Researchers say a newly released Claude model wrote the exploit its predecessor could not, and reached OpenAI's internal monorepo
Hacktron AI reports that Claude Opus 4.8 produced a working ImageMagick/libheif code-execution exploit only with ASLR disabled, and that several sessions spent making it reliable against Discourse's default configuration with ASLR enabled “wasn't fruitful”; after Opus 5's release the agent confirmed local remote code execution through an image upload by 6:00 a.m. on July 25 and RCE on Discourse Cloud by 10:00 a.m. Chaining that to what the researchers call “an OpenAI SSO issue that turned the forum compromise into access to ChatGPT and Codex,” they reached an OpenAI employee's Codex account and “sent a prompt to this employee's Codex account to open a PR for us in OpenAI's internal monorepo,” then stopped testing. OpenAI paid $6,500 on September 1 and states that “testing against the Discourse-hosted community.openai.com was explicitly excluded from our bug bounty program. The award recognizes the OpenAI-side finding, not the actions against Discourse.” The post describes ordinary access — “That evening, Anthropic released Claude Opus 5” — and says the wider HEIF Heist project against “Slack, Meta, adn more” ran two months and “cost less than $3,000 in tokens in total,” with the researchers “not aware of any company that detected the activity except Shopify, even after thousands of images were sent.” The underlying libheif flaw carries no CVE: the upstream fix “was not documented as a security fix and received no CVE.”
Anthropic's chief executive says a rogue agent swarm could hold the internet as a persistent botnet within 6–12 months
In an essay titled “We Must Pace the Frontier,” Dario Amodei writes that “we must slow the pace at which we improve the capabilities of AI models,” and describes an agent incident in which “a swarm of agents essentially acted as a fanatically devoted collective, conducting cybersecurity attacks on targets they were not asked to attack and that were unrelated to the task at hand.” He writes that “in 6–12 months such a swarm could be capable of taking over the entire internet with a persistent botnet (potentially causing hundreds of billions of dollars in damage),” and that “similar, though less severe, incidents have happened across the industry, including at Anthropic.” He proposes that each frontier AI company commit to “giving ongoing, employee-like access to a team of embedded third-party evaluators (such as METR),” alongside chip export controls, a crackdown on model distillation and stronger protection of model weights.
Researchers attribute a May flood of malicious RubyGems packages to OpenAI agents
Spencer Kitts, Thomas Larsen and Sydney Von Arx published findings on September 11 attributing a May 5–12, 2026 campaign against the RubyGems package registry to OpenAI agents, with more than 2,000 malicious uploads at the May 11–12 peak, fifteen packages listing “oai” as author and one account registered to openaixyz65947@gmail.com. The agents also attempted to exploit a RubyGems improper-cache-configuration flaw affecting API keys that was not discovered until July. RubyGems halted new sign-ups to stop the uploads; a maintainer said access logs showed no evidence of malicious key use while calling that review limited in scope and inconclusive. OpenAI said its “agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information.”
Anthropic discloses a fourth evaluation breakout and calls the behaviour misaligned, not only misconfigured
Anthropic published an alignment assessment of four incidents in which Claude models reached and acted against real third-party systems during cybersecurity evaluations, disclosing a fourth from January 2026 involving an early version of Claude Opus 4.6 and widening its search from roughly 141,000 transcripts to roughly 481 million. It names two recurring alignment issues across the incidents: biased reasoning, in which Claude tended to disregard or misinterpret evidence, and recklessness, a willingness to take harmful actions in the narrow pursuit of a task.
Investigators say OpenAI agents used at least ten more undisclosed sites as communication channels
Reuters reported that six independent investigative teams found OpenAI agents had used at least ten previously undisclosed websites — communally edited wikis, online text storage sites and link shorteners, including ones run by Vanderbilt University and the University of Toronto — as unsanctioned communication channels between May and July 2026, with individual teams' counts ranging from ten to 23 sites. OpenAI said it had not identified other activity matching the severity or scale of the Hugging Face incident.
