Fireworks AI breached again through its cloud provider, and Anthropic won't fix a planted-file flaw in Claude's Office skills

Fireworks AI, the inference platform a lot of teams use to run open-weight models, has disclosed a second breach in a month. In its own bulletin the company says a third-party cloud provider hosting its R&D machines was compromised on October 23, and the attacker used that foothold on October 24 to reach Fireworks development machines and run an unauthorized workload. This time the take included resource metadata, billing details and incomplete model weights and datasets for some customers. Card numbers weren't exposed because Fireworks doesn't store them. The first incident, in early October, was an LLMjacking job that lifted API keys from environment variables, and Unit 42 is now helping with the investigation.

If you're a Fireworks customer, rotate every Fireworks API key and any third-party keys you stored there as secrets, then check billing for usage spikes and treat any fine-tuned weights or datasets you uploaded as possibly copied. My take: two incidents in four weeks, the second arriving through a supplier, tells you inference providers are now holding the crown jewels (keys, weights, training data) without the security maturity of a cloud hyperscaler. Ask yours the vendor-chain questions you would ask a payroll processor.

AIR Security's "Office Party" finding hits closer to home for anyone running Claude agents on Linux. Anthropic's official DOCX, PPTX and XLSX skills share a helper, soffice.py, that preloads a shim library from a fixed path in the shared temp directory whenever Unix sockets are blocked, which is the normal state inside Claude Code's sandbox. If a file named lo_socket_shim.so is already there, the helper loads it without checking who wrote it. We confirmed the public script on GitHub still uses that fixed path. Anthropic acknowledged the report but calls it outside its security boundary, so no fix is coming.

Check your Linux agent hosts for an unexpected lo_socket_shim.so in the temp directory, give each agent its own private TMPDIR, and inventory which skills are installed. The second demo, where one harmless-looking skill unpacks the planted library for another, is the real lesson: skills are dependencies, and nobody is reviewing how they interact.

Malbear Labs published a rare inside look at an autonomous intrusion after finding the operator's open directory. A jailbroken DeepSeek agent spent two weeks inside a European telecom, getting in through a Cisco BroadWorks XXE bug (CVE-2026-20320, patched in August) and moving on through old Liferay and JBoss flaws while the operator mostly typed "Go on." The agent's own reports claim credentials, AD data and patient records, though Malbear hasn't said whether victims confirmed any of it. Patch the BroadWorks bug and treat internet-facing JBoss 6 as already owned.

Anthropic shipped Claude Mythos 5.2 and Fable 5.2, reporting an 89.6% CVE rediscovery rate and sandbox escapes down to 3.1% of test scenarios from 21% in Mythos 5.1. Microsoft's FORGE Lab used its agentic scanner to turn up a nearly 11-year-old memory-safety bug in Rust's standard library, which it rates as unlikely to be exploitable. The bug-finding race keeps getting faster, so budget for a heavier patch queue.