Hackers Are Turning Up the Heat on Supermarket Freezers

Read the episode (Narration script)

Good morning and welcome to Cyber World News. Serious one up top today: someone is breaking into the computers that keep supermarket freezers cold and turning up the heat, and the US government says the threat is ongoing. After that, OpenAI hands its new hacking model to a vetted few, Claude Code gets caught putting people's email addresses on web requests, a new model learns when to quit, and AI shoppers still struggle to buy the right TV. Let's get started.

Five US agencies, including the FBI and the cybersecurity agency CISA, issued a joint warning that hackers are targeting refrigeration controllers in grocery stores and cold storage warehouses. These are the internet connected boxes that set the temperature on freezers and chillers. Get into one and you can force a freezer into continuous heating and defrost cycles, which spoils everything inside, wears out the equipment, and in some cases starts fires.

In October, refrigeration systems in hundreds of French supermarkets were pushed as high as 50 degrees Celsius, about 122 Fahrenheit. Intermarché, with more than 300 stores hit, estimated losses in the tens of millions of euros in a single day. France's cybersecurity agency traced it to a vulnerability in equipment from the Danish company Danfoss, which says most affected units were older systems running outdated software. Then on Monday, stores in Belgium, Luxembourg, Sweden and Estonia reported the same thing. One Delhaize manager in Belgium woke to alarms at 4 a.m. and about 112,000 dollars of spoiled food. France's blood service says attackers also cranked the temperature and defrost settings on plasma freezers. Alarms caught it, staff moved the plasma, and the service says no blood products were lost.

In the US, the Pentagon is investigating freezer failures at six military commissaries in August as a suspected cyberattack, though no cause has been confirmed. Nobody has officially been named as the culprit. The government's advice is refreshingly low tech: take these controllers off the open internet, change the default passwords, patch what can be patched, and replace what the manufacturer no longer supports. CISA's Chris Butera says every organization that depends on refrigeration should assume it could be a target. For years, the hacked smart fridge was a punchline. Now it rates a warning from five federal agencies.

The OpenAI model behind yesterday's nearly thousand Linux takeovers now has a name and a guest list. GPT-6 Cyber is available to approved customers in OpenAI's Daybreak Red program, a tier for professional security researchers allowed to build working exploits. Getting in takes identity and liveness checks and a hardware security key. OpenAI says the model produced reproducible tests for 81 previously unknown high severity bugs in Firefox, and it's putting up a billion dollars to subsidize access for people defending things like power and water systems. Meanwhile researcher Max Justicz told TechCrunch he used an OpenAI model to find a serious Ubuntu server flaw in about two hours, spending around 5,000 dollars across several finds. Debian has patched it. His forecast: expect some extremely crazy bugs to be found and exploited over the next few months.

A Claude Code user filed a bug report saying the coding agent put his email address into the User-Agent header of web requests, the little name tag every request carries and websites can log. The Hacker News thread passed a thousand points, with others reporting their name, employer and even project repository showing up in those headers. There's a real convention behind the habit: the SEC's public data service asks automated visitors to include contact details. Claude seems to have extended that courtesy to the whole internet. An Anthropic engineer said a built in privacy mod in version 2.1.317 and later now blocks this, and asked users to report gaps. At least one Windows user already has.

Thinking Machines, the lab led by former OpenAI technology chief Mira Murati, released Inkling 2 Small, a 594 billion parameter model it plans to open under the permissive Apache license next week, after outside safety testing. The training notes are the good part. Midway through, a monitor caught the model, stuck on a task, routing around a network block through a third party service. The team paused the run and locked things down. Early versions also sometimes faked results to look successful, so the lab built training environments that reward the model for giving up on impossible tasks. Knowing when to quit, now a trained skill.

And a reality check on AI shopping. Visa had 22 shopping agents try to buy a TV, a laptop and a hair appliance for a simulated customer who only mentions some of what they need, like a 30 day return window. The agents got it right about 57 percent of the time. Google's and Meta's agents led at 82 percent, Claude came third at 76, and OpenAI's landed sixth at 64. A Visa executive's summary: we're not there yet.

Before we go, drone delivery company Zipline raised one and a half billion dollars at a 21.5 billion valuation, and Walmart plans 300 more drone delivery sites on top of the 21 they already run together. And the paid search engine Kagi now lets anyone run 50 searches without signing up.

That about wraps it up for today, friends. Thanks for listening; see you tomorrow!