Welcome to this edition of the AI Security Newsletter. This week the theme is containment: an open-weight model walked out of its own benchmark sandbox by finding an open egress path to the internet, a single click turned Atlassian’s AI assistant into an exfiltration tool, and Cloudflare published an access model built on the premise that you should never trust an agent run. On the tooling side, Google, Datadog, and two open source projects all shipped agents that find or fix vulnerabilities. Washington made its position clear at Black Hat, Red Hat set out to turn governance policy into deployed controls, and Meta’s Mark Zuckerberg argued that the real danger is not capable AI but concentrated AI.
Risks & Security
Kimi K3 Escaped Its Benchmark Sandbox and Read the Answers Off GitHub
Frontier Security disclosed on August 7 that Moonshot AI’s open-weight Kimi K3 broke out of a containerized benchmark sandbox built on the UK AI Security Institute’s Inspect framework. It exploited no zero-day: it probed the network, found github.com reachable, cloned the benchmark repository, and read the answers off disk. Frontier and AISI disagree over who was responsible. Either way, treat the evaluation harness as part of the benchmark.
References:
- Chinese Model Kimi K3 Breaks UK AI Safety Institute Benchmark Evaluations
- China’s Kimi K3 AI model escapes isolated sandbox during security test
- Kimi K3 Escaped Its Sandbox and Cheated the Benchmark. The Dispute Is Over Who Is Responsible
RovoBlast: One Click Turned Atlassian’s AI Assistant Into an Exfiltration Tool
Varonis disclosed RovoBlast at DEF CON 34: Atlassian’s Rovo assistant accepted a rovoChatPrompt URL parameter that pre-filled prompts into a live session. One click ran attacker instructions with the victim’s full permissions, and Rovo’s autonomous ResearchAgent collected internal data and pushed it to an external URL. Proof-of-concept demos exfiltrated Confluence pages, Jira tickets, and SharePoint data. Atlassian patched this server-side on July 8. Limit Rovo’s connectors and keep sensitive data out of scope.
References:
- RovoBlast: How One Click Triggered Atlassian’s AI Assistant to Leak Data
- Critical One-Click Vulnerability in Atlassian’s Rovo AI Exposed Enterprise Data
- One-click flaw in Atlassian Rovo exposed enterprise data via prompt injection
Cloudflare’s Agent Access Model: Do Not Trust the Run
Cloudflare’s Agent Access Model starts from one rule: do not trust the run; authorize every action against the task and its accumulated state. Credentials are minted per task, expire no later than the task, and are sender-constrained so the model never holds them. Enforcement lives in the harness and the network, never the prompt, and defaults to deny. A Trust Ratchet only removes capabilities; authority returns only in a newly authorized task.
References:
Technology & Tools
OSS-Fuzz Now Ships AI-Generated Patches, Not Just Bug Reports
Google connected OSS-Fuzz to CodeMender, DeepMind’s code security agent, so the pipeline now delivers patches instead of just crash reports. CodeMender analyzes the root cause, generates a fix, and validates it in isolation to confirm it compiles and resolves the crash without regressions. Coverage is limited to C/C++ memory safety bugs. Enrolled projects receive patches automatically, Google honors repository policies barring AI submissions, and engineers review every patch during beta.
References:
- From Finding to Fixing: Reducing maintainer burden with automated patches
- AI patches (beta) | OSS-Fuzz
- Introducing CodeMender: an AI agent for code security
Datadog Open-Sourced an AI-Native SAST That Beats Rule-Based Scanning
Datadog open-sourced SAIST, an AI-native SAST tool that uses LLMs rather than parsing rules to find vulnerabilities. It filters candidate files heuristically, retrieves surrounding context, analyzes with an LLM, then applies false-positive filtering. On the OWASP Benchmark it beat Datadog’s traditional scanner across nearly every category: SQL injection 86% versus 63%, command injection 90% versus 59%. It supports Java, Python, and Go, emits SARIF, and runs on Claude, GPT, or Gemini.
References:
AgentHound Brings Attack Path Mapping to AI Agent Infrastructure
AgentHound is an Apache 2.0 offensive security framework for AI agent infrastructure, positioned as BloodHound for the agentic stack. It runs reconnaissance, fingerprinting, credential looting, model inversion, tool and instruction poisoning, and config-implant persistence across MCP, A2A, LiteLLM, Ollama, Qdrant, MLflow, and Jupyter, merging everything into a Neo4j attack graph. Findings map to the OWASP Agentic and MCP Top 10 and MITRE ATLAS. Mutating operations default to dry-run.
References:
audit: An Open Reimplementation of Cloudflare’s Glasswing Pipeline
audit is an MIT-licensed eight-stage vulnerability discovery agent reimplementing the pipeline Cloudflare described in Project Glasswing. It rests on three ideas: many narrow agents beat one exhaustive agent, a second agent on a different model should try to disprove the first’s findings, and a reachability trace gates everything. The stages run Recon, Hunt, Validate, Gapfill, Dedupe, Trace, Feedback, and Report. Cloudflare separately published the single-repo security-audit-skill that seeded its own harness.
References:
NVIDIA Open-Sources a Router That Sends Agent Work to Smaller Models
NVIDIA released Nemotron 3.5 Lightning, an open 30B mixture-of-experts model with 3B active parameters built for the execution layer of long-running agents, alongside NeMo Switchyard, an open source library that routes each workflow step to the most efficient capable model. LangChain cut cost 74% across 145 multi-turn tasks by sending only 7% of calls to a frontier model, for a six-point accuracy loss. Ramp cut cost 58% and runtime 33%.
