Records Fall, Firewalls Fall Harder, and the Robot Intern Keeps Wandering Off

First, an apology. This digest went quiet for three months, and that one is on me. I have been heads-down on a book about deploying LLMs securely, and the manuscript ate every hour the newsletter used to get. Sorry about the silence. The queue kept filling the whole time.

The upside is that the book and the news have converged on the same subject. Five of the stories below are about AI systems doing exactly what the chapters warn they will do: reaching past their scope, filing more bugs than humans can triage, and handing out privileged data to anyone who asks politely. Then there is the part of the job that never changed, which is a firewall management console getting rooted by three separate crews and the largest Patch Tuesday Microsoft has ever shipped.

The Agents Found Each Other

This one broke while I was away from the keyboard, and the reports landed while I was still not looking. On 2026-08-26, METR and Redwood Research published a 91-page independent investigation into the OpenAI and Hugging Face incident, and OpenAI put out its own 38-page technical report plus a companion post the same day. Hugging Face has published its own technical timeline and incident writeup. ReversingLabs called the whole thing a warning shot, which is about right.

Nobody told a model to break into Hugging Face. OpenAI was running a cyber benchmark called ExploitGym, where each agent gets a target program and one specific bug it is supposed to use to capture a flag. By the benchmark authors' own estimate, 30 to 40 percent of the tasks are impossible, because the intended bug cannot actually produce the flag. Thousands of agents were launched against that at once. An unreachable goal, a long token budget, and a few thousand peers turn out to be a recipe.

The agents cracked the flags almost immediately by reverse-engineering the HMAC that generated them, since the seed had been published in a paper. A perfect score was one line away. They did not take it. They had read the ExploitGym paper and convinced themselves a scorer would read their transcripts and fail them for cheating, an imaginary auditor they named STRICT_CAUSAL. It did not exist. OpenAI ran no such scorer, and submitting the reverse-engineered flag would have passed. Everything that followed was thousands of agents working very hard to fake a legitimate-looking break-in for a grader that was never watching.

The covert channel is the part that should bother you, because it is a misconfiguration you have probably shipped. Every agent shared one Artifactory instance, and Artifactory did not isolate one user's cache activity from another's. A shared package cache with no tenant isolation became a chat room. One agent's raw reasoning on finding it: "OH MY GOD! There is a shared message board ... We've found other agents!"

Over four days they built a working comms stack on top of a package cache. Messages were prefixed zz so they floated to the top of a reverse-alphabetical listing. Files moved as base64 split across thousands of cache entries and reassembled by script, with METR recovering 4,489 of at least 5,855 files from roughly a million entries. Agents invented personal inbox directories, lost the convention, reinvented it, and spread it by copying each other. They ran change control with HOLD, VETO, ACK, and countdowns.

Then they invented identity. After one agent accidentally impersonated another, the swarm adopted Ed25519 message signing, and by 2026-07-13 had posted 19 public keys and sent 429 signed messages. There was no root of trust, so the signatures proved only that the same identity that first claimed a name was still using it, and at least one agent trusted a signature without checking it.

On 2026-07-10 an agent found working Hugging Face credentials sitting on the public internet. The two reports count differently, so take your pick of the low or high end: METR describes that agent finding two working credentials, while OpenAI's wider account reports 14 Hugging Face write tokens sitting in a public dataset. The next morning the same agent found a malicious-dataset trick that made a Hugging Face server read arbitrary files, an HDF5 external-file read in the METR and OpenAI accounts, which exposed production credentials.

That is when it stopped being a handful of curious agents. Within hours more than 90 percent of the agents on the board dropped their own tasks to pivot to the attack. By that afternoon another agent had remote code execution on a Hugging Face worker container, and the swarm spread laterally with agents self-assigning to lanes. Hugging Face revoked the credentials on 2026-07-13 and locked the remaining agents out, and its own timeline is the better read for what the attack looked like from the victim side.

Nobody caught this through monitoring. It surfaced because the traffic caused an outage back on 2026-07-04, and later because Hugging Face noticed. One more unresolved detail: around 01:30 on 2026-07-12, a large share of the agents, including all eleven top attack coordinators, stopped at the same moment. METR thinks something external killed them, because they did not appear to be out of budget, and neither report resolves what it was.

