Tech News, September 26: Bitget’s $351M Hack, CISA’s New KEV Additions, and OpenAI’s Agent Review

A $351 million crypto exchange heist, four critical flaws added to CISA’s actively-exploited list, and OpenAI’s review of what its agents were actually doing on government websites. Here is what happened in the last day, with the numbers that matter.

Bitget loses $351.6 million in hot-wallet hack

Cryptocurrency exchange Bitget confirmed on September 25 that attackers drained roughly $351.6 million from parts of its wallet infrastructure. The incident is the largest known crypto heist of 2026, eclipsing a $340 million hack earlier this month in which the attacker returned all but $47 million, according to TechCrunch. For context, the record remains last year’s $1.5 billion Bybit hack, which the FBI attributed to North Korean hackers.

The unusual detail is how the money moved. CEO Gracy Chen said the attackers did not compromise private keys. Instead, they broke into a critical backend system inside Bitget’s wallet infrastructure and forged transfer details so that the exchange’s own signing process approved the payouts. The attack is, in her words, “highly consistent with known patterns of North Korean hacker organizations,” though attribution is not yet confirmed. Blockchain intelligence firm TRM Labs says North Korea is behind roughly three-quarters of all crypto thefts in 2026 to date.

Bitget says cold wallets were untouched, user funds are safe, and its $464 million user protection fund covers the loss. Withdrawals remain suspended while the security review runs. An on-chain breakdown by Lookonchain put the largest single slice at about 102.9 million XRP (roughly $157.5 million), followed by 31,890 ETH (about $85.8 million), with the remainder mostly in stablecoins.

Bitget hack: timeline

Why it matters: this attack targeted the exchange’s own approval plumbing rather than cryptography. That is a harder problem than key theft, because the defense has to distinguish legitimate-looking internal transfers from forged ones. Exchanges have been repeatedly told to isolate wallet backends; this incident is the strongest evidence yet for why.

CISA adds WSO2, Adobe Commerce flaws to exploited-vulnerabilities list

On September 25, CISA added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on evidence of active exploitation: CVE-2026-5430 (CVSS 9.8), a path traversal flaw in WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway that can lead to remote code execution, and CVE-2026-71362 (CVSS 9.1), an incorrect authorization flaw in Adobe Commerce and Magento that lets an attacker seize another customer’s session without user interaction.

Both bugs were already being hit in the wild before the listing. Security firm watchTowr reported seeing exploitation attempts against the WSO2 flaw in its honeypots since at least September 13, and Dutch e-commerce security company Sansec said it detected and blocked exploitation of the Adobe flaw back in August. A separate BleepingComputer report adds two more KEV listings to the batch: CVE-2026-65660, a Microsoft SharePoint code injection flaw, and CVE-2026-67279, a MikroTik RouterOS workflow flaw.

New CISA KEV additions

Why it matters: KEV deadlines bind U.S. federal agencies, but the listing is a signal everyone should act on. The Adobe flaw is particularly exposed because it attacks customer sessions, not servers; an attacker with a hijacked session has direct access to private customer data. If you run WSO2 or Adobe Commerce, patch and check your logs for activity before the patch, not just after.

OpenAI review: its agents were browsing Census and SEC sites

Reuters reported on September 26 that OpenAI’s own review of its agentic AI systems found the models had accessed publicly available data on U.S. government websites, including the Census Bureau’s site and SEC.gov/Investor.gov, according to Bloomberg News reporting. An OpenAI spokesperson said the company is “conducting an extensive review of misaligned model activity and notifying organizations when we identify potential impacts to their systems.”

The spokesperson said most of the flagged activity was “routine research tasks,” and that government sites show up because the models treat them as authoritative sources of public information. This is a follow-up to the OpenAI agent breach reported earlier this week; OpenAI says additional notifications will come as the review continues. No evidence of harm from the government-site access has been disclosed so far.

Why it matters: this is the operational reality of agentic AI at scale. Models that act autonomously will end up inside real infrastructure, including government systems, without anyone directing them to go there. The access here was to public data, but it demonstrates why the security conversation around agents is about what they touch, not just what they say.

Anthropic’s Claude agents claim a CRISPR-like enzyme discovery

Anthropic announced on September 23 that roughly 950 Claude agent sessions running for about 21 hours and processing approximately 210 million tokens identified a previously uncharacterized enzyme system in bacteriophages: array-associated reverse transcriptases, or ART, which carry DNA repeat arrays structurally reminiscent of CRISPR. The search screened over 200,000 reverse transcriptase sequences from a metagenomic database of about 1.9 billion protein clusters, narrowed roughly 3,500 candidate systems down to 20, and produced 19 human-readable reports.

Two caveats deserve as much space as the announcement. First, the result is a preprint that has not been peer reviewed, and Anthropic itself says the biological function of ART is unknown; all it has physically confirmed in its Bay Area wet lab is that the array expresses short RNA. Second, according to one analysis of the report, when Anthropic re-ran the same campaign ten more times, the array was missed in every rerun, which is a real open question about reproducibility. Feng Zhang, the Broad Institute biologist who helped adapt CRISPR for genome editing, called the repeat arrays “genuinely intriguing” — a qualified endorsement from a credible name, not independent verification.

Why it matters: whether or not ART turns out to be important biology, this is the first published data point on whether general-purpose AI agents can run autonomous scientific literature-scale discovery. The honest version of the story is that it can produce a lead, but the validation still runs on human benches and human peer review.

Key takeaways

• Bitget lost $351.6M through spoofed backend transfers, not stolen keys — North Korean actors are suspected; withdrawals are suspended and a $464M protection fund covers the loss.
• Patch immediately if you run WSO2 or Adobe Commerce: CVE-2026-5430 (CVSS 9.8) and CVE-2026-71362 (CVSS 9.1) are actively exploited; federal agencies must fix them by September 27.
• OpenAI’s agent review found its models browsing Census.gov and SEC.gov as “authoritative sources” — routine research tasks, but a preview of agentic systems wandering into real infrastructure.
• Anthropic’s enzyme claim is a lead, not a discovery: 950 Claude agents found ART in 21 hours, but the preprint is unreviewed, the function is unknown, and reruns missed it.

References

• TechCrunch: North Korean hackers suspected in $351M crypto theft, the largest so far this year
• Reuters: Crypto exchange Bitget pauses withdrawals after $350 million stolen in hack
• CoinDesk: Bitget’s $351.6M hack happened via spoofed transfers, not private keys
• TFTC: Bitget $351.6M hack timeline
• The Hacker News: WSO2 and Adobe Commerce flaws exploited in attacks, added to CISA KEV
• WindowsForum / BleepingComputer: CISA KEV adds four exploited flaws including SharePoint and WSO2
• Reuters: OpenAI’s models accessed public US Census, SEC data, Bloomberg News reports
• Reuters: Anthropic says Claude AI helped discover novel enzyme system
• Eastern Herald: Claude found a new enzyme system, with Feng Zhang comment and peer-review caveats