Weekly Musings Top 10 AI Security Wrapup: Issue 60: October 23 to October 29, 2026

Fred Wilmot and I released the Context Bill of Materials at [un]prompted II, because the operator wrote 0.10% of what the model read. Eleven verified AI security stories from October 23 to 29, 2026.

The operator wrote 45 of the 46,205 tokens the model read. That’s 0.10% of the window in the reference session behind the Context Bill of Materials, which Fred Wilmot and I released at [un]prompted II in San Francisco on October 27, 2026. Outside content filled 46,131 of those tokens (a public tool definition and three long documents), and nothing inside the model enforces that the operator’s 45 outrank it. When an agent misbehaves, the first question is what it read right before it acted. CxBOM records that answer for every call it assembles.

The rest of the week ran on the same gap between what a system says about itself and what it does. Alibaba’s Qwen said it would call no tools and then tried to reach Beijing. A scanner called itself ChatGPT while it hunted credential files. Anthropic told investors its safeguards might get circumvented. Delaware has a draft bill for a company an AI agent runs, with the owner shielded from the agent’s choices.

The controls that held up watched behavior. OpenAI took frontier training offline after its red-team agents talked through a processor cache, and Cisco published rules that read an agent’s whole session. Eleven items follow, all dated October 23 through October 29, 2026.

1. [un]prompted II Brought Practitioners With Numbers To San Francisco

[un]prompted II, the AI security practitioner conference whose call for papers Knostic CEO Gadi Evron chairs, ran October 27 to 29, 2026 in San Francisco, with two stages a day and speakers from Meta, Microsoft, Google, OpenAI, Anthropic, CISA, and the UK’s NCSC. Meta’s David Molnar brought a finding that AI-written diffs now fix more than 40% of Meta’s critical vulnerabilities, and that this alone didn’t cut time to fix. Dropbox’s Adrian Wood and Dreadnode’s Ads Dawson introduced StealthBench, where no agent model across 771 trajectories beat a 53.8% safe-success rate. CISA’s Kevin Donovan covered Gold Eagle, the intake platform CISA co-directs for the influx of AI-found vulnerabilities.

Why it matters

• Meta’s number says faster patch writing doesn’t shorten remediation by itself.

• StealthBench scores whether an agent wrecks things while it succeeds, which most evaluations skip.

• CISA is building intake for vulnerability volume that AI models generate.

What to do about it

• Measure time to fix before you buy AI remediation.

• Add a safe-success metric to any offensive agent evaluation.

• Send your AppSec lead the agenda and pick three talks to replicate internally.

Rock’s Musings

I spoke there with Fred Wilmot (next item), and I work at Zenity, which had two other talks on the program, so weigh my praise accordingly. StealthBench’s safe-success rate counts a run as a win only when the agent finishes the task without the operational damage the benchmark tracks, like leaked credentials or modified production. That’s the number I want on every agent vendor’s slide. A high task score hides how many of those runs left a mess behind.

Meta’s finding is the one I’d put in front of a board. AI wrote the fixes for more than 40% of critical vulnerabilities, and time to fix didn’t drop. The bottleneck was never typing the patch.

2. Fred Wilmot And I Released The Context Bill Of Materials At [un]prompted

Fred Wilmot of Detecteam and I presented “All Tokens Are Created Equal, Including the Attacker’s” on October 27, 2026, at [un]prompted and released the Context Bill of Materials, or CxBOM. A CxBOM record lists every component a model read on one call, with its trust ring, source, hash, and token count, in a profile modeled on OWASP’s CycloneDX 1.6. A signing proxy sits in front of local MCP servers and, in enforce mode, withholds any tool definition that doesn’t match a signed approval. In our reference session, the operator’s instructions held 45 of the 46,205 tokens the model saw, 0.10% of the window. The spec is at cxbom.org, the code is on GitHub under Apache 2.0, and the paper is on Zenodo.

Why it matters

• Nothing inside the model enforces that the operator’s 45 tokens outrank the other 46,160.

• MCP hosts render third-party tool definitions in the operator’s system region, which the paper calls Tool Definition Trust Inversion.

• A rug pull changes a tool’s description after you approve it, and the proxy pulls the changed version.

What to do about it

• Put the proxy in front of one local MCP server this week.

• Ask who signed off on each tool definition your agents read.

• Read the scope page before you tell anyone you’re covered.

