Daily brief at 7am Melbourne. Unsubscribe any time.

Sunday 4 October 2026

MI5 Names a Chinese State Front That Turned 100+ UK Academics Into Intelligence Assets

MI5 exposes a Chinese state front funding 100+ UK academics, Meta's Muse agent quietly profiles everyone in your contacts, and Apple slaps new limits on what AI agents can read off your Mac.

Lead story

MI5 Names a Chinese State Front That Turned 100+ UK Academics Into Intelligence Assets

British intelligence has a name for it now. MI5's September 30 "Security Service Espionage Alert" — a rare public-facing document — identifies the China General Technology Research Institute (CGTRI, 中国通用技术研究院) as a front organisation for China's Ministry of State Security. Its primary mission, according to MI5, is to fund academic research in ways that feed intelligence back to Beijing. More than 100 academics with UK links have been caught up in the scheme.

This isn't the usual story of a researcher naively collaborating with a Chinese university that turns out to have defence ties. MI5's framing is deliberate: CGTRI is described as purposefully structured to obscure its MSS relationship, presenting itself as a legitimate research funder while directing the intellectual output it pays for toward state intelligence goals. The academics involved may not all have known what they were participating in — which is precisely the point.

The alert names specific research domains CGTRI has been targeting: advanced materials, quantum technologies, and — pointedly — artificial intelligence. These are exactly the sectors where Western governments have been trying to restrict technology transfer to China, through export controls, foreign investment screening, and research security frameworks. The MSS, it seems, found a cheaper and less detectable route in.

Why this matters beyond the UK

Academic espionage through funding is difficult to counter because it exploits the open-science norms that make research valuable in the first place. Researchers share preprints, present at conferences, and collaborate internationally. A front funder doesn't need to steal data — it can simply commission work and receive it legitimately.

Australia has particular exposure here. Australian universities are among the most internationally connected in the world, and China is the largest source of international students at every major institution. The Australian Security Intelligence Organisation (ASIO) has warned repeatedly about foreign interference in the university sector, and the federal government's Foreign Influence Transparency Scheme (FITS) was designed to surface exactly these kinds of arrangements. But FITS has faced criticism for being under-resourced and hard to enforce at the granular level of individual research grants.

The CGTRI alert should prompt Australian research institutions to check whether any of their grant relationships or co-investigator arrangements touch the same organisation — or structurally similar ones. CGTRI is not the first MSS front to be named publicly, and it will not be the last.

What to watch

MI5's decision to name CGTRI publicly — rather than handle this quietly through university security liaisons — is itself a signal. It suggests UK intelligence believes the scale of the problem requires public awareness to counter it effectively. Expect ASIO and the Australian Department of Home Affairs to face questions about whether equivalent Australian-linked academics appear in their own assessments. The Five Eyes partners share intelligence; the UK's named list is unlikely to have no overlap with Australian institutions.

The harder question is what universities are supposed to do about it. Blanket restrictions on Chinese-funded research would cause enormous collateral damage to legitimate science. But a "nothing to see here" posture is no longer tenable when the signals are this explicit.

Also today

OpenAI Safety Staffer Quits, Says the Culture Is 'Broken'

David Robinson, who wrote the safety reports that accompanied every major OpenAI model release, has resigned and published a piece in The Atlantic calling the company's culture fundamentally broken. He's careful to acknowledge he's a cliché — the departing AI employee sounding the alarm — but argues that self-awareness doesn't make the warning less valid. Robinson says the pressure to ship has steadily eroded the internal processes designed to catch dangerous behaviour before it reaches the public. The resignation lands just days after OpenAI paused training its most powerful model following an agentic safety incident, adding uncomfortable timing to an already uncomfortable message.

TechCrunch ↗

Meta's Muse Agent Builds Detailed Profiles on Everyone in Your Life

Meta's AI agent Muse has racked up millions of downloads — but using it comes with a privacy cost that extends beyond the user. To personalise its assistance, Muse constructs detailed profiles of the people in your contacts: your friends, your family, your colleagues. You didn't consent to that profiling. They didn't either. Wired's investigation finds the data collection is extensive and largely invisible during setup. This is the structural privacy problem with personal AI agents that operate on your behalf — they need to understand your social world to be useful, and that means modelling people who never agreed to be modelled.

WIRED ↗

Apple Locks Down Full-Disk Access to Stop AI Agents Reading Everything

Apple has tightened its Full Disk Access (FDA) permission system in macOS, making it harder for AI agents to silently read private messages and other sensitive files. The change is a direct response to the growing ecosystem of AI agents — including Meta's Muse — that request broad file system access. Meta had argued that FDA access was insufficient for Muse to read messages properly; Apple's counter-move is essentially to say that's the point. For security defenders in Australian organisations deploying Macs, this is a meaningful hardening worth tracking — especially as AI agents proliferate on corporate endpoints.