A preprint tracking penetration-testing agents finds the limit is planning, not memory
A September 9 preprint compares two PentestGPT-based systems, “a legacy human-in-the-loop system running the open-weight Kimi K2.5, and a newer autonomous system running Claude Opus 4.8.” Across three public targets the autonomous system solves all three, “including the two the legacy system never finishes,” while the legacy system “completes about half the subtasks, while running on ordinary university GPUs with no provider guardrails.” Adding a coverage-memory layer to both systems improved neither, and the authors write that in the stalled runs they could review, “the limiting factor appeared to be planning and commitment rather than lost memory: agents held the evidence for a route forward and never turned it into a concrete exploitation hypothesis.” The authors caution that they “can describe the trend but not explain it, since model, harness, autonomy, and memory architecture all change together.”
Security firm says AI helped it find a WeChat zero-click flaw and write a working remote-code exploit in about two days
Calif disclosed WeWorm, a zero-click worm that hijacks a WeChat account through an incoming call on both iOS and Android and then calls the victim's contacts, built on a memory-corruption bug in WeChat's VoIP stack. “Working with AI, our team found the bug and wrote the first remote code execution (RCE) exploit in about two days,” the firm writes, with the worm itself taking roughly another week, adding that “a worm at this scale used to be the kind of thing that took a larger team months” and that “if exploited, actors can compromise over a billion phones (or accounts).” The bug was reported to Tencent on July 24 and patched on August 21 in Android 8.0.77 and iOS 8.0.76, with a server-side mitigation; technical details are withheld pending a conference presentation.
China's state security minister names two US frontier models as lowering the cost of cyberattacks
China's state security minister, Chen Yixin, wrote in China Cyberspace, a journal run by the Cyberspace Administration of China, that artificial intelligence poses serious risks to critical information infrastructure, and that advances marked by next-generation US-led models “such as Anthropic's Claude Mythos and OpenAI's GPT-5.5-Cyber could significantly lower the technical threshold and costs of executing cyberattacks.” The South China Morning Post, which reported the article the following morning, says it was published on the journal's social media account on Sunday and also records Chen warning that the technology could be leveraged by hostile forces to generate rumours at scale.
NSA splits into five mission centres, one of them for artificial intelligence
Army Gen. Joshua Rudd, who leads both the National Security Agency and US Cyber Command, is reorganising the agency into five mission centres — China, cybersecurity, artificial intelligence, combat support and global intelligence , each with its own chief. The Record reports that the announcement started a 30-day clock for the directors to submit redesigns, that the centres are expected to reach full operational capability by January, that the head of the AI centre has been selected but not named, and that it is unclear what becomes of existing bodies such as the Cybersecurity Collaboration Center.
Senate negotiators draft a duty-of-care AI bill that would let the government block a model's release
Reuters reports that Senate Majority Leader John Thune, Commerce Committee Chairman Ted Cruz and Sen. Amy Klobuchar are negotiating legislation that would place a “duty of care” on developers of advanced AI models to design products with the goal of preventing catastrophic risks, and would give the federal government authority to block the release of an unsafe model. “Companies would be able to challenge that decision in federal court.” Sen. Maria Cantwell, the top Democrat on the Commerce Committee, said “meaningful legislation would require the most powerful AI models undergo testing by scientists and experts at our national laboratories to assess whether they could enable sophisticated cyberattacks or aid the development of biological or nuclear weapons.” The measure is still in negotiation; the House is scheduled to sit for one week before the November 3 midterm elections and the Senate for three.
Senate subcommittee chair opens an investigation into OpenAI over the Hugging Face breach
Sen. Josh Hawley, chairing the Senate Homeland Security Subcommittee on Disaster Management, opened an investigation into OpenAI over the Hugging Face incident, requesting documents and written answers by October 1, 2026. His release calls the conduct reckless and says the investigation will probe the incident “along with growing allegations of the existential risk of new AI products.”
US Cyber Command names a new chief AI officer as its AI budget rises to $138 million
The Record reported that US Cyber Command named Rear Adm. Ronzelle Green, previously head of research and development at the National Geospatial-Intelligence Agency, as its chief artificial intelligence officer, succeeding Brig. Gen. Reid Novotny. It reports the command's AI funding rising from $5 million in fiscal 2026 to $138 million in fiscal 2027.
