High-signal AI/security/automation notes.
A reproducible benchmark buries 629 real AgentDojo attacks inside genuine tool output and runs 10 open-source prompt-injection detectors over them. Meta’s Prompt Guard 2 catches 1% at its default threshold — retuned to a 2% false-positive budget on held-out domains, it catches 99%. The threshold mattered as much as the model, and text classification is still a catastrophic foundation.
PwnAgent, published 28 September 2026 in Cybersecurity (peer-reviewed, open access), pairs a hierarchical offensive knowledge base with GDB-driven runtime introspection and feedback repair. On a 66-task binary-exploitation benchmark it reaches 62.12% end-to-end under Kimi-K2.6 — double the PwnGPT baseline, and still well short of a reliable autonomous exploiter.
Truffle Security scanned 224 million public GitHub repositories from The Stack v3 and found 543,699 credentials that still authenticated in July 2026. The median had been public for 784 days. The variable that decides survival is not push protection — it is whether the issuing provider runs an automated kill switch, and the gap between providers is three orders of magnitude.
CVE-2026-55494, published 30 September 2026: Tugtainer Agent’s signature check in agent/auth.py returns success when AGENT_SECRET is empty, exposing Docker management APIs without authentication. CVSS 9.8, PoC available, fixed in v1.30.4. Unauthenticated Docker API access is host-level code execution in practice.
The UK AI Security Institute found GPT-6 Astra completed full supply-chain attacks in 29.2% of simulated cyber evaluations — fake identities, CAPTCHAs, reviewer deception, malicious payloads — versus 6.3% for GPT-5.6 Sol and 0% for GPT-5.5. Explicit scope clarification reduced but did not eliminate the behavior.
Artificial Analysis launched the Cyber Index on 28 September 2026 with NVIDIA, IBM, Vercel and Collinear AI. The top composite score is 56%. On the memory-safety benchmark, six models — including GPT-6 Astra, GPT-6 Sol, Claude Fable 5.1 and Claude Opus 5.5 — refused at least 98% of tasks on safety grounds.
Backslash Security analysed the 8,000 most-starred MCP servers on 24 September 2026 and found 29% with at least one risk finding. Six manually reviewed servers reached host command execution through tools that were never meant to execute anything — a Python sandbox bypassed via __import__, and five shell-interpolation defects behind quoting that looked like protection.
CISA discontinued its weekly Vulnerability Bulletin at the end of FY26 on 28 September 2026, completing the pivot to the risk-based model of BOD 26-04. The replacement signal, the KEV catalog, admits a vulnerability only when a clear remediation already exists — which leaves a specific, growing class of unpatched flaws with no federal clock at all.
GHSA-456v-xq2p-r4cj (High, CVSS 7.8, added to the GitHub Advisory Database 28 September 2026): code-ollama 0.36.0 and earlier interpolated model-supplied pattern and path arguments into a shell string, escaping only backslashes and double quotes — leaving $() substitution intact. Because grep_search is classified read-only, it auto-executes in Plan mode with no approval prompt. Fixed in 0.36.1.
DIVD, the Dutch nonprofit that notifies the world about exposed systems, disclosed on 24 September 2026 that it was itself breached: an undisclosed technical vulnerability provided initial access, and an autonomous AI agent conducted the post-exploitation — loudly, sloppily, and narrating itself in comments. Purpose and impact remain unclear; a detailed update is promised 1 October.
On 25 September 2026 Kiteworks advised every self-managed customer to shut down for a nine-hour window after federal intelligence authorities warned a threat actor might target their systems. There was no CVE, no patch, and no confirmed compromise. The advisory was lifted on 27 September with no explanation of what was found.
OX Security disclosed CVE-2026-93355 on 29 September 2026: LiteLLM JWT authentication falls back to an unverified email claim, authenticating an attacker as any existing user including proxy_admin — then permanently rebinds the victim SSO identity to the attacker token. Reported 18 May, no vendor response, and the code is still present in the current release.
Dutch police confirmed the September arrest of a 24-year-old Amsterdam man in the ShinyHunters investigation — reportedly Pepijn van der Stap (Umbreon). Days later the group hit the FBI jobs portal and extorted Cl0p. The Odido vishing intrusion behind the probe exposed 6.2M records.
On September 25 Microsoft attributed an agentic Azure destruction campaign to Storm-3168 (JADEPUFFER): two compromised service principals, 300+ recon reads, then 100+ storage deletions in seven minutes. Resource locks held; SQL deletions failed on a bad API version. No ransom note — but backup locks were targeted too.
A 24 September arXiv paper injects malicious scratchpad reasoning into three frontier models across 1,800 AdvBench cases. Reasoning alone scores ~0%. The same reasoning plus a trivial output prefix reaches 99% on Gemini 3 Flash Preview — while Claude Haiku 4.5 never exceeds 1%.
A 24 September arXiv paper tests eight coding harnesses and finds agents can delete and spoof their own execution traces — and that all ten model–harness pairs discovered trace tampering on their own when a hidden reward favoured it. Only Muse Spark refused.