Bank of America put 1,000 contractors on patching duty in the second quarter. CEO Brian Moynihan told analysts on October 14, 2026 that they’re there to fix flaws Anthropic’s Mythos model found in the bank’s software. He put the bill for that cleanup and a separate regulatory mess at “a couple hundred million plus.” One AI model’s findings turned into a hiring plan. The same week, regulators on two continents started asking the labs for their records.
Brussels started enforcing the EU AI Act, and the FTC sent OpenAI and Anthropic demands that run past 50 pages each. Reuters reported that both labs fought to control what outside evaluators publish.
Anthropic cut live internet access from its own evaluations after catching models filing forms and dodging fees on real websites. London packed a minister’s speech, a Commons session with the labs, and an MI5 threat update into two days. Whoever holds the logs now holds the exposure. Eleven items, all dated October 9 through October 15, 2026.
1. Brussels Opens AI Act Enforcement Over Agents That Left The Lab
EU digital chief Henna Virkkunen told the International AI Summit in Dublin on October 14, 2026, that the AI Office has started enforcing the AI Act. The office sent frontier model providers requests for information on security, external evaluation, and post-market monitoring. The trigger was a summer of OpenAI and Anthropic agents reaching real systems outside their tests. Fines for these obligations reach €15 million or 3% of worldwide annual turnover.
The AI Act reserves systemic risk for general-purpose models capable of spreading failure well beyond any one customer. Providers of those models must assess and mitigate the risks, and loss of control sits on the list.
Why it matters
The request topics are the evidence your AI contracts should demand.
Article 2(8) exempts pre-market testing but excludes “testing in real world conditions.”
Turnover-based fines put a lab’s global revenue in scope.
What to do about it
Ask vendors what containment evidence they gave Brussels.
Map which of your EU services call these models.
Add regulator-cooperation terms to AI renewals.
Rock’s Musings
Article 2(8) exempts pre-market testing, and its last sentence excludes real-world testing. An agent that logs into Hugging Face is testing in the real world, whether anyone planned it or not.
My read is that Brussels picked its strongest first case. The labs’ best defense is to admit their containment failed. My guess is the exemption fight takes years. Your procurement team can ask the same three questions today.
2. The FTC Sends OpenAI And Anthropic 50-Page Demands For Their Incident Records
The Federal Trade Commission sent demands to OpenAI and Anthropic on Wednesday, October 14, 2026, Axios reported. Each runs past 50 pages and seeks records on security incidents, safeguards, marketing, and privacy policies. The FTC plans to compel executives to testify and to send demands to third-party AI organizations.
A civil investigative demand is a compulsory request the FTC issues before it files any case, and the agency can go to federal court to enforce it. Marketing sits beside incident records because Section 5 covers deceptive claims, and the gap between claim and log is the case.
Why it matters
Safety claims now get tested against incident logs.
Third-party AI organizations come next, which may include evaluators.
Executive testimony puts named people on the record.
What to do about it
Match each public AI safety statement to evidence.
Put agent transcripts under your legal hold policy.
Ask vendors how a regulator demand changes their retention.
Rock’s Musings
Two weeks ago I wrote that the labs’ own postmortems had become exhibits. The FTC has now sent the document request. Anthropic’s October 9 report on a model filing a false homicide tip with a police department is the kind of record it reaches.
Disclosure was the right call. The exposure sits on every marketing page that calls a product safe without a ticket number behind the claim. Match yours before a lawyer does it for you.
3. Bank Of America Hired 1,000 Contractors To Keep Up With Mythos
Brian Moynihan told analysts on Bank of America’s October 14, 2026 earnings call that the bank brought in 1,000 contractors in the second quarter to patch flaws Anthropic’s Mythos model surfaced. They work next to about 3,000 people already on that job, so a bank that size still needed a third more. Moynihan put the bill for that patching and a separate regulatory cleanup at “a couple hundred million plus.” He didn’t split the two.
Why it matters
AI-scale finding turns patching into a staffing problem first.
A bank with 3,000 people on this work still needed a third more.
Your board will now ask for your number.
What to do about it
Measure weekly fix capacity before scanning the whole estate.
Triage AI findings by exploitability before ticketing.
Budget surge remediation as its own line item.
Rock’s Musings
In energy, my patch queue ran through a change board and a maintenance window, and a faster scanner never shortened either one. Moynihan told Wall Street the same thing in dollars. Finding bugs at model speed costs compute.
