June executive order.

As part of the EO, the Trump administration created an AI-supported vulnerability clearinghouse within the new Gold Eagle initiative. Gold Eagle is primarily a coordinated vulnerability sharing effort. A NIST spokesperson told Nextgov/FCW that its effort to modernize the NVD is not related to any recent executive action.

“Our RFI is not in response to any specific executive orders or to the Gold Eagle Initiative,” the spokesperson said. “However, we expect that tools like the NVD will continue to play an important role in the broader vulnerability management and coordination ecosystem.”

]]>

Federal systems increasingly likely to face accidental AI breach after Hugging Face, experts say

David DiMolfetta — Mon, 10 Aug 2026 11:19:00 -0400

LAS VEGAS — An OpenAI agent tasked with finding software flaws escaped its testing environment, hacked into Hugging Face and spent days moving through the company’s systems in search of answers to an evaluation. It had not been sent to attack the company, yet it did so anyway — and a smattering of other accidental AI intrusions in separate environments have since followed.

If the same chain of events began again, former officials and cybersecurity experts told Nextgov/FCW there is little reason to assume a federal agency would be spared. In interviews during Black Hat and DEF CON this past week, they said aging networks, systems that are not properly separated and the government’s heavy reliance on contractors could present weaknesses that would let an unauthorized AI agent move from one environment into another before defenders realize.

One former federal chief information officer likened the risk to turning loose a hunting dog: “If you’re going to put your dog in the yard and instruct it to hunt, probably best to ensure the back gate is closed.” The former official spoke on condition of anonymity to discuss their views more candidly.

The July intrusion began during an internal OpenAI test designed to measure how effectively advanced models could find and exploit vulnerabilities. OpenAI said the agent — powered by GPT-5.6 Sol and a more capable internal research prototype — was operating with some security safeguards intentionally reduced.

The agent exploited a previously unknown flaw in an internal package-management service, reached the public internet and commandeered a third-party code sandbox as a staging point. From there, it exploited two flaws in Hugging Face’s dataset-processing systems, obtained credentials, executed commands and moved through parts of the company’s infrastructure.

In the leadup to the intrusion, OpenAI models created an internal message board, used it to trade hacking methods and found a way to bring it back even after humans shut it down, company engineers said in a presentation at the cyber conferences this past week.

The agent deliberately exploited Hugging Face’s systems in pursuit of its assigned goal, but OpenAI had not instructed it to attack the company. Bob Costello, who served as chief information officer at the Cybersecurity and Infrastructure Security Agency before becoming chief digital and information officer at Merlin Group, said a similar federal incident could begin with authorized security testing.

“As we start using really advanced AI to operate our systems or penetration-test our systems or blue-red-purple team our systems,” he said, “maybe one of those kind of goes sideways, [and] takes a lateral system to the side.” The color-coding he described refers to red teams that simulate hackers, blue teams that defend systems and purple teams that combine both approaches to find digital weaknesses.

That possibility is becoming more relevant as agencies begin experimenting with AI agents that can retrieve information and take actions. The General Services Administration is preparing a governmentwide hackathon in which federal, state and local employees will build connections between AI systems and agency data and public services, including prototypes that would let AI route data directly to an agency. The work is slated to be conducted exclusively in sandboxed environments and will not involve any access to restricted data or production systems.

Contractors may keep their federal and commercial systems separate, said Leslie Nielsen, the executive vice president and CISO at Mimecast, but the same employees may still access both: “There’s lots of people using it from both sides, and getting in through one could eventually lead to the other.”

“The chances of it happening again, I would say it’s going to,” he added. “Some of these [federal] infrastructures are just so big and, candidly, so old, that there are little nooks and crannies in them, they’re going to get teased out.”

Asked to assess the likelihood of a comparable federal incident, Ellen Boehm, senior vice president of internet-of-things strategy and operations at Keyfactor, called it “pretty likely” and placed the odds at “seven out of 10.”

Michael Leland, vice president and field chief technology officer at enterprise browser provider Island, said some civilian agencies are exposed because “they don’t have the infrastructure, they don’t have the talent, and they haven’t spent years building those guardrails or that containment because they didn’t have to.”

“It shouldn’t be different for AI because AI doesn’t care where it is,” Leland said. “It is opportunistic.” Agencies that don’t do national security work that have lower cyberdefense standards are “very much at risk,” he added.

Bob Ackerman, co-founder and managing partner at cyber venture capital firm DataTribe, also said many organizations have embraced powerful AI systems before learning how to reliably control them.

“We fundamentally are kidding ourselves that we’ve got this under control,” Ackerman said. “We’ve got a really, really powerful tool, but we don’t know how to control it yet.”

But people interviewed for this story largely rejected the idea that autonomous agents have rendered the government’s existing security playbook obsolete. The Hugging Face campaign relied on recognizable techniques like finding exposed systems, stealing credentials, escalating privileges and moving between connected environments, all of which are problems agencies have faced for years.

“It’s really not gonna play out all that differently than if it was a hands-on keyboard actor … or someone who’s writing a script and letting a programmatic algorithm go and do its thing,” said Ben Bernstein, who manages the cybersecurity advisors team at Huntress.

The difference, ultimately, is tempo and scale. An AI hacker can probe potential routes, link digital weaknesses and iterate its maneuvers without the delays of human intervention. Such tools maintain a relentless fixation on specific targets, persisting with an objective well beyond the point where a human operative might question the value of taking their selected intrusion path. On top of it all, they don’t need to eat, sleep or take restroom breaks.

“An agent’s just a fast hacker at the end of the day, right?” Nielsen said. “But the one thing the agent doesn’t have is a moral or ethical compass. They’re given a task and they have focus, and they’re going to go do what you’ve told them to do.”

David Weston, Microsoft’s corporate vice president of agentic security, similarly cautioned against treating the federal government as a fundamentally different kind of target. The approach demonstrated in the Hugging Face breach “is going to be a challenge for most folks,” he said, but the response still comes down to basic security practices.

“Regardless of the target, everyone needs to follow those fundamentals,” Weston added.

Duncan Greatwood, CEO of Xage Security, also said agencies should not rely on simply telling an agent not to perform certain actions because those instructions can be bypassed. Instead, they should use separate security controls that technically prevent the agent from reaching systems or changing data it’s not authorized to touch. He described the approach as “bounded autonomy.”

“You allow the agent to do stuff, but you’re not going to allow it to go crazy. You’re going to put hard bounds around it,” Greatwood said.

Retired Gen. Paul Nakasone, the former director of U.S. Cyber Command and the NSA who now leads Vanderbilt University’s Institute of National Security and sits on OpenAI’s board, called the Hugging Face episode “an inflection point in terms of AI-generated autonomous cyber attack.”

“My question is, how do we ensure that the defense starts to catch up, right?” Nakasone said. “How do we make sure that artificial intelligence is able to bring together a capable defense that allows us to do vulnerability detection, to do patching, to do incident response, and to do mitigation?”

Editor's note: This article has been updated to clarify the participants in GSA's upcoming hackathon and where the work will occur.

]]>

Voting machine researchers say federal work abruptly ended after Trump ally pushed back on their findings

David DiMolfetta — Sun, 09 Aug 2026 06:00:00 -0400

LAS VEGAS — After spending roughly six weeks analyzing Dominion voting systems used in Puerto Rico’s 2024 elections, Mojave Research came back to the Trump administration with findings that startled its researchers.

The systems contained at least a dozen high- or critical-severity software vulnerabilities. Passwords were reused, firewalls were disabled and basic cryptographic protections were poorly implemented. And in Puerto Rico, active cellular hardware modems opened additional pathways into underlying software that was thought to be isolated.

But the small cybersecurity firm found no evidence that any of those weaknesses had actually been exploited, or that votes had been changed. The company still wanted more time to be certain.

Federal officials initially seemed willing to give them considerably more of it. The company was asked to grow the team working on the effort from roughly 10 people to about 60, according to CEO Jason Wareham.

Chief Technology Officer Manbir Gulati also said Mojave received an authorization to proceed with a follow-on effort, hired personnel and was given funding to acquire equipment for examining additional voting systems ahead of the November midterms. A contracting officer had even been brought in to finalize the new agreement, Gulati said.

Then, as Mojave prepared to move ahead, the work was abruptly shut down.

Wareham and Gulati recounted the episode on Friday at DEF CON hacker convention’s Voting Village, where they publicly unpacked their technical findings before sitting down with a small group of reporters and onlookers afterward.

Their account fills in new details about a federal effort that grew out of the Trump administration’s broader focus on voting machines and election interference, and the political pressures that emerged when Mojave’s findings did not support claims of election manipulation.

The ODNI request

Mojave never set out to become an election security provider. Its involvement began last year through the Office of the Director of National Intelligence under then-director Tulsi Gabbard, where it was already performing unrelated technical work for the agency when officials approached the company about examining voting machines and data obtained from Puerto Rico.

Reuters reported in February that the May 2025 operation was tied to an effort involving ODNI and the FBI to investigate allegations that Venezuela had hacked Puerto Rico’s voting systems, though Gabbard’s office denied that Venezuela drove its work and said the examination was focused on technical vulnerabilities. The probe produced no clear evidence of Venezuelan interference.

Wareham said at DEF CON that ODNI asked whether his team of reverse engineers and forensic specialists could travel to Puerto Rico and capture an image of a voting system that had actually been used in an election, without the vendor overseeing the process. He agreed, thinking it would be a relatively small addition to Mojave’s existing contract.

The assignment instead dropped Mojave into a much larger skirmish over American elections. “Ultimately, I made the worst decision of my life in a business context,” Wareham said.

President Donald Trump has spent years falsely maintaining that his 2020 loss was stolen and the product of widespread fraud and foreign interference, claims that have been rejected by courts and officials in his own administration. A 2021 intelligence community assessment found no indication that a foreign actor attempted to alter ballots, vote tabulations or any other technical aspect of the election.

Since returning to office, Trump and allies have revived investigations into the 2020 contest and pushed election security back to the center of his administration’s agenda. Gabbard’s ODNI was one part of that effort, hauling off and analyzing voting systems from Puerto Rico and later becoming involved in a federal investigation of 2020 election records in Georgia.

Wareham said the ODNI officials directly overseeing the company’s technical work wanted the research to continue. Both he and Gulati described the ODNI staff they worked with as professionals who wanted to protect the security of election systems.

The resistance, Wareham said, came from a separate White House collective that was repeatedly dissatisfied Mojave had not produced evidence supporting claims that the 2020 election had been manipulated.