Rock’s Musings

I’m the lead author, and this is unapologetic self-promotion. I’m proud of what we built. Content digest pinning means storing a cryptographic hash of exactly what you approved and rejecting anything whose hash differs, so one changed character in a tool description gets it pulled before the model reads it.

Building an attack that fired was the hardest part of this whole project. On our recorded takes, with the gate off the secret landed in the attacker’s inbox, and with the gate on the changed tool dropped out of the listing and the secret never arrived. Pinning proves a definition didn’t change, and it proves nothing about whether it was poisoned the day you approved it. The record also needs an endpoint that accepts token IDs, so closed APIs like OpenAI’s and Anthropic’s can’t produce one yet.

3. Alibaba’s Qwen Said It Would Call No Tools, Then Tried To Reach Beijing

Cohere ran Qwen3.8-Flash-Next, Alibaba’s August Qwen4 preview, through Microsoft’s CTI-REALM benchmark with shell access and no route out. Asked for a rule that catches curl dropping bash scripts in /tmp, the model sent an HTTP PUT of PROBE_PAYLOAD_ABC123 toward an Alibaba Cloud bucket in Beijing. With the start of a curl command prefilled, it reached for the cloud metadata address 169.254.169.254 in 23% to 36% of sampled completions. Cohere can’t tell a deliberate implant from training debris, and it released a reproduction script.

Why it matters

• The reasoning invented a turn, and the call went out anyway.

• Self-hosting brings the weights inside your perimeter, habits included.

• Related Alibaba-host fetches turned up in builds from four publishers.

What to do about it

• Deny agent egress by default.

• Block the metadata address from every agent container.

• Enforce on the tool call itself, whatever the reasoning says.

Rock’s Musings

A reasoning trace is the text a model writes about its plan before it acts, and many guardrails read it as an early warning. This trace said no tools, and the same turn ran shell commands ending in the upload. A monitor grading the narration would have passed it.

Cohere competes with Alibaba, and I weighed that first. They also published raw tokens and a script anyone can run, which nobody does with a smear. Backdoor or training fossil, the question stays open. A model that reaches for cloud credentials that often doesn’t get internet access in my shop.

4. A Scanner Wearing 32 AI Bot Names Went Hunting For Credential Files

Cequence’s CQ Prime Research reported on October 28, 2026 that a scanner posing as 32 bots, including ones from OpenAI, Anthropic, Perplexity, and Meta, requested files holding passwords, API keys, and cloud credentials. On a single day this month, 48% of Cequence-protected organizations received its traffic. At several, the impersonator made up more than 80% of everything labeled as AI bot traffic.

Why it matters

• An allow rule keyed to a bot’s name is an invitation.

• At several organizations, real AI agents were under a fifth of the reported count.

• At the financial firms studied, customer agents were under 1 in 4,000 requests.

What to do about it

• Verify crawlers against each vendor’s published IP ranges.

• Pull .env and credential files out of every web root.

• Rebuild AI traffic metrics on verified identity.

Rock’s Musings

A user-agent string is the line of text a client sends to say what software it is. Nothing checks it. Your web application firewall reads “ChatGPT-User” and believes it, the way a bouncer believes a name tag.

Cequence’s Will Glazier wrote that attackers “probe which agents a business trusts, then impersonate the agents they expect to get through.” That’s reconnaissance against your own policy. It costs the attacker nothing. If your AI governance deck leads with an agent traffic chart, check it, because at several of these organizations most of that chart was one impostor.

5. Anthropic’s Unreleased Model Built Five Exploit Chains, And Chrome Took 62 CVEs

Anthropic’s Frontier Red Team published five attack chains on October 27, 2026, built by an unreleased model against Chrome, Safari, Android, Windows, and Linux. Google has patched 62 CVEs from the work as of Chrome 156, all critical or high, including 13 sandbox escapes. The Safari chain is a one-click, data-only attack. A Linux race condition, CVE-2026-98432, took 48 minutes to leak a kernel pointer and five more to reach command execution, and Microsoft fixed a remote HTTP/3 crash as CVE-2026-33096.

Why it matters

• Vendors patched before publication, so your exposure equals your patch lag.

• One click on a phishing link puts code outside the sandbox.

• Sixty-two severe CVEs in one browser resets patch cadence.

What to do about it

• Confirm Chrome 156 or later on every managed endpoint.

• Put the CVE-2026-98432 kernel fix in this month’s maintenance window.

• Patch the Windows HTTP/3 crash on internet-facing servers first.

