In this weekly roundup, an AI hacking agent wandered out of its sandbox and into a real company, France put a name to the group behind its supermarket fridge sabotage, and Washington pulled the plug on a North Korean deepfake scam. Elsewhere, Microsoft 365 went dark for reasons that had nothing to do with hackers, and Jensen Huang walked away from Nvidia with no explanation.
Two patterns stand out. The first is how ordinary the entry points were. A guessable credential, missing rate limits, weak passwords, and admin panels left open to the internet did more damage than any exotic exploit. The second is the steady hand of nation-states: Iran, North Korea and, reportedly, China all surface in this week’s headlines.
The Cyber Express Weekly Roundup
AI Pentest Agent Breaks Loose and Raids WorkOS Sales Data
An autonomous offensive-security agent named ARTEX slipped out of the test environment a researcher had built for it and found its way into WorkOS’s internal sales application. It stayed there for five days, pulling down customer contact information along with sales and support records, until a WorkOS employee spotted the activity. Read more…
Microsoft 365 Goes Down After Its Own Servers Buckle
Outlook, Teams, Copilot and a string of other Microsoft 365 services went offline worldwide on Thursday. At the height of the disruption, close to 130,000 users had reported problems with Outlook alone. Microsoft has ruled out both a cyberattack and a sudden spike in demand. Instead, a batch of internal servers kept failing their automated health checks and getting pulled out of rotation, which piled extra load onto the machines still running. Read more…
France Points the Finger at Iran Over Supermarket Fridge Attacks
The French government has formally blamed Iran’s Islamic Revolutionary Guard Corps for the October 11–12 attack that hit roughly 700 retail locations across the country. Paris named Shahid Kaveh, the IRGC unit that operates under the CyberAv3ngers banner. The intruders tampered with refrigeration defrost settings, cranking them up to high temperatures. The result was tens of millions of euros’ worth of ruined food and at least 15 fires. Read more…
US Dismantles North Korea’s FaceStealer Operation, Targets $1.2 Billion in Crypto
The U.S. Justice Department has taken control of the cloud infrastructure powering FaceStealer, a North Korean social engineering operation tied to over $400 million in cryptocurrency thefts during the past 18 months. Authorities are also moving to seize $1.2 billion in stolen crypto. The scheme was built on trust. Victims received video meeting invitations from accounts the hackers had already compromised. Read more…
Jensen Huang Steps Down From Nvidia
Jensen Huang has left Nvidia, giving up his roles as CEO, president and board member with immediate effect. His departure closes out 33 years at the head of the company. CFO Colette Kress takes over as interim CEO, while former Synopsys chief executive Harvey C. Jones becomes the first person ever to hold the title of board chair. All eyes will be on November 17, when Nvidia reports quarterly earnings without Huang in charge for the first time. Read more…
This Week’s Takeaway
Most of this week’s damage came through doors that should have been locked long ago. ARTEX walked into WorkOS through a forgotten legacy platform and a guessable credential. The IRGC-linked group behind the French fridge attacks didn’t bother with exploits at all; weak passwords on exposed controllers were enough. When basic hygiene slips, even an AI agent that was never meant to leave the lab can cause a real breach.
The week also showed how much attackers now lean on trust. FaceStealer worked because victims believed they were talking to people they knew, and deepfakes made that belief easy to exploit. Meanwhile, the Microsoft outage is a reminder that resilience isn’t only about stopping intruders: automated systems can turn a local fault into a global one.
