BERLIN — As she was climbing the ranks of far-right Alternative for Germany (AfD) a decade ago, Alice Weidel privately denounced one of her party’s most influential figures for using racist arguments and Nazi-era language, and sought to have him expelled.

Years later, she praised his leadership, said a bid to ban him from the party was “exaggerated” and that he was suitable for a federal cabinet position.

That striking reversal emerges from a massive leak of internal AfD communications, including emails in which Weidel condemned Björn Höcke, the party’s leader in the eastern state of Thuringia, and warned that extremists were driving away mainstream conservative voters.

The revelations come from more than 420,000 emails and roughly 48,000 documents released by hackers this week, providing a rare glimpse inside Germany’s largest far-right party. An anonymous spokesperson for the hackers told Die Zeit the attack was not “politically” motivated “in the sense that [they] support another party,” but that they published the allegedly stolen material to promote “transparency and public accountability.”

The AfD confirmed the breach, saying hackers had attacked a hosting provider in late September. It condemned the leak as “an attack on the German party system and therefore on democracy itself.”

WELT, which, like POLITICO, is part of the Axel Springer Global Reporters Network, examined emails from one of Weidel’s accounts between 2015 and 2017, when she was a relatively junior figure in the party’s leadership.

Asked by WELT to explain the contrast between her warnings at the time and her present position, Weidel declined to comment through a spokesperson.

A spokesperson for Höcke did not respond to a request for comment sent by POLITICO on Saturday.

‘Deeply problematic’

The messages seen by WELT show a politician deeply alarmed by the growing influence of Höcke, who championed an ethnically defined German nationalism drawing on ideas associated with the Nazi era.

In October 2015, Weidel warned colleagues that the party’s proximity to Pegida, an anti-Islam street movement, and the neo-Nazi National Democratic Party (now known as The Homeland) was alienating the conservative voters it needed to attract.

“In the west we are losing the mainstream conservative electorate completely through our proximity to Pegida, and to the NPD in the east,” she wrote.

Weidel also strongly pushed back on a speech from Höcke that same year, where he contrasted a “life-affirming African expansionary type” with a “self-negating European placeholder type,”

“This is deeply problematic, because the reasoning here is racial. It is fundamentally wrong,” she wrote to the AfD’s federal executive board. “And please, spare me the usual ‘that’s-not-how-it-was-meant.’ I can’t hear it any more.”

In another message, she warned that extremists were deliberately blurring the boundary between the AfD and neo-Nazi politics, driving mainstream conservatives away “in horror.”

She also feared that Höcke’s rhetoric could bring the party under scrutiny by Germany’s Federal Office for the Protection of the Constitution, its domestic intelligence service monitoring threats to the constitutional order.

“Höcke’s statements alone, and the use of the term Volksgemeinschaft” — the Nazi-era concept of an ethnic national community — “are enough to land the AfD in that report,” she wrote, referring to the intelligence service’s annual assessment. “Some in our party seem in a hurry to drive the AfD, deliberately or not, into oblivion.”

In May 2025, the agency classified the AfD as a “confirmed right-wing extremist organisation”, citing, among other things, an exclusionary concept of the German nation. The classification, which grants authorities broader surveillance powers, was provisionally suspended by a court in Cologne last February.

‘Wake up, for once’

The leak also features emails about a speech Höcke gave in January 2017 to the AfD’s youth wing, attacking Germany’s culture of Holocaust remembrance.

Höcke described Berlin’s Holocaust memorial as a “memorial of shame,” criticized the country’s efforts to confront its Nazi past and demanded a “180-degree turn in the politics of memory.”

Weidel herself brought a motion to expel him from the AfD.

The motion, obtained by WELT, accused Höcke of using “vocabulary from Adolf Hitler” and endorsing the “Führerprinzip” — the Nazi doctrine of absolute leadership authority. It described him as displaying an “affinity in essence with National Socialism.”

In an internal message, Weidel urged colleagues to recognize the implications of Höcke’s language. “Wake up, for once,” she wrote, warning of the “explosive force of the double meanings” in his speech.

As Weidel prepared to seek the party’s nomination as lead candidate for the 2017 federal election, the leaked correspondence shows that she blocked the recording of her own motion against Höcke in the minutes of a party leadership meeting, arguing that further controversy would damage the party.

Höcke subsequently acknowledged that his speech had been a mistake and asked the leadership to withdraw the move against him.

Weidel publicly welcomed his letter as a “positive signal” and called for an end to the infighting.

