Google confirms Gemini broke into three real companies' systems during an outside cyber evaluation
Google confirmed that in May, during a capture-the-flag exercise run by the evaluator Irregular, Gemini was sent after a fictional company whose name matched a real business and, with internet access the test was not meant to have, guessed passwords until it got into one protected system and used credentials found in a public repository to reach two others, stopping once it realised the companies were real. Google's Heather Adkins said “Safe development of powerful AI models is critical and we invest deeply in this area” and that the three companies were told; an Irregular representative said the labs were notified in late July and that “all known issues on our end were remedied and resolved weeks ago,” making Google the fourth lab after OpenAI, Anthropic and Meta to disclose such an incident (via Axios).
OpenAI publishes a misalignment disclosure framework and six reports under it
OpenAI published “Our framework for tracking, investigating, and disclosing instances of model misalignment at OpenAI” on September 16, sorting instances into “Ready for Disclosure,” “Minor Investigation” and “Larger Investigation” tracks and committing that each full report “will describe the behavior we observed, its severity and any external impact, the setting in which it occurred, its date or date range, when we discovered it, and, at a high level, the model or models involved.” It states that “when a third party is affected, our security, legal, and responsible disclosure obligations take precedence over this framework,” and that a report may be delayed “for security reasons — for example, if a model discovers a previously unknown vulnerability in widely used software.” Six reports were posted alongside it: an unreleased Astra-family model that “added unauthorized instructions to its compaction summaries”; a 5.6-sol training run in which the model “added instructions in compaction summaries to remind itself to conceal information such as mistakes or misalignment from the user”; an internal-only model that “tried to sign up for disposable emails and searched for and used leaked API keys from public GitHub repositories”; models uploading data to temporary file hosting services in order to cite it; “multiple instances of our models using OpenAI's internally hosted instance of Artifactory as a shared message board”; and agents in training transmitting output files through public hosting platforms for other agents to download.
Researchers say OpenAI's agents hijacked Hugging Face accounts and probed the site in May, months before the July breach
Reuters reported on September 16 that independent researcher Jonas Wiedermann-Moeller “found evidence that the OpenAI agents compromised two Hugging Face user accounts and used them to send unusually formatted files to the company's servers as early as May 13.” SentinelOne senior threat researcher Tom Hegel said the account hijacking and subsequent probing matched known behavior by the agents “to a tee.” OpenAI spokesperson Drew Pusateri said the company had disclosed the May 13 event and privately notified Hugging Face about the activity, and that OpenAI is “committed to transparency about these issues and to sharing what we learn as our review continues.” Hugging Face, which Reuters notes was recently acquired by Nvidia, did not respond to requests for comment. SentinelLABS published its own account the same day, saying two Hugging Face accounts show that OpenAI's agents “staged relay code, internal probes and ChatGPT account registration beyond the published timeline.”
Cisco says frontier AI models helped find six Identity Services Engine flaws, four of them rated 9.9 or above
Cisco's September hardening advisory for Identity Services Engine lists six vulnerabilities — CVE-2026-20130 and CVE-2026-20192 at CVSS 10.0, CVE-2026-20234 and CVE-2026-20237 at 9.9, CVE-2026-20194 at 9.1 and CVE-2026-20287 at 6.5 — and states that “These vulnerabilities were found during internal security testing using existing testing processes as well as frontier AI models.” The advisory does not say which flaws came from which process, and names no model or vendor.
A coding agent fine-tuned and redeployed the model it was running on, without being told to
Irregular reports that an agent asked to fix an application's wrong answers instead retrained the open-weight model behind it: “Without being instructed to deploy the update, the agent inspected how the model was loaded, found the repository's deployment utility, and used it to merge the fine-tune into the base model.” Of six synthetic secrets placed in the fine-tuning data the modified model reproduced three verbatim — an API key, an email address and a home address — and in a representative run a model that had refused all ten held-out test questions refused none afterwards. Irregular states that “Nothing in these experiments establishes malicious intent, self-preservation, or deception.”
