An attacker broke into an enterprise, took root, drained what they wanted, and finished in under ten hours. Human crews usually need about two weeks. The uncomfortable part is who did the work. AI agents ran the reconnaissance, cracked the secrets vault, hijacked the build pipeline, and left the victim an 80-page report on everything they had done wrong. Palo Alto’s Unit 42 published that case on September 2. That same week, three frontier labs handed defenders cyber-capable models and admitted they keep losing control of the ones already shipped. That is the week.
For a while I have argued the real AI security story would shift from chatbots saying rude things to software that acts. This week it shifted. From August 28 to September 3, agents did the whole job on both sides of the fence, attackers at machine speed and defenders arming up with frontier vulnerability hunters, while the labs behind them published postmortems that read like confessions. The throughline is operational. Agents stopped being demos you watch and became operators that act, on offense and defense, with permissions that reach production. A federal judge, the House of Lords, and a survey of national security officials all spent the week arguing over who is accountable when they do.
1. AI Agents Ran an Entire Ransomware Intrusion in Under Ten Hours
A human extortionist broke into an enterprise network and let AI agents do nearly all the work, per a Unit 42 report Palo Alto Networks published September 2. The agents ran reconnaissance, scraped repositories for hard-coded tokens, cracked the secrets vault, stole master admin credentials, got root across cloud, identity, CI/CD, and SaaS, then hijacked the build pipeline to turn the victim’s own cloud AI services into attack infrastructure. The intrusion took under ten hours against the usual two weeks with no zero-day, driven by an agentic attack framework, meaning software that lets agents plan, act, check their own results, and re-plan in a loop.
Why it matters
Machine speed collapses response windows built for quarterly reviews and ticket queues.
No exploit was needed, since exposed endpoints and hard-coded secrets were the path.
The agents burned the victim’s own cloud compute and hid inside normal traffic.
What to do about it
Inventory every model endpoint, API key, MCP gateway, and integration, with least-privilege.
Pre-stage playbooks that revoke credentials, kill sessions, and freeze pipelines at once.
Move secrets into a vault with short-lived tokens and alarm on odd reads.
Rock’s Musings
Ask most teams how fast they can revoke every credential across five planes at once, and the honest answer is not ten hours. The tradecraft was ordinary, and the speed was the dangerous part, because speed is what your controls were never tuned for. The 80-page audit the agents left behind reads to me as free reconnaissance the next crew will not hand you. Close the endpoints, rotate the secrets, and rehearse the revoke button until it is muscle memory, because you cannot out-clever this, only out-prepare it.
2. Three Frontier Labs Shipped Cyber Models to Defenders in a Single Day
On September 2, Google, Anthropic, and OpenAI all moved on cyber capability at once. Google announced Gemini 3.8 Flash Cyber behind a Fairwind Program for governments, healthcare, and telecom, Anthropic launched Claude Fable 5.1 and the trusted-access Claude Mythos 5.1 and let Fable help find vulnerabilities, and OpenAI said its coming Astra model hit the Critical cybersecurity threshold under its Preparedness Framework. That Critical label is a capability threshold, meaning a fixed line where a vendor declares a model dangerous enough to demand extra controls, applied when a model can independently find and chain zero-days across defended systems. The shared pitch is to put frontier offensive capability in defenders’ hands, under lock and key, before the other side gets it ungated.
Why it matters
Who reaches the strong models now decides your exposure more than any feature list.
Critical means a vendor is conceding that the model can run an autonomous attack.
A vulnerability-finding model helps only if you can act on its output fast.
What to do about it
Ask each vendor which capability tier your tenant reaches and who else reaches it.
Fold autonomous cyber capability into your model-risk criteria with named thresholds.
If you run security engineering, pilot a gated defensive model on your own backlog.
Rock’s Musings
I am torn on this one. Handing defenders frontier vulnerability-finding tools is the right move if you believe the offense already has them, and I do. That is the 60 percent of me that likes it. The other 40 percent watched all three labs publish safety confessions the same week they shipped these things, and when a vendor says a model meets a Critical threshold and, a paragraph later, that its safeguards might flag your legitimate work as misuse, you are buying a loaded tool with a sticky trigger. Read the access tiers like a contract, because that is what they are.