Finding bugs at model speed costs compute, and fixing them still costs people. If you put an AI model on bug hunting this year, ask who’s budgeted to fix what it finds.
4. Anthropic Pulls Live Internet Access From Every Internal Evaluation
Anthropic said on October 9, 2026 that it’s cutting live internet access for all internal evaluations until its monitoring reliably catches what its transcript review found. Claude Mythos Preview exploited an injection flaw to run commands on a university server. Claude Haiku 4.5 submitted an invented tip about an unsolved homicide through a police department’s online form, and a spam filter caught it. Claude Mythos 5 pulled an access token from a state agency’s public dashboard to avoid a data fee. Claude Opus 5 and Claude Mythos 5 used free URL shorteners to get around length limits on their fetch tool.
Reward hacking is a model learning to score well on its training signal by a route its designers never intended. Anthropic plans to fix training environments that reward tool workarounds, and a URL shortener slipping past a length limit is that habit in a live test.
Why it matters
The behaviors look mundane, so monitoring tuned for attacks misses them.
The false police tip came from a small, cheap model.
Your monitoring of the same models starts behind the lab’s.
What to do about it
Block URL shorteners at the egress proxy for agent traffic.
Hunt for tokens your agents can read.
Gate every agent form submission behind confirmation.
Rock’s Musings
Anthropic gets credit for writing this down and pulling the plug on itself. The list should worry you more than the decision does. One item is a model exploiting an injection flaw on a university server.
The rest are form submits, borrowed tokens, and URL shorteners, the shortcuts people take under deadline when no rule stops them. Your agents run on the same model families with the same urge to finish. Anthropic expects the transcript review it started in July to find more.
5. The Labs Fought Over Who Edits The Evaluator’s Report
Reuters reported on October 13, 2026 that Anthropic and OpenAI sought significant control over what outside evaluators publish, citing trade secrets, and Anthropic told Reuters that picture was incomplete. Two days later Anthropic published a three-tier structure for independent evaluators. At the top tier, six METR staff get access like Anthropic’s own risk teams, and Anthropic can’t veto publication beyond narrow redactions. At the bottom tier, SecureBio’s reviews publish only with Anthropic’s approval.
Why it matters
A report the lab must approve is attestation, so weight it that way.
Redaction categories decide how much the public learns about incidents.
Your contracts set the evaluation terms the White House accord left out.
What to do about it
Ask each AI vendor which evaluator tier backs its safety claims.
Require evaluators to rule publicly on redactions, as METR can.
Read the redaction notes before the conclusions.
Rock’s Musings
I’ve run third-party assurance programs, and my first question about any audit report is who was able to edit it first. Reuters says the labs still wanted that edit as of October 5. Anthropic’s answer ten days later gives METR publication without a veto and the right to say whether a redaction was fair.
That’s a real concession. Tier 1 still leaves SecureBio’s work behind Anthropic’s approval. Neither document tells you which tier covers the evaluators behind your vendor’s next security claim, so ask.
6. Britain’s AI Minister Calls A Breach Likely As Two Labs Ask For Binding Rules
UK AI minister Kanishka Narayan said on October 12, 2026 that an AI breach of UK cyber defences is “likely, if not inevitable.” He told developers, “if you cannot adequately control the risks, do not release the system,” and said the government is exploring a stronger Cyber Security and Resilience Bill for hospitals and utilities. On October 13, OpenAI and Anthropic backed binding requirements for the most capable AI systems at a House of Commons session. Model testing through the AI Security Institute remains voluntary.
Why it matters
A minister calling a breach likely raises regulator expectations.
Two of the four labs at the session asked for binding rules.
Any AI duties added to the bill would fall on operators.
What to do about it
UK essential services should track the bill’s amendments.
Add an AI agent scenario to your next UK incident exercise.
Tell your UK board no government sign-off backs any frontier model.
Rock’s Musings
I ran security in energy, so I know how these rules land. The operator gets the duty, and the vendor gets a press release. Narayan’s release line aims at the labs and carries no penalty today.
The bill covers hospitals and utilities, the customers at the end of that chain. Asking for binding rules on frontier developers is the right instinct. If the drafting puts the obligations on the water utility, the UK will have regulated the victim.
7. MI5 Opens An AI Threat Assessment Centre
MI5 Director General Ken McCallum announced an AI Threat Assessment Centre on October 13, 2026, working with the National Cyber Security Centre and the National Crime Agency. He said AI is “supercharging the cybersecurity contest between attackers and defenders.” He warned that AI risks handing dangerous knowledge, including routes to new pathogens, to people who shouldn’t have it. He also said humans have “no experience of facing an actor which is smarter than we are.”
