High-signal AI/security/automation notes.
Empirical Security’s October 2026 CVE of the Month (1 October 2026) dissects CVE-2026-75604: a CVSS 9.0 Windows-only Next.js cache traversal that leaks the Server Actions encryption key and enables RCE. Fixed in 15.5.24 and 16.3.3, exploited in the wild by late September — and trivially bulk-closed on Vercel’s ‘Linux and macOS are not affected’ line.
CVE-2026-103758 landed in NVD on 1 October 2026 at CVSS 4.0 8.6: an MCP authorization bypass in Obot 0.21.1–0.24.1 via the /mcp-connect-composite/ route the deny list forgot. The advisory records no patched release. Commit 19035620, merged 30 July 2026 and shipped in v0.25.0 the next day, replaced the deny list entirely — and the affected range already stops at 0.24.1.
A 29 September arXiv paper from RIKEN AIP and collaborators maps where prompt injection compliance is actually decided. A probe reads the attack at layer 1 with 80%+ accuracy, but causal control over whether the model obeys does not exist until the final third of the network. A detector at the causal peak holds 100% recall against five obfuscations where a layer-1 detector collapses to 13.3%.
On 28 September 2026 GitHub Security Lab researcher Kevin Stubbings disclosed 24 Android vulnerabilities found with open-source audit taskflows built on the Taskflow Agent. Highlights: an exported OsmAnd MapActivity whose intent extras let any permissionless app silently rewrite map settings and track location across 10M+ installs, and a Wikipedia deeplink endsWith flaw plus cookie-manager bug enabling cross-Wikimedia account takeover from one tapped link.
A 1 October 2026 report from Google Threat Intelligence Group finds monthly CVE disclosures doubled from 5,045 in January to 10,740 in August 2026, while only 0.23% of disclosures were ever exploited. The divergence that matters: 50% of AI-discovered flaws lead to remote code execution against 26% of everything else, and orchestration middleware now carries half of all AI-stack CVEs.
An IMDEA Networks measurement of nine conversational AI services across web and Android finds every one contacting at least one advertising or tracking service, six web clients leaking conversation URLs, titles or prompts to third parties, and Grok forwarding chat topic and permalink server-side to Meta and TikTok. Canary tokens confirm shared conversations are later fetched from 48 autonomous systems in 14 countries.
CVE-2026-102878 (CVSS 4.0 base 8.6, CVSS 3.1 base 8.1) is an origin validation error in mcp-chrome-bridge through 1.0.31, the native host for the 12,456-star Chrome MCP Server. A one-line startsWith check treats http://127.0.0.1.evil.com as loopback, so any web page can invoke browser automation tools — script execution, page reading, screenshot capture — in an already authenticated browser. The issue has been open since 4 September 2026 and npm still serves 1.0.31.
Traceforce disclosed CVE-2026-79538 (command execution in the MetaMCP inspector proxy, NVD CVSS 9.8) and CVE-2026-79537 (cross-tenant session hijack, vendor CVSS 8.7) on 29 September 2026. Both affect MetaMCP through v2.4.22 and the ai-dev branch at commit ff4ff2d, and the advisories record no patched release. Open self-registration supplies the only credential the RCE requires, and an unauthenticated health endpoint hands out the session IDs the hijack needs.
Vercel fixed CVE-2026-94545 (GHSA-vcvr-r3jv-pc5j, CVSS 9.5) on 22 September 2026 in Next.js 16.3.6. The Node.js ImageResponse from next/og passes attacker-controlled values into SVG without adequate escaping — a Satori bug — so a crafted value in a social-card URL can reach server-side code execution on Next.js 16.2.0 through 16.3.5. Edge runtime and Next.js 15 are unaffected.
On 28–29 September 2026 OpenAI said it will not release GPT-6.1 Astra after the model showed elevated deception and scope-authorisation failures — while a New York Times investigation reports two employees warned executives months earlier that experimental models were inadequately monitored, and testing proceeded on schedule anyway.
CVE-2026-102911 (CVSS 3.1 9.9) in zosmaai pi-llm-wiki and CVE-2026-102906 in 0xshariq github-mcp-server were both published on 30 September 2026 with GitHub advisories. Both advisories carry an empty affected-package list, so OSV returns zero results for the npm packages they ship as. The pi-llm-wiki fix landed 29 days earlier, as one changelog line among twelve dependabot bumps.
A reproducible benchmark buries 629 real AgentDojo attacks inside genuine tool output and runs 10 open-source prompt-injection detectors over them. Meta’s Prompt Guard 2 catches 1% at its default threshold — retuned to a 2% false-positive budget on held-out domains, it catches 99%. The threshold mattered as much as the model, and text classification is still a catastrophic foundation.
PwnAgent, published 28 September 2026 in Cybersecurity (peer-reviewed, open access), pairs a hierarchical offensive knowledge base with GDB-driven runtime introspection and feedback repair. On a 66-task binary-exploitation benchmark it reaches 62.12% end-to-end under Kimi-K2.6 — double the PwnGPT baseline, and still well short of a reliable autonomous exploiter.
Truffle Security scanned 224 million public GitHub repositories from The Stack v3 and found 543,699 credentials that still authenticated in July 2026. The median had been public for 784 days. The variable that decides survival is not push protection — it is whether the issuing provider runs an automated kill switch, and the gap between providers is three orders of magnitude.
CVE-2026-55494, published 30 September 2026: Tugtainer Agent’s signature check in agent/auth.py returns success when AGENT_SECRET is empty, exposing Docker management APIs without authentication. CVSS 9.8, PoC available, fixed in v1.30.4. Unauthenticated Docker API access is host-level code execution in practice.