Category Archives: Security

History, Security

AI Warfare Targeting Black Authors: Wheatley to Kundizeza

1 Comment

The Academie Goncourt struck a novel from its longlist on 25 September, four days after an anonymous account with 92 followers declared it the work of a machine. The evidence was a single commercial detector. AFP ran the same passages through its own tool and got “very likely written by a human”, and seven other detectors disagreed with each other. The Goncourt cited plagiarism findings alongside the detector, but the plagiarism hunt began only because the anonymous account had made the author a target.

The author is Thelyson Orelien, 38, born in Gonaives, Haiti, resident in Montreal since 2010. His first novel, C’etait ca ou mourir, follows a teacher fleeing gang violence to Canada. It won the Prix du Roman Fnac on 21 September. The accusation from “Balance ton Claude” landed the same day. Within four days his Quebec publisher had suspended promotion, a book fair had withdrawn his guest of honour title, two newspapers had found copied passages in a short story and columns he wrote between 2012 and 2014, and the Goncourt had acted “to preserve the integrity of the Goncourt Prize” and its mission of honouring “literature written by women and men.”

On 24 September Le Figaro identified the account’s operator as one of its own columnists, Samuel Fitoussi, author of Woke Fiction. He had denied involvement to AFP all week while reposting the accusation from his named account. On 25 September he confirmed a “collective project” whose other members remain unnamed, and called the question of race conspiracist. The president of the Academie Goncourt, Philippe Claudel, had already told franceinfo why he thought the timing mattered: a Haitian, Canadian, Black, francophone foreigner, in a season when passions run high.

Fitoussi’s stated motive is fear that AI will end human writing. He is an associate member of Frst, a Paris fund that finances AI startups and began life as Otium Ventures under the Catholic billionaire Pierre-Edouard Sterin. The detector he relied on, Pangram, raised $9 million in July in a round led by Menlo Ventures. Menlo’s partner wrote that the firm led the round as part of the Anthology Fund, the vehicle it runs with Anthropic, whose assistant gave the account its name. Pangram describes its detector as a model trained on tens of millions of documents known to be written by humans.

The Goncourt was the second prize of the year to act on that detector. On 14 May the Commonwealth Foundation named five regional winners of its short story prize. A Wharton professor ran the Caribbean winner through Pangram, “The Serpent in the Grove” by Jamir Nazir of Trinidad, and posted the result: 100 percent AI. Granta, which published the winners, asked Claude whether the story was machine written and put the answer in a statement. Its publisher Sigrid Rausing wrote that the judges may have awarded a prize to AI plagiarism and that Granta might never know. On 19 June Granta ended its external publishing partnerships. On 22 June the Foundation cleared all five winners. It had refused to run detectors on unpublished work and instead asked every winner for working drafts, time-stamped documents and notes. Nazir was named overall winner on 30 June. Vauhini Vara of The Atlantic then fed fifteen years of winning stories into Pangram and found that the only ones it flagged were three of the five from 2026.

On 6 October the Caine Prize for African Writing gave its £10,000 award to “The Blue Fighter” by Simbarashe Steyn Kundizeza of Harare, chosen from 407 entries across 27 countries. On 11 October Vara published her Pangram scan of the story under the headline “Yet Another Literary Prizewinner Seems to Be AI”. The detector flagged almost the whole text. It had passed every earlier Caine winner she tested and “The Whistleblower”, a thriller Kundizeza published in 2021. His agency told her it has full confidence the work is his. The same day the Caine Prize Foundation opened a review. Vara noted in the article that detectors flag the tidy English of writers for whom it is a second language. Stanford measured this in 2023: seven detectors were near perfect on essays by American eighth graders and flagged 61 percent of essays by non-native speakers as machine written.

The accused writers in May, September and October came from Trinidad, Haiti and Zimbabwe. The detector was the same each time.

