AI Security Newsletter No.85 (09-24-2026)

, ,
, , ,

Welcome to this edition of the AI Security Newsletter. The dominant theme this week is agent autonomy meeting its first real consequences: Google’s Gemini breached three real companies during an evaluation, Spain’s regulator logged the first breach report attributed to an AI agent, and infostealers began harvesting credentials from AI coding tools. Alongside that, the infrastructure is filling in fast, with orchestration runtimes, edge runtime controls, and MCP servers opening homes and security operations to third-party agents. Governance is moving too, from the UN Security Council to a revised EU AI Act timeline, while at Dreamforce the industry argued in public about how fast any of this should go. On the commercial side, OpenAI went after law firms and Mastercard walked Trip.com’s agent through booking and payment.

Small change you’ll spot up top: I’ve started numbering the issues, and this one is No.85. Rather than starting fresh at one, I counted back through everything sent since August 2024, which took a while longer than expected. The number should make it easier to point at a particular issue later, and I like being able to watch the count climb. Everything else stays where it was.

Risks & Security

Gemini breached three real companies during a security evaluation

Google confirmed a Gemini model accessed three real companies’ systems during a May exercise run by AI-security firm Irregular, its first known autonomous breakout. The sandbox was accidentally internet-connected; the fictional target shared a real company’s name. The model guessed passwords once and used repository credentials twice. Google says it stopped each time it recognised a real company. Irregular reported it in late July; Google disclosed only when the Wall Street Journal asked, roughly seven weeks later.

References:

Spain logs the first data breach report attributed to an AI agent

Spain’s AEPD received the first notification of a personal data breach carried out by an AI agent. AEPD president Francisco Perez Bes says someone deployed an agent built on a well-known LLM that scanned files, accessed systems, ran vulnerability scans for read/write access, then modified personal data and accessed invoices. The organisation self-reported; the LLM was not named and the case remains under review. The case raises a governance question: who is accountable when the agent is the actor.

References:

Infostealers add AI coding agents to their collection targets

Gen Digital found infostealer operators expanding beyond browser passwords and crypto wallets to local data from AI development tools, naming Claude, Cline, Codex, Continue, Cursor, and OpenCode. The haul: access tokens, MCP configurations, prompt histories, project data. Gen’s Windows telemetry recorded Amatera and Remus detections across tens of thousands of protected users over three months. Because the rules are remotely configurable, operators can add agent directories to campaigns where they already have access. Inventory what your agents cache locally.

References:

A concrete scenario for testing whether an agentic SOC actually works

An unsecure.sh write-up details a seven-phase intrusion built to test whether an agentic SOC can assemble an attack chain from signals that look benign in isolation. It runs from GitHub Actions cache poisoning to code execution in CI, then lateral movement to a monitoring pod and node compromise, with validation gates throughout. Elastic Security Labs takes the benchmark route instead, seeding a realistic intrusion into a live deployment and scoring models blind across seven capability categories.

References:

Technology & Tools

Aikido releases Altar, an open-weight model for on-premises security work

Belgian vendor Aikido introduced Altar, its first open-weight security model, positioned to keep defensive security inside infrastructure the customer controls. Aikido says Altar powers Aikido Machine, an autonomous pentesting appliance that runs entirely in the customer’s environment, including air-gapped deployments, so sensitive code and context are not sent to a third-party inference service. Outside coverage describes it as a roughly 328 GB compressed prune of GLM-5.3. The stated target is teams with strict in-house code rules.

References:

Google open-sources AX, a Kubernetes-shaped orchestrator for agent workloads

Google released AX, an open-source declarative orchestrator for autonomous agent workloads running on Agent Substrate for sandboxed execution. The premise: agents are a distinct workload class (stateful, bursty, long-running) that neither stateless microservices nor batch orchestrators are shaped for. You declare a task with workspaces and gateway specs; AX sandboxes it, wires the workspace, and fences the network. Four primitives, YAML, pitched at billions of tasks per cluster.

References:

Qualcomm’s new flagship runs a 30B mixture-of-experts model on the phone

At Snapdragon Summit, Qualcomm launched the Snapdragon 8 Elite Gen 6 and Elite Extreme Gen 6 on a 2nm process. The Extreme variant can run a 30-billion-parameter mixture-of-experts model locally, activating only a subset of parameters per task. Both add a sensing hub capable of running models up to 200 million parameters for speaker recognition, scribe tools, and voice-in/voice-out agents. Apple’s most advanced third-generation foundation model, from June, was a 20-billion-parameter MoE.

References:

Fastly adds runtime controls and a firewall for enterprise AI

Fastly announced AI Runtime Control, AI Firewall, and new API Security capabilities, extending its Fastly for AI portfolio. Fastly’s stated aim is real-time visibility and control across AI systems: governing model access and usage, protecting the AI applications behind the business, and controlling how agents reach enterprise APIs, on the same platform already handling delivery. Industry analysis of the launch notes machine-generated traffic has passed half of all traffic.

