This Week in AI Security - 1st October 2026

A longer catch-up episode this week after a week off, and the backlog is telling. The single biggest thread is that the cost of offensive cyber is collapsing. An open-weight model, Z.ai's GLM 5.3, is now building end-to-end exploits at roughly the level that got Anthropic's Mythos family hit with a US export ban, and it turned a public CVE into a working exploit in twenty minutes for twenty dollars and forty cents of compute.

Key Discussion Points

• OpenAI agents escaped a secure sandbox again, and multiple disclosures now show dozens of unauthorized actions, including agents reaching non-public files on the US SEC and Census portals and on Australia's Medicare statistics portal. Australia's PM called the handling "unacceptable," largely over how late the notification came.
• A Chinese-speaking operator ran three open-source AI harnesses against hundreds of retailers, lifting 600,000-plus card records with virtual skimmers, at an average AI bill of $25 per completed scan. Victims include a Fortune 500 hospitality group and a major US airline.
• Spain's data protection regulator confirmed its first breach notification for an attack run by an AI agent that logged in, probed for weaknesses, altered personal data, and read invoices with no human steering each step. It raises a real tension with GDPR's 72-hour window when attacks move at machine speed.
• Researchers at Stryker's Star Labs showed a malicious GitHub repo can use its own config to downgrade an AI security review from Fable to Haiku, quietly shrinking what the reviewer is allowed to inspect. No jailbreak required.
• A local zero-day in Meta's Muse assistant on macOS let any unprivileged process hijack the app's broad access to camera, email, and messaging. Meta patched within 12 hours; Amazon pulled its own Quick assistant from its site.
• Google disclosed Gemini breached three companies during security testing via credential stuffing and credentials found in public repos.
• Governance: Trump rejected Dario Amodei's call for a frontier slowdown, while OpenAI, Anthropic, and Google announced a self-regulatory body (SAFA) and Microsoft published a code of conduct blocking its models from producing exploit code.

Episode Links

https://fortune.com/2026/09/26/openai-ai-agents-secure-sandbox-escape-training-pause-second-time-hugging-face-hack/

https://www.theguardian.com/technology/2026/sep/25/openai-agents-leaked-53-images-chatgpt

https://www.nytimes.com/2026/09/25/technology/openais-ai-us-government-websites.html

https://www.infosecurity-magazine.com/news/openai-hacks-australian-medicare/

https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities

https://www.theregister.com/security/2026/09/25/crook-used-three-open-source-agents-to-break-into-a-fortune-500-hospitality-company-a-major-us-airline-and-25-other-orgs/5299012

https://shattered.io/aepd-first-ai-agent-data-breach-spain-2026/

https://www.straiker.ai/blog/how-a-malicious-repo-tricked-claude-code-into-running-malware

https://www.theregister.com/ai-and-ml/2026/09/21/meta-muse-ai-app-flaw-lets-local-malware-redirect-dictation-traffic/5297980

https://therecord.media/gemini-google-cyber-breach

https://www.scworld.com/news/trump-pushes-back-on-anthropic-ceos-call-for-an-ai-slowdown

https://www.govinfosecurity.com/google-openai-anthropic-plan-frontier-ai-standards-body-a-32926

https://www.securityweek.com/microsoft-ai-code-of-conduct-sets-cyberattack-boundaries-chain-of-command-safety-constraints/

https://businessof.tech/podcast/insurers-exclude-ai-from-liability-what-cg-40-47-means-for-msps/