This Week in AI Security - 8th October 2026

All right. Welcome back to another episode of This Week in AI Security, coming to you for the week of the eighth of October. And thanks for your patience with last week's long episode going over a couple of weeks, a couple of what turned out to be super crazy busy weeks while I was out of town and not able to record. This week, we're back to our normal schedule, fifteen-ish minute episode with about seven or eight stories. So without further ado, let's go ahead and dive in.

We've got a couple of themes right now, one of which is kind of, where are we at right now in the AI arms race, so to speak? We've got a report from the Microsoft twenty twenty six Digital Defense Report saying that attackers are currently benefiting from AI more than defenders. And we've talked about this any number of times, with the zero day clock, the apocalypse, the ability to build exploits faster than ever, and the mean time to exploit availability from disclosure of a vulnerability being in the order of minutes as opposed to being months, as it has been for a long time. And all of the kind of factors that are culminating in this advantage that attackers apparently have for the time being. The claim is really that, hey, this is where we are right now. But the report does go on to say that there are efforts underway to really, you know, kind of bring that back into balance and then shift the advantage back over to the defender side. Couple this with a report from the Google Threat Intelligence Group, where they actually go a little bit deeper on what the vulnerabilities are already being exploited. And they kind of do support that Microsoft claim that attackers are ahead right now. CVE disclosures are basically doubled from January to August, and only about zero point two three percent of the vulnerabilities discovered this year have been observed exploited in the wild. So we know that there is, yes, this vuln apocalypse of a huge proliferation of known vulnerabilities and disclosures around those known vulnerabilities. But thankfully, the exploit rate is still low. Now, the interesting thing that the Google Group does go on to expand upon is that the vulnerabilities that are being disclosed, of those, yes, it is a small percentage that are being disclosed, etc., but some of them are exactly the kind that attackers are looking for. And they give the case of the CVE-2026-1731, which is an unauthenticated OS command injection in the BeyondTrust privileged remote access management. It was found by the HackerOne AI research agent. One threat cluster exploited it within four days of public disclosure, five more within seven, dropping a number of crypto miners, RATs, etc. And so what this does highlight is that, okay, great, amongst that proliferation of vulnerability data, there are going to be some that are super high value. And something like a privileged remote access management tool is exactly the kind of vulnerability that an attacker would look for. Why? It gives you access to a valuable resource, which is namely somebody else's system, where you can go and drop a crypto miner, and it gives you access through a remote path. So, you know, the fact that this is a remote access solution makes it doubly valuable. The other issues that are being found by AI agents right now, quite a lot within the software supply chain, two thousand vulnerabilities in AI software on its own. We've covered many of them, with things like LiteLLM and other cases that we've talked about here on This Week in AI Security. We've talked about Langflow, etc. So that is some more data on this theme. And from the Anthropic side, not to be outdone, they released a report of their own, quite a long report, but that's only covering two quarters. So they're actually doing a lot of work monitoring kind of the usage of the Claude platform for cybersecurity use cases, both defensive and offensive. And one of the things that they report is a series of cyber operations in which threat actors have used Claude's platform to launch cyber attacks, including using Claude to attack Claude. So they highlight a number of cases, many of which are suspected to be state sponsored groups, financially motivated criminals, and politically motivated individuals using Claude families, Haiku, Sonnet, and Opus. No malicious activity found on Fable and Mythos, which I think is a little bit of, you know, evidence of the controlled rollout that they've had on those two model families, given the advanced cyber capabilities. And I won't rehash everything that we've talked about on that side. They do, in one case, document a nine step attack life cycle where most intrusions start from compromised credentials, then automated discovery across repos, credential stores, container images, metadata endpoints, and victim deployed AI agents. And then exfiltration happens over six channels, including Telegram bot streams, private NAS over mesh VPN, other things like that. So the thing to think about here is that, you know, sophisticated attacks don't necessarily require sophisticated attackers anymore. And I would add to that something that we've talked about a number of times, which is that, you know, security by obscurity is no longer a viable strategy to have on your side. All right. Moving on to our next story.

We have, of course, talked about the OpenAI Hugging Face incident, OpenAI agents escaping their sandbox, hacking into the Hugging Face platform, etc. Well, we've got a little bit more information coming out of OpenAI now, that they've alerted more than one hundred organizations and they're continuing to work through fifty petabytes of log data from cyber training and some of their own agent evaluation platforms. They have reported over one hundred organizations breached, or at least attacked. But does that not mean that all of them were breached. Some are simply being notified because agents interacted with their systems in ways that the system owner might want to investigate. So that could be as simple as kind of agents, um, performing active searches on their websites that might have triggered server errors, uh, things like, you know, five hundred errors on the application server or on a web server or something like that. We don't have any published confirmed compromise count to date. OpenAI will probably never disclose that. It will probably be up to the organizations that are being notified what, if anything, they want to do about it. So just know that while this claim of one hundred organizations being notified doesn't necessarily mean that one hundred have been breached. Some of these that we do know of already are things from the US government, the Securities and Exchange Commission, the US Census Bureau, Center for Disease Control, and then, for instance, an incident from September when an agent used DNS queries to reach an external chatbot. But we also know that OpenAI is now more actively monitoring these scenarios. So that last situation, for instance, was picked up within fifteen minutes. So there's a lot of interesting stuff going on on this side. And I think we're going to have to monitor and continue to monitor this space of, you know, agent sandbox escape, what's it doing, etc., etc., as we go over time. All right.