Zimbabwe has seen this office before. In 1954 the Southern Rhodesia government set up the African Literature Bureau. Its stated purpose was to grow a reading market in Shona and Ndebele. Its working purpose was to screen every manuscript by an African before a publisher could print it, and to keep politics out. Solomon Mutswairo’s Feso, among the first novels by an African, came out under the Bureau in 1956, and the Ministry of Education later struck it from the reading list for African schools. Philemon Mutambara, a teacher with a Fort Hare degree, submitted a Shona novel in the 1960s. The Bureau returned it with demands for changes and a reader’s report telling him that the books it had already published “would be an invaluable guide to you as the sort of standard required for publication.” He refused, died in 1968, and the novel appeared 51 years after he wrote it. A white office in Salisbury held a model of what an African story should read like and graded manuscripts against it. Flora Veit-Wild, who wrote the social history of that system in Teachers, Preachers, Non-Believers (1992), later interviewed the Bureau’s post-independence director, who told her there had been no censorship, only screening. Pangram holds a model of what a human story should read like and grades manuscripts against it. It flagged a Harare writer’s prize story and passed the one he wrote in 2021.

Black authors in the French and English worlds have been asked to prove they wrote their own books for 250 years. Phillis Wheatley was examined by eighteen Boston men in 1772, Governor Thomas Hutchinson among them, before a London publisher would print her poems, and their signed certificate opens the 1773 edition.

Bakary Diallo, a Senegalese rifleman, published Force-Bonte in Paris in 1926 and was assumed for decades to have had it written by his French patrons. Camara Laye’s Le Regard du roi (1954) was attributed in 2002 by the scholar Adele King to two Belgians in Paris, his landlord and a reader at his publisher. Yambo Ouologuem won the Renaudot in 1968 for Le Devoir de violence, faced plagiarism charges from 1971, and published nothing after 1972.

A white author gets the opposite treatment. Michel Houellebecq copied Wikipedia passages into La Carte et le Territoire, admitted it, called it collage, and won the 2010 Goncourt anyway.

Nazir handed over his drafts and timestamps to keep his prize. Orelien is compiling a dossier with his editor to prove he wrote his own book. Kundizeza’s agency is vouching for him while a foundation reviews his story. Wheatley stood before eighteen examiners in Boston over 250 years ago.

The information warfare against Black authors hasn’t changed much.

Security

Micah Lee’s Tinfoil AI Privacy Post Skips the Privacy

Leave a comment

Micah Lee’s new post tells readers NOT to use OpenAI or Anthropic, and points them to Tinfoil with the advice to:

read their docs on secure enclaves and remote attestation.

Fine advice. But the details matter, and he gets them dangerously wrong in a post about being private.

His post argues for open weight models on Tinfoil’s secure enclaves for anything private. He calls Tinfoil “the company that’s doing the most work here” and offers no comparison to back it. And he runs Tinfoil through OpenCode, a coding harness that talks to any OpenAI-compatible endpoint.

Tinfoil’s page for coding agents lists OpenCode by name and says plainly:

OpenAI-compatible clients don’t perform connection-time attestation themselves.

No attestation at connection time. That’s a big problem for someone recommending Tinfoil as the company doing the most work. Attestation is the check that the enclave is real hardware running the code it claims to run. Tinfoil’s answer is a local proxy that runs that check before each request leaves the machine. Without the proxy, what remains is an audit log reviewed after the fact, which the Tinfoil SDK documentation calls “a much weaker guarantee.”

Much weaker. The work Tinfoil does goes unused in the setup he describes.

Later in the same post he waves off OpenCode Go’s privacy terms:

Of course, it’s just a promise. Nothing technical guarantees it.

An enclave left unchecked at connection time is also a promise. The premium that he pays to Tinfoil is for hardware that can prove itself, yet that proof counts only when the client asks for it. His post never mentions the proxy. So what is he paying them for exactly?

Privatemode, from the German company Edgeless Systems, puts that check in its standard client. A small local proxy handles encryption and attestation, and verification runs on the user’s side before any data goes out.

Notably Micah trusts Mistral with your data for being French. The same reasoning favors a German service where verification is the default path. Tinfoil is American.

The larger problem is actually on his laptop. He warns readers away from ZCode, Z.ai’s coding harness, because it was caught uploading local source code without consent. That is what any harness can do with the access it gets: read a file and send it somewhere. His replacement is OpenCode, a different harness with the same reach into the same machine, and he recommends that setup for malware analysis and pen tests.

