Claude Opus Surfaces Longstanding Zcash Flaw in a Week of Security News
Summary
A weekly security roundup reports that Claude Opus helped uncover a longstanding Zcash Orchard flaw, alongside updates on AI safeguards, security triage and monitoring tools, cloud-security research, and security-company funding.
Key points
- A researcher using Claude Opus 4.8 found a validation flaw in Zcash’s Orchard shielded pool, present since its 2022 launch, that could have enabled double-spending.
- Because Orchard is a privacy pool, the team says it cannot determine cryptographically whether the flaw was exploited; it recommends users not assume it was unused and is pursuing turnstile accounting.
- Anthropic released Claude Fable 5 with classifiers intended to redirect cybersecurity and other sensitive requests to Opus 4.8; the article says a state-level team had already found a seam in the safeguards.
- Salesforce says its security-alert triage agent achieved about 95% agreement with human analysts across its workforce, with low-confidence cases sent to people.
- fwd:cloudsec published 38 conference talks, including a demonstration of command-and-control activity through an AWS data perimeter via Bedrock-AgentCore and related CloudTrail detection signals.
- Datadog announced AI security capabilities, including tools for prompt-injection and agent-poisoning defense and centralized monitoring of AI agents and coding assistants.
Article Details
- Event Type
- Weekly security industry news covering a critical Zcash vulnerability, AI security product launches, and cybersecurity funding announcements.
- Impact
- A flaw in Zcash’s Orchard shielded pool could have enabled double-spending, but the article says exploitation cannot be determined and the team assessed it as unlikely. Zcash’s market capitalization reportedly fell by more than $3 billion, and the team is pursuing a network upgrade to check for counterfeit supply. Other items describe new security capabilities and funding; no additional incident impact is reported.
People
Arthur HayesThe article reports that he sold his entire Zcash position as its price fell.Dan GanselDemonstrated C2 through an AWS data perimeter via Bedrock-AgentCore at fwd:cloudsec North America 2026.Taylor HornbyHired by the Zcash team to find vulnerabilities; used Claude Opus 4.8 to surface the Orchard flaw.
Vendors
1PasswordSnowflake and 1Password tackle the growing challenge of securing AI agents at scaleA SecuritySalesforce is about as well-instrumented as a security org gets. $140B+ market cap, compute to burn, and an in-house agent platform in Agentforce their security teams already lean on hard, one of those agents hasAnthropic🪶 Anthropic ships Claude Fable 5 — First public Mythos-class model, gated by a classifier layer a state-level team already cracked.Aryon SecurityAryon Security Raises $25M Series ABlinkOpsNew from BlinkOps: interactive agents. Over a year ago we shipped the first natural language agent builder in security, where you set an agent's role, guardrails on how it reasons, limits on what it can do, plus itsCrowdStrikeAryon raised a $25M Series A led by Brightmind Partners and Shlomo Kramer’s Skinos Ventures, with Datadog Ventures and CrowdStrike CEO George Kurtz participating; total funding hits $38M since late 2024.Cyera📈 Cyera $600M round at $12B valuation — Led by Evolution Equity; valuation doubled since January.DatadogCybersecurity Pulse (TCP)! I’m Darwin Salazar, Head of Growth at Monad and former detection engineer at Datadog. Each week, I bring you the latest security innovation and industry news. Subscribe to receive weeklyEmphereEmphere Raises $2.1 Million for AI-Powered Vulnerability RemediationNinjaOne🥷 NinjaOne lands $400M+ secondary — Profitable, $500M ARR, and shopping for partners, not runway.Opal SecurityOpal Security Raises $23 Million for AI-Native Identity GovernanceSalesforce🔮 Salesforce’s triage agent hits 95% — SATA matches analysts on triage across 80,000 employees, if you have Salesforce’s budget.SnowflakeSnowflake and 1Password tackle the growing challenge of securing AI agents at scaleUpwindfeatures actually fall short. This year’s theme leaned hard into agentic and neocloud risk. As a taste, Upwind’s Dan Gansel demoed C2 through an AWS data perimeter via Bedrock-AgentCore, abusing trusted AI servicesZscalerZscaler launches AI Broker and Endpoint AI Security for agents
Products
Agent Console📊 Datadog drops 100+ features at DASH — AI Guard targets prompt injection; Agent Console monitors Claude Code, Cursor, Copilot.Agent EvalsBits Detection and Agent Evals: always-on infrastructure scanning plus debugging and fix generation for AI agentsAgentforceas a security org gets. $140B+ market cap, compute to burn, and an in-house agent platform in Agentforce their security teams already lean on hard, one of those agents has reportedly chewed through 44,000+AI Guard📊 Datadog drops 100+ features at DASH — AI Guard targets prompt injection; Agent Console monitors Claude Code, Cursor, Copilot.Azure Resource GraphFun fact: I presented at fwd:cloud in 2022 on leveraging Azure Resource Graph for good and for evil 😈.. Easily in my top 3 of conferences.Bedrock-AgentCoreand neocloud risk. As a taste, Upwind’s Dan Gansel demoed C2 through an AWS data perimeter via Bedrock-AgentCore, abusing trusted AI services to slip past perimeter controls, plus the CloudTrail signals to catchBits AIat DASH, its annual conference and the company’s biggest product moment of the year. The headline is Bits AI expanding from root cause analysis into autonomous detection, investigation, and remediation underBits DetectionBits Detection and Agent Evals: always-on infrastructure scanning plus debugging and fix generation for AI agentsClaude Fable 5🪶 Anthropic ships Claude Fable 5 — First public Mythos-class model, gated by a classifier layer a state-level team already cracked.Claude Opus 4.8Claude Opus 4.8 Found a Zcash Bug That Wiped $3B in Market CapCloudTrailperimeter via Bedrock-AgentCore, abusing trusted AI services to slip past perimeter controls, plus the CloudTrail signals to catch it. Block out a weekend. This is the highest signal-to-noise content in the spaceOrchard🤷🏽♂️ Claude Opus found a bug causing $3B wipeout in Zcash — A public model surfaced a 4-year-old Orchard flaw in 24 hours; ZEC cap got cut in half.SATA (Security Alerts Triage Agent)Salesforce dropped an autonomous triage agent, SATA (Security Alerts Triage Agent), into production across 80,000 employees and is claiming ~95% agreement with human analysts.Zcash🤷🏽♂️ Claude Opus found a bug causing $3B wipeout in Zcash — A public model surfaced a 4-year-old Orchard flaw in 24 hours; ZEC cap got cut in half.