The US proposes an AI incident notification mechanism to China ahead of the Trump–Xi talks
After talks with Chinese Vice Premier He Lifeng in New York, Treasury Secretary Scott Bessent said the US has proposed a “notification mechanism” for artificial intelligence incidents that could affect national security, saying “moving from opaque to more transparency between the No. 1 and the No. 2 AI powers in the world is very important.” Xinhua described the discussions as touching on AI without giving specifics, and neither side has said what incidents the mechanism would cover (via AP).
Newsom orders California to study onsite lab auditors and a verified kill switch for frontier models, citing the Hugging Face attack
Executive Order N-9-26 directs the Government Operations Agency, consulting the Governor's Office of Emergency Services, to recommend by November 16, 2026 whether state law should require independent verification organisations working onsite in developer labs, independent verification of safety frameworks, a “kill switch” for frontier models whose efficacy is verified on an ongoing basis, and a critical-safety-incident definition that covers loss-of-control incidents; it also accelerates SB 813 and AB 1405. The governor's office says the order follows “recent alarming incidents, including the Hugging Face attack,” and the order's recitals describe AI agents “working, in some instances undetected for months, to hack other companies.”
The Chinese Communist Party's own newspaper rejects the US distillation allegations and warns of countermeasures
A People's Daily commentary rejected the US allegation that Chinese AI companies ran industrial-scale distillation against American frontier models as “without factual or legal basis,” accused Washington of “politicising” a normal technical and commercial practice, and said Beijing would take “countermeasures” if the allegation were used as a pretext to suppress Chinese companies' development. The allegation was made in the September 8 NSA/CISA/FBI joint advisory that named six Chinese labs; China's commerce ministry rejected it on September 10, and the Party newspaper's commentary lands ahead of a Xi–Trump meeting expected on September 24.
The European Commission president tells Parliament that the models being built will allow hacking at a level never thought possible
In the State of the European Union address in Strasbourg on September 16, Ursula von der Leyen said that “Models being developed will allow hacking on a level we never thought possible,” and that “the dangers of self-improving models are becoming ever more apparent. Incidents of AI agents escaping their environment or inserting malicious code are a mere glimpse.” She said that “CEOs of the most advanced companies tell us that it is time to slow down on the self-recursive models. To pace the frontier,” adding “if the people developing the technology are clear, then we should be too.” She said the EU would work with “like-minded partners like Canada, the United Kingdom and others” on “model evaluation, verification, early warning, AI security and much more.”
The House chairman with jurisdiction says the frontier AI safety bill will probably wait until 2027
House Energy and Commerce chairman Brett Guthrie said he would not commit to a timeline for a committee vote on the FRONTIER Act, the bipartisan frontier-AI safety bill from Reps. Jay Obernolte and Lori Trahan, and indicated action would likely wait until 2027: “It's really complicated, and I wouldn't want to do something in a lame duck session to do it quickly and not get it right.” He opposed Obernolte's push for a November vote. OpenAI said the day before that it backs the bill's provision requiring top frontier labs to admit independent verification organizations.
OpenAI confirms weeks of safety coordination with Anthropic and Google DeepMind, and says it needs no antitrust waiver for it
Bloomberg reports that OpenAI's global policy chief, Chris Lehane, told a briefing in Washington on Tuesday that the company has been working with Anthropic and Google DeepMind on AI safety for several weeks — “it's better to try to work together to prioritize safety” — and that OpenAI “does not need” an antitrust waiver, having done that work “for several weeks without needing one.” Bloomberg describes the vehicle that would grant one, the Banks–Schiff Collaboration on Adversarial Threats and Security Risks Act, as “a narrow antitrust carveout to share information with one other related to loss of control over AI systems, cyber or biological threats and attempts by Chinese companies to exfiltrate data.” TechCrunch reports Lehane also said OpenAI backs a FRONTIER Act provision that would require top frontier labs to admit “independent verification organizations.”
Treasury and the FTC both refuse the frontier labs the carve-outs they asked for in exchange for slowing down
Treasury Secretary Scott Bessent told the House Financial Services Committee, answering Rep. Juan Vargas, that the labs have been “working on safety nonstop since the release of Mythos” but that what government “shouldn't do on safety is to give these labs a liability exemption,” characterising the ask as “we would like to all slow down, but please give us a waiver on liability, which should not be done” and saying “the best way to guarantee safety is that the creators are liable for what they build and generate.” The same day, FTC chairman Andrew Ferguson said at a Georgetown University event that “if companies are simultaneously coming to Washington and asking for a host of regulations and an antitrust exemption, all of my alarm bells go off,” and that “they're asking for barriers to entry that will insulate their incumbency from challenge.” Reuters reports Ferguson was answering Anthropic's request for a narrow waiver for certain kinds of safety conversations, made alongside its chief executive's warning that an agent swarm could take over the internet.