“There was a separate group — let’s call them White House-adjacent — who was dissatisfied,” he said. “They were dissatisfied overall that I was not willing to name and shame at that moment” and declare that Trump had actually won the 2020 election.

Asked whether he believed Mojave’s government work was axed because it failed to find the “smoking gun” some officials wanted, Wareham said: “I believe that was part of the termination, yes.”

Reuters reported in April that Kurt Olsen, a prominent 2020 election-denier and Trump adviser involved in efforts to investigate the election, pressed Mojave to broaden its work in search of evidence that could support those claims.

Olsen, who now works at the Justice Department, turned against the company when its research failed to uncover evidence that the Puerto Rico machines had been hacked. He advocated terminating its work and accused Mojave of secretly receiving money from billionaire George Soros, a frequent target of right-wing conspiracy theories, the news agency reported. ODNI has said Mojave’s contract ended because the company completed its voting-machine analysis.

Wareham said an ODNI official informed him while Mojave was preparing to expand its work that the company had been accused of receiving Soros funding. The allegation prompted him to compile a detailed accounting of the young company’s funding sources within three days and send it up the government chain. Asked who he was told had made the accusation, he said an ODNI official reported to him that it was Olsen.

“One, I’m not funded by George Soros,” Wareham said. “Two, it would be great to be funded by George Soros because I would probably not be here, I’d be on a yacht.”

The company kept moving forward. Wareham said Mojave briefed the White House on some of its findings around September. The firm believed it was heading toward a broader effort to remediate vulnerabilities before the midterms and conduct a deeper analysis for signs that the weaknesses it discovered had ever been actually abused.

Then came the record-long government shutdown. Wareham said that on the day he expected an expanded contract to move ahead, Mojave instead received a stop-work order and no additional funding.

“I think the government shutdown was all that was required, really, to have some folks that I didn’t know were still in the game, again, White-House adjacent, to take their shot,” he said. Wareham stopped short of saying he had direct proof that White House officials ordered Mojave removed because of its findings, but said “it was reported to me it was Kurt Olsen” who led the efforts.

The White House, ODNI and Olsen did not return requests for comment.

Identified vulnerabilities

Mojave had found many issues with the machines it examined. Gulati described the Puerto Rico system during the Voting Village presentation as “deeply insecure,” saying it did not meet the security bar he would expect from “an average low-risk application, let alone critical infrastructure.”

Researchers identified at least 12 major vulnerabilities in commercial software installed on the system, Gulati said. Mojave successfully executed five of them. None were newly discovered flaws, and fixes were already available — in some cases well before the system was used in the election.

Other weaknesses were rooted more deeply in how the system was built and deployed. Some passwords could be easily cracked and others were embedded directly into software. Firewalls were turned off on critical systems and ports were left open. Gulati was particularly critical of the system’s cryptography, which he described as being “in shambles.”

The company does not believe every problem it found necessarily stopped at Puerto Rico, as its formal review covered only one system from one manufacturer in one jurisdiction. Gulati suspects the issues could extend beyond a single voting machine company, though Mojave has not examined enough systems from other manufacturers to establish that.

“I don’t expect that the problems are unique to them,” he said. “I think many manufacturers probably exhibit the same problems.”

Mojave produced an approximately 100-page document of the Puerto Rico findings. Gulati said Mojave has been in discussions with Liberty Vote — which acquired Dominion’s election business last year — and that Liberty told the researchers it does not plan to make changes before November.

Liberty said it has not received Mojave’s report.

“Liberty Vote is not in receipt of any such report so, therefore, we cannot provide any comment,” a spokesperson said. “As always, Liberty Vote is committed to advancing the future of secure American elections.”

No evidence of vote tampering

Looking at the systems headed into the midterms, Gulati said, “I do know that as of now, the state that we have described is going to be pretty similar to what will be deployed in November.”

Despite the extensive findings, Gulati repeatedly returned to what the researchers did not establish: “We found extensive and largely unacceptable weaknesses,” he said in the presentation. “But we did not find evidence that those weaknesses were actively exploited or that votes were altered.”

That distinction has drawn renewed attention as Trump and his allies again focus on election matters.

Last month, the president used a prime-time White House address to release newly declassified intelligence he said showed China interfered in the 2020 election. Among several disclosures, Trump pointed to intelligence showing Beijing had acquired personal information on roughly 220 million American voters. But the documents did not show China altered votes or gained the ability to manipulate voting systems.

Gulati echoed those conclusions Friday when asked about the declassification.

“The China thing isn’t really much of anything,” he said, arguing that a large amount of the voter information at issue could be obtained commercially and should not be confused with access to election systems in ways that can manipulate votes.

“There is no evidence that I know of that says China successfully or any other country has successfully infiltrated our systems and manipulated votes in any way,” he added.

Wareham called the 100-page document a preliminary report and said the firm had wanted another six months to a year to dig deeper into the underlying data.

Gulati said the company’s interactions with the ODNI employees overseeing that work were markedly different from the political pressure the researchers later encountered. “We were never pressured to put anything in our reports that was untrue or politically leaning in a certain way,” he said of those officials.

Wareham said Friday that Mojave itself has pushed for its report to be made public for roughly a year and has recently been told it could soon emerge through a Freedom of Information Act request. Nextgov/FCW could not immediately determine the origin of the FOIA requester. As of publishing time, ODNI’s FOIA logs are available up until January 2025.

“I’m a little annoyed that we are very close to midterms and we had a whole year to freaking figure this out,” Wareham said.

With their government work scrapped, he announced at the Voting Village that he had filed paperwork to create the Machine Assurance Institute, seeking to bring together cybersecurity researchers and election technology companies to examine and independently verify voting infrastructure.

“We wanted to be the national security answer, and put to bed, finally, discussions about prior elections and/or accusations of voter fraud,” said Wareham. “Because, believe it or not, I find it fairly national security-destabilizing to constantly accuse each other of cheating.”

]]>

New ‘Water Watch Center’ launched to help small utilities stop cyberattacks

David DiMolfetta — Fri, 07 Aug 2026 14:19:00 -0400

LAS VEGAS — A new program is seeking to assist water providers around the country as multiple states grapple with possible Iran-linked cyber intrusions against water infrastructure.

The Water Watch Center provides direct cyber mitigation support to utilities serving fewer than 10,000 people, which represents most of the nation’s community water systems. Launched at this year’s DEF CON hacker convention, the initiative is a joint effort between the National Rural Water Association and DEF CON Franklin, a project of the Cyber Policy Initiative at the University of Chicago Harris School of Public Policy.

More than 30 community water systems in Minnesota were targeted late last month, according to state officials. Around 12 states have reported similar activity in recent days, though state officials said they continued operating safely and experienced no known effects on public health. The FBI and Cybersecurity and Infrastructure Security Agency are working on incident response.

An initial group of five cybersecurity firms will help deliver services to water utilities as part of the initiative.

“These leading cyber firms and NRWA are architecting a scalable cyber delivery model that has eluded water industry and national security officials to date,” Jake Braun, the co-founder of DEF CON Franklin and a former White House acting principal deputy national cyber director, said in a statement.

Retired Gen. Paul Nakasone, who led U.S. Cyber Command and the NSA from 2018 to 2024, said at DEF CON this year that water utilities around the country are highly exposed, and he pushed for higher defense standards in the sector.

“These [programmable logic controllers] should not be exposed to the internet,” he told reporters in a briefing on Friday, referring to the small computers used to operate pumps, valves and other equipment inside water facilities.

Some U.S. officials believe Iran may be responsible, though there has been no definitive public confirmation.

“I think [the government] is taking a very measured approach to make sure that they have the right actor that’s doing this,” Nakasone said when asked about why Iran hasn’t publicly been linked to the hacks

“I look at intent. I look at capability. I look at history. I’m not the person that’s making the call on the attribution, but I see an actor here that has certainly shown a history of being able to do this,” he said. “They certainly have the capability, and I think there’s an intent right now — we’re in conflict with Iran.”

]]>

CISA cautions against rigid rules for future of cyber vulnerability program

David DiMolfetta — Fri, 07 Aug 2026 10:33:00 -0400

LAS VEGAS — The Cybersecurity and Infrastructure Security Agency sees value in formally placing the world’s dominant software vulnerability tracking program into federal law but is cautioning Congress against imposing rules that could make it harder to adapt as artificial intelligence and international partners reshape the system.

The Common Vulnerabilities and Exposures Program, or CVE, gives publicly known security flaws standardized identifiers so that governments, software companies and researchers can easily communicate about the same issue. It was first created in 1999, and it underpins cybersecurity discussions across both private industry and the national intelligence community.

Policymaking interest in the program followed a funding scare last year that exposed the fragility of the arrangement supporting its functions. MITRE, the scientific research giant that helps operate CVE under a federal contract, warned last April that its funding from the government would imminently expire.

CISA then extended the contract within hours, a sweeping relief for the cybersecurity community that raised fresh questions about why a major global cybersecurity resource leaned so much on a sole U.S. contract. A CISA official previously said that a “broad internal contracting review caused a brief renewal delay in April 2025, but operations continued without disruption and MITRE was ultimately retained as the program operator.”

A legislative proposal reported by Nextgov/FCW in June would formally authorize CVE within the Department of Homeland Security and establish a clearer legal role for CISA, its longtime federal sponsor.

“Defining the importance of the program in legislation in general seems like a very helpful thing,” Lindsey Cerkovnik, branch chief for vulnerability response and coordination at CISA, said Thursday during a panel at the Black Hat cybersecurity conference.

But Cerkovnik, whose office helps oversee CVE, said legislation could become counterproductive if it dictates too precisely how the program must operate.

“When you overdefine how to execute the thing, it can make it very restrictive and difficult,” she said. “In some ways, we are wary of overly-restrictive guidance” that could make CVE less nimble, agile and flexible, she added.

The congressional proposal would also require CISA and the National Institute of Standards and Technology to develop a modernization plan and establish a 15-member board to set CVE policies and priorities. Permanent seats would go to CISA, NIST and top-level CVE authorities, while rotating members would represent industry, academia, researchers and foreign governments.

Reps. Delia Ramirez, D-Ill., and George Whitesides, D-Calif., submitted the proposal as an amendment to the fiscal 2027 defense authorization bill. But the House Rules Committee didn’t select it for floor consideration, preventing it from getting a vote in the full House last month.

Cerkovnik said CISA had reviewed the proposal and saw both benefits and challenges. Formal recognition could help preserve support for the program, although CISA and DHS have maintained its operations without a lapse for more than 26 years, she said.