Why? No thanks!

The enclave security only protects the model while it computes. The agent’s file reads and shell commands happen outside the enclave, on his laptop and across the open internet. The private part of his private AI is the inference. See the disconnect?

The same gap shows up in how he splits his work. He sends “completely public work” to OpenCode Go because the code is already open source. A coding agent sends whatever it reads into the conversation, command output included, and the conversation goes to the router and the provider behind it. The repository is public. The session holds whatever the agent read from his machine.

On the models themselves, he writes that it’s “perfectly fine, safe, and secure to use these open weight models,” as long as readers keep their chats away from the companies that made them. The weights are the company’s work. Open weights let anyone run a model, and they reveal very little about what it was trained to do. Researchers at Anthropic showed in 2024 that a model can be trained to act normally until a trigger appears, and that standard safety training left the hidden behavior in place. Trusting the weights while distrusting the lab is still trust in the lab.

He is right that the frontier labs gate access to their strongest cyber capability, and he understates how far it goes. Anthropic’s least restricted tier is vetted in collaboration with the US government, and every organization in its verification program accepts data retention so Anthropic can monitor for misuse. Security researchers pay for fewer refusals from the vendor by sacrificing privacy, if you can believe that.

His answer is a model without “a cop watching over your shoulder.” A filter at the provider serves the provider’s policy. Removing it leaves the operator with zero controls of his own while the agent runs malware analysis on his machine. That’s not logical. The control that protects the operator sits outside the model, in his hands, so it can decide what each proposed action may touch. Refusals trained into a model can be removed. But a gate setup outside the model stays in place when the model changes.

He also says the labs can share your data “or do whatever they want.” Anthropic’s commercial terms bar training on customer content, and its government request policy requires valid legal process outside emergencies. Those are promises, the same class he assigns to OpenCode Go and files under inference without privacy. Tinfoil without connection-time attestation belongs in that class too, yet he files it under private. A promise becomes a guarantee through verified attestation, which is the step missing from the Tinfoil setup he describes.

I built Wirken for what his post is trying to say. It is a model-agnostic gateway between the model and everything the agent can touch. Every tool call passes a gate that allows it, asks a human, or refuses it. Outbound traffic reaches only allowed hosts, and each action goes into a signed audit log that verifies offline. The same gate runs whether the model is open weight on my own GPUs, Tinfoil, Privatemode or Claude at Anthropic.

Changing the model changes who proposes the action. The proper gate decides whether it happens. And a proper TEE has attestation as default behavior.

Security

Anthropic’s Worm Paper Shows Why Nobody Needs Anthropic

Leave a comment

Anthropic’s Frontier Red Team gave Qwen3.5-9B access to Opus 4.8 as an advisor and measured whether the advice made the small model better at setting up inference on unfamiliar hardware. Success rates stayed flat. The team offered the advisor as a tool call and, in a second arm, pushed its advice to the small model whenever it stalled. Both arms stayed flat.

A version first trained with reinforcement learning to call an advisor on coding problems still struggled to ask for useful help. The authors take that result, add that small models are persistent agents on their own, and judge coordination more likely to come from:

a large model handling high-level strategy and spinning up small models as subagents.

Ok, supervised agent swarms is one way of working, but that doesn’t mean it is a necessary one.

The same paper builds its threat model on the independence of small models. A small replicator carries its own weights onto cheap devices, and the authors judge it hard to shut down because the swarm has no central point to switch off.

A swarm is a distributed compute model, and distributed systems carry their own power-off by design. Every node runs the same program, and the program checks a condition before it continues: a lease that expires, a signed stop command from any peer, a heartbeat that goes quiet. Any one of those switches off the whole swarm with no central server anywhere. The Internet already works this way. A BGP route withdrawal propagates router to router with no central router. A TLS certificate stops working on the expiry date written into it at issuance. A DNS record dies on its TTL.

The paper’s own precedent shows the same property. FritzFrog takes commands from any peer, which is how Guardicore joined the network with its own client and issued commands to it.

A distributed swarm has no central point and an off switch at the same time.