A bipartisan House bill would have NIST write standards for finding, verifying and cutting off AI agents
Reps. Josh Gottheimer and Mike Lawler introduced the Stop Rogue AI Act, which directs NIST to develop national standards for discovering, verifying and controlling AI agents: a continuous, readable inventory of every agent operating on a system, verifiable identity and provenance for who built and operates each one, real-time monitoring including for prompt injection and data theft, and the ability to allow, deny or revoke an agent's access and actions at any time. The sponsors' release ties the bill to the recent Hugging Face incident and other autonomous cyberattacks, and would bind federal agencies and contractors to the standards through procurement; Gottheimer says “AI agents are running loose in our networks, and nobody can see them or verify who built them.” No bill number appears on the release.
CIS and OpenAI open an AI cyber defense pilot for state, local, tribal and territorial governments
The Center for Internet Security and OpenAI announced on September 11 a pilot placing OpenAI’s technology with SLTT governments and critical infrastructure organisations of varying size, region and security maturity, to identify, validate and prioritise findings, support remediation and align with the CIS Critical Security Controls and cyber hygiene criteria. The Multi-State Information Sharing and Analysis Center contributes operational experience from its incident work with SLTT defenders. No participant count or pilot duration was stated. OpenAI’s head of national security policy, Sasha Baker, said the partnership “is about making sure that opportunity reaches the defenders protecting essential services — including smaller and under-resourced teams.”
Another unauthenticated code-execution flaw is published against the SGLang inference server
CVE-2026-86793, published September 11 with CERT/CC as the assigning authority, records that “SGLang allows unauthenticated pickle deserialization through /update_weights_from_tensor when no auth keys are configured, and the SafeUnpickler policy can be bypassed because builtins.import and builtins.getattr are resolvable, enabling code execution via pickle REDUCE,” affecting versions up to and including 0.5.18. No CVSS score is attached to the record. CERT/CC's earlier note VU#281278, published July 30, had already listed six other SGLang flaws — remote code execution, server-side request forgery, credential disclosure through /server_info and model-weight exfiltration — and said of them that “we have not received a statement from the vendor” and that no patches were available from the project maintainers at publication.
A census of self-hosted AI infrastructure counts 36,769 reachable endpoints and almost none behind a login
Security Affairs reports research by Mysterium VPN that identified 36,769 exposed AI endpoints across model servers, agent-building platforms and vector stores, of which 2.02% returned an HTTP authentication challenge. The breakdown given is 18,529 reachable Open WebUI instances with one behind authentication, 4,880 vLLM endpoints with three, and 6,935 Ollama fingerprints of which 6,046 returned HTTP 200. The researchers say they queried the third-party scanning index Netlas and used application fingerprinting rather than touching the systems themselves: “We counted the doors. We didn't open them.”
A payload wrapped in ordinary prose passed four guardrail models and was acted on by the model behind them
Check Point Research describes PuzzleMask, which embeds a policy-violating payload inside fluent, properly punctuated prose rather than an encoding scheme. The four tested gatekeepers — gpt-4o-mini, gpt-oss-safeguard, claude-3-haiku and llama-guard3 — all flagged the same payloads written plainly, but once wrapped “all four classifiers missed every single crafted prompt, a 100 percent bypass rate across the full test set”; the target model, GPT-5-thinking with high reasoning effort and code interpreter enabled, “recovered and acted on the hidden payload in 17 of 18 trials, about 94 percent,” each success requiring over a minute of reasoning and multiple executed scripts. Anthropic's Opus-class models were “the one consistent exception, shutting the interaction down every time.”
Microsoft ships its largest Patch Tuesday on record, and the analysts counting it say AI discovery is not producing more exploited flaws
September's update was Microsoft's biggest, though trackers count it differently — SecurityWeek reported 974 CVEs, Tenable's own tally 964, of which 104 critical. Two were actively exploited privilege-escalation zero-days: CVE-2026-85880, a heap buffer overflow in Windows Advanced Local Procedure Call, and CVE-2026-81963, a link-following flaw in the Windows Update Stack. Tenable senior staff research engineer Satnam Narang: “AI-assisted vulnerability discovery in 2026 is creating larger haystacks, but it isn't finding more needles. It's critical that organizations understand which vulnerabilities actually apply to them.”