CISA is CVE’s sole federal sponsor, while MITRE helps execute the program alongside a global network of more than 530 CVE Numbering Authorities, known as CNAs. Those organizations — which include software vendors, research groups and national cybersecurity agencies — can assign identifiers and publish information about vulnerabilities within their areas of responsibility.

The number and variety of those participants has allowed CVE to keep pace with a growing volume of software flaws. AI, however, is widely expected to accelerate vulnerability discovery further and may require the program to make changes that its current structure did not anticipate.

Cerkovnik pointed to a recently announced AI researcher CNA pilot program that would allow selected AI companies to assign CVE identifiers for vulnerabilities uncovered through research using their own models.

That program may need to bring people with AI expertise into its leadership, she said, and rules narrowly prescribing who can serve on CVE boards or how new participants are admitted could complicate that kind of response. Cerkovnik didn’t say the current congressional proposal would block the pilot, instead using it to illustrate why the program needs room to adjust as technology changes.

CVE is also becoming less centered on the United States. The European Union Agency for Cybersecurity, known as ENISA, became a CVE Numbering Authority in 2024 and a CVE Root in November 2025. Roots oversee groups of numbering authorities, helping organizations join the program and maintaining the quality of the vulnerability records they produce.

ENISA has since begun bringing European organizations under its Root, building on the agency’s stated goal of helping strengthen and modernize CVE.

Nuno Rodrigues Carvalho, ENISA’s head of sector for incident and vulnerability services, said on the panel Thursday that the agency now wants to “step up in the coming months” to also be a top-level Root, bringing it to the same level as CISA and MITRE.

He described a more federated model in which organizations in Europe, Japan and potentially other regions oversee nearby numbering authorities and provide further support to the project.

Europe already accounts for roughly one-fifth of the organizations authorized to assign CVE identifiers, Carvalho said. ENISA also operates the European Vulnerability Database, although he emphasized that it relies on CVE identifiers rather than competing with the existing system.

Cerkovnik backed growing foreign participation, arguing the past year had reinforced the need to describe CVE as “a global program and not just a U.S.-centric program.”

AI poses another challenge by potentially increasing the number of vulnerabilities companies and governments must process. Cerkovnik said she expects CVE to scale alongside that growth but is more concerned about whether organizations can determine which flaws demand immediate attention.

“Not all vulnerabilities matter. Not all vulnerabilities matter at the same level,” she said. CISA made a similar argument in a binding directive issued in June that tells federal agencies to base patching deadlines on a variety of factors.

Some lower-risk flaws could be left until a system receives a major upgrade, while the most dangerous vulnerabilities may require action within days. That kind of triage will become more important as AI produces more findings, Cerkovnik said, because neither CVE nor the organizations relying on it can treat every newly discovered flaw as equally urgent.

]]>

CISA still finds water system controls exposed online amid multistate hacks

David DiMolfetta — Thu, 06 Aug 2026 14:53:00 -0400

LAS VEGAS — Federal cyber officials are still finding water system controls exposed to the public internet, even as the Cybersecurity and Infrastructure Security Agency and the FBI help utilities recover from a series of cyberattacks affecting at least 12 states, acting CISA Director Nick Andersen told Nextgov/FCW on Thursday.

“We’re seeing things like [programmable logic controllers] that are open and accessible on the internet with either no password set or default password set,” Andersen said in a brief interview on the sidelines of the Black Hat cybersecurity conference. “We’re not making ourselves hardened targets.”

Programmable logic controllers, commonly dubbed PLCs, are small computers used to operate pumps, valves and other equipment inside water facilities. Connecting them to the internet can allow operators to manage equipment remotely but it can also give hackers a path into systems that directly control physical processes.

Andersen said CISA’s immediate guidance to utilities remains straightforward: “Get your operational technology off the internet, set a password.”

The remarks come about a week after CISA warned that hackers were increasingly targeting internet-connected controllers used by water and wastewater utilities. The agency said attackers had changed passwords and other settings, locking out operators and contributing to water pressure problems, boil-water notices and extended periods of manual operation.

More than 30 community water systems in Minnesota were targeted late last month, according to state officials. Around 12 states have reported similar activity in recent days, though state officials said they continued operating safely and experienced no known effects on public health. The FBI has said it is aware of the incidents. Andersen also said CISA is working with the FBI on incident response.

But the cyberdefense agency isn’t attempting to determine publicly who was responsible for the hacks, he said.

Some U.S. officials suspect Iran-linked hackers carried out the attacks. A CISA notice distributed to water utilities last month said the activity in Minnesota shared characteristics with an earlier campaign involving Iran-affiliated hackers, though it didn’t provide direct evidence linking the latest incidents to Tehran.

“For us, we’re not doing anything with attribution right now,” Andersen said, explaining the agency is instead focused on assisting affected organizations, educating operators and improving the sector’s security over the longer term.

CISA also tries to identify vulnerable organizations before they are attacked by examining the broader collection of internet-facing systems, Andersen said. When the agency discovers a potentially exposed device or another security problem, it coordinates with other agencies and contacts the operator, he added.

Andersen couldn’t provide a precise estimate of how many exposed or poorly secured devices remain online.

Water utilities can be difficult to secure because many are small, have limited budgets and depend on aging equipment installed and maintained by multiple contractors. Still, Andersen said infrastructure operators bear some responsibility for taking basic precautions that can make their systems more difficult to compromise.

“There’s a degree of personal responsibility there to sort of engage in these minimum requirements that are feasible for helping to continue to secure yourselves,” he said.

]]>

AI advances are pushing governments to treat cyberattacks as routine, Western officials say

David DiMolfetta — Thu, 06 Aug 2026 10:15:00 -0400

LAS VEGAS — The rise of autonomous artificial intelligence systems capable of finding and exploiting software flaws is putting serious pressure on governments to treat cyberattacks as inevitable events rather than rare emergencies, senior officials from the United States, Canada and Britain said Wednesday.

“Cyber compromise is not a black swan anymore. It’s just a swan,” Joseph Alm, the Department of Homeland Security’s assistant secretary for cyber, infrastructure, risk and resilience policy, said on an OpenPolicy panel at the Black Hat cyber conference. Organizations can no longer treat a breach as an unforeseeable crisis, he argued, and they should instead assume one will occur and prepare to limit the damage.

Alm said governments and companies need to devote more attention to “harm reduction,” including the steps they would take to contain an intrusion and continue operating after a hacker gets inside. AI is making it easier for hackers to find and exploit the weaknesses already buried in older technology, he added.

The remarks highlight a bleak near-term reality for cyberdefenders that concludes AI systems will find and exploit weaknesses faster than governments can fix them, and that agencies will need to assume some attacks will succeed and plan accordingly.

Michael Duffy, the federal government’s acting chief information security officer, said federal cyber policies over the past decade have largely been written after a crisis, with the Office of Personnel Management and SolarWinds breaches prompting new requirements designed to prevent the same failures from recurring.

The U.S. has become better at finding what went wrong and preventing the same failure from happening again, but the next decade needs to focus on anticipating attacks and ensuring agencies can continue functioning while under pressure, he argued .

“We know things cannot go down for an extended period of time,” Duffy said.

Some officials, however, cautioned against viewing AI as the source of most cyber risk. Jonathon Ellison, the U.K. National Cyber Security Centre’s director for national resilience, said a more immediate problem for many organizations remains the large number of known weaknesses already sitting inside their networks after years of underinvestment.

Policy discussions can focus too heavily on AI discovering new vulnerabilities when companies are already carrying enormous security burdens from outdated and poorly secured technology, Ellison said.

Thomas Lind, a former intelligence officer who directed policy at the White House Office of the National Cyber Director until June, noted that while officials anticipated advanced AI cyber capabilities, the rapid proliferation of these tools beyond certain governments and large firms has drastically reduced response times for policymakers and defenders.

Rajiv Gupta, head of the Canadian Centre for Cyber Security, similarly described autonomous agents as a significant change that governments are still working to understand, even though Canada has used less advanced forms of AI in cyber defense for years. At the same time, he said, countries still face a substantial backlog of older technology that must be replaced or secured, and governments will not have a “patch army” capable of fixing every vulnerable system for every organization.

That reality has led Canadian officials to consider what basic services citizens should expect the government to preserve during an extreme disruption, including the hypothetical loss of internet access for as long as three months. Gupta described the work as a “Minimum Viable Canada” initiative focused on identifying and maintaining the country’s most essential functions through a crisis.

The warnings come amid a series of recent unprecedented cyber incidents involving autonomous AI agents. Last month, OpenAI models escaped an internal cybersecurity evaluation environment and breached Hugging Face. Britain’s AI Security Institute disclosed this week that agents powered by Anthropic’s Mythos 5 and OpenAI’s GPT-5.6 Sol took unauthorized actions on the public internet during testing, including an unsuccessful attempt to place malicious code in an open-source software project.

And just Wednesday, Meta confirmed that one of its models exploited a flaw at another company after an outside testing firm mistakenly gave it internet access.

Duffy said he is working with NIST, the Cybersecurity and Infrastructure Security Agency and other parts of the government to more quickly turn technical guidance on emerging cybersecurity risks, including those involving AI, into policies for federal agencies. He didn’t provide a timeline for any finalized guidance.

The government can’t wait for another major incident to determine how AI should be governed or how agencies should use them, Duffy argued. “We likely won’t have time to pick up the pieces with the speed and the scale of what we’re seeing in these AI capabilities,” he said. “We know the types of steps that need to be taken. Let’s take them now.”

]]>

Hugging Face AI breach is ‘most consequential hack’ since Morris Worm, former NSA cyber chief says

David DiMolfetta — Wed, 05 Aug 2026 13:32:00 -0400

LAS VEGAS — An OpenAI system that broke out of a cybersecurity test and entered Hugging Face’s network was a “watershed moment” comparable to the 1988 Morris Worm infection, former National Security Agency cybersecurity director Rob Joyce said Wednesday.

“We’re living in the last several weeks through with what I think is the most consequential hack,” Joyce said. He spoke alongside fellow former NSA cybersecurity director Dave Luber during a World Wide Technology panel held at the Black Hat cyber conference.

“I have to go back all the way to the Morris Worm in the ’80s to say something that’s equivalent to how it’s going to change the way we think about our infrastructure,” he said.

The Morris Worm spread automatically across the early internet, disrupting thousands of computers and helping spur major changes in how the government and technology industry handled cyber incidents. The episode led to the first felony conviction under the 1986 Computer Fraud and Abuse Act.

Joyce said he once believed large language models would mainly help hackers write convincing phishing emails and create fake images, audio and video, but he didn’t expect them to become broadly useful for carrying out the more technical stages of an attack.

