In Other News: Trezor Implant, LLMJacking Bills Hit $1M, SAP Flaws Weaponized Within Days

Anthropic has introduced enhanced security features for Claude Enterprise, including a beta security center to check configurations against Anthropic recommendations and inference hooks that route prompts and tool calls through existing data loss prevention systems. A centralized console is also in beta to manage settings across multiple Claude organizations. Simultaneously, phishing campaigns targeting OpenAI, SpaceX, and Anthropic events were documented, utilizing fake registration pages and methods involving device code phishing flows via platforms like Kali365. Chainalysis disclosed that names, usernames, password hashes, and live tokens for its users were exposed in November 2. Google is contributing Agent Substrate and gVisor to the CNCF as Sandbox projects, aiming to provide a vendor-neutral base for AI agent infrastructure on Kubernetes. Researchers detailed a Chinese-language exploitation framework named Greeter that leveraged an old code injection flaw in Flowise to extract credentials from honeypots. The LLM space has seen reports of attackers using stolen cloud credentials and exploiting vulnerabilities like LiteLLM to hijack enterprise AI access through services like LLM Mixers. Furthermore, concerns arose regarding the security of hardware wallets when an implant was allegedly found in some Trezor devices sold via CryptoBilis.

Anthropic rolled out a security center (beta) for Claude Enterprise to check configurations against Anthropic recommendations and inference hooks to route prompts through DLP tools. A centralized console, also in beta, allows management of settings across Claude organizations. A phishing campaign was documented involving fake registration pages for OpenAI, SpaceX, and Anthropic events, using device code phishing via Kali365. Chainalysis reported that names, usernames, password hashes, and live tokens for its users were exposed in November 2. Google is donating Agent Substrate and gVisor to the CNCF as Sandbox projects. Researchers detailed Greeter, a Chinese-language exploitation framework, which used CVE-2024-58351 to interact with Flowise honeypots. Mandiant investigated LLMJacking cases involving stolen cloud credentials or LiteLLM vulnerabilities, leading to fraudulent billing. A report alleged an implant was fitted into some Trezor Safe 5 hardware wallets, capturing recovery phrases via a cellular module. The HIBP system loaded email addresses from the November 2025 Harvard breach. Onapsis and Recorded Future noted a reduced gap between SAP vulnerability patching and exploitation, with ransomware groups increasing their presence in SAP-related content. Synology reported an abuse of a December 2024 fixed vulnerability in DSM releases for ransomware attacks. Alexander Block appeared in US court regarding exploitation of the Nomad Bridge smart contract.

The flow of information demonstrates a complex tension between advancing AI capabilities, escalating adversarial tactics, and fundamental infrastructure security failures across multiple domains. The simultaneous development of enterprise AI controls by Anthropic alongside documented large-scale social engineering attacks against high-profile entities like Microsoft and Google suggests that security innovation often lags behind the adversarial adoption curve. The concern surrounding LLM Mixers and stolen credentials highlights a shift where the vulnerability is no longer just in the application layer, but in the foundational access mechanism—stolen keys become direct pathways to massive financial fraud. Furthermore, the donation of AI-related infrastructure projects to the CNCF reflects an effort to create decentralized, vendor-neutral sandboxes for advanced systems, which speaks to a potential systemic need for shared security standards in agent deployment. The incident involving Greeter and Flowise illustrates that even specialized exploit frameworks can leverage low-level flaws to achieve broad information gathering across disparate systems. Finally, the connection between leaked personal data (Harvard breach) and hardware integrity (Trezor implant) alongside supply chain risks (SAP/Synology exploits) shows that vulnerabilities are no longer isolated technical bugs but symptoms of broader failures in data governance, trust in infrastructure providers, and physical device security. The question then becomes: if systems are designed to be shared and virtualized, how can true cognitive sovereignty be established when the integrity of the underlying substrate—be it code, keys, or physical hardware—is inherently mutable and contested? What systemic checks must be instituted to ensure that the push for autonomous AI infrastructure does not simply introduce new, untraceable points of failure across the entire stack?