Apple’s Hide My Email Has a Problem

Do you rely on Hide My Email to keep your real email address hidden? According to security researcher Tyler Murphy, that hasn’t been true for more than a year. A vulnerability that Apple has twice declared fixed makes it possible to uncover the real address behind an alias within minutes — and the journalists at 404 Media verified it first-hand. For a company that builds its marketing on privacy, this is a story worth paying attention to.

In today’s Security Sunday, we’ll also look at BioShocking, a new prompt injection technique that fooled every agentic AI browser it was tested on, at a hidden mechanism in Claude Code that flagged requests coming through China-linked proxies, and at the $10 million reward the US has put on Russian hackers targeting Signal accounts.

The Hide My Email feature generates random forwarding email addresses so that users don’t have to enter their real email address when signing up for websites and apps. According to security researcher Tyler Murphy, co-founder of the personal data removal service EasyOptOuts, the system contains a vulnerability that makes it possible to discover the real address hidden behind a Hide My Email alias.

According to the timeline published by EasyOptOuts, communication with Apple dragged on for months. Detailed reproduction steps were submitted on June 13, 2025, additional information followed on June 20, and on July 9, 2025 a second, related vulnerability was reported. On July 14, 2025, Apple confirmed it was investigating the reports — and then went silent for months.

In March 2026, Apple told the researchers the issue had been fixed. A test on March 19, 2026, however, showed that it hadn’t. On May 22, 2026, EasyOptOuts reported that the severity and scope of the flaw were greater than originally assumed. Apple reportedly never responded to that message at all.

On June 30, 2026, Apple once again claimed the fix was complete, and the researchers once again found that the vulnerability still worked — which was the trigger for making the whole affair public.

404 Media independently verified the claims before publication: journalist Joseph Cox generated a new Hide My Email address and handed it to Murphy, who reportedly sent back the real address hidden behind it in about five minutes. Murphy also stated that in tests with volunteers, every single Hide My Email address they tested proved exploitable. Neither EasyOptOuts nor 404 Media have published the technical details of the attack.

More than a year later, the flaw is still exploitable — which is quite striking for a company that prides itself on protecting its users’ privacy.

BioShocking: A New Prompt Injection Technique Targets AI Browsers

Researchers at LayerX have published a new prompt injection technique called BioShocking, which can get agentic AI browsers to abandon their safety mechanisms by convincing them that they are inside a game rather than in the real world.

The attack itself is deceptively simple. LayerX created a malicious web page with a BioShock-style puzzle that rewards deliberately wrong answers — for example, claiming that 2 + 2 = 5. Once the AI browser agent adapts to this inverted logic in order to “win” the game, it is given one final task: navigate to a specific path and copy text from a text field.

In the test environment, this redirect secretly led to a GitHub repository containing credentials in an unencrypted file. All six agents tested copied the credentials and handed them over to a simulated attacker, without flagging the action as a violation of their safety guardrails. Several of them even responded as if they had won the game.

LayerX tested the technique on five agentic browsers and one browser plugin: ChatGPT Atlas (OpenAI), Comet (Perplexity AI), Fellou (ASI X INC), Genspark Browser, Sigma Browser (Sigmabrowser OÜ), and the Claude for Chrome plugin (Anthropic). Every single tool tested was successfully manipulated into leaking data.

LayerX says it notified all affected vendors of the vulnerability between October 2025 and January 2026, well in advance of publishing the results.

The vendors’ responses varied considerably. OpenAI fixed the issue in ChatGPT Atlas. Perplexity reportedly closed the report concerning the Comet browser without a resolution, and Fellou, Genspark, and Sigma did not respond at all. Anthropic attempted to fix its Claude for Chrome plugin, but according to LayerX the fix did not hold up against the proof of concept.

According to LayerX, the root cause lies in the architecture itself. Agentic browsers act on the assumption that their operating context is real, yet that context can be manipulated through prompt injection or memory poisoning.

The recommendation is the same as for any work with agentic AI. Think carefully about everything your AI browser can “see”. Anything you are logged into during a given session is potentially within reach.

Claude Code Secretly Flagged Requests from China-Linked Proxies. Anthropic Is Now Removing the Mechanism

Staying with AI for a moment longer. On June 30, a Reddit user going by the name LegitMichel777 reported that while trying to restore a deactivated remote control feature, they stumbled upon hidden logic inside Anthropic’s Claude Code CLI tool.

According to these reports, the code activates only when Claude Code is redirected to a custom API endpoint via the ANTHROPIC_BASE_URL environment variable, instead of communicating directly with Anthropic’s servers. In that case, the tool reads the system time zone and flags it if it is set to Asia/Shanghai or Asia/Urumqi, and it also compares the proxy hostname against an obfuscated list said to contain 147 entries.

Few people question the motive that likely lay behind it. Anthropic has previously stated that Chinese AI labs, including DeepSeek, Moonshot AI, MiniMax, and Alibaba, ran large-scale campaigns in which tens of thousands of fraudulent accounts and millions of exchanges allegedly served to extract Claude’s outputs for training competing models.

Thariq Shihipar, a member of Anthropic’s technical staff working on Claude Code, confirmed the mechanism. He described it as an experiment launched in March aimed at curbing account abuse by unauthorized resellers and protecting against model distillation, adding that stronger safeguards have been deployed since then.

For a tool that routinely works with the file system and shell access directly inside developers’ repositories, the whole affair reopens the question of what other undocumented client-side checks may exist.

US Puts a $10 Million Bounty on Hackers

The US Department of State, through its Rewards for Justice (RFJ) program, has offered a reward of up to $10 million for information that helps identify or locate members of two Russia-linked hacking groups tracked as UNC5792 and UNC4221.

The reward was announced on June 29. It links UNC5792 to the Federal Security Service (FSB), while UNC4221 is associated with Russia’s military services. The reward reaches the maximum rate the RFJ program offers for state-sponsored cyber operations, and its goal is not just to name specific individuals but to help dismantle the infrastructure and financial networks that keep these campaigns alive.

According to US authorities, UNC5792 ran extensive phishing campaigns against Signal and WhatsApp accounts belonging to American and allied government officials, military commanders, and diplomatic staff, abusing the legitimate “linked devices” feature without needing to exploit any technical flaw.

Victims were often deceived using fake messages impersonating Signal support or through modified group invite links. Once a QR code from an invite was scanned, the attacker’s device became linked to the compromised account.

In an updated advisory issued on June 26, the FBI and CISA warned that the same actors are now attempting to steal Signal’s so-called Backup Recovery Keys.

According to the FBI and CISA advisory, several thousand accounts have already been compromised in these operations. Typical targets are not only senior government officials but also analysts, journalists covering Russia and Ukraine, NGOs supporting Ukraine, and researchers focused on Russian affairs.

To build a more complete picture of how the whole operation works, the US is interested in the identities of the actors and their ties to Russian intelligence services, in their technical infrastructure — domains, servers, hosting providers, tools — and also in the financial trail, including bank accounts and cryptocurrency wallets used to fund the campaigns.