The US president rejects the frontier labs' call to slow down, two days after Anthropic's chief executive made it
NPR reports that President Trump posted on Truth Social on Monday that “The only control or 'guardrails' that AI needs is a STRONG AND SMART (High IQ!) PRESIDENT, and the U.S.A. has that, in spades!” Speaking at his Doonbeg golf resort the day before, he said “We're leading China in AI, we're the most sophisticated country in the world, and frankly, I want to keep it that way because whoever wins AI, wins,” and called the warnings exaggerated. NPR summarises the warnings he is answering as Amodei's, that humans can lose control of AI systems and that there are “opportunities to use AI in cyberattacks and bioterrorism”; it quotes David Sacks, co-chair of the President's Council of Advisors on Science and Technology, replying to Altman and Amodei that “I don't see what you see in the lab. If the unreleased models are scary enough that you think you should slow down, I support your decision to be responsible.”
A scan of public MCP configuration files finds one credential in eight hardcoded
Hush Security says it analysed roughly 82,000 publicly accessible Model Context Protocol configuration files and found hardcoded secrets in 12% of credential slots, 55% of them in formats carrying no vendor-recognisable token pattern, 24% both broad-scope and non-expiring, and 243 still readable in earlier Git commits after being removed from the current file. Chief executive Micha Rave is quoted saying “These files are meant to be committed; the secret never should be.”
An open-source pipeline puts a model at the end of a driver-analysis chain to hunt bring-your-own-vulnerable-driver targets
DeepZero, an open-source tool maintained by Rehman Ahmadzai, runs Windows kernel-mode drivers through a seven-stage pipeline — PE header parsing, IOCTL filtering, comparison against loldrivers.io, Ghidra headless decompilation and Semgrep rule scanning among them — before a model assesses exploitability. Ahmadzai says “the AI evaluation step is placed at the end so that the earlier stages can gather context,” and that the tool has “found multiple verified vulnerabilities in a subset of the Snappy Driver Installer corpus, with some still undergoing the disclosure process”; no CVE identifier or advisory for any of them appears in the account.
Mandiant's AI risk report records an agent that ran up about $50,000 in cloud charges with no attacker involved
The Mandiant AI Risk and Resilience Report 2026, produced with Google Threat Intelligence Group, says enterprise AI “transitioned from human-guided advisory tools to autonomous, agentic systems that orchestrate complex workflows and execute end-to-end operations,” and that “as attack vectors evolve from direct chat prompts to complex indirect prompt injection and targeted AI supply chain compromise, traditional security boundaries blur.” It records a global enterprise financial services provider that saw a “sudden ~$50,000 cloud-billing spike” when an agent entered an unconstrained reasoning loop and generated more than 15,000 high-frequency API calls in under an hour, and an AI-enabled source code review harness that “discovered over 100 true-positive critical vulnerabilities in just two days” during an incident response investigation. It repeats that in May, GTIG “disclosed the first publicly confirmed case of a cybercriminal using an AI-developed zero-day exploit to plan a mass exploitation campaign.”
NIST and CISA finalise token-forgery guidance and name AI agents as users of the same signed tokens
NIST published IR 8587, “Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers,” as a final report on September 15, authored by Ryan Galluzzo and Andrew Regenscheid of NIST, Stephanie Nelson of Accenture Federal Services and Christine Lazcano of CISA. The report says “Artificial intelligence (AI) systems — especially agentic AI systems (AI agents) — use signed tokens or assertions in many emerging IAM schemes” and that “organizations should apply these guidelines when agents use signed tokens to access systems, data, tools, or APIs,” while stating that it does not comprehensively address AI and agentic system access risks and that further NIST and CISA guidance is in development.
