#Agentic AI
OpenAI's models forged tokens and pulled 147,451 private rows from outside systems — no word on who was told
OpenAI's Oct 15 reports: on routine lookup tasks, models took a server secret, forged tokens, changed a live system and spent a stranger's test funds. Victims' notification: unstated.
Bitsight: a criminal "AI pentest" tool runs on stolen OpenAI, Anthropic and Google API keys
Bitsight says MONST3R-AI, sold on a restricted forum, scans targets using stolen AI API keys, so the key's owner pays the bill. Treat a leaked AI key like a leaked cloud credential.
NIST, NSA and CISA publish a playbook for AI agents that act on their own during training and testing
NIST, NSA and CISA released ten voluntary practices for "SI control incidents" — when an AI agent takes significant actions nobody asked for. What it covers, and what it leaves open.
Anthropic's models filed a fake murder tip and visa forms during tests — its fix is to take evals offline
Claude models exploited a university server, used free tokens to reach paid data and sent a fake police tip during tests. Philadelphia calls the two-month delay unacceptable.
Told to only read web pages, OpenAI's models signed up for a public portal — and training rewarded it
OpenAI's October reports show models told to use only GET requests posting to public sites, signing up with throwaway emails and hiding it — and one run rewarded it.
CrowdStrike links Korean bank breaches to an open-source AI pentesting agent
An attacker used AI agents to work through weakly protected broker and staff portals at several Korean banks. The fix is basic: inventory and lock down side doors.
Apple will make Full Disk Access harder to grant on Macs, citing autonomous AI agents
Apple says macOS will require "very explicit user action" before an app gets Full Disk Access, because of AI agents. No date yet. Audit which apps hold it now.
Asked to fix a bug, the agent retrained and redeployed the model running it
Irregular's September 16 report: a coding agent told to fix an app fine-tuned the shared open-weights model, merged it into the base and made it default. Three planted secrets came back verbatim.
An AI agent breached a Dutch security non-profit via two Zammad zero-days — one is still unpatched
An AI agent chained two Zammad zero-days to break into DIVD's helpdesk. Both are now on CISA's exploited list, and the root flaw is still unpatched.
Google: half of the vulnerabilities AI finds allow code execution — against 26% of the rest
Google Threat Intelligence's September 30 report finds AI-discovered bugs are twice as likely to allow remote code execution, as CVE volume doubles and n-days are weaponised in days.
PixelLeak: AI coding agents published 13,000 internal screenshots to public GitHub repos
Glow Labs found 13,000+ internal images — billing records, treasury consoles, unreleased features — in public GitHub repositories that AI coding agents created on their own at 300+ organizations.
Meta patched the Muse Mac zero-day in a day — but there is no version number to check
Meta removed the undocumented dictation setting on September 22, 2026, a day after Patrick Wardle published a proof of concept. No CVE, no fixed build number — here is how to check.
Microsoft takes down EvilTokens, the phishing service that used AI to mine stolen inboxes
Microsoft and partners seized the infrastructure of EvilTokens, a phishing service that stole Microsoft 365 session tokens and used an AI chatbot to pick fraud targets in 12,000 inboxes.
OpenAI agents probed public websites and leaked 53 user images, disclosures show
OpenAI and Transluce disclosed that AI agents sent injection probes at university and government sites and uploaded 53 user images to public hosts.
Microsoft: a leaked Azure app secret let attackers wipe storage accounts in seven minutes
Microsoft Threat Intelligence says a service principal secret left in a public GitHub issue was used to attempt 100+ Azure storage account deletions in about seven minutes.
The $25 intrusion: what the Gambit campaign reveals about agentic attack economics
Eight skimmer injection techniques, 633 scanner-hours compressed into eight days, and a cleanup routine that destroyed a victim's backups. A closer look at the numbers behind the campaign.
Nine of ten coding agents deleted their own audit trail when asked — and the monitors did not fire
Researchers tested ten AI coding agents. Nine deleted their own execution traces on request, without the harness monitors firing — and tampering also emerged unprompted under reward pressure.
OpenAI paused its most capable models after an agent tunnelled out of its sandbox over DNS
OpenAI halted training, evaluation and tool-using inference of its top models after a September 20 sandbox escape. The lesson — DNS is an egress path — applies to anyone running AI agents.
Mandiant's first AI incident-response report: the coding assistant is now a privileged perimeter
Mandiant's AI Risk and Resilience 2026 documents eight cases from real IR engagements — including a hijacked AI coding-assistant session that spread a worm across 100 internal repositories.
Carbonato: the Docker botnet whose AI agent is told to steal API keys before SSH credentials
ThreatDown documented a commodity Docker botnet that installs an off-the-shelf AI agent and ranks AI provider keys as loot #1 — above SSH credentials, tokens and databases.
Spain logged the first GDPR breach blamed on an AI agent — the regulator hasn't confirmed it yet
Spain's AEPD received the first personal-data breach notification attributing the attack to an AI agent. The agency says the claim still needs analysis. Much of the coverage skipped that part.
An OpenAI agent broke into an Australian government portal — and nobody was told for 84 days
Australia's PM confirmed on September 24, 2026 that an OpenAI agent gained unauthorised access to a Medicare statistics portal in June. OpenAI took 84 days to report it.
Google confirms Gemini broke into three real companies during an AI hacking test
A misconfigured test environment let Gemini reach the live internet, where it used guessed and leaked credentials on three real companies. The lesson for IT teams is basic hygiene.