Top Kalshi trader Caleb Davies usually speaks to the press about how prediction markets help him rake in money. The Minneapolis-based IT worker estimates he’s made $1.2 million overall across different prediction platforms, with $414,000 in winnings from Kalshi’s culture markets alone. He especially enjoys wagering on music charts, because he carefully analyzes Spotify data to pick winners. “Every single morning, I’m going in, downloading the data, and updating my projections,” he tells WIRED.

This summer, though, he’s become increasingly agitated about what he claims is an obvious, bot-fueled effort to manipulate Spotify-related markets. He recently began compiling and publishing evidence for his theory, eventually becoming so convinced that he contacted Spotify, Kalshi, and Polymarket with his concerns.

This week, the situation hit a boiling point when the song “Earrings” by Malcolm Todd surged to number one on a Spotify chart. In a series of X posts, Davies outlined his suspected culprit: “botting,” or scammers who purchase bots to juice streaming numbers. Davies argued that prediction market traders were botting the charts to influence the outcome of related events contracts. Todd’s song was such an underdog that it wasn’t even listed as an option on Polymarket: “Looking at the dataset of Sunday to Monday changes, it was a 11.24 sigma event, or a roughly 1 in 77 octillion chance of happening randomly,” Davies wrote.

It turns out that he was on to something. Spotify confirmed to WIRED that it investigated suspected manipulation incidents Davies flagged and found evidence of artificial streaming. “All streaming services face ever-changing stream manipulation. Spotify has best-in-class detection and mitigation practices for manipulated streams, and we don’t pay out associated royalties,” spokesperson Laura Batey says. (The company didn’t offer any explanation for the manipulation, however, so Davies’ theory that it was directly tied to a scheme to manipulate prediction markets remains just that.)

Spotify ultimately adjusted its charts to account for the discrepancy, culling over 500,000 artificial streams, which bumped Todd’s song from first to fourth. The process was not immediate, though, and Kalshi had already resolved the market to award traders who selected Todd’s song.

“We’re in touch with Spotify and are actively investigating this matter,” Kalshi spokesperson Elisabeth Diana tells WIRED. Those conversations did prompt a more immediate change: At the Swedish streaming giant’s request, Kalshi removed Spotify’s logo from its markets that relate to the company, and adjusted language that initially suggested Spotify had verified chart results.

When Davies first reached out to Kalshi with concerns, the company’s head of enforcement Robert DeNault told the trader that only Spotify would be able to definitively confirm whether it had been botted, and noted that there could be non-suspicious reasons for the uptick. DeNault also floated a theory that Kalshi traders could be merely copying what peers were doing on Polymarket.

“Nobody from Polymarket profited from the fraud. That’s what undermines Kalshi’s argument, because they didn’t have a Malcom Todd bracket,” Davies tells WIRED.

Polymarket refutes this theory as well. “It’s actually not plausible since we didn’t even have Malcolm Todd as an option on this Spotify market,” said spokesperson Annabel Walsh. The company confirmed it’s reviewing the broader streaming manipulation situation, but hasn’t identified any immediate manipulation thus far.

No one has spoken with the people or group of people behind the streaming manipulation, so their motivations remain unclear. (Todd did not respond to requests for comment, but there’s nothing to suggest he’s anything more than an innocent bystander.)

Security

Don’t count on the LLM to return your data – even if you pay up

They’re not bad; they’re just prompted that way. Sysdig threat hunters documented what they say is the first-ever documented agentic ransomware infection with an LLM – not a human – driving the entire extortion operation, from gaining initial access to compromising a production database server and destroying data.

The security shop’s research team named the agentic intruder JadePuffer and said it gained initial access to an internet-facing Langflow instance by exploiting CVE-2025-3248, and then ran a fully automated attack.

“The most striking characteristic, however, was the LLM’s behavior,” Sysdig director of threat research Michael Clark said in a blog about the agentic ransomware and extortion operation. 

