Fable 5, GPT-5.6 and the high stakes of AI safeguards. Agentic ransomware, ClickFix reigns supreme
This podcast explores the critical role of safeguards in frontier AI models like Anthropic's Fable 5 and OpenAI's GPT-5.6 Sol, analyzing the tension between powerful capabilities and misuse prevention. It also dissects the emergence and debate around agentic ransomware, specifically Jade Puffer, and covers the rise of ClickFix as a dominant social engineering attack targeting developers. Finally, it provides an in-depth analysis of UnregStealer, a credential-theft campaign impacting Latin American financial institutions, detailing its attack chain and mitigation strategies.
This podcast episode begins by highlighting a significant shift in the AI landscape: the foregrounding of safeguards alongside the release of powerful new models like Anthropic’s Fable 5 and Mythos 5, and OpenAI’s GPT 5.6 Sol. These models emphasize security features, such as “classifiers” designed to detect and block harmful interactions. However, panelists note that “change is the only constant” in AI, implying an ongoing, cyclical battle between evolving threats and defenses.
Challenges and Tensions in AI Safeguards
While classifiers are beneficial for identifying vulnerabilities—Mythos 5 notably discovered a 27-year-old flaw in OpenBSD—concerns exist about their potential to be overly strict, hindering legitimate use or model performance. A key challenge lies in the “good guys” versus “bad guys” dilemma: safeguards primarily apply to responsible actors. The availability of open-source models like Zippu AI’s GLM 5.2 (reportedly comparable to Mythos) and specialized malicious tools like “WormGPT” means determined adversaries will always find ways to bypass restrictions, creating a “lowest common denominator” problem. Anthropic is working with partners to develop a shared framework for jailbreak mitigation, but Diego Matos Martins stresses that organizations must prepare for a “wave of vulnerabilities” from exploited AI models, necessitating robust controls and incident response. Jeff Crume cautions that poorly designed guardrails could inadvertently penalize legitimate users and slow down defenders without truly deterring malicious actors.
Agentic Ransomware: The Jade Puffer Case
Sysdig reported Jade Puffer as potentially the “first documented case of agentic ransomware,” claiming an LLM-driven extortion operation. This ransomware reportedly exploited a Langflow authentication flaw, gained access to a production server, encrypted data, and generated a ransom note. Sysdig cited “self-narrating code” and rapid execution as key indicators. However, experts like Kevin Bowmont and Diego Matos Martins express skepticism, noting Jade Puffer’s unsophisticated methods (exploiting default credentials and unpatched vulnerabilities) and limited impact (one server, destruction of encryption keys), suggesting it didn’t differ substantially from human-led attacks. Jeff Crume argues that the inevitability of agentic attacks is more significant than Jade Puffer’s specific classification. He emphasizes that AI will enable attacks at unprecedented “volume and velocity,” lowering the “barrier of entry” for less skilled attackers. Sophie Cunningham adds that while self-narrating code might initially aid researchers, sophisticated attackers will likely suppress such indicators.
ClickFix: Dominant Social Engineering Attack
ClickFix has emerged as a prevalent social engineering technique that tricks users into copying and pasting malicious commands into their system terminals. ReliaQuest analysis identified it as a dominant initial access vector. Sophie attributes its success to being a novel method that bypasses traditional email filters. Diego highlights that it exploits a modern “self-help mentality” in IT, where users are guided to “fix” problems themselves by executing commands, often under deceptive pretenses. ClickFix disproportionately targets developers, using fake libraries and downloads to compromise the software supply chain. Jeff explains this focus due to developers’ extensive access, allowing for significant amplification of attacks. He underscores that ClickFix attacks the human element, bypassing technical controls like antivirus or EDR. The tech community’s past practice of instructing users to run commands from helpdesks has inadvertently made users more susceptible. Mitigation strategies include applying existing social engineering defenses like role-based access control and user training, but the challenge of “un-training” users remains.
UnregStealer: Browser-Based Credential Theft Campaign
Senior Threat Researcher Itzhak Chimino detailed UnregStealer, a browser-based credential theft campaign targeting banking and payment users, primarily in Latin America, with a strong focus on Brazilian fintech and Pix platforms. Its effectiveness comes from the deliberate assembly of known techniques against specific targets. The attack chain involves: (1) social engineering to run a fake certificate file; (2) a batch file launching a minimized PowerShell to download further stages; (3) silent installation of a malicious Chrome extension via enterprise policy, often disguised as legitimate (e.g., “SSL” or “certificate”); and (4) the extension monitoring banking sites, injecting a stealer kit that manipulates password fields to reveal credentials as they are typed. The campaign features a “person in the loop,” meaning the live stealer payload is conditionally delivered, making automated sandboxing difficult. This indicates attackers prioritize “value not volume” and adapt proactively. Warning signs include unexpected PowerShell activity (minimized, encoded, connecting to low-reputation domains) and unrecognized Chrome extensions. Prevention focuses on locking down browser extension installation policies, hardening PowerShell, and user awareness. Remediation requires immediate credential rotation from a clean device, removal of malicious extensions and their re-installation policies, and hunting for persistent PowerShell elements and original droppers while taking the affected machine offline.