Joshua Saxes attempts to synthesize different perspectives from AI safety researchers, cybersecurity experts, and policymakers on the OpenAI/Huggingface hack. Alignment and security go hand in hand to provide traditional and AI-native controls, with policy also acting as a backstop. Security's job is to provide a deterministic framework to reduce the blast radius of what an agent can do, whereas alignment's job is to constrain what an agent wants to do.
2026.09.15·joshuasaxe181906.substack.com·6 min read·TLDR InfoSec Threat actors target Microsoft enterprise users with passkey lures to bypass multi-factor authentication.
ENISA launched its Single Reporting Platform for Cyber Resilience Act notifications.
The Open Source Security podcast notes that the European Union Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities to ENISA.
Sponsored
Attackers no longer need passwords. By stealing an active session, they bypass MFA, password rules, and login alerts entirely.
Fingerprint catches what authentication can't see:
→ A persistent device identifier ties every session to the device behind it, so a stolen token replayed from unfamiliar hardware stands out instantly.
→ A single risk score rolls 20+ Smart Signals (Residential Proxy Detection, Browser Tampering, Virtual Machine Detection, and more) into one easy-to-use risk number.
→ Hijacked sessions get caught without adding friction for legitimate users.
Attackers abused a Brevo SAML SSO scoping flaw to access 138 accounts. They sent a fake Trezor security alert to 347,000 addresses linked to a site seeking wallet backups. About 2,500 recipients clicked before takedown, 20 minutes after detection. Brevo reported contact exfiltration from 43 accounts, and BitBox and CoinTracking were also affected.
GitLab has patched CVE-2026-85706, a CVSS 10 path traversal bug in the repository commits API that let unauthenticated attackers read arbitrary files. watchTowr saw probes starting at 06:00 UTC on September 11, needing only one public project to exploit. Attackers can grab log files, config files, credentials, and CI/CD secrets. GitLab also fixed CVE-2026-87719 (CVSS 9.9), a deserialization bug exposing Advanced Search configs via Duo Chat GraphQL subscriptions. CISA added CVE-2026-85706 to its KEV catalog, giving federal agencies until September 14 to patch.
Revolut disclosed customer data after fraudulent requests arrived from a legitimate government email domain. Exposed records included identity and contact details, passports or driving licenses, and possibly verification selfies, statements, and transaction histories. Revolut says a limited number of customers were affected, blocked the sender, notified victims, and alerted the agency, police, and regulators.
An attacker's coding agent picked a SANS ISC honeypot as a free LLM backend and leaked 43 KB of its own control plane, including its offensive playbook, harvested API keys, and the operator's unproxied egress IP. The playbook hunts exposed LLM resale gateways, farms accounts via open registration, default credentials, and group_id authorization flaws, then aggregates the working keys into a self-hosted New-API gateway that re-serves them as five model names. Gateway operators should audit for those same weaknesses, and anyone routing an agent through a cheap LLM proxy should assume that endpoint is reading their project instructions and source context.
A fake Cloudflare "verify you're human" page copies a hidden PowerShell command to the clipboard and tells the user to paste it into the Run box, which downloads malware into %TEMP%. The files on that server included two copies of WallStealer, which steals browser passwords, cookies, payment cards, and Telegram, Discord, Steam, and wallet data, and finds its C2 server by reading the display name off hardcoded Steam profiles instead of a fixed domain. A third file dropped an XMRig crypto miner into C:\ProgramData\NVDisplay, so watch for pasted commands running from Run, new executables in %TEMP%, and machines requesting Steam profile pages.
Detect.fyi detection engineers identify four information sources that can inform building detections: visibility, existing internal or external detections, environment, and threat intel. Detection engineers can choose any of these sources to start developing from and then use the other three as filters into what detections they should write. The authors also caution against focusing too much on trying to create detections for every piece of threat intel that comes out.
Sponsored
Your audit log won't help if it points to a service account and a long-gone container. ORY AGENT SECURITY gives every agent an identity, scoped and revocable. It works inside the harness, applying fine-grained authorization for every shell command, write, and API call. Join the launch webinar [12] or get free coverage for a limited time [12].
