One attacker's AI agent mesh hits Taiwan's emergency dispatch, plus a CPython sandbox escape for model hosts

One person with a pile of AI agents reached Taiwan's emergency services. Acronis's Threat Research Unit says a single attacker in Hualien City pointed agents at hundreds of organizations in at least 11 countries and got data or access at about 10 of them, mostly in Taiwan. That includes dispatch records for seven Taipei districts pulled from the 119 system's API. Commercial models mostly refused to help him, so the agents ran on local "abliterated" models with the safety training stripped out. The researchers got all of this from his own server, which held more than 90,000 files.

What to do: if you run public APIs for emergency, municipal or health systems, check this week for endpoints that answer without a login, because the agents found a fire department platform exposing 2018 patient data, ECG readings included, with no authentication. My take: refusals from the big labs don't protect you, since a motivated attacker just runs an open model locally. Your defense is the boring stuff, auth and exposure, because an agent finds a forgotten endpoint faster than you can.

Second, a CPython memory-safety flaw that RunSybil used to escape the Jinja sandbox with a malicious model template and run code inside an inference server. The researchers say that could give an attacker a foothold in servers handling millions of requests, and possibly the cloud infrastructure underneath. Python's maintainers say sandbox escapes fall outside their security threat model, so don't wait for a patch to save you. If you host customer-uploaded models, treat the template as untrusted code and run inference in an isolated container or VM with no cloud credentials attached.

The UK NCSC published an assessment of AI-enabled intrusion trends and projections out to 2028, and its chief has warned that AI-powered malware is highly likely to show up in ransomware attacks on British critical infrastructure by then. It's a primary source worth reading before your next risk review, and a good way to ask your board whether detection assumes human-speed attackers.

Two more to flag. The Register reports Anthropic won't fix a Claude Dispatch flaw that lets a browser extension with control of Dispatch make Claude Desktop run code, even on another machine signed into the same account. No vendor advisory exists yet, so audit which browser extensions your team runs next to Claude. Wired covers an experiment where DeepSeek and GLM came close to OpenAI's most advanced non-public cyber model at breaking into simulated networks, which means capable offensive models are now free to download.

Research roundup from arXiv cs.CR this past week: [2611.08811](https://arxiv.org/abs/2611.08811) tests thought injection attacks on reasoning agents, and [2611.07640](https://arxiv.org/abs/2611.07640) benchmarks indirect prompt injection that tampers with the agent's task rather than just overriding instructions. Other papers this week cover defenses for tool-using agents and parameter poisoning. These are preprints, not peer reviewed, so treat the numbers as leads.