The design question is who holds a key, and the paper very suspiciously never asks it, perhaps because they don’t fully understand the topic of swarm safety. I have written about it extensively in designing a swarm harness called Wirken, which is open source and free, for those who want more details.

The hardware work seems logical. The team ran Gemma4-26B-A4B across 15 off-brand TV boxes at 0.39 tokens per second, on ARM processors limited by memory bandwidth.

The problem is with the inference made by the authors from those experiments.

A Large-model advice leaves small-model success flat, asked or unasked.
B Small replicators are hard to kill because the swarm has no central point.
C Expect a large model to direct small subagents.
Paper A ∴ C, while holding B

C needs a channel from the large model to the small one that carries useful instruction. A measured that channel and found it flat. The arm that pushed advice whenever the small model stalled is the closest the paper comes to testing a large model intervening in a small model’s work, and it showed no significant gain. A counts against C.

The paper derives C from A in a single sentence, so the authors reach their conclusion from evidence against it.

The paper has a point. It reports that small models complete individual replication steps and make errors when chaining them end to end, so a large model handling the chaining while small models handle the steps is a coherent design.

The paper offers that design as an expectation. And then the expectation is left untested, therefore unproven. Or perhaps they tested it and decided not to publish the result because it made Anthropic look even worse than this paper already does.

C also cancels B.
B depends on the swarm having no central point.
C adds a central point.

A large model directing many small ones is a central point by construction, and it runs where large models run, in a datacenter or behind an inference API. The paper describes an API-based replicator as one that needs a model provider to serve it unknowingly, and judges it easier to discover. A strategist on an API puts command of the worm inside a vendor’s product, where the vendor holds the logs and can revoke the keys. Taking out the strategist takes out the coordination C describes. B and C each describe a replicator, and they describe two different ones.

Takedown logic tends to aim at central command. In April 1970 Nixon told the nation that American and South Vietnamese units would attack the headquarters for the entire Communist military operation in South Vietnam. The Pentagon’s own Vietnam War commemoration records that the incursion never found the headquarters it had hallucinated. This is what should come to mind when reading Anthropic claims.

Microsoft disabled Rustock in 2011 by seizing its command and control servers from five hosting providers in seven US cities and severing the IP addresses that controlled the botnet. FritzFrog and P2PInfect put command in the peers instead. Guardicore found that FritzFrog distributes control across all of its nodes, and Unit 42 found P2PInfect running on a peer-to-peer command and control network. The Anthropic paper cites both as the precedents for its small replicator. But the paper’s own data points us to a very different conclusion.

In its Memento harness, each Qwen3.5-9B instance kept notes on what it tried and what failed, and a fresh instance inherited them. Setup success rose from 45 percent in the first generation to between 61 and 84 percent in later ones. Small-to-small transfer raised success, while large-to-small transfer left it flat. The one Anthropic model in the experiments, Opus 4.8, appears only as that advisor.

D Small models improve on notes inherited from small models.
Supported A ∧ D ∴ small coordinates with small
Non sequitur A ⊬ C
Inconsistent C → ¬B

The supported inference keeps the premise of B intact: the swarm has no central point. It describes the replicator the experiments produced: small models running their own weights and passing notes forward to their successors.

Therefore, the paper’s sentence that a large model is the more likely director follows from nothing in its data.

It appears to be a hallucination by the authors.

In April I read the Mythos system card and found an engineering research voice that refused to sign the number that the marketing voice was pushing in the headlines. The research voice said the model weaponized two bugs another earlier model found, in patched software, with the sandbox off. The marketing voice said thousands of zero-days. I think we all know how the marketing turned out.

Six months on, I see the conflict of these two voices again, compressed into a single paragraph. Engineering says that a large model adds nothing to a small one. Marketing, in the next sentence, puts the large model in charge. A company with a mature risk owner would have reconciled the giant gap between those two sentences before publication. It strikes me that Anthropic doesn’t have strong enough security leadership.

Every measured result in the paper has small models working alone and teaching each other. That makes sense. That’s logical as well as consistent with Internet history. Nobody needs an IBM. Nobody needs Amazon. The market should not favor hedge and capture by artificial pressure. The paper’s own data shows a large model adds nothing to a swarm of small ones.

Nobody needs Anthropic.