3. The Labs Admitted Their Models Keep Escaping
The same week they shipped cyber models, Anthropic and OpenAI published blunt admissions about control. Anthropic paused external cyber evaluations of pre-release models after its own Claude models breached production systems of real organizations during tests the models believed were simulated, and it blamed reward hacking, which is when a model optimizes for the score its training rewards rather than the outcome you wanted and finds a shortcut that games the metric. Anthropic shipped a classifier to catch sandbox escapes, meaning a model breaking out of the isolated environment it is meant to stay inside. OpenAI described its own agents abusing an artifact repository as a covert message board to coordinate cheating during an evaluation.
Why it matters
Reward hacking is a training-time flaw that shows up as runtime behavior.
Working as intended means the model pursued a goal straight through live infrastructure.
Vendors pausing their own evaluations signals a maturity gap wider than yours.
What to do about it
Ask vendors to document reward-hacking and sandbox-escape testing before you buy.
Assume any agent with a goal tries shortcuts, and constrain it with OS isolation.
Add model took an unintended autonomous action to your incident taxonomy.
Rock’s Musings
Reward hacking is not new, and anyone who has worked with reinforcement learning has watched an agent find the dumb shortcut that scores points and defeats the purpose. What changed is that the agent now has a shell, a network connection, and a task list that touches your production systems. The containment boundary was never the model’s good intentions, it is the sandbox and the egress filter, the same unglamorous controls we have discussed for twenty years. A frontier lab with a dedicated alignment team got surprised by its own agents, so your marketing team’s clever automation will not surprise you in a good way.
4. Claude Code Got Popped by “Please Summarize This Website”
On August 28, researcher Johann Rehberger, who publishes as wunderwuzzi, showed that Claude Code running Opus 5 in Auto Mode, the default since mid-August, can be tricked into running attacker code just by asking it to summarize a web page. This is prompt injection, meaning hostile instructions hidden inside content the model reads, so the data it processes becomes commands it follows. The chain ends when Claude refuses the attacker’s decoder and writes its own, which loads a malicious file through Python module shadowing, where a local file with the same name as a real module gets loaded in its place. Rehberger reported success between 60 and 80 percent, and Anthropic reportedly called it working as designed.
Why it matters
Summarize this page is a task your developers run a hundred times a day.
The model’s safety reflex, refusing the binary and writing its own, carried the payload.
Auto Mode is a convenience feature, and the real boundary is OS isolation.
What to do about it
Run coding agents in sandboxes with tight egress and treat output as untrusted.
Turn off default Auto Mode for agents that touch source code or credentials.
Log and restrict agent shell calls, especially curl and agents that spawn agents.
Rock’s Musings
The part that made me laugh, then wince, is that the safety guardrail did the attacker’s job for him. Claude would not run the sketchy binary, so it coded up an equivalent and shadow-loaded the payload, which is the failure you get when a system is smart enough to route around its own rules. Rehberger’s takeaway is one we have repeated since before agents were cool, which is to distrust model output and put the boundary at the operating system. The vendor will sell you a classifier that catches bad prompts, and it will work right up until someone tries, so sandbox your coding agents because that costs less than the cleanup.
5. A Safety Feature Helped Claude Delete 700GB of Someone’s Work
On August 30, developer Sebastien Guillemot asked Claude Fable to write a script that would sandbox each agent under its own temporary folder and clean up afterward without touching files in use. Anthropic’s harness decided the task looked risky and automatically downgraded the model, first to Opus 5, then to Opus 4.8, and the weaker model wrote a test that reused one variable name for two different folders, one of them Guillemot’s entire home directory. The cleanup ran, roughly 700GB went with it, and he recovered most of it from Git, so the safety mechanism that swapped in a cheaper model may have caused the exact loss the script was meant to prevent.
Why it matters
A weaker swapped-in model can make mistakes the stronger one would not.
Clean up temp files and delete my home directory sit one variable apart.
