Next up, a pair of very different warnings. First, as we’ve mentioned before, if you’re relying on Microsoft Defender to keep your PC safe, you can do much better, even with free antivirus software, regardless of what Microsoft says. A disgruntled security researcher just disclosed a zero-day vulnerability in Defender, claiming that in the past he’d been poorly treated by Microsoft for bringing bugs to their attention. Second, the FBI has a warning for all of us: Hackers are coming for your nudes, so keep them safe.
Now, let’s see what else is going on in the infosec world this week.
Root Access: How a Researcher Cracked ChatGPT’s Secure Sandbox
The point of a “sandbox” environment in software development is to have a secure area that’s isolated from your live, production systems to do the hard work of testing updates, building new tools, fixing bugs, and doing other important, heads-down dev work before deploying it to your live system, where all of your users can benefit from the work you’ve done. Most importantly, it should be completely isolated and secure. You wouldn’t want your Twitter drafts going live without your knowledge, right?
Well, thanks to reporting from Dark Reading, we learned that at Black Hat last week, a researcher from Palo Alto Networks demonstrated a proof-of-concept attack chain against OpenAI’s secure sandbox environment for ChatGPT. Worse, Simcha Kosman, the researcher who made the discovery, was able to bypass the LLM’s supervisor entirely and obtain persistent root access to the sandbox. It’s important to note that this isn’t indicative of any real attacks or hackers with access to the environment: It’s a proof-of-concept, and companies usually pay close attention to talks at conferences like Black Hat for help securing their systems. Sure enough, an OpenAI representative told Dark Reading that they learned about the issue from Kosman prior to his talk, and were grateful for his findings. Even so, it’s yet another reminder that sometimes when it comes to AI development, speed trumps security.
Don't Fall for the CAPTCHA: New Mac Malware Drains Crypto Wallets
Whenever I find malware aimed at macOS, I like to highlight it, mostly because the myth that Macs don’t get malware persists, and, worse, macOS malware is often aggressively targeted for specific purposes and can be very complex if you don’t know what you’re looking at. If you’re a Mac user who takes security seriously, I applaud you. In this case, IT Security Guru reports that researchers at Huntress discovered malware that profiles a user’s computer and, if a crypto wallet with a balance is found, opens it and transfers either part of the wallet or the full balance to the attacker’s account.
At its core, the malware uses ClickFix, a well-known scam, to get onto the user’s computer. ClickFix works by tricking you into performing an action on your computer that stealthily downloads and installs malware. In this case, the trick is a surprise CAPTCHA you find while browsing the web, claiming that you need to complete the CAPTCHA and then copy and paste some string of text into your Mac’s terminal in order to access whatever you were looking for. And that’s the key here: the attacker has to trick you into getting the malware on your PC somehow. Even worse, this particular malware profiles your Mac before doing anything, and while it could be configured to steal passwords and other data, it’s focused entirely on crypto, and stealing it from the people who own it.
Timing Is Everything: Ransomware Cripples Colombia Ahead of Inauguration
On August 2, 2026, Colombia’s Ministry of Justice confirmed that a ransomware attack had infected and encrypted files on several public-facing servers, mostly disrupting services around drug monitoring and other drug-related legal processes, according to Dark Reading. At any other time, it would just be another ransomware attack on a government system, the kind we’ve become all too familiar with in recent years. Unfortunately, the country was scheduled to inaugurate a new president five days later. The ministry denied at the time that any information had actually been stolen, but the encryption was serious enough, and government security teams were working to recover the data.
Latin American countries have been targeted by cyberattacks recently, especially Colombia and Venezuela, as hackers look to steal data, cripple government systems, or just take advantage of unrest, elections, or other national events. Additionally, security researchers suggest that some of these attacks are extremely organized and automated, and may be carried out by state-sponsored hackers.
Have a Security Question? Ask Me About It!
Do you have a question about online privacy or security? I'm here to help! You can submit your question here, and I may answer it in an upcoming SecurityWatch column and newsletter. If you're not subscribed to the newsletter, head here to sign up, and check back each week for the latest updates from PCMag's security team. Now, on to this week's question!
Geoff T asks: "Hi Alan. What is the hardest combination of [password] characters you have seen used on a public website? I've not seen one higher than 14 characters personally."
Hi Geoff, thanks for your question! In my experience, 12 to 14 characters is pretty standard across the public web, although I did see a forum once that required a 20-character password, which I found both funny, given the forum wasn’t exactly important or sensitive, and a good testament to the security-mindedness of its owners.
I’ve definitely seen sensitive systems that demand even stronger passwords, and I checked with Kim Key, PCMag's senior security writer who handles password manager reviews, and we both recommend setting your password manager to generate passwords that are at least 20 characters long, complete with letters of mixed case, numbers, and special characters. That should cover your bases no matter where you roam on the web, including spots you want to keep secure, like banking sites, shopping sites you use frequently, email accounts, and anywhere else you want to keep safe. Although I’ll admit I did stumble upon one banking website where 20 characters were actually too strong, and I had to dial it back to 14. That was a little disappointing!