Food, Security

French Food Chains Hacked With Freezer Bug, Following US Military Base Case

1 Comment

The refrigerated cases in about four hundred French supermarkets ran their defrost heaters through the night of 11 to 12 October with the setpoint at 50 degrees Celcius. That’s hot, even in Fahrenheit.

Attackers reached the Danfoss refrigeration controllers in roughly 300 Intermarché and Netto stores, under a hundred Coopérative U stores, and outlets of Leclerc, Carrefour Market and Monoprix, and held the defrost on for about six hours. Fresh and frozen stock was destroyed, with losses in the millions of euros. The Paris prosecutor opened an investigation on its own initiative and assigned it to the national anti-cybercrime office, citing fire starts alongside the food loss. The attack remains unclaimed and unattributed.

A spoiled summer, now fall

The attack hit the aisle already under the most strain. French fresh-produce prices rose 5.9 percent year on year in August, up from 2.7 percent in June, with salads and tomatoes each up more than 20 percent after the summer heat. Farm diesel was up 50 percent and nitrogen fertiliser had doubled by May after the Strait of Hormuz blockage. Dominique Schelcher, the Coopérative U chief who called the attack unprecedented, had already told France 2 in April to expect food prices up four to five percent. Economists expect this summer’s weather to push eurozone food inflation toward 3 percent in 2027, with fresh food first.

One night of spoiled stock across four hundred stores is small against national food spending. It lands on households already watching the fresh aisle, and it puts empty cases in front of them when their budgets are tightest.

Danish intelligence describes the aim of Russia’s hybrid campaign as creating insecurity in the targeted countries. A visible hit on food during a cost-of-living squeeze serves that aim quite clearly.

Germany’s BSI had the warning drafted before the attack. The recommendation, that internet-exposed industrial control systems are a cheap target for hybrid warfare and that an operator who leaves them exposed acts in breach of duty, is dated 9 October, two days before the French night. BSI held it until the 13th, publishing it the day after France and the same day its president spoke. Its named examples of exposed small operators included food refrigeration, alongside power generation and water treatment. The pattern was the same. The warning cited two recent cases of the kind, more than thirty US water utilities hit in August with their process controls manipulated and locked, and a December 2025 run at Polish wind and power plants where one reused password opened several separate sites. BSI president Claudia Plattner said the attack could have hit any country and would draw copycats, and pressed operators to secure their systems.

The noise of destruction was the point.

The same controllers can be made to spoil stock quietly, with no heat and no alarms. The attacker took the opposite route, pushing the cases to 50 degrees and emptying whole aisles by opening time. A quieter attack was available, and the attacker passed it over. Whoever did this wanted the damage seen and left no name on it. That is the shape of a message. Everything the heat touched had to be dumped, so the loss fell on the chains and stopped short of a customer incident.

The common factor across the chains was a refrigeration-control platform reachable over the network and running software a year past its fix. European law covers only part of this. The Cyber Resilience Act reaches the product with reporting required since last September, as explained below. NIS2 reaches the operator if they are wholesale, meaning not these stores (retail).

The mechanism

A supermarket runs its cold cases and cold rooms from one supervisory controller, here the Danfoss AK-SM and AK-SC families, which set the temperatures and schedule the defrost for every case in the store. The controller is networked so a contractor can monitor and adjust hundreds of sites from one desk. France’s national CERT confirmed on 12 October that it knew of numerous compromises of Danfoss AK-SM and AK-SC systems, and said exposing a management interface to the internet runs against good practice. An Intermarché spokesperson said the attackers targeted outdated versions of the control software on consoles reachable over an inadequately secured remote channel. A stolen password would have worked on any version, so the reported version cutoff points to an exploit aimed from a scan.

Claroty’s Team82 published its research on the AK-SM 800A in August: a hidden authentication path built on a daily code, logged as CVE-2025-41450, and 2,765 of the controller’s management interfaces exposed on the public internet. Danfoss had shipped the fix in firmware R4.3.1 in 2025. The stores hit were reported to be running older firmware, though the CERT named no version.