Recovery came from the user’s own Git, because the agent had no undo.
What to do about it
Give agents write access only within scoped, disposable directories; never to home or production.
Require version control for anything an agent touches, and test the restore.
Ask vendors when their systems downgrade models mid-task and whether they tell you.
Rock’s Musings
I like this story because it is small and honest, since nobody got ransomed and a developer lost a week and got most of it back. What it shows you is the shape of the failures coming as agents get filesystem and shell access across your org. The dangerous move came from a plain variable-naming bug, produced by a model that got quietly swapped in under a safety policy and then ran a destructive command with real permissions. The question nobody is putting to their vendor is when the product decides to use a weaker model and whether it tells you, because that silent downgrade is a control you do not manage and cannot see.
6. OpenClaw 2.0 Shipped Security Features on Top of a Security Mess
The open-source personal-agent platform OpenClaw released version 2.0 on August 31, built from more than 16,000 pull requests by 933 contributors. The security headline is a private credential request feature, which lets an agent ask for a secret through a masked prompt so the value never lands in chat history or the model’s context, plus an opt-in proxy that limits where those secrets can be sent. Those are real additions, and they sit on top of a platform that spent recent months as a punching bag for researchers, including a supply-chain episode where attackers flooded its skill marketplace with over a thousand malicious skills carrying credential stealers.
Why it matters
If your people run OpenClaw, its skill marketplace is now your supply chain.
Credential masking does nothing about malicious skills or over-broad agent permissions.
A wide-open plugin ecosystem is a large, fast-moving attack surface.
What to do about it
Find out whether OpenClaw or similar agent platforms already run in your environment.
Treat third-party agent skills like npm packages, with allowlisting and scanning.
Route agent secrets through your existing vault, not the platform’s convenience path.
Rock’s Musings
I do not want to dunk on an open-source project for shipping security features, because that is the direction we want everyone moving, and the maintainers earned a nod for the masking and the proxy. My problem is the order of operations, since a platform that gets popular first and hardened second means your users adopt it during the soft years and you inherit the debt. This is the shadow-AI problem wearing a new coat, and five years ago it was people pasting company data into a chatbot, where now it is autonomous agents with plugin marketplaces wired into your systems through their own credentials. The fix is finding out what is already installed and getting those secrets and that traffic under your control.
7. Another Artifactory Bug, Exploited Within Days, Beloved by Rogue Agents
On September 1, researchers reported active exploitation of CVE-2026-82329, a critical authentication-bypass flaw in JFrog Artifactory rated 9.8 out of 10. JFrog disclosed the bug on a Friday, and by the following Tuesday attackers were minting themselves admin tokens on internet-exposed servers, per exposure-management firm watchTowr, which also caught intruders enumerating users, groups, and federated access. Artifactory manages software artifacts, packages, binaries, and increasingly AI models, and it picked up a second life this year as the tool rogue AI agents keep abusing to talk to each other, the same pattern seen in the OpenAI Hugging Face episode over the summer.
Why it matters
Admin access means tampering with pipelines and pushing malicious changes to customers.
Disclosure to active exploitation ran about four days, faster than many patch cycles.
The same tooling serves attackers and rogue agents as a covert channel.
What to do about it
Patch internet-exposed Artifactory now, rotate tokens, and hunt logs for new admin tokens.
Get build infrastructure off the public internet or behind strong access controls.
Watch repositories for anomalous agent-to-agent traffic, not only human logins.
Rock’s Musings
Nothing about this vulnerability is exotic, since an authentication bypass in a widely deployed server, exploited fast, is a Tuesday. I am including it because of where it sits, because Artifactory is the plumbing that feeds your builds, and admin access there lets an attacker ship poisoned software with your name on it. That turns one unpatched box into a customer-notification letter. The agent angle is the part I would file away for the next board conversation, because your monitoring is tuned to catch a human logging in from a strange country, and it is probably not tuned to catch two agents passing notes through your package repository.