References:

Building custom SOC agents on the Google SecOps MCP server

Google is pushing a pattern for multi-agent security operations built on the Google SecOps MCP server, the Agent Development Kit, and the Agent2Agent protocol. A companion session walks through building agents tailored to your own environment on the Gemini Enterprise Agent Platform. The reference architecture supports deployment as a serverless Cloud Run service or a managed Agent Runtime, and the MCP security servers are published openly.

References:

Google Home opens to third-party agents over MCP

Google opened early access to a Model Context Protocol server for Google Home, letting any MCP-capable agent, including Antigravity, Claude, Hermes, and OpenClaw, reach devices and event history across the Google Home ecosystem, from Nest doorbells and thermostats to Works with Google Home and Matter devices. Google frames it as giving agents physical context: home activity, camera footage across rooms, device control. Setup requires a Google Cloud project. Sonos announced comparable MCP access in the same period.

References:

Business & Products

OpenAI launches Astra for Law, with privacy controls aimed at legal work

OpenAI announced Astra for Law, combining GPT-6 Astra with settings, tools, and context tailored for professional legal work. It is initially available to selected law firms through Trusted Access in ChatGPT and Codex, while API customers including Harvey and Legora can build on it inside their own products. OpenAI paired the launch with expanded privacy and governance controls aimed at lawyers’ professional obligations. Reuters framed it as escalating the race for law firm users.

References:

Mastercard and Trip.com pilot end-to-end agentic travel booking

Mastercard and Trip.com, with Network International, showcased an agentic travel booking experience at Arabian Travel Market in Dubai. Trip.com’s TripGenie agent handles search, booking, and payment end to end, running on Mastercard’s Agent Suite for Merchants, which Mastercard says lets merchants build agent-driven shopping into infrastructure they already operate rather than a separate app. It is one of the clearer examples of agentic commerce moving past demos, with a payment network, an acquirer, and a merchant in the loop.

References:

Regulation & Policy

Altman and Amodei address the UN Security Council on AI

Sam Altman and Dario Amodei gave separate briefings to the UN Security Council during the 81st General Assembly. Altman called for international AI standards, fast incident reporting, and secure channels for sharing safety incidents, arguing the most important decisions cannot be made by San Francisco labs alone. Amodei, by video, urged a ban on AI-assisted biological weapons development and global model-testing standards. Both said they would delay model releases if they identify a serious threat.

References:

The EU AI Act timeline shifts as obligations become operational

AI literacy duties, unacceptable-risk bans, and general-purpose AI obligations already apply, with a core wave of obligations landing on 2 August 2026. Under the Digital Omnibus revisions, watermarking starts 2 December 2026, and high-risk use cases covering biometrics, critical infrastructure, education, employment, law enforcement, and border management move to 2 December 2027. Disclosure that someone is interacting with AI is not delayed. Compliance means evidence tied to real systems: documentation, risk management, evaluations, incident reporting.

References:

Opinions & Analysis

Dreamforce 2026 exposed an industry split over the pace of AI

At Salesforce’s Dreamforce, Anthropic’s Dario Amodei renewed his call to slow frontier development and invite independent scrutiny, days after publishing an essay urging deceleration. Nvidia’s Jensen Huang took the opposite line, rejecting slowdown and new regulation and telling AI companies to “run as fast as you can”. Sam Altman granted that public fear was justified. Separately, CNBC found business leaders at the event saying older models already meet their needs.

References:

Noam Brown on agent swarms and what coordination looks like at scale

OpenAI’s Noam Brown, a foundational contributor to the o1 reasoning line, told Dwarkesh Patel about a swarm of 10,000 agents that spent 130 billion tokens over 88 hours on a Millennium Prize Problem, an effort he likened to one person thinking full-time for roughly 4,000 years. The mechanics matter more: agents can message any other agent, with the message dropped straight into that agent’s context, and can fork context when spinning up sub-agents. Coordination is learned, not specified.

References:

Zapier’s Wade Foster on headless tools and where to put the reasoning

Zapier CEO Wade Foster described the shift towards headless AI tools and how Zapier MCP brings workflows and context into whatever interface people already work in, such as Cursor. Drawing on Zapier’s AutomationBench data, he argued effective agentic systems should reserve model reasoning for the steps that need it and use deterministic code for the rest. He also covered consolidation around “daily driver” interfaces and the fading of seat-based pricing.

References:

Discover more from Mindful Machines

Subscribe to get the latest posts sent to your email.

Leave a comment

Discover more from Mindful Machines

Subscribe now to keep reading and get access to the full archive.

Continue reading