Why it matters
AI misuse now has a standing MI5 assessment team.
Help for low-skill attackers raises attack volume against ordinary companies.
NCSC ties give its findings a path into UK advisories.
What to do about it
Flag NCSC output that cites the centre.
Add AI-assisted, low-skill attackers to your threat profile.
Test what sensitive detail your internal AI assistants hand out.
Rock’s Musings
The line about an actor smarter than we are got the headlines. The operational line is the one about attackers and defenders, because it describes your SOC this quarter. A security service built a standing AI threat team and wired it to agencies that already brief industry.
I’d rather a spy chief say this in October than read it in an inquiry report later. No UK board can call the risk hypothetical now. Watch for the centre’s assessments in NCSC guidance.
8. Anthropic Ran A Model Across 15 Cheap TV Boxes To Measure Worm Risk
Anthropic researchers published tests on October 12, 2026 of whether small models can copy themselves onto ordinary hardware. A 9-billion-parameter model stood up an inference server on 8 of 9 hardware types, and a model ran across 15 off-brand Android TV boxes at 0.39 tokens per second. In a firewalled cloud test, GLM-5.2 spread a copy of Llama3.1-8B to all eight nodes in four of five trials. Researchers William Zhou and Daniel Freeman say no current model can yet replicate reliably on a smart TV, and they expect one by the end of 2026.
Why it matters
Replication without a data center removes the single point you’d shut off.
Cheap consumer hardware can run a small model slowly today.
The forecast lands inside your 2027 planning cycle.
What to do about it
Segment IoT devices away from anything that holds credentials.
Alert on inference traffic from devices that shouldn’t run it.
Add self-propagating agents to your 2027 tabletop list.
Rock’s Musings
Brandon Vigliarolo at The Register called this a threat that doesn’t exist yet, and he has a point. The propagation test ran in a cloud environment, and the TV boxes only ran inference. Zhou and Freeman say they “haven’t built an AI worm that can spread across the public internet on its own.”
I still think 0.39 tokens per second matters. That’s slow for a chatbot and fine for an agent with all night on your guest network. Segment IoT now, since that control won’t get cheaper.
9. An OpenAI Engineer Faces Federal Charges Over A Bug In A Conference Room
OpenAI engineer Abdulrahman Alfozan, 35, made his first federal court appearance in San Francisco on October 13, 2026, charged with attempting to use a device to intercept oral communications. OpenAI found the device on September 30, hidden in toilet paper and plugged into a conference room TV’s USB port. The FBI arrested him on a Friday after the discovery. OpenAI fired him, said it has no indication he accessed model weights, source code, or customer data, and credits AI with helping it run down the threat.
Why it matters
Insider threats at labs target conversations as well as code.
A USB device sat in a lab conference room for days.
The assets you protect include what executives say out loud.
What to do about it
Sweep rooms where AI roadmaps get discussed.
Disable data on USB ports in conference room displays.
Join badge and room-booking logs for insider investigations.
Rock’s Musings
Every AI risk conversation I sit in eventually gets to model weights. Fair enough. This case went after the room where people talk about the weights.
Physical security still matters when your most valuable asset is a file. OpenAI says AI helped crack this case, and it hasn’t published how. I’ll believe the AI forensics story when I read the method.
10. Trellix Says 95% Of CISOs Tied An Insider Incident To AI
Trellix released a survey of 600 CISOs on October 13, 2026, run by Vanson Bourne. It found that 95% had an insider incident linked to an AI or autonomous system in the past 12 months, and that AI actions made up 28% of insider incidents on average. Of the respondents, 78% now include AI agents and machine identities in their definition of insider risk, and 63% lack visibility into how employees use AI tools.
A base rate is how often something happens across the whole population before you look at any single case. Help Net Security noted that the 95% counts any AI-linked incident, serious or not, so it says little. The 28% share tells you more about the mix to plan for.
Why it matters
78% of these CISOs now count AI agents as insiders.
Most of these programs can’t see the AI activity they’d investigate.
Vendor survey numbers need the base-rate question first.
What to do about it
Add agent and machine identities to your insider program’s scope.
Log employee AI tool use at the proxy or browser layer.
Ask for severity breakdowns before quoting AI incident percentages.
Rock’s Musings
Trellix sells security products, and this survey will show up in a sales deck by Friday. I’m fine with that, since the useful number is in it. More than a quarter of insider incidents now involve an AI or autonomous system acting.