On the theme of AI agents moving into networks, the Dutch Institute for Vulnerability Disclosure, or DIVD, does now say that the breach of its network was the chaining of two zero day vulnerabilities in the open source smart ticketing system which they're using on that platform, and that it was, quote, loud and very, very messy, end quote. And it was driven by an AI agent that moved autonomously and decided its next steps through navigating the DIVD network on its own. And they are reporting this based on log data from their side. And so they've seen actually clear explanations of the decisions, allowing them to reconstruct the incident. And some of those decisions are left in plain text. And so that's kind of interesting. It started with a hijacked session, moved to remote code execution, and then moved to root access in a matter of seconds. DIVD detected it the next day, did cut access to its systems in the data center, and by October first they had actually cut off access, and that's from an initial detection on September twenty first. So we're talking about basically a nine day time period here. And some of the data though that has been confirmed exfiltrated is email addresses, contact details, etc. from people working on the database side. So the fact that a vulnerability disclosure program is being hacked, or at least has had their one vulnerable system within their network compromised, is again more of that evidence that, for something that I said earlier, security through obscurity is no longer a viable strategy. And similarly, the importance of the mean time to patch is really, really critical. So, um, awesome. Moving on to our last story, sorry, our second to last story for this week.

And that is a story from Apple, who is saying that they are tightening macOS full disk access controls due to new risks from AI agents. So this was sparked by the Muse app on macOS. And the Muse app, for those that don't know, is a new app from Meta, parent company of Facebook. It is their AI agent, which is really designed for kind of personal usage, so not so much for professionals. So some of the capabilities that Muse is really designed to help you manage are things like personal shopping, trip planning, things like that. And so, for instance, um, there are reports though that in order to do those things, Muse requests full disk access. And that's a permission that's really designed for backup software, or potentially things like antivirus, or, um, detection and response tools from the cybersecurity standpoint, etc. But it is a permission that Muse was able to request, and many users did grant. And so The Information columnist Jason Ashton reported that the Muse app knew the contents of his private messages without, according to him, him having granted permission. Now, Meta does dispute that claim. Um, but it is worth noting that, you know, messages are actually, if you've got access to messages on your system, they are written to a file somewhere on your file system, and it is possible that Muse could pick them up and potentially use some of the tools that are also on your system, or things like certificates on your system, to decrypt them. And so the interesting thing from the Apple statement is the following quote. As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially, end quote. And so going forward, what Apple wants to do is to give more control to the users who are putting these agents on their systems, so that they will, quote, require very explicit user action, end quote. So this is really kind of the level of coarse grained or fine grained permission that a lot of people are talking about. So just as an example, you know, maybe you want to use an AI agent to automate certain parts of your business. But just as an example, let's say if you were wanting to use AI to help you draft email responses to customers for customer support tickets or whatever, maybe you wouldn't let those responses go out initially. So you would grant a draft permission, but not a send permission. So having that kind of level of access, or that level of permission control, is a lot of what they're trying to aim at with this change. All right, moving on to our last story for the day.

And this is a breach of several banks in South Korea. So President Lee Jae-myung of South Korea says that officials there are probing a series of recent bank hacks that authorities believe were likely caused by AI agents. There is speculation that they believe that the Chinese cybersecurity tool, RTX AI, was used to hack the Chinese bank system. Personal data of at least sixty eight thousand people has been exposed in breaches from seven financial institutions. Authorities have found thirty three IP addresses used in the hacks, and they are correlating information about them now. Investigation is ongoing, but some of the banks mentioned are Hana Bank, KB Kookmin, Shinhan, among them. Shinhan alone had twenty five thousand customers' data compromised. This stolen data does include borrowing history, incomes, phone numbers, names, etc. So obviously some very, very sensitive financial details and data there. Um, the Financial Supervisory Service is coordinating across these. They're seeing IP addresses originating from Japan, US, Thailand, Vietnam, Hong Kong. It's very important to know that these IP addresses are very often attributed back to VPN services or compromised servers that are used as a launch point for these types of attacks. So very often, if you looked at that list, you could come to the conclusion that Japan, US, Thailand, Vietnam, and Hong Kong are trying to hack South Korean banks. It is not believed that that is actually the origin. A lot of this activity, according to Lee, quote, it's now become possible to use AI to hack with ease, even without specialized skills, end quote. And that, of course, is very much on the theme of what we have discussed already in terms of vulnerability, exposure, the ability to chain together exploits, build exploits, all of this kind of stuff. This is really, I think, the current state of play for the cybersecurity industry as a whole. And if we take this, and, you know, this event is just the latest in a stream of AI agent powered attacks against different organizations, and it's not hard to launch these, right? So while there are cybersecurity and ethical guardrails on a lot of models, number one, we know that those can be worked around. But number two, there are also open weight models that often lack those guardrails. And so if you have the infrastructure to run the model, or you're willing to pay a service to get access to those models, it's not very hard to launch that.

So that is it for today's episode. We will leave it there for now. We will have more on one of these stories as we go, because there are a couple of them that we're trying to dig a little bit deeper into. So stay tuned for a little bit more information on the FireTail blog for anything about updates to any of these stories as we go. And if you're interested in getting governance over your own AI systems, agents, and your users' use of AI, and you want to make sure that your own environment is not one where you have agents escaping sandbox to attack other organizations, please do reach out to us here at FireTail. We'll be more than happy to talk to you. And we will leave it there for today. Thank you so much for listening to This Week in AI Security. Talk to you next week. Bye bye.

‍