Within weeks, she had secured her nomination as the AfD’s lead candidate. Asked whether she would campaign alongside Höcke, she replied: “Yes, of course. We are two parts of one party.”

Indeed, the emails suggest that Weidel’s private misgivings had not entirely disappeared. In May 2017, she condemned an AfD election poster featuring a pregnant woman and the slogan “‘New Germans?’ We’ll make our own” as “an NPD poster,” in a reference to the neo-Nazi party.

Today, Weidel no longer publicly criticizes Höcke. She has praised his leadership in Thuringia and even suggested him for a federal cabinet position.

“We get along very well and we got to know each other over the years,” she told BILD in a 2025 interview. When she was asked whether Höcke was suitable for a federal cabinet position, she simply replied: “Yes.”

When asked in February 2025 about the 2017 expulsion proceedings against him that were backed by Weidel, Höcke called it “old news.”

“We got to know each other and came to appreciate each other. Alice Weidel was the right lead candidate and did a top job,” Höcke told WELT at the time.

The Axel Springer Global Reporters Network harnesses the resources of the company’s newsrooms to publish ambitious scoops, investigations, interviews, opinion pieces and analysis. It allows journalists — including those from POLITICO, The Telegraph, Business Insider, WELT, BILD, Onet and Fakt — to collaborate on major stories for an international audience of hundreds of millions across platforms: online, print, TV and audio.

The exposure was immense, with AI multiplying the risks — and yet time-tested global cybersecurity procedures appeared to be functioning. Then suddenly, it all broke down.        

The decision by a cybersecurity company on Wednesday to prematurely release information about a flaw in the popular PHP computer programming language left much of the web exposed to hackers, triggering a panic that brought to life months of warnings of how the AI-powered era could cause widespread damage.

The flaws in PHP, discovered using AI tools through a months-long process coordinated by OpenAI, caused cyber agencies across Europe, the U.S., the U.K., Australia and Canada to post urgent warnings Wednesday. Numerous governments took websites offline as a precaution.

While no major hacking damage was immediately apparent, the way the incident unfolded over 72 hours showed how easily cybersecurity processes can break down and the outsized consequences of cyber risks in the AI era.

The man who set off the chain reaction with the early release — Chainguard’s CEO Dan Lorenc — quickly apologized in a LinkedIn post. But on Thursday, in an interview with POLITICO, Lorenc said he’d shared the information ahead of time because the flaw was already being exploited. Though others disputed that, Lorenc said he believed he’d seen enough evidence to invalidate an embargo set up to allow time to find a fix for the flaws. 

While he disputed that his actions would have caused problems for other defenders, Lorenc conceded that the evidential threshold in these coordinated cyber defense systems is a “grey area.” 

The revelation of the PHP flaw brings out into the open what cyber officials have been bracing for since the arrival of the most powerful tools of artificial intelligence, which not only can be used to discover vulnerabilities but also to exploit them at scale. 

The cybersecurity world’s long-established protocols helped prevent disaster scenarios, in which hackers would have successfully exploited the vulnerabilities to take control of numerous websites and access their data. But now the scale and end-of-days potential of AI-driven cyber risks are visible for the world to see. 

This “is what happens when AI turns up a flaw that’s been hiding for years,” said Eylam Milner, co-founder and chief technology officer at cybersecurity start-up Echo. The vulnerabilities, he added, are “about as serious as it gets for the web.”

Origin story

Understanding how this week’s emergency unfolded offers a glimpse at how companies and authorities are working to stave off attacks — and how much risk they face going forward. 

The origins of the incident can be traced back as far as April when top frontier AI firm Anthropic unveiled Mythos, leading some in the cybersecurity world to worry that systems would quickly be overrun by advanced artificial intelligence, with potential for catastrophic events to ensue.

But while researchers did find more flaws in computer systems in the months after Anthropic and other AI firms like OpenAI released those models, they had little impact in the real world. Even the Hugging Face incident, a widely discussed hack that saw OpenAI’s autonomous AI agents go rogue during an internal security evaluation, related more to the level of control AI companies exert over their models than their power to break into systems worldwide. 

That changed this week after researchers unveiled the vulnerability in PHP, a coding language estimated to be integrated into some 70% of the web.

The process by which information about flaws is released among cybersecurity officials and affiliated companies is crucial. Through a longstanding practice known as coordinated disclosure, researchers and companies that identify flaws can find a fix and share it confidentially with agencies and others before releasing to the public, meaning they don’t hand malicious hackers the gift of a hole without a fix.