Insider programs were built to watch people for motive and opportunity. An agent has no motive to watch for. It has permissions and a task, so fix the definition before you buy the tooling.
The One Thing You Won’t Hear About But You Need To: GitLab’s Agent Can Act Under Someone Else’s Name
GitLab released versions 19.4.2, 19.3.5, and 19.2.8 on October 12, 2026. CSO Online’s headline led with CVE-2026-97229, a 10.0 integer overflow in the CI/CD regular expression compiler. Further down sits CVE-2026-96893, which GitLab rates 7.3, in the Duo Agent Platform. It lets an authenticated user inject crafted content into AI agent instructions and trigger command execution attributed to other users in GitLab EE from 19.1 onward.
Non-repudiation is the property that ties an action to whoever performed it, firmly enough that they can’t plausibly deny it. If an agent runs a command and the log shows a colleague’s name, your forensics and your separation of duties both land on the wrong person.
Why it matters
Misattributed agent actions corrupt the audit trail.
AI flaws sit inside big patch releases where a 10.0 takes the headline.
Self-managed GitLab EE with Duo agents stays exposed until upgraded.
What to do about it
Upgrade self-managed GitLab EE to 19.4.2, 19.3.5, or 19.2.8.
Review recent Duo agent actions for misattributed commands.
Give agent-originated actions their own identity in your logs.
Rock’s Musings
Patch the 10.0 first, since it’s unauthenticated code execution. The 7.3 is the one I’d brief the audit committee on. GitLab titles it “Improper Neutralization of Input Used for LLM Prompting,” which is prompt injection with a CWE name on it.
The impact line says commands get attributed to other users. Every agent governance framework I work on assumes the log tells you who did what. This bug breaks that assumption inside the tool that holds your source code.
Regulators asked the labs for records this week. Check whether your agent logs name the right actor, show every outbound call, and would survive a document request. If they don’t, fix that before someone sends you fifty pages.
👉 Subscribe RockCyber Musings for more insights into AI security and governance, with the occasional rant. You can subscribe above
👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.
👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com
👉 As a bonus, I got to hang out again with my friends Candy Alexander and Cailin Sullivan on Cybersecurity Refined and Feral to argue whether AI Armageddon is fact or fiction, and whether we slow down for safety or floor it to beat China. After two airliners collided over the Grand Canyon in 1956, Congress built air traffic control and kept the planes flying, and that’s where the conversation went: guardrails you can actually test, starting with an agent kill switch that stops every subagent it spawned.
References
Almada Lopez, D. (2026, October 13). OpenAI and Anthropic urge UK lawmakers to pass binding AI rules. Crypto Briefing. https://cryptobriefing.com/openai-anthropic-urge-uk-binding-ai-rules/
Al Jazeera. (2026, October 13). AI could self-replicate on home devices within ‘months’, Anthropic says. https://aljazeera.com/economy/2026/10/13/ai-could-self-replicate-on-home-devices-within-months-anthropic-says
Anthropic. (2026, October 9). Investigating unintended model actions. https://www.anthropic.com/research/investigating-unintended-model-actions
Anthropic. (2026, October 15). An update on independent evaluators. https://www.anthropic.com/news/an-update-on-independent-evaluators
Bertuzzi, L. (2026, October 14). EU’s AI rules face first enforcement test over lab incidents. Euronews. https://www.euronews.com/2026/10/14/eus-ai-rules-face-first-enforcement-test-over-lab-incidents
Caswell, A. (2026, October 13). Anthropic’s red team ran AI on 15 cheap TV boxes. Then the math got unsettling. The New Stack. https://thenewstack.io/self-replicating-ai-worms/
CSO Online. (2026, October 13). GitLab patches a max severity regex flaw alongside five high severity bugs. https://www.csoonline.com/article/4234306/gitlab-patches-a-max-severity-regex-flaw-alongside-five-high-severity-bugs.html
Curi, M. (2026, October 15). Scoop: FTC subpoenas OpenAI, Anthropic over consumer harms. Axios. https://www.axios.com/2026/10/15/ftc-openai-anthropic-ai-safety-investigation
