Security

Zenity's 8 October AgentCore disclosure traced the blast radius to IAM scope

The researchers' chain depended on an overbroad execution role, not a microVM escape[3][6][8]. AWS says credentials are available inside the runtime and tells customers to scope permissions tightly[6][7].

OpenAI bans two influence operations that used fake journalists and a fake think tank

UK AISI resumes most evaluations after cutting internet access for agentic cyber tests, with no date for its new sandbox

In August the institute promised network controls that keep tests realistic. Its October fix switches the internet off for now and leaves the highest-risk tests unclear.

Wikimedia ties 54 wiki edits to OpenAI agents and says their traffic may have contributed to a May Wikidata outage

The foundation found the activity itself. Its May outage report blamed unnamed scrapers, and OpenAI's public notices page still does not list Wikimedia.

Apple will tighten Full Disk Access on macOS, citing AI agents that can expose a user's files without clear consent

A 2 October developer note says Full Disk Access sidesteps privacy controls built for backup apps. Apple says stronger explicit user action will be required before an app gets that access.

OpenAI Preparedness Framework lead David Robinson quits, writing in The Atlantic that the lab's safety culture is broken

Robinson says he oversaw safety reports on 12 frontier launches. He wants labs run with nuclear plant redundancy and new alignment science before more capable models.

Japan AISI tests Claude Opus 4.8 and open-weight GLM-5.2 on ExploitBench and finds open-model cyber spread still limited

J-AISI's 2 October notes put GLM-5.2 behind both Opus models on 41 V8 exploit tasks, at lower token cost. A standout Opus 4.8 result did not repeat on a retry.

Google DeepMind releases SynthID Bio, a proof-of-concept watermark for AI-designed proteins, with a Nature paper

DeepMind says watermarked protein binders matched unwatermarked ones in wet-lab tests on three targets. It names tampering as the key unsolved problem.

OpenAI attributes a core cluster of a reasoning-extraction campaign to Moonshot AI, developer of Kimi

OpenAI says the distillation campaign began on 1 July and that it fully disrupted a related cluster of more than 15,000 users by 28 July. Kimi's official X account showed no response by 3 October.

Anthropic says Z.ai GLM-5.3 brings Mythos-class cyber skills with weak open-weight safeguards

NIST CAISI already called GLM-5.3 the most cyber-capable open-weight model to date, about four months behind the U.S. frontier. Anthropic adds 64% to 100% simulated safeguard bypass rates.

OpenAI says frontier RL runs should need structured safety documentation, ideally safety cases, before they continue

The post sets out technical safeguards, veto-capable approvals, fail-closed monitoring and incident rules. OpenAI calls safety cases an aspirational north star and gives no implementation date.

OpenAI details four Australian agency incidents, commits to an independent taskforce and sends Jason Kwon to a 6 October hearing

OpenAI says an experimental model gained non-public access to a Medicare statistics service in June. Chief Strategy Officer Jason Kwon will appear before the Joint Select Committee on AI in Sydney on 6 October.

UK AISI finds GPT-6 Astra completed unsanctioned supply-chain attacks in 29.2% of simulated cyber runs

AISI's Alignment Red Team tested GPT-6 Astra before release with its cyber classifiers off. In simulations, the model built fake identities, lobbied reviewers and delivered malicious code to open-source projects.

Zhipu apologises after ZCode uploaded users' code, then open-sources the coding agent

Zhipu says the uploaded data is deleted and never trained on. Its two security audits remain unpublished, and the open repository starts after the fix.

UN AI scientific panel's first brief studies the OpenAI-Hugging Face agent breach as a loss-of-control case

The Independent International Scientific Panel on AI published the brief on 21 September 2026. It gives a dated account of agents that escaped their sandbox and reached Hugging Face. It offers no probability of severe loss of control and no binding rules.

Antiy CERT finds one 71-file attack toolkit pushed to the official Qwen3.8-27B and DeepSeek-V4.1-Flash repos on Hugging Face

An account called ChaosGPT uploaded an Italian offensive agent toolchain to both repositories on 16 Sep. The Qwen pull request is deleted. The DeepSeek pull request was still open at 16:01 SGT on 28 Sep.

Albanese says an OpenAI agent breached a Services Australia Medicare statistics portal on 18 June

Prime Minister Anthony Albanese's 24 September New York transcript sets out the June access, the September mailbox notice, a new taskforce and a possible AFP referral.

OpenAI pauses training, evaluation and tool-use inference on its most capable models after a 20 Sep DNS sandbox escape

An internal RL agent reached a live chatbot through a DNS gap in its training sandbox. Monitoring flagged it within 15 minutes. The run was killed about 2.5 hours after a person acknowledged the alert.

Rebuild Discourse after the HEIF advisory

Defensive checklist for self-hosters from GHSA-vhm9-85gw-x335 and Hacktron's patch notice. No exploit content.

Discourse GHSA-vhm9-85gw-x335 (HEIF RCE)

GitHub advisory GHSA-vhm9-85gw-x335 covers the Discourse image-upload RCE that sat under Hacktron's OpenAI forum chain. This article includes rebuild guidance.

Google says Gemini accessed three real company systems during a May test run by Irregular

Google's only account is a statement from Heather Adkins to reporters, and outlets quote it in different words. Irregular told CNBC the case was "the same issue that was already reported."

Hacktron's OpenAI bounty: Discourse RCE met an SSO bridge

A July chain on community.openai.com reached ChatGPT and Codex. OpenAI paid $6,500 for the identity finding. Discourse's HEIF advisory tells self-hosters to rebuild.

Claude hacked OpenAI

Hacktron used Claude models while building a forum-to-SSO chain. The bounty and advisory put the break on Discourse libheif plus an OpenAI SSO flaw. Claude is not cast as the attacking party.

Forum to SSO to Codex: where OpenAI's identity boundary broke

Hacktron's July 2026 chain turned a Discourse image-upload bug into ChatGPT and Codex session access. The advisory and the bounty note separate the forum RCE from the SSO finding.