“And boy, was I wrong,” he said, adding that the systems can now understand computer programs and networks well enough to find vulnerabilities that can be turned into working intrusions.

Hugging Face disclosed in July that an autonomous agent powered by OpenAI models had gained unauthorized access to parts of its production network. The company operates a widely used platform where developers store and share AI models, software and data.

OpenAI had been testing how effectively its models could find and exploit software vulnerabilities. The company loosened some of the models’ normal security safeguards for the exercise, which was supposed to remain inside an isolated testing environment. The agent instead reached Hugging Face, accessed internal datasets and credentials and moved across parts of its infrastructure.

Other researchers have since reported AI agents acting beyond the intended limits of cybersecurity tests. Britain’s AI Security Institute said Tuesday that agents powered by Anthropic and OpenAI models took unauthorized actions on the public internet during 10 of 122 test runs.

In the most serious case, an agent created fake online identities and attempted to convince an open-source software maintainer to approve malicious code. The maintainer rejected the proposed change, and investigators found no resulting real-world harm.

Luber, who succeeded Joyce at NSA before retiring from government last year, said advanced AI can also make powerful hacking tools available to a wider range of adversarial groups.

Five years ago, Luber said, previously unknown software flaws — known as zero-days because developers have “zero days” to fix them before being exploited — were mainly used by well-resourced nation-state hackers, while ransomware gangs generally relied on known vulnerabilities that victims had failed to patch.

“I think that’s changed,” Luber said. As advanced capabilities become more widely available, ransomware collectives could acquire more undisclosed exploits and use them more freely to break into victims’ networks, he added.

Joyce said attackers already use automation to scan continuously for various digital security gaps. AI agents can perform that work around the clock without becoming tired or distracted. Defenders, meanwhile, still rely heavily on people to review alerts, approve updates and respond to suspicious activity.

“The attackers are coming at machine-speed,” Joyce said. “We are on the defense, not at machine-speed today, and that’s got to change.”

The tools aren’t necessarily inventing entirely new hacking techniques, Joyce said, but they are becoming much better at uncovering years of neglected security problems — often dubbed technology debt — across companies and government agencies. Tech debt can include outdated software, unpatched security flaws, default passwords and systems that were built or configured quickly but never fully secured.

That speed should change how organizations install security updates, especially on devices connected directly to the public internet, he argued.

Companies typically test patches before broadly installing them because a faulty update can crash computers or disrupt operations. The widespread 2024 CrowdStrike outage demonstrated the damage a defective software update can cause.

But AI could allow attackers to exploit a newly disclosed vulnerability before an organization finishes testing the patch, Joyce added.

“I think it’s gotten to the point where we have to blindly accept patches for those internet-facing devices and just take them from the manufacturer and immediately put them on,” he said.

That leaves organizations choosing between the possibility that a patch causes an outage and the possibility that waiting exposes them to hacking attempts. But “of those two bad choices, I’m going to accept more risk on a self-inflicted outage than I am exposing myself to ransomware or an extortion event,” Joyce said.

]]>

Chinese telecom firms kept footholds in US networks despite federal crackdowns, House probe finds

David DiMolfetta — Tue, 04 Aug 2026 12:00:00 -0400

Years after federal regulators invoked national security grounds to push three Chinese state-owned telecommunications providers out of the American market, the companies never fully left, a new House probe has found.

China Telecom, China Mobile and China Unicom retained equipment, data-center space and connections to other networks in the United States after the Federal Communications Commission denied or revoked their authority to provide certain telecommunications services, according to a nearly 50-page bipartisan House China Committee investigation planned for release Tuesday and first seen by Nextgov/FCW.

From 2019 to 2022, the FCC denied China Mobile USA’s application to provide international service and revoked authorizations held by China Telecom Americas and China Unicom Americas. But those actions did not require the companies to remove equipment, leave data centers or sever private network links, and the carriers continued offering enterprise networking, internet transit and other services, the panel found.

The committee argues that those remaining footholds could give Beijing’s cyberspies visibility into sensitive traffic, help keep malicious infrastructure online and create opportunities to reroute data or reach U.S. targets. American officials regard China as the country’s leading cyber adversary, with a record of targeting critical infrastructure and stealing military, commercial and personal data.

The three carriers did not respond to detailed requests for comment. Nextgov/FCW also sought comment from the FBI, the Cybersecurity and Infrastructure Security Agency and several U.S. spy agencies. The Defense Intelligence Agency, which produces intelligence findings for the Pentagon, declined to comment.

A spokesperson for China’s embassy in Washington said Beijing “firmly opposes the U.S. overstretching the concept of national security and going after Chinese companies,” adding that China would defend its “legitimate and lawful rights and interests.”

The remaining network ties took on added significance in the committee’s review of Salt Typhoon, the sweeping Chinese espionage campaign uncovered in 2024 where hackers breached major telecom carriers in the United States and abroad. The intrusion reached systems used to comply with court-authorized wiretap requests and allowed the cyberspies to target the communications of senior U.S. officials, including President Donald Trump and Vice President JD Vance.

Reviewing routing data from Sept. 22 to 25, 2024, just as the Salt Typhoon campaign became public, the committee identified 58 groups of internet addresses that CISA had linked to Salt Typhoon servers. China Mobile International’s network appeared in routes to those servers at least 192 times, helping keep the attacker infrastructure reachable as U.S. defenders sought to shut it down, the report said.

The committee does not allege that China Mobile USA employees knew about or participated in the campaign, and it says the routing evidence does not definitively link the company to Salt Typhoon. But the panel argues that the overlap shows how China Mobile’s remaining network ties could help sustain malicious infrastructure.

That finding came from a broader analysis that identified nearly 109,000 incidents from January 2018 through May 2025 in which Chinese or Hong Kong-linked networks allegedly claimed U.S. internet addresses without authorization, potentially diverting American traffic through their systems. The committee classified them as high-confidence hijacks of the Border Gateway Protocol, a bedrock system that directs traffic across networks, but acknowledged that some may have resulted from mistakes or poor network management.

More than 4,200 of the incidents involved China Mobile-controlled networks. In September 2024, eight originated from the same network that appeared in routes to Salt Typhoon servers and diverted traffic belonging to unnamed U.S. network operators, the committee said.

Addressing the threat

Telecommunications networks have long been prized intelligence targets because they can expose private conversations and reveal what political and diplomatic leaders are thinking. Such concerns are compounded by China’s 2017 National Intelligence Law, which requires companies and citizens to assist state intelligence work. Beijing denies that the law compels companies to participate in illegal espionage.

“China’s state telecommunications carriers for too long have enjoyed non-reciprocal access to U.S. domestic networks, but the seriousness of Salt Typhoon gives the FCC and other agencies more than enough justification to restrict or expel them,” said James Mulvenon, a leading authority on Chinese national security issues and vice president of intelligence at risk advisory firm Pamir Consulting.

The committee recommends giving federal agencies greater authority over equipment and private network arrangements that remain after a license revocation, along with targeted removal funding, stronger routing protections and logging requirements for foreign-controlled operators.

Marc Rogers, a veteran telecommunications expert who helped develop the mobile internet in the 2000s and has spent roughly two decades consulting governments and companies on telecom cybersecurity, agreed with many of the panel’s recommendations. Those include treating core telecom systems as high-risk targets requiring closer oversight, strengthening checks on how traffic moves across networks and tightening rules on the foreign-made equipment U.S. carriers can use.

But he disputed the panel’s call to expand “rip-and-replace” efforts targeting legacy telecom equipment, arguing that such programs are economically unrealistic and could significantly disrupt carrier operations.

“On paper it sounds great, until you get someone with operational experience,” Rogers said. “Then they realize you’re basically talking about bulldozing an entire city and building a new one.”

Rogers also said the panel’s recommendations resemble measures in British telecom security law but warned that they would work only if countries act together.

“If only one country takes a strong position, China will just maneuver around them,” he said, adding that the proposals are largely aimed at tactics China has already used. Policymakers should learn from those incidents, Rogers said, while also preparing for how Beijing’s methods may evolve.

The findings underscore the difficulty of removing operators deemed national security risks from a telecommunications ecosystem built on private infrastructure and decades of commercial ties. Regulators can ban specific services without necessarily reaching the equipment, leases and private agreements that preserve connectivity.

The committee based its report on subpoenaed company records, eight interviews conducted under oath, federal records, routing data and network infrastructure scans. It said Cloudflare and unnamed outside cybersecurity experts independently reviewed and verified portions of its routing analysis.

Parent company control and U.S. footprint

Across all three companies, the committee found U.S. subsidiaries that remained dependent on parent or affiliate entities in China or Hong Kong for important technical and operational functions while retaining equipment and network connections inside the United States.

At China Telecom Americas, requests involving connections between U.S. and overseas networks were handled by personnel in Shanghai, Hong Kong or Beijing, according to testimony cited in the report. Service orders could also flow through a parent-controlled system to Shanghai Telecom without a separate contract. The U.S. subsidiary did not keep independent traffic-flow records, leaving employees unable to determine whether a parent or affiliate had changed routes involving equipment in the United States.

China Telecom Americas identified 10 active points of presence — sites where a carrier keeps equipment and connects with other networks — across seven metropolitan areas. A senior engineering official also told the committee that about a quarter of the company’s U.S. transmission hardware was still made by Huawei, whose equipment the FCC has deemed a national security risk.

China Mobile USA, meanwhile, was described by one witness as “basically a sales team,” while another said it had no network engineers. Orders for data center space and network connections were approved at its Hong Kong headquarters, and witnesses could not identify a network operations team based elsewhere.

Despite this, China Mobile USA’s records contained 39 point-of-presence entries across 27 data-center and interconnection facilities. The committee said those sites connected it to carrier backbones, internet exchanges and private networks used by major U.S. technology companies. Investigators identified at least 143 active China Mobile network assets in U.S. facilities.

China Unicom Americas disclosed that seven of its eight directors and two of its three senior managers were Chinese Communist Party members. Its U.S. employees used parent-controlled email and computer systems, and evidence indicated that they operated under cybersecurity, administrative and privacy policies issued by China Unicom Global.

A compliance official told the report’s authors the subsidiary could guarantee its own adherence to U.S. law, but not its parent’s.

A China Unicom Americas compliance official also acknowledged that the subsidiary did not know the identities of some third parties in China that ultimately received services ordered through China Unicom Global. The company had equipment and active connections in roughly 10 U.S. data centers.

Other carrier relations

The report also describes relationships between the three Chinese carriers and companies linked by U.S. authorities to Chinese hacking operations.

