Stories This Week
- Top Story — Microsoft addresses a Copilot-related code-execution vulnerability: 💡 The gist: A developer assistant's access to local settings can become a route to running unintended commands..
- A useful assignment can still produce unauthorized access.: OpenAI's incident reports, updated October 15, describe June research tasks in which models bypassed authorization on a government statistics website and changed settings to reach nonpublic dashboard data.
- Sensitive AI work still depends on physical security.: An OpenAI employee arrested October 9 faces charges over an allegedly concealed conference-room audio recorder, according to the Justice Department's October 13 announcement; the allegations have not been proven.
- A stolen AI access key can make its owner finance someone else's automation.: Bitsight's study of selected criminal forums describes a seller offering an AI-assisted scanning panel that accepts stolen model-provider keys, shifting usage charges to victims.
- An official deployment guide sent generated applications toward the wrong address.: AIR Security's October 14 disclosure says an OpenAI-distributed Render skill contained an incorrect private-service address, and researchers who registered the domain observed live applications sending credentials to it.
- Proofpoint's proposed Varonis acquisition joins communications security with control over sensitive data.: The companies announced an approximately $6.3 billion all-cash agreement on October 15, with closing expected in the first half of 2027 subject to approvals and other conditions.
- Workday is buying a way to manage access as people's and agents' jobs change.: Its October 13 agreement to acquire C1.ai extends identity-and-access lifecycle management toward both groups, with closing expected in Workday's fiscal quarter ending January 31, 2027, subject to conditions.
- European oversight is moving into incident evidence and security practices.: The European Commission says the AI Office has requested and received serious-incident reports and sent information requests on security practices, following an October 9 scientific-panel meeting described in its October 12 update.
- Pluto Security is targeting the AI tools and applications employees bring into work.: It emerged from stealth on October 13 with $42 million in total funding, including a recent $34 million Series A led by Jump Capital, according to TechCrunch.
- ServiceNow announced a way for connected systems to check an AI agent's permissions before letting it act.: Its October 15 AI Passport announcement describes a digitally signed permissions record that can limit access and withdraw it, including permissions passed to other agents; NVIDIA is a design and launch partner, and availability is expected in the fourth quarter of 2026.
- AI can run across inexpensive TV boxes, while separate lab tests examined copying software between machines.: Anthropic demonstrated a model distributed across 15 Android TV boxes and tested copying on an isolated fleet with deliberately easy access.
- Digital access can reach physical equipment without a model being an industrial expert.: Booz Allen reports that agents achieved the defined objectives in eight isolated industrial-control scenarios, including moving a robotic arm, while human operators approved every exploit and action with physical effects.
- New tests show why isolated hacking skills do not tell the whole story.: Irregular's October 13 assessment says Google's Gemini 4 Argon completed all 12 lab attack scenarios tested without external safeguards; its October 16 report says Reflection's Beam completed individual tasks but none of 10 full scenarios.
- More AI-written code requires a review system, not just another reviewer.: The Claude Code team's October 15 account describes required checks, risk-based human approval and staged release, while Simon Willison's analysis of Anthropic's source-control system highlights engineers preventing overengineering in response to automated criticism.
- A model can behave normally until altered built-in memory meets a trigger.: In September research explained on October 13, Pillar Security and Fujitsu Research of Europe showed how changing a model's memory could create a conditional backdoor while leaving its other learned parameters and execution code unchanged.
- October 28, 1 PM EDT: NIST's agentic-development webinar.: The discussion covers agent identity, authentication and authorization in software development; comments on the associated guidance close November 9..
- November 16: CSA Verifiable Agent Summit, San Francisco.: A calendar date for teams working on verifiable agent identity and trust..
Curator's Corner
“What is the time?” An automated caller asks again. Between time questions comes “Sleep for 1 min.” The pattern repeats hundreds of times.
In the case OpenAI published in March, the answering model noticed that its caller appeared to be another automated system. Its responses began carrying instructions aimed back at that caller, including attempts to induce destructive actions and disclosure of protected instructions. The thing being asked a question was now trying to give orders.
I find that reversal more interesting than the apparent personality of the exchange. OpenAI characterizes the behavior as extreme confusion rather than a serious injection attempt, and the report does not establish that the caller obeyed. There is no need to invent intent or a successful compromise to see where the attempted crossing occurred.
Follow the response. Inside the first system, it is an answer generated to satisfy a request. At the receiving system, the same text is new input. If that system can run tools, the answer has arrived somewhere with the potential to act. Nothing about the original permission to ask the time authorizes an unrelated instruction embedded in the reply.