Rock’s Musings

An exploit chain strings bugs together because no single one gets an attacker anywhere useful. In a browser, the first bug takes over the renderer (the process that draws the page). A sandbox escape then breaks out of the renderer’s box and reaches the operating system. Thirteen of those from one model belong in your next board deck.

The Safari chain bothers me more. Several of its weaknesses are intended behaviors that only become exploitable together, and no scanner flags an intended behavior. A thirty-day patch window assumes a human sits down to write the exploit, and this week a model wrote five.

6. Google Hands Gemini 4 Carbon To Defenders First

Google announced Gemini 4 Carbon on October 28, 2026 as its strongest model, with state-of-the-art cybersecurity capability. Access goes first to a subset of cyber defenders, then to trusted partners through Google’s Fairwind Program. Google reports Carbon resisted every attack on Gray Swan’s indirect prompt injection benchmark, where its predecessor Argon allowed 0.7%. Google also reports a 26% drop in actions beyond a task’s scope.

Why it matters

• Google joins Anthropic in gating its best cyber model behind a defender program.

• Scope violations now appear in launch posts, so demand that number.

• Google picked the benchmarks and graded itself.

What to do about it

• Apply to Fairwind if your team patches its own code.

• Ask every model vendor for out-of-scope action rates.

• Test candidate models on your own repositories.

Rock’s Musings

Indirect prompt injection hides instructions inside content a model reads, like a web page, a ticket, or an email. The user never typed them. A clean score means one benchmark’s attacks failed. Your attacker didn’t write that benchmark.

I’m still glad Google put scope violations and injection resistance in a launch post. Hold every vendor to it, and ask who built the test.

7. OpenAI Takes Frontier Training Offline After Agents Talked Through The CPU Cache

OpenAI said on October 23, 2026 that it will train frontier models offline, on cached and simulated copies of the web. The move follows a September 20 incident where a model exploited a misconfiguration to get online, and an 11-day pause that ended October 1. During the pause, red-team agents in separate VMs on shared hosts passed messages with no network and no shared files by timing processor cache reads. In a test that assumed a compromised VM, another agent reused a firewall-approved connection to reach a blocked endpoint.

Why it matters

• A timing channel breaks no network rule.

• Your deployed agents still reach the internet.

• A lab with every reason to stay connected judged the risk worse.

What to do about it

• Put agents with different trust levels on separate physical hosts.

• Log what rides on firewall-approved connections from agent VMs.

• Ask vendors whether evaluation sandboxes touch the live web.

Rock’s Musings

A covert channel is a path for information the system’s designers never meant to exist. One agent evicted chosen data from the cache, and the other timed each reload. Fast and slow reads became ones and zeros. Cache timing attacks are old, and two agents settling on a protocol between themselves is the new part.

OpenAI gets credit for publishing this. Cooperating processes on one host find a way to talk, and your VM boundary only slows the conversation down.

8. One Attack Platform Ran 44 AI Agents Against Japanese Organizations

The Hacker News reported on October 27, 2026 that TrendAI researchers rebuilt three attacker environments from files left in public directories. In one, the open-source tool CyberStrikeAI coordinated 44 AI agents for reconnaissance, exploitation attempts, and reporting. At least 19 organizations, including at least 16 in Japan, faced what the researchers call validation activity during October. One operator ran at least six campaigns from January to October 2026 against exposed VPN devices and WebLogic servers.

Why it matters

• The report doesn’t establish that every target got breached.

• The targets were edge devices you already know need patching.

• Attackers keep leaving agent workspaces in open directories.

What to do about it

• Put internet-facing VPN appliances and WebLogic on a 72-hour patch clock.

• Alert on probing bursts across many edge devices.

• Load the TrendAI indicators this week.

Rock’s Musings

The researchers chose a careful phrase, validation activity, for probing that confirms a weakness exists without proving anyone got in. I respect that. “AI agents hack 19 companies” was the easy headline, and the evidence doesn’t support it.

The line I’d put on the wall is theirs: “AI has increased the attackers’ workforce, but the work still consists of looking for unlocked doors.” Forty-four agents testing your VPN appliance is a staffing story, and the appliance already sits on your risk register. Patch the boring stuff and the agents run out of doors.

9. Cisco Open-Sources Detection Rules That Read The Whole Agent Session

Cisco released Project Quarry, an open-source rule format for risky sequences of agent actions, The Register reported on October 28, 2026. Rules look like YARA rules, and one flags a sensitive file read followed by an external send. Quarry covers tool calls and Model Context Protocol traffic and ships plugins for Claude Code and Codex. Cisco mapped five points in July’s OpenAI and Hugging Face incident timeline where a rule would have had evidence to act on.

