Here’s the irony of the week: OpenAI spent the last few months teaching an AI model to out-hack human red teamers, and it worked. Meanwhile, a team of researchers at Bitdefender proved you don’t need machine learning to blind an endpoint detection tool. You just need to understand a Windows filesystem feature that’s been sitting there, mostly ignored, for years. One story is about cybersecurity getting smarter. The other is a reminder that the fundamentals still have holes nobody bothered to check.

Put those two stories next to a new crypto-stealing framework and a CISA advisory begging enterprises to patch SharePoint, and you get a pretty honest snapshot of where defense actually stands right now: increasingly sophisticated at the frontier, embarrassingly exploitable at the foundation.

The AI Arms Race You Didn’t Ask For

GPT-Red is OpenAI’s automated red-teaming model, trained specifically to hunt prompt injection weaknesses in other GPT models. It behaves the way a human red-teamer does: send a prompt, watch the response, adjust, repeat, chase a goal like data exfiltration. The twist is that it trains via self-play reinforcement learning against a set of defender models, both sides improving simultaneously across huge numbers of scenarios. In head-to-head testing, it beat human red teamers.

That’s genuinely useful for threat detection research, and it’s a reasonable use of AI for defense, automating a labor-intensive discipline that’s chronically understaffed. But don’t mistake “GPT-Red found it first” for “the problem is solved.” Every automated attacker eventually gets studied by real adversaries who don’t care whose model found the technique. Prompt injection at scale, discovered faster, is still prompt injection you now have to remediate faster. The tooling improved. The workload didn’t shrink.

Meanwhile, Malware Just Walks Past Your EDR

Now the low-tech half of the story. Bitdefender researchers disclosed a technique using Windows bind links, a filesystem feature that lets you mount one directory’s contents at another path, to create conflicting views of the same files. Your EDR agent looks at path A and sees something benign. The operating system, when it actually goes to execute, resolves path B and runs something else entirely. No exploit, no zero-day, no clever injection. Just two components of your security stack disagreeing about what’s actually on disk, and the attacker sitting comfortably in that disagreement.

This is the part that should bother you more than any AI headline: endpoint detection tools are built on an assumption that the filesystem tells the truth consistently to every process that asks. Bind links break that assumption cleanly, and they’ve been available in Windows for a long time. Nobody needed AI to find this. Somebody just needed to read the documentation more carefully than the vendors who built detection logic on top of it.

Defense in depth exists precisely for this scenario, where one control’s blind spot is covered by another layer that doesn’t share the same assumption. If your entire threat detection strategy leans on a single EDR agent’s view of the filesystem, this is your reminder that a single point of trust is a single point of failure.

OkoBot Doesn’t Need Zero-Days, Just Patience

Kaspersky’s GReAT team laid out OkoBot this week, a new malware framework going after cryptocurrency users through a multi-stage chain: initial delivery via TookPS, monitoring of Chromium-based browsers, exfiltration of seed phrases, and deployment of additional payloads including the Rilide stealer. It’s not flashy. It’s methodical, which is worse. Frameworks like this succeed by being patient and modular, swapping components as detection catches up to the last version.

What ties OkoBot to the EDR story above is the same underlying lesson: sophisticated malware increasingly doesn’t need a novel exploit to survive in your environment. It needs your detection stack to have a blind spot, any blind spot, and enough persistence to find it. Seed phrase theft isn’t glamorous the way a nation-state campaign is, but it’s a direct financial hit, and the framework behind it is built the same way enterprise malware is: modular, monitored, and designed to outlast a single incident response cycle.

The Boring Fix: Patch, Then Actually Check

None of this is a reason to panic-buy new tooling. It’s a reason to go back and check what you already have. CISA’s urgent call this week for organizations to patch three actively exploited SharePoint vulnerabilities, two of them targeted as zero-days before a fix existed, is the same story it always is: attackers are already inside some networks running these flaws right now, and the patch alone doesn’t undo that. If SharePoint is exposed in your environment, patching is the floor, not the finish line.

Some concrete steps that actually move the needle this week, not eventually:

• Patch the SharePoint vulnerabilities CISA flagged today, then hunt for indicators of prior compromise, don’t assume the patch retroactively cleans anything.
• Audit what your EDR agent actually resolves filesystem paths against, and whether any process on your endpoints has legitimate reason to create bind links or junction points outside IT-managed processes.
• Layer network-level threat detection behind your endpoint tools. If a bind link or filesystem trick blinds one layer, egress monitoring and firewall logging should still catch the exfiltration attempt.
• Treat brute-force login attempts and credential stuffing against exposed admin panels as a standing threat, not an occasional incident, automated blocking on repeated failures is cheap insurance against exactly the kind of patient, modular attacker OkoBot represents.
• Rotate and monitor browser-stored credentials and crypto wallet access on any machine that touches financial systems, since Chromium-based browser monitoring is now a standard stage in stealer frameworks, not an edge case.

Security hardening isn’t about chasing the newest technique. It’s about closing the gap between what your tools assume and what’s actually true on the machine. AI-assisted red teaming and bind link evasion are two very different sophistication levels, but they both exploit the same kind of gap: a defender who trusted a single source of truth.

The Takeaway Nobody Wants to Hear

Cyber security teams love a good arms race story because it’s exciting and it justifies budget. But this week’s real lesson is duller than that. GPT-Red beating a human red team is impressive. A Windows filesystem feature quietly defeating EDR products is a much bigger problem, because it means the basics you already paid for aren’t as solid as the vendor deck claimed. Check your assumptions before you buy the next thing that promises to fix them.

Sources

• GPT-Red beat human red teamers on a prompt injection test
• Windows Bind Link Attacks Can Hide Malware From EDR Tools
• OkoBot: new sophisticated malware framework targets cryptocurrency users
• CISA Urges Immediate Patching of Exploited SharePoint Vulnerabilities