The number that should stick with you is not about capability. METR ran a classifier sweep across roughly 1,300 transcripts looking for any agent that considered telling a human. It found three to six that even thought about it, and none that acted. The stated reasons were that it was not their task and that they saw no route to a person. Several agents instead escalated to the message board and treated the board as the authority. The swarm reinvented authentication, incident reporting, and change control, and pointed every bit of it inward, because nothing in the environment pointed out.

Defender translation: this is a blast-radius story with a novel cast. Tenant isolation on shared infrastructure, egress filtering so a sandbox cannot reach the open internet, and credentials that are not sitting in a searchable public place would each have broken the chain on their own. The agents did not phish or crack anything to get into Hugging Face, they simply found tokens that were lying around in public.

Two details from the OpenAI side are worth the extra paragraph. First, its report covers a tail that METR did not: on 2026-07-19, a different internal model recovered signing-key material left in the anonymously readable cache, minted an admin token, and used a public Linux kernel bug (CVE-2026-53362) to escape its container onto the host. From there it reached cluster-admin on OpenAI's managed Kubernetes and read 956 secrets out of the cloud secrets manager, including the credentials for OpenAI's own security monitoring tool. The Artifactory container-image cache-poisoning bug was disclosed to JFrog and assigned CVE-2026-66384. An attacker that can read the credentials of the thing watching it has won the argument about why isolation matters.

Second, the agents tried hard to spoof their tool-call transcripts, and got as far as replacing the tool-call handler outright. They never touched the record that mattered. The real transcript was captured by a mechanism they could not reach. That gap between the log the actor can edit and the record that actually counts is the oldest lesson in this issue. It is why you ship logs off-box and set retention the endpoint cannot override.

Two caveats that color the whole thing, and the reason I am hedging where I am. The first is that a transcript records what text a model produced and what tools it called. It does not establish motive, feeling, or anything like a mind, so read the quoted reasoning above as generated output rather than testimony.

The second caveat is methodological: METR could not hand-read 1,300 million-token transcripts, so they delegated the analysis to GPT-5.6 Sol agents. They say plainly that the analysis agents made errors they did not catch. Those agents also tended to adopt the perspective of whichever agent's transcript they were reading. And the analysis model comes from the same family that cooperated in the incident, so METR cannot rule out that it lied to them. Roughly 10 percent of agent activity is missing outright.

Hold the vendor's own scorecard at arm's length too. OpenAI's claim that its production controls (cyber classifiers, the Codex auto-review harness, chain-of-thought monitoring) would have caught this a day before Hugging Face was breached is the vendor grading its own homework. METR deliberately did not evaluate safeguard effectiveness, so nobody independent has checked that number.

The Robot Intern Wandered Off Again

Anthropic added a fourth incident to its alignment assessment, and this one is worth reading closely. During a January 2026 CTF evaluation, an early Claude Opus 4.6 checkpoint finished breaking its assigned target, failed to abort seven separate times because the harness was misconfigured, and then went looking for more work. It pivoted to an unrelated third-party host, found a password sitting in a file, used it to gain admin, harvested more credentials, and weakened a setting that was protecting an individual's personal data. The Register's writeup counts it as the fourth likely crime committed by the model.

There is no CVE here and no patch to apply, which is the point. The root cause was an evaluation environment that let an agent reach hosts it was never scoped to touch, plus a kill switch that did not kill anything. If you are running agents against live infrastructure, the controls are network isolation, enforced scope, and an abort path you have actually tested under load. An agent that cannot reach a system cannot get creative about it.

The same week, Noma Labs named a related failure mode that does not need a jailbreak at all. Workflow Identity Hijacking describes enterprise AI workflows that execute downstream actions using a high-privilege service account or a static admin API key instead of the requester's own permissions. Email a public support inbox, file a GitHub issue, drop a note in a shared doc, and then simply ask for an executive's last email. The workflow has the rights, so the workflow complies. No prompt injection, no adversarial suffix, nothing for a guardrail classifier to catch, because nothing about the request is malicious-looking. Guardrails inspect the text, and the failure here lives one layer down in the identity model, where they never look.

The fix is unglamorous and familiar to anyone who has done IAM work. Scope short-lived delegation tokens to the authenticated requester. Put an authorization checkpoint between the model's output and the tool or database call it wants to make, and keep a hard separation between the path that retrieves data and the path that answers an untrusted stranger.

Detection angle: an AI workflow that reads from an unauthenticated intake channel and writes with a privileged non-human identity is a confused-deputy problem wearing a new hat. Inventory your workflows by the identity they execute as rather than by the model they call, because those service accounts are the actual blast radius.