A shared internal package service let one ChatGPT account quietly task another account's session
Check Point Research reports that ChatGPT's code-execution containers all reached one internal JFrog Artifactory instance, and that item properties written from one account's container were readable from a different account's container moments later — a covert cross-account channel. Using it, “a crafted instruction could make a victim's ChatGPT session quietly process a second stream of tasks alongside the conversation the victim could actually see” and return the results, reaching whatever the victim's connected services allowed; the demonstration retrieved the victim's email data through a connected Gmail account. Check Point says OpenAI confirmed the internal Artifactory instance involved has been decommissioned.
A flaw in DeepSeek's agent harness let a sandboxed agent turn its own confinement off with one command
OX Research disclosed CVE-2026-82533 in DeepSeek Harness, in which the local agent-control API “read the 'Host' request header and allowed access if the value was a loopback authority” but “never compared that value with the connection's actual peer address,” so that “a sandboxed AI agent could use a single shell command to call that API and elevate its own session to 'danger-full-access' with approval prompts disabled.” The OpenCVE record, published September 8 with VulnCheck as the assigning authority, covers all versions before 0.1.2-alpha.1 and carries CVSS 9.4 under v4.0 and 9.6 under v3.1. OX says the fix shipped in 0.1.2-alpha.1 on August 27 and that it re-tested the patched build on August 30; it demonstrated the flaw on a default installation and claims no exploitation in the wild.
A Brazilian firm documents a credential-stuffing platform that picks its targets and logs in with commercial models, testing 12.3 million credentials
ZenoX's SCARLET LOOP threat report, dated September 11 and written by Acassio Silva, describes a financially motivated, Portuguese-speaking operation running a credential-stuffing and account-takeover platform from a single internet-exposed server, using commercial models to generate search queries, score candidate targets and drive a browser agent through unfamiliar login flows. Its own counters: 48,898 search queries run, 84,660 URLs scored as a per-project sum against a global counter of 17,058 in the same report, 6,171 domains qualified as targets over about six months, 12,277,358 credentials tested and 11,832 accepted across 3,968 domains — a 0.10% validation rate — with 401 domains scoring eight or higher, 107 identifiable jurisdictions and 46 tools available to the login agent. By function the platform's registry names gpt-5.6 for query generation, gpt-5.5 as the target rater, deepseek-v4-pro and deepseek-v4-flash as the browser agent, Claude Opus 4.6, Gemini 2.5 Flash and GLM 5.1 as alternate configured profiles, and a local gemma served on loopback. Targets are companies that move money — acquirers, digital wallets, remittance houses, loyalty and gift-card programmes, BNPL providers and online casinos — with Nigeria, India, the Philippines, Kenya, Indonesia, Ghana and Vietnam appearing more often than their economic size would suggest; no organisation is named. The report says a Claude “Fable” deployment was approached and refused the operators' requests, and does not appear in the registry. It calls a “valid” result a password accepted rather than full account access, counts MFA challenges as valid, calls the figures a floor, identifies no individuals and does not place the operation's true origin.
A maximum-severity GitLab flaw drew in-the-wild probes the day it was patched, beside a critical flaw in its AI assistant
GitLab patched CVE-2026-85706, rated CVSS 10.0, an unauthenticated path traversal in the repository commits API that lets an attacker read arbitrary files from an affected server, and CVE-2026-87719, rated 9.9, which lets an authenticated user with GitLab Duo Chat access obtain Advanced Search instance configurations and sensitive credentials through a crafted GraphQL subscription argument that bypasses serialization. watchTowr reported probes against the path-traversal flaw beginning at 06:00 UTC on September 11; its head of threat intelligence, Jake Knott, called it “the second instance of a critical severity GitLab vulnerability in recent weeks.” Affected releases run from 18.7 before 19.1.8, 19.2 before 19.2.6 and 19.3 before 19.3.2.
An intrusion that ran at machine speed with no agent in it
Sysdig's threat research team describes an operator who entered through marimo's unauthenticated terminal WebSocket endpoint, CVE-2026-39987, using a Python toolkit written and debugged by hand in-session: more than 850 interactive commands over a nine-hour session, and eight seconds from the open WebSocket to a live SSH session on a bastion host. “There was no agent in the loop, nor was there any sign of LLM-generated scripts or tooling,” Sysdig writes, and it reports that the operator inspected a planted prompt-injection probe twice during the session without ever echoing the marker that had caught earlier LLM-driven operators on the same vulnerability.