In the case of the PHP flaw, that process worked well, but not perfectly. Information about the bugs started to circulate ahead of the planned release time. Then, according to the PHP Foundation, Chainguard “unilaterally broke the embargo,” which “disregarded weeks of work by many parties toward a coordinated disclosure.” PHP Foundation executive director Elizabeth Barron told POLITICO by email that while it was “disappointed” with Chainguard, it hopes to “rebuild trust with them in the future to ensure we can continue to collaborate effectively.”

After the leak— which meant information about the bugs was in the open before the fix was ready — confusion quickly ensued, with government bodies and private companies choosing to temporarily shut down their websites rather than risk potentially damaging breaches to their data and the sites themselves.

Early Thursday, Matthew Prince, the CEO of Cloudflare, an internet services company that is widely used by websites to block cyberattacks, giving it a high level of visibility over what hackers are doing, said in a post on X that it had seen “millions” of attempts to exploit the flaw.

Cloudflare saw thousands in the 10 hours before the flaw was publicly announced, then tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and now millions, Prince said.

Amazon’s cloud division also said the flaw is “now being broadly exploited in the wild.”

One senior U.S. government cyber official said that federal authorities have been overwhelmed — and not just by PHP. The same day the world was racing to address PHP, they were also dealing with bugs in node.js, a widely used JavaScript framework, Fortinet, GitHub and Oracle.

“The fire department is fighting multiple fires at once,” the official said, adding: “The good news is they’re all one-story structures on fire, which the fire department deals with all day, every day.”

More to come

Dauntingly, OpenAI said there’s more on the way. “These bugs are among several significant vulnerabilities we’ve already found and are working to fix, and we expect similar findings to increase sharply in the coming months,” the company said Wednesday in a statement.

Matthijs van Amelsfort, head of the Dutch cybersecurity agency, said in an interview that the job of keeping computer systems safe has been transformed by the advancement of AI. “As soon as the frontier models came out, that’s exactly what we said, this will be the trend,” he said. “And actually that’s happening now.”

Thomas Caspers, vice president of Germany’s cyber agency BSI, concurred: “We expect that [to be] happening more and more during the coming months.” 

AI also ramps up the risks once the flaws are out in the open. Cyber agencies’ recommendation that organizations take their websites offline was “really a drastic measure,” Caspers said. “We wouldn’t have done that a few years ago or so.” But because AI has made it quicker and easier to exploit flaws, “we had to do that,” he said. 

At the same time, the use of advanced AI to detect the flaws may create a new level of protection against malicious hackers looking to take advantage of them. Caspers said that though his German agency has also seen attacks, it has not seen any successful use of the flaw by hackers.

“It seems a little bit more complicated than expected to exploit,” he said. 

Despite the fact that AI offers a new way to discover flaws, the work involved in keeping systems protected is more quotidian, with cyber agencies urging organizations to install the fix shared by the PHP Foundation, in a process known as patching.

“There are three things that you have to do right now,” said van Amelsfort from the Dutch agency. “And that’s patch, patch, and patch.” 

John Sakellariadis contributed to this report.

The vibe-coding platform said all of its customers should revoke and rotate their private keys, after hackers were able to decrypt some customer secrets.

Cyberattackers have made “millions” of attempts to take advantage of a critical hole in a building block of the internet, a key cybersecurity provider said early Thursday.

Two top European cyber officials later told POLITICO that hackers have so far struggled to exploit the vulnerability.

Cybersecurity agencies worldwide continue to scramble to respond to the public revelation Wednesday of a flaw in PHP, a foundational computer programming language used to underpin 70% of the internet. 

Matthew Prince, the CEO of Cloudflare, an internet services company that is widely used by websites to block cyberattacks — giving it a high level of visibility over what hackers are doing — said in a post on X that it’s seen “millions” of “attempts to exploit” the flaw.

Cloudfare saw thousands in the 10 hours before the flaw was publicly announced, meaning information must have leaked, then tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and now millions, Prince said.

Amazon’s cloud division also said the flaw is “now being broadly exploited in the wild.”

But Thomas Caspers, vice president of Germany’s cyber agency BSI, said in an interview that though his agency has also seen attacks, it has not seen any successful use of the flaw by hackers. 

“It seems a little bit more complicated than expected to exploit,” he said. “When we had the planning process before the release of the patch, we were expecting a much faster track of the attackers.” 

Caspers is not certain why this is the case at this stage, but said it appears that successfully making use of the flaws is harder than expected. Global cyber officials were part of a process coordinated by OpenAI, to find and fix the flaws. “An ad hoc exploitation seems a little more difficult than expected,” he said.

