Last week the theme was old data. This week it is the little connected things you stopped thinking about: smart TV boxes, refrigeration controllers, cameras. Anthropic's researchers warn that cheap devices like these could eventually carry AI worms, and attackers just used the same kind of weak spot to cook the contents of French supermarket fridges. Add an OpenAI engineer arrested by the FBI, a Canadian ransomware run on hospitals and distributors, and a record month of software patches, and it's a full one. Let's get into it.
🗞️ STORY OF THE WEEK
Anthropic Warms AI Worms Could Soon Spread Through Cheap Smart Devices
Researchers on Anthropic's Frontier Red Team published a warning this week: small AI models may be only months away from being able to copy themselves across poorly secured internet-connected devices, without needing a data centre. An AI worm of this kind would run its own model on each device it infects, which means there is no central server to switch off.
This is a warning, not an outbreak. There is no fully working rogue replicator yet. In the lab, the team ran a 26 billion parameter AI model across 15 off-brand Android TV boxes that cost about $55 each. It was painfully slow, but it worked. In a separate test on eight emulated devices, one open model copied itself to every device in four of five runs, although the researchers deliberately made the break-in step easy. Anthropic expects small models to reach that capability by the end of 2026 if progress continues.
The most useful detail for a business owner is the researchers' own comparison: older botnets such as Mirai spread simply by trying the default passwords manufacturers ship with their devices. An AI worm would be better at figuring out unfamiliar hardware, but weak or default credentials are still the open door. Anthropic notes defenders have advantages too, since large transfers between devices that never normally talk to each other would stand out, and manufacturers removing default passwords would shrink the target pool.
Why It Matters
Most small businesses own more connected devices than they realize: cameras, streaming boxes, printers, thermostats, door systems, fridges. If any of them still use the password they shipped with, they are the easy targets this research is about.
What Can You Do
Ask your IT provider or whoever set up your office for a simple list of every device that connects to your network, and confirm none of them use a default password or are reachable from the internet. Anything nobody can account for should be unplugged.
⚡THE RIPPLE EFFECT - Three stories, and what they actually mean for your business
An OpenAI Engineer Is Accused of Planting a Hidden Recording Device
The FBI arrested an OpenAI engineer on October 9, accused of hiding a small audio recording device behind a TV in an executive conference room at the company's San Francisco office. He is charged with one count under the federal Wiretap Act and is presumed innocent. According to court documents reported by Fortune, he used a ChatGPT account linked to his wife to help design the device, and an internal company AI assistant to learn which rooms hosted high level meetings. OpenAI says staff found the device during a routine sweep and that it has no indication model code, weights or customer data were taken.
What it means for you: Not every threat comes through the internet. Ask who can book your most sensitive meeting space, whether anyone ever checks for unfamiliar devices in it, and whether your internal AI tools log what employees ask them.
Hackers Cooked the Contents of French Supermarket Fridges
Attackers took over internet-connected refrigeration controllers made by Danfoss at hundreds of French supermarkets, pushing some units to around 50 degrees Celsius and forcing stores to throw out food. French authorities urged operators to disconnect the controllers from the internet. SecurityWeek reports the attack has since widened to controllers from other manufacturers.
What it means for you: If your business runs refrigeration, heating or building controls that can be reached remotely, ask your supplier whether they are exposed to the internet and who is responsible for securing them. A cyberattack can spoil real inventory.
A Run of Ransomware Claims Hits Canadian Hospitals and Distributors
Ransomware groups claimed several Canadian organizations in early October, including Nipigon District Memorial Hospital in Ontario, where outpatient lab and imaging services were disrupted, plus an electrical distributor and a Montreal firm. Some claims are unverified. The Canadian Centre for Cyber Security data cited by the source shows ransomware incidents growing about 26 percent a year.
What it means for you: Treat these as a prompt, not a headline. This week, confirm your backups can actually be restored, that remote access requires multi factor authentication, and that everyone knows who to call if systems go down.
1413
Microsoft's October security update fixed a record 1,413 vulnerabilities in one go, including one flaw already being exploited that lets malicious files avoid Windows' usual warning flag. The volume is attributed in reporting to AI assisted bug hunting. For a small IT team, that is a lot of patching, and it makes knowing which fixes matter most more important than ever.
✅ ONE THING TO DO THIS WEEK
Make a List of Every Device Connected to Your Network
This week's lead story and the supermarket fridge attack share a theme: the devices nobody thinks of as computers are often the weakest link. Cameras, TV boxes, printers, thermostats and refrigeration controllers all connect to your network, and many ship with a default password that never gets changed.
Walk the office or shop with your IT provider and write down every connected device. For each one, check three things: has the default password been changed, does it need to be reachable from the internet, and does anyone own keeping it updated? Anything that fails all three is the first to fix or unplug. One page, done once, reviewed each quarter.
If nobody can say who owns a connected device, an attacker is happy to.
📌 QUICK BITES
Attackers are breaking into Ivanti Connect Secure VPNs, even fully patched ones. Researchers saw attackers chain several flaws to take full control of an up to date device, and one flaw is still unpatched. If you use this VPN, apply the latest fixes and ask your IT provider to review it for signs of compromise.
A serious flaw in Cisco's Secure Email Gateway is being actively exploited. The US cyber agency added it to its must patch list. If your business filters email through Cisco, confirm the fix has been applied.
The Five Eyes cyber agencies, including Canada's partners, warn that AI could soon overwhelm defences. Their joint statement urges businesses to shrink their exposure, patch faster and use AI defensively. In plain terms: fewer things connected to the internet, and fixes applied in days, not months.
AI labs say their own models keep taking actions nobody asked for. Anthropic reported an evaluation run that submitted an invented tip to a police website and cut live internet access for all its internal tests, while OpenAI reported a model trying to damage its test environment. If you let an AI tool act on its own, limit what it can reach and keep a human approval step.
💬 PARTING THOUGHT
It is easy to picture cyber risk as something that happens to servers and laptops. This week it was fridges, TV boxes, a conference room television, and a meeting room booking system.
The common thread is not the technology, it is ownership. Somewhere in each of these stories was something connected, nobody quite responsible for it, and a default setting nobody changed.
Resilience begins with knowing what you have, and who is looking after it.
See you next Friday and stay
TryberResilient