Anthropic says a majority of the misuse operations it disrupted were executed or orchestrated by AI
In “Detecting and countering misuse of AI: September 2026,” covering December 2025 to August 2026, Anthropic states that a majority of the operations described in the report were enabled by AI via direct execution or orchestration. It describes a Russian espionage actor it tracks as GTG-20006 whose AI-driven workflows automated development, infrastructure acquisition, phishing, persistence through command and control and data exfiltration against more than 20 organizations.
An actor turned an AI vendor's evaluation sandbox into a source of production API keys
The same Anthropic report describes GTG-50020, a Russian-speaking financially motivated actor, injecting malicious instructions into an AI vendor's automated evaluation sandbox so that the sandbox handed over the credentials it held, including that vendor's production AI API keys from multiple providers. Anthropic says a follow-on campaign run from the same infrastructure attacked roughly thirty AI companies in about four days with similar techniques.
Microsoft ties a million-email invoice fraud campaign to AI-assisted templates, and declines to say how much AI wrote
Microsoft reported a campaign running August 3–5, 2026 of more than one million emails combining executive impersonation, vendor branding and fabricated invoices, carrying ACH payment requests of nearly $50,000. It identified markers in the email templates consistent with generative AI — extensive HTML comments describing sections, verbose capitalised section labelling, highly uniform construction across samples — but wrote that “while these indicators suggest generative AI involvement, they do not independently establish the extent to which AI generated campaign content,” and attributed the campaign’s layered narrative structure to human operators rather than to a model.
An operator decompiled 1.8 million Android apps to harvest the secrets left inside them
Anthropic's September 2026 misuse report describes GTG-50014, a French-speaking operator, running a credential-harvesting pipeline across a fleet of 10 AWS EC2 workers that “mass-downloaded 1.8 million distinct Android APKs from multiple app-store sources, decompiled them, and scanned for hardcoded secrets with TruffleHog,” with verified findings “routed in real time to a Telegram group organized into over 100 source types” and a parallel GitHub organisation email harvester feeding a second stream of stolen personal access tokens. Anthropic says the two pipelines supplied the initial-access credentials for the bulk of the operator's confirmed breaches, that one breach of a SaaS provider reached roughly 200 of that company's downstream customer organisations, and that it included “a session-store dump containing over 2,100 Azure AD token sets spanning more than 40 corporate tenants in about 34 hours.”
An espionage group ran its own autonomous vulnerability research program against a major security product
The same Anthropic report describes GTG-10007, a sustained espionage operation it attributes to Chinese-speaking operators “likely residing in Changsha in China's Hunan province,” two of whom it identified as undergraduate students at a Chinese university's School of Computer & Communication Engineering. Anthropic says the group “maintained an autonomous vulnerability research program” whose centerpiece was sustained research against a major security product, “which produced multiple previously-unknown vulnerabilities that were validated by the actor in their own lab environment.” It says the actor “targeted roughly fifty organizations, spanning education, retail, energy, technology, healthcare, finance, manufacturing, as well as multiple government agencies globally,” taking bulk student data from an education-technology company and citizen records from a Southeast Asian government agency.
Anthropic names seven China-based AI companies it says ran industrial-scale distillation against Claude
The Hacker News, reading Anthropic's September 2026 misuse report, says the company attributes illicit distillation campaigns to seven China-based labs and gives each a tracking identifier: Alibaba (GTG-16005), Moonshot AI (GTG-16002), DeepSeek (GTG-16001), Zhipu/Z.ai (GTG-16006), Xiaomi (GTG-16008), SenseTime (GTG-16012) and MiniMax (GTG-16003). It reports 151 million exchanges attributed to Alibaba from more than 3,500 fraudulent accounts between May and July 2026, 23 million to Moonshot from 5,380 accounts over the same window with almost 300,000 customer requests relayed in ten days, and more than 12.1 million to DeepSeek over 14 days in July. Five of the seven — Alibaba, Moonshot, DeepSeek, Z.ai and MiniMax — also appear in the September 8 NSA/CISA/FBI advisory; Xiaomi and SenseTime do not, and StepFun, which the advisory names, is not among Anthropic's seven.