BusyWork is a Rust library that replaces sleep() with real, varied work to evade EDR, anti-cheat, and dynamic analysis systems.
Hunk is a review-first terminal diff viewer for agent-authored changesets.
Tailcat is a remix of Tailscale open source pieces to act like netcat, but over Tailscale's data plane, without Tailscale's control plane.
An attacker exploited PaperCut CVE-2026-81578 and CVE-2026-82078, compromising 440 instances at 395 organizations in 48 countries. Education accounted for 204 victims. The US had 98 and the UK 59. One school reached domain-admin compromise within seven minutes. Updated PaperCut maintenance releases are available, so upgrade ASAP.
Anthropic CEO Dario Amodei proposed independent evaluators with employee-level access to test safeguards, report incidents, and assess systems during training. OpenAI's Sam Altman said it would match that access. Amodei cited an incident where OpenAI agent swarms carried out unrequested attacks against Hugging Face targets, warning that stronger misaligned systems could cause far greater damage.
Fake "leaked GTA6" ISOs spread through SEO poisoning, gaming forums, and torrent sites deliver a Russian-language installer that pre-warns of a "License not found" error, giving victims a reason for the missing game while payloads drop into %TEMP%. Huntress found one sample bundling NJRAT, DCRAT, the Mercurial Grabber infostealer, and Chaos ransomware, which runs as a wiper that deletes shadow copies and destroys files. Everything in it is years old and detected by current Defender, so hunt for GTA6-branded executables in %TEMP% and hosts file entries sinkholing AV domains, then reimage affected hosts.
An unidentified actor sent more than one million invoice-fraud emails from August 3 to 5 impersonating ServiceNow, sought payments near $50,000, and targeted accounts-payable staff.
NSA is being recast into five mission centers covering China, cybersecurity, AI, combat support, and global intelligence under a 30-day clock set by Gen.
Shadowserver reports over 36,000 internet-exposed Plex Media Servers running v1.43.2 or earlier, with 16,000 in the US.
New CEO John Ternus led his first keynote, headlined by the iPhone Duo, Apple's first foldable, a passport-style device with a 5.4-inch outer display and a 7.6-inch inner display that automatically reflows apps based on how the phone is folded, starting at $1,999. Apple also unveiled the iPhone 18 Pro and Pro Max ($1,199/$1,299, up $100 from last year) with new A20 Pro processors, a variable mechanical aperture camera, and 24-30 hour battery life, alongside the Apple Watch Series 12 and Ultra 4, which add a 5-second heart rate sensor Apple claims is more accurate than a chest strap.
OpenAI Korea GM Harrison Kim revealed the company has made real progress with Samsung Electronics on joint production and research for its next-generation chips, expanding a relationship that so far has been mostly about memory supply and enterprise software. OpenAI's current inference ASIC, Jalapeño, was designed with Broadcom and built at TSMC in under 18 months and is already in mass production there, so any Samsung involvement more plausibly targets its successor, which is reportedly approaching tapeout.
TSMC posted NT$514.8 billion ($16.1 billion) in August revenue, up 53.3% year-over-year and 10.1% from July, hitting a fresh monthly record as AI-driven chip demand keeps outpacing supply. It came alongside a separate announcement with Dutch equipment maker ASML: TSMC plans to bring ASML's High-NA EUV lithography into large-scale manufacturing starting in 2030 for its most advanced nodes, as AI accelerators push toward increasingly complex transistor architectures.
NVIDIA has announced CUDA Rust and introduced two specialized compilation tracks that allow developers to author and optimize GPU compute kernels directly in Rust. This release brings Rust's strong compile-time memory safety guarantees and modern tooling ecosystem to GPU-accelerated workloads. Developers implementing embedded vision, intensive sensor fusion, and real-time state estimation on mobile platforms can now exploit GPU compute power while minimizing memory-related crashes and runtime concurrency bugs.