Ars Technica ↗

Warlock Uses SharePoint Bugs to Kill Security Tools Before Deploying Ransomware

The China-linked threat actor tracked as Warlock is weaponising Microsoft SharePoint vulnerabilities — both old and newly disclosed — to hit critical infrastructure, government agencies, and educational institutions across Portuguese- and Spanish-speaking countries. The distinctive element in recent campaigns is the sequencing: Warlock disables endpoint security tooling before deploying ransomware, buying itself a wider damage window. Symantec and VMware Carbon Black's Threat Hunter team observed the activity. SharePoint remains one of the most widely deployed collaboration platforms globally, including across Australian government and enterprise environments, making patch cadence on any new SharePoint CVEs a priority.

The Hacker News ↗

N0n Ransomware: A New Extortion Gang That Hit a Dozen Victims in Weeks

N0n is a newly emerged ransomware and extortion group that appeared in mid-September 2026 and within days had published claimed victim data on a dark web leak site. The tally has kept climbing since. Graham Cluley's write-up for Fortra lays out what's known so far: the group's operational tempo is fast, it's targeting organisations across sectors, and it's using the standard double-extortion playbook — encrypt and threaten to publish. N0n hasn't been attributed to a known actor yet. For incident responders, the early-stage profile is useful: new groups often reuse infrastructure or tooling that leaves detectable signatures before they mature their opsec.

Graham Cluley / Fortra ↗

Fortra Patches Critical Flaws in BoKS Access Control Platform

Fortra has patched several critical vulnerabilities in its BoKS Server Access Control product, covering authentication bypass, arbitrary shell command execution, and memory corruption bugs. BoKS is used to manage privileged access across Unix and Linux server estates — the kind of platform that sits at the centre of an organisation's access control architecture. A bypass or remote command execution bug in that layer is a serious problem: it's the thing supposed to stop attackers from moving laterally, so compromise of it hands an attacker significant reach. Organisations running BoKS should treat this as an urgent patch cycle.

SecurityWeek ↗

doxx.net Raises $38M to Keep AI Agents Out of Trouble on the Open Web

Startup doxx.net has raised $38 million to build what it calls the Agentic Defence Network (ADN) — infrastructure designed to prevent AI agents from doing things their users didn't intend when those agents are operating on the open internet. The timing is sharp: autonomous agents browsing the web on users' behalf are creating a new category of security risk, from prompt injection attacks on web pages to unintended data exfiltration. doxx.net's pitch is essentially a policy enforcement layer that sits between the agent and the internet. It's early, but the problem is real — and growing fast as agent deployment accelerates.

SecurityWeek ↗

Flock Safety Called 'Indiscriminate Mass Surveillance' by Federal Judge

A US federal judge has ruled that a sheriff's deputy violated a woman's Fourth Amendment rights by using Flock Safety's automated licence plate reader network to locate her vehicle without a warrant. The ruling is significant: it's one of the first judicial findings to characterise Flock's system — which aggregates plate reads across thousands of cameras into a searchable database — as constitutionally problematic surveillance rather than ordinary police observation. Separately, Senator Bernie Sanders has introduced a bill to ban the federal government from using Flock altogether. The legal and legislative pressure is mounting on a platform that's become ubiquitous in US law enforcement.

TechCrunch ↗

Sean Parker Is Rebuilding Stability AI — as a Music Company

Sean Parker, who famously upended the music industry with Napster and then helped build its streaming replacement via Spotify, is now taking the helm at a restructured Stability AI with a focus on AI-generated music. The move is unusual on multiple levels: Stability AI was best known for Stable Diffusion image generation, not audio; and Parker is doing this with the active backing of major record labels — the exact institutions his earlier ventures antagonised. It's a bet that licensed, label-approved AI music generation is the defensible commercial path, rather than the copyright-contested free-for-all that's characterised the space so far.

TechCrunch ↗

Anthropic's Mythos Bug-Hunting Model Exposes Live Vulnerability Under Active Exploitation

Anthropic's Mythos model — purpose-built for vulnerability research and notable for its mathematical reasoning capabilities — has flagged a vulnerability that VulnCheck researchers confirm is already under active exploitation. Exploitation attempts are being traced to China-hosted IP addresses. The case is a live example of the double-edged dynamic in AI-assisted security research: specialised models can surface serious bugs faster than traditional methods, but the window between discovery and exploitation is shrinking at the same time. Defenders need to be watching Mythos's public disclosures as closely as attackers apparently are.

The Register ↗

Someone Ran Doom Inside an SQL Database at 35fps

A developer has implemented a playable version of Doom using 1,300 lines of pure SQL, with query execution rendering bitmapped frames at a claimed 35 frames per second. It's the latest entry in the long-running tradition of running Doom on things that have no business running Doom — previous victims include pregnancy tests, ATMs, and MIDI controllers. The technical achievement here is real: rendering a 3D perspective projection through SQL query logic alone requires some genuinely creative abuse of set-based operations. Whether it's useful is a separate question. It is, however, impressive.

Ars Technica ↗

Sources consulted