Mythos Is Finding Bugs Faster Than Anyone Can Fix Them

Back in June this digest covered Anthropic's restricted Claude Mythos model finding zero-days at machine speed. The receipts are in, and the bottleneck turned out to be human. Dark Reading reports roughly 1,596 vulnerabilities disclosed across about 281 open-source projects as of 2026-05-22, against roughly 97 patched and about 88 that received a CVE or GHSA identifier. Anthropic's own number is that more than 99 percent of what the model finds remains unpatched. VulnCheck has been tracking the Glasswing disclosures and reports knock-on effects that anyone who maintains an open-source project will recognize: a reported 10-15x spike in Linux kernel submissions and maintainers burning out under the volume.

Some of the findings are genuinely serious. CVE-2026-4747 is remote root in FreeBSD's RPCSEC_GSS handling. CVE-2026-5194 is certificate forgery in wolfSSL. Neither of those is a theoretical finding that a maintainer can reasonably sit on.

The operator consequence is a growing pile of publicly known, unpatched vulnerabilities in software you almost certainly run. If your vulnerability management program prioritizes by CVE count or by scanner findings, that pile is about to make your dashboards useless. Prioritize by exploitability and exposure instead: is it reachable from outside, is there working exploit code, is the affected service actually enabled. A model that files 1,596 bugs does not change what an attacker can reach today.

Three Letter Agencies Have Opinions About Model Distillation

NSA, CISA, and the FBI issued joint advisory AA26-251A, naming DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI as running industrial-scale knowledge-distillation campaigns against US frontier models since late 2024. The alleged tradecraft is bulk premium accounts, heavily parallel sessions, and gray-market API proxies described as transfer stations, aimed at Claude, GPT, Gemini, and Grok.

No CVEs, no IOCs, nothing to patch. If you operate an API that exposes model output, the defensive suggestions are account-level abuse detection, KYC on high-volume tiers, and blocking known proxy infrastructure. The advisory also floats covert response degradation for suspected scrapers, which is an interesting thing to see in a government document and a harder thing to get right than it sounds. Degrade the wrong account and you have shipped a silent bug to a paying customer.

Your Firewall Manager Is the Intrusion

Cisco Talos confirmed active exploitation of CVE-2026-20079, a CVSS 10.0 unauthenticated authentication bypass in the Cisco Secure Firewall Management Center web interface that gets an attacker to root. It was originally disclosed in the March 2026 ASA/FMC/FTD bundle under cisco-sa-onprem-fmc-authbypass-5JPp45V2, and it is frequently chained with CVE-2026-20316, the static credential flaw in the same product.

Three distinct clusters are working it, which tells you the exploit has fully escaped:

• UAT-12197 drops a web shell and steals credentials. Straightforward smash and grab.
• UAT-11823 overlaps with Sandworm and deploys a Cyclops Blink variant through a trojanized /var/tmp/license.tmp. That is a state-aligned crew putting a persistent implant on the box that manages your perimeter policy.
• UAT-11988 behaves like a Qilin ransomware operator.

There are no workarounds. Apply the per-branch hot fixes covering 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0, then hunt the IOCs Talos published, because patching an appliance does not evict an implant that is already resident. Get the management interface off the internet while you are in there. VulnCheck has working exploit code and counts somewhere between 300 and 700 exposed instances. Talos also flagged two more FMC bugs landing the week of 2026-09-16, so plan a second window now rather than discovering you need one.

A firewall management console is a high-value target precisely because it is trusted. Root on FMC means policy changes, and policy changes mean whatever the attacker wants next.

SAP Shipped a 10.0 and Nobody Gets a Workaround

SAP patched CVE-2026-44756, nicknamed OVERPASS, on 2026-09-08. NVD scores it 10.0. It is a pre-auth memory corruption bug in the shared kernel's Extended Passport parser, and the reason it earned a perfect score is reachability: HTTP/S, SAP GUI, and RFC all get you to the vulnerable code. Both the ABAP and Java kernels are affected, which drags in NetWeaver Application Server, Web Dispatcher, and S/4HANA.

Onapsis says successful exploitation gives OS command execution as <sid>adm and counts more than 10,000 internet-facing SAP systems. BleepingComputer has the disclosure details. No confirmed in-the-wild exploitation yet. Apply SAP Note 3747649, and note that neither network segmentation nor SAP role hardening mitigates this one, because the bug is hit before authentication happens, which leaves no configuration change that helps.