The challenge for bad actors may also be linked to the major AI providers building guardrails so their tools can’t be used to exploit flaws, he said. When a POLITICO reporter as a test asked ChatGPT and Claude, models from OpenAI and Anthropic respectively, how to exploit the PHP vulnerabilities, both chatbots declined to provide the information. The two companies did not immediately respond to requests for comment. 

Numerous European government departments took their websites offline as a precaution to Wednesday’s developments. As of Thursday morning, key French websites such as the justice ministry and the data protection authority still featured a message they were undergoing maintenance. 

Matthijs van Amelsfort, the head of the Dutch cybersecurity agency, told POLITICO that his agency has no indication that the flaw is “actively being misused” but said that can change, particularly because AI makes it easier to exploit flaws. The agency took its website offline on Wednesday, but it is now back up.

This article has been updated.

Ein Datenleck trifft die AfD: Hunderttausende interne E-Mails und sensible Dokumente sind plötzlich öffentlich abrufbar. Während die Partei den Vorfall herunterspielt, hoffen andere auf Enthüllungen, die der Alternative massiv schaden könnten. Pauline von Pezold, Co-Host von „Inside AfD“, ordnet ein, wie gefährlich dieser Akt des „Hacktivismus“ für die Partei wirklich werden kann.

Brennende Barrikaden in Frankreich wecken im Bundesinnenministerium die Sorge vor einem Überschwappen der Gewalt nach Deutschland. Rasmus Buchsteiner hat den Überblick, wie sich die Sicherheitsbehörden auf die bundesweiten Gen-Z-Proteste Ende des Monats vorbereiten und wo die Unterschiede zur französischen Protestkultur liegen.

Im 200-Sekunden-Interview erklärt Juso-Chef Philipp Türmer, warum er die Anliegen der Schülerproteste unterstützt, aber vor einer Unterwanderung durch radikale Kräfte warnt.

Das Berlin Playbook als Podcast gibt es jeden Morgen ab 5 Uhr. Rixa Fürsen, Maximilian Stascheit und das POLITICO-Team liefern Politik zum Hören – kompakt, international, hintergründig.

Für alle Hauptstadt-Profis: Der Berlin Playbook-Newsletter bietet jeden Morgen die wichtigsten Themen und Einordnungen. Jetzt kostenlos abonnieren.

POLITICO Deutschland – ein Angebot der Axel Springer Deutschland GmbH
Axel-Springer-Straße 65, 10888 Berlin
Tel: +49 (30) 2591 0
information@axelspringer.de
Sitz: Amtsgericht Berlin-Charlottenburg, HRB 196159 B
USt-IdNr: DE 214 852 390
Geschäftsführer: Christoph Eck-Schmidt, Carolin Hulshoff Pol, Mathias Sanchez Luna

OpenCode is an open source AI coding agent that's become a popular alternative to Claude Code and Cursor. But hackers got into part of its online platform and stole some users’ API keys, and the AI tools it turned to for help kept refusing to look at the malicious code.

Donald Trump’s latest moves on Russia and Ukraine have alarmed Kyiv and European capitals alike. But rather than scrambling to contain the fallout, EU leaders are keeping their cool. Zoya Sheftalovich and Nick Vinocur explore Europe’s strategy for weathering Trump’s midterm storm — and what it means for Ukraine.

Then, France reels from a weekend of violent protests, with more than 1,800 arrests and widespread destruction. As political leaders trade accusations, we look at how the unrest is shaping the battle ahead of the 2027 presidential election from Paris.

Plus, hackers turn supermarket fridges into heaters, exposing some surprisingly basic cybersecurity vulnerabilities.

If you have a question or comment, don’t hesitate! Message us on our WhatsApp here or at +32 491 05 06 29.

The cyberattack last week that hit hundreds of French supermarket refrigerators had Europeans wondering if the nonstop warnings about AI risks had finally landed in the real world.

They hadn’t — at least, not yet.

Experts say the attack, which forced hundreds of retailers to throw away defrosted food and spoiled milk, was mostly a reminder of the importance of old-school cybersecurity in safeguarding essential goods and services.

The attack is a “typical example” of how “low-key cyber-enabled sabotage can affect very crucial supply for society,” said Ferdinand Gehringer, hybrid threats lead at FTI Consulting. 

It’s arguably the most consequential hack in the European Union this year, with tangible, disruptive real-world repercussions. France’s Prime Minister Sébastien Lecornu personally managed the fallout, which prompted coordination and information-sharing at the EU level. 

