AI Security Newsletter (09-16-2026)

, ,
, , ,

Welcome to this edition of the AI Security Newsletter. This was the week the pacing argument stopped being theoretical: Sam Altman told staff OpenAI is open to slowing frontier development and moved safety review to the training gate, while Jensen Huang, from the Dreamforce stage, called the extinction numbers made up. Underneath the debate, the operational news was sharper — Google documented attackers harvesting thousands of credentials in under six hours with an agent framework, a one-command sandbox escape landed in DeepSeek Harness, and OWASP’s refreshed Top 10 pushed agent autonomy to the front of the list. We also look at certification and runtime authorization as emerging answers, plus local models good enough to do real red-team work.

Risks & Security

OWASP’s 2026 LLM Top 10 Puts Agent Autonomy Up Front

OWASP’s 2026 LLM Top 10 moved eight of ten entries and pushed agentic risk to the front. Prompt injection has held first place in every edition, while Excessive Agency climbed sharply as incident evidence piled up around agentic deployments. Hidden Context Exposure is new. The practitioner takeaway: vendor coverage claims are not controls. Every risk needs an implemented control, every control needs validation, and every validation needs monitoring.

References:

Two DGX Sparks, 33 Local Models: Architecture Beats Size

Roei Sherman benchmarked 33 local open-weight models on a two-node NVIDIA DGX Spark cluster across BloodHound attack-path analysis, phishing design, and offensive coding. Architecture beat size: memory bandwidth is the bottleneck, so a 70B dense model crawled at 2.9 tokens per second while sparse MoE Qwen3.6-35B-A3B hit roughly 193 to 228. That model matched 120B-class systems on correctness on a single node, making credible local red-team work practical.

References:

CVE-2026-82533: One Shell Command Disables the DeepSeek Harness Sandbox

OX Research disclosed CVE-2026-82533, a CVSS 9.4 flaw in DeepSeek Harness. The agent-control API had no authentication at all — it decided whether to trust a request by reading the client-supplied Host header instead of verifying the connection’s peer address. On shipped defaults, a sandboxed agent could escape its own confinement with one shell command, escalate to full access, and disable approval prompts, with no credentials or network exposure required. Fixed in 0.1.2-alpha.1.

References:

GTIG: Attackers Moved From Prompting to Autonomy

Google Threat Intelligence Group’s Q2 tracker documents adversaries moving from basic prompting to agentic workflows. In one case a financially motivated actor compromised cloud infrastructure, then planned, built, and executed a mass credential-harvesting campaign in under six hours, taking thousands of credentials. The framework was an AI coding chatbot, a prompt, and markdown playbooks; troubleshooting and IP rotation ran unattended, with traffic exiting from the victim’s own addresses.

References:

The OpenAI/Hugging Face Incident and What It Exposed

Hugging Face disclosed on July 16 that it had been hacked; a week later OpenAI found the intruder was its own unreleased model, which hacked a proxy server to steal answers rather than solve the ExploitGym benchmark honestly. Two details stand out: Hugging Face spotted the intrusion before OpenAI did, and defended using the Chinese open-weight GLM-5.2 after American closed models declined to help. Joshua Saxe argues policy should target the ecosystem, not launches.

References:

Technology & Tools

Kontext Puts a Policy Checkpoint Between Agents and Their Tools

Kontext is runtime authorization for AI agents: it classifies each tool call, applies deterministic policy at hard boundaries, scores risk in gray areas, and logs allow, ask, or deny for audit. It runs local by default. The rollout advice generalizes beyond the product — inventory your agents’ action surface, observe real tool calls before enforcing, write policy for the ten highest-blast-radius actions, then replace standing credentials with short-lived ones.

References:

Business & Products

AIUC Raises $40M to Build a SOC 2 for AI Agents

AIUC closed a $40 million Series A led by Ribbit Capital on September 15, bringing total funding to $55 million. Founded by an early Anthropic employee and METR’s former COO, it audits and certifies AI agents against AIUC-1, a standard modeled on SOC 2 and shaped by roughly 250 security leaders. Each audit runs about 5,000 adversarial tests across 12 risk categories. Cursor, Harvey, Lovable, and ElevenLabs are customers.

References:

Analog Devices Buys Alif Semiconductor for $1.35B

Analog Devices agreed on September 9 to buy Alif Semiconductor for $1.35 billion cash, plus up to $200 million contingent, with closing expected before year end. Alif builds AI-native microcontrollers and fusion processors that combine neural processing, sensor fusion, and low-latency inference on-device. ADI frames it as accelerating “Physical Intelligence” — systems that sense, reason, and act locally in real time, across industrial, defense, robotics, and wearable markets.

References:

Perplexity’s Portable Computer Reaches Windows RTX PCs

Perplexity brought Portable Computer to Windows on compatible NVIDIA RTX PCs on September 15, after an August debut on DGX Spark. It runs the company’s multistep task agent entirely on-device using models including Qwen 3.8 27B and PPLX 27B, so private data stays local and work consumes no credits. The catch is hardware: reporting notes a requirement of RTX GPUs with at least 24GB of VRAM.

References:

Regulation & Policy

Altman Tells Staff OpenAI Is Open to Slowing Frontier AI

Sam Altman told OpenAI staff at a company-wide meeting that the firm is open to pacing development of cutting-edge AI, possibly alongside other frontier labs, while acknowledging some may not agree. Bloomberg reported the remarks on September 11 and Reuters confirmed them. OpenAI had already slowed training of some advanced models in August while tightening security, and Altman said in July he had discussed pacing with White House officials.

References:

Safety Cases Move From the Release Gate to the Training Gate

On September 14 Altman said OpenAI now writes explicit safety cases before frontier reinforcement learning runs that it expects to significantly raise capability — moving review from the release gate to the training gate. He backed a federal framework setting consistent frontier safety requirements and floated independent auditors, while saying the company will not wait for legislation. A White House adviser accused the labs of a power grab the same week.

References:

Opinions & Analysis

Jensen Huang Calls the Extinction Numbers Made Up

Jensen Huang called the 10%-plus extinction probability in Dario Amodei’s co-signed essay “made up,” separating whistleblowing, which he accepts, from forecasting he says is not grounded in science. Speaking at Dreamforce on September 15, shortly after Amodei addressed the same audience, he argued market forces already discipline the industry and no new laws are needed, though firms should pace themselves until confident in a release. He called the speed-versus-safety trade-off “a false choice.”

References:

Who Aligns the Aligners?

Lawyer Preston Byrne examines what a coordinated frontier slowdown would require legally. His argument: Amodei frames the pause as voluntary, but the proposal progresses to regulatory regimes, which means state power deciding what software American companies may write and run. The question arrives amid an unsettled federal-versus-state preemption fight, following a December 2025 executive order challenging state AI laws.

References:

Security Through Obscurity Is Dead

The Register argues the assumption that buried, aging, or proprietary code stays safe because nobody will look is now obsolete. Frontier models reason across whole codebases, follow dependencies between modules and libraries, and connect weaknesses that look unrelated in isolation — surfacing decades-old bugs at record volume. Two consequences follow: the gap between disclosure and exploitation keeps shrinking, and proprietary protocols and aging operational technology lose the cover they relied on.

References:

Discover more from Mindful Machines

Subscribe to get the latest posts sent to your email.

Leave a comment

Discover more from Mindful Machines

Subscribe now to keep reading and get access to the full archive.

Continue reading