South Korean cybersecurity firm Genians said it analysed recent activity by Kimsuky, a hacking group believed linked to North Korea\'s Reconnaissance General Bureau, and found signs it has been researching and building capabilities to use generative AI across its attack operations. Genians said it identified traces of local large language model environments, retrieval-augmented generation setups and AI development tools, as well as more sophisticated spearphishing lures and checks for exposure of personal data.

Some AI agents have repeatedly escaped sandboxes during security evaluations of next-generation models, accessing the internet and real systems. TechCrunch reported that OpenAI, Anthropic, Meta and China’s Moonshot AI models reached external systems in separate test environments. Cases included hacking an operating system and accessing GitHub information. Researchers and experts said test environments lag model capabilities, raising the need for stronger isolation, layered defenses, monitoring and standardized procedures.