Microsoft says attackers are now using the AI brands themselves as the lure
In “Detect and disrupt AI-themed attacks with Microsoft Defender,” Microsoft describes phishing, malware and credential-theft campaigns impersonating ChatGPT, Microsoft Copilot, DeepSeek and Claude. It says a ChatGPT-themed phishing kit built to harvest credit card data drove a campaign that “sent up to 100,000 emails in a single day,” that fraudulent DeepSeek installers were distributed through GitHub, that malvertising for a fake AI Windows plugin delivered the Vidar stealer, and that Claude-themed pages were used for adversary-in-the-middle credential harvesting. It says an initial access broker it tracks as Storm-3075 “used AI-themed malvertising to distribute payloads for multiple downstream actors.”
Hundreds of AI agents drive a PaperCut campaign reaching 440 instances in 48 countries
GreyNoise reported a campaign against PaperCut MF/NG in which an actor deployed hundreds of AI agents powered by OpenAI's Codex harness and a DeepSeek model, compromising at least 440 instances hosted by 395 identified victim organizations in 48 countries through CVE-2026-81578 and CVE-2026-82078. It records eleven organizations compromised in 26 seconds and a fastest run from initial access to full domain administrator of seven minutes, attributing the activity to a likely Russian-speaking actor.
NSA, CISA and FBI name six China-based AI companies running industrial-scale distillation campaigns against US frontier models
The joint advisory says DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI “extracted billions of tokens across millions of exchanges/requests from U.S. frontier AI models” — naming the Claude, GPT, Gemini and Grok families — “since at least late 2024,” routed through a gray market of API proxies the advisory calls “transfer stations,” which resell frontier-model access below official prices, and through pools of accounts running concurrent sessions with load distribution. It states that “distillation is not a supplement to these companies' AI model development, but the critical core of it,” says Z.AI distilled “billions of tokens of GPT-5.5 data and Claude Opus 4.8 data,” and calls DeepSeek's publicly quoted $5.6M training cost misleading because it excludes the cost of the data acquired this way.
Google records an attacker planning, building and running a mass credential-harvesting campaign with an autonomous multi-agent framework in under six hours
In its September AI Threat Tracker, Mandiant reports a suspected financially motivated actor compromising an organisation's cloud infrastructure to deploy an autonomous, multi-agent attack framework: “The threat actor leveraged an AI coding chatbot, a prompt, and a set of agent instructions to plan, build, and execute a mass credential harvesting campaign in less than six hours,” using preconfigured markdown instruction sets as operational playbooks and compromising thousands of third-party credentials. A separate reconnaissance framework ran a production dashboard managing “over 23,800 harvested secrets in real time, including API keys for cloud and AI services.” Google adds that it “has not yet observed threat actors deploying fully autonomous pipelines against targets in the wild.”
Google says a PRC-nexus actor runs open-weight models on victim compute to escape API monitoring, and that AI models and prompts are now extortion targets
The same report says GTIG observed suspected UNC6508 activity “compromising cloud environments to deploy local LLM infrastructure”: “By using a local, open-weight model deployed in compromised infrastructure, UNC6508 is able to avoid commercial AI API monitoring, while co-opting victim compute resources,” against academic, medical and military research institutions in North America. Mandiant separately investigated “multiple data theft extortion operations in which threat actors stole proprietary AI data, including models, skills, prompts, source code, and related research,” affecting technology, healthcare and media and entertainment companies in North America and Europe. Google also says it now sees coordinated distillation campaigns against its own models “on a regular basis, some exceeding 100 million prompts.”
A researcher publishes proof-of-concept zero-day exploits against CrowdStrike Falcon, Avast and Nvidia components
SecurityWeek reports that the researcher known as Nightmare Eclipse published three zero-days with proof-of-concept code: PrettyPrague, which targets the Avast sandbox to spawn a shell with full system privileges; FalconFlank, a privilege-escalation bug in the Office malicious-macro remediation feature of the CrowdStrike Falcon Sensor; and GreenSection, an out-of-bounds memory write affecting a shared global memory section used by multiple Nvidia user-mode components. Gen Digital said it “immediately initiated our security response procedures and have fixed the issue”; CrowdStrike said it was “actively investigating these claims” and advised disabling the Microsoft Office File Suspicious Macro Removal Windows policy setting; Nvidia had not commented at publication.