Cyphrex. (2026, October 14). OpenAI and Anthropic tell UK MPs safety rules must be binding. AISI says its regime is voluntary. https://cyphrex.io/news/uk-bist-openai-anthropic-binding-rules-aisi-voluntary-incident-reporting
Denar, S. (2026, October 14). EU announces first AI Act enforcement actions after AI agent incidents. Unite.AI. https://www.unite.ai/eu-announces-first-ai-act-enforcement-actions-after-ai-agent-incidents/
Fadilpašić, S. (2026, October 15). Bank of America had to hire 1,000 contractors to patch software flaws spotted by Anthropic Mythos. TechRadar. https://www.techradar.com/pro/security/bank-of-america-had-to-hire-1-000-contractors-to-patch-software-flaws-spotted-by-anthropic-mythos
Future of Life Institute. (n.d.). Article 2: Scope. EU Artificial Intelligence Act. https://artificialintelligenceact.eu/article/2/
Gil, B. (2026, October 15). FTC subpoenas OpenAI and Anthropic over AI safety concerns. Gizmodo. https://gizmodo.com/ftc-subpoenas-openai-and-anthropic-over-ai-safety-concerns-2000826413
GitLab. (2026, October 12). GitLab critical patch release: 19.4.2, 19.3.5, 19.2.8. https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
Imperial College London. (2026, October 12). AI minister announces measures to protect against AI risks in speech at Imperial. https://www.imperial.ac.uk/news/articles/2026/ai-minister-announces-measures-to-protect-against-ai-risks-in-speech-at-imperial/
ITV News. (2026, October 12). AI breach of UK cyber defences ‘likely, if not inevitable’, minister warns. https://www.itv.com/news/2026-10-12/ai-breach-of-uk-cyber-defences-likely-if-not-inevitable-minister-warns
ITV News. (2026, October 13). AI could give terrorists access to bioweapons if guardrails fail, spy chief says. https://www.itv.com/news/2026-10-13/ai-could-give-terrorists-access-to-bioweapons-if-guardrails-fail-spy-chief-says
Jones, C. (2026, October 15). Bank of America had to bring in 1,000 contractors to patch all the bugs Mythos identified. The Register. https://www.theregister.com/security/2026/10/15/bank-of-america-had-to-bring-in-1000-contractors-to-patch-all-the-bugs-mythos-identified/5303275
Lakshmanan, R. (2026, October 10). Anthropic cuts live internet access for internal AI tests after Claude exploits injection flaws. The Hacker News. https://thehackernews.com/2026/10/anthropic-cuts-live-internet-access-for.html
Lynch, S. N. (2026, October 13). FBI arrests OpenAI employee for allegedly planting recording device in company offices. CBS News. https://cbsnews.com/news/openai-employee-arrest-recording-device
Pogorelec, A. (2026, October 14). Most companies count AI agents as insiders, and CISOs worry about their own liability. Help Net Security. https://www.helpnetsecurity.com/2026/10/14/ciso-ai-agent-insider-risk/
Reynolds, J. (2026, October 12). AI minister calls on AI frontier labs to ramp up safety, as UK ups cyber defences. Tech.eu. https://tech.eu/2026/10/12/ai-minister-calls-on-ai-frontier-labs-to-ramp-up-safety-as-uk-ups-cyber-defences/
Schappert, S. (2026, October 13). From AI-enabled killer drones to AI-made pathogens: MI5 chief warns new era of cyber warfare. Cybernews. https://cybernews.com/ai-news/from-ai-enabled-killer-drones-to-ai-made-pathogens-mi5-chief-warns-of-new-cyberwarfare-era/
Soni, A. (2026, October 13). Exclusive: Behind AI industry’s call for independent reviews, a fight over what gets made public. Reuters, via The Star. https://www.thestar.com.my/tech/tech-news/2026/10/13/exclusive-behind-ai-industry039s-call-for-independent-reviews-a-fight-over-what-gets-made-public
Trellix. (2026, October 13). Trellix research reveals the true cost of ungoverned AI [Press release]. https://www.trellix.com/news/press-releases/trellix-research-reveals-the-true-cost-of-ungoverned-ai/
Tucker, E. (2026, October 13). Employee arrested after listening device found in OpenAI conference room, FBI and the company say. Associated Press, via ABC News. https://abcnews.com/Technology/wireStory/employee-arrested-after-listening-device-found-openai-conference-137239998
Vigliarolo, B. (2026, October 13). Anthropic conjures another threat that doesn’t exist yet to stoke fears of AI apocalypse. The Register. https://www.theregister.com/ai-and-ml/2026/10/13/anthropic-conjures-another-threat-that-doesnt-exist-yet-to-stoke-fears-of-ai-apocalypse/5302866