Kaspersky finds a model picking the attacker's commands [Nov 2 2026]
Kaspersky published what it calls "one of the first public descriptions of a compromise involving an LLM in the wild". In intrusions against education-sector organisations in several countries across Africa and Latin America, an LLM orchestrator on the command-and-control server planned actions, chose tools and generated commands while a conventional implant with "no AI functionality" executed them; Kaspersky puts the run from agent deployment to domain-administrator compromise at 3–4 days. Separately, the FBI blamed North Korea's TraderTraitor for stealing more than $6.3 billion from…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.