AI-written edition with a fictional anchor
Here is today's morning report. Wed, Sep 23, 06:14 HKT
- 05:58 HKT ShinyHunters Say They Have Every FBI Employee's Data Kai Tanner has the sourcing gap that matters: ShinyHunters' claim against the FBI and Cl0p, and what neither Oracle nor the Bureau has confirmed.
- 05:59 HKT Researchers Hacked OpenAI With Anthropic's Own Model Aya Nakamura on researchers turning Claude against OpenAI, and why the direction of that arrow matters more than the headline.
- 06:01 HKT StanChart's $6.9B Admission Lands on No One's Desk Rachel Lam on StanChart's 6.9 billion dollar admission and why it still isn't a Hong Kong regulatory event.
- 05:58 HKT China Expels Two Top Generals Before Xi-Trump Summit Mei Chen on why Xi is walking into Thursday's summit having just gutted his own command structure twice in a month.
- 05:59 HKT China Moves Coast Guard From South China Sea To Pre-Summit Cover Vincent Lai checks the purge against the Coast Guard's own patrol cycle, not the press conference.
- 05:59 HKT 18,000 Taxi Plates, Zero New Cars, One Crackdown Coming Cheung Kwok-keung on who actually benefits when Hong Kong cracks down on illegal ride-hailing drivers.
- 06:00 HKT A Compact AI Model Just Beat Every Frontier System At Aging Magnus Honeyfield on the small model that just beat every frontier system at understanding aging.
- 06:00 HKT Kawhi Leonard Signs $115 Million Raptors Extension Dev Chatterjee on Kawhi Leonard's 115 million dollar extension, and who actually holds the exit clause.
Continue reading
ShinyHunters Claim FBI And Cl0p Both Breached
One extortion crew says it hit a federal agency and a rival ransomware gang's infrastructure in the same week, and neither victim has confirmed a thing.
The crew calling itself ShinyHunters says it walked into the FBI's own human resources systems through an unpatched flaw in Oracle PeopleSoft and came out with data on every employee: names, addresses, job assignments. The Bureau has not confirmed it. Oracle has not named the flaw. Kai Tanner's desk has the full sourcing on that gap, and on the second half of the same week's work: ShinyHunters also defaced Cl0p's dark web site and claims to hold Cl0p's own victim data, meaning companies that already paid Cl0p a ransom now face a second extortion attempt from whoever holds that data next.
What makes it one story rather than two is the crew, not the target. The same operators claim a federal law enforcement agency and a fellow ransomware gang as marks inside a single cycle. Identity and access controls that both a US agency and a criminal enterprise relied on turned out not to hold, and PeopleSoft's own customer base spans exactly the kind of institution that assumes itself hardened.
Elsewhere, Aya Nakamura's desk reports that researchers used Anthropic's Claude, not a rival's model, to penetrate OpenAI's own infrastructure in a disclosed red team exercise, days after Anthropic tightened Claude Opus 5.5's safeguards specifically against this kind of use. Rachel Lam's desk flags that Standard Chartered's chief executive admitted this week, in a media interview rather than a regulatory filing, that the bank had closed accounts tied to a 6.9 billion dollar Russian laundering network. No Hong Kong regulator has made it a supervisory matter. In Washington, Mei Chen and Vincent Lai both file on Xi Jinping arriving Thursday for his summit with Donald Trump with a thinned Central Military Commission behind him and a more aggressive South China Sea patrol posture in front of him.
Across the cyber and AI filings this week, the pattern is not which vendor's software failed or which lab's model was used. A federal agency, a systemic bank, and a frontier AI lab each learned of a breach or made an admission before their own regulators or auditors caught it. The disclosure came from the attacker, or from the CEO's own mouth, ahead of the system built to catch it.
All episodes and how to subscribe →