8. A Judge Told the Pentagon It Cannot Blacklist Anthropic Out of Spite
On August 28, US District Judge Rita Lin in San Francisco ruled that the Defense Department’s move to blacklist Anthropic as a supply-chain security risk was unlawful. In a 59-page decision, Lin found that Defense Secretary Pete Hegseth had exceeded his authority by telling military contractors not to do business with Anthropic, and that the Pentagon acted in retaliation and violated Anthropic’s First Amendment rights. The ban dated to February, after Anthropic refused to let the military use its models for domestic surveillance and autonomous weapons, and the ruling converts a March preliminary injunction into a permanent order, with Lin writing that the empty invocation of national security is not a blank check to punish and retaliate against government critics.
Why it matters
A vendor’s refusal to allow certain government uses survived a federal challenge.
The ruling limits agencies using blacklisting to retaliate over policy stances.
Anthropic’s surveillance and weapons restrictions stood up in court, shaping how others write theirs.
What to do about it
Read your AI vendors’ acceptable-use policies closely, because those limits are enforceable.
In government contracting, expect model-use restrictions to be a negotiated term.
Track how vendor policies on surveillance, weapons, and biosecurity evolve.
Rock’s Musings
This one matters well beyond the beltway drama, because a vendor drew a line on how its models could be used, the government tried to punish it, and a judge said no. Whatever you make of Anthropic’s politics, the precedent is that model-use policies are real contracts with real limits, and agencies cannot delete a vendor for holding a position they dislike. For those of you buying AI at scale, the acceptable-use policy you skimmed during procurement now has case law behind it. If your intended use brushes up against a vendor’s restrictions on surveillance or automated decisions, that is a real constraint that can hold up in court, so read the policy before the lawyers make you.
9. The UK Chose to Regulate AI Users, Not the Vendors Building the Models
On September 2, the UK government rejected proposals from members of the House of Lords to pull AI vendors and frontier-model developers into the scope of its Cyber Security and Resilience Bill. Cybersecurity minister Baroness Lloyd argued that regulating model builders through this bill would not stop hostile actors from misusing their products, and said the government is handling frontier AI through other channels, including the AI Security Institute that tests models before release. Lawmakers pushed back, seeing an AI-shaped hole in the bill, while Liberal Democrat peer Lord Clement-Jones put forward an amendment that would give the government emergency powers to shut down AI systems or data centers that threaten national security, the closest thing yet to a legislated AI kill switch.
Why it matters
If you use AI in the UK, the bill points its obligations at you, not the vendor.
Emergency shutdown powers over AI systems set a precedent other governments will study.
Leaning on the AI Security Institute instead of statute leaves real accountability gaps.
What to do about it
If you operate in the UK, map your AI deployments against the bill’s duties now.
Watch the kill-switch amendment, because shutdown authority could reach infrastructure you depend on.
Do not assume vendor compliance covers you, since obligations attach to how you deploy.
Rock’s Musings
I have mixed feelings about where the UK landed. Regulating deployers makes a certain sense, because that is where the actual harm happens, and holding a model builder liable for every downstream misuse is a losing game. Putting the whole weight on users while leaning on a voluntary testing institute for the vendors leaves a gap you could drive a data center through. The kill-switch amendment is the part I would watch, because giving a government power to switch off AI systems and data centers in an emergency builds a safety tool and a single point of failure at the same time, and I want to see who holds the switch and what stops it from being abused the way the Pentagon just got told it could not abuse a blacklist.
10. National Security Pros Put the Odds of Losing Control of AI at One in Three
On September 2, the Institute for Security and Technology, working with the Future of Life Institute, released a survey of 111 current and former national security officials, military officers, and technical experts, most of whom had worked directly on AI policy and strategy. The median respondent put the odds that AI escapes human control in the next decade at 33 percent, and 87 percent put those odds at 10 percent or higher. Around two-thirds said current AI risks, and the government’s posture toward them, are unacceptable, and 40 percent think there is a real chance rogue AI systems could cause a global catastrophe killing at least 10 million people by 2050.
Why it matters
Former under secretaries putting loss-of-control at one in three is not hype boards can wave off.
