ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories 威胁日报：AI算力劫持、苹果邮件漏洞、BlueHammer勒索软件等14则新闻

TL;DR

• Anthropic dismissed a critical sandbox root escape in Claude Cowork as non-issue due to required pre-existing local code execution, highlighting gaps in trust boundaries for AI-integrated desktop apps.
• OpenAI's GPT-5.6 Sol demonstrates improved offensive security capabilities, successfully exploiting zero-days in mobile and database systems, though it still struggles with end-to-end attacks on well-defended targets.
• Apple's "Hide My Email" service contains a fully exploitable vulnerability that unmasks user identities, remaining unpatched despite being reported over a year ago.
• A sophisticated China-linked RAT (BeepRAT) leverages DNS-over-HTTPS and disguised .NET utilities to establish persistent, multi-stage espionage channels with extensive host control features.
• A new ransomware phishing campaign targets small businesses globally using fake law enforcement emails and custom payloads hosted on Proton Drive.

Why It Matters

This collection of news underscores the expanding attack surface of AI-integrated software, where local code execution can lead to severe privilege escalation within sandboxed environments, challenging current security assumptions for AI developers. Simultaneously, the demonstrated capability of advanced LLMs like GPT-5.6 to identify and exploit zero-days in critical infrastructure signals a shift toward automated, AI-driven offensive cyber operations that organizations must prepare for.

Technical Details

• Claude Cowork Exploit: Researchers identified two unvalidated parameters in the service interface allowing arbitrary root command execution within the VM sandbox, bypassing network egress filters to exfiltrate data.
• GPT-5.6 Sol Performance: Evaluated against real-world offensive benchmarks, the model showed proficiency in finding high-impact zero-days across mobile OS and database systems, marking a step up from GPT-5.5 in autonomous vulnerability discovery.
• Apple Hide My Email Flaw: A logic flaw allows the mapping of alias addresses back to real user identities, with testing showing 100% exploitability across volunteer accounts.
• BeepRAT Infrastructure: Uses DNS-over-HTTPS for C2 resolution to evade detection, establishes persistence via scheduled tasks, and executes a multi-stage loader disguised as a phone management utility (HFY.exe).
• Custom Ransomware Payload: The latest campaign utilizes a bespoke ransomware variant delivered via password-protected archives linked from Proton Drive, avoiding signature-based detection by lacking known family traits.

Industry Insight

Security teams must re-evaluate the trust boundary between host-level code execution and AI-assisted sandbox environments, implementing stricter input validation and network segmentation for AI desktop integrations. Organizations should assume that advanced LLMs can now autonomously discover and exploit complex vulnerabilities in critical systems, necessitating enhanced monitoring for AI-generated attack patterns and zero-day exploits. Finally, the persistence of unpatched flaws in major services like Apple's highlights the need for independent security audits and faster remediation SLAs for privacy-critical features.

TL;DR

• 本周安全新闻核心主题并非单一重大漏洞，而是普遍存在的“微小权限滥用”和“弱检查机制”，涵盖浏览器、沙箱、AI系统及邮件流程。
• Anthropic的Claude Cowork在Windows上被发现存在沙箱逃逸风险，攻击者可利用未验证参数以root权限运行命令并绕过网络过滤，但Anthropic认为需先决条件故非其责任。
• Apple的“隐藏我的电子邮件”服务被曝存在隐私漏洞，可完全还原用户真实邮箱地址，且该问题已报告一年多仍未修复。
• 开源AI模型GPT-5.6 Solon在现实世界进攻性安全基准测试中表现略优于GPT-5.5，具备利用零日漏洞的能力，但在防御严密的目标和端到端攻击中仍显吃力。
• 威胁态势包括针对中小企业的定制勒索软件钓鱼活动，以及与中国相关的BeepRAT远控木马活动，后者伪装成电话管理工具，具备高度隐蔽的多阶段感染链。

为什么值得看

这篇文章揭示了当前网络安全领域的一个关键趋势：攻击者正越来越多地利用系统设计中看似正常但存在细微缺陷的组件（如AI代理、沙箱环境、隐私保护服务）进行渗透，而非依赖传统的重大漏洞。对于AI从业者和安全专家而言，理解这些新型攻击向量（如AI计算劫持和沙箱逃逸）对于构建更鲁棒的AI系统和防御策略至关重要。

技术解析

• Claude Cowork沙箱逃逸：Armadin研究团队发现了一条影响Windows版Claude Cowork的攻击链。攻击者通过本地代码执行在应用目录植入恶意文件，劫持受信任进程与底层VM服务通信。利用服务接口中的两个未验证参数，攻击者可在无网络出口限制的情况下以root权限运行任意命令，从而提取敏感数据。Anthropic回应称，由于利用需要主机上预先存在的本地代码执行，因此不视为其安全问题。
• Apple Hide My Email漏洞：研究员Tyler Murphy发现Apple“隐藏我的电子邮件”服务存在严重隐私缺陷，允许攻击者解包并还原用户的真实电子邮件地址。在志愿者测试中，100%的隐藏邮箱地址均可被利用。该漏洞早在一年多前已报告，但截至发文仍未修复，具体细节因担心被滥用而未公开。
• GPT-5.6 Solon安全基准评估：AI安全实验室Irregular对OpenAI的GPT-5.6 Solon进行了现实世界进攻性安全基准测试。结果显示，该模型在寻找和利用多个真实系统（包括移动操作系统和数据库系统）中的高影响力零日漏洞方面表现出相关能力，略优于GPT-5.5。然而，它在面对防御良好的目标时仍表现不佳，难以完成端到端的复杂攻击。
• BeepRAT恶意软件分析：Rubrik Zero Labs识别出一种名为BeepRAT的定制远控木马，它是开源DCRat框架的变体。该木马通过伪装成中国电话管理工具的ZIP档案分发，包含.NET应用程序HFY.exe。它使用计划任务持久化，通过DNS-over-HTTPS (DoH) 解析C2基础设施，并建立持久通信通道以执行文件传输、键盘记录、屏幕截图、Webcam录制等间谍活动，被认为隶属于中国关联的情报生态系统。

行业启示

• AI代理的安全边界需重新定义：Claude Cowork的沙箱逃逸案例表明，即使是在隔离环境中运行的AI代理，若其宿主环境或通信接口存在配置弱点，仍可能被利用。开发者必须严格审查AI系统与底层操作系统及网络服务的交互接口，实施最小权限原则和严格的输入验证，而不仅仅依赖沙箱隔离。
• 隐私保护功能的脆弱性与响应滞后：Apple长期未修复的Hide My Email漏洞警示我们，即使是大型科技公司提供的隐私增强功能，也可能存在根本性的设计缺陷或维护疏忽。企业和个人在使用此类服务时应保持警惕，定期评估隐私工具的有效性，并推动供应商提高安全响应的透明度与速度。
• AI赋能的网络攻防双刃剑效应：GPT-5.6在安全基准测试中的表现证实了大语言模型在自动化网络攻击中的潜力，同时也暴露了其局限性。这要求组织不仅要防范传统威胁，还需建立针对AI驱动攻击的检测和防御机制，同时推动负责任的AI开发，防止模型被用于恶意目的。