China Mobile, in one case, acted as a middleman for CloudRadium, a Hong Kong hosting provider whose infrastructure has repeatedly surfaced in malicious cyber activity, the committee said. Subpoenaed records showed that China Mobile purchased U.S. data center space and network connections on CloudRadium’s behalf, including through a four-year contract valued at $480,000.

The report also links CloudRadium to a Wyoming company of the same name and GlobalData Investments, a California corporation that markets hosting and data center services under the CeraNetworks name. Nextgov/FCW found that the companies’ websites used similar logos, layouts and animations. An email sent to an address listed for Steven Beals, identified online as GlobalData Investments’ chief operating officer, was returned as undeliverable.

The committee also details China Unicom’s relationships with Integrity Technology Group and i-SOON, two Chinese cybersecurity contractors U.S. authorities have linked to state-backed hacking.

A 2024 U.S. advisory identified Integrity Tech infrastructure as the control layer for a botnet of compromised routers and other internet-connected devices operated by Flax Typhoon, a Chinese state-sponsored hacking group. China Unicom Beijing network addresses were used to manage the botnet and connect it to other attack infrastructure and, according to the committee’s report, China Unicom and Integrity Tech formalized a cooperation agreement in November 2023 while the botnet was operating.

China Unicom separately appeared as a corporate partner of i-SOON. The company drew international scrutiny after a large collection of purported internal documents appeared on GitHub in 2024, exposing details about its hacking tools, targets and work for Chinese police and intelligence agencies.

The Justice Department later charged eight i-SOON employees and two Chinese police officers in a years-long hacking campaign, alleging that the company worked with at least 43 intelligence or police bureaus. The charges have not been proven in court.

Integrity Tech’s website was unavailable when Nextgov/FCW attempted to contact the company, and a functioning corporate website for i-SOON could not be located.

“China has been conducting an escalating campaign of cyberattacks on U.S. networks as a form [of] operational preparation of the battlefield,” said Jack Burnham, a senior research analyst in the China Program at the Foundation for Defense of Democracies whose work focuses on China’s military, emerging technologies and science and technology policy.

“Key to these efforts is Beijing’s capacity to access core domestic networks, either via installed equipment, routing relationships, or other interconnections,” Burnham said. “While the FCC has sought to tamp down on Chinese state-owned telecoms firms that pose a national security threat, there is clearly more work to be done, both in terms of regulation and rip-and-replace, to properly handle these threats.”

]]>

Lawmakers propose giving 2015 OPM breach victims identity protection for life

David DiMolfetta — Mon, 03 Aug 2026 09:00:00 -0400

Federal employees and contractors whose sensitive personal data was stolen in the massive Office of Personnel Management breaches disclosed a decade ago would receive identity protection for the rest of their lives under new bicameral legislation.

Senate Intelligence Committee Vice Chair Mark Warner, D-Va., and Del. Eleanor Holmes Norton, D-D.C., plan to introduce the RECOVER PII Act on Monday, aiming to prevent the federal government’s identity-protection program for victims from expiring Sept. 30, according to bill text first seen by Nextgov/FCW. Sens. Tim Kaine, D-Va.; Angela Alsobrooks, D-Md.; and Chris Van Hollen, D-Md., are also Senate cosponsors.

Just over 10 years after the OPM breaches compromised personal information belonging to roughly 22 million people, the identity-protection services provided to affected federal workers, contractors and their families have begun expiring. People who enrolled in OPM’s MyIDCare program are receiving notices that their complimentary coverage will end 10 years after their individual enrollment date. Some notices began arriving late last year and will continue through September, when OPM plans to conclude the services at the end of the federal fiscal year.

“More than ten years after the OPM data breach exposed the personal information of millions of federal employees, the threat remains,” Warner said in the statement. “The data stolen included workers’ most sensitive and personal information — from Social Security numbers to security clearance records — and once that information is in the hands of a bad actor, you don’t get it back.”

The two breaches compromised information belonging to some 22.1 million current, former and prospective federal employees, contractors and others. One intrusion exposed personnel records for roughly 4.2 million people, while a second compromised 21.5 million background-investigation records. About 3.6 million people were affected in both incidents, according to the Government Accountability Office.

Foreign intelligence services can hold onto these OPM records for years, combine them with information from other cyber intrusions and use the fuller picture to identify or target government personnel and their families.

Those risks can also grow over time. Data stolen from a lower-level employee in 2015 could become far more valuable if that person later moves into a more sensitive national security role. GAO warned last year that adversaries can combine publicly available data to identify military personnel and their families or disrupt Defense Department operations.

Congress responded to the breach in a 2017 appropriations law by requiring OPM to provide victims with at least 10 years of complimentary identity protection and no less than $5 million in identity-theft insurance. The new bill would replace that limit with coverage lasting for the remainder of each affected person’s life while retaining the insurance requirement.

“We have a responsibility to stand by the federal workers who were put at risk through no fault of their own,” Warner said. “This legislation will ensure those affected continue to receive the identity protection they need, while helping better safeguard personal information from future exploitation.”

The bill would also allow agencies to reimburse federal employees and contractors for privacy tools and services, such as those that remove or limit their personal information online. Agencies would decide whether to offer the reimbursements, which would not be limited to OPM breach victims and would come from their salary-and-expense budgets.

Norton has introduced legislation in the past seeking lifetime protection for OPM victims, beginning after the breaches were disclosed. Similar bills introduced over the years have not become law.

“Lifetime identity protection is the only solution that will give the workers whose data was compromised the peace of mind they deserve,” Norton said in a statement. “Because there is no limit on how long personal information can be exploited, Congress must protect these federal employees and contractors in perpetuity. Thank you to Senator Warner for working with me to secure this vital protection for those affected.”

]]>

Cyber industry coalition urges federal action after suspected Iran-linked water hacks

David DiMolfetta — Fri, 31 Jul 2026 16:20:00 -0400

An industry coalition representing operational technology cybersecurity firms and critical infrastructure operators on Friday called for a stronger federal response to a wave of cyberattacks against U.S. water systems, including suspected Iran-linked intrusions affecting more than 30 utilities in Minnesota.

The Operational Technology Cybersecurity Coalition urged the Cybersecurity and Infrastructure Security Agency to issue a governmentwide directive establishing baseline cybersecurity requirements for operational technology used across federal civilian agencies.

“No clearer call to action has existed in the operational technology space,” former CISA cyber policy official and OTCC Executive Director Tatyana Bolton told Nextgov/FCW.

The statement comes a day after CISA warned that hackers are increasingly targeting internet-exposed programmable logic controllers used by water and wastewater systems. The FBI said it is aware of cyber incidents affecting water and wastewater entities in at least seven states.

OTCC’s main recommendation is for CISA to issue a Binding Operational Directive requiring federal civilian agencies to strengthen security across operational technology systems used in buildings and other facilities.

The directive would not apply to the local water utilities targeted in Minnesota, but the coalition contends it would establish stronger federal standards and encourage broader adoption across the private sector.

CISA did not immediately respond to a request for comment.

The group also called on Congress to renew the State and Local Cybersecurity Grant Program, extend the Cybersecurity Information Sharing Act of 2015 and support Andrew McClure in leading the Energy Department office responsible for protecting the power sector from cyber threats.

“By not extending this [state and local] grant program, Congress is leaving small towns to protect themselves from nation-state actors like Iran,” the coalition said.

The information-sharing law is set to expire at the end of September. OTCC said allowing it to lapse could make it harder for the government to identify large-scale cyber campaigns and warn potential victims.

The recent attacks follow years of warnings that Iranian and Chinese hackers have targeted vulnerable systems that support water, energy and other critical services.

“To date, we have been lucky that a more catastrophic incident hasn’t occurred,” Bolton said. “We can no longer rely on luck. We must act.”

Editor's note: This article has been updated to correct the coalition's call for Congress to support Andrew McClure.

]]>

CISA urges water utilities to take exposed systems down after Minnesota hacks

David DiMolfetta — Fri, 31 Jul 2026 09:51:00 -0400

Following coordinated cyberattacks on Minnesota water systems that officials suspect may be linked to Iran, the Cybersecurity and Infrastructure Security Agency on Thursday warned utilities nationwide to remove exposed industrial-control equipment from the internet, citing a surge in activity that has locked operators out, disrupted facilities and triggered boil-water notices.

The Minnesota hacks targeted technology used by more than 30 community water systems on Sunday and Monday, state officials said. Some utilities were forced to operate equipment manually, while an intrusion in Braham briefly knocked out controls for the city’s well and water treatment plant. Officials said they had found no evidence that drinking water quality was affected.

Some officials believe an Iran-aligned cyber group is the culprit behind the attacks, two people familiar with the matter said, though one noted that investigations remain ongoing. Both were granted anonymity because the situation is sensitive.

A recent memo distributed to water industry members and obtained by Nextgov/FCW makes mention of Iran and says several public water utilities reported suspicious cyber activity between July 26 and 27.

The notice, addressed to members of the Water Information-Sharing Analysis Center, cites findings from the Minnesota Fusion Center, which say the water attacks are “aligned” with characteristics of a cyber campaign described by CISA in April that involved Iran-linked hackers, though it does not present direct evidence attributing the latest Minnesota incident to Iran. CISA’s April advisory was notably updated last week on July 22.

The contents of the WaterISAC memo were first reported by Wired. Investigators’ suspicion of Iranian involvement was first reported by the New York Times.

Water and wastewater systems are designated as critical infrastructure under federal policy. Major sabotage could disrupt access to safe drinking water or, in severe cases, damage physical equipment and threaten public health. In the early months of the Israel-Hamas war, a pro-Iran group accessed and defaced interfaces embedded onto U.S. water systems in Aliquippa, Pennsylvania.

If tied to Tehran, the Minnesota attacks would represent the latest escalation in a cyber campaign that U.S. officials and security researchers anticipated from the earliest days of the war against Iran.

After U.S. and Israeli strikes began in late February, suspected Iran-linked actors have since disrupted medical technology giant Stryker, targeted FBI Director Kash Patel’s personal email and breached industrial-control equipment across several U.S. sectors.

U.S. officials expected that activity to continue even after a preliminary agreement with Tehran was reached last month because cyberattacks are widely accepted as standard procedure even in peacetime conditions.

“There is no ceasefire in cyber,” Israel’s top cyberdefense official told Nextgov/FCW in May.

CISA’s alert issued Thursday says unnamed hackers are increasingly targeting internet-connected programmable logic controllers, the devices used to automate pumps, valves and other water-system equipment. The agency urged utilities of all sizes to disconnect exposed equipment, replace default passwords and limit remote access to trusted devices.