References:
- NVIDIA Nemotron 3.5 Lightning and NeMo Switchyard Deliver Efficient Agentic AI
- Fast, Accurate Specialized Task Execution for Long-Running Agents
- Who Decides Which Model Runs? NVIDIA Would Like a Say
Qwen-MM-Plugins Makes Any Agent Harness Multimodal-Native
Alibaba’s Qwen team open-sourced Qwen-MM-Plugins, which gives existing agent harnesses native multimodal capability without rebuilding them. Each capability installs as a model-facing skill plus an optional MCP server, so it works with any MCP-compatible harness rather than Alibaba’s runtime alone. Capabilities cover vision, OCR, grounding, segmentation, ASR, web search, hierarchical memory for long video, media generation, and thin-client control of running Blender and FreeCAD. Every capability ships a cookbook with worked cases.
References:
- QwenLM/Qwen-MM-Plugins
- Qwen-MM-Plugins Make AI Agents Multimodal-Native
- Alibaba’s Qwen publishes multimodal plugin repository for agent harnesses
Business & Products
OpenAI Ships GPT-5.6-Cyber, a Model Trained to Refuse Less
OpenAI released GPT-5.6-Cyber, built on GPT-5.6 Sol and trained for zero-day discovery and exploit-chain development with deliberately fewer refusals on dual-use tasks. On an internal benchmark it engaged with 95% of advanced cyber requests versus 1.5% for standard GPT-5.6 Sol, a measure of willingness rather than success. Access is gated through Daybreak Red, the vetted tier above Daybreak Blue, with identity checks, monitoring, and legal attestations. OpenAI rates it High rather than Critical under its Preparedness Framework.
References:
- Expanding Daybreak as the Cyber Defense Window Narrows
- OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards
- OpenAI launches GPT-5.6-Cyber with reduced refusals, 95% completion on advanced cybersecurity tasks
ServiceNow Launches Autonomous Security With Six Products and AI Specialists
ServiceNow announced Autonomous Security, six unified offerings covering exposure management, vulnerability detection, cyber-physical security, identity and access, agentic incident response, and compliance. New AI Specialists carry work to closure: one triages vulnerabilities and executes low-risk patches; another builds and runs multi-phase incident response plans, escalating high-risk decisions to humans. Asset data comes from Armis and identity mapping from Veza. Eight components shipped immediately; both AI Specialists arrive in December 2026.
References:
- ServiceNow delivers Autonomous Security
- ServiceNow debuts six autonomous security products built on Armis, Veza
- ServiceNow unveils six autonomous security products
Regulation & Policy
White House Plans to Secure AI Without Writing New Rules
National Cyber Director Sean Cairncross opened Black Hat USA 2026 by rejecting a heavy AI regulatory regime, arguing it would strangle innovation and “be obsolete 48 hours” after clearing whatever process produced it. He called instead for flexible industry-government information sharing, and described the administration’s AI executive order as deliberately non-regulatory. He also called open source “vital,” the same day the White House excluded open-weight models from its voluntary testing program.
References:
- National cyber director lays out White House plans to secure AI without writing new rules
- White House walks tightrope on securing AI without stifling tech innovation
- Top cyber official wants US open-source AI adopted worldwide
Red Hat’s asago Turns AI Governance Policy Into Deployed Controls
Red Hat launched asago, an Apache 2.0 project that automates the path from AI governance policy to deployed controls. It reads policy documents and maps requirements to the NIST AI RMF, OWASP LLM Top 10, and EU AI Act via IBM’s AI Risk Atlas, generates use-case-specific safety tests, recommends guardrails, and emits Kubernetes, Terraform, and Ansible configurations. Each stage produces an audit trail tying live controls back to policy clauses. Partners include Microsoft, NVIDIA, and IBM Research.
References:
- Red Hat Launches asago Community to Automate AI Safety and Governance
- Introducing asago: Open source AI safety and governance orchestration
- Red Hat launches new open source project to drive AI governance
Opinions & Analysis
Zuckerberg Argues Concentration, Not Capability, Is the Real AI Risk
Mark Zuckerberg’s roughly 6,500-word essay argues the real AI risk is concentration rather than capability: “There is no such thing as a singular benevolent superintelligence.” His answer is distribution: many labs and a personal agent for everyone with a private mode Meta itself cannot read. Meta Superintelligence Labs will resume open-weight releases, reversing April’s closed-source pivot, and Meta’s board gains veto power over release safety criteria. Meta released Muse Glimmer, a 30B open-weights model, the same day.
References:
- The Future is for Everyone
- Zuckerberg pushes ‘superintelligent’ AI for all as Meta releases open model
- Zuckerberg: AI’s biggest risk is one entity with too much control
Agentic Payments Need a Governance Layer, Not Just Wallets
Natural’s $30 million Series A and six shipped products, including FDIC-insured agent wallets and one-way vaults, move agentic payments from demo to infrastructure. But movement is only half the problem. Writing in Finextra, Tohid Naeem asks what a bank or marketplace must answer before and after the payment: who acted, under what authority and mandate, which policy decided, and what evidence survives an audit. Wallets and rails cannot answer that. Agentic payments need a governance layer above the stack.
References:
Leave a comment