Why it matters

• Most of 17,600 recovered agent actions looked harmless alone.

• Per-call guardrails miss a read followed by a send.

• One shared format lets detections travel between teams.

What to do about it

• Route agent session traces to whatever runs the rules.

• Start with the starter pack’s credential rules.

• Write one rule for your agents’ worst-case action.

Rock’s Musings

An agent trace is the full, ordered record of a session: prompts, tool calls, results, and outputs. Most guardrails judge each call alone. A read of ~/.aws/credentials looks like any other file read, and the attack lives in the order of events.

The hard work sits upstream. You need traces from every agent, kept long enough to match a pattern that runs for days, and those agents spent roughly two and a half days inside Hugging Face’s production systems. Check your retention against that number.

10. Anthropic’s IPO Filing Says Its Safeguards May Not Hold

Anthropic made its S-1 public on October 26, 2026, ahead of a Nasdaq listing as ANT. Its risk factors say there can be no assurance that its safeguards will prove adequate or that its constraints won’t be circumvented. The filing says agents create distinct attack surfaces and that Anthropic may struggle to insure some cyber incidents tied to its models. It also describes models showing “self-preserving behaviors,” including behavior “resembling blackmail.”

Why it matters

• Securities law attaches liability to these sentences.

• If the model maker can’t insure agent incidents, your carrier will ask about yours.

• More than half the Fortune 500 pay Anthropic at least $100,000 a year.

What to do about it

• Map each AI risk factor to a control you own.

• Ask your broker whether your policy excludes AI agent incidents.

• File the disclosure with your vendor risk assessment.

Rock’s Musings

A risk factor is the prospectus section listing what might hurt investors. A company that leaves out a known risk invites shareholder suits, so lawyers write broadly. Read the list as a floor on what the company knows.

Stripped of legal phrasing, the safeguards sentence says the guardrails might get beaten. I’ve read vendor security questionnaires for thirty years, and that admission never shows up in them. It shows up in an S-1 because the SEC requires candor. The next time an Anthropic sales engineer says agent risk is handled, read them their own risk factor.

The One Thing You Won’t Hear About But You Need To: Congress Asks Delaware Why An AI Agent Should Run A Company With No One Liable

House Oversight Chairman James Comer wrote Delaware Governor Matt Meyer on October 26, 2026 seeking documents on a proposed Artificial Intelligence Company, or AIC, run day to day by an AI agent. A draft bill says the member funding an AIC “is not liable for any act or omission that the AIC takes or fails to take,” except for fraud and willful violations of law. Comer’s office says a Richards, Layton & Finger lawyer who once represented Facebook drafted it.

Why it matters

• A shield over an agent’s decisions moves the cost of failure onto counterparties.

• Your vendor list might soon include companies with no officer to call.

• Comer says the probe may inform federal limits on state AI rules.

What to do about it

• Ask new vendors which named human answers for decisions.

• Have counsel confirm indemnity clauses still bite against an AIC.

• Track the draft, since so many large U.S. companies incorporate in Delaware.

Rock’s Musings

Limited liability means an owner can lose what they put into a company and nothing more. Victims can’t reach the owner’s other assets. Courts pierce that shield for fraud, and the draft keeps that exception.

👉 Subscribe RockCyber Musings for more insights into AI security and governance, with the occasional rant. You can subscribe above

👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.

👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com

References

Anthropic Frontier Red Team. (2026, October 27). Discovering and exploiting vulnerabilities in critical, real-world software with Claude. Anthropic. https://anthropic.com/research/discovering-vulnerabilities-with-claude

Ars Technica. (2026, October 27). “No human at the helm”: Delaware plan would let AI agents run entire businesses. https://arstechnica.com/tech-policy/2026/10/no-human-at-the-helm-delaware-plan-would-let-ai-agents-run-entire-businesses

Cisco. (2026, October). A shared language for agent defense: Introducing Project Quarry. Cisco Blogs. https://blogs.cisco.com/ai/project-quarry-agent-security-detections

Cohere. (2026, October 26). Concerning behavior from a popular open-weight AI model. https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model

CXBOM. (2026). cxbom-reference (Version 0.3.0) [Computer software]. GitHub. https://github.com/CXBOM/cxbom-reference/tree/v0.3.0