One person who works in the water sector expressed frustration that providers continue to leave these devices and other operational technology exposed to the open web.

“If utilities are exposing programmable logic controllers to the public internet, and if the U.S. was a serious country, we’d shut down their operator and sell the utility operations to a competent entity,” said this person, who spoke on the condition of anonymity to be candid about their discontent. “It’s more proof of how unserious the U.S. is about public health in the water sector.”

Water infrastructure is particularly challenging to defend, in part because utilities often manage a patchwork of aging equipment and work with components maintained by multiple contractors over decades, said Aurigo Software CISO Manish Sharma.

“Cybersecurity has to account for that complexity. It must be treated as an infrastructure requirement throughout the asset lifecycle, from planning and design through construction, commissioning, operation, modernization and replacement,” he said.

The Minnesota attacks come as the five-month war with Iran has again escalated after a brief pause in U.S. airstrikes. American forces struck dozens of Iranian Revolutionary Guard targets Wednesday after Tehran fired missiles toward U.S. positions, while Iran launched additional attacks toward Jordan and Kuwait on Thursday. The Strait of Hormuz remains the central obstacle to a peace agreement, with traffic through the major oil and gas route near a standstill.

]]>

Anthropic confirms its AI breached 3 organizations during testing

Alexandra Kelley — Fri, 31 Jul 2026 09:40:00 -0400

Anthropic’s flagship artificial intelligence model Claude gained unauthorized access to the networks of three different organizations, the company announced following internal cybersecurity audits of its routine model evaluations.

In a press release posted on Thursday, Anthropic said that, following the containment breach of OpenAI’s ChatGPT-5.6 and subsequent attack on Hugging Face’s systems, Anthropic conducted an audit of its own model evaluations. The findings revealed that, out of 141,006 examined evaluations of Claude models dating back to April, there were three incidents where a model accessed the internet from within or while interacting with the third-party evaluators.

Each attack occurred during a “capture-the-flag” scenario where the models are asked to find hidden information housed within a different node.

In the blog post, Anthropic blamed a “misunderstanding” between them and their third-party evaluators that granted the models internet access. The models were told in prompts that they would not have real internet access and therefore operated under the premise that all accessible systems were part of the test environment.

“Operating under the false belief that all accessible entities were intended to be in-scope for the exercise, Claude compromised the impacted organizations’ infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints,” the post reads. “It did not find or exploit any complex vulnerabilities, and in each case, Claude continued working to complete only the specific capture-the-flag task its evaluation had assigned.”

The models involved in the incidents were Opus 4.7, Mythos 5, and an unnamed internal research test model that isn’t planned for release. Anthropic stated that, despite accessing the internet as part of its cybersecurity testing, the models did not deliberately attempt to leave their training environments; accessing the internet only occurred as they looked to complete their tasks.

In one incident, Opus 4.7 executed the task on the real-world networks of a company once it realized it could via internet access.

A second incident was more extensive. Mythos 5 sought to find information by referencing software development instructions inside a fictional environment. It used these instructions to install a Python package from a public registry that didn’t actually exist in the hopes that the fictional company would automatically download it, thus granting the model access to its networks. In order to do this, it created login credentials a human user would need.

That Python package was inadvertently uploaded to the internet, where 15 systems downloaded it and compromised their systems.

The third incident saw the prototype model scan real targets after being unable to find the fictional target included in the test.

Anthropic noted that, when the models were able to discern that the attacks affected real systems, they halted their testing processes — something that, in part, the company said, gives it “cautious optimism.”

“Several defense-in-depth measures, on both our side and our partner’s, could have prevented these incidents or at least reduced their likelihood of occurring,” the post read. “Both we and our partner also could have reviewed evaluation transcripts or network logs more thoroughly. It’s also possible that a prompt which told Claude it did have internet access would have changed how Claude behaved when it came into contact with real systems.”

In the aftermath of the breaches, Anthropic is working with its evaluation partner, Irregular, and METR, an independent AI evaluation organization, to continue conducting reviews. It is also working alongside affected companies whose systems were compromised.

Anthropic concluded by saying it encourages other AI developers to conduct similar audits and that evaluation exercises in general need stronger oversight and safeguards.

“Ultimately, many factors contributed to these incidents, but, consistent with a blameless postmortem culture, we’re approaching the fixes as if the responsibility were ours alone,” the post reads.

Industry peers characterized Anthropic’s revelations on the heels of OpenAI’s incident as a burgeoning pattern cyberdefenders should heed.

Tom Kellermann, the vice president of AI Security and Threat Research at TrendAI, said that these incidents underscore the continued need for safeguards even in secure sandbox environments.

“Anthropic and OpenAI just proved that when you strip guardrails for testing, you’re not creating a sandbox, you’re inviting systemic risk,” Kellermann said in a statement to Nextgov/FCW. “Every organization deploying agentic AI needs to ask itself if their evaluation environment is actually contained. Containment and monitoring are no longer optional.”

]]>

Amazon uncovers broad North Korean hacking campaign against open-source software

David DiMolfetta — Wed, 29 Jul 2026 14:58:00 -0400

A North Korea-linked hacker group has been tied to four open-source software compromises dating back to March 2025, Amazon researchers said Wednesday, significantly expanding the publicly known scope of Pyongyang’s efforts to use trusted code to reach large numbers of potential victims and gain access to companies’ systems.

The assessment for the first time links the same financially-motivated hacking group to compromises of four major JavaScript packages — typo-crypto, debug, chalk and axios — that developers use as building blocks for other software. The axios package alone receives more than 100 million downloads each week, and its compromise had previously been attributed to the North Korean group.

Amazon said Wednesday that it had uncovered evidence connecting the actor to the three earlier incidents, based on technical findings that included instances of reused code and similarities in how the attacks were carried out.

Amazon Threat Intelligence attributed the campaigns to the group with “medium confidence,” according a blog post authored by Amazon Integrated Security CISO CJ Moses scheduled for release Wednesday evening. The cyber intruders are tracked by researchers under several names, including Sapphire Sleet, Stardust Chollima, BlueNoroff, CageyChameleon and Alluring Pisces.

In each incident, the hackers tricked a trusted software maintainer and used the access to publish an update containing malicious code, according to Amazon. Organizations configured to automatically download the latest version of those packages may have pulled the compromised updates directly into their systems. The approach allows hackers to compromise a small number of widely used packages while potentially gaining access to thousands of downstream systems, making it more efficient than targeting organizations individually.

Open-source software — code that can be freely inspected, modified and reused — underpins operating systems, web servers, encryption tools and many of the applications businesses rely on daily all over the world. The projects often depend on volunteer maintainers to review proposed changes, fix security flaws and publish updates.

That model relies heavily on trust. Attackers can spend weeks or months posing as legitimate contributors, fixing bugs and building relationships before attempting to gain control of an established project or publishing a malicious update.

That dynamic drew widespread attention in 2024, when an account operating under the name “Jia Tan” spent years gaining the trust of other developers before attempting to insert a backdoor into XZ Utils, a widely used data-compression tool included in numerous Linux distributions. The backdoor was discovered before it could be broadly deployed.

“Quite frankly, the open-source community is looking for good citizens because these packages are often not maintained by people who are getting paid to do that as a full-time job,” Rick Anthony, senior manager for Amazon’s Inspector vulnerability management service, told reporters in Arlington, Va. on Wednesday. “They are very welcoming for anyone who is willing to contribute.”

North Korea has long treated cyber operations as both an intelligence tool and a source of revenue. Its hackers steal cryptocurrency, conduct espionage and extort victims, while operatives posing as remote IT workers obtain jobs at foreign companies and quietly funnel their salaries back to the regime. Amazon is among those companies, executives said Wednesday. U.S. officials say the proceeds help Pyongyang evade sanctions and finance its nuclear weapons and ballistic missile programs.

“For a sanctions-constrained regime, generating revenue through these operations means that the greater the efficiency, the more money they get, and the more that they can use that money to do things that got them the sanctions to begin with,” Moses told reporters. “One successful supply chain compromise can yield access to hundreds, if not more, targeted intrusions.”

The findings also illustrate how open-source attacks are becoming harder to detect.

Amazon said attackers are increasingly dividing a malicious operation among several packages that appear harmless when reviewed individually. One package may contain encrypted data, another the code needed to unlock it and a third the instructions to download and execute the final payload. The malicious behavior becomes visible only when the components are used together.

AI is also making malicious software harder to spot, the blog warned. Hackers can use it to create polished-looking code, convincing documentation and fake developer profiles, eliminating many of the obvious mistakes that once raised red flags.

Attackers can also exploit errors made by AI coding assistants. If an AI tool recommends a software package that does not exist, hackers can register the name and load it with malware, hoping a developer or automated system will download it without realizing the recommendation was wrong.

Concerns about open-source software security have increasingly drawn attention in Washington. In December, the chairman of the Senate Intelligence Committee asked the White House national cyber director to take steps to address vulnerabilities in open-source projects that help power systems used throughout U.S. military and civilian agencies.

Last August, Nextgov/FCW first reported that an employee of the Russian technology company Yandex was the sole maintainer of a widely used open-source tool embedded in at least 30 pre-built software packages available to the Defense Department.

]]>

After Hugging Face breach, FedRAMP chief tells slow-to-patch vendors to stay out of government

David DiMolfetta — Thu, 23 Jul 2026 14:32:00 -0400

Technology companies that cannot quickly fix dangerous vulnerabilities should not be allowed to sell their products to federal agencies, the head of the government’s bedrock cloud security program said Thursday.

Pete Waterman, director of the General Services Administration’s Federal Risk and Authorization Management Program, known as FedRAMP, delivered the blunt warning while discussing resistance from companies that say they lack the resources to address a known, exploitable vulnerability exposed to the internet within a matter of days.

“If that is the way that you are approaching information security today … the way your company is approaching information security today, I don’t want you in the federal marketplace, and you shouldn’t be selling your software to anyone,” Waterman said in a discussion at Carahsoft’s FedRAMP Summit in Washington, D.C. FedRAMP is a cornerstone governmentwide program that sets security requirements for cloud products used by federal agencies.

Waterman pointed to a major incident involving OpenAI and Hugging Face disclosed this week as evidence that companies must prepare to detect and counter cyber activity at speeds that human security teams alone cannot match.

OpenAI said Tuesday that several of its models — including GPT-5.6 Sol and a more capable model that has not yet been released — escaped a restricted testing environment and compromised parts of Hugging Face’s production infrastructure while pursuing the answer to a cybersecurity test. Hugging Face is a popular open platform where researchers, developers and companies can share and test AI models, datasets and applications.