JadePuffer’s “self-narrating” payloads “contained natural language reasoning, target prioritization, and the kind of detailed annotations that human operators don’t often write but LLM-generated code produces reflexively,” Clark added. “The operation also adapted in real time, retrying failed steps within refined parameters. In one sequence, it went from a failed login to a working fix in 31 seconds.”

After exploiting CVE-2025-3248, a missing authentication vulnerability in Langflow that allows remote, unauthenticated attackers to execute arbitrary Python on the host, the AI agent began scanning for and collecting secrets, including LLM provider API keys, cloud credentials “with explicit coverage of Chinese providers” including Alibaba, Aliyun, Tencent, and Huawei, while also scanning for AWS, Azure and Google Cloud Platform, cryptocurrency wallets, and database credentials. 

The AI also installed a crontab entry on the Langflow server to maintain persistence and call back to the attacker’s infrastructure every 30 minutes.

JadePuffer’s intended target was a separate internet-exposed production server running a MySQL database and an Alibaba Nacos configuration service, we’re told. Nacos is an open-source service-discovery and dynamic configuration platform developed by Alibaba and used in the cloud provider’s microservices applications.

The agent connected to the server’s exposed MySQL port using root credentials, although Sysdig doesn’t know how the attacker obtained them. These credentials weren’t stolen from the victim’s environment.

JadePuffer then attacked Nacos via multiple vectors including an authorization bypass flaw (CVE-2021-29441) and forging a valid JSON web token (JWT) using Nacos’s default signing key. Additionally, using its root database access, the LLM injected a backdoor administrator into the Nacos backing database.

It ultimately encrypted all 1,342 Nacos service configuration items using MySQL’s built-in AES encryption function, and created an extortion demand, ransom note, Bitcoin payment address, and a Proton Mail contact:

“YOUR DATA HAS BEEN ENCRYPTED. All NACOS configurations, REDACTED customer data, and REDACTED PII have been encrypted with AES-256.”, “3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy”, “e78393397[@]proton[.]me”

However, according to the threat hunters, the victim can’t recover the encrypted data, even if they paid the ransom demand, because the agent escalated “from row-level deletion to dropping entire database schemas, narrating its own targeting rationale,” without backing up any of the encrypted data.  

There are a couple of things that security teams and vulnerability managers should do immediately to avoid being ransomed by this AI agent. First up: patch Langflow to a release that fixes CVE-2025-3248, and do not expose code-execution/validation endpoints to the internet.

Also, don’t ever expose Nacos to the open internet, change its default token.secret.key, and upgrade to a release that forces a custom key.

The threat hunters also recommend against running any AI orchestration servers with provider API keys or cloud credentials in their environment.

While the AI agent didn’t use any especially sophisticated or unique techniques in this attack, the fact that an LLM “strung them together into a complete ransomware operation against neglected internet-facing infrastructure,” is notable, according to Clark. “The skill floor for running ransomware has dropped to whatever it costs to run an agent, and if that agent is running on stolen credentials through LLMjacking, the cost to an attacker is close to zero.”®

from the maybe-don’t-compound-your-evilness-with-stupidity dept

Some readers might look at this headline and think there’s something off about it. And I’ll grant you that. There are several ways music can be played: to, for, not at all. Sometimes though, the only way to describe the playing of music is “at.”

One of Trump’s many vindictive “surges” targeting cities and states run by Democratic party members occurred in Washington DC. Not content to flood the streets with tons of federal officers, the administration decided these forces needed backup from the National Guard. Of course, Trump claimed the crime problem in DC was so bad it could only be dealt with by a surge that blended choice bits from “police state” and “martial law” into an unpalatable whole.

DC residents were less than thrilled. One resident — Sam O’Hara — made his displeasure known by doing the thing in the headline: playing music at National Guard troops.