The perpetrators, whose identity and motives are currently unknown, hacked into digital systems to remotely raise the temperature of refrigerators in supermarkets including Intermarché and Carrefour.

One cybersecurity expert working with Lecornu’s office said the French government held meetings after the attack to try to map all the potentially affected sectors, beyond supermarkets. “We’re in the middle of the flu vaccination campaign,” he said, referring to vaccine storage, which also relies on temperature control solutions, though no such attacks have been registered.

To add to the fear and confusion, supermarkets in the Netherlands and Belgium experienced unrelated cyber incidents that same week. Though there was limited impact in those cases, they were a good example of “how big our reliance is in the food supply chain on IT and network systems,” Dutch food security minister Silvio Erkens told POLITICO. 

The attacks come after citizens and policymakers have spent months being bombarded with warnings about scenarios in which unpredictable advanced artificial intelligence models escape human control.

While most good and bad actors on the internet are increasingly using AI models to increase speed and capacity, cyber experts say the hackers in question in the French case most likely used traditional methods to take advantage of devices needlessly exposed to the internet.

Connecting devices to the internet in this way is “an old-fashioned bad practice,” said Amir Preminger, chief technology officer at Claroty, a cybersecurity company that identified a software flaw in a product made by Danfoss, one of the refrigeration companies targeted by the French hacks. Danfoss fixed that flaw in 2025. 

Food systems

The attacks come at a time when Europe’s food security is already under considerable pressure due to geopolitical insecurity and climate change. The continuing disruptions in the Strait of Hormuz are pushing up fuel and fertilizer prices at a time where farmers struggle with the fallout of extreme drought that caused lower yields in many parts of Europe. These problems are compounded by the blockade of the Black Sea which is fueling the rise of global food prices.

“It is very serious that cyber criminals attack our food systems,” said Else Groen, director general of trade body Independent Retail Europe. She nonetheless stressed that food supply chains are resilient, which reduces the chances that consumer food supply would be endangered — even if such attacks are already a “major blow” for retailers operating on razor-thin margins.

The incidents bring to the fore a long-running problem with so-called operational technology, meaning industrial devices with physical outputs, like refrigeration systems. Critical sectors are packed with these kinds of devices, many of which are old, poorly protected, unnecessarily connected to the Internet, or some combination of the three. They’re also obscure and sometimes forgotten, despite the ramifications if they’re tampered with.  

And last week’s problems are far from solved. French and German cyber authorities warned that attacks were probably still ongoing, and the Greek cyber agency and an industry tracker said after the attack that there were hundreds of devices still connected to the internet.

Preminger too said there are still devices exposed, though he added that the number is declining, and not all are necessarily vulnerable to attack. Another research group found that the number of exposed Danfoss devices had significantly decreased.

Finding a fix

What’s changed with the widespread diffusion of advanced AI models is that cyber attacks are now faster and easier to replicate. Claroty reproduced the original flaws in Danfoss products in 28 minutes at a cost of $6, it said. 

In broad terms, AI makes it easier to carry out many types of cyberattacks and enables attackers to pounce on software flaws more quickly. Financially motivated cybercriminals — who have already spent years extorting businesses and disrupting essential services like hospitals — can use AI to simultaneously launch attacks on multiple targets.

Though the motive for the attacks on French supermarkets remains unknown, it is notable that there was no reported attempt at extortion. The strike did come as Russia ramps up its campaign of hybrid warfare against Europe, and senior EU and European leaders have consistently warned that Moscow could use cyberattacks to disrupt real-world services. Beyond food supplies, AI-enhanced targeting could be aimed at banking, hospitals and the functioning of the internet itself.

Still, these fears of bad human actors using AI should be distinguished from the science-fiction scenarios pushed by so-called AI doomers, in which bots themselves are motivated and able on their own to wipe out humanity.

Digital security experts, including the EU’s own in-house cyber team, are also turning to AI for defense. But it’s not a silver bullet, said Rémi Enjolras, a chief technology officer at Splunk, part of Cisco. Critical industries need to stop “seeing AI as a magical tool that will solve everything and go back to the fundamentals,” he said.

The EU has passed laws intended to force critical industries and product manufacturers to get those fundamentals right. But France, for example, is lagging in implementing such national regulations, and there are few other incentives to get companies to do that difficult and costly work.

Still, the images of empty supermarket shelves could provide a new incentive. “It should serve as a kind of a wake-up call,” Enjolras said.

Émile Marzolf contributed to this report.