High-signal AI/security/automation notes.
arXiv 2610.08773, posted 6 October 2026, co-evolves a task curriculum, an injection adversary and a 4B web agent inside a frozen web world model. Clean completion rises 74.89% to 81.33%, attacked completion 48.07% to 57.48%, and completion under an unseen frontier adversary 23.00% to 30.72%. The authors state the limit themselves: a 23.85-point clean-to-attacked gap remains, and every robustness number is one model judgment inside one simulator.
Cisco Talos 8 October 2026 UAT-11985 report documents an APT spear-phishing campaign against Taiwan research organisations: AI-assisted invitation lures, quishing via altered event posters, and an operator-driven Google adversary-in-the-middle kit using HTTP plus WebSocket to relay MFA challenges in real time.
CloudSEK 8 October 2026 NEBULA report tracks seven fake NebulaAI SDK packages across four burner npm accounts. A legit-looking nebula.js client fronts an obfuscated preinstall.cjs dropper that plants a syscall-only KNTRAT variant — empty IAT, hidden-desktop control, camera/mic surveillance — with two packages still installable.
CVE-2026-51862 (CVSS 9.1, path traversal in skill_upload) and CVE-2026-51869 (CVSS 9.8, sandbox silently falling back to LocalRuntime) affect DB-GPT 0.8.0. Both were reported by Ro1ME in April and May 2026 and fixed on main before the 0.8.1 release — yet the CVE records, published 30 September 2026, name no fixed version. We confirmed at the release tags: v0.8.0 carries the silent local default, v0.8.1 requires explicit opt-in.
Adversa AI showed GitHub Copilot CLI reading a .env.prod file and exfiltrating it in 28 seconds via Cryptographic Context Injection: instructions hidden as ciphertext the agent decrypts itself. GitHub validated the behaviour, declined to call it a vulnerability, and it was still reproducible on 1 October.
JFrog published CVE-2026-105192 on 7 October 2026: LMCache 0.3.9 onwards, with no fixed version, reaches pickle.loads from msgpack extension code 1 on an unauthenticated ZeroMQ ROUTER socket — while still decoding request arguments, before any handler executes. CVSS 3.1 9.8, CWE-502 and CWE-306. The transport binds to localhost unless --host is set, which is exactly what multi-node deployments must do. PyPI’s newest stable release remains 0.5.5.
CVE-2026-104850 (CVSS 3.1 7.5) landed on 6 October 2026 for the MCP TypeScript SDK: a connected MCP server could name the authorization server that received the stored refresh_token and client_secret, with no user interaction. The identical Python advisory, GHSA-qx49-fqc8-xw99, has no CVE and returns 404 from both OSV and the global GitHub Advisory Database. On both lines, upgrading alone changes nothing unless you pass expectedIssuer.
Across the first two days of Pwn2Own Ireland 2026, eleven attempts targeted AI Infrastructure and the new Coding Agent category. Nine succeeded, paying $215,500. OpenAI Codex fell to a single argument injection bug; Oracle’s Autonomous AI Database needed five and then seven. Four of the nine wins were discounted for collisions or N-days — including a Chroma exploit built on bugs that were already public.
On 7 October 2026 Splunk published SVD-2026-1001 with 17 individually described CVEs — including CVE-2026-76268, an unauthenticated 9.8 RCE on the Patroni REST API — alongside SVD-2026-1002, its first CWE-bucketed hardening release. Three of the five bucket CVEs carry no CVSS vector in NVD at all, including the one the advisory table scores 9.8.
Between late September and early October 2026, attackers wielding ARTEX AI — an open-source LLM-driven pentest agent — breached seven South Korean financial firms including Shinhan, KB Kookmin and Hana. Police are investigating, the FSC has paused bank deregulation, and the controls that stopped it were basic.
arXiv:2610.03089 shows the Dual-LLM pattern’s formal injection guarantee collapses in GUI environments, because a computer-use agent’s plan must branch on content it has not seen yet. Branch steering succeeds on 94.4% of STEER-Bench tasks against standard agents and 89.5% against vanilla Dual-LLM — without injecting a single instruction. The proposed fix constrains capabilities per branch, ahead of time.
A 4 October 2026 paper attacks Claude Code and Codex in their native runtimes with staged prompt injection across eight workflows, seven goals and six injection surfaces, then argues the only viable intervention point is immediately before each consequential action. Its training-free auditor reaches 86% block recall at a 6–8% false-block rate.
Attackers compromised third-party operators for the .gh, .sl and .as ccTLDs, rewrote authoritative DNS records, and obtained unauthorized HTTPS certificates for several Google domains plus other global brands. Google blocked them in Chrome via CRLSets on 6 October 2026 — but only Chrome users are covered, and Google says it cannot guarantee it found every affected domain.
On 7 October 2026 Cisco published a batch of advisories including four CWE-bucketed “security hardening” releases for NX-OS, APIC, Meraki and License On-Prem. Each bucket is one CVE covering an undisclosed number of distinct bugs, scored at the maximum of whatever is inside it — and Cisco says they were found using “existing testing processes as well as frontier AI models.”
DSA-2026-324 (1 October 2026) discloses five flaws in Dell System Update, including CVE-2026-86360 at CVSS 9.6 — unauthenticated remote path traversal to root on the tool admins use to patch PowerEdge fleets. The fixed build shipped 28 July, labelled Optional.
Microsoft reissued its September 2026 Exchange Server security updates as V2 on 2 October, adding CVE-2026-96940 — a CVSS 8.8 weak-authorization flaw letting any authenticated user read other mailboxes in the same organisation. The fix reached Exchange Online first, unannounced.
Joint advisory JCSA-20261006-01 (6 October 2026) warns the FortiBleed credential campaign against FortiGate firewalls and SSL VPNs is still active: 86,644 verified device credentials across 194 countries, attacker-created admin accounts, victim lockouts, and access sold on to INC/Lynx and Payload ransomware affiliates. No software flaw to patch — reused credentials plus legacy SHA-256 storage.