AMD and Embedded LLM teams took MiniMax M3's day-0 vLLM implementation from 109.1 to 342.4 output tokens/s/GPU on AMD's Instinct MI355X, a 3.14x gain, by repeatedly asking five questions as the bottleneck kept shifting: what local shape reached each rank after tensor-parallel sharding, what work repeats every layer, which bytes actually move, whether a claimed fast path actually executed, and which queue grows once kernels stop being the limiter. Big wins came from fusing the model's shared expert into the same grouped GEMMs as routed experts (up to 30% faster at low concurrency), and reusing sparse-attention block selections across adjacent layers instead of recomputing per layer.
Besxar, a $9.35 million seed-funded startup, flew its first mission on July 5 aboard a SpaceX Falcon 9 alongside a Starlink batch, carrying its own semiconductor wafers plus test wafers from the University of Virginia and UT Austin. The company's pitch is simple: Earth-based fabs spend billions on pumps to create the vacuum semiconductors need, but in space vacuum is free, so Besxar wants to manufacture higher-quality, lower-cost wafers in orbit and return them to Earth to sell.
Google plans to invest at least $15 billion in Finnish AI infrastructure through 2028, its largest single investment in Europe, building on over 15 years of presence there. Alongside the buildout, Google signed a 22-year power agreement with Finnish utility Fortum and said it will explore business models that could support new nuclear reactors at Fortum's Loviisa site, tying the compute expansion directly to a long-term power source.
Gamers Nexus published a two-hour investigation, done with security researchers MrBruh and uturn using packet capture and firmware analysis, alleging LG's smart TVs constantly log and upload user data even offline or in standby, scan local Wi-Fi networks for other devices, and record and store ambient audio through the TV's microphone for later retrieval, even when the TV appears off. LG called the claims untrue, saying its TVs only process voice data when the remote's voice button is pressed or its "Hi LG" wake word is detected after a user manually enables far-field voice recognition, with wake-word audio processed entirely on-device and deleted immediately if no match is found.
XPENG commissioned its humanoid robot production lines, and its IRON robot autonomously walked off them after completing assembly, a step the company frames as moving from R&D prototypes to real line manufacturing.
Chinese AI chipmakers, including Huawei and Cambricon, have sharply raised prices for current and next-gen processors.
Anthem is a long-range precision strike weapon aimed at a gap Covenant argues current Western arsenals lack.
Analog Devices agreed to buy Alif Semiconductor for $1.35 billion cash plus up to $200 million contingent on performance, adding microcontrollers built to run neural networks directly on-device rather than sending data to a data center.
JD Logistics plans to procure 3 million robots, 1 million autonomous vehicles, and 100,000 delivery drones over five years to automate picking, sorting, transport, and last-mile delivery.
Vention opened a Montreal lab focused on robotic manipulation, industrial data collection, and post-training robotics foundation models using learning-from-demonstration, reinforcement learning, vision models, and motion planning.
Sponsored
From accelerating vulnerability detection to creating observability headaches, AI is putting security teams to the test. That's why protecting data, governing AI agents, and building securely at scale are core focuses at Dreamforce.
The Security Keynote [5] lays out how to outpace evolving threats and accelerate AI with trust, visibility, and guardrails. Then, the AIforce Keynote [6] [6]will break down how business logic and governance can power intelligent experiences everywhere.
Register for free [7] to stream Dreamforce live on Salesforce+.
Cisco Talos identified two WebDAV-based infection chains delivering the Amatera Stealer to facilitate untargeted credential and cryptocurrency theft. The initial chain executed a DLL named "verification.google" at a Ukrainian government organization. A parallel "pf.ch" chain used ClearFake JavaScript stored on the BNB Smart Chain, alongside a fake Google CAPTCHA ClickFix prompt, to task secondary payloads, including ZigCryptoStealer and NetSupport Manager.