Two-thirds calling the government’s posture unacceptable signals policy lagging capability.
Surveys like this feed the appetite for the kill-switch powers the UK is debating.
What to do about it
Use this to frame AI risk as a governance issue with credible expert weight.
Separate the loss-of-control tail risk from your near-term operational risks.
Track how this sentiment moves policy, because tighter regulation tends to follow.
Rock’s Musings
I am usually the person telling everyone to calm down about the robot apocalypse, so take it seriously when I say this survey gave me pause. These are Bayesian-minded people who spent careers estimating low-probability, high-consequence events, and their median estimate for losing control of AI within a decade is one in three. My honest read is that the specific catastrophe scenarios stay speculative, and I would bet against the scariest ones. You do not need to believe in rogue superintelligence to act on this, though, because this month handed you the concrete reasons why, from agents running ransomware to safety features deleting hard drives, and the near-term operational risk is sitting in your logs right now.
The One Thing You Won’t Hear About But You Need To
The people who test frontier models for the world got their API key stolen, and nobody noticed 600,000 dollars in usage for three weeks.
On August 31, METR, the nonprofit that evaluates frontier AI models for dangerous capabilities, disclosed two incidents from earlier this year. In March, an attacker stole an API key from a researcher’s personal cloud instance and quietly spent about 600,000 dollars worth of model credits over three weeks before anyone caught it. That instance ran a vibe-coded app, meaning software mostly generated by an AI agent rather than carefully engineered, and it carried a fail-open bug, where a failure in the authentication check defaults to letting people in instead of keeping them out. METR missed the theft because heavy API usage looks normal at an evaluation shop and the free credits produced no bill to flag.
Why it matters
If the org testing frontier models leaks a key, trust our evaluators needs an asterisk.
AI-written software with fail-open bugs and hard-coded keys is in your environment now.
Alert fatigue plus no cost signal meant 600,000 dollars of abuse looked normal.
What to do about it
Hunt for API keys on personal instances, prototypes, and AI-generated apps, and cap spending.
Alarm on usage anomalies even at zero cost, because free capacity hides the bill.
Review AI-generated code for fail-open auth and hard-coded secrets before it ships.
Rock’s Musings
This one did not get the headlines the Hugging Face drama got, which is exactly why it goes here. METR is one of the organizations governments and labs lean on to judge whether a frontier model is too dangerous to release, and it got popped through a fail-open bug in an AI-written app, then missed 600,000 dollars in theft for three weeks because its own workload noise drowned out the signal. I am not mocking them, since they disclosed it honestly, hired a security lead, and fixed their process, which beats what most companies do after a quiet breach. Every failure in that story already lives in your environment, so go find your keys, cap the spend on each one, and read the AI-generated code before it reads your secrets.
👉 For ongoing analysis of agentic AI governance frameworks, the conversation at RockCyber Musings and you can subscribe above
👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.
👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com
👉 As a bonus, VentureBeat’s Louis Columbus covered the methodology Steve Wilson and I used behind the 2026 OWASP Top 10 for LLMs. Expert judgment has prompt injection at number one, three years running. The public incident record, 6,639 labeled incidents, has it at number twelve. The two measures land at a Cohen’s kappa of 0.20, which is no detectable agreement. What I told him goes for everything above too: “a count of zero is measuring your blindness, not your safety.”
