Fable 5, GPT-5.6 and the high stakes of AI safeguards. Agentic ransomware, ClickFix reigns supreme

Anthropic, OpenAI, and other providers are releasing powerful AI models with enhanced safety guardrails, while threat actors adapt by using AI-driven ransomware and sophisticated social engineering like ClickFix to bypass defenses 1:41.

Key Takeaways:
• Frontier models like Fable 5, Mythos 5, and GPT-5.6 Sol prioritize real-time classifiers to detect harmful inputs, marking a shift in AI safety implementation 2:02.
• Safeguards primarily benefit compliant users, leaving a gap where unrestricted models (like open-weight GLM 5.2) or unregulated actors can still be used for malicious purposes 5:46.
• "Agentic ransomware" (JADEPUFFER) demonstrates AI's ability to automate exploitation, though its current lack of sophistication suggests it is an early stage of a broader trend toward AI-amplified cyberattacks 13:34.
• ClickFix has emerged as a dominant social engineering attack by tricking users into pasting harmful commands into terminals, exploiting the "self-help" IT culture and bypassing traditional email filters 24:11.
• The UnregStealer campaign targets Latin American financial institutions using a human-in-the-loop approach, delivering malicious Chrome extensions via enterprise policy to steal banking credentials selectively 33:10.

The cybersecurity landscape is shifting from static defenses to dynamic, AI-driven threats that require continuous adaptation in both technical controls and user awareness.

Sources:

• 1:41 Introduction to new AI models and their safety features.
• 2:02 Discussion of Fable 5, Mythos 5, and GPT-5.6 Sol sa