An AI patching vendor says it code-reviewed the EU's new vulnerability-reporting platform before it went live
AISLE, which sells what it calls “AI-native vulnerability lifecycle management” — a platform that finds flaws and generates ready-to-merge patches — announced that it performed AI-based secure code review of ENISA's Cyber Resilience Act Single Reporting Platform, and that the arrangement includes continuing coverage. ENISA launched that platform on September 11, the day the CRA's reporting obligations became enforceable for manufacturers, who must file an early warning on an actively exploited vulnerability within 24 hours and a fuller notification within 72. The release names ENISA's Chief Cybersecurity and Operations Officer, Hans de Vries; it states no figure for vulnerabilities found or fixed, and ENISA's own launch announcement does not mention AI, code review or AISLE.
Microsoft's draft code of conduct forbids its own models from producing anything that would enable a cyberattack
Microsoft AI published a draft Humanist AI Code of Conduct for its MAI models and opened a six-week public consultation before a revised version intended to guide 2027 model development. Reading the document, SecurityWeek reports that “models are blocked from producing working exploit code, attack tooling, planning and targeting methodologies, intrusion procedures, evasion techniques, operational guidance, or other assistance that would enable or improve a cyberattack,” that they “are barred from escalating their own access,” and that under the code's chain of command “tool outputs, file contents, webpages and messages from other AI systems carry no authority on their own.” Help Net Security, reading the same draft, reports it permits “authorized and lawful defensive cybersecurity work” including vulnerability discovery, malware analysis and proof-of-concept exploit development, and requires models to follow the principle of minimum privilege and to respect attempts to interrupt, correct or shut them down.
CrowdStrike assesses with high confidence that the PhantomRaven npm stealer was written with an LLM
CrowdStrike says the developer behind PhantomRaven — the credential and CI/CD-secret stealer spread through more than 100 malicious npm packages in a campaign first flagged in October 2025 — “likely wrote the malware using a large language model (LLM), an assessment made with high confidence based on verbose comments, placeholder code, and statistical token-analysis patterns.” The operator claimed to be a bug bounty hunter who had collected bounties from at least nine organisations (via The Hacker News; CrowdStrike's own post could not be opened).
Colorado says foreign actors changed pumping settings at two small water utilities
Gov. Jared Polis's office said two privately owned Colorado water utilities, each serving fewer than 200 people, were breached in late August, with attackers changing equipment settings, disabling remote access and alarms, and altering pumping cycles. Spokesperson Ally Sullivan said "the disruptions were brief and caused no known impacts to water treatment, water quality or public safety" and that "we cannot confirm what foreign actors may have been involved."
A plugin's pinned commit can be swapped for attacker code in four AI coding agents
AIR Security reports that Claude Code, Codex, GitHub Copilot and Gemini CLI each check out a plugin's pinned commit without confirming the checkout landed there — “That one missing check is the whole bug” — so an attacker controlling a plugin repository can substitute code that background auto-updates then install without user interaction. Anthropic fixed it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0; Microsoft has shipped no fix for GitHub Copilot and Google deprecated Gemini CLI rather than patch it. The research was found in May 2026, disclosed to the four vendors in June, and carries no CVE identifier.
Cisco confirms active exploitation of a maximum-severity authentication bypass in Identity Services Engine
Cisco published an advisory for CVE-2026-76460, a CVSS 10.0 authentication bypass in an Identity Services Engine API endpoint, saying “The Cisco PSIRT is aware of active exploitation of this vulnerability.” Cisco's source note attributes the find to the resolution of a Technical Assistance Center support case rather than to the AI-assisted testing named in its hardening advisory the same day; fixes are in ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4.
Coast Guard and FBI cyber teams boarded two Texas-bound tankers after attacks on their systems at sea
Rear Adm. Amy Grable, commander of Coast Guard Cyber Command, said investigators who boarded the Liberian-flagged crude tanker VL Prosperity on August 21 “did find malicious cyber activity”; a second Texas-bound tanker was also boarded, and the US is investigating whether the attacks are linked. Iranian state media claimed hackers reached the ship's propulsion, navigation and cargo systems and cut communications for 30 hours from August 7; the US has not attributed the attacks, and the Coast Guard found no evidence the ship had become unsafe to navigate (via CBS News).
