Here is the uncomfortable part: someone can break into your Mac right now without knowing your password, and all they need is for one particular port to be open to the internet. That is not a theoretical risk. Dutch cybersecurity officials confirmed this week that it is already happening on real machines.
The vulnerability, tagged as CVE-2026-65400, lives inside macOS's screen sharing feature. Screen sharing lets a remote party see your display and control your keyboard and mouse, which is legitimately useful for IT support and remote work. The flaw is in how the system tracks its own state — basically, the logic that remembers what has already happened and who is supposed to be in control. When that logic breaks down, an unauthenticated attacker can walk right through the front door.
Apple patched it last week across macOS Tahoe, Sequoia, and Sonoma, rating the severity at 7.1 out of 10. That score sounds middling, but the real-world impact is anything but. Details went public at the Black Hat security conference around the same time the patch dropped, which is a rough combination — researchers demonstrating an exploit while a chunk of the user base has not yet updated.
The Netherlands' National Cyber Security Centrum sounded the alarm after receiving reports of active exploitation on systems where port 5900 was reachable from the open internet. Port 5900 is what macOS screen sharing uses. When you enable screen sharing, the system automatically opens that port. Attackers who scan the internet for exposed port 5900 connections — which is not hard to do — can then attempt to exploit the vulnerability.
In every confirmed case so far, attackers gained root access and installed a Monero cryptocurrency miner. Root access means complete control of the machine. The miner quietly uses the computer's processing power to generate crypto for the attacker, which is annoying and expensive in electricity costs but relatively benign compared to what else could be done with that level of access.
The word "relatively" is doing a lot of work in that sentence. Researchers and security teams are watching closely because the same exploit that drops a miner today could drop credential-stealing malware or ransomware tomorrow. The infrastructure is built; the payload is just a variable.
If you use screen sharing, the practical advice is straightforward but slightly inconvenient. Security professionals have long recommended against exposing port 5900 directly to the internet, suggesting VPN or SSH tunneling instead. Those options require a level of technical comfort most regular users do not have, which is a real gap in the advice.
The more accessible fix is to disable screen sharing when you are not actively using it. Go to System Settings, then General, then Sharing, and toggle screen sharing off. Turn it on when you need it, then turn it off again when you are done. And if you have not installed last week's macOS security update yet, that should be the very next thing you do.
POLICY
Man Hid Prompt Injections in Court Filings to Outsmart AI Judges
A Connecticut man apparently decided that if the court was going to use AI to read his filings, he was going to try to hack the AI. The court was not using AI. He tried anyway.
In what a judge described as likely the first confirmed case of its kind in the US, plaintiff Matthew Elliott embedded hidden text inside court documents in a healthcare records dispute. The text was shrunk to nearly invisible type and colored white against a white background, making it undetectable to a human reader. To any software parsing the document's underlying text, though, it was perfectly legible — and it contained explicit instructions for an AI system to rule in Elliott's favor.
The hidden commands told any AI reviewing the document to agree with Elliott's arguments, disregard earlier denials from the court, and steer toward the outcome Elliott wanted. It is a textbook prompt injection attack, the same class of technique used to manipulate AI chatbots by smuggling instructions inside content the AI is asked to process. Elliott just applied it to a courtroom setting.
Connecticut Judge Walter Spader Jr. confirmed in his ruling that the hidden text had zero effect on the case. The Connecticut Judicial Branch does not use AI to evaluate or decide filings, so Elliott's carefully constructed jailbreak landed in a system that was never going to read it. The court reviewed his filing on its actual merits, and Elliott still lost on the underlying arguments.
He faced sanctions regardless, and the reason it escalated is almost more interesting than the original offense. After the court flagged the hidden text and warned Elliott he could face penalties, he kept doing it. The follow-up hidden messages included a link to a Nosferatu clip on YouTube, a cheerful "hi :) I hope yo ucant see me," and what he called a nonsense phrase apparently shouted at someone named Shawn. Elliott told the court these were jokes.
Spader was not amused. He called Elliott's continued behavior after receiving explicit warnings "stunning," and noted that the fact the text was hidden at all serves as evidence of its malicious intent. If Elliott genuinely believed the court was improperly using AI to decide cases — which was his stated defense — he could have written that concern plainly in his filing where everyone could see it and respond to it.
The ruling matters beyond this one odd case. AI tools are increasingly showing up in court systems around the world, and the attack surface Elliott identified is real even if his execution was bungled. A more sophisticated actor, targeting a court that actually does use AI-assisted review, could potentially influence how a document gets summarized or flagged. Spader acknowledged that this will probably not be the last time courts encounter the tactic. The legal system now has a new category of litigation abuse to watch for, and it is one that most judges were almost certainly not trained to detect.
Source: Ars Technica
In what a judge described as likely the first confirmed case of its kind in the US, plaintiff Matthew Elliott embedded hidden text inside court documents in a healthcare records dispute. The text was shrunk to nearly invisible type and colored white against a white background, making it undetectable to a human reader. To any software parsing the document's underlying text, though, it was perfectly legible — and it contained explicit instructions for an AI system to rule in Elliott's favor.
The hidden commands told any AI reviewing the document to agree with Elliott's arguments, disregard earlier denials from the court, and steer toward the outcome Elliott wanted. It is a textbook prompt injection attack, the same class of technique used to manipulate AI chatbots by smuggling instructions inside content the AI is asked to process. Elliott just applied it to a courtroom setting.
Connecticut Judge Walter Spader Jr. confirmed in his ruling that the hidden text had zero effect on the case. The Connecticut Judicial Branch does not use AI to evaluate or decide filings, so Elliott's carefully constructed jailbreak landed in a system that was never going to read it. The court reviewed his filing on its actual merits, and Elliott still lost on the underlying arguments.
He faced sanctions regardless, and the reason it escalated is almost more interesting than the original offense. After the court flagged the hidden text and warned Elliott he could face penalties, he kept doing it. The follow-up hidden messages included a link to a Nosferatu clip on YouTube, a cheerful "hi :) I hope yo ucant see me," and what he called a nonsense phrase apparently shouted at someone named Shawn. Elliott told the court these were jokes.
Spader was not amused. He called Elliott's continued behavior after receiving explicit warnings "stunning," and noted that the fact the text was hidden at all serves as evidence of its malicious intent. If Elliott genuinely believed the court was improperly using AI to decide cases — which was his stated defense — he could have written that concern plainly in his filing where everyone could see it and respond to it.
The ruling matters beyond this one odd case. AI tools are increasingly showing up in court systems around the world, and the attack surface Elliott identified is real even if his execution was bungled. A more sophisticated actor, targeting a court that actually does use AI-assisted review, could potentially influence how a document gets summarized or flagged. Spader acknowledged that this will probably not be the last time courts encounter the tactic. The legal system now has a new category of litigation abuse to watch for, and it is one that most judges were almost certainly not trained to detect.
Enjoyed this?
Get stories like this delivered every Tuesday — free.