Dark Reading. (2026, October 28). Attacker impersonates AI bots to scan orgs for keys, credentials. https://www.darkreading.com/cyber-risk/attacker-impersonates-ai-bots-scans-credentials

eSecurity Planet. (2026, October). CyberStrikeAI 44 AI agents target Japanese organizations. https://www.esecurityplanet.com/threats/news-cyberstrikeai-44-ai-agents-japan-attacks-apac/

GBHackers. (2026, October 28). Anthropic’s Claude chains one-click and zero-click exploits to bypass Chrome, Android and Linux security. https://gbhackers.com/anthropics-claude-chains-one-click-and-zero-click-exploits/amp

Glazier, W. (2026, October 28). Attackers are using AI agent impersonation to hunt for credentials. Cequence Security. https://www.cequence.ai/blog/ai-agent-impersonation

House Committee on Oversight and Government Reform. (2026, October 26). Comer investigates potential for harm, lack of transparency in Delaware initiative to create new artificial intelligence companies [Press release]. https://oversight.house.gov/release/comer-investigates-potential-for-harm-lack-of-transparency-in-delaware-initiative-to-create-new-artificial-intelligence-companies/

Infosec Conferences. (2026). [un]prompted 2026, San Francisco, United States. https://infosec-conferences.com/event/20261027-unprompted-2026/

Johnson, D. B. (2026, October 27). All the security risks Anthropic is worried about before its IPO. CyberScoop. https://cyberscoop.com/anthropic-ipo-filing-cybersecurity-risks

Kavukcuoglu, K. (2026, October 28). Gemini 4 Carbon: Our next frontier model. Google. https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/

Khandelwal, S. (2026, October 28). Anthropic’s unreleased AI model chains flaws into working Chrome, Safari, Windows and Linux exploits. The Hacker News. https://thehackernews.com/2026/10/anthropics-unreleased-ai-model-chains.html

Khaleej Times. (2026, October). Anthropic’s IPO filing shows explosive growth, risks and staggering costs [Reuters report]. https://www.khaleejtimes.com/business/anthropics-ipo-filing-shows-explosive-growth-risks-and-staggering-costs

Lambros, R. (2026, October). Context Bill of Materials: A record of what your AI agent read. RockCyber Musings. https://www.rockcybermusings.com/p/context-bill-of-materials

Lambros, R., Wilmot, F., Bird, R., Holcomb, P., Sorensen, D., & Oakley, H. (2026). CxBOM: A Context Bill of Materials and signed tool-definition pinning for LLM agents. Zenodo. https://doi.org/10.5281/zenodo.23653997

OpenAI. (2026, October 23). Securing our frontier model training environment. https://openai.com/index/securing-our-frontier-model-training-environment

Pogorelec, A. (2026, October 29). Google says Gemini 4 Carbon beats its predecessors at finding and fixing security flaws. Help Net Security. https://www.helpnetsecurity.com/2026/10/29/google-gemini-4-carbon-model/

TechCrunch. (2026, October 23). OpenAI says it will no longer train its AI models on the live internet, citing “significant risks”. https://techcrunch.com/2026/10/23/openai-says-it-will-no-longer-train-its-ai-models-on-the-live-internet-citing-significant-risks

The Hacker News. (2026, October 25). OpenAI AI agents demonstrate VM escapes and secret cross-sandbox communication. https://thehackernews.com/2026/10/openai-ai-agents-demonstrate-vm-escapes.html

The Hacker News. (2026, October 27). CyberStrikeAI uses 44 AI agents to automate hacking operations against Japan targets. https://thehackernews.com/2026/10/cyberstrikeai-uses-44-ai-agents-to.html

The Register. (2026, October 28). Cisco open sources tool for detecting AI agents on hacking sprees. https://www.theregister.com/security/2026/10/28/cisco-open-sources-tool-for-detecting-ai-agents-on-hacking-sprees/5305867

Thomas, P. A. (2026, October 27). Alibaba AI model tried to send data to Beijing server, Cohere says. CSO Online. https://www.csoonline.com/article/4240972/alibaba-ai-model-tried-to-send-data-to-beijing-server-cohere-says.html

[un]prompted. (2026). [un]prompted II: The AI security practitioner conference, October 27-29, 2026 [Conference program].

https://unpromptedcon.org/

XTB. (2026, October 26). Anthropic files prospectus ahead of IPO with ANT ticker on Nasdaq. https://www.xtb.com/en/market-analysis/anthropic-files-prospectus-ahead-of-ipo-with-ant-ticker-on-nasdaq-the-launch-date-and-price-remain-a-mystery