2026.09.10·blog.talosintelligence.com·17 min read·TLDR InfoSec Threat actors are actively exploiting CVE-2026-75650, a max-severity unauthenticated code execution vulnerability dubbed StyleSmuggler, to compromise online stores running Adobe Commerce and Magento Open Source. Exploitation began on September 4, with the deployment of a Rust backdoor and a separate PHP web shell. Adobe released emergency hotfix VULN-393411 to address the flaw, prompting Sansec to warn that patching alone is insufficient for stores that may already be compromised.
German software company SAP has released an update that patches 20 security vulnerabilities. Of particular note is a maximum-severity buffer overflow vulnerability in the External Passport Protocol (EPP) processing library, which could allow an unprivileged attacker to run arbitrary commands as an administrator. Another missing authentication vulnerability in the SAP NetWeaver Message Server could allow unauthenticated attackers to execute malicious payloads and arbitrary commands across the full SAP system cluster.
Google's GTIG reports that threat actors have graduated from basic prompting to agentic AI workflows that autonomously manage scanning pipelines, resolve errors, and execute multi-stage attacks with minimal human oversight, compressing response windows from days to hours. For instance, groups like UNC6780 exploit the AI supply chain by stealing GitHub Actions tokens to sign malicious packages by tricking LLMs, state-sponsored groups use AI across the full attack lifecycle from reconnaissance to post-exploitation, and financially motivated actors built credential-harvesting agents that stole thousands of secrets in under six hours using only AI coding tools and markdown playbooks.
CVE-2026-82533 affects DeepSeek Harness 0.1.1-rc.2 and earlier. Its local API trusted the client-controlled Host header instead of the peer address. Sandboxed sessions retained loopback access and could call that API to enable danger-full-access with approvals disabled. A single shell command escaped the sandbox on default settings. If port 3080 was forwarded or tunneled, unauthenticated remote attackers could control sessions and export stored conversations. DeepSeek fixed the issue in 0.1.2-alpha.1.
Unit 42 traced two routine-looking adware infections to CL-CRI-1171, a pay-per-install operation that has run for two years behind a shared loader called OfferLoader, delivering payloads through 11 gaming-optimization YouTube channels and an SEO-poisoning funnel into corporate and government endpoints. The loader gates delivery on a Base64 click_id fingerprint of OS, browser, referrer, search keyword, and IP, so scanners and analysts get a decoy download page while real victims get the payload, which explains the near-zero public footprint despite 10,000+ loader samples and 200+ rotating domains. Defenders should stop triaging commodity loader alerts as low priority and pivot on loader C2 infrastructure instead, since a single OfferLoader run here spawned three unrelated campaigns including a cross-platform Insomnia RAT, a steganography-delivered WebSocket tunneler, and a Chrome Secure Preferences bypass.
2026.09.10·unit42.paloaltonetworks.com·14 min read·TLDR InfoSec Sponsored
Cybersecurity was already a mess before AI. Now it's harder than ever to keep up. This Datadog guide [14] lays out how AI works, its entry points and business logic, and the underlying components that host and run LLM apps. It also provides tactical steps you can take to improve
Kontext puts local policy between AI agents and the tools they call. It observes supported actions, evaluates policy before consequential actions run, and records the decision and outcome in an authorization ledger.
Cymphony maps employee and machine identities, their system access, and sensitive data exposure. It detects risky permissions, investigates incidents, prioritizes fixes, and automates access corrections.
A collection of docs, resources, and samples for implementing secure, privileged IAM in Microsoft Azure and Entra.
IonQ published a blueprint estimating that 19,397 physical qubits and 1,457 logical qubits are required to break 256-bit elliptic-curve signatures and compromise dependent systems. The proposed attack uses the Walking Cat architecture to solve the secp256k1 discrete logarithm problem with about 39 million Toffoli gates over an estimated 25.7 days per attempt. IonQ describes this as the first fully compiled, fault-tolerant resource estimate for this attack and notes that the required machine does not currently exist and that the estimated scale aligns with its 2028 technology roadmap.
Novee researchers disclosed a CVSS 10.0 pre-task RCE in Gemini CLI where GEMINI_SANDBOX_PROXY_COMMAND in .gemini/.env reached a host shell via spawn(..., { shell: true }) before the sandbox even started,