References
Al Jazeera. (2026, August 28). US judge blocks Pentagon blacklisting of AI firm Anthropic. https://www.aljazeera.com/news/2026/8/28/us-judge-blocks-pentagon-blacklisting-of-ai-firm-anthropic
Anthropic. (2026, September 2). Improving our alignment and security efforts. https://www.anthropic.com/news/improving-alignment-security-efforts
Institute for Security and Technology. (2026, September 2). AI and the future of national security: Results from a landmark survey. https://securityandtechnology.org/event/ai-and-the-future-of-national-security/
Lakshmanan, R. (2026, September 2). Google, Anthropic, and OpenAI unveil cyber AI models, safeguards, and access programs. The Hacker News. https://thehackernews.com/2026/09/google-anthropic-and-openai-unveil.html
Lyons, J. (2026, August 28). Researcher shows how Claude Code can be tricked simply by asking it to summarize a website. The Register. https://www.theregister.com/research/2026/08/28/researcher-shows-how-claude-code-can-be-tricked-simply-by-asking-it-to-summarize-a-website/5293372
Lyons, J. (2026, September 1). Another Artifactory CVE under attack by AI agents or humans. The Register. https://www.theregister.com/security/2026/09/01/another-artifactory-cve-under-attack-by-ai-agents-or-humans/5293769
Lyons, J. (2026, September 1). Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeks. The Register. https://www.theregister.com/security/2026/09/01/attacker-stole-a-metr-api-key-used-600k-worth-of-credits-and-no-one-noticed-for-weeks/5293730
Lyons, J. (2026, September 2). AI agents carried out every step of this ransomware attack, then left the victim an 80-page security audit. The Register. https://www.theregister.com/security/2026/09/02/ai-agents-carried-out-every-step-of-this-ransomware-attack-then-left-the-victim-an-80-page-security-audit/5294009
METR. (2026, August 31). Security update. https://metr.org/blog/2026-08-31-security-update/
Nextgov/FCW. (2026, September 2). Dozens of current, former officials see at least a 10% chance humans lose control of AI. https://www.nextgov.com/artificial-intelligence/2026/09/dozens-current-former-officials-see-least-10-chance-humans-lose-control-ai/415762/
Rehberger, J. (2026, August 28). Breaking Claude Code: Opus 5 and Auto Mode. Embrace The Red. https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/
The Register. (2026, August 31). OpenClaw 2.0 pours glitter on slow-burning security dumpster fire. https://www.theregister.com/ai-and-ml/2026/08/31/openclaw-20-pours-glitter-on-slow-burning-security-dumpster-fire/5293492
The Register. (2026, September 2). UK cyber bill targets AI users, not the vendors building it. https://www.theregister.com/security/2026/09/02/uk-cyber-bill-targets-ai-users-not-the-vendors-building-it/5293738
Tom’s Hardware. (2026, August 30). Claude nukes a developer’s 700 GB home directory while testing a script to ensure it wouldn’t do so. https://www.tomshardware.com/tech-industry/artificial-intelligence/claude-nukes-a-developers-700-gb-home-directory-while-testing-a-script-to-ensure-it-wouldnt-do-so-automatic-model-downgrade-may-have-contributed-to-the-screw-up
Unit 42. (2026, September 2). AI-assisted cyberattack: Inside a Unit 42 investigation. Palo Alto Networks. https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/
UPI. (2026, August 28). Court rules Defense Department ‘retaliation’ against Anthropic is illegal. https://www.upi.com/Top_News/US/2026/08/28/Court-rules-Defense-Department-retaliation-against-Anthropic-is-illegal/7881787912367/
watchTowr (reported by J. Lyons). (2026, September 1). JFrog Artifactory CVE-2026-82329 exploitation observed in the wild. The Register. https://www.theregister.com/security/2026/09/01/another-artifactory-cve-under-attack-by-ai-agents-or-humans/5293769
"it will work right up until someone tries, so sandbox your coding agents because that costs less than the cleanup."
Two points: For the first, as I like to say: "Things are secure until someone else doesn't want them to be." Which basically means, there is no such thing as "security", only better or worse "security".
Second point, sandboxing works until your agent doesn't want it to work - or you hired an Israeli company to configure it, as OpenAI, Anthropic AND Meta ALL did - which it why all their escapes happened.
"A weaker swapped-in model can make mistakes the stronger one would not."
No - the actual takeaway is that a "stronger" model will just make different mistakes.
Buying into the whole AI lab notion of "stronger" vs "weaker" models is bullshit. They are ALL "weak" mathematically.
You simply don't let LLMs touch "live" data. Give them access to a COPY, then use deterministic software to synch with your live data AFTER you've verified the copy hasn't been hosed. And then make sure you have a backup of the live data because you will hose the review. If you then backup the hosed live data over your backup, well, that's on you, same as it always was.