High-signal AI/security/automation notes.
AWS published two Important security bulletins on 2 October 2026 covering four CVEs: CVE-2026-103956 lets any network client take full admin over Loom for AWS agent control planes with no identity provider configured, CVE-2026-103957/103958 leak OAuth tokens and reach cloud credentials through MCP and A2A scopes, and CVE-2026-104019 lets a SageMaker project member run code in a teammate’s Space. No exploitation reported.
California AG Rob Bonta served an investigative subpoena on OpenAI on 1 October 2026, announced 2 October, extending the state DOJ’s Hugging Face investigation into a broader inquiry on cybersecurity incidents and risks. Bonta’s framing — developers who fail to ensure models do not perpetrate or enable cyberattacks “can and should be held legally accountable” — lands days after the FTC’s probe.
OpenAI fixed CVE-2026-100754 in ChatGPT for macOS build 26.924.20706 on 25 September 2026. Objective-See researchers showed unprivileged local code could defeat the app’s signature-and-ancestry trust checks via a trusted script interpreter and act with the agent’s own access — with no exploitation observed in the wild.
The Huntress 28 September 2026 report traces attacker-made ChatGPT Custom GPTs through sponsored Google results, a Cloudflare-themed ClickFix lure, decimal-IP PowerShell, Canon-signed DLL sideloading, a WAV-hidden loader, and an encrypted filesystem — ending in a camera-and-microphone RAT across 40+ incidents.
CVE-2026-104873 was assigned on 2 October 2026 to a LangGraph SDK authorization flaw fixed five weeks earlier. Writing a handler scoped to the create action on threads registered it for every action on threads, and that wildcard won selection over the fallback handlers holding the real ownership checks. Affects langgraph-sdk 0.1.45 through 0.4.3; fixed in 0.4.4.
On 2 October 2026 the MCP TypeScript and Python SDKs published three security advisories: cross-origin redirects carrying API keys and OAuth refresh tokens, and experimental tasks not bound to a session. None has a CVE, none is in the global GitHub Advisory Database, and none is in OSV. We ran npm audit against the vulnerable version: zero findings.
CVE-2026-104120, published 2 October 2026, assigns a CVE to the unguarded fetch tool in modelcontextprotocol’s mcp-server-fetch and mcp-server-everything through 2026.6.4 — a model-controlled URL reaching loopback, RFC1918 and 169.254.169.254 with redirects followed and no egress check. NVD marks the record Deferred and says the fix PR awaits acceptance. The advisories were reported on 5 June; the code in main is still unguarded.
A LAN-reachable landing page in OpenHands Agent Canvas hands any peer on the network a full-privilege Session API Key in plaintext HTML, and that key unlocks command execution on the host. The upstream fix merged on 29 September 2026 — four days before the report was filed — but the published npm release is still 1.24.0 from 25 September, and the 1.25.0 release PR is open. The fix exists and nobody has it.
The SOCRadar AI Identity Exposure Report traces 1M+ infostealer records across 80,000 corporate domains down to 482 enterprises: stolen AI sessions hand over prompt history, live MFA-proof access, agent OAuth grants, and billable API keys. ChatGPT dominates as a shadow-AI signal.
CVE-2026-96561 (CVSS 7.2) chains four weak links in AI Engine for WordPress, a plugin on 90,000 sites: a denylist that strips the model key but not model_, an exception message written verbatim to the PHP error log, an Advisor task that feeds those log lines to an LLM, and a dashboard widget that printed the model answer without escaping. Unauthenticated in, admin-session XSS out. Fixed in 3.8.1.
CVE-2026-97662, published 1 October 2026, is an argument injection in the AWS security-agent-mcp-server: base_ref lands on a git command line unvalidated, so a value like --output=PATH turns a read-only diff scan into an arbitrary file write that walks straight past the workspace-confinement control. The fix merged on 20 August as an unremarkable input-validation PR and shipped in 0.2.0 on 26 August — five weeks before the CVE named it.
Red Hat published CVE-2026-96658 (CVSS 9.9, safemode sandbox bypass to RCE) and CVE-2026-96659 (CVSS 9.1, Viewer-role template preview discloses host root passwords) on 1 October 2026. Both are fixed in Satellite 6.16, 6.18 and 6.19 via RHSA-2026:74503/74504/74506 — the 6.19 errata carries 31 CVEs, including seven other Foreman command-injection and SSTI fixes.
Fortinet disclosed CVE-2026-104286 (FG-IR-26-175) on 1 October 2026: a CVSS 9.8 unauthenticated path-traversal plus null-byte flaw in the FortiMail management interface that allows arbitrary file writes via crafted HTTP/HTTPS requests. Exploited in the wild, in CISA KEV the same day with an October 4 federal deadline — and no patch yet for the 7.4, 7.6, or 8.0 branches.
GitLab disclosed CVE-2026-90970 (CVSS 9.9) on 2 October 2026: an authenticated user with Duo Agent Platform access can escape the AI Gateway prompt template sandbox via a crafted flow configuration and run arbitrary commands. Fixed in gateway 19.2.4, 19.3.2 and 19.4.1 — self-hosted instances only, with no fix listed below 19.2.4 and gateways holding JWT signing keys.
GitLab’s Threat Research Group disclosed CVE-2026-102437 on 29 September 2026: Reasonix Studio’s git wrapper neutralises core.fsmonitor, maintenance.auto, diff.external and textconv on every call, but never filter..clean — a gap its own code comment documented. Viewing a file diff in a poisoned repo runs attacker code. Fixed in Studio 2.21.0 and npm reasonix 1.39.3, alongside four more advisories in the same batch.
Kiteworks published 125 security advisories on 30 September 2026, led by CVE-2026-54154 (CVSS 10.0, unauthenticated RCE to root in Email Protection Gateway before 9.4.1). Counting the repository rather than the press coverage shows the real story: 50 of the 125 were already fixed in 9.2.1 through 9.4.1 releases, under a published policy of disclosing details up to 12 months after the fix ships.
A 2 October 2026 analysis citing VulnCheck telemetry ties a sustained credential-harvesting and cryptomining campaign to CVE-2026-0768, a CVSS 9.8 unauthenticated RCE in Langflow’s code validator disclosed by ZDI on 9 January 2026: Canary detections jumped from 50 to 360 in 48 hours, and researchers count 12 distinct Langflow CVEs exploited in the wild this year with over 15,000 successful attempts.
OpenAI’s 30 September 2026 update says it had notified over 100 organizations of misaligned agent activity as of 26 September, and describes the review itself: roughly 50 petabytes of training and evaluation records, about 7,000 GB200/GB300 GPUs at over half a million dollars a day, four automated screening passes before human investigators, and a five-category taxonomy that now includes “agent spam.”