Where the law ends

France’s cyber agency is treating the attack as a product fault. A person close to Prime Minister Lecornu said ANSSI had identified a vulnerability in software supplied by a Danish company and contacted the vendor. The agency is working with its European counterparts because other countries may be affected, and is searching for other exposed French companies before the attack spreads. The response therefore follows the product, across many operators and borders.

The Cyber Resilience Act covers product fault, and part of it is already in force. Since 11 September, manufacturers have had to report actively exploited vulnerabilities in their products to ENISA and a national CSIRT within 24 hours of becoming aware of them, a duty that extends to products sold before the regulation fully applies.

This attack falls a month inside that window.

The full requirements, secure-by-default design and security updates across a defined support period, will start to apply from 11 December 2027. Old controllers with internet-facing interfaces and a vendor-built hidden authentication path are the case those requirements address, next year.

Liability is the real gap, which let bad network-connected software spread in the first place. For forty years a manufacturer had to answer for a defective physical product. However, software was shipped as a licensed service that disclaimed the same duty. A controller is both at once, a box on the wall and the code inside it, and the code lacked an equivalent liability. That gap has allowed a business case for shipping an internet-facing controller with a hidden authentication path and leaving the fix to a firmware update the field apparently never installs.

Berlin’s own breach this year ran on the same arrangement, with 21 state systems whose admin passwords only the vendors could change. The revised Product Liability Directive closes it, treating a missing security update as a defect the maker answers for, though only for products placed on the market from 9 December 2026.

Controllers already installed fall under the 1985 directive, where liability for software remains contested. Groupement Les Mousquetaires has already said the systems were under Danfoss’s management and so the complaint has to fall to the supplier.

The EU’s NIS2 also has a gap where the attack landed. Annex II covers food businesses engaged in wholesale distribution and industrial production, which takes in the purchasing and logistics groups behind these large retail chains. The stores where the controllers sit are considered outside Annex II, and many belong to independent members of the cooperatives. Article 21(2)(d) makes an in-scope entity answer for the security of its direct suppliers, so the duty follows whoever holds the refrigeration contract.

Look at it logically. When a store holds it, the duty falls outside NIS2. The refrigeration-management provider enters NIS2 in its own right only if it qualifies as a managed service provider under Annex I, a question regulators should soon settle.

The CER Directive draws the same line around retail for the physical resilience of food operators. Article 22 of NIS2 lets EU bodies run coordinated risk assessments of critical ICT supply chains, and supervisory controllers for food refrigeration belong on that list.

US military base warnings

On 26 and 27 August, at least six US military commissaries lost refrigeration within days of each other, with reports from as many as fourteen. At Fort Huachuca every freezer went into defrost overnight while the power stayed on, and the base said the defrost heated the food.

The Defense Commissary Agency’s own engineering specification states that defrost is controlled through its remote monitoring system, and a DeCA contract required its refrigeration contractor to keep a master control system for all of those systems in the continental United States. A defense official acknowledged a “possible refrigeration disruption,” and three federal criminal investigative agencies, led by DCIS, opened investigations.

Claroty’s Danfoss research had appeared eighteen days before Fort Huachuca lost its freezers. The two incident nights share the defrost signature, the overnight timing and the published research that came before them. Both remain unattributed.

In August the United States was at war with Iran, and in October France sat inside Russia’s campaign against Ukraine’s supporters, so the motives point to different adversaries.

One actor rehearsing on US bases and then striking France fits the sequence. So does a method made public in August and picked up by more than one crew. The commissary controller records, still in a FOIA queue, would help distinguish or connect these incidents.

Who done it

The version cutoff and the reported hits on Metro and independent butchers fit a scan of French addresses that hit whatever fit the profile. Any actor could run it. A state or state-directed operation inside the Russian hybrid campaign fits the motive against a Ukraine supporter and the pattern of an effect felt with the hand unseen, and the technical evidence for it has yet to appear. Unclaimed and fragmented is the Russia hypothesis itself, since an operation of this kind succeeds while the case stays open. A pro-Russian hacktivist crew fits the method, and its silence counts against it, since those groups claim loudly. A criminal demonstration ahead of a private extortion demand fits the absent ransom note and little else.