Here’s how that mild act of protest was described in his lawsuit against the city by his ACLU legal reps:

 Given the roughly 200-year-old tradition of civilian law enforcement in the United States, Mr. O’Hara was deeply concerned about the normalization of troops patrolling D.C. neighborhoods. And so, he began protesting the Guard members’ presence by walking several feet behind them when he saw them in the community. Using his phone and sometimes a small speaker, he played The Imperial March as he walked, keeping the music at a volume that was audible but not blaring. Mr. O’Hara recorded the encounters and posted the videos on his TikTok account, where millions of people have viewed them.

And here’s how it looked, from O’Hara’s POV:

I really hate to begin a sentence with “if you’re not familiar with The Imperial March.” And so I haven’t, via the clever use of punctuation. Just in case the presiding judge was unfamiliar, the lawsuit included a brief explainer:

In the Star Wars franchise, The Imperial March is the music that plays when Darth Vader or other dark forces enter a scene or succeed in their dastardly plans.

One of the National Guard troops objected to being Bluetoothed in public. Sgt. Devon Beck threatened to call the cops if O’Hara didn’t stop. Then he did exactly that. The DC Metro PD immediately fell down on the job, arresting O’Hara for crimes he couldn’t have possibly committed. He was not “harassing” the troops, as one of the officers claimed. Nor was he impeding their movement. Nor was he preventing people from entering a nearby store, as Officer Campbell alleged. He was standing to the side of it.

Officer Campbell wasn’t done being stupid quite yet.

In response to Mr. O’Hara’s statements that he was engaged in protest, Officer Campbell said, “That’s not a protest. You better define protest. This isn’t a protest. You are not protesting.”

You are wrong, Officer Campbell. Demonstrably wrong, which is a play on words or something… So enjoy that, readers. I’m taking English and grammar for a rough ride in this post, to borrow a bit of law enforcement vernacular. My apologies in arrears.

Anyway, O’Hara gets the last laugh, some money, and the unfortunate confirmation of the implication he made musically. And, while his original salvo targeted National Guard interlopers, it was the Metro PD officers who accosted/arrested him that truly proved the point.

The District of Columbia has reached a settlement agreement for an undisclosed amount of money with a resident who claims police illegally detained him for following an Ohio National Guard patrol while playing Darth Vader’s theme song from “Star Wars” on his phone — an act of protest against the Trump administration’s federal law-enforcement surge in the nation’s capital.

No one is saying how much the settlement is, but it seems like it’s big enough to mean something.

In an email on Friday, an ACLU spokesperson referred to the settlement’s financial terms as “a significant amount” that O’Hara “is pleased with” but said they aren’t disclosing the dollar figure to protect his privacy.

It also may not be O’Hara’s settlement check from the government. There’s still the matter of the National Guard troop who decided to call the police because he personally didn’t care for O’Hara’s playlist. Beck is still defending himself against the lawsuit, but I have no idea what kind of defense this is:

Attorneys for the Guard member, Sgt. Devon Beck, has asked a judge to dismiss O’Hara’s claims against him.

“He was there because that was his assigned duty,” Beck’s lawyers wrote. “This was not an accidental encounter or a one-time disagreement on a public sidewalk.”

So… Beck isn’t responsible for his direct (or contributory) rights violations because he didn’t ask to be deployed to Washington DC? It probably doesn’t matter. Members of the military are rarely sued by US citizens for rights violations because, well, until very recently they were never asked to patrol US neighborhoods or provide support for law enforcement. There are likely layers of immunity that haven’t even been probed yet, but even if the courts decide the troops were acting as federal officers, it’s almost impossible to successfully sue federal officers. If the government agrees to a settlement, it will because it’s afraid its lawyers might fuck things up so badly adverse precedent might be set.

But for now, some justice has been done. O’Hara gets his money. The Metro PD gets a lesson in why it’s rarely a good idea to provide backup to federal forces and, more hopefully, learns something about how to handle people engaged in protected speech.

Filed Under: 1st amendment, dc metro police, evil empire, free speech, mass deportation, michael perloff, mpd, national guard, trump administration, washington dc