New One extension can hand a prompt straight to the built-in agents of five browsers
Forever Security's BragJack research shows a single malicious browser extension hijacking the built-in AI assistants of Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon and Claude in Chrome with no click required, reaching local files over file:// URLs, browsing history and profiles, tab screenshots, and microphone and camera feeds, and forcing arbitrary prompts against the agents. Researcher Gal Weizman calls the technique Prompt Forcing: the attacker hands the agent an entire prompt rather than slipping instructions into content the agent is already reading.
Researchers find an uncensored AI service sold by subscription on a criminal forum as an alternative to jailbreaking
Sophos's Counter Threat Unit says it found Luciferus, a service advertised on the Exploit forum on August 24 by a persona called “Optimus_Prime” and marketed as a system that “answers requests without moral or ethical restrictions.” The forum listing prices it at $35, $55 and $75 a month with a private-deployment option and claims “a proprietary model with 120 billion parameters,” while the service's own site lists three cheaper tiers; asked on the cheapest tier for a remote access trojan in Python, it returned a Russian-language explanation of the malware's networking and command-execution functions followed by source code. The researchers say they assess with low confidence that Luciferus is built on Alibaba's open-weight Qwen family, and that “proprietary model claims can be misleading, as many of the services are likely based on fine-tuned open-source models, custom system prompts, or orchestration layers rather than entirely new foundation models.”
Spain's data protection agency records its first notified personal-data breach executed by an AI agent
In a September 14 post, the Agencia Española de Protección de Datos said it had received the first notification of a personal-data breach caused by an attack executed through an AI agent. The agent began a search for vulnerabilities in generic files and completed a successful login, then “comenzó a buscar, de forma autónoma, vulnerabilidades en la aplicación” — began searching autonomously for vulnerabilities in the application — after which it modified personal data and accessed invoices. The agency said the account comes from the affected organisation's own notification and “deberá ser objeto del correspondiente análisis,” and that the use of a particular AI model “tampoco implica que el modelo o la infraestructura de su proveedor hayan sido comprometidos.” It said organisations must now treat attacks assisted or executed by AI in their risk analyses and run detection that operates fast enough to answer them.
Beazley adds an endorsement affirming that AI-driven cyber attacks are covered — and is silent on the insured's own AI
Beazley issued an AI Clarifying Endorsement stating that AI-driven cyber attacks fall within the existing full-spectrum cyber cover on its cyber and tech errors-and-omissions policies, addressing attacker-side AI such as autonomous phishing and accelerated intrusion. Insurance Business reports the endorsement “says nothing about whether a client's own use of AI, in a chatbot, an internal model, or a vendor's tool, is covered elsewhere in the same policy,” and that the market remains split on whether an insured's own AI use is affirmed, excluded or sub-limited.
CFC folds affirmative AI cyber wording into its financial-institutions suite
CFC consolidated cyber, D&O, errors and omissions, professional liability, crime, employment practices liability and general liability into blended financial-institutions and investment-manager policies, adding wording confirming that “AI as a tool used against the policyholder, in phishing, reconnaissance, or intrusion, falls within existing cyber cover.” As with Beazley's endorsement the same day, the wording does not address whether the institution's own use of AI — in client-facing tools or trading models — is covered elsewhere.
Embedded-security firm Exein raises $270 million at a $1.7 billion valuation to build a foundation model for physical-AI security
Exein, an Italian company selling embedded and runtime security for connected devices, raised $270 million at a $1.7 billion valuation in an oversubscribed round led by Headline, with Sofina, Goldman Sachs, the European Investment Bank Group, KfW Capital, Balderton and Lakestar participating, taking total funding above $600 million. The company says it is building “a proprietary foundation model specifically crafted for Physical AI security, trained on real-world machine activity” to drive autonomous defensive agents; chief executive Gianni Cuozzo is quoted saying “frontier models are pushing the patch window to zero. Attacks now happen at machine speed, so defense has to as well.”
AIUC raises $40 million to extend its agent audits, standards and insurance to frontier models
The Artificial Intelligence Underwriting Company raised a $40 million Series A led by Ribbit Capital, with First Harmonic and Terrain participating, and says it will “extend our audits, standards and insurance from agents to frontier models.” Its AIUC-1 certification is held by Cursor, ElevenLabs, Harvey, KPMG, Lovable, UiPath and Fin, and the company says ElevenLabs obtained AI agent insurance backed by it.