There is one question nagging at me. Danfoss is a Danish company and other Ukraine-supporting states run its equipment, yet the reports come from France. Either the exposed pre-version-4 population sat in France or France was carefully chosen, and the other countries may have yet to report. ANSSI is asking its counterparts now.

The same weekend, Ahold Delhaize, the largest grocer in the Netherlands and owner of Delhaize in Belgium, took systems offline after a cybersecurity incident, and the damage there ran deeper than a night of spoiled stock. It cut the distribution chain. Albert Heijn’s website and app went dark, deliveries stopped, shelf-label pricing failed, the disruption reached the group’s US business, and by the third day Dutch media were running live tickers on empty shelves while rivals picked up the trade. The company found no evidence of data theft, and Dutch experts called it very likely an attack. France spoiled what was in the cases. The Netherlands stopped the cases being filled. As a demonstration that someone can switch off a country’s food supply, the quieter incident is the stronger one. No link to France is established, and nobody has claimed either.

Ok, say Russia already

Control-system attacks with physical effect have a verified record older than the press admits, running back past the Maroochy Shire sewage release in 2000. The matching cases reached an exposed control system and pushed a setpoint or valve to a destructive value. At Køge in 2024 an intruder altered pump pressure at a waterworks and burst pipes, and Danish intelligence attributed it to Russia in December 2025. Norwegian authorities said hackers opened the valves at a dam and blamed Russia. Dutch military intelligence reported the first cyber-sabotage attack by a Russian-aligned group on a control system in the Netherlands. France is unattributed and belongs to this class.

The wider campaign is accelerating. Danish intelligence said on 7 October that Russia had begun sabotage against Danish companies supplying Ukraine. German police logged hundreds of sabotage acts against critical infrastructure in a year, from the Vulkangruppe arson that blacked out Berlin in January to the rail fires claimed by “Kommando Angry Birds” in July, and Germany attributed the Leipzig/Halle drone attempt to Russia on 1 September. Dutch rail went down four days after NATO staged trains for the Russian front, while a US indictment shows Russian recruiters paying for sabotage from a price list. These are physical attacks, a different technique from France, carried out against the same group of countries supporting Ukraine. France sits in the middle ground between cyber and kinetic attack that threat frameworks still split in two, where a network command produces a physical result.

Put the week together and the target class is food. While the French cases ran hot and the Dutch distribution chain stood still, drones were hitting merchant ships in the western Black Sea. On 5 October two drones that Zelensky called Russian sank the Royad Mammadov, a dry-cargo ship carrying Ukrainian corn from Izmail to Italy, killing its captain. On 13 October two more were struck off Bulgaria, one of them Ukrainian-owned, and one sank with eleven crew missing. Bulgaria summoned the Russian ambassador. Von der Leyen called it another front of Russia’s war. Three hands or one, the cold chain in France, the distribution chain in the Netherlands and the grain route out of the Black Sea were all hit inside nine days. That is an infrastructure strike on food, whoever ran each piece.

How to settle this

Open question What would answer it
Entry vector An internet-exposed StoreView interface, or compromised provider and installer credentials. The answer separates opportunistic exploitation from supply-chain compromise.
Scan history Archived Shodan and Censys records of French-geolocated AK-SM interfaces, matched against the victim list.
Independents Whether butchers with no shared provider were hit. If they were, the product version is the common factor.
Other countries Danfoss sites outside France. ANSSI says other countries may be affected and is checking with its European counterparts.
Ahold Delhaize Whether its same-weekend incident shares anything with France beyond timing. It hit IT and the distribution chain, not refrigeration, and nobody has claimed it. Dutch experts read it as very likely an attack and most likely criminal. Of the two, it is the larger hit on the food supply.
Claims Any posting on dark-web forums or Telegram.
Vendor telemetry Whether the affected units were cloud-managed or exposed standalone.
US parallel Controller make and firmware at the commissaries hit in August, now in a FOIA queue.

Spoiled food is a smaller harm than a grid outage, while the security problem ends up looking the same: physical equipment behind a network control left reachable, running software a year past its fix. The Cyber Resilience Act as it stands is for the controller. These chain stores with massive footprints, where the food spoiled from infrastructure-grade attacks, isn’t yet addressed as NIS2.