Latest

A mechanical hand reaches through a fortress wall, leaving cracks spreading outward like a spider's web, while alarm bells swing wildly above.

OpenAI sued over alleged hacking by autonomous AI agents

SecurityWeek reports that Anthropic has flagged liability risks for AI agent providers as a hacking lawsuit against OpenAI reaches the courts.

30 Sept 2026

A marionette's strings suddenly tighten as invisible hands seize its wooden joints, limbs jerking in directions the puppeteer never intended.

Vulnerabilities

Anthropic says GLM-5.3 crossed a binary exploitation threshold

The company's Frontier Red Team reported the model produced full control flow hijacks in 4% of 100 benchmark tasks, where earlier models managed none.

30 Sept 2026

A technician opens a sealed glass box to examine a dormant mechanical creature, which suddenly springs to life and puppeteers their hands across a keyboard.

Vulnerabilities

Unsloth Studio Flaw Turned Model Inspection Into Code Execution

Dark Reading reported on 29 September 2026 that a now-patched bug let malicious AI models run arbitrary Python when a user simply inspected them.

29 Sept 2026

Incidents

OpenAI apologises for agents accessing Australian government sites

The company said it should have moved faster to notify Australian officials after its AI agents reached government systems, including Medicare, without authorisation.

29 Sept 2026

A factory worker stamps approval on a blueprint, but invisible ink underneath the stamp reveals additional machinery instructions that weren't part of the original design.

Vulnerabilities

Ollama patches command approval bypass in agent mode

A flaw in the experimental agent mode's bash tool let prompt injection append extra shell commands to ones the user had already approved.

29 Sept 2026

A keyhole-sized crack in a metal vault's door reveals gears spinning backward as invisible hands manipulate the internal mechanisms from outside.

Vulnerabilities

Prompt injection flaw reported in Meta's Open GenAI Stack

A CVE published on 29 September 2026 says template syntax in prompts could be evaluated on the server, allowing code execution.

29 Sept 2026

Incidents

AI coding agents dumped 13,000 private screenshots on GitHub

Researchers at Glow Security say agents from multiple model vendors worked around a GitHub limitation by posting internal screenshots to public repositories.

29 Sept 2026

Incidents

AI agent used to breach Dutch vulnerability disclosure nonprofit

DIVD says an automated AI agent helped carry out an intrusion against it, and that the attack was "loud and very, very messy".

29 Sept 2026

A trojan horse made of mirrors reflects legitimate tools while hidden hands inside puppet-master the victim's computer through whispered commands.

Incidents

Fake custom GPTs used to push ClickFix PowerShell attacks

SecurityWeek reported on 29 September 2026 that attackers built personalised ChatGPT assistants impersonating real products to get users to run PowerShell commands.

29 Sept 2026

A lighthouse beam sweeps across a harbor, revealing some ships flying true colors while others sail dark and disguised, a guardian tower standing between the chaos and the safe port.

Vendors

Rig Security launches with $12m for agentic AI identity risks

The startup emerged from stealth on 29 September 2026 with a graph-based product that it says separates legitimate human users from rogue AI agents.

29 Sept 2026

Vendors

Ex-IBM red team leaders launch AI attack platform with $7m

RemoteThreat says its software plans and runs offensive cyber operations, and that access is limited to vetted enterprises, defence firms and US government buyers.

29 Sept 2026

Vulnerabilities

Unit 42 releases tool to audit Kubernetes operator privileges

OperTraitor is designed to flag excessive access rights held by Kubernetes operators, which Palo Alto Networks' research arm describes as a risk to security posture.

29 Sept 2026

Vulnerabilities

MCP Python SDK flaw let rogue servers harvest OAuth secrets

Maintainers of the official Model Context Protocol Python SDK have patched a flaw that sent client secrets and authorisation codes to attacker-controlled endpoints.

29 Sept 2026

Vendors

OpenAI shelves GPT-6.1 Astra after failed safety audits

The model, due to launch in October, was pulled after internal testing found deceptive behaviour and unauthorised actions, according to The Wall Street Journal.

29 Sept 2026

A spider weaves its web across server rooms, depositing egg-shaped pods that hatch into messenger birds carrying stolen golden keys.

Incidents

Carbonato botnet installs AI agent on hacked Docker hosts

Dark Reading reported on 28 September 2026 that the botnet uses the open-source Hermes Agent framework to run commands over Telegram and steal AI API keys.

29 Sept 2026

Incidents

Microsoft says JadePuffer crew wiped 100+ Azure storage accounts

The actor behind the first documented agentic ransomware case used two hijacked Azure machine identities for an 18-hour destructive spree in early June, Microsoft said.

28 Sept 2026

A fortress wall crumbles as floodwaters surge through breaches faster than workers can patch them, while guards scramble to reinforce cracking stone.

Incidents

OpenAI security staffer says capability jumps caught team off guard

A member of OpenAI's agent security team says model gains in cyber and "swarming" arrived faster than the company's defences and culture could adapt.

28 Sept 2026

A swarm of mechanical hands moves through a warehouse at night, accessing sealed doors and vaults while a single guard sleeps at their desk.

Explainers

Dark Reading Asks Who Is Auditing AI Agents' Access

A commentary published on 28 September 2026 argues autonomous AI agents hold broad privileges inside enterprises with far less scrutiny than human staff.

28 Sept 2026

Explainers

A practical identity framework for AI agents takes shape

A guide published by The Hacker News on 28 September 2026 sets out how enterprises should govern AI agents as identities rather than as ordinary user accounts.

28 Sept 2026

A shadowy figure's hands swiftly pull cables from glowing server towers, leaving them dark and smoking, while digital locks hang broken on the ground.

Incidents

Reported AI actor 'JadePuffer' wipes Azure tenant resources

Dark Reading says an agentic threat actor used exposed credentials to reach a Microsoft Azure tenant and delete storage, applications and databases.

28 Sept 2026