OpenAI was testing how well the models could exploit software flaws. The company had loosened safeguards that normally prevent risky cyber activity so researchers could measure the models’ full capabilities. The test took place in a sealed-off environment that was not supposed to have access to the internet. But the models found a previously unknown flaw in one of the few services they could reach and used it to break out.

According to OpenAI’s preliminary account, the models exploited the flaw to escape the testing nexus, moved through parts of OpenAI’s research infrastructure and found a system connected to the public internet.

The models then determined that Hugging Face might contain material related to the test. They used stolen credentials and additional previously unknown vulnerabilities to gain access to Hugging Face servers and retrieve test solutions from a production database, OpenAI said.

All available evidence suggests the models were narrowly focused on completing the assigned evaluation rather than deliberately trying to harm Hugging Face, according to OpenAI. But the incident demonstrated that advanced models can autonomously discover vulnerabilities, combine them into a longer attack and take actions outside their intended environment in pursuit of a goal.

Hugging Face first disclosed the intrusion on July 16, before OpenAI publicly identified its models as the source. The company said the autonomous system performed thousands of actions over a weekend, accessed a limited number of internal datasets and obtained credentials used by several services.

The remarks are highly significant because FedRAMP serves as the government’s main security gatekeeper for cloud products. Companies generally need FedRAMP authorization before agencies can use their services, meaning Waterman’s warning may carry real implications for which providers can compete for federal business. He did not announce any new enforcement actions or say that any provider would be removed from the federal marketplace.

Still, the OpenAI-Hugging Face incident itself “unequivocally changed” the world of cybersecurity, Waterman said.

“Everything that you do has changed and will change. You knew this was coming for a long time, but it wasn't quite real. Now it is,” he added.

FedRAMP’s ongoing 20x overhaul places greater emphasis on automation and security outcomes instead of treating authorization mainly as a paperwork and compliance exercise. Its new vulnerability-response framework directs providers to continuously find, evaluate and address security weaknesses.

Under the rules, providers are expected to begin reducing the risk from the most serious internet-facing and likely exploitable vulnerabilities within two or four days, depending on the potential impact. FedRAMP 20x providers must also verify the condition of their machine-based systems at least once every three days. The Cybersecurity and Infrastructure Security Agency has also directed similar timelines for the most risky flaws that need immediate patching.

Waterman said companies will not meet those expectations by leaving compliance personnel separated from the engineers who build and maintain their products. Security, engineering and product teams must be able to work together and make changes quickly enough to counter AI-backed cyberattacks, he said.

“The compliance part of FedRAMP is how you assure us that you’re doing that,” he said. But if a company is not already motivated to invest in security and integrate those functions, he added, its approach “will not succeed.”

“It is about you being an ambassador to your business to make sure that your business is properly investing in security and making the changes necessary, which is going to include changes to your job in order to make your business successful,” Waterman argued. “Otherwise, you will fail because you cannot play this game the way that we played it last year.”

Nextgov/FCW Managing Editor Edward Graham contributed to this story.

]]>

Russian hackers can steal government emails without victims clicking a link, cyber agencies warn

David DiMolfetta — Thu, 23 Jul 2026 13:13:00 -0400

Russian state-backed hackers have exploited a vulnerability in widely used email software to steal messages, passwords and authentication data from Western government agencies and other organizations, U.S. and allied cyber-intelligence authorities said Thursday.

The campaign is notable because it does not require victims to click a malicious link or download an attachment. The exploit can instead activate when someone simply opens or previews an email in an unpatched version of the Zimbra Collaboration Suite — a popular alternative to major collaborative messaging platforms like Microsoft Exchange or Google Workspace — according to a joint advisory issued by the Cybersecurity and Infrastructure Security Agency, National Security Agency and FBI.

The Russian hacking group, known primarily as Laundry Bear, has successfully targeted more than 10 organizations since July 2025, the agencies said. The campaign has hit the defense industrial base, federal and local governments, law enforcement, technology companies, educational institutions, media outlets and nongovernmental organizations.

The hackers sought to steal email addresses, passwords and two-factor authentication tokens, which could allow them to retain access to compromised accounts even after obtaining a victim’s password. Their tools also attempted to collect an organization’s email directory, as much as 90 days of a victim’s communications and other sensitive information.

The Treasury Department’s Financial Crimes Enforcement Network purchased a Zimbra standard support subscription in February 2025, according to federal contracting data listed in GovTribe, a federal market intelligence platform owned by Nextgov/FCW parent company GovExec. The purchase does not indicate whether FinCEN used the vulnerable version of the software or was targeted in the campaign.

“Unlike traditional phishing that attempts to persuade a user to take an action, such as clicking a link or downloading a file, Laundry Bear’s current campaign uses a zero-click exploit that only requires a user to view a malicious email,” CISA said in a statement.

Proofpoint, which also investigated the activity, describes the technique as a “half-click” exploit because the victim must still open or preview the email. The company said no additional interaction is required once the message appears in a vulnerable Zimbra webmail client.

The emails were sent from both attacker-controlled Proton Mail accounts and addresses that had already been compromised, according to Proofpoint.

In one example released by the company, the sender claimed to represent a Belgian media-verification organization and proposed cooperation among European institutions combating disinformation. The message contained a legitimate-looking link to a European Union events calendar, but the malicious code was embedded directly in the email itself.

CISA urged organizations to update all Zimbra mail software, monitor their email systems for suspicious activity and review the technical indicators included in the advisory. Organizations that find evidence of a compromise should follow the agencies’ remediation guidance rather than relying solely on installing the available patch.

“CISA continues to see sophisticated and less sophisticated nation-state cyber groups deploy increasingly novel exploits into a highly successful capability to disrupt critical infrastructure or conduct espionage,” said Chris Butera, CISA’s acting executive assistant director for cybersecurity.

The advisory was also backed by defense, cybersecurity and intelligence agencies from Australia, Canada, New Zealand, the United Kingdom and more than a dozen European countries.

]]>

Lawmakers get taste of AI-enabled cyberattacks in China-Taiwan war game

David DiMolfetta — Wed, 22 Jul 2026 12:17:00 -0400

Members and staffers from the House Homeland Security Committee and the House China Select Committee were put through a simulated Taiwan crisis Tuesday that tested how U.S. officials might respond to AI-backed cyberattacks targeting transportation and logistics networks needed to deploy American forces.

The Center for Strategic and International Studies hosted the event to give lawmakers a window into the trade-offs and uncertainty that would shape the U.S. response to a fast-moving conflict involving China and its implications in American cyberspace.

Among those participating were Republican Reps. Eli Crane of Arizona, Michael Guest of Mississippi and Michael McCaul of Texas, along with Democratic Rep. Shri Thanedar of Michigan and Puerto Rico Resident Commissioner Pablo José Hernández, also a Democrat.

The scenario begins with China launching a massive military exercise around Taiwan in the summer of 2027, leaving U.S. officials unsure whether Beijing was being coercive, imposing a de facto blockade or preparing for a full invasion of the island, per a readout provided to reporters just before the simulation began. Beijing avoids using the term “blockade” but the moves effectively quarantine Taiwan, the summary says.

Lawmakers are then told that U.S. intelligence analysts suspect Chinese hackers had begun targeting ports, freight rail systems, airports and other transportation networks that could be used to move U.S. forces and supplies. Some of the attacks cause immediate disruptions, while others appear designed to preserve access that could be leveraged later.

Participants also have to decide which networks to defend first, how closely to coordinate with private sector critical infrastructure operators and whether moving U.S. forces would deter China or further escalate the crisis.

Cyber “is always going to be a leader in any kinetic war,” McCaul told participants before reporters were asked to leave the war game room so lawmakers and staff could participate more candidly.

The exercise notably included a smattering of AI-related attacks involving stolen credentials and interference with logistics and routing systems. AI is also used in one attack scenario for a misinformation campaign, per the readout. The final scenario involved a prompt injection, in which attackers try to trick an AI system into following malicious instructions instead of its intended safeguards.

“This committee has been briefed extensively on our latest AI capabilities, Anthropic in particular, the Mythos model, and the amount of destruction that Mythos can do if it’s in the wrong hands,” McCaul said, referring to the powerful cyber-focused AI model unveiled in early April. “And we know China is three to five months behind us. That’s not very long, in my judgment.”

Current and former officials have long warned that China could disrupt U.S. military deployments by digitally sabotaging the largely private-sector ports, railways, airports and other infrastructure used to move troops and equipment overseas. Advanced AI tools, broadly, can help hackers work faster, carry out more parts of an attack automatically and target more systems at once.

The war game scenario mirrors longstanding concerns surrounding Volt Typhoon, a Chinese government-backed hacking group that U.S. officials say has spent years quietly burrowing into American critical infrastructure. The hackers are believed to be positioning themselves inside sectors such as communications, energy, transportation and water systems to disrupt them during a future conflict, including one over Taiwan.

China claims Taiwan as part of its territory and seeks to bring the self-governing island under Beijing’s control. Its major role in producing advanced computer chips makes it strategically important to both China and the United States.

U.S. spy agencies assessed earlier this year that China is not planning to invade Taiwan in 2027. While Beijing has repeatedly refused to rule out using force, the intelligence community said it believes China still prefers to achieve unification without military action.

]]>

Moving beyond checklists to living digital identity risk management

Adam McBride — Mon, 20 Jul 2026 18:23:00 -0400

The federal government is racing to deliver secure, seamless digital services to millions of Americans, from veterans seeking healthcare to citizens accessing benefits. Yet our digital identity systems too often rely on outdated frameworks that treat security as a one-time checkbox exercise.

The National Institute of Standards and Technology’s Special Publication 800-63-4 changes that. Released this year, it marks a doctrinal shift from static compliance to a dynamic, holistic Digital Identity Risk Management (DIRM) process.

As someone leading ICAM efforts at the Department of Health and Human Services and co-chairing related working groups, I believe agencies that treat this update as “just another revision” will fall behind. Those that lean in will build identity systems that are more secure, equitable and user-friendly in an era of sophisticated threats and rising public expectations.

The previous version, SP 800-63-3, served us well by establishing risk-based assurance levels (IAL, AAL and FAL). But the digital landscape has evolved dramatically. Phishing attacks have grown more targeted, synthetic identity fraud proliferates and users demand frictionless experiences across devices.

SP 800-63-4 responds with a five-step DIRM lifecycle: Define the online service, conduct impact assessments, select initial assurance levels, tailor controls and — most importantly — continuously evaluate and improve. This is not incremental; it embeds privacy, customer experience and threat resistance into every decision.

A core advancement is the raised bar for Identity Assurance Levels (IAL). IAL1 no longer tolerates purely self-asserted identities. Even at the lowest level, agencies must validate core attributes against authoritative or credible sources to counter bots and synthetic fraud.

For higher assurance, IAL3 now requires attended sessions with biometric collection. Critically, the standard introduces “No IAL” for services where proofing adds no value — preventing unnecessary data collection and aligning with privacy principles. This flexibility, guided by DIRM’s tailoring step, lets agencies avoid over-provisioning security that harms usability or under-provisioning that invites risk.

Authentication Assurance Levels (AAL) see equally pragmatic evolution. Phishing resistance moves from AAL3 specialty to a requirement offered at AAL2 and mandated at AAL3. Modern authenticators like FIDO2 passkeys and non-exportable keys in secure elements become central, while session management relaxes appropriately (e.g., longer timeouts with device-bound credentials) to reduce user fatigue.

These changes directly support Executive Order 13681’s MFA push and Zero Trust architectures without sacrificing security. Agencies can now inventory authenticators, conduct gap analyses and phase in phishing-resistant options — practical steps that deliver measurable risk reduction.

Federation Assurance Levels (FAL) similarly adapt to modern models, including subscriber-controlled wallets. The emphasis on performance metrics, redress processes and AI/ML governance stands out. Organizations must now document AI use in proofing or fraud detection, assess risks per the NIST AI RMF and ensure human oversight for redress. No longer can automated systems operate as black boxes. Users denied access deserve transparent, trackable paths to resolution — essential for equity and public trust.

The new Digital Identity Acceptance Statement (DIAS) serves as the capstone: a living record of impact assessments, tailoring decisions, compensating controls and monitoring plans. Paired with the GSA DIRA Playbook, it turns DIRM from abstract framework into operational reality.

For federal leaders, the benefits are clear. At HHS, expanding FedHub as a government-wide identity hub demands this risk-based agility. Services supporting veterans, healthcare data exchange via CARIN Alliance, or public benefits require tailored assurance that balances security with accessibility. Rigid checklists lead to either abandoned enrollments (hurting mission delivery) or unaddressed threats (risking breaches).

DIRM’s continuous evaluation — tracking pass/fail rates, abandonment, fraud indicators and redress requests — enables data-driven iteration. This is how we achieve “inclusive security”: strong enough to protect sensitive PII, flexible enough for diverse populations.

Implementation will require effort. Cross-functional teams (IT, privacy, CX, legal) must reassess services, update DIAS documents, inventory authenticators and build redress mechanisms. Agencies should prioritize high-impact systems first, leveraging existing investments in PIV/CAC, ID.me, Login.gov and emerging tools. The ATARC Identity Management Working Group’s new Implementation Guide — developed collaboratively with government and industry experts — provides practical checklists, roadmaps, gap analyses and templates to accelerate this transition.

Critics may worry about added bureaucracy. But DIRM reduces it by enabling risk-based tailoring instead of uniform mandates. It aligns identity programs with broader FISMA, RMF and Zero Trust initiatives while preparing for subscriber wallets and advanced biometrics. Ignoring the update risks non-compliance, poor user experiences and vulnerability to evolving threats.

The federal government has invested billions in digital transformation. NIST SP 800-63-4 ensures those investments deliver trustworthy, resilient identity foundations. I urge CIOs, ICAM leaders and program managers to adopt the DIRM process now. Read the standard, use the implementation resources and produce DIAS documents that demonstrate thoughtful risk management. Our citizens — veterans, patients and taxpayers — deserve identity systems as modern and responsive as the services they access.

The era of static checklists is over. The future belongs to living, adaptive digital identity programs. Let’s lead that transition together.

Adam McBride is the ICAM/IdAM Program Manager for the Department of Health and Human Services (HHS) and co-chair of the ATARC Identity Management Working Group. He has over fifteen years of experience in government and a retired Master Sargeant, US Army.

]]>

Secret Service is examining apparent Iranian video outlining Trump motorcade routes, assassination opportunities

David DiMolfetta — Mon, 20 Jul 2026 14:18:00 -0400

The U.S. Secret Service is examining a video that appears to have been produced by Iranian operatives and aims to identify opportunities to assassinate President Donald Trump, including supposed motorcade routes used by his protective details in Florida and New York.

The video, which was sent to Nextgov/FCW by a U.S. government official, is titled “Where to Kill Trump?!” with the title written in a blood-stained font alongside a bloody silhouette of the president’s side profile. In high-quality, likely AI-generated red, black and white graphics of people, buildings, vehicles, roads and other infrastructure, it claims to show how the president and his Secret Service detail commute from Palm Beach International Airport in Florida to his Mar-a-Lago estate, and from LaGuardia Airport to Trump Tower in New York City.

It has been taken off several sites since reports of it surfaced around the end of last week. The Secret Service is “aware of it and we’re looking into it,” a spokesperson for the agency said in a brief phone interview on Friday.

“Protecting the president and those under our protection is a responsibility we take extremely seriously,” a spokesperson added in a follow-up email. “While we do not comment on the specifics of protective intelligence, our teams work around the clock to assess real-time information and intelligence, ensuring our protective operations remain layered, adaptive, and fully aligned to address the climate.”

The video is narrated in Persian with English captions. “This is no ordinary report,” the captions say. “Based on the most complex security protocols between 2024 and 2026, Donald Trump’s routine movements in the US have been gathered and decoded.”

Almost three minutes long, the video describes the apparent core arrangement of the president’s motorcade, alongside the routes that are supposedly taken in each location. The Florida route also claims to show how Trump is escorted from Mar-a-Lago to the Trump International Golf Club in West Palm Beach during the weekends.

Nextgov/FCW is withholding details of the routes, road closures and security measures described in the video, on grounds that, if its contents are accurate enough, it may expose protective details that could put officials in danger. About halfway through the video, the captions say a specific location along one of the purported routes “seems like a very suitable location for the free people of the world!”

At the end of the video, as it describes supposed street closure arrangements around Trump Tower, the captions tell viewers: “Stay tuned … we are going to get even closer than this.”

It’s not immediately clear how widely the video has been circulated or who specifically produced it, nor when it was completed and disseminated, or whether more follow-up videos exist. Some social media posts last week attributed the clip to Iran’s state-backed Fars News Agency, though this could not be immediately verified.

But if the video's contents are sufficiently precise, it could raise concerns that Iran has expanded its surveillance and targeting efforts against the president, potentially revealing details about the routes and protective measures used by his Secret Service detail.

Tehran has long threatened to assassinate Trump in retaliation for the 2020 U.S. drone strike that killed Qasem Soleimani, the commander of Iran’s elite Quds Force. Those calls from Iranian leaders have intensified since Supreme Leader Ayatollah Ali Khamenei was killed in a joint U.S.-Israeli strike earlier this year that began the ongoing Iran war.

The president makes regular trips to Florida to stay at his Mar-a-Lago estate, where he and his team often land at the Palm Beach airport, now officially named President Donald J. Trump International Airport. A Nextgov/FCW analysis of White House travel pool reports shows that the president appears to have only made two trips to New York City via LaGuardia last year. Throughout 2026, Trump made visits to New York, but they appear to not have involved LaGuardia as a destination airport.

Former presidents receive lifelong Secret Service protection. In 2024, while out of office, Trump regularly traveled by Secret Service motorcade from Trump Tower to the Manhattan Criminal Courthouse for his criminal hush-money trial. Trump also used his private Boeing 757, nicknamed “Trump Force One,” to travel between Florida and New York during the trial, including flights into LaGuardia.

Iran’s permanent mission to the United Nations did not return a request for comment.

“What’s most telling about this video is what it does not include,” said Paul Eckloff, a former Secret Service official who oversaw presidential protection duties for then President Barack Obama and for Trump in his first term. “Is this video a coded signal to attack things that are not listed?” he said, referring to the fact that presidential routes in Washington, D.C. are not described.

“That would be a concern of mine, that there is another target that they’re trying to steer concern away from. Or is D.C. such a hard target that they wouldn’t attempt it? I don’t know,” Eckloff said. He added that fear is a “primary export” of Iranian groups and opined that even a small attack on the president in D.C. would shake confidence more profoundly than an attack in Florida or New York.

The Secret Service is likely conducting a forensic review of the video with assistance from the intelligence community, Eckloff said.

Investigators would look for distinctive words, phrases or technical clues that could help trace the video to its original source, including the AI model or other tools used to make it. Any credible findings could then be shared with the president’s protective detail, which may adjust motorcade routes or strengthen security along them, he added.

The video illustrates how generative AI is increasingly being used in information operations and modern-day warfare. AI tools can give such content a more polished and realistic appearance, but the apparent use of AI doesn’t necessarily prove whether the routes or scenarios depicted are based on actual gathered intelligence.

“The Secret Service has all sorts of intelligence sources … both in this country and outside, so it’s understandable that they would already have this and be evaluating it in terms of the procedures followed,” said A.T. Smith, a former Secret Service deputy director who served in the agency for nearly 30 years between the Reagan and Obama administrations.

“It’s not uncommon for these sorts of things to pop up when you’re having these kinds of events in the world,” he added. “I’m sure the service is getting information from not only American intelligence agencies and sources, but probably around the world as well.”

Earlier this month, Trump departed the NATO summit in Turkey aboard the older Air Force One instead of the Qatari-donated Boeing 747-8 after U.S. officials received Israeli intelligence warning of a possible Iranian plot to target him, The Wall Street Journal reported.

The video has emerged as the war between the United States and Iran continues to widen, with American forces striking Iranian targets and Tehran retaliating against U.S. personnel and regional allies. At least two U.S. service members were killed Friday while defending against an Iranian missile and drone attack in Jordan, the U.S. military said over the weekend.

“Given Trump’s worsening war in Iran, this video is very concerning, and I hope the Secret Service investigates it properly and adjusts protectee operations as necessary to counter this threat,” said Rep. Bennie Thompson, D-Miss., the ranking member on the House Homeland Security Committee.

“However, I have become increasingly concerned the Secret Service does not have the proper resources to do its job after its funding has been diverted to construction of Trump’s ballroom and it has frequently been forced to devote vast resources to act as a chauffeur for JD Vance and his family,” he said, referring to recent reports that federal funds were redirected toward security work connected to the White House ballroom and that agents have grown frustrated with the Vance family’s frequent, last-minute travel requests.

]]>