Daily Briefing for 06.29.26

Top stories.

1. White House eases restrictions on Mythos.
2. FBI issues updated warning on Russian phishing attacks targeting messaging apps.
3. Japanese telecommunications giant discloses breach.

White House eases restrictions on Mythos.

The White House has loosened its restrictions on Anthropic's Mythos model, allowing the company to release the advanced AI tool to at least 100 large corporations and government agencies, WIRED reports. Commerce Secretary Howard Lutnick said in a letter sent to Anthropic that he had "determined that appropriate safeguards are in place," adding, "Anthropic has worked with the U.S. government to address risks associated with the Covered Models. These efforts have yielded significant progress."

Anthropic is still in negotiations with the administration about restoring access to Fable 5, which was hit with export controls after the US government deemed it a national security risk. An Anthropic spokesperson told WIRED, "We received notice from the US government that Mythos 5, our strongest cybersecurity model, can be redeployed to a small group of cyber defenders and infrastructure providers. We are working to provision the approved set of providers and restore their access to Mythos 5 as quickly as possible. We are pleased to see this progress and continue to work with the government to expand access to Mythos 5 and make Fable 5 available for general use again."

FBI issues updated warning on Russian phishing attacks targeting messaging apps.

The US FBI and CISA have updated a March public service announcement on Russian intelligence services targeting Signal and other commercial messaging apps, warning that these threat actors are now targeting Backup Recovery Keys. The attacks are conducted via phishing, and don't involve exploitation of any vulnerabilities in the messaging apps. The campaign has targeted "current and former U.S. and international government officials, military personnel, political figures, journalists, and key officials located in Ukraine."

The advisory states, "If a victim inadvertently shares their Backup Recovery Key, that same key remains valid even if they create a new account following the compromise using the same phone number. Consequently, the actor could potentially use the compromised key to take over the new account in the future as well. To mitigate this risk, the user must generate a new Backup Recovery Key within the Settings control; this action will invalidate the previous key for all future backup downloads. However, please note that this does not prevent the actor from having already downloaded a backup of the original account."

Japanese telecommunications giant discloses breach.

KDDI, one of Japan's largest telecommunications operators, has disclosed a breach in which attackers gained access to an email system used by five Japanese ISPs, BleepingComputer reports. The affected ISPs are STNet, JCOM, Chubu Telecommunications, NIFTY Corporation, and BIGLOBE. KDDI is still investigating the breach, but says the incident may have affected email addresses and passwords belonging to at least 14.2 million current and former customers. Users are urged to reset their email account passwords and ensure that multifactor authentication is enabled. It's also advisable to update any other accounts that use the same password, in order to prevent credential stuffing attacks.

The attackers gained access through a vulnerability in an unnamed third-party software product used by KDDI.