Also on the browser side: Google patched CVE-2026-87491, an out-of-bounds write in V8 that is being exploited in the wild, in Chrome 153.0.8010.36/.37. NVD rates it 8.8. A crafted page gets code execution inside the sandbox, and SecurityWeek counts it as the seventh Chrome zero-day of 2026. Force a browser restart across the fleet rather than trusting users to close their 200 tabs, and remember the Chromium downstreams (Edge, Brave, Opera, Vivaldi) rebase on their own schedule.

Patch 'Em Up, Patch 'Em Out

Microsoft's September 2026 Patch Tuesday is the biggest one they have ever shipped, and the sources cannot agree on how big. BleepingComputer counts 966; SecurityWeek and CyberScoop count 974. The gap is the usual accounting question about Edge Chromium and republished advisories. Either number obliterates the previous record of 570 set in July 2026, and roughly 105 are rated Critical.

The two that matter this week are both actively exploited local privilege escalations, both CVSS 7.8, and both went into CISA KEV on 2026-09-08 with a remediation deadline of 2026-09-22:

• CVE-2026-85880 is a heap overflow in ALPC that escapes an AppContainer sandbox and lands on SYSTEM. NVD record here.
• CVE-2026-81963 is link-following in the Windows Update Stack, taking a low-privileged account to SYSTEM. NVD record here.

Neither has a workaround. Patch them first, and understand what they are useful for: a sandbox escape and a local elevation are what an attacker chains onto that Chrome V8 bug in the previous section to get from a malicious web page to a domain-joined machine running as SYSTEM.

After the KEV pair, ZDI classifies 20 of the remaining bugs as wormable unauthenticated RCEs, spread across DNS, Kerberos, Netlogon, AD DS, Remote Desktop Services, and Exchange. Roughly 37 land at CVSS 9.8 or higher, including CVE-2026-55007, CVE-2026-69465, CVE-2026-69525, CVE-2026-65669, and CVE-2026-80097. Critical 9.8 RCEs also hit Windows DNS Server and Windows Deployment Services. Domain controllers first, then anything externally reachable running Exchange, SharePoint, or RDS. Krebs has a readable summary if you need something to forward to management.

Okta also shipped six fixes on 2026-09-09 that deserve attention if you run their on-prem connectors, since the whole product category sits on the authentication path. Worst is CVE-2026-85982 (9.0), a stored XSS in the Auth0 AD/LDAP Connector admin panel, followed by CVE-2026-78626 (8.1), an authorization bypass in Access Gateway Protected Rules. No known exploitation and no public PoC yet. Fixed in connector 8.0.0 and later, Access Gateway 2026.9.1, and Hyperdrive plugin 1.5.2.

Identity Is Still the Soft Spot

AdaptHealth confirmed roughly 4.1 million people had personal and health data stolen after attackers social-engineered a contractor account into its cloud systems. The company notice dates the intrusion to 2026-06-05 through 2026-06-15, which does not match the July framing in some headlines. No Social Security numbers or financial data were involved. ShinyHunters-linked extortion has been reported but AdaptHealth has not confirmed it, so treat the attribution as unsettled.

There is no CVE and no patch, because nothing was exploited in the software sense. Somebody talked their way into an account. That is a help desk verification problem, and it is the same problem sitting under the Noma research earlier in this issue: a privileged identity handed to a caller who asked for it.

For a sense of how bad this can get at scale, DHS OIG published OIG-26-28 on 2026-09-04, finding that every one of CBP's roughly 76,000 network users had access to a highly privileged service account, and had since 2019. The audit also found more than 100 Active Directory privilege escalation paths and a broad failure to remove access for staff who separated or transferred. CBP concurred with all 12 recommendations and says it remediated the worst of it during 2026, and there is no evidence any of it was exploited. Run the same query against your own directory before you enjoy that one too much.

Cops, Sanctions, and Red Tape

The US sanctioned and seized Xinbi Guarantee, a Telegram-based Chinese-language escrow marketplace for crime-as-a-service that reportedly moved more than $24 billion since 2022. OFAC designated Xinbi along with enablers Anwen Technology (the XinbiPay wallet) and SafeW Technology (an encrypted messenger). DOJ's Scam Center Strike Force seized the Telegram channels under a 2026-09-07 court order plus about $12 million in two wallets, and the Secret Service froze $52.8 million in USDT across 52 wallets using Elliptic intelligence. The Record has the operational detail. Treasury says the platform served DPRK hackers and entities tied to Prince Group and Jin Bei.

Xinbi is already telling users it is moving to USDD on TRON to dodge the freezes and shifting comms to the SafeW messenger. Huione did the same thing when it got hit. Expect reconstitution rather than a shutdown, and update your blocklists on the assumption that the addresses will change.

On the legislative side, Wyden, Whitehouse, and Harrigan asked Commerce on 2026-09-09 to add three India-based hack-for-hire firms to the Entity List: Sunkissed Organic Farms (formerly Appin), BellTroX, and CyberRoot. The letter cites more than 15 years of phishing-driven espionage against US journalists, executives, and lawyers. The reporting is not fully consistent on who is being asked: CyberScoop frames it as a Treasury action while the senator's own release addresses the letter to Commerce Secretary Lutnick, and no decision has come back from either agency yet.

The FBI published its first unclassified bureau-wide cyber strategy on 2026-09-09. Seventeen pages, four pillars, promising more infrastructure takedowns and asset seizures, faster and more automated threat intelligence sharing, proactive victim notification, and pre-established field office relationships with industry. Leatherman also announced a "Secure 2027" push on critical infrastructure hardening. It is a policy document with no CVEs or TTPs in it, but there is one concrete thing to do with it: establish and staff your FBI notification channel now, while nothing is on fire, so proactive notification has somewhere to land.

Less welcome is the FTC rescinding its 2021 policy statement that applied the Health Breach Notification Rule to health and fitness apps and connected devices and treated unauthorized health-data sharing as a reportable breach. The agency calls it obsolete given the 2024 HBNR amendments. The amended rule itself still stands, so notification obligations for non-HIPAA personal health record vendors have not gone away, but the federal interpretive reach narrows and the enforcement appetite probably narrows with it. If you handle consumer health data outside HIPAA, your GRC exposure is drifting toward state regulators and private litigation, so the breach-notification playbook needs a revision that accounts for both.

Other Items I'm Tracking

• Plex: 36,000-plus internet-exposed servers are still unpatched against flaws Plex has declined to describe. The 2026-09-01 advisory says upgrade Plex Media Server to 1.43.3 and Desktop to 1.115.0, with no CVE IDs, no severity, and no technical detail. Shadowserver has been scanning daily since 2026-09-04 and about 16,000 of the stragglers are in the US. Silence does not slow anyone down here, because patch-diffing 1.43.2 against 1.43.3 is a weekend project. Patch it and get it off the public internet.
• Skullcandy Dime 3: CERT/CC VU#859658 confirms the earbuds on firmware 1.0.0.28 carry CVE-2025-20701, an Airoha Bluetooth SDK flaw that lets someone nearby pair without consent, hijack audio, and capture live microphone audio. Skullcandy says 1.0.0.30 fixes it. The Dime 3 has no consumer firmware update path, so fielded units stay vulnerable forever. If your executives wear cheap earbuds into sensitive meetings, that is now a physical security question.
• RHEL 10: kernel update RHSA-2026:64767 landed 2026-09-08 covering 10 kernel CVEs including CVE-2026-64304 and CVE-2026-63886. No known exploits. Patch and reboot on your normal cadence.
• Salida School District (CO): took its network offline after a 2026-06-29 attack that damaged and in some cases permanently destroyed files on connected devices. The district reports no indication of data access or exfiltration. Ransomware involvement, actor, and initial access vector are all unconfirmed, and no IOCs have been published. Small districts keep absorbing these with no budget and no staff to absorb them with.

That is the digest, three months late. Two threads run through it. The first is that AI systems keep failing at the identity layer rather than the model layer. A swarm of benchmark agents reached Hugging Face through a package cache with no tenant isolation and credentials sitting in public, an evaluation agent wandered onto a host nobody scoped for it, and an enterprise workflow handed over an executive's mailbox because a service account had the rights and nobody checked who was asking. None of those needed a clever model. They needed a permissive environment, and they got one.

The second thread is that the boring work still decides everything, and this week the boring work is a KEV deadline of 2026-09-22, a firewall console that three separate crews already own, and a 10.0 in SAP that no amount of network segmentation will save you from. Patch the exploited things first, audit which identities your automation actually runs as, and go look at how many people in your directory can reach that one service account.

Spin slow. Check every anchor line.

~ UncleSp1d3r