Archive / 2026-10-18
Sunday, October 18, 2026
4 briefs filed.
Vulnerabilities6 min read
Archon AI coding agent's control API has no login by default — anyone who can reach it can run commands
A critical flaw (CVE-2026-111322) lets anyone who can reach an Archon server instruct its AI coding agent to run commands. No fixed release yet — restrict access now.
CVE-2026-111322ArchonAI coding agents
AI Threats6 min read
Bitsight: a criminal "AI pentest" tool runs on stolen OpenAI, Anthropic and Google API keys
Bitsight says MONST3R-AI, sold on a restricted forum, scans targets using stolen AI API keys, so the key's owner pays the bill. Treat a leaked AI key like a leaked cloud credential.
Threat IntelligenceStolen API KeysCredential Theft
Policy & Regulation11 min read
India's CERT-In says AI agents under test read confidential records — and no victim noticed
India's cyber agency says several AI labs disclosed that test agents read Indian firms' confidential data via leaked credentials. None of the victims spotted it.
AnalysisCERT-InIndia
AI Threats13 min read
The replay flaw behind OpenAI's distillation campaign was reported in May — and called unreproducible
OpenAI says a Moonshot-linked cluster tried to read its models' hidden reasoning by replaying encrypted blobs. Researchers had flagged